joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d4478
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x6b5ccb
call fcn.006426c4
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
xor edx, edx
mov dword [ecx], 0x71a428
lea edi, [ecx + 0x10]
mov dword [ecx + 0xc], 4
lea esi, [ecx + 8]
mov dword [ebp - 4], edx
mov byte [esi], dl
lea ebx, [ecx + 9]
mov byte [ebx], 1
mov dword [edi], edx
mov dword [edi + 4], edx
mov dword [edi + 8], edx
mov dword [ecx + 0x1c], edx
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x24], edx
mov dword [ecx + 0x28], edx
mov dword [ecx + 0x2c], edx
mov dword [ecx + 0x30], edx
push 0x6c6e04
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.0040f32f
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 4
push eax
mov ecx, edi
call fcn.005d5be8
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.0040f95f
push str.extra_ulslots
lea ecx, [ebp - 0x2c]
call fcn.0040f32f
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 5
push eax
mov ecx, edi
call fcn.005d5be8
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.0040f95f
push str.ul_slots_per_torrent
lea ecx, [ebp - 0x2c]
call fcn.0040f32f
mov esi, dword [ebp - 0x10]
lea eax, [esi + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 6
push eax
lea ecx, [esi + 0x1c]
call fcn.005d5be8
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040f95f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x5d626d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
lea eax, [ebp - 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
push eax
push esi
lea ecx, [edi + 0x34]
call fcn.0059005e
mov edx, dword [edi + 0x80]
mov eax, dword [ebp + 8]
mov ebx, dword [edx + eax*4]
movzx eax, si
push eax
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0xfe
lea ecx, [ebp - 0x228]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x28]
push str._A_HREF__s___s__A_
push eax
call fcn.00465d7f
mov ecx, eax
add esp, 0x10
cmp dword [ecx + 0x14], 8
jb 0x5d62dc
mov ecx, dword [ecx]
mov eax, dword [ebp - 4]
xor esi, esi
sub eax, dword [ebp - 0xc]
push esi
push dword [0x7e4c80]
push esi
push ebx
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x50010000
push ecx
push 0x6c7150
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, dword [ebp + 0x14]
push esi
push 1
mov dword [ecx], eax
lea ecx, [ebp - 0x28]
call fcn.004285f6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5d7fd8
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x6b5fb0
call fcn.006426c4
push ecx
mov eax, dword [0x7e6ef0]
push esi
test eax, eax
je 0x5d7ffe
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [0x7e6ef0]
jmp 0x5d8041
push 0x210
call fcn.00642424
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x5d801f
mov ecx, eax
call fcn.005d5fcd
mov esi, eax
jmp 0x5d8021
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
push 0
push 0x13
call fcn.005906ba
push esi
call fcn.005d710a
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0xffffffff
je 0x5d8051
push dword [ebp + 8]
mov ecx, esi
call fcn.005d8a06
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x5dc262
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x84], 0
jne 0x5dc288
push dword [esp + 8]
call fcn.005dcb8e
push 0
mov dword [esi + 0x84], eax
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4

Function at 0x5dfca8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, 0x6b10e9
call fcn.006426c4
sub esp, 0x30
push ebx
push esi
push str.http:__
lea ecx, [ebp - 0x24]
call fcn.00429d77
xor ebx, ebx
push 1
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x5dfd52
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5dfd52
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x5dfd4c
push 4
push str.http
push esi
call fcn.00671ccf
add esp, 0xc
test eax, eax
je 0x5dfd18
push 4
push str.feed
push esi
call fcn.00671ccf
add esp, 0xc
test eax, eax
jne 0x5dfd4c
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5dfd1d
sub ecx, edx
cmp ecx, 0x12c
jae 0x5dfd4c
push esi
lea eax, [ebp - 0x3c]
push eax
call fcn.0047e93b
push eax
lea ecx, [ebp - 0x24]
call fcn.00428071
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.004285f6
call dword [sym.imp.USER32.dll_CloseClipboard]
push ebx
sub esp, 0x18
lea eax, [ebp - 0x24]
mov ecx, esp
push eax
call fcn.00427fbe
call fcn.005dfbac
push ebx
push 1
lea ecx, [ebp - 0x24]
call fcn.004285f6
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5e150e
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x6b659e
call fcn.006426c4
push ecx
mov eax, dword [0x7e72c0]
test eax, eax
je 0x5e152d
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x5e156c
push esi
push 0xc4
call fcn.00642424
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x5e154f
mov ecx, eax
call fcn.005e05a0
mov esi, eax
jmp 0x5e1551
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
push 0
push 0x25
call fcn.005906ba
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5e3121
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0x25
mov edi, ecx
call esi
cwde
push 0x27
mov dword [ebp - 4], eax
call esi
cwde
push 0x26
mov dword [ebp - 8], eax
call esi
cwde
push 0x28
mov dword [ebp - 0xc], eax
call esi
cmp byte [edi + 0x14], 1
movsx ebx, ax
jne 0x5e3195
test byte [ebp - 4], 1
je 0x5e3168
push 0
push 0xffffffffffffffff
mov ecx, edi
call fcn.005e30d8
test byte [ebp - 8], 1
je 0x5e3179
push 0
push 1
mov ecx, edi
call fcn.005e30d8
test byte [ebp - 0xc], 1
je 0x5e3188
push 1
mov ecx, edi
call fcn.005e34f3
test bl, 1
jne 0x5e3191
test ebx, ebx
jns 0x5e3195
mov byte [edi + 0x15], 0xa
cmp byte [edi + 0x16], 0
jne 0x5e31af
inc byte [edi + 0x15]
cmp byte [edi + 0x15], 0xa
jb 0x5e31af
mov ecx, edi
mov byte [edi + 0x15], 0
call fcn.005e2ebe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5e3534
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x6b65ed
call fcn.006426c4
push ecx
mov eax, dword [0x7e72e0]
test eax, eax
je 0x5e3553
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x5e35a3
push ebx
push esi
mov ebx, 0x1d0
push ebx
call fcn.00642424
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
test esi, esi
je 0x5e3585
push ebx
push 0
push esi
call fcn.0065d010
add esp, 0xc
mov ecx, esi
call fcn.005e2696
mov esi, eax
jmp 0x5e3587
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
push 0
push 0x1e
call fcn.005906ba
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x5e3f09
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
call fcn.00464286
push dword [edi + 4]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
mov dword [edi + 0x34], eax
mov eax, dword [edi + 0x44]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x48]
mov dword [edi + 0x38], edx
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edx, dword [edi]
mov esi, eax
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
push esi
call dword [edx + 0x24]
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp byte [edi + 0x10c], 0
je 0x5e3fa2
push 0x50
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x5e3f7c
mov esi, dword [edi + 4]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
jne 0x5e3f7c
xor byte [edi + 0x12a], 1
lea ecx, [edi + 0x114]
call fcn.005e3121
mov eax, dword [edi + 0x12c]
cmp eax, dword [edi + 0x110]
je 0x5e3fa2
mov ecx, edi
mov dword [edi + 0x110], eax
call fcn.005e372e
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5e4000
Capabilities:
Hide graphical window

Disassembly:
jmp 0x5e4005
mov eax, 0x69ee9a
call fcn.006426c4
push ecx
mov eax, dword [0x7e772c]
test eax, eax
je 0x5e4024
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x5e4069
push 0x34
call fcn.00642424
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x5e4040
mov ecx, eax
call fcn.005e3fbf
jmp 0x5e4042
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov ecx, eax
push 0
push 0x183
mov dword [0x7e772c], eax
call fcn.005906ba
mov eax, dword [0x7e772c]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5e53b9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
mov byte [ebp - 4], 0
je 0x5e53e4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5e53e0
mov byte [ebp - 4], 1
test al, 0x10
jne 0x5e53e4
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov ecx, esi
push 0x51d
call fcn.0059070f
push dword [ebp - 4]
mov ecx, esi
push 0x51e
call fcn.0059070f
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x5e5d3e
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x6b68a3
call fcn.006426c4
push ecx
push esi
push 0xe4
call fcn.00642424
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x5e5d71
push dword [ebp + 0xc]
mov ecx, eax
push dword [ebp + 8]
call fcn.005e5a90
mov esi, eax
jmp 0x5e5d73
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
push 0
push 0xfd
call fcn.005906ba
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x5e62b5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10b8
call section..text
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
cmp dword [eax + 8], 0xfffffffe
je 0x5e62d8
cmp dword [eax + 8], 0xfffffffc
jne 0x5e6327
add eax, 0xc
push 0x10b8
push eax
lea eax, [ebp - 0x10b8]
push eax
call fcn.0065afc0
add esp, 0xc
push 0x5d4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esi + 0xc]
cmp dword [ecx], eax
jne 0x5e6327
cmp dword [ebp - 0x10b4], 0
jne 0x5e6327
push 5
xor ecx, ecx
lea eax, [ebp - 0x1048]
push ecx
push ecx
push eax
push 0x6c4654
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x5e8cfa
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x210
push ebp
push edi
push dword [esp + 0x21c]
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
lea eax, [esp + 8]
push eax
push dword [esp + 0x220]
push edi
call fcn.0058eb3c
mov ecx, dword [esp + 0x220]
test ecx, ecx
jne 0x5e8d49
push 0xfe
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x224]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x14]
xor ebp, ebp
sub eax, dword [esp + 0xc]
push ebp
push dword [0x7e4c80]
push ebp
push edi
push eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
push eax
push dword [esp + 0x24]
mov eax, dword [esp + 0x244]
push dword [esp + 0x24]
or eax, 0x50010000
push eax
push ecx
push 0x6c7150
push ebp
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
mov eax, dword [esp + 0x224]
test eax, eax
jne 0x5e8da6
push ebp
push ebp
push 0x31
push dword [esp + 0x228]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push eax
push 0x30
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, edi
pop edi
pop ebp
add esp, 0x210
ret 0x10
Function at 0x5e98b4
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x6b6c4f
call fcn.006426c4
mov eax, dword [0x7e7bd0]
sub esp, 0x1c
test eax, eax
je 0x5e98d8
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x5e997f
cmp byte [0x7e7ba8], 0
jne 0x5e98f7
push 0x71d1fc
push 0x7e7bac
call fcn.0046bb16
mov byte [0x7e7ba8], 1
push 0x2b0
call fcn.00642424
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x5e9916
mov ecx, eax
call fcn.005e8612
jmp 0x5e9918
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov ecx, eax
push 0
push 0xf8
mov dword [0x7e7bd0], eax
call fcn.005906ba
call fcn.0049494b
push eax
push 0x70b
call fcn.0058dfbe
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00465d7f
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x5e9954
mov eax, dword [eax]
push eax
mov eax, dword [0x7e7bd0]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004285f6
mov eax, dword [0x7e7bd0]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x5ea164
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [eax], ecx
je 0x5ea182
push 5
push ecx
push ecx
add eax, 0x7c
push eax
push 0x6c4654
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret 4
Function at 0x5eb8a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0x34]
cmp eax, 1
je fcn.005e9b53
test eax, eax
jne 0x5eb8b1
inc eax
push 0
push 3
push eax
mov dword [ecx + 0x34], eax
call fcn.005eb8d6
ret 4

Function at 0x5ed88e
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
push ebx
push ebx
or dword [esi], 0xffffffff
push 3
push ebx
push 3
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5ed8bb
xor eax, eax
jmp 0x5ed8ef
push ebx
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
push 0xc
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x2d1080
push edi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x5ed8e0
mov eax, dword [ebp - 8]
mov dword [esi], eax
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
cmp dword [esi], 0xffffffff
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5ef939
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 8]
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x5ef961
xor al, al
jmp 0x5efa3e
push edi
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
test edi, edi
je 0x5ef98b
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x5ef992
xor al, al
jmp 0x5efa3d
push ebp
push edi
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [esi + 0x10], eax
test eax, eax
je 0x5efa3a
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
xor ebp, ebp
test eax, eax
je 0x5efa2e
push edi
push ebx
push eax
call fcn.0065afc0
add esp, 0xc
mov dword [esp + 0x1c], ebp
lea eax, [esp + 0x1c]
push eax
push ebp
push dword [esi + 0x10]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x5efa25
push ebp
push dword [esp + 0x20]
call fcn.005ef84a
mov dword [esi + 4], eax
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x5efa25
mov eax, dword [ecx + 8]
mov dword [ecx + 8], ebp
mov ecx, dword [esi + 4]
test eax, eax
jne 0x5efa18
call fcn.005bb8dc
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
call fcn.005babbb
mov dword [esi + 0xc], eax
mov al, 1
jmp 0x5efa3c
test ecx, ecx
je 0x5efa22
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], ebp
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov dword [esi + 0x10], ebp
xor al, al
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x5efcc7
Capabilities:
Delete file

Disassembly:
mov eax, 0x6b72ff
call fcn.006426c4
sub esp, 0x3f0
push ebx
push esi
push 7
mov ebx, ecx
xor eax, eax
pop edx
xor ecx, ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], ecx
mov word [ebp - 0x44], ax
mov dword [ebp - 4], ecx
cmp dword [ebx + 0x8c], eax
jne 0x5efe0b
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x7b5c3c
call fcn.0042a98d
mov eax, dword [ebp - 0x14]
add eax, 8
push 8
pop esi
cmp dword [eax + 0x14], esi
jb 0x5efd27
mov eax, dword [eax]
push edi
lea edi, [ebx + 0xb4]
cmp dword [edi + 0x14], esi
jb 0x5efd37
mov ecx, dword [edi]
jmp 0x5efd39
mov ecx, edi
lea edx, [ebp - 0x2c]
push edx
lea edx, [ebp - 0x10]
push edx
push eax
push ecx
lea ecx, [ebp - 0x1fc]
call fcn.005ee4a9
cmp dword [ebp - 0x10], 0
mov byte [ebp - 4], 2
jne 0x5efd7a
push 0x6c4198
lea ecx, [ebp - 0x44]
call fcn.004392ec
test eax, eax
jne 0x5efd7a
push 0x6c4198
lea ecx, [ebp - 0x2c]
call fcn.004392ec
test eax, eax
je 0x5efded
push 0x100
lea eax, [ebp - 0x3fc]
push eax
push dword [ebp - 0x10]
call fcn.00462ced
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x5efd99
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x30], esi
jae 0x5efda4
lea eax, [ebp - 0x44]
cmp dword [edi + 0x14], esi
jb 0x5efdab
mov edi, dword [edi]
push ecx
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x3fc]
push eax
push edi
lea eax, [ebp - 0x5c]
push str.The_install_of__s_failed._n__s__d_.___s____s_
push eax
call fcn.00465d7f
add esp, 0x1c
cmp dword [eax + 0x14], esi
jb 0x5efdd0
mov eax, dword [eax]
push 0
push 0
push eax
push dword [0x7c1ee4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 1
lea ecx, [ebp - 0x5c]
call fcn.004285f6
lea ecx, [ebp - 0x1fc]
call fcn.005ee880
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.004285f6
pop edi
jmp 0x5efe27
push 8
lea eax, [ebx + 0x7c]
pop esi
cmp dword [eax + 0x14], esi
jb 0x5efe18
mov eax, dword [eax]
push ecx
push ecx
push eax
push dword [0x7c1ee4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [ebx + 0xe4], 0
jne 0x5efe44
lea eax, [ebx + 0xb4]
cmp dword [eax + 0x14], esi
jb 0x5efe3d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp byte [ebx + 0xe6], 0
pop esi
pop ebx
je 0x5efe54
call fcn.004858b3
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.004285f6
mov ecx, dword [ebp - 0xc]
mov al, 1
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x5f2c42
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x6b49e5
call fcn.006426c4
sub esp, 0x48
push esi
mov esi, ecx
cmp dword [esi + 0x48], 2
jne 0x5f2cda
push edi
push 1
xor edi, edi
push edi
push edi
push str.www.bittorrent.com_speed_
push 0x6c4654
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.action
lea ecx, [ebp - 0x24]
call fcn.0040f32f
push edi
push str.LearnMore
lea eax, [ebp - 0x24]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0046adc6
push edi
push 1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.0040f95f
push str.HelperTip
lea ecx, [ebp - 0x3c]
call fcn.0040f32f
push edi
push edi
push edi
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x54]
push eax
push 0x40
call fcn.00489021
push edi
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040f95f
push edi
push 1
lea ecx, [ebp - 0x54]
mov byte [0x7e580d], 1
call fcn.0040f95f
pop edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x5f9a18
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x464
push esi
push 0
push 2
mov dword [esp + 0x3c], 0x22c
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x5f9b23
lea eax, [esp + 0x34]
push eax
push esi
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
jne 0x5f9a56
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x5f9b23
and dword [esp + 4], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebp
push edi
mov edi, dword [esp + 0x47c]
add edi, 0x208
lea eax, [esp + 0x64]
push eax
call fcn.005f99e2
test eax, eax
jne 0x5f9afe
push dword [esp + 0x48]
push eax
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x5f9a9b
push eax
call ebx
jmp 0x5f9afe
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push eax
lea eax, [esp + 0x270]
push eax
push 0
push ebp
call dword [sym.imp.KERNEL32.DLL_QueryFullProcessImageNameW]
test eax, eax
lea eax, [esp + 0x26c]
push 0x104
jne 0x5f9acd
lea eax, [esp + 0x68]
push eax
lea eax, [edi - 0x208]
push eax
call fcn.0042978d
push 0x28
lea eax, [esp + 0x1c]
push eax
push ebp
call sub.KERNEL32.DLL_K32GetProcessMemoryInfo
neg eax
push ebp
sbb eax, eax
and eax, dword [esp + 0x28]
mov dword [edi], eax
call ebx
inc dword [esp + 0x10]
add edi, 0x20c
lea eax, [edi + 4]
cmp eax, dword [esp + 0x478]
jae 0x5f9b1d
lea eax, [esp + 0x40]
push eax
push esi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x5f9a71
push esi
call ebx
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x464
ret 8
Function at 0x6081c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push esi
push edi
push dword [esp + 0x14]
mov esi, ecx
mov byte [esp + 0xf], 0
push dword [esp + 0x14]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
test edi, edi
jne 0x6081f3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor al, al
jmp 0x608267
push ebx
push edi
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x608208
xor al, al
jmp 0x608266
push ebp
push ebx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebp, eax
test ebp, ebp
je 0x60825a
cmp dword [esp + 0x20], 0
push edi
push dword [esi + 0x24]
jne 0x60822f
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
jmp 0x608255
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [esp + 0x24]
cmp ecx, eax
jl 0x60825a
push ecx
push ebp
push dword [esp + 0x28]
call fcn.0065afc0
add esp, 0xc
mov byte [esp + 0x13], 1
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov al, byte [esp + 0x13]
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret 0x10

Function at 0x6085f2
Capabilities:
Hide graphical window

Disassembly:
push 0x6b0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x60868b
Capabilities:
Create process on windows

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, ecx
mov eax, dword [edx + 8]
cmp eax, 0x6b0
je 0x608701
cmp eax, 0x6b1
je 0x6086b8
cmp eax, 0x6b3
je 0x6086b8
mov ecx, 0x748
cmp eax, ecx
je 0x6086dc
jbe 0x608724
cmp eax, 0x74b
ja 0x608724
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x608724
cmp dword [ecx + 8], 0x701
jne 0x608724
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov dword [esi + 0x5c], eax
mov eax, dword [ecx + 0x18]
sub eax, dword [ecx + 0x10]
mov dword [esi + 0x60], eax
jmp 0x608724
mov eax, dword [edx + 0xc]
test eax, eax
je 0x608724
cmp dword [eax + 8], 0xfffffffe
jne 0x608724
push 5
xor ecx, ecx
add eax, 0x7c
push ecx
push ecx
push eax
push 0x6c4654
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x608724
mov eax, dword [edx + 0xc]
test eax, eax
je 0x608724
cmp dword [eax + 8], 0xfffffffe
jne 0x608724
xor ecx, ecx
mov dword [esi + 0x58], 2
push ecx
push ecx
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
ret 4