joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56801c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x56808f
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
test al, al
je 0x568079
lea ecx, [ebp - 4]
lea edx, [ebp - 0xc]
call fcn.00567e7c
cmp dword [ebp - 0xc], 0
je 0x56806e
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00409944
test al, al
je 0x568079
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x568079
mov eax, dword [ebp - 4]
call fcn.00567f74
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x568096
lea eax, [ebp - 4]
call fcn.004056ac
ret

Function at 0x568130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x5681ea
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
jne 0x568159
mov eax, ebx
call fcn.004056ac
jmp 0x5681d4
mov ecx, ebx
lea edx, [ebp - 8]
call fcn.00567e7c
cmp dword [ebp - 8], 0
je 0x5681d4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00409938
test al, al
je 0x5681cd
xor eax, eax
push ebp
push 0x5681c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.005680a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5681d4
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
call fcn.00409938
test al, al
je 0x5681c5
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
mov eax, ebx
call fcn.004056ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5681f1
lea eax, [ebp - 4]
call fcn.00407888
ret
Function at 0x58ab24
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x58ac95
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x58ac70
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.00405894
lea eax, [ebp - 0x118]
mov edx, 0x58acac
call fcn.00405994
mov eax, dword [ebp - 0x118]
call fcn.00405b58
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x58abe2
lea eax, [ebp - 0x111]
call fcn.0040c6d0
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.0040579c
jmp 0x58abe9
mov eax, esi
call fcn.004056ac
cmp bl, 0x61
jae 0x58ac0a
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.004127e0
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00405700
jmp 0x58ac24
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0041274c
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00405700
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x58acb8
call fcn.0040ce68
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00405700
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58ac77
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x5ceef0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5cf073
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.005cf350
mov eax, ebx
call fcn.00436ecc
dec al
je 0x5cef34
dec al
je 0x5cef3a
jmp 0x5cef40
mov byte [ebp - 0x77], 2
jmp 0x5cef44
mov byte [ebp - 0x77], 1
jmp 0x5cef44
mov byte [ebp - 0x77], 0
mov eax, dword [ebp - 0x8c]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0x8c], eax
mov eax, ebx
call fcn.00436e4c
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
mov dword [ebp - 0x84], eax
mov edi, dword [ebx + 0x18]
cmp edi, 0xff000008
je 0x5cef92
cmp edi, 0x20000000
jne 0x5cef9e
or dword [ebp - 0x88], 0x40000000
jmp 0x5cefa8
mov eax, edi
call fcn.004365dc
mov dword [ebp - 0x7c], eax
mov eax, ebx
call fcn.00436e88
test al, 1
je 0x5cefba
or dword [ebp - 0x88], 1
mov eax, ebx
call fcn.00436e88
test al, 2
je 0x5cefcc
or dword [ebp - 0x88], 2
mov eax, ebx
call fcn.00436e88
test al, 4
je 0x5cefde
or dword [ebp - 0x88], 4
mov eax, ebx
call fcn.00436e88
test al, 8
je 0x5ceff0
or dword [ebp - 0x88], 8
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.00436dd8
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x76]
mov ecx, 0x20
call fcn.0040c7b8
or dword [ebp - 0x8c], 0x8000000
mov eax, ebx
call fcn.00436f04
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x3c]
push eax
push 0x3c
mov eax, ebx
call fcn.00436b40
push eax
call sub.gdi32.dll_GetObjectA
test eax, eax
je 0x5cf04d
or dword [ebp - 0x8c], 0x400000
movzx eax, word [ebp - 0x2c]
mov word [ebp - 0x56], ax
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.005cf37c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5cf07a
lea eax, [ebp - 0x94]
call fcn.004056ac
ret
Function at 0x5d035c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, 0x659434
xor eax, eax
push ebp
push 0x5d04cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x6638cc], 1
mov edx, 0x8000
mov eax, 0x5d04e4
call fcn.00414124
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x5d03a5
cmp dword [ebx], 0x20
jae 0x5d03a5
xor eax, eax
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x5d03d6
mov edx, 0x8000
mov eax, 0x5d04fc
call fcn.00414124
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x5d04b9
cmp dword [ebx], 0x20
jae 0x5d04b9
xor eax, eax
mov dword [ebx], eax
jmp 0x5d04b9
mov dword [0x6638cc], 2
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.00413644
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405b58
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x5d04b9
mov eax, ebx
call fcn.0040300c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5d04b2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x5d049c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5d050c
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5d049c
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov eax, ecx
and eax, 0xffff0000
cmp eax, 0x50000
jne 0x5d0478
mov eax, ecx
and eax, 0xffff
mov ecx, 0xa
xor edx, edx
div ecx
mov dword [0x6638cc], eax
jmp 0x5d0489
cmp eax, 0xc0000
jne 0x5d0489
mov dword [0x6638cc], 6
cmp dword [0x6638cc], 0
jne 0x5d049c
mov dword [0x6638cc], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d04b9
mov eax, dword [ebp - 0xc]
call fcn.00403028
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d04d6
lea eax, [ebp - 4]
call fcn.004056ac
ret
Function at 0x5d72e8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5d73ed
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0045ce68
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x5d73c3
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0045ce68
call fcn.0045cd3c
mov edi, eax
dec edi
test edi, edi
jl 0x5d73ab
inc edi
xor ebx, ebx
call fcn.0045ce68
mov edx, ebx
call fcn.0045cd44
add eax, 0xfffffff7
sub ax, 2
jb 0x5d73a7
sub ax, 5
je 0x5d73a7
call fcn.00639a98
test al, al
je 0x5d7368
call fcn.0045ce68
mov edx, ebx
call fcn.0045cd44
sub ax, 2
je 0x5d73a7
sub ax, 0xc
je 0x5d73a7
call fcn.0045ce68
mov edx, ebx
call fcn.0045cd44
movzx eax, ax
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x5d73a7
push esi
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x390], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x390], 0x400
jge 0x5d73ab
inc ebx
dec edi
jne 0x5d732c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d73ca
call fcn.0045ce68
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x5d8354
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x5d83d4
xor eax, eax
push ebp
push 0x5d83c0
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0045ce68
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x5d83a4
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0045ce68
mov edx, dword [eax]
call dword [edx + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5d83ae
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5d83e1
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jb 0x5d836a
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x5d8900
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, edx
mov ebp, eax
call sub.user32.dll_GetForegroundWindow
mov edi, eax
test edi, edi
jne 0x5d891a
xor ebx, ebx
jmp 0x5d89f0
mov eax, dword [ebp + 0x3a8]
call fcn.00406e94
dec eax
test eax, eax
jl 0x5d8967
inc eax
xor esi, esi
mov edx, dword [ebp + 0x3a8]
cmp edi, dword [edx + esi*8]
jne 0x5d8963
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 0x3a8]
sub eax, dword [edx + esi*8 + 4]
cmp eax, 0x7530
seta bl
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 0x3a8]
mov dword [edx + esi*8 + 4], eax
jmp 0x5d89f0
inc esi
dec eax
jne 0x5d892d
mov byte [ebx], 1
mov eax, dword [ebp + 0x3a8]
call fcn.00406e94
cmp eax, 0x64
jne 0x5d8995
push 0
lea eax, [ebp + 0x3a8]
mov ecx, 1
mov edx, dword [0x5d5264]
call fcn.00407050
add esp, 4
mov eax, dword [ebp + 0x3a8]
call fcn.00406e94
inc eax
push eax
lea eax, [ebp + 0x3a8]
mov ecx, 1
mov edx, dword [0x5d5264]
call fcn.00407050
add esp, 4
mov eax, dword [ebp + 0x3a8]
call fcn.00406e94
mov edx, dword [ebp + 0x3a8]
mov dword [edx + eax*8 - 8], edi
mov eax, dword [ebp + 0x3a8]
call fcn.00406e94
mov edx, dword [ebp + 0x3a8]
lea eax, [edx + eax*8 - 4]
push eax
call sub.kernel32.dll_GetTickCount_1
pop edx
mov dword [edx], eax
mov bl, 1
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5d8b2c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x5d8b57
cmp byte [0x659438], 0
je 0x5d8b4b
cmp byte [ebx + 0x3a0], 0
je 0x5d8b65
mov eax, dword [0x65a3f4]
mov eax, dword [eax]
call fcn.0048c808
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 0x12c
jb 0x5d8b39
mov eax, 0x1e
call fcn.0063c044
pop esi
pop ebx
ret

Function at 0x5df310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov eax, esi
mov edx, ebx
call fcn.00405700
test ebx, ebx
je 0x5df3e5
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x5df3ec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x5df3dc
xor eax, eax
push ebp
push 0x5df3d5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
mov eax, ebx
call fcn.00405b58
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x5df3be
cmp dword [ebp - 4], 0
jbe 0x5df3be
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405de8
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.00405bb8
push eax
push 0
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x5df3b5
mov eax, esi
mov edx, dword [esi]
call fcn.00405700
jmp 0x5df3be
mov eax, esi
mov edx, ebx
call fcn.00405700
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5df3e5
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, esi
mov edx, ebx
call fcn.00405700
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x5e425c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
sar eax, 1
jns 0x5e4272
adc eax, 0
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
xor edx, edx
xor eax, eax
call fcn.00422ca4
push 1
push 1
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
xor eax, eax
call fcn.00422ca4
push 1
push 1
lea eax, [ebp - 0x34]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebp - 0x10]
inc eax
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.gdi32.dll_CreateRectRgn
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.gdi32.dll_CreateRectRgn
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x30]
inc eax
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.gdi32.dll_CreateRectRgn
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.gdi32.dll_CreateRectRgn
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x5e43c3
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
xor ecx, ecx
mov dl, 2
call fcn.005e4140
pop ecx
push ebp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov cl, 2
xor edx, edx
call fcn.005e4140
pop ecx
push ebp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
xor ecx, ecx
xor edx, edx
call fcn.005e4140
pop ecx
push ebp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
xor ecx, ecx
mov dl, 1
call fcn.005e4140
pop ecx
push ebp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov cl, 1
xor edx, edx
call fcn.005e4140
pop ecx
push ebp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov cl, 3
mov dl, 3
call fcn.005e4140
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e43ca
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0x24]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0x20]
push eax
call sub.gdi32.dll_DeleteObject
ret
Function at 0x5eed80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, edx
xor eax, eax
push ebp
push 0x5eef47
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [ebx + 5]
sub al, 2
jae 0x5eedfd
call fcn.0063cad8
dec eax
jle 0x5eedfd
mov eax, dword [0x65a970]
mov eax, dword [eax]
mov eax, dword [eax + 0xb4]
mov edx, dword [0x65a970]
mov edx, dword [edx]
cmp eax, dword [edx + 0xac]
jne 0x5eedfd
cmp dword [0x6594d0], 0
jle 0x5eedda
call fcn.005ee248
jmp case.0x5eee0d.9
push ebp
mov eax, 1
call fcn.005ee8e0
pop ecx
test al, al
jne case.0x5eee0d.9
mov eax, 1
call fcn.005edfe0
jmp case.0x5eee0d.9
movzx eax, byte [ebx + 5]
movzx edx, al
cmp edx, 0xc
ja case.0x5eee0d.9
jmp dword [edx*4 + 0x5eee14]
call fcn.0063cad8
dec eax
jle case.0x5eee0d.9
call fcn.005ee248
jmp case.0x5eee0d.9
call fcn.0063cad8
dec eax
jle 0x5eee75
mov eax, 1
call fcn.005edfe0
jmp case.0x5eee0d.9
mov eax, dword [0x65a970]
mov eax, dword [eax]
cmp dword [eax + 0xc0], 0
jne case.0x5eee0d.9
push 0
push 0x5eef54
call sub.kernel32.dll_WinExec
jmp case.0x5eee0d.9
mov eax, dword [ebx + 8]
xor edx, edx
call fcn.004061d4
je case.0x5eee0d.9
push 0
push 0
lea eax, [ebp - 8]
mov edx, dword [ebx + 8]
call fcn.00405950
mov eax, dword [ebp - 8]
call fcn.0040bbb4
test eax, eax
je case.0x5eee0d.9
push 0
push 0
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 8]
call fcn.00405950
mov eax, dword [ebp - 0xc]
call fcn.0040bbb4
call fcn.005edfe0
jmp case.0x5eee0d.9
call fcn.0063cad8
dec eax
jle case.0x5eee0d.9
push ebp
movzx eax, byte [ebx + 5]
call fcn.005ee8e0
pop ecx
jmp case.0x5eee0d.9
push ebp
movzx eax, al
call fcn.005ee8e0
pop ecx
jmp case.0x5eee0d.9
push ebp
mov eax, 1
call fcn.005eecfc
pop ecx
jmp case.0x5eee0d.9
push ebp
mov eax, 2
call fcn.005eecfc
pop ecx
jmp case.0x5eee0d.9
push ebp
mov eax, 3
call fcn.005eecfc
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eef4e
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004056d0
ret
Function at 0x5f2c4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x5f2ca7
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0x5f2cb4
push 0
lea edx, [ebp - 4]
mov eax, 0x5f2cc0
call fcn.00617670
mov eax, dword [ebp - 4]
call fcn.00405b58
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004738dc
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f2cae
lea eax, [ebp - 4]
call fcn.004056ac
ret
Function at 0x5f3878
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x5f3915
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6594d4], 0
jne 0x5f38f7
mov eax, 0x664520
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403c80
push 0
mov eax, dword [0x65d7f8]
push eax
mov eax, 0x5f3700
push eax
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [0x6594d4], eax
cmp dword [0x6594d4], 0
jne 0x5f38f7
lea eax, [ebp - 8]
push eax
mov eax, dword [0x65a508]
mov eax, dword [eax]
mov ecx, 0x5f3928
mov edx, 1
call fcn.00637180
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00405950
mov eax, dword [ebp - 4]
call fcn.00638b18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f391c
lea eax, [ebp - 8]
call fcn.00405ea8
lea eax, [ebp - 4]
call fcn.004056ac
ret
Function at 0x5f8b9c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov edi, eax
xor eax, eax
push ebp
push 0x5f8dbf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jle 0x5f8da4
mov dl, 1
mov ax, 0x25
call fcn.0063af90
push 0xa
call sub.kernel32.dll_Sleep_2
xor ecx, ecx
xor edx, edx
mov ax, 0x10
call fcn.0063af24
push 0xa
call sub.kernel32.dll_Sleep_2
mov dl, 1
mov ax, 0x27
call fcn.0063af90
push 0xa
call sub.kernel32.dll_Sleep_2
xor ecx, ecx
mov dl, 1
mov ax, 0x10
call fcn.0063af24
push 0xa
call sub.kernel32.dll_Sleep_2
call fcn.0062713c
mov eax, 0x1e
call fcn.0063c044
lea eax, [ebp - 0x10]
call fcn.0063c57c
mov eax, dword [ebp - 0x10]
mov edx, 0x5f8dd4
call fcn.004061d4
je 0x5f8cce
mov dl, 1
mov ax, 0x25
call fcn.0063af90
push 0xa
call sub.kernel32.dll_Sleep_2
mov dl, 1
mov ax, 0x25
call fcn.0063af90
push 0xa
call sub.kernel32.dll_Sleep_2
xor ecx, ecx
xor edx, edx
mov ax, 0x10
call fcn.0063af24
push 0xa
call sub.kernel32.dll_Sleep_2
mov dl, 1
mov ax, 0x27
call fcn.0063af90
push 0xa
call sub.kernel32.dll_Sleep_2
xor ecx, ecx
mov dl, 1
mov ax, 0x10
call fcn.0063af24
push 0xa
call sub.kernel32.dll_Sleep_2
call fcn.006270f8
mov eax, 0x1e
call fcn.0063c044
lea eax, [ebp - 0x14]
call fcn.0063c57c
mov eax, dword [ebp - 0x14]
mov edx, 0x5f8dd4
call fcn.004061d4
je 0x5f8cf6
call fcn.00627270
jmp 0x5f8cf6
mov eax, dword [0x659f8c]
mov eax, dword [eax]
cmp dword [eax + 0x958], 0x60
jne 0x5f8ceb
xor edx, edx
mov ax, 8
call fcn.0063af90
jmp 0x5f8cf6
xor edx, edx
mov ax, 0x2e
call fcn.0063af90
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0xc], eax
mov ebx, edi
test ebx, ebx
je 0x5f8d09
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [0x65a970]
mov eax, dword [eax]
mov eax, dword [eax + 0x420]
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x5f8d25
sub esi, 4
mov esi, dword [esi]
mov ecx, 1
mov edx, esi
movzx eax, byte [ebp - 1]
call fcn.0042fe70
add eax, dword [ebp - 8]
sub eax, ebx
jg 0x5f8d6c
dec eax
xchg ebx, eax
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0xc]
cmp eax, 0x1388
jbe 0x5f8d56
call fcn.00412274
jmp 0x5f8da4
cmp byte [edi + esi - 1], 0xa
je 0x5f8d68
mov dl, 1
mov ax, 0x25
call fcn.0063af90
dec esi
inc ebx
jne 0x5f8d40
cmp byte [ebp - 1], 0
je 0x5f8da4
mov eax, dword [0x65a970]
mov eax, dword [eax]
mov eax, dword [eax + 0x420]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x5f8d8e
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5f8da4
inc ebx
xor edx, edx
mov ax, 8
call fcn.0063af90
dec ebx
jne 0x5f8d96
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f8dc6
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405ec0
ret
Function at 0x607edc
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x60801b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [esi + 0x8b8]
push eax
push 0x1e
call sub.user32.dll_GetKeyboardLayoutList
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x607f3b
cmp dword [ebp - 0x10], 0x63
jae 0x607f4b
jmp 0x607f3d
jge 0x607f4b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
jmp 0x607f59
mov dword [ebp - 0x18], 0x63
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x607ffd
inc eax
mov dword [ebp - 8], eax
xor ebx, ebx
push pe_nt_image_headers32
lea eax, [ebp - 0x118]
push eax
push 2
movzx eax, word [esi + ebx*4 + 0x8b8]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x118]
mov ecx, pe_nt_image_headers32
call fcn.0040591c
push dword [ebp - 0x120]
push 0x608034
mov eax, dword [esi + ebx*4 + 0x8b8]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x124]
mov eax, 8
call fcn.0040bacc
push dword [ebp - 0x124]
push 0x608040
lea eax, [ebp - 0x11c]
mov edx, 4
call fcn.00405a5c
mov edx, dword [ebp - 0x11c]
mov ecx, dword [esi + ebx*4 + 0x8b8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0x3c]
inc ebx
dec dword [ebp - 8]
jne 0x607f6b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x608022
lea eax, [ebp - 0x124]
mov edx, 3
call fcn.004056d0
ret