joyce8/EMBER2024-capa huggingface dataset:
Function at 0x575240
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61ea28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
mov dword [ebp - 0x64], ecx
mov eax, dword [ebp - 0x64]
xor ecx, ecx
cmp dword [eax + 0x18], 0
sete cl
movzx edx, cl
test edx, edx
je 0x575288
push 0x146
push str.c:_build_src_thirdpartypoco_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.0056bd60
add esp, 0xc
lea eax, [ebp - 0x31]
mov dword [ebp - 0x30], eax
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00404d80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00568610
add esp, 8
cmp dword [ebp - 0x10], 8
jb 0x5752bf
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
jmp 0x5752c5
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x64]
add edx, 0x20
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 0x18], 8
jb 0x5752e2
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x6c], edx
jmp 0x5752eb
mov eax, dword [ebp - 0x4c]
add eax, 4
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x68]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x57530c
mov eax, dword [ebp - 0x64]
add eax, 4
push eax
call fcn.00575560
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00404d80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x575330
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax + 0x18], 0
sete cl
movzx edx, cl
test edx, edx
je 0x575363
push 0x151
push str.c:_build_src_thirdpartypoco_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.0056bd60
add esp, 0xc
mov ecx, dword [ebp - 0xc]
call fcn.00574940
movzx eax, al
test eax, eax
je 0x5753b7
mov ecx, dword [ebp - 0xc]
add ecx, 0x20
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 0x18], 8
jb 0x57538f
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
jmp 0x575398
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x5753b5
mov ecx, dword [ebp - 0xc]
add ecx, 4
push ecx
call fcn.00575560
add esp, 4
jmp 0x5753fa
mov edx, dword [ebp - 0xc]
add edx, 0x20
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 8
jb 0x5753d4
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x14], edx
jmp 0x5753dd
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x5753fa
mov edx, dword [ebp - 0xc]
add edx, 4
push edx
call fcn.00575560
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x5754c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp dword [eax + 0x18], 0
sete cl
movzx edx, cl
test edx, edx
je 0x5754f3
push 0x174
push str.c:_build_src_thirdpartypoco_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.0056bd60
add esp, 0xc
mov ecx, dword [ebp - 8]
call fcn.00574630
movzx eax, al
test eax, eax
je 0x575515
mov ecx, dword [ebp - 8]
call fcn.00574940
movzx ecx, al
test ecx, ecx
je 0x575515
xor al, al
jmp 0x57555c
mov edx, dword [ebp - 8]
add edx, 0x20
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 8
jb 0x575532
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xc], edx
jmp 0x57553b
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x57555a
mov edx, dword [ebp - 8]
add edx, 4
push edx
call fcn.00575560
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x58abf0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61ff47
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf0
mov dword [ebp - 0x84], 0
lea eax, [ebp - 0x8d]
mov dword [ebp - 0x8c], eax
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00404d80
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00568610
add esp, 8
cmp dword [ebp - 0x10], 8
jb 0x58ac58
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xf8], eax
jmp 0x58ac61
lea ecx, [ebp - 0x24]
mov dword [ebp - 0xf8], ecx
push 0
push 0
mov edx, dword [ebp - 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x58ac97
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x80]
call fcn.00563bd0
push 0x691bd4
lea ecx, [ebp - 0x80]
push ecx
call fcn.005ecf53
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x50], edx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005df5a2
add esp, 4
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x98], ecx
cmp dword [ebp - 0x10], 8
jb 0x58ace6
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0xfc], edx
jmp 0x58acef
lea eax, [ebp - 0x24]
mov dword [ebp - 0xfc], eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x98]
push edx
mov eax, dword [ebp - 0xfc]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0xa1]
mov dword [ebp - 0xa0], ecx
push 0
push 0
lea ecx, [ebp - 0x48]
call fcn.004028c0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0xb8], edx
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 1
push ecx
mov edx, dword [ebp - 0xb8]
push edx
call fcn.00568a10
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.004028c0
mov eax, dword [0x68013c]
push eax
push 0
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004027b0
mov edx, dword [ebp - 0x84]
or edx, 1
mov dword [ebp - 0x84], edx
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004028c0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xe0], eax
mov ecx, dword [ebp - 0xe0]
push ecx
call fcn.005e06d6
add esp, 4
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00404d80
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x58add0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61ff59
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
lea eax, [ebp - 0x39]
mov dword [ebp - 0x38], eax
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00404d80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00568610
add esp, 8
cmp dword [ebp - 0x10], 8
jb 0x58ae22
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
jmp 0x58ae28
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x68], ecx
push 0
push 0
mov edx, dword [ebp - 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp eax, dword [ebp - 0x2c]
sbb ecx, ecx
neg ecx
mov byte [ebp - 0x2d], cl
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00404d80
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x58ae70
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61ff7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
lea eax, [ebp - 0x99]
mov dword [ebp - 0x98], eax
push 0
push 0
lea ecx, [ebp - 0x44]
call fcn.00404d80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xa5]
mov dword [ebp - 0xa4], ecx
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00404d80
mov byte [ebp - 4], 1
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00568610
add esp, 8
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00568610
add esp, 8
cmp dword [ebp - 0x10], 8
jb 0x58aefa
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x11c], eax
jmp 0x58af03
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x11c], ecx
cmp dword [ebp - 0x2c], 8
jb 0x58af14
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x120], edx
jmp 0x58af1d
lea eax, [ebp - 0x40]
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x58af8c
push str.cannot_set_environment_variable:
lea ecx, [ebp - 0x60]
call fcn.00402730
mov byte [ebp - 4], 2
mov eax, dword [0x68013c]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x60]
call fcn.0040e9a0
push 0
lea edx, [ebp - 0x60]
push edx
lea ecx, [ebp - 0x90]
call fcn.00564200
push 0x6a3798
lea eax, [ebp - 0x90]
push eax
call fcn.005ecf53
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x60]
call fcn.004028c0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00404d80
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.00404d80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x58ba50
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x620016
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x58bb49
lea edx, [ebp - 0xa5]
mov dword [ebp - 0xa4], edx
push 0
push 0
lea ecx, [ebp - 0x98]
call fcn.004028c0
mov dword [ebp - 0x118], str.Cannot_get_computer_name
mov eax, dword [ebp - 0x118]
add eax, 1
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x118]
mov dl, byte [ecx]
mov byte [ebp - 0x11d], dl
add dword [ebp - 0x118], 1
cmp byte [ebp - 0x11d], 0
jne 0x58bac9
mov eax, dword [ebp - 0x118]
sub eax, dword [ebp - 0x11c]
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
push ecx
push str.Cannot_get_computer_name
lea ecx, [ebp - 0x98]
call fcn.00402910
mov dword [ebp - 4], 1
push 0
lea edx, [ebp - 0x98]
push edx
lea ecx, [ebp - 0x7c]
call fcn.00564200
push 0x6a3798
lea eax, [ebp - 0x7c]
push eax
call fcn.005ecf53
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x98]
call fcn.004028c0
lea ecx, [ebp - 0xd5]
mov dword [ebp - 0xd4], ecx
push 0
push 0
lea ecx, [ebp - 0x4c]
call fcn.004028c0
mov dword [ebp - 4], 2
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x30]
push eax
call fcn.00568ac0
add esp, 8
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.004028c0
mov ecx, dword [0x68013c]
push ecx
push 0
lea edx, [ebp - 0x4c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004027b0
mov eax, dword [ebp - 0x9c]
or eax, 1
mov dword [ebp - 0x9c], eax
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.004028c0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x58d320
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x68], 0xffffffff
je 0x58d343
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x48]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
and eax, 1
jne 0x58d348
or eax, 0xffffffff
jmp 0x58d3bc
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x48]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
and eax, 2
je 0x58d366
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x58d3a0
mov eax, dword [ebp - 0x14]
add eax, 0x4c
push eax
call fcn.00576a50
add esp, 4
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 0x14]
add ecx, dword [eax + 0x70]
mov eax, dword [eax + 0x74]
adc eax, edx
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x70], ecx
mov dword [edx + 0x74], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x58d3d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x68], 0xffffffff
je 0x58d3f3
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x48]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
and eax, 2
jne 0x58d3fb
or eax, 0xffffffff
jmp 0x58d4b8
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x48]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
and eax, 8
je 0x58d462
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 2
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x58d453
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x58d453
mov edx, dword [ebp - 0x1c]
add edx, 0x4c
push edx
call fcn.00576a50
add esp, 4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x70], ecx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x74], edx
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x58d49c
mov edx, dword [ebp - 0x1c]
add edx, 0x4c
push edx
call fcn.00576a50
add esp, 4
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
add eax, dword [edx + 0x70]
mov edx, dword [edx + 0x74]
adc edx, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x70], eax
mov dword [ecx + 0x74], edx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x5a3f80
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x621353
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc8
mov dword [ebp - 0xc4], ecx
mov ecx, dword [ebp - 0xc4]
call fcn.00585590
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc4]
mov dword [eax], vtable.Poco::PipeImpl.0
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0xc4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0xc4]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x5a409e
lea ecx, [ebp - 0x6d]
mov dword [ebp - 0x6c], ecx
push 0
push 0
lea ecx, [ebp - 0x64]
call fcn.004028c0
mov dword [ebp - 0xc8], str.anonymous_pipe
mov edx, dword [ebp - 0xc8]
add edx, 1
mov dword [ebp - 0xcc], edx
mov eax, dword [ebp - 0xc8]
mov cl, byte [eax]
mov byte [ebp - 0xcd], cl
add dword [ebp - 0xc8], 1
cmp byte [ebp - 0xcd], 0
jne 0x5a402a
mov edx, dword [ebp - 0xc8]
sub edx, dword [ebp - 0xcc]
mov dword [ebp - 0xd4], edx
mov eax, dword [ebp - 0xd4]
push eax
push str.anonymous_pipe
lea ecx, [ebp - 0x64]
call fcn.00402910
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00566f60
push 0x694a60
lea edx, [ebp - 0x48]
push edx
call fcn.005ecf53
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.004028c0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5c3410
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x58
push 0
mov eax, dword [ebp - 4]
add eax, 4
push eax
call fcn.005e7de0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x5c5430
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x5cca10
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62206c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov dword [ebp - 0x64], ecx
mov eax, dword [ebp - 0x64]
cmp dword [eax + 0x60], 0
jne 0x5cca44
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x64]
mov eax, dword [edx + 0xc]
call eax
lea ecx, [ebp - 0x35]
mov dword [ebp - 0x34], ecx
push 0
push 0
lea ecx, [ebp - 0x2c]
call fcn.00404d80
mov dword [ebp - 4], 0
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
call fcn.00568610
add esp, 8
cmp dword [ebp - 0x14], 8
jb 0x5cca7e
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x68], ecx
jmp 0x5cca84
lea edx, [ebp - 0x28]
mov dword [ebp - 0x68], edx
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x10], eax
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push 1
push 0
push 0x1000
mov edx, dword [ebp + 8]
push edx
call fcn.005ccdc0
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.005ccd60
add esp, 4
push eax
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + 0x60]
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404d80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5d9300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov dword [ebp - 0xa0], ecx
mov eax, dword [ebp - 0xa0]
cmp dword [eax + 0x1c], 0xffffffff
jne 0x5d9326
mov ecx, dword [ebp - 0xa0]
call fcn.005d9560
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x9c], edx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x5d9349
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xa4], edx
jmp 0x5d9355
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 0xa4], eax
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x9c]
push edx
mov eax, dword [ebp - 0xa4]
push eax
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5d93a1
push 0
mov eax, dword [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x38]
call fcn.00567380
push 0x694a70
lea ecx, [ebp - 0x38]
push ecx
call fcn.005ecf53
push 0
lea edx, [ebp - 8]
push edx
push 2
push 0x6862a0
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5d93e6
push 0
mov edx, dword [ebp - 0xa0]
push edx
lea ecx, [ebp - 0x68]
call fcn.00567380
push 0x694a70
lea eax, [ebp - 0x68]
push eax
call fcn.005ecf53
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5d9424
push 0
mov eax, dword [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x98]
call fcn.00567380
push 0x694a70
lea ecx, [ebp - 0x98]
push ecx
call fcn.005ecf53
mov esp, ebp
pop ebp
ret 4

Function at 0x5dfa41
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6cb2e8]
jne 0x5dfa4b
repz ret
jmp fcn.005f01df
Function at 0x5fc943
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005f03bf
and dword [ebp - 4], 0
cmp dword [0x798eb8], 0
mov ebx, eax
jne 0x5fc9f4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x5fcaa5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
test eax, eax
je 0x5fcaa5
push eax
call fcn.005f034d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x798eb8], eax
call esi
push eax
call fcn.005f034d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x798ebc], eax
call esi
push eax
call fcn.005f034d
mov dword [esp], 0x67ce20
push edi
mov dword [0x798ec0], eax
call esi
push eax
call fcn.005f034d
pop ecx
mov dword [0x798ec8], eax
test eax, eax
je 0x5fc9f4
push 0x67ce08
push edi
call esi
push eax
call fcn.005f034d
pop ecx
mov dword [0x798ec4], eax
mov eax, dword [0x798ec4]
cmp eax, ebx
je 0x5fca4c
cmp dword [0x798ec8], ebx
je 0x5fca4c
push eax
call fcn.005f03c8
push dword [0x798ec8]
mov esi, eax
call fcn.005f03c8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5fca4c
test edi, edi
je 0x5fca4c
call esi
test eax, eax
je 0x5fca43
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5fca43
test byte [ebp - 0xc], 1
jne 0x5fca4c
or dword [ebp + 0x10], 0x200000
jmp 0x5fca85
mov eax, dword [0x798ebc]
cmp eax, ebx
je 0x5fca85
push eax
call fcn.005f03c8
pop ecx
test eax, eax
je 0x5fca85
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5fca85
mov eax, dword [0x798ec0]
cmp eax, ebx
je 0x5fca85
push eax
call fcn.005f03c8
pop ecx
test eax, eax
je 0x5fca85
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x798eb8]
call fcn.005f03c8
pop ecx
test eax, eax
je 0x5fcaa5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5fcaa7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x607a55
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005f03bf
and dword [ebp - 4], 0
cmp dword [0x798f48], 0
mov ebx, eax
jne 0x607b06
push 0x64c3b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x607bb7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x67e14c
push edi
call esi
test eax, eax
je 0x607bb7
push eax
call fcn.005f034d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x798f48], eax
call esi
push eax
call fcn.005f034d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x798f4c], eax
call esi
push eax
call fcn.005f034d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x798f50], eax
call esi
push eax
call fcn.005f034d
pop ecx
mov dword [0x798f58], eax
test eax, eax
je 0x607b06
push 0x67ce08
push edi
call esi
push eax
call fcn.005f034d
pop ecx
mov dword [0x798f54], eax
mov eax, dword [0x798f54]
cmp eax, ebx
je 0x607b5e
cmp dword [0x798f58], ebx
je 0x607b5e
push eax
call fcn.005f03c8
push dword [0x798f58]
mov esi, eax
call fcn.005f03c8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x607b5e
test edi, edi
je 0x607b5e
call esi
test eax, eax
je 0x607b55
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x607b55
test byte [ebp - 0xc], 1
jne 0x607b5e
or dword [ebp + 0x10], 0x200000
jmp 0x607b97
mov eax, dword [0x798f4c]
cmp eax, ebx
je 0x607b97
push eax
call fcn.005f03c8
pop ecx
test eax, eax
je 0x607b97
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x607b97
mov eax, dword [0x798f50]
cmp eax, ebx
je 0x607b97
push eax
call fcn.005f03c8
pop ecx
test eax, eax
je 0x607b97
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x798f48]
call fcn.005f03c8
pop ecx
test eax, eax
je 0x607bb7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x607bb9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret