joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b9d40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x715790
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc04
mov cl, byte [str._MY_PATH_]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], 0
mov al, byte [ebx]
mov dword [ebp - 0x10], esp
cmp al, cl
jne 0x5b9ed7
lea ecx, [ebp - 0x410]
push 0x400
push ecx
push ebx
call fcn.005be860
movsx edx, byte [str._MY_PATH_]
add esp, 0xc
lea eax, [ebp - 0x40f]
push edx
push eax
call fcn.004502e0
add esp, 8
test eax, eax
je 0x5b9ed7
push 0xffffffffffffffff
lea ecx, [ebp - 0x410]
push str._MY_PATH_
mov byte [eax + 1], 0
push ecx
mov byte [ebp - 0xc10], 0
call fcn.005be9b0
add esp, 0xc
test eax, eax
jne 0x5b9e86
push 0xffffffffffffffff
lea edx, [ebp - 0x410]
push str._COMMANDER_PATH_
push edx
call fcn.005be9b0
add esp, 0xc
test eax, eax
jne 0x5b9e86
push 0xffffffffffffffff
lea eax, [ebp - 0x410]
push str._APPDATA_
push eax
call fcn.005be9b0
add esp, 0xc
test eax, eax
je 0x5b9e6d
lea edi, [ebp - 0x410]
or ecx, 0xffffffff
xor eax, eax
push 0x800
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp - 0xc10], al
mov esi, ecx
lea ecx, [ebp - 0xc10]
push ecx
push 0x1a
call fcn.005bd6c0
mov al, byte [ebp - 0xc10]
add esp, 0xc
test al, al
jne 0x5b9e5f
lea edx, [ebp - 0xc10]
push 0x800
push edx
call fcn.005c3540
add esp, 8
lea eax, [ebp - 0xc10]
push 0x800
push eax
jmp 0x5b9ec6
lea ecx, [ebp - 0xc10]
push 0x800
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x5b9ed7
jmp 0x5b9ed1
lea edi, [ebp - 0x410]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xc10]
repne scasb al, byte es:[edi]
not ecx
push 0x800
dec ecx
push edx
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0xc10]
push eax
call fcn.005b9010
add esp, 4
lea ecx, [ebp - 0xc10]
push 0x800
push ecx
add esi, ebx
push esi
call fcn.005be650
add esp, 0xc
lea ebx, [ebp - 0xc10]
mov esi, dword [ebp + 0xc]
cmp ebx, esi
je 0x5b9eec
mov edx, dword [ebp + 0x10]
push edx
push esi
push ebx
call fcn.005be860
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
push esi
call fcn.005b98a0
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5bb300
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x800
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
lea eax, [esp + 0x10]
push 0x400
xor ebx, ebx
push eax
mov ebp, ecx
push str._U3_HOST_EXEC_PATH_
mov edi, 1
mov byte [esp + 0x1c], bl
call esi
mov cl, byte [esp + 0x10]
mov al, byte [str._U3_HOST_EXEC_PATH_]
cmp cl, al
jne 0x5bb341
mov byte [esp + 0x10], bl
jmp 0x5bb3b0
lea edx, [esp + 0x410]
push 0x400
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x410]
push eax
push ecx
mov byte [esp + 0x18], bl
call fcn.005ba000
add esp, 8
test eax, eax
je 0x5bb3aa
lea edx, [esp + 0x10]
push 0x400
push edx
push str._U3_APP_DATA_PATH_
call esi
mov al, byte [esp + 0x10]
mov cl, byte [str._U3_HOST_EXEC_PATH_]
cmp al, cl
jne 0x5bb397
mov byte [esp + 0x10], bl
jmp 0x5bb3b0
lea ecx, [esp + 0x10]
push ecx
call fcn.0041b6d0
add esp, 4
test eax, eax
je 0x5bb391
xor edi, edi
cmp byte [esp + 0x10], bl
jne 0x5bb3cb
lea edx, [esp + 0x10]
push 0x400
push edx
push ebx
call fcn.005b9f90
mov al, byte [esp + 0x1c]
add esp, 0xc
cmp al, bl
je 0x5bb41a
cmp edi, ebx
jne 0x5bb3dc
lea eax, [esp + 0x10]
push eax
call fcn.005b9010
add esp, 4
lea ecx, [esp + 0x410]
push 0x400
push ecx
mov ecx, ebp
call fcn.005bb450
lea edx, [esp + 0x10]
push 0x400
lea eax, [esp + 0x414]
push edx
push eax
call fcn.005b9140
add esp, 4
lea ecx, [esp + eax + 0x418]
push ecx
call fcn.005be7c0
add esp, 0xc
mov edx, dword [esp + 0x818]
mov eax, dword [esp + 0x814]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.005be860
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret 8

Function at 0x5bd620
Capabilities:
Get common file path

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push ecx
push 0
mov dword [esp + 0xc], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x5bd643
xor eax, eax
pop ecx
ret
mov eax, dword [esp]
pop ecx
ret
Function at 0x5bd860
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x715880
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x808
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
push eax
push 0x75b568
push 1
push 0
push 0x75b558
mov dword [ebp - 4], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x5bd979
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x5bd8cb
mov eax, dword [ebp - 0x14]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x5bd8ee
cmp byte [eax], 0
je 0x5bd8ee
mov ecx, dword [ebp - 0x14]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x5bd922
xor eax, eax
mov ax, word [ecx]
dec eax
je 0x5bd90e
dec eax
je 0x5bd907
mov eax, 5
jmp 0x5bd913
mov eax, 3
jmp 0x5bd913
mov eax, 7
mov ecx, dword [ebp - 0x14]
and eax, 0xffff
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x3c]
mov eax, dword [ebp - 0x14]
lea edx, [ebp + 0xc]
push edx
push 0x75b548
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x5bd970
mov ecx, dword [ebp + 8]
push 0
lea eax, [ebp - 0x814]
push 0x400
push eax
push ecx
call fcn.005be3b0
mov eax, dword [ebp + 0xc]
add esp, 0x10
lea ecx, [ebp - 0x814]
mov edx, dword [eax]
push 1
push ecx
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5bdd00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7158a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x464
push ebx
push esi
push edi
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x470]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
push eax
lea eax, [ebp - 0x6c]
push 0x20
push eax
push str.properties
mov dword [ebp - 4], 0
call fcn.005be430
mov edx, dword [ebp + 0x10]
add esp, 0x10
lea ecx, [ebp - 0x470]
push 0x400
push ecx
push edx
call fcn.005be650
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x470]
lea eax, [ebp - 0x6c]
add esp, 0xc
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x4c]
push ecx
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], 0xc
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x2c], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x5bddc4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
call fcn.005c4990
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5bde00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7158b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x8444
call fcn.00450100
push ebx
push esi
push edi
mov ecx, 0x2000
xor eax, eax
lea edi, [ebp - 0x8454]
rep stosd dword es:[edi], eax
mov ebx, dword [ebp + 0x18]
xor esi, esi
stosb byte es:[edi], al
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x10], esp
test bl, 0x80
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
je 0x5bde5d
mov esi, 1
and ebx, 0xff7f
cmp bx, 5
jne 0x5bde68
mov ebx, 1
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x8454]
push 0x8000
push eax
push ecx
call fcn.005be650
mov ecx, dword [ebp + 0x10]
add esp, 0xc
test ecx, ecx
jne 0x5bdec7
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x450]
lea edx, [ebp - 0x450]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x401
lea eax, [ebp - 0x8454]
push edx
push eax
call fcn.005be650
add esp, 0xc
lea ecx, [ebp - 0x450]
push ecx
call fcn.005b9010
add esp, 4
lea ecx, [ebp - 0x450]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x5bded5
cmp byte [eax], 0
jne 0x5bded5
xor eax, eax
mov edx, dword [ebp + 8]
and ebx, 0xffff
mov dword [ebp - 0x44], edx
lea edx, [ebp - 0x8454]
test esi, esi
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], ebx
je 0x5bdf16
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x40], str.runas
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x5bdf20
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5bdf40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7158c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x848
push ebx
push esi
push edi
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x450]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x854]
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x4c]
push 0x400
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x450]
mov dword [ebp - 4], 0
push eax
push str.notepad.exe
call fcn.005be650
mov edx, dword [ebp + 0xc]
add esp, 0xc
lea ecx, [ebp - 0x854]
push 0x400
push ecx
push edx
call fcn.005be650
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x450]
lea edx, [ebp - 0x854]
push eax
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x30], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5be010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7158d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
push esi
lea eax, [ebp - 0x58]
push 0x40
push eax
push ecx
mov dword [ebp - 4], esi
call fcn.005be430
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x58]
push 1
push esi
push esi
push edx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cdq
cmp edx, esi
ja 0x5be06b
cmp eax, 0x7fffffff
jbe 0x5be08d
mov eax, 0x7c5
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c3540
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x5c3566
mov al, byte [0x77f950]
push esi
push edi
push eax
call fcn.005b24c0
add esp, 0xc
pop edi
pop esi
ret

Function at 0x5c3570
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x1c
call fcn.005c4e00
test al, al
je 0x5c3607
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
je 0x5c35ea
lea ecx, [esp]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x5c35ea
lea edx, [esp + 4]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x5c35ea
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
lea edx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 8]
push 0x10
push edx
push 0
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call fcn.005c4e00
cmp al, 0x6e
jne 0x5c3607
push 0
push 1
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
test eax, eax
jne 0x5c3614
push SysReAllocString
push 0xd
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x1c
ret

Function at 0x5c3fd0
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret

Function at 0x5c4560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x715a10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x404
mov eax, dword [0x7c70a4]
push ebx
push esi
xor ecx, ecx
push edi
cmp eax, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], ecx
je 0x5c45b4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
push eax
call fcn.005be860
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x410]
push 0x400
push eax
push ecx
mov byte [ebp - 0x410], cl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x410]
push ecx
call fcn.005b9120
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
add esp, 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x410]
push edx
call fcn.005b9140
add esp, 4
lea eax, [ebp + eax - 0x410]
push edi
push esi
push eax
call fcn.005be7c0
jmp 0x5c45a0
Function at 0x5c4760
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
push eax
xor esi, esi
call dword [sym.imp.USER32.dll_OpenClipboard]
mov edi, dword [sym.imp.USER32.dll_GetClipboardData]
push 0xd
call edi
mov ebp, eax
test ebp, ebp
je 0x5c47b2
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x5c47f4
push ebx
call fcn.00450270
mov edi, eax
inc edi
push edi
call fcn.005c3430
mov esi, eax
add esp, 8
test esi, esi
je 0x5c47f4
push 0
push edi
push esi
push ebx
call fcn.005be3f0
jmp 0x5c47f1
push 1
call edi
mov ebp, eax
test ebp, ebp
je 0x5c47fb
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x5c47f4
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
inc edi
push edi
call fcn.005c3430
mov esi, eax
add esp, 4
test esi, esi
je 0x5c47f4
push 0
push edi
push esi
push ebx
call fcn.005be430
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x5c4810
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x5c488d
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
je 0x5c488d
lea edi, [ebp + 1]
push edi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x5c488d
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x5c4861
mov eax, dword [esp + 0x18]
push 0
push edi
push esi
push eax
call fcn.005be430
add esp, 0x10
mov byte [esi + ebp], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop esi
je 0x5c488d
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
pop ebx
ret

Function at 0x5c48a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
je 0x5c4917
lea edi, [ebp + 1]
push edi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x5c4917
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x5c48eb
mov eax, dword [esp + 0x18]
push edi
push esi
push eax
call fcn.005be890
add esp, 0xc
mov byte [esi + ebp], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop esi
je 0x5c4917
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
pop ebx
ret
Function at 0x5c4ab0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x5c4b07
push edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x5c4aed
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
xor edi, edi
call fcn.005b2860
add esp, 4
mov eax, edi
pop edi
pop esi
ret
push 5
call fcn.005c4990
add esp, 4
mov edi, eax
push esi
call fcn.005b2860
add esp, 4
mov eax, edi
pop edi
pop esi
ret
push 5
call fcn.005c4990
add esp, 4
pop esi
ret

Function at 0x5c4bc0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x5c4bfd
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
mov eax, dword [esp + 0x18]
pop edi
cmp eax, 2
pop esi
jne 0x5c4d5d
mov ecx, dword [esp + 4]
lea eax, [ecx - 4]
cmp eax, 6
ja case.0x5c4c1c.7
jmp dword [eax*4 + 0x5c4dac]
mov eax, 6
add esp, 0x9c
ret
mov eax, dword [esp + 8]
sub eax, 0
je 0x5c4c90
sub eax, 2
je 0x5c4c49
mov eax, 8
add esp, 0x9c
ret
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x5c4c61
mov eax, 0xc
add esp, 0x9c
ret
mov eax, dword [esp + 0x98]
test ah, 0x80
je 0x5c4c79
mov eax, 0xb
add esp, 0x9c
ret
mov al, byte [esp + 0x9a]
dec al
neg al
sbb eax, eax
add eax, 0xa
add esp, 0x9c
ret
mov eax, 7
add esp, 0x9c
ret
mov eax, dword [esp + 8]
cmp eax, 3
ja case.default.0x5c4ca9
jmp dword [eax*4 + 0x5c4dc8]
mov al, byte [esp + 0x9a]
dec al
neg al
sbb eax, eax
add eax, 0xe
add esp, 0x9c
ret
mov al, byte [esp + 0x9a]
dec al
neg al
sbb eax, eax
add eax, 0x10
add esp, 0x9c
ret
mov al, byte [esp + 0x9a]
dec al
neg al
sbb eax, eax
add eax, 0x12
add esp, 0x9c
ret
mov dl, byte [esp + 0x9a]
xor eax, eax
cmp dl, 1
setne al
add eax, 0x13
add esp, 0x9c
ret
mov eax, dword [esp + 8]
test eax, eax
jne case.default.0x5c4ca9
cmp byte [esp + 0x9a], 1
jne 0x5c4d34
cmp dword [esp + 0xc], 0x4e20
sbb eax, eax
add eax, 0x17
add esp, 0x9c
ret
mov eax, 0x15
add esp, 0x9c
ret
cmp ecx, 4
jae case.default.0x5c4ca9
mov eax, 5
add esp, 0x9c
ret
mov eax, 0x18
add esp, 0x9c
ret
test eax, eax
jne 0x5c4d6d
mov eax, 1
add esp, 0x9c
ret
cmp dword [esp + 4], 4
jne 0x5c4d9d
mov eax, dword [esp + 8]
cmp eax, 0xa
jne 0x5c4d93
cmp dword [esp + 0xc], 0x7ce
jne 0x5c4d9d
mov eax, 3
add esp, 0x9c
ret
cmp eax, 0x5a
mov eax, 4
je 0x5c4da2
mov eax, 2
add esp, 0x9c
ret
Function at 0x5d3800
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x28
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x38]
push edi
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x14], 0x3e8
mov bl, byte [esi]
mov edi, eax
shr edi, 0x13
shr eax, 0x11
and edi, 1
and eax, 1
cmp bl, 0xa8
mov dword [esp + 0x10], eax
mov byte [esp + 0x40], bl
jae 0x5d3a0f
cmp bl, 0x21
jb 0x5d3918
cmp bl, 0x61
ja 0x5d3918
mov eax, dword [esp + 0x40]
push eax
call fcn.005d3b20
mov cl, 0x21
add esp, 4
sub cl, al
add bl, cl
cmp bl, 0x28
mov byte [esp + 0x40], bl
ja 0x5d3883
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
push ecx
push edi
push esi
call fcn.005d3b60
add esp, 0x14
jmp 0x5d3885
xor eax, eax
cmp bl, 0x21
je 0x5d38a1
cmp bl, 0x23
je 0x5d38a1
cmp bl, 0x25
je 0x5d38a1
cmp bl, 0x27
mov dword [esp + 0x1c], 0
jne 0x5d38a9
mov dword [esp + 0x1c], 1
test eax, eax
je case.default.0x5d398a
lea edx, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
push eax
push ecx
push ebp
push edx
push edi
push eax
call fcn.005d3e00
add esp, 0x1c
test eax, eax
je case.default.0x5d398a
mov eax, dword [esp + 0x40]
and eax, 0xff
add eax, 0xffffffdf
cmp eax, 7
ja case.default.0x5d398a
jmp dword [eax*4 + 0x5d3a24]
add byte [esi], 9
jmp case.default.0x5d398a
add byte [esi], 8
jmp case.default.0x5d398a
add byte [esi], 7
jmp case.default.0x5d398a
add byte [esi], 6
jmp case.default.0x5d398a
add byte [esi], 5
jmp case.default.0x5d398a
cmp bl, 0x6e
je 0x5d392b
cmp bl, 0x6f
je 0x5d392b
cmp bl, 0x70
jne 0x5d39ad
mov bl, byte [esi + 0x21]
cmp bl, 0x62
mov byte [esp + 0x40], bl
jb case.default.0x5d398a
cmp bl, 0x69
ja case.default.0x5d398a
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
push ecx
push edi
push esi
call fcn.005d3b60
lea edx, [esp + 0x28]
lea ecx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
not bl
push ebp
push edx
and ebx, 1
push edi
push eax
mov dword [esp + 0x4c], ebx
call fcn.005d3e00
add esp, 0x30
test eax, eax
je case.default.0x5d398a
mov eax, dword [esp + 0x40]
and eax, 0xff
add eax, 0xffffff9e
cmp eax, 7
ja case.default.0x5d398a
jmp dword [eax*4 + 0x5d3a44]
mov byte [esi + 0x21], 0x6a
jmp case.default.0x5d398a
mov byte [esi + 0x21], 0x6b
jmp case.default.0x5d398a
mov byte [esi + 0x21], 0x6c
jmp case.default.0x5d398a
mov byte [esi + 0x21], 0x6d
mov cl, byte [esi]
mov byte [esp + 0x40], cl
mov ecx, dword [esp + 0x40]
and ecx, 0xff
cmp ecx, 0xa1
ja case.0x5d39c7.5
xor edx, edx
mov dl, byte [ecx + 0x5d3a7c]
jmp dword [edx*4 + 0x5d3a64]
mov al, byte [esi + 1]
jmp 0x5d39d6
mov al, byte [esi + 3]
cmp al, 0x10
je 0x5d39de
cmp al, 0xf
jne case.0x5d39c7.5
add esi, 2
jmp case.0x5d39c7.5
xor eax, eax
mov ah, byte [esi + 5]
mov al, byte [esi + 6]
add esi, eax
jmp case.0x5d39c7.5
xor edx, edx
mov dl, byte [esi + 1]
add esi, edx
xor eax, eax
mov al, byte [ecx + 0x72a44c]
add esi, eax
mov bl, byte [esi]
cmp bl, 0xa8
mov byte [esp + 0x40], bl
jb 0x5d383b
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x28
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
Function at 0x5e1df0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
push edi
mov edx, dword [esi + 4]
mov esi, dword [esi]
test esi, esi
mov edi, ecx
jle 0x5e1e1c
push ebx
mov cl, byte [edx]
mov ebx, eax
shl ebx, 4
and ecx, 0xff
add ebx, eax
add ecx, ebx
inc edx
dec esi
mov eax, ecx
jne 0x5e1e04
pop ebx
xor edx, edx
div dword [edi + 4]
pop edi
pop esi
mov eax, edx
ret 4
Function at 0x5f4340
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
mov dl, byte [esi]
test dl, dl
je 0x5f4367
push edi
mov edi, eax
and edx, 0xff
shl edi, 4
add edi, eax
add edx, edi
inc esi
mov eax, edx
mov dl, byte [esi]
test dl, dl
jne 0x5f434e
pop edi
mov ecx, dword [ecx + 0xc]
xor edx, edx
pop esi
lea ecx, [ecx + ecx - 1]
div ecx
mov eax, edx
ret 4
Function at 0x5f6fe0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
push 0x7abbb0
push 0x779f40
call fcn.006fabb2
add esp, 0xc
push 1
call fcn.00452785
nop
nop
Function at 0x6036b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
mov dl, byte [esi]
test dl, dl
je 0x6036d7
push edi
mov edi, eax
and edx, 0xff
shl edi, 4
add edi, eax
add edx, edi
inc esi
mov eax, edx
mov dl, byte [esi]
test dl, dl
jne 0x6036be
pop edi
xor edx, edx
pop esi
div dword [ecx + 4]
mov eax, edx
ret 4