joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58f4c2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 8
call fcn.005fffc4
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x58f509
cmp dword [ebp + 0x10], 0
je 0x58f509
xor eax, eax
jmp 0x58f50e
mov eax, 1
test eax, eax
je 0x58f557
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.user32.dll_GetCursorPos]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x58f538
push 6
call fcn.005fffca
add esp, 4
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
mov dword [ebp + 8], eax
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
mov dword [ebp + 0x10], eax
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.00601800
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x58f58c
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.user32.dll_WindowFromPoint]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x58f5b5
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
push 0x100
push 0xd
push dword [ebp - 0x10]
call dword [sym.imp.user32.dll_SendMessageA]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x58f5e7
push 6
call fcn.005fffca
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x58f603
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x58f608
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.005fffbe
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x58f625
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x58f9de
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x58fa1c
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x58fa3e
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 1
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.user32.dll_AttachThreadInput]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x58fa6b
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 8], esp
push dword [ebp + 8]
call dword [sym.imp.user32.dll_SetActiveWindow]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x58fa8d
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 8], esp
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x58faac
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.user32.dll_AttachThreadInput]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x58fad9
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 8], esp
push dword [ebp + 8]
call dword [sym.imp.user32.dll_SetForegroundWindow]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x58fafb
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
setne al
jmp 0x58fb0f
mov esp, ebp
pop ebp
ret 4
Function at 0x591bc5
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x24
call fcn.005fffc4
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 9
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x591c19
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x591c15
imul eax, dword [ebx]
jmp 0x591c0a
mov ecx, eax
test ecx, ecx
je 0x591c34
push ecx
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.005fffbe
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x591c1f
call fcn.005fffbe
add esp, 4
mov eax, 0x760403
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
push 4
call dword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x591c6d
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x591da5
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 0x1c
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_Thread32First]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x591cae
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x591d83
mov ebx, dword [ebp - 8]
add ebx, 0xc
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x10]
cmp dword [ebx], eax
jne 0x591d56
push dword [ebp + 0xc]
push 4
mov eax, 2
call fcn.006010d0
add esp, 8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
mov dword [ebp - 0x14], ebx
call fcn.004c6a80
mov dword [ebp - 0x18], ecx
mov edi, dword [ebp - 0x14]
mov dword [edi], 1
add edi, 4
mov eax, ecx
inc eax
mov dword [edi], eax
add edi, 4
cmp edi, ebx
je 0x591d16
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x18]
inc eax
shl eax, 2
add eax, 8
push eax
push dword [ebp - 0x14]
call fcn.005fffe2
add esp, 8
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov edi, eax
add edi, 8
mov eax, dword [ebp - 0x18]
shl eax, 2
add edi, eax
mov eax, dword [ebp - 0x10]
push edi
push eax
push 0x24
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [edi], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_Thread32Next]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x591d7b
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x591cb1
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x591da5
push 6
call fcn.005fffca
add esp, 4
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
call fcn.004c6a67
jmp 0x591db4
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5920d9
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetExitCodeThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x59210f
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_TerminateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x592134
push 6
call fcn.005fffca
add esp, 4
jmp 0x592139
mov esp, ebp
pop ebp
ret 4

Function at 0x592477
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x5925d4
call dword [sym.imp.user32.dll_EnumWindows]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x5924a8
push 6
call fcn.005fffca
add esp, 4
mov eax, dword [ebp + 8]
jmp 0x5924b0
mov esp, ebp
pop ebp
ret 4
Function at 0x5942b0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
call dword [sym.imp.kernel32.dll_GetVersion]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x5942e6
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 4], eax
push 0x80000301
push 0
push bind
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc4
call fcn.006046a0
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x59432a
mov dword [ebp - 8], 1
jmp 0x594331
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 3
jne 0x5943d1
cmp dword [ebp + 0x10], 0
je 0x59439e
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push 0
push 2
mov ebx, 0xc8
call fcn.006082d0
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0xffff
push dword [ebp - 0xc]
call dword [sym.imp.user32.dll_ExitWindowsEx]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x594399
push 6
call fcn.005fffca
add esp, 4
jmp 0x5943c7
mov dword [ebp - 0xc], esp
push 0xffff
push 0
call dword [sym.imp.user32.dll_ExitWindowsEx]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x5943c7
push 6
call fcn.005fffca
add esp, 4
jmp 0x594574
cmp dword [ebp + 8], 2
jne 0x5944aa
cmp dword [ebp + 0x10], 0
je 0x594477
cmp dword [ebp - 8], 1
jne 0x59441e
push 1
mov eax, str.SeShutdownPrivilege
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
call fcn.005148a1
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x59441e
push ebx
call fcn.005fffbe
add esp, 4
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push 2
push 2
mov ebx, 0xc8
call fcn.006082d0
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0xffff
push dword [ebp - 0xc]
call dword [sym.imp.user32.dll_ExitWindowsEx]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x594472
push 6
call fcn.005fffca
add esp, 4
jmp 0x5944a0
mov dword [ebp - 0xc], esp
push 0xffff
push 2
call dword [sym.imp.user32.dll_ExitWindowsEx]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x5944a0
push 6
call fcn.005fffca
add esp, 4
jmp 0x594574
cmp dword [ebp + 0x10], 0
je 0x594546
cmp dword [ebp - 8], 1
jne 0x5944ed
push 1
mov eax, str.SeShutdownPrivilege
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
call fcn.005148a1
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x5944ed
push ebx
call fcn.005fffbe
add esp, 4
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push 1
push 2
mov ebx, 0xc8
call fcn.006082d0
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0xffff
push dword [ebp - 0xc]
call dword [sym.imp.user32.dll_ExitWindowsEx]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x594541
push 6
call fcn.005fffca
add esp, 4
jmp 0x59456f
mov dword [ebp - 0xc], esp
push 0xffff
push 1
call dword [sym.imp.user32.dll_ExitWindowsEx]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x59456f
push 6
call fcn.005fffca
add esp, 4
jmp 0x594574
mov esp, ebp
pop ebp
ret 0x10
Function at 0x594ca5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.00601800
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x594cea
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0x100
call dword [sym.imp.kernel32.dll_GetTempPathA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x594d15
push 6
call fcn.005fffca
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x594d31
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x594d36
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x594d47
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x595333
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.00601800
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x595378
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.wsock32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x59538f
mov eax, 0x760402
push eax
push 1
mov ebx, 0x130
call fcn.006015a0
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetComputerNameA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x5953cb
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5953f9
mov eax, dword [ebp - 4]
test eax, eax
je 0x5953f4
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x595403
mov eax, 0x760402
jmp 0x595403
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x595414
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x5959fd
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.wininet.dll_InternetGetConnectedState]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x595a2d
push 6
call fcn.005fffca
add esp, 4
jmp 0x595a32
mov esp, ebp
pop ebp
ret 8
Function at 0x59b189
Capabilities:
Check for trap flag exception

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
pushfd
or dword [esp], 0x100
popfd
clc
call fcn.0059b1ae

Function at 0x59d23a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00601800
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x59d27f
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x59d2aa
push 6
call fcn.005fffca
add esp, 4
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x59d2c9
mov eax, 0x760402
push eax
push 2
mov ebx, 0x138
call fcn.006015c0
add esp, 0x1c
mov dword [ebp - 8], eax
push 0x760400
push dword [ebp - 8]
call fcn.004cce90
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x59d30d
push ebx
call fcn.005fffbe
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x59d347
push 0x760400
push dword [ebp - 4]
mov ecx, 2
call fcn.004c5686
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x59d343
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x59d363
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x59d368
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x59d379
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x59d4c9
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [0x7ad27d], 0
jne 0x59d559
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0
push 6
call dword [0x7ad53d]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x59d51b
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0
push 0
push 0
push 6
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_MapViewOfFile]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x59d554
push 6
call fcn.005fffca
add esp, 4
mov dword [0x7ad27d], eax
cmp dword [0x7ad27d], 0
je 0x59d594
mov dword [ebp - 0xc], esp
push 4
push dword [0x7ad27d]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x59d594
push 6
call fcn.005fffca
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x59d59c
mov esp, ebp
pop ebp
ret 4
Function at 0x59e6a3
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
cmp dword [0x7ad109], 0
jne 0x59e6f6
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
call fcn.004d3900
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x59e6f6
mov eax, 0
jmp 0x59e873
call fcn.0055cbd1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x59e712
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.wsock32.dll_getpeername
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x59e729
mov eax, 0x760403
push eax
push 1
mov ebx, 0x194
call fcn.006031d0
add esp, 0x10
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x760425]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.004c58cd
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esp
push 0
push dword [ebp - 8]
mov eax, dword [ebp - 4]
test eax, eax
je 0x59e771
add eax, 8
push eax
push dword [0x7ad10d]
push dword [0x7ad109]
call dword [sym.imp.kernel32.dll_WriteProcessMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x59e79a
push 6
call fcn.005fffca
add esp, 4
cmp dword [0x7ad109], 0xffffffff
jne 0x59e7b7
push dword [0x7ad10d]
call fcn.004ee84a
jmp 0x59e869
mov dword [ebp - 0x10], esp
push 0
push 4
push 0
push dword [0x7ad10d]
push 0
push 0
push dword [0x7ad109]
call dword [sym.imp.kernel32.dll_CreateRemoteThread]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x59e7fb
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_ResumeThread]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x59e820
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x10], esp
push 0xffffffff
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x59e847
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x59e869
push 6
call fcn.005fffca
add esp, 4
mov eax, 1
jmp 0x59e873
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x59e884
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x5f2e5b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.006082d0
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x5f2ec5
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5f2f38
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.006082d0
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x5f2f2e
push 6
call fcn.005fffca
add esp, 4
jmp 0x5f2f40
mov eax, dword [ebp - 4]
jmp 0x5f2f40
mov esp, ebp
pop ebp
ret 8
Function at 0x5faf0c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 1
push 0
push 0
push 6
push 1
push 2
call dword [sym.imp.ws2_32.dll_WSASocketA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x5faf52
push 6
call fcn.005fffca
add esp, 4
jmp 0x5faf57
mov esp, ebp
pop ebp
ret

Function at 0x5fbc38
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push dword [ebp + 0xc]
call fcn.005fb3d7
mov dword [ebp - 4], eax
fild dword [ebp + 0xc]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x79d624]
fstp qword [ebp - 0x14]
mov dword [ebp - 0x18], esp
push 0
push dword [ebp + 0xc]
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 1
fld qword [ebp - 0x14]
call fcn.004c58cd
push eax
push dword [ebp - 4]
call dword [sym.imp.ws2_32.dll_WSARecv]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x5fbcae
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x5fbcf1
mov dword [ebp - 4], esp
call dword [sym.imp.kernel32.dll_GetLastError]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x5fbcda
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e5
mov eax, 0
sete al
jmp 0x5fbcfb
mov eax, 1
jmp 0x5fbcfb
mov esp, ebp
pop ebp
ret 8

Function at 0x5fbdae
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push dword [ebp + 0xc]
call fcn.005fb3d7
mov dword [ebp - 4], eax
fild dword [ebp + 0xc]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x79d61c]
fstp qword [ebp - 0x14]
mov dword [ebp - 0x18], esp
push 0
push dword [ebp + 0xc]
push 0
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 1
fld qword [ebp - 0x14]
call fcn.004c58cd
push eax
push dword [ebp - 4]
call dword [sym.imp.ws2_32.dll_WSASend]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x5fbe1d
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x5fbe73
mov dword [ebp - 4], esp
call dword [sym.imp.kernel32.dll_GetLastError]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x5fbe49
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e5
jne 0x5fbe5e
jmp 0x5fbe73
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005fbd01
mov eax, 0
jmp 0x5fbe7d
mov eax, 1
jmp 0x5fbe7d
mov esp, ebp
pop ebp
ret 8
Function at 0x601710
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
push eax
call fcn.0060a6c0
mov esi, dword [esp + 0x28]
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ebp, ebp
je 0x6017e1
test ecx, ecx
je 0x6017e1
inc ecx
push ebx
push ecx
call fcn.0061d01f
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0060ee10
mov esi, eax
add esp, 0xc
test esi, esi
je 0x601783
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6017bd
mov ecx, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
jne 0x6017d0
mov eax, dword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.advapi32.dll_RegDeleteKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push ebx
call fcn.0061d048
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
pop edi
pop esi
mov eax, edx
pop ebp
pop ecx
ret