joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bb2d33d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
xor esi, esi
push 0x1e
xor eax, eax
pop ecx
lea edi, [ebp - 0x7c]
mov dword [ebp - 0x80], esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, esi
mov dword [ebp - 4], ebx
je case.0x5bb2d2af.3
mov ecx, dword [eax]
shl ecx, 4
mov ecx, dword [ecx + 0x5ba4a1f0]
dec ecx
cmp ecx, 0x10
ja case.0x5bb2d2af.3
movzx ecx, byte [ecx + 0x5bb2d3fe]
jmp dword [ecx*4 + 0x5bb2d3e2]
cmp word [eax + 0x18], si
je 0x5bb2d3d1
xor ebx, ebx
jmp 0x5bb2d3d9
cmp word [eax + 0x18], 0x13
jne 0x5bb2d3d9
jmp 0x5bb2d3d1
cmp word [eax + 0x18], 0x13
jne 0x5bb2d3d9
cmp dword [eax + 0x20], esi
jmp 0x5bb2d35d
cmp word [eax + 0x18], 0x41
jne 0x5bb2d3d9
cmp dword [eax + 0x20], esi
je 0x5bb2d3d9
mov edi, dword [eax + 0x24]
push edi
call fcn.5bb1dd29
test eax, eax
jne 0x5bb2d3d9
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x80]
push edx
push dword [edi + 8]
push eax
call dword [ecx + 0xe0]
test eax, eax
jl 0x5bb2d3d9
mov eax, dword [0x5bb73870]
mov ecx, dword [eax]
lea edx, [ebp - 0x80]
push edx
push eax
call dword [ecx + 0x28]
jmp 0x5bb2d3d1
cmp word [eax + 0x18], 0x1e
jne case.0x5bb2d2af.3
mov eax, dword [eax + 0x20]
cmp eax, esi
je case.0x5bb2d2af.3
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x5bb2d3d9
jmp 0x5bb2d3d1
cmp word [eax + 0x18], 0x1e
mov dword [ebp + 8], esi
jne case.0x5bb2d2af.3
mov eax, dword [eax + 0x20]
cmp eax, esi
je case.0x5bb2d2af.3
push eax
push esi
call sub.MSOERT2.dll_PszToUnicode
mov edi, eax
cmp edi, esi
je case.0x5bb2d2af.3
push esi
lea eax, [ebp + 8]
push eax
push esi
push edi
call fcn.5bb1b907
push dword [ebp + 8]
mov ebx, eax
mov eax, dword [0x5bb73714]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [0x5bb73714]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
cmp ebx, esi
jl case.0x5bb2d2af.3
push 0x54
call fcn.5ba5c700
test eax, eax
jne 0x5bb2d3d6
push 0x55
call fcn.5ba5c700
test eax, eax
jne 0x5bb2d3d6
xor ebx, ebx
inc ebx
jmp 0x5bb2d3d9
mov ebx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x5bb2f873
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push dword [esi + 0x10]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
inc edi
push edi
lea eax, [ebp - 4]
push eax
call fcn.5baaee23
test eax, eax
jl 0x5bb2f907
mov eax, dword [ebp - 4]
push edi
mov byte [eax], bl
push dword [ebp - 4]
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push ebx
push 1
push 1
push dword [ebp - 4]
call sub.MSOERT2.dll_UlStripWhitespace
test eax, eax
jne 0x5bb2f8e7
push 0x5ba5f15a
push sub.SHLWAPI.dll_Ordinal_107
push 0x40
push ebx
push 0x1aee
push 0x1073
push dword [esi + 0xc]
push dword [0x5bb73708]
call sub.MSOERT2.dll_MessageBoxInstW
jmp 0x5bb2f907
push dword [ebp - 4]
mov ecx, esi
push ebx
call fcn.5bb2e8eb
push 0x5ba44198
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, esi
call fcn.5bb2e851
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x5bb2f91d
mov eax, dword [0x5bb73714]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
leave
ret

Function at 0x5bb30951
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], 0x202
mov esi, ecx
je 0x5bb30978
cmp dword [ebp + 8], 0x100
jne 0x5bb309df
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
je 0x5bb30988
call dword [sym.imp.USER32.dll_ReleaseCapture]
cmp dword [ebp + 0x14], 0
push dword [ebp + 0xc]
mov ecx, esi
je 0x5bb3099a
call fcn.5bb2eccb
jmp 0x5bb309ac
cmp dword [ebp + 0x10], 0
je 0x5bb309a7
call fcn.5bb30341
jmp 0x5bb309ac
call fcn.5bb2f0c6
test eax, eax
je 0x5bb309dc
mov eax, dword [esi]
or dword [esi + 8], 2
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
lea ecx, [ebp - 0x14]
push ecx
push eax
push 0x4e
push dword [esi]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xfffffc19
call dword [sym.imp.USER32.dll_GetParent]
push eax
call ebx
xor edi, edi
inc edi
cmp dword [ebp + 8], 0x201
je 0x5bb309f1
cmp dword [ebp + 8], 0x203
jne 0x5bb30a34
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
js 0x5bb30a34
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ebp + 0x14], eax
je 0x5bb30a0f
mov edx, dword [ecx + 0x28]
mov ecx, dword [ecx + 0x2c]
jmp 0x5bb30a15
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push eax
push eax
push 0x43f
push dword [esi]
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
call ebx
lea eax, [ebp - 8]
push eax
push dword [esi]
call fcn.5ba9373e
xor edi, edi
inc edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x5bb32bf8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push 0x20019
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x5bb32c39
jle 0x5bb32c9f
and eax, 0xffff
or eax, 0x80070000
jmp 0x5bb32c9f
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x5ba4f2f4
push dword [ebp - 8]
mov dword [ebp - 0xc], 4
call esi
cmp eax, ebx
jne 0x5bb32c2b
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
mov edi, 0x5ba4f2fc
push edi
push dword [ebp - 8]
call esi
cmp eax, ebx
jne 0x5bb32c2b
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
call fcn.5baaee23
mov ebx, eax
test ebx, ebx
jl 0x5bb32cc8
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push 0
push 0
push edi
push dword [ebp - 8]
call esi
xor ebx, ebx
cmp eax, ebx
je 0x5bb32ca3
jg 0x5bb32c2d
mov ebx, eax
jmp 0x5bb32cc8
mov edx, dword [ebp - 4]
cmp byte [edx], 0
je 0x5bb32cc3
mov ecx, dword [ebp - 0x10]
test ecx, 3
je 0x5bb32cc3
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [ebp - 4], ebx
jmp 0x5bb32ce0
mov ebx, 0x80070057
cmp dword [ebp - 4], 0
je 0x5bb32ce0
mov eax, dword [0x5bb73714]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
and dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x5bb32cef
push dword [ebp - 8]
call dword [entry0]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x5bb32cfd
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 4]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp byte [eax], bl
push edi
je 0x5bb32d93
test dword [esi], 3
je 0x5bb32d93
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
je 0x5bb32d50
jle 0x5bb32d8b
and eax, 0xffff
or eax, 0x80070000
jmp 0x5bb32d8b
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
push esi
push 4
push ebx
push 0x5ba4f2f4
push dword [ebp - 4]
call edi
cmp eax, ebx
jne 0x5bb32d42
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esi + 4]
push 1
push ebx
push 0x5ba4f2fc
push dword [ebp - 4]
call edi
cmp eax, ebx
je 0x5bb32d8f
jg 0x5bb32d44
mov esi, eax
jmp 0x5bb32d98
xor esi, esi
jmp 0x5bb32d98
mov esi, 0x80070057
cmp dword [ebp - 4], ebx
je 0x5bb32da6
push dword [ebp - 4]
call dword [entry0]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x5bb33649
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x5bb74be4], 0
jne 0x5bb33676
push 0x5bb74b50
mov dword [0x5bb74be4], esi
mov dword [0x5bb74b50], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp + 8]
sub eax, 0
je 0x5bb336e9
dec eax
je 0x5bb336de
dec eax
je 0x5bb336c9
dec eax
je 0x5bb336c0
dec eax
je 0x5bb336ae
dec eax
je 0x5bb33691
xor eax, eax
jmp 0x5bb336f4
cmp dword [0x5bb74b60], esi
jne 0x5bb3368d
mov eax, dword [0x5bb74b54]
cmp eax, 4
ja 0x5bb336da
jne 0x5bb3368d
cmp dword [0x5bb74b58], 0xa
jmp 0x5bb336d8
cmp dword [0x5bb74b60], 2
jne 0x5bb3368d
cmp dword [0x5bb74b54], 5
jmp 0x5bb336d8
cmp dword [0x5bb74b60], 2
jmp 0x5bb336cf
cmp dword [0x5bb74b60], esi
jne 0x5bb3368d
cmp dword [0x5bb74b54], 4
jb 0x5bb3368d
mov eax, esi
jmp 0x5bb336f4
xor eax, eax
cmp dword [0x5bb74b60], 2
jmp 0x5bb336f1
xor eax, eax
cmp dword [0x5bb74b60], esi
sete al
pop esi
pop ebp
ret 4

Function at 0x5bb3392a
Capabilities:
Check os version
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5bb70c3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
xor eax, eax
cmp dword [0x5bb70a08], eax
push esi
push edi
mov dword [ebp - 0x218], eax
je 0x5bb33984
push 0x5bb74bf0
mov dword [0x5bb70a08], eax
mov dword [0x5bb74bf0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x5bb33984
mov dword [0x5bb74c00], 1
cmp dword [0x5bb74c00], 2
jne 0x5bb33a99
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, 0x104
push esi
lea eax, [ebp - 0x110]
push eax
push 0x5ba4a790
call edi
test eax, eax
je 0x5bb339cd
push 0x5ba4a780
lea eax, [ebp - 0x110]
push eax
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.5bb3387d
test eax, eax
jne 0x5bb33a38
cmp dword [0x5bb74bf4], 5
jb 0x5bb33a07
push esi
lea eax, [ebp - 0x110]
push eax
push 0x5ba4a734
call edi
test eax, eax
je 0x5bb33a07
push 0x5ba4a770
lea eax, [ebp - 0x110]
push eax
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.5bb3387d
test eax, eax
jne 0x5bb33a38
push esi
lea eax, [ebp - 0x110]
push eax
push 0x5ba4a764
call edi
test eax, eax
je 0x5bb33a6d
push 0x5ba4a754
lea eax, [ebp - 0x110]
push eax
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.5bb3387d
test eax, eax
je 0x5bb33a6d
mov dword [ebp - 0x218], 1
lea ebx, [ebp - 0x214]
push dword [ebp + 0x10]
push ebx
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
pop edi
pop esi
pop ebx
call fcn.5bb3f314
leave
ret 0xc
push 5
lea eax, [ebp - 0xc]
push eax
push 0x5ba4a728
call edi
test eax, eax
je 0x5bb33a99
push 0x5ba4a744
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.5bb3387d
test eax, eax
jne 0x5bb33a38
cmp dword [ebp - 0x21c], ebx
je 0x5bb33a58
jmp 0x5bb33a48
Function at 0x5bb3569b
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x5bb70c3c]
push esi
push edi
xor esi, esi
inc esi
push 0x5bb74cdc
mov dword [ebp - 4], eax
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [0x5bb74ccc], edi
jne 0x5bb357c5
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x5bb35701
push 0x5ba4b41c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [0x5bb74ccc], eax
jne 0x5bb3570c
mov dword [ebp - 0x9c], edi
jmp 0x5bb357c5
cmp dword [ebp - 0x88], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x5bb35726
mov dword [0x5bb70c18], 0x5bb355e2
jmp 0x5bb35738
push 0x5ba4b404
push eax
call esi
mov dword [0x5bb70c18], eax
mov eax, dword [0x5bb74ccc]
cmp dword [0x5bb70c18], edi
jne 0x5bb3574a
mov dword [0x5bb70c18], 0x5bb34d96
cmp dword [ebp - 0x88], 2
mov edi, 0x5bb34dba
push ebx
mov dword [0x5bb70c1c], edi
mov ebx, 0x5bb34dde
jne 0x5bb357a8
cmp dword [ebp - 0x94], 5
jb 0x5bb357a8
push 0x5ba4b3f0
push eax
call esi
test eax, eax
mov dword [0x5bb70c1c], eax
jne 0x5bb35784
mov dword [0x5bb70c1c], edi
push 0x5ba4b3dc
push dword [0x5bb74ccc]
call esi
test eax, eax
mov dword [0x5bb70c20], eax
jne 0x5bb357a0
mov dword [0x5bb70c20], ebx
cmp dword [0x5bb70c1c], edi
jne 0x5bb357b2
mov dword [0x5bb70c1c], 0x5bb35677
cmp dword [0x5bb70c20], ebx
pop ebx
jne 0x5bb357c5
mov dword [0x5bb70c20], 0x5bb35689
push 0x5bb74cdc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x9c]
pop edi
pop esi
call fcn.5bb3f314
leave
ret
Function at 0x5bb35946
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x5bb70c3c]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [0x5bb74d00]
test eax, eax
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x9c], esi
jne 0x5bb35a49
cmp dword [0x5bb74d08], eax
jne 0x5bb35a35
push edi
call fcn.5bb357e7
mov edi, eax
test edi, edi
je 0x5bb35a07
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5ba4b4d4
push edi
call esi
test eax, eax
je 0x5bb35a07
lea ecx, [ebp - 0xb0]
push ecx
mov dword [ebp - 0xb0], 0x14
call eax
test eax, eax
jl 0x5bb35a07
cmp dword [ebp - 0xac], 5
jb 0x5bb35a07
push 0x18c
push edi
call esi
cmp dword [0x5bb74d0c], 0
mov dword [0x5bb74d00], eax
jne 0x5bb35a07
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x5bb35a07
cmp dword [ebp - 0x94], 5
jb 0x5bb35a07
mov dword [0x5bb74d0c], 1
mov eax, dword [0x5bb74d00]
test eax, eax
mov dword [0x5bb74d08], 1
pop edi
je 0x5bb35a35
xor ecx, ecx
cmp dword [0x5bb74d0c], ecx
setne cl
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x9c]
jmp 0x5bb35a5c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x9c]
push ebx
call fcn.5bb3de25
jmp 0x5bb35a5f
xor ecx, ecx
cmp dword [0x5bb74d0c], ecx
setne cl
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push ebx
call eax
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.5bb3f314
leave
ret 0x10

Function at 0x5bb36ad0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x5bb70c70]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x5bb36b32
push 0x88
push 1
call fcn.5ba823e2
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x5bb36b2a
push esi
push dword [0x5bb70c70]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x5bb36b2a
push esi
call fcn.5ba824c6
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x5bb36b32
push 0x10
call fcn.5bb360f9
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
ret
Function at 0x5bb37213
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5bb74e80]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push edi
xor ebx, ebx
xor edi, edi
cmp eax, ebx
jne 0x5bb3725f
call esi
mov edi, eax
cmp edi, ebx
je 0x5bb37245
mov dword [0x5bb74e80], 1
jmp 0x5bb37264
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x5bb3725a
push 2
pop eax
mov dword [0x5bb74e80], eax
jmp 0x5bb3725f
mov eax, dword [0x5bb74e80]
cmp eax, 1
jne 0x5bb372dc
cmp edi, ebx
jne 0x5bb37270
call esi
mov edi, eax
cmp edi, ebx
je 0x5bb372e5
cmp word [edi], bx
mov eax, edi
je 0x5bb37285
inc eax
inc eax
cmp word [eax], bx
jne 0x5bb37277
inc eax
inc eax
cmp word [eax], bx
jne 0x5bb37277
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, edi
push ebx
sar eax, 1
inc eax
push eax
push edi
push ebx
push ebx
mov dword [ebp - 0xc], eax
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x5bb372d3
push eax
call fcn.5bb362a2
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x5bb372d3
push ebx
push ebx
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push edi
push ebx
push ebx
call esi
test eax, eax
jne 0x5bb372d0
push dword [ebp - 4]
call fcn.5bb3636d
pop ecx
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x5bb37334
cmp eax, 2
je 0x5bb372e9
cmp eax, ebx
je 0x5bb372e9
xor eax, eax
jmp 0x5bb37336
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x5bb372e5
cmp byte [esi], bl
je 0x5bb37306
inc eax
cmp byte [eax], bl
jne 0x5bb372fc
inc eax
cmp byte [eax], bl
jne 0x5bb372fc
sub eax, esi
inc eax
mov edi, eax
push edi
call fcn.5bb362a2
cmp eax, ebx
pop ecx
je 0x5bb3732d
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 4]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5bb3744c
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5bb70c3c]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x5bb70ca0]
je 0x5bb37476
inc eax
cmp eax, 0x12
jb 0x5bb37467
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x5bb70ca0]
mov dword [ebp - 0x110], esi
jne 0x5bb37621
mov eax, dword [0x5bb74d20]
cmp eax, 1
je 0x5bb375ef
test eax, eax
jne 0x5bb374ac
cmp dword [0x5bb74d24], 1
je 0x5bb375ef
cmp ecx, 0xfc
je 0x5bb37621
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5bb374e7
push 5
pop ecx
mov esi, 0x5ba4ba84
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebx, [ebp - 0x10c]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5bb374f2
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x5bb3752a
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5bb3750a
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x5ba4ba80
push ebx
call fcn.5bb39f60
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5bb3752f
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + 0x5bb70ca4]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x5bb37549
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.5bb36150
mov edx, esp
push 6
pop ecx
mov esi, 0x5ba4ba64
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5bb37575
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x5bb37581
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x5bb3759a
mov eax, dword [ebp - 0x110]
mov esi, 0x5ba4ba60
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x5bb70ca4]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5bb375b8
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x5bb375c4
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x5ba4ba38
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.5bb39e5d
add esp, 0xc
jmp 0x5bb37621
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x5bb37621
mov esi, dword [esi + 0x5bb70ca4]
mov ecx, esi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x5bb37606
push 0
sub ecx, edx
lea edx, [ebp - 0x114]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x120]
mov ecx, dword [ebp - 4]
call fcn.5bb3f314
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5bb39e5d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x5bb75040], ebx
push esi
push edi
jne 0x5bb39edf
push 0x5ba4c180
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x5bb39f1a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5ba4c174
push edi
call esi
test eax, eax
mov dword [0x5bb75040], eax
je 0x5bb39f1a
push 0x5ba4c164
push edi
call esi
push 0x5ba4c150
push edi
mov dword [0x5bb75044], eax
call esi
cmp dword [0x5bb74d34], 2
mov dword [0x5bb75048], eax
jne 0x5bb39edf
push 0x5ba4c134
push edi
call esi
test eax, eax
mov dword [0x5bb75050], eax
je 0x5bb39edf
push 0x5ba4c11c
push edi
call esi
mov dword [0x5bb7504c], eax
mov eax, dword [0x5bb7504c]
test eax, eax
je 0x5bb39f24
call eax
test eax, eax
je 0x5bb39f0b
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x5bb75050]
test eax, eax
je 0x5bb39f0b
test byte [ebp - 8], 1
jne 0x5bb39f24
cmp dword [0x5bb74d40], 4
jb 0x5bb39f1e
or byte [ebp + 0x12], 0x20
jmp 0x5bb39f43
xor eax, eax
jmp 0x5bb39f53
or byte [ebp + 0x12], 4
jmp 0x5bb39f43
mov eax, dword [0x5bb75044]
test eax, eax
je 0x5bb39f43
call eax
mov ebx, eax
test ebx, ebx
je 0x5bb39f43
mov eax, dword [0x5bb75048]
test eax, eax
je 0x5bb39f43
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x5bb75040]
pop edi
pop esi
pop ebx
leave
ret