joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ae96b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0059f353
and dword [ebp - 4], 0
cmp dword [0x6700dc], 0
mov ebx, eax
jne 0x5aea1c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5aeacd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5fb8dc
push edi
call esi
test eax, eax
je 0x5aeacd
push eax
call fcn.0059f2e1
mov dword [esp], 0x5fb198
push edi
mov dword [0x6700dc], eax
call esi
push eax
call fcn.0059f2e1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x6700e0], eax
call esi
push eax
call fcn.0059f2e1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x6700e4], eax
call esi
push eax
call fcn.0059f2e1
pop ecx
mov dword [0x6700ec], eax
test eax, eax
je 0x5aea1c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0059f2e1
pop ecx
mov dword [0x6700e8], eax
mov eax, dword [0x6700e8]
cmp eax, ebx
je 0x5aea74
cmp dword [0x6700ec], ebx
je 0x5aea74
push eax
call fcn.0059f35c
push dword [0x6700ec]
mov esi, eax
call fcn.0059f35c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5aea74
test edi, edi
je 0x5aea74
call esi
test eax, eax
je 0x5aea6b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5aea6b
test byte [ebp - 0xc], 1
jne 0x5aea74
or dword [ebp + 0x10], 0x200000
jmp 0x5aeaad
mov eax, dword [0x6700e0]
cmp eax, ebx
je 0x5aeaad
push eax
call fcn.0059f35c
pop ecx
test eax, eax
je 0x5aeaad
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5aeaad
mov eax, dword [0x6700e4]
cmp eax, ebx
je 0x5aeaad
push eax
call fcn.0059f35c
pop ecx
test eax, eax
je 0x5aeaad
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x6700dc]
call fcn.0059f35c
pop ecx
test eax, eax
je 0x5aeacd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5aeacf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5b6a00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5cc8b3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x66a8c4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x67010c
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x67010c
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x6021c6
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.005b9a50
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x5bdf70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x5be410
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0xc]
test eax, eax
jne 0x5be453
mov ecx, dword [ebp - 4]
mov byte [ecx + 0xc], 1
mov edx, dword [ebp - 4]
add edx, 8
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x5be360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x5be590
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x28]
or edx, 0x20019
push edx
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.00403c80
push eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5be5fb
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.00403c80
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 5], al
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret 4

Function at 0x5be800
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.005be4f0
movzx eax, al
test eax, eax
jne 0x5be81a
xor al, al
jmp 0x5be853
mov ecx, dword [ebp + 0xc]
call fcn.00414da0
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00403c80
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
call fcn.00403c80
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x5be851
xor al, al
jmp 0x5be853
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x5beb40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cd35b
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x44]
call fcn.005be4f0
movzx eax, al
test eax, eax
jne 0x5beb9a
mov ecx, dword [ebp + 8]
call fcn.00403ca0
mov ecx, dword [ebp - 0x40]
or ecx, 1
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp + 8]
jmp 0x5bec98
lea edx, [ebp - 0x14]
push edx
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00403c80
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5bebd2
cmp dword [ebp - 0x10], 1
je 0x5bebeb
cmp dword [ebp - 0x10], 2
je 0x5bebeb
cmp dword [ebp - 0x10], 6
je 0x5bebeb
mov ecx, dword [ebp + 8]
call fcn.00403ca0
mov eax, dword [ebp - 0x40]
or eax, 1
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
jmp 0x5bec98
cmp dword [ebp - 0x14], 0
jbe 0x5bec84
mov ecx, dword [ebp - 0x14]
add ecx, 1
push ecx
lea ecx, [ebp - 0x3c]
call fcn.004088b0
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00587180
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00403c80
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004088f0
mov byte [eax], 0
lea ecx, [ebp - 0x3c]
call fcn.00587180
push eax
lea ecx, [ebp - 0x34]
call fcn.00404560
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403cd0
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00403d10
mov eax, dword [ebp + 8]
jmp 0x5bec98
mov ecx, dword [ebp + 8]
call fcn.00403ca0
mov eax, dword [ebp - 0x40]
or eax, 1
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret 8
Function at 0x5bef00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x5bef1f
cmp dword [ebp + 0xc], 0
jne 0x5bef26
xor eax, eax
jmp 0x5bf043
lea eax, [ebp - 0x400]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x5bf033
mov dword [ebp - 8], 0
jmp 0x5bef52
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, word [ebp + edx*2 - 0x400]
test eax, eax
je 0x5bf033
push 0x601ee8
mov ecx, dword [ebp - 8]
lea edx, [ebp + ecx*2 - 0x400]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x5bef99
push 0x601ef0
mov eax, dword [ebp - 8]
lea ecx, [ebp + eax*2 - 0x400]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x5bef9b
jmp 0x5bef49
mov edx, dword [ebp - 8]
mov ax, word [ebp + edx*2 - 0x400]
mov word [ebp - 0x14], ax
mov ecx, dword [ebp - 8]
mov dx, word [ebp + ecx*2 - 0x3fe]
mov word [ebp - 0x12], dx
xor eax, eax
mov word [ebp - 0x10], ax
push 0x64
lea ecx, [ebp - 0x4c8]
push ecx
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x5befda
xor eax, eax
jmp 0x5bf043
lea eax, [ebp - 0x4c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x4c8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005992c2
add esp, 0xc
test eax, eax
jne 0x5bf02e
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, 1
jmp 0x5bf043
jmp 0x5bef49
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret

Function at 0x5bf1a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x5bf1c7
xor al, al
jmp 0x5bf1ed
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
mov esp, ebp
pop ebp
ret
Function at 0x5bf340
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x424], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00591690
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x5bf3f6
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00591690
add esp, 0xc
push 0x208
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp - 0x214]
push eax
call sub.PSAPI.DLL_GetProcessImageFileNameW
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.005bef00
add esp, 8
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004016d0
mov edx, dword [ebp - 0x424]
or edx, 1
mov dword [ebp - 0x424], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret

Function at 0x5bfa60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cced5
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x2c]
call fcn.00403ca0
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x5bfb04
mov dword [ebp - 0x38], 1
mov ecx, dword [ebp + 0x18]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00401590
lea edx, [ebp + 0x18]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00401570
push eax
lea eax, [ebp - 0x38]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x2c]
call fcn.00401570
push eax
mov ecx, dword [ebp + 8]
call fcn.00404560
mov ecx, dword [ebp - 0x3c]
or ecx, 1
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403d10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret
Function at 0x5bfb50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ccf1a
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x2c]
call fcn.00403ca0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x5bfc46
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x48]
call fcn.00404560
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x88], ecx
mov byte [ebp - 4], 1
push 0x601eb8
mov edx, dword [ebp - 0x88]
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.004031b0
add esp, 0xc
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x90]
push eax
lea ecx, [ebp - 0x80]
push ecx
call fcn.004031b0
add esp, 0xc
mov dword [ebp - 0x94], eax
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x98], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x98]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004013f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x80]
call fcn.00403d10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.00403d10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00403d10
jmp 0x5bfc52
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00403c60
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00403c80
push eax
push 0x601ebc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403d10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret
Function at 0x5bff70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ccf7a
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x244], 0
push 0x228
push 0
lea eax, [ebp - 0x240]
push eax
call fcn.00591690
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x5bffd4
xor al, al
jmp 0x5c006f
mov dword [ebp - 0x244], 0x22c
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x5c0063
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x260]
push ecx
call fcn.005bfd30
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
call fcn.00403c80
push eax
lea ecx, [ebp - 0x260]
call fcn.00403c80
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x5c003d
lea edx, [ebp - 0x23c]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00401980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.00403d10
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x5bfff2
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret

Function at 0x5c0090
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 0
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.00591690
add esp, 0xc
push 0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x110]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404560
mov ecx, dword [ebp - 0x114]
or ecx, 1
mov dword [ebp - 0x114], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret
Function at 0x5c05c0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
call fcn.005c0380
add esp, 4
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x20]
call fcn.00401790
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5c061c
push 3
push 0
mov ecx, dword [ebp + 8]
call fcn.00401790
push eax
lea ecx, [ebp - 0x20]
call fcn.00401790
push eax
push 0x601ff0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x20
jae 0x5c0641
push 3
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.00401790
push eax
push 0x601ffc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x20
jae 0x5c0669
push 3
push 0
mov ecx, dword [ebp + 8]
call fcn.00401790
push eax
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x20
sbb ecx, ecx
add ecx, 1
mov byte [ebp - 0x25], cl
lea ecx, [ebp - 0x20]
call fcn.00401750
mov al, byte [ebp - 0x25]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret

Function at 0x5c0690
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x5c06f6
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x20]
add eax, 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
cmp ecx, 0x186a0
jl 0x5c06dd
push 0
mov ecx, dword [ebp - 4]
call fcn.005ba290
mov ecx, dword [ebp - 4]
call fcn.005ba2c0
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [ebp - 4]
mov dword [eax + 0x20], 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00595890
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.005ba2f0
mov esp, ebp
pop ebp
ret 4

Function at 0x5c0fb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x44], ecx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.004176e0
jmp 0x5c0fdf
push 0
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 8]
call fcn.00417b70
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp + 8]
call fcn.004158a0
push eax
lea ecx, [ebp - 8]
call fcn.00415c50
movzx eax, al
test eax, eax
je 0x5c105f
lea ecx, [ebp - 8]
call fcn.00415c80
mov ecx, eax
call fcn.00403c80
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3c], esp
push eax
push ecx
call fcn.005bf430
add esp, 8
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x28]
push edx
call fcn.00418fe0
add esp, 0x20
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x28]
call fcn.00401790
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5c1052
mov byte [ebp - 0x3d], 0
lea ecx, [ebp - 0x28]
call fcn.00401750
mov al, byte [ebp - 0x3d]
jmp 0x5c1061
lea ecx, [ebp - 0x28]
call fcn.00401750
jmp 0x5c0fd1
mov al, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret 4
Function at 0x5c1080
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x44], ecx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.004176e0
jmp 0x5c10af
push 0
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 8]
call fcn.00417b70
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp + 8]
call fcn.004158a0
push eax
lea ecx, [ebp - 8]
call fcn.00415c50
movzx eax, al
test eax, eax
je 0x5c112f
lea ecx, [ebp - 8]
call fcn.00415c80
mov ecx, eax
call fcn.00403c80
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3c], esp
push eax
push ecx
call fcn.005bf430
add esp, 8
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x28]
push edx
call fcn.00418fe0
add esp, 0x20
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x28]
call fcn.00401790
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5c1122
mov byte [ebp - 0x3d], 0
lea ecx, [ebp - 0x28]
call fcn.00401750
mov al, byte [ebp - 0x3d]
jmp 0x5c1131
lea ecx, [ebp - 0x28]
call fcn.00401750
jmp 0x5c10a1
mov al, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret 4

Function at 0x5c23c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x13c], 0
mov byte [ebp - 0x138], 0
push 0x12b
push 0
lea eax, [ebp - 0x137]
push eax
call fcn.00591690
add esp, 0xc
mov ecx, dword [ebp - 0x140]
call fcn.00403c80
push eax
push 0x12c
lea ecx, [ebp - 0x138]
push ecx
push 0
mov ecx, dword [ebp + 0x10]
call fcn.00403c80
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00403c80
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
lea edx, [ebp - 0x138]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404560
mov eax, dword [ebp - 0x13c]
or eax, 1
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5fde1cea
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x5fe47509
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219