joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d2377
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
call fcn.00461427
push dword [edi + 4]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
mov dword [edi + 0x30], eax
mov eax, dword [edi + 0x40]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x44]
mov dword [edi + 0x34], edx
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edx, dword [edi]
mov esi, eax
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
push esi
call dword [edx + 0x24]
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp byte [edi + 0x108], 0
je 0x5d2410
push 0x50
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x5d23ea
mov esi, dword [edi + 4]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
jne 0x5d23ea
xor byte [edi + 0x126], 1
lea ecx, [edi + 0x110]
call fcn.005d153d
mov eax, dword [edi + 0x128]
cmp eax, dword [edi + 0x10c]
je 0x5d2410
mov ecx, edi
mov dword [edi + 0x10c], eax
call fcn.005d1b26
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5d31dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
mov byte [ebp - 4], 0
je 0x5d3207
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5d3203
mov byte [ebp - 4], 1
test al, 0x10
jne 0x5d3207
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov ecx, esi
push 0x51d
call fcn.00584b86
push dword [ebp - 4]
mov ecx, esi
push 0x51e
call fcn.00584b86
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x5d3b78
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x66d0c2
call fcn.006313fc
push ecx
push esi
push 0xe0
call fcn.00630af1
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x5d3bab
push dword [ebp + 0xc]
mov ecx, eax
push dword [ebp + 8]
call fcn.005d38d6
mov esi, eax
jmp 0x5d3bad
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
push 0
push 0xfd
call fcn.00584b39
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x5d412c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10b8
call section..text
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
cmp dword [eax + 8], 0xfffffffe
je 0x5d414f
cmp dword [eax + 8], 0xfffffffc
jne 0x5d419e
add eax, 0xc
push 0x10b8
push eax
lea eax, [ebp - 0x10b8]
push eax
call fcn.00631810
add esp, 0xc
push 0x5d4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esi + 0xc]
cmp dword [ecx], eax
jne 0x5d419e
cmp dword [ebp - 0x10b4], 0
jne 0x5d419e
push 5
xor ecx, ecx
lea eax, [ebp - 0x1048]
push ecx
push ecx
push eax
push 0x689f9c
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x5d6ba9
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x210
push ebp
push edi
push dword [esp + 0x21c]
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
lea eax, [esp + 8]
push eax
push dword [esp + 0x220]
push edi
call fcn.00582fbd
mov ecx, dword [esp + 0x220]
test ecx, ecx
jne 0x5d6bf8
push 0xfe
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x224]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x14]
xor ebp, ebp
sub eax, dword [esp + 0xc]
push ebp
push dword [0x791130]
push ebp
push edi
push eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
push eax
push dword [esp + 0x24]
mov eax, dword [esp + 0x244]
push dword [esp + 0x24]
or eax, 0x50010000
push eax
push ecx
push 0x68cb38
push ebp
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
mov eax, dword [esp + 0x224]
test eax, eax
jne 0x5d6c55
push ebp
push ebp
push 0x31
push dword [esp + 0x228]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push eax
push 0x30
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, edi
pop edi
pop ebp
add esp, 0x210
ret 0x10
Function at 0x5d7770
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x66d0c2
call fcn.006313fc
mov eax, dword [0x793358]
sub esp, 0x1c
test eax, eax
je 0x5d7794
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x5d783b
cmp byte [0x793318], 0
jne 0x5d77b3
push 0x6e00ec
push 0x7936bc
call fcn.00466fdc
mov byte [0x793318], 1
push 0x2ac
call fcn.00630af1
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x5d77d2
mov ecx, eax
call fcn.005d6509
jmp 0x5d77d4
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov ecx, eax
push 0
push 0xf8
mov dword [0x793358], eax
call fcn.00584b39
call fcn.00490a5f
push eax
push 0x6da
call fcn.00582370
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0047224d
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x5d7810
mov eax, dword [eax]
push eax
mov eax, dword [0x793358]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0042341c
mov eax, dword [0x793358]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x5d802f
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [eax], ecx
je 0x5d804d
push 5
push ecx
push ecx
add eax, 0x7c
push eax
push 0x689f9c
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret 4
Function at 0x5d9731
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [ecx + 0x30]
lea eax, [edx + 1]
cmp eax, 2
je fcn.005d7a1d
test edx, edx
jne 0x5d9745
inc edx
push 0
push 3
push edx
mov dword [ecx + 0x30], edx
call fcn.005d976a
ret 4

Function at 0x5dac43
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x67f75e
call fcn.006313fc
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004249e7
push dword [ebp + 0xc]
xor edi, edi
lea ecx, [esi + 0x18]
mov dword [ebp - 4], edi
call fcn.004249e7
push dword [ebp + 0x10]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.004249e7
push 7
pop ecx
xor eax, eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x58], edi
mov word [esi + 0x48], ax
mov dword [esi + 0x74], ecx
mov dword [esi + 0x70], edi
mov word [esi + 0x60], ax
mov dword [esi + 0x8c], ecx
mov dword [esi + 0x88], edi
mov word [esi + 0x78], ax
mov dword [esi + 0xa4], ecx
mov dword [esi + 0xa0], edi
mov word [esi + 0x90], ax
mov dword [esi + 0xbc], ecx
mov dword [esi + 0xb8], edi
mov word [esi + 0xa8], ax
mov dword [esi + 0xd4], ecx
mov dword [esi + 0xd0], edi
mov word [esi + 0xc0], ax
mov dword [esi + 0xec], ecx
mov dword [esi + 0xe8], edi
mov word [esi + 0xd8], ax
mov dword [esi + 0x104], ecx
mov dword [esi + 0x100], edi
mov word [esi + 0xf0], ax
push edi
push edi
mov ecx, esi
mov byte [ebp - 4], 0xa
mov dword [esi + 0x114], edi
call fcn.00665b7a
push edi
mov ecx, esi
call fcn.00665b4c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5dba24
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
push ebx
push ebx
or dword [esi], 0xffffffff
push 3
push ebx
push 3
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5dba51
xor eax, eax
jmp 0x5dba85
push ebx
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
push 0xc
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x2d1080
push edi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x5dba76
mov eax, dword [ebp - 8]
mov dword [esi], eax
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
cmp dword [esi], 0xffffffff
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5dd4d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 8]
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x5dd4fb
xor al, al
jmp 0x5dd606
push edi
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
test edi, edi
je 0x5dd525
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x5dd52c
xor al, al
jmp 0x5dd605
push ebp
push edi
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [esi + 0x10], eax
test eax, eax
je 0x5dd602
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
xor ebp, ebp
test eax, eax
je 0x5dd5f6
push edi
push ebx
push eax
call fcn.00631810
add esp, 0xc
mov dword [esp + 0x1c], ebp
lea eax, [esp + 0x1c]
push eax
push ebp
push dword [esi + 0x10]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x5dd5ed
mov ebx, dword [esp + 0x1c]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov edi, eax
test edi, edi
je 0x5dd5a6
lea eax, [esp + 0x18]
mov dword [edi], 0x6d7d78
push eax
push ebx
mov dword [esp + 0x20], ebp
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [edi + 8], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 4], eax
jmp 0x5dd5a8
mov edi, ebp
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], edi
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x5dd5ed
mov eax, dword [ecx + 8]
mov dword [ecx + 8], ebp
mov ecx, dword [esi + 4]
test eax, eax
jne 0x5dd5e0
call fcn.005ad452
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
call fcn.005ac7c1
mov dword [esi + 0xc], eax
mov al, 1
jmp 0x5dd604
test ecx, ecx
je 0x5dd5ea
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], ebp
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov dword [esi + 0x10], ebp
xor al, al
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x5dd802
Capabilities:
Delete file

Disassembly:
mov eax, 0x66d28b
call fcn.006313fc
sub esp, 0x18
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 0x78], edi
cmp dword [ebp + 8], edi
je 0x5dd867
push dword [ebp + 8]
lea ecx, [ebp - 0x24]
call fcn.004249e7
lea eax, [ebp - 0x24]
mov dword [ebp - 4], edi
push eax
mov ecx, esi
call fcn.005b2d7f
push edi
push 1
lea ecx, [ebp - 0x24]
call fcn.0042341c
cmp dword [esi + 0xc4], edi
je 0x5dd85e
lea eax, [esi + 0xb4]
cmp dword [eax + 0x14], 8
jb 0x5dd857
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push esi
push edi
push 0x801e
jmp 0x5dd86e
push esi
push edi
push 0x8023
push dword [0x792820]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5e6f33
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x258
push esi
push 0
push 2
mov dword [esp + 0x38], 0x22c
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x5e7022
lea eax, [esp + 0x30]
push eax
push esi
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
jne 0x5e6f71
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x5e7022
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
mov edi, dword [esp + 0x270]
lea ebx, [edi + 0x20c]
lea eax, [esp + 0x60]
push eax
call fcn.005e6efd
test eax, eax
jne 0x5e7000
push dword [esp + 0x44]
push eax
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x5e6fb1
push eax
jmp 0x5e6ffe
push 0x104
lea eax, [esp + 0x64]
push eax
push edi
call fcn.004243e1
mov eax, 0x20c
add edi, eax
add ebx, eax
push 0x28
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call sub.PSAPI.DLL_GetProcessMemoryInfo
test eax, eax
je 0x5e6fea
mov eax, dword [esp + 0x20]
mov dword [edi + 0x208], eax
jmp 0x5e6ff1
and dword [edi + 0x208], 0
push dword [esp + 0x10]
mov eax, 0x20c
add edi, eax
add ebx, eax
call ebp
cmp ebx, dword [esp + 0x26c]
jae 0x5e701c
lea eax, [esp + 0x3c]
push eax
push esi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x5e6f87
push esi
call ebp
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x258
ret 8
Function at 0x5e9a22
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x66d0c2
call fcn.006313fc
push ecx
push esi
push 0x64
call fcn.00630af1
pop ecx
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 4], esi
test eax, eax
je 0x5e9a51
push dword [ebp + 0xc]
mov ecx, eax
push dword [ebp + 8]
call fcn.005e9409
mov esi, eax
mov eax, dword [esi + 0x30]
mov ecx, esi
or dword [ebp - 4], 0xffffffff
push dword [eax + 4]
push 0xf
call fcn.0058422a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x5f0f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x68095c
call fcn.006313fc
sub esp, 0x38
push ebx
push ebp
push esi
push edi
push dword [esp + 0x70]
mov ebp, ecx
call fcn.005efcff
mov ebx, eax
test ebx, ebx
je 0x5f112b
push dword [esp + 0x70]
mov ecx, ebp
call fcn.005efcc8
cmp byte [ebx + 0xd0], 0
mov eax, dword [ebx + 0xd4]
mov dword [esp + 0x10], eax
sete byte [esp + 0x70]
mov eax, dword [esp + 0x74]
test eax, eax
je 0x5f0f55
mov eax, dword [eax]
mov dword [esp + 0x10], eax
and dword [esp + 0x28], 0
xor eax, eax
mov dword [esp + 0x2c], 7
mov word [esp + 0x18], ax
and dword [esp + 0x50], eax
mov byte [esp + 0x74], 1
call fcn.00475044
lea eax, [esp + 0x5c]
mov byte [esp + 0x50], 1
push eax
call fcn.0048922a
mov esi, eax
test esi, esi
je 0x5f1114
cmp byte [esp + 0x70], 0
jne 0x5f0fb0
mov eax, dword [esi + 0xd8]
push 0
push ebx
add eax, 0x28
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0045daae
jmp 0x5f1016
call fcn.005866b0
push 0
push 0
test al, al
je 0x5f1103
push 0x1cf
push 0x6f6080
lea eax, [esp + 0x6c]
push eax
call fcn.0047abfb
cmp dword [ebx + 0x14], 8
mov ecx, dword [esi + 0xcc]
jb 0x5f0fe5
mov esi, dword [ebx]
jmp 0x5f0fe7
mov esi, ebx
lea eax, [esp + 0x5c]
push eax
push eax
mov eax, dword [ecx]
push dword [ebx + 0x54]
call dword [eax + 0x2c]
push eax
movzx eax, word [0x73f90c]
push esi
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x4c]
push str.http:__pairing:_H_127.0.0.1:_d_proxy__s_sid_xfile_dtoken_Hpairing_HserviceSTREAMING
push eax
call fcn.0047224d
add esp, 0x24
push eax
lea ecx, [esp + 0x1c]
call fcn.0044dbe6
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.0042341c
mov byte [esp + 0x50], 0
call fcn.00475085
push 0x14
call fcn.00630af1
mov dword [esp + 0x74], eax
pop ecx
test eax, eax
je 0x5f1054
push 5
pop ecx
lea esi, [esp + 0x5c]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x5f1059
and dword [esp + 0x70], 0
push 0x80
call fcn.00630af1
pop ecx
mov dword [esp + 0x74], eax
mov byte [esp + 0x50], 2
test eax, eax
je 0x5f10c1
sub esp, 0x18
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
push ecx
call fcn.005efb2a
push dword [ebp + 0x68]
lea esi, [esp + 0x78]
mov byte [esp + 0x6c], 3
sub esp, 0x14
lea eax, [esp + 0x48]
push 5
pop ecx
mov edi, esp
sub esp, 0x18
rep movsd dword es:[edi], dword [esi]
mov ecx, esp
push eax
call fcn.00422efb
mov ecx, dword [esp + 0xbc]
push ebx
mov byte [esp + 0x9c], 2
call fcn.0060eb6a
jmp 0x5f10c3
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push eax
push 0
push 0x806b
push dword [ebp + 0xb8]
call esi
push dword [esp + 0x70]
mov eax, dword [ebp + 0x48]
push 0
push 0x80c7
push dword [eax + 4]
call esi
mov eax, dword [ebx + 0x54]
lea esi, [ebp + 0x31]
lea edi, [ebp + 0x79]
mov dword [ebp + 0x74], eax
cmp edi, esi
je 0x5f111e
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x5f111e
push 0x806b
push dword [ebp + 0xb8]
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [esp + 0x50], 0
call fcn.00475085
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.0042341c
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
leave
ret 0x1c
Function at 0x5f4dfb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push esi
push edi
push dword [esp + 0x14]
mov esi, ecx
mov byte [esp + 0xf], 0
push dword [esp + 0x14]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
test edi, edi
jne 0x5f4e26
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor al, al
jmp 0x5f4e9a
push ebx
push edi
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x5f4e3b
xor al, al
jmp 0x5f4e99
push ebp
push ebx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebp, eax
test ebp, ebp
je 0x5f4e8d
cmp dword [esp + 0x20], 0
push edi
push dword [esi + 0x24]
jne 0x5f4e62
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
jmp 0x5f4e88
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [esp + 0x24]
cmp ecx, eax
jl 0x5f4e8d
push ecx
push ebp
push dword [esp + 0x28]
call fcn.00631810
add esp, 0xc
mov byte [esp + 0x13], 1
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov al, byte [esp + 0x13]
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret 0x10

Function at 0x5f5200
Capabilities:
Hide graphical window

Disassembly:
push 0x6b0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x5f5299
Capabilities:
Create process on windows

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, ecx
mov eax, dword [edx + 8]
cmp eax, 0x6b0
je 0x5f530f
cmp eax, 0x6b1
je 0x5f52c6
cmp eax, 0x6b3
je 0x5f52c6
mov ecx, 0x748
cmp eax, ecx
je 0x5f52ea
jbe 0x5f5332
cmp eax, 0x74b
ja 0x5f5332
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x5f5332
cmp dword [ecx + 8], 0x701
jne 0x5f5332
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov dword [esi + 0x58], eax
mov eax, dword [ecx + 0x18]
sub eax, dword [ecx + 0x10]
mov dword [esi + 0x5c], eax
jmp 0x5f5332
mov eax, dword [edx + 0xc]
test eax, eax
je 0x5f5332
cmp dword [eax + 8], 0xfffffffe
jne 0x5f5332
push 5
xor ecx, ecx
add eax, 0x7c
push ecx
push ecx
push eax
push 0x689f9c
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x5f5332
mov eax, dword [edx + 0xc]
test eax, eax
je 0x5f5332
cmp dword [eax + 8], 0xfffffffe
jne 0x5f5332
xor ecx, ecx
mov dword [esi + 0x54], 2
push ecx
push ecx
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
ret 4
Function at 0x5f6a45
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x680e64
call fcn.006313fc
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
call fcn.00584133
xor eax, eax
mov dword [ebx], 0x6f6760
mov dword [ebp - 4], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x4c], 0xf
mov dword [ebx + 0x48], eax
mov byte [ebx + 0x38], al
lea ecx, [ebx + 0x54]
mov byte [ebp - 4], 2
mov byte [ebx + 0x50], al
call fcn.005ca1a3
lea ecx, [ebx + 0x64]
call fcn.005ca1a3
push 0
push ebx
lea ecx, [ebx + 0x54]
call fcn.005ca2ef
push 1
push ebx
lea ecx, [ebx + 0x64]
call fcn.005ca2ef
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x5f7e8d
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x681072
call fcn.006313fc
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00584133
mov eax, dword [ebp + 0x1c]
xor ecx, ecx
mov esi, dword [ebp + 0xc]
mov dword [edi + 0x38], eax
xor eax, eax
push 7
mov dword [edi], 0x6f6cf8
mov byte [edi + 0x30], cl
mov dword [edi + 0x34], esi
mov dword [edi + 0x3c], ecx
pop ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x50], ecx
mov dword [ebp - 4], ecx
mov word [edi + 0x40], ax
push dword [ebp + 0x18]
lea ecx, [edi + 0x58]
mov byte [ebp - 4], 1
call fcn.00409ba7
push dword [ebp + 0x10]
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 2
call fcn.004249e7
xor ecx, ecx
xor eax, eax
mov dword [edi + 0xb8], ecx
mov dword [edi + 0xd0], ebx
mov dword [edi + 0xcc], ecx
mov word [edi + 0xbc], ax
mov eax, dword [ebp + 0x14]
or dword [edi + 0x10], 0x84
push esi
push dword [ebp + 8]
mov byte [edi + 0xd8], cl
mov ecx, edi
mov byte [ebp - 4], 4
mov dword [edi + 0xd4], eax
call fcn.0058422a
push 0x200
xor esi, esi
push esi
push dword [edi + 4]
call fcn.005841e5
push dword [ebp + 0x18]
lea ecx, [ebp - 0x28]
call fcn.00409ba7
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
call fcn.00597007
push esi
push 1
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.0040a0e9
test bl, bl
je 0x5f7f73
mov byte [edi + 0xd8], 1
cmp byte [ebp + 0x20], 0
je 0x5f7f86
cmp byte [edi + 0xd8], 0
jne 0x5f7f86
push 5
jmp 0x5f7f87
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x6048f7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, 0x798030
push dword [ebp + 8]
mov dword [0x79802c], eax
call fcn.005a68b0
lea eax, [ebp + 0xc]
push eax
xor eax, eax
push eax
push 0x79802c
push 0x605059
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x797ff4], eax
pop ebp
ret 8

Function at 0x60589c
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 5
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x60]
sub eax, dword [esi + 0x58]
push 0x254
push eax
mov eax, dword [esi + 0x5c]
sub eax, dword [esi + 0x54]
push eax
push dword [esi + 0x58]
push dword [esi + 0x54]
push 0
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push 0
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
ret