joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5cd8c203
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebx
push esi
push 0x5cd94658
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
test esi, esi
je 0x5cd8c249
cmp dword [0x5cd94764], 0
mov al, byte [0x5cd9466c]
mov byte [0x5cd94772], al
mov al, byte [0x5cd946e8]
mov byte [0x5cd94773], al
mov al, byte [0x5cd946e9]
mov byte [0x5cd94770], al
je 0x5cd8c249
mov al, byte [0x5cd9466d]
mov byte [0x5cd94771], al
xor ebx, ebx
cmp byte [0x5cd94772], bl
je 0x5cd8c26a
push ebx
push ebx
push ebx
push 0x14
call dword [sym.imp.USER32.dll_keybd_event]
push ebx
push 2
push ebx
push 0x14
call dword [sym.imp.USER32.dll_keybd_event]
push edi
cmp byte [0x5cd94773], bl
je 0x5cd8c28d
push ebx
push ebx
push ebx
mov edi, 0x90
push edi
call dword [sym.imp.USER32.dll_keybd_event]
push ebx
push 2
push ebx
push edi
call dword [sym.imp.USER32.dll_keybd_event]
cmp byte [0x5cd94770], bl
je 0x5cd8c2af
push ebx
push ebx
push ebx
mov edi, 0x91
push edi
call dword [sym.imp.USER32.dll_keybd_event]
push ebx
push 2
push ebx
push edi
call dword [sym.imp.USER32.dll_keybd_event]
pop edi
cmp dword [0x5cd94764], ebx
je 0x5cd8c2d7
cmp byte [0x5cd94771], bl
je 0x5cd8c2d7
push ebx
push ebx
push ebx
push 0x15
call dword [sym.imp.USER32.dll_keybd_event]
push ebx
push 2
push ebx
push 0x15
call dword [sym.imp.USER32.dll_keybd_event]
test esi, esi
pop esi
pop ebx
jne 0x5cd8c319
cmp dword [0x5cd94764], 0
mov al, byte [0x5cd94772]
mov byte [0x5cd9466c], al
mov al, byte [0x5cd94773]
mov byte [0x5cd946e8], al
mov al, byte [0x5cd94770]
mov byte [0x5cd946e9], al
je 0x5cd8c30e
mov al, byte [0x5cd94771]
mov byte [0x5cd9466d], al
push 0x5cd94658
call dword [sym.imp.USER32.dll_SetKeyboardState]
ret
Function at 0x5cd8dbf2
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edx, eax
test edx, edx
jne 0x5cd8dc13
mov eax, 0x80004005
jmp 0x5cd8dc41
cmp byte [edx], 0
push edi
mov edi, edx
je 0x5cd8dc35
mov ecx, edi
inc esi
lea eax, [ecx + 1]
mov dword [ebp - 4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5cd8dc24
sub ecx, dword [ebp - 4]
inc edi
add edi, ecx
cmp byte [edi], al
jne 0x5cd8dc1b
push edx
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5cd8dc45
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
xor eax, eax
push edi
mov dword [ebp - 8], ebx
mov edi, eax
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edx, eax
test edx, edx
jne 0x5cd8dc6c
mov eax, 0x80004005
jmp 0x5cd8dcab
xor eax, eax
push esi
mov esi, edx
cmp word [edx], ax
je 0x5cd8dc9f
xor ebx, ebx
mov ecx, esi
inc edi
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x5cd8dc81
sub ecx, dword [ebp - 4]
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
cmp word [esi], bx
jne 0x5cd8dc78
mov ebx, dword [ebp - 8]
push edx
mov dword [ebx], edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x5cd8dcaf
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x5cd942c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x218], edx
lea edi, [ebp - 0x204]
xor edx, edx
mov dword [ebp - 0x224], eax
push edx
push edx
mov eax, edx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x208], eax
mov ebx, edx
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov esi, eax
test esi, esi
je 0x5cd8dd2e
mov edi, ebx
jle 0x5cd8de6e
movzx esi, si
or esi, 0x80070000
jmp 0x5cd8de6e
mov eax, dword [ebp - 0x20c]
cmp eax, 0x400
ja 0x5cd8de58
mov ecx, dword [ebp - 0x214]
cmp ecx, 0x2000
ja 0x5cd8de58
add eax, 2
add eax, ecx
cmp eax, 0x200
jbe 0x5cd8dd7c
push eax
call fcn.5cd873b0
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x5cd8dd7a
mov edi, dword [ebp - 0x208]
mov esi, 0x8007000e
jmp 0x5cd8de6e
mov edi, ebx
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [ebp - 0x218]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
test esi, esi
je 0x5cd8ddbc
mov edi, dword [ebp - 0x208]
jle 0x5cd8de63
movzx esi, si
or esi, 0x80070000
jmp 0x5cd8de63
mov eax, dword [ebp - 0x20c]
lea ecx, [ebp - 0x214]
inc eax
mov dword [ebp - 0x20c], eax
inc eax
push ecx
add eax, edi
push eax
lea eax, [ebp - 0x220]
push eax
push 0
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [ebp - 0x218]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
test esi, esi
jne 0x5cd8dda2
mov eax, dword [ebp - 0x20c]
mov byte [eax + edi], 0x3d
cmp dword [ebp - 0x220], 1
je 0x5cd8de24
cmp dword [ebp - 0x220], 2
je 0x5cd8de24
mov eax, dword [ebp - 0x20c]
mov byte [eax + edi + 1], 0
lea edx, [ebp - 0x210]
mov ecx, edi
call fcn.5cd8b647
mov esi, eax
test esi, esi
js 0x5cd8de50
mov ecx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x210]
and dword [ebp - 0x208], 0
xor esi, esi
mov dword [ecx], eax
jmp 0x5cd8de5d
mov edi, dword [ebp - 0x210]
jmp 0x5cd8de63
mov esi, 0x8007000e
mov edi, dword [ebp - 0x208]
test ebx, ebx
je 0x5cd8de6e
push ebx
call fcn.5cd873d9
pop ecx
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.5cd87900
leave
ret 4
Function at 0x5cd8de88
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5cd942c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, ecx
mov dword [ebp - 0x410], edx
mov ecx, dword [ebp + 8]
lea edi, [ebp - 0x404]
xor edx, edx
mov dword [ebp - 0x41c], ecx
push edx
push edx
lea ecx, [ebp - 0x40c]
mov dword [ebp - 0x414], eax
push ecx
lea ecx, [ebp - 0x408]
mov ebx, edx
push ecx
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
test esi, esi
je 0x5cd8def9
jle 0x5cd8e02d
movzx esi, si
or esi, 0x80070000
jmp 0x5cd8e02d
mov eax, dword [ebp - 0x408]
cmp eax, 0x400
ja 0x5cd8e01d
mov ecx, dword [ebp - 0x40c]
cmp ecx, 0x2000
ja 0x5cd8e01d
lea edx, [ecx + 2]
add edx, eax
push 2
pop esi
cmp edx, 0x200
jbe 0x5cd8df58
xor ecx, ecx
mov eax, edx
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.5cd873b0
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x5cd8df50
mov esi, 0x8007000e
jmp 0x5cd8e02d
mov eax, dword [ebp - 0x408]
mov edi, ebx
inc eax
mov dword [ebp - 0x408], eax
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x408]
push eax
push edi
push dword [ebp - 0x410]
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
je 0x5cd8df99
jle 0x5cd8e022
movzx esi, si
or esi, 0x80070000
jmp 0x5cd8e022
mov eax, dword [ebp - 0x408]
lea ecx, [ebp - 0x40c]
inc eax
push ecx
mov dword [ebp - 0x408], eax
lea eax, [edi + eax*2]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
lea eax, [ebp - 0x408]
push eax
push edi
push dword [ebp - 0x410]
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
jne 0x5cd8df85
mov eax, dword [ebp - 0x408]
push 0x3d
pop ecx
mov word [edi + eax*2], cx
cmp dword [ebp - 0x418], 1
je 0x5cd8e006
cmp dword [ebp - 0x418], 2
je 0x5cd8e006
mov eax, dword [ebp - 0x408]
xor ecx, ecx
mov word [edi + eax*2 + 2], cx
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x5cd8e01d
mov ecx, dword [ebp - 0x41c]
xor esi, esi
mov dword [ecx], eax
jmp 0x5cd8e022
mov esi, 0x8007000e
test ebx, ebx
je 0x5cd8e02d
push ebx
call fcn.5cd873d9
pop ecx
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.5cd87900
leave
ret 4
Function at 0x5cd8e8ec
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5cd942c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, ecx
mov dword [ebp - 0x21c], eax
and dword [ebp - 0x20c], 0
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
mov dword [ebp - 0x218], ecx
lea ebx, [ebp - 0x204]
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x210], edx
xor edx, edx
push edx
push edx
mov dword [ecx], edx
mov dword [ebp - 0x220], ecx
lea ecx, [ebp - 0x208]
push ecx
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push dword [eax + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov esi, eax
test esi, esi
jle 0x5cd8e968
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x5cd8ea5d
mov eax, dword [ebp - 0x208]
mov esi, pe_nt_image_headers32
inc eax
mov dword [ebp - 0x208], eax
cmp eax, esi
jbe 0x5cd8e99d
push eax
call fcn.5cd873b0
mov edi, eax
pop ecx
test edi, edi
jne 0x5cd8e99b
mov esi, 0x8007000e
jmp 0x5cd8ea5d
mov ebx, edi
mov ecx, dword [ebp - 0x218]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
lea edx, [ebp - 0x104]
call fcn.5cd8b6d1
mov esi, eax
test esi, esi
js 0x5cd8ea3d
lea eax, [ebp - 0x208]
push eax
push ebx
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push dword [ebp - 0x210]
push dword [eax + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, 2
jne 0x5cd8ea00
xor eax, eax
mov byte [ebx], 0
xor esi, esi
inc eax
mov dword [ebp - 0x214], eax
jmp 0x5cd8ea06
mov eax, dword [ebp - 0x214]
test esi, esi
jle 0x5cd8ea15
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x5cd8ea3d
cmp eax, 1
je 0x5cd8ea28
cmp eax, 2
je 0x5cd8ea28
mov esi, 0x80004005
jmp 0x5cd8ea3d
mov edx, dword [ebp - 0x220]
mov ecx, ebx
call fcn.5cd8b647
mov esi, eax
test esi, esi
js 0x5cd8ea3d
xor esi, esi
cmp dword [ebp - 0x20c], 0
je 0x5cd8ea52
push dword [ebp - 0x20c]
call fcn.5cd873d9
pop ecx
test edi, edi
je 0x5cd8ea5d
push edi
call fcn.5cd873d9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.5cd87900
leave
ret 8
Function at 0x5cd8ea70
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5cd942c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push pe_nt_image_headers32
lea eax, [ebp - 0x204]
mov dword [ebp - 0x20c], edx
push eax
xor edi, edi
mov dword [ebp - 0x208], ecx
push ecx
mov esi, edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
cmp ebx, 0x100
jb 0x5cd8eaef
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.5cd873b0
mov esi, eax
pop ecx
test esi, esi
jne 0x5cd8ead7
mov edi, 0x8007000e
jmp 0x5cd8eb1e
push ebx
push esi
push dword [ebp - 0x208]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, ebx
jae 0x5cd8eb0e
mov ebx, eax
mov eax, esi
jmp 0x5cd8eaf5
lea eax, [ebp - 0x204]
xor ecx, ecx
push eax
mov word [eax + ebx*2], cx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp - 0x20c]
mov dword [ecx], eax
test eax, eax
jne 0x5cd8eb13
mov edi, 0x8007000e
test esi, esi
je 0x5cd8eb1e
push esi
call fcn.5cd873d9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.5cd87900
leave
ret
Function at 0x5cd8eb2f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5cd942c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edx, edx
lea ebx, [ebp - 0x204]
mov eax, ecx
mov edi, edx
mov ecx, dword [ebp + 8]
push edx
push edx
mov dword [ebp - 0x214], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], eax
mov dword [ecx], edx
lea ecx, [ebp - 0x208]
push ecx
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push dword [eax + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
test esi, esi
jle 0x5cd8eb98
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x5cd8ec73
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
push 2
pop edx
cmp eax, 0x100
jbe 0x5cd8ebdf
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.5cd873b0
mov edi, eax
pop ecx
test edi, edi
jne 0x5cd8ebd7
mov esi, 0x8007000e
jmp 0x5cd8ec73
mov eax, dword [ebp - 0x208]
mov ebx, edi
add eax, eax
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x218]
push 0
push dword [ebp - 0x214]
push dword [eax + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 2
jne 0x5cd8ec24
xor eax, eax
xor esi, esi
mov word [ebx], ax
inc eax
mov dword [ebp - 0x20c], eax
jmp 0x5cd8ec2a
mov eax, dword [ebp - 0x20c]
test esi, esi
jle 0x5cd8ec39
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x5cd8ec68
cmp eax, 1
je 0x5cd8ec4c
cmp eax, 2
je 0x5cd8ec4c
mov esi, 0x80004005
jmp 0x5cd8ec68
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp - 0x21c]
mov dword [ecx], eax
test eax, eax
jne 0x5cd8ec66
mov esi, 0x8007000e
jmp 0x5cd8ec68
xor esi, esi
test edi, edi
je 0x5cd8ec73
push edi
call fcn.5cd873d9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.5cd87900
leave
ret 8
Function at 0x5cd8eec6
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5cd942c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x214]
push esi
push edi
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push eax
xor edi, edi
push pe_nt_image_headers32
mov dword [ebp - 0x208], edi
mov dword [ebp - 0x20c], edi
call fcn.5cd8b6d1
mov esi, eax
test esi, esi
js 0x5cd8ef96
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
lea eax, [ebp - 0x208]
push eax
push pe_nt_image_headers32
lea edx, [ebp - 0x204]
call fcn.5cd8b6d1
mov esi, eax
test esi, esi
js 0x5cd8ef90
mov edx, dword [ebp - 0x210]
test edx, edx
je 0x5cd8ef5c
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5cd8ef51
sub ecx, esi
jmp 0x5cd8ef5e
mov ecx, edi
lea eax, [ecx + 1]
push eax
mov eax, dword [ebp - 0x218]
push edx
push 2
push edi
push dword [ebp - 0x214]
push dword [eax + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
jle 0x5cd8ef8c
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x5cd8ef90
mov esi, edi
mov edi, dword [ebp - 0x208]
cmp dword [ebp - 0x20c], 0
je 0x5cd8efab
push dword [ebp - 0x20c]
call fcn.5cd873d9
pop ecx
test edi, edi
je 0x5cd8efb6
push edi
call fcn.5cd873d9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.5cd87900
leave
ret 8

Function at 0x5cd8efed
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, ecx
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
je 0x5cd8f015
mov edx, dword [ebp + 0xc]
push ebx
lea ebx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x5cd8f003
sub edx, ebx
sar edx, 1
pop ebx
jmp 0x5cd8f017
mov edx, ecx
lea eax, [edx*2 + 2]
push eax
push dword [ebp + 0xc]
push 2
push ecx
push dword [ebp + 8]
push dword [edi + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
test eax, eax
jle 0x5cd8f03e
movzx eax, ax
or eax, 0x80070000
pop ebp
ret 8
Function at 0x5cd8fd5b
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x5cd942c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x218], eax
push edi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x250], 0x44
push eax
mov esi, edx
mov dword [ebp - 0x24c], ebx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x208]
mov edi, ecx
mov dword [ebp - 0x214], edx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x204]
push eax
mov dword [ebp - 0x210], ecx
mov ecx, esi
push 0x200
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], pe_nt_image_headers32
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x208], ebx
call fcn.5cd8b6d1
test eax, eax
js 0x5cd8fe56
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp - 0x20c]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x5cd8fe48
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x5cd8fe56
lea eax, [ebp - 0x260]
mov ecx, edi
push eax
call fcn.5cd88b6c
cmp dword [ebp - 0x208], 0
pop edi
pop esi
pop ebx
je 0x5cd8fe6e
push dword [ebp - 0x208]
call fcn.5cd873d9
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.5cd87900
leave
ret 0xc

Function at 0x5cd8fe7e
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
xor eax, eax
mov dword [ebp - 0x54], 0x44
push esi
mov dword [ebp - 0x24], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x50], edi
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push edx
push edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], pe_nt_image_headers32
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x5cd8ff01
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x5cd8ff12
movzx eax, ax
or eax, 0x80070000
jmp 0x5cd8ff12
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.5cd88b6c
test eax, eax
js 0x5cd8ff12
mov eax, edi
pop edi
pop esi
leave
ret 0xc
Function at 0x5cd904e4
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
push esi
push edi
test eax, eax
jne 0x5cd90500
or esi, 0xffffffff
jmp 0x5cd90506
imul esi, eax, 0x3e8
mov eax, 0x5cd83ca4
mov dword [ebp - 0x1c], eax
test ecx, ecx
je 0x5cd90515
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
test edx, edx
je 0x5cd9051f
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x5cd90820
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x5cd9055c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x5cd9060d
movzx eax, ax
or eax, 0x80070000
jmp 0x5cd9060d
lea eax, [ebp - 0x10]
mov edx, esi
push eax
mov ecx, edi
call fcn.5cd90789
mov esi, dword [ebp - 0x10]
mov ebx, eax
test ebx, ebx
js 0x5cd90594
test esi, esi
jne 0x5cd90594
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
push edi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x5cd9060d
cmp esi, 0x80
jne 0x5cd9059d
int3
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x5cd87340
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_EnumThreadWindows]
mov eax, dword [ebp - 8]
test eax, eax
jle 0x5cd905e7
push 0
push 0xabcdefbb
push 0x12
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
test eax, eax
jne 0x5cd9059d
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 0x10]
push edi
or dword [ecx], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esi, 0x102
neg esi
sbb esi, esi
and esi, ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x5cd90614
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x5cd942c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x20c], 0
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x218], eax
and dword [eax], edi
mov ebx, edx
lea eax, [ebp - 0x214]
mov dword [ebp - 0x208], edi
push eax
lea eax, [ebp - 0x20c]
push eax
push pe_nt_image_headers32
lea edx, [ebp - 0x104]
call fcn.5cd8b6d1
mov esi, eax
test esi, esi
js 0x5cd90756
test ebx, ebx
jne 0x5cd90678
mov ecx, ebx
jmp 0x5cd906b0
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
lea eax, [ebp - 0x208]
push eax
push pe_nt_image_headers32
lea edx, [ebp - 0x204]
call fcn.5cd8b6d1
mov edi, dword [ebp - 0x208]
mov esi, eax
test esi, esi
js 0x5cd90756
mov ecx, dword [ebp - 0x210]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x254]
push eax
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x248], 0x5cd84198
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x5cd90746
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x5cd90756
movzx esi, si
or esi, 0x80070000
jmp 0x5cd90756
mov ecx, dword [ebp - 0x218]
mov esi, ebx
mov eax, dword [ebp - 0x21c]
mov dword [ecx], eax
cmp dword [ebp - 0x20c], 0
je 0x5cd9076b
push dword [ebp - 0x20c]
call fcn.5cd873d9
pop ecx
test edi, edi
je 0x5cd90776
push edi
call fcn.5cd873d9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.5cd87900
leave
ret 0xc