joyce8/EMBER2024-capa huggingface dataset:
Function at 0x538ad0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.00629030
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, edx
mov ecx, dword [ebp + 0xc]
push edi
xor edi, edi
call fcn.004a0870
mov ecx, dword [ebp + 0xc]
call fcn.004a09e0
mov esi, eax
test esi, esi
je 0x538ce6
mov edx, dword [ebx + 4]
add edx, edx
cmp edx, dword [esi + 8]
jle 0x538b1a
mov ecx, esi
call fcn.004749e0
test eax, eax
je 0x538ce6
mov eax, dword [ebx + 4]
lea ecx, [eax - 1]
test ecx, ecx
js 0x538c9e
mov edi, ecx
nop word [eax + eax]
mov eax, dword [ebx]
mov edx, dword [eax + edi*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, reloc.WS2_32.dll_accept
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + edi*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + edi*8], edx
sub edi, 1
jns 0x538b30
mov eax, dword [ebx + 4]
xor edi, edi
add eax, eax
mov dword [esi + 4], eax
test eax, eax
jle 0x538cc3
mov ecx, dword [esi]
lea ecx, [ecx + eax*4]
nop dword [eax]
cmp dword [ecx - 4], 0
lea ecx, [ecx - 4]
jne 0x538cbe
dec eax
test eax, eax
jg 0x538cb0
mov dword [esi + 4], eax
test eax, eax
jne 0x538ccc
mov dword [esi + 0xc], 0
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.005384f0
add esp, 4
mov ecx, 1
test eax, eax
cmovne edi, ecx
mov ecx, dword [ebp + 0xc]
call fcn.004a0970
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a42be
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
je 0x5a42d9
push 2
push dword [esi + 0x88]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [esi + 0x20], 0
pop esi
ret

Function at 0x5a4ee5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 8
mov eax, 0x654069
call fcn.00628f4a
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push dword [ebp + 8]
call fcn.005ba392
pop ecx
pop ecx
push 0x65c9d0
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x5a4f4a
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5a4f4a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [edi + 0x10], eax
setne bl
cmp dword [ebp - 0x14], 0
je 0x5a4f59
push dword [ebp - 0x14]
call fcn.0062fb07
pop ecx
mov al, bl
call fcn.00628f18
ret 4

Function at 0x5a54a6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
xor eax, eax
push eax
push esi
push 0x5a2784
push eax
push eax
mov byte [esi + 0x20], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x88], eax
pop esi
leave
ret
Function at 0x5a5a6b
Capabilities:
Create pipe

Disassembly:
push 0x3c
mov eax, 0x65420c
call fcn.00628f7d
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
cmp dword [esi + 4], 0xffffffff
mov dword [ebp - 4], ebx
jne 0x5a5b11
call fcn.005b9f68
push eax
lea eax, [ebp - 0x28]
push str..pipe_
push eax
call fcn.005a0eb7
push str._admin_proxy_pipe_in
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.005a0e4e
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
push ecx
push eax
call fcn.005ba392
add esp, 0x20
lea ecx, [ebp - 0x40]
call fcn.00449330
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00449330
push ebx
push ebx
push ebx
push ebx
push 0xff
push ebx
push 2
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x5a5b11
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.005ba47c
pop ecx
pop ecx
mov byte [ebp - 4], 3
jmp 0x5a5b99
cmp dword [esi + 8], 0xffffffff
jne 0x5a5ba8
call fcn.005b9f68
push eax
lea eax, [ebp - 0x40]
push str..pipe_
push eax
call fcn.005a0eb7
push str._admin_proxy_pipe_out
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
call fcn.005a0e4e
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
push ecx
push eax
call fcn.005ba392
add esp, 0x20
lea ecx, [ebp - 0x28]
call fcn.00449330
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.00449330
push ebx
push ebx
push ebx
push ebx
push 0xff
push ebx
push 1
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x5a5ba8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.005ba47c
pop ecx
pop ecx
mov byte [ebp - 4], 6
call fcn.005b204e
lea ecx, [ebp - 0x28]
call fcn.00449330
jmp 0x5a5baa
mov bl, 1
cmp dword [ebp - 0x48], 0
je 0x5a5bb9
push dword [ebp - 0x48]
call fcn.0062fb07
pop ecx
mov al, bl
call fcn.00628f2c
ret
Function at 0x5a5c69
Capabilities:
Connect pipe
Create process on windows
Create thread

Disassembly:
push 0x5c
mov eax, 0x65428c
call fcn.00628f7d
mov esi, ecx
cmp byte [esi], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x64], eax
je 0x5a5c9f
mov edi, str.AdministrativeProxy_is_already_running
push edi
call fcn.0062fbc0
pop ecx
push eax
push edi
lea ecx, [esi + 0x10]
call fcn.00448f70
mov al, 1
jmp 0x5a5e1a
cmp byte [esi + 0xc], 0
je 0x5a5cac
xor al, al
jmp 0x5a5e1a
lea edi, [esi + 0x10]
call fcn.005a5a6b
test al, al
jne 0x5a5ccf
mov esi, str.unable_to_listen_on_admin_proxy_pipes
push esi
call fcn.0062fbc0
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00448f70
jmp 0x5a5ca5
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
lea eax, [ebp - 0x60]
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 0x64]
call fcn.005ba392
pop ecx
pop ecx
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push ebx
push ebx
push ebx
push dword [ebp - 0x60]
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x5a5d44
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.005b99ce
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 1
push str.ShellExecute_for_admin_proxy_failed__
push eax
call fcn.005a0e81
add esp, 0x14
mov ecx, edi
push eax
call fcn.005a1f05
lea ecx, [ebp - 0x58]
call fcn.00449330
lea ecx, [ebp - 0x28]
call fcn.00449330
mov byte [esi + 0xc], 1
jmp 0x5a5e09
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x5a5d8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.005ba47c
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push str.ConnectNamedPipe_for_admin_proxy_failed__
push eax
call fcn.005a0e81
add esp, 0x14
mov ecx, edi
push eax
call fcn.005a1f05
lea ecx, [ebp - 0x28]
call fcn.00449330
lea ecx, [ebp - 0x58]
jmp 0x5a5e04
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
mov dword [esi + 0x40], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x68]
push eax
push ebx
push esi
push 0x5a5851
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.005a5bc1
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x28]
push str.got_adminStatus_from_admin_proxy__
push eax
call fcn.005a0eb7
add esp, 0xc
mov ecx, edi
push eax
call fcn.005a1f05
lea ecx, [ebp - 0x28]
call fcn.00449330
push str.STATUS:ADMIN
lea ecx, [ebp - 0x40]
call fcn.005a58fd
mov byte [esi], al
lea ecx, [ebp - 0x40]
mov bl, al
call fcn.00449330
cmp dword [ebp - 0x60], 0
je 0x5a5e18
push dword [ebp - 0x60]
call fcn.0062fb07
pop ecx
mov al, bl
call fcn.00628f2c
ret 4
Function at 0x5a6059
Capabilities:
Write file on windows

Disassembly:
push 0xc
mov eax, 0x654330
call fcn.00628f4a
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
push dword [ebp + 8]
call fcn.005ba392
pop ecx
pop ecx
push ebx
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 0x14]
add eax, eax
push eax
push dword [ebp - 0x18]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp + 8]
mov dword [ebp - 0x10], 0x1234
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x18], ebx
je 0x5a60c0
push dword [ebp - 0x18]
call fcn.0062fb07
pop ecx
call fcn.00628f18
ret 4
Function at 0x5af395
Capabilities:
Get common file path

Disassembly:
push 0x3c
mov eax, 0x655875
call fcn.00628f7d
push 0x208
push 0
mov dword [ebp - 0x44], 0x104
call fcn.0062fb22
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x48], esi
and dword [ebp - 4], 0
push 0
push 0x23
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x5af41b
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.005bb0b4
push str..exe
push eax
xor ebx, ebx
lea eax, [ebp - 0x28]
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.005a0e4e
add esp, 0x14
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.00449330
lea eax, [ebp - 0x28]
push eax
call fcn.005b78f9
pop ecx
lea ecx, [ebp - 0x28]
test al, al
je 0x5af416
call fcn.00449330
jmp 0x5af41d
call fcn.00449330
xor bl, bl
test esi, esi
je 0x5af428
push esi
call fcn.0062fb07
pop ecx
mov al, bl
call fcn.00628f2c
ret
Function at 0x5b1e87
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x70d514]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
call fcn.005df2a0
mov esi, eax
test esi, esi
jne 0x5b1ebc
or eax, 0xffffffff
jmp 0x5b2021
cmp dword [ebx + 0x14], 0x10
mov eax, ebx
jb 0x5b1ec6
mov eax, dword [ebx]
push eax
push 0x2712
push esi
call fcn.005e28e0
add esp, 0xc
cmp dword [edi + 0x10], 0
je 0x5b1ef2
cmp dword [edi + 0x14], 0x10
jb 0x5b1ee3
mov edi, dword [edi]
push edi
push 0x271f
push esi
call fcn.005e28e0
add esp, 0xc
xor edi, edi
inc edi
push edi
push 0x63
push esi
call fcn.005e28e0
push edi
push 0x34
push esi
call fcn.005e28e0
add esp, 0x18
push 0
call fcn.005ba044
push eax
mov ecx, ebx
call fcn.005a830b
cmp eax, 0xffffffff
mov edx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_114.0.0.0_Safari_537.36
mov ecx, str.m_installer
cmove ecx, edx
push ecx
push 0x2722
push esi
call fcn.005e28e0
push 2
push 0x54
push esi
call fcn.005e28e0
push edi
push 0x29
push esi
call fcn.005e28e0
push 0x32
push 0x44
push esi
call fcn.005e28e0
push edi
push 0xd5
push esi
call fcn.005e28e0
add esp, 0x3c
cmp byte [ebp + 0x14], 0
jne 0x5b1f8d
mov edi, dword [ebp - 0x24]
mov ecx, edi
call fcn.005b1d27
cmp dword [eax + 0x10], 0
je 0x5b1f8d
mov ecx, edi
call fcn.005b1d27
cmp dword [eax + 0x14], 0x10
jb 0x5b1f86
mov eax, dword [eax]
mov ecx, 0x2751
jmp 0x5b1f92
push 0x40
pop ecx
xor eax, eax
push eax
push ecx
push esi
call fcn.005e28e0
and dword [ebp - 0x1c], 0
and dword [ebp - 0xc], 0
push 0x5b2032
push 0x4e2b
push esi
mov dword [ebp - 8], 0xf
call fcn.005e28e0
push dword [ebp - 0x20]
push 0x2711
push esi
call fcn.005e28e0
lea eax, [ebp - 0x1c]
push eax
push 0x272d
push esi
call fcn.005e28e0
push esi
call fcn.005df300
push esi
mov edi, eax
call fcn.005df280
mov ecx, dword [ebp - 8]
add esp, 0x38
cmp ecx, 0x10
jb 0x5b201f
mov eax, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
cmp ecx, 0x1000
jb 0x5b2016
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00447b40
mov eax, dword [ebp - 0x24]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x20]
push ecx
push eax
call fcn.00628ef7
pop ecx
pop ecx
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00628f0a
leave
ret 0x10

Function at 0x5b2e5b
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
je 0x5b2e9a
push 2
push dword [esi + 0x12c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0xb8]
mov byte [esi + 0x20], 0
test eax, eax
je 0x5b2e8e
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
and dword [esi + 0xb8], 0
push dword [esi + 0x158]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x5b377e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea eax, [esi + 0xc8]
mov byte [esi + 0xe0], 1
mov byte [esi + 0x21], bl
mov dword [esi + 0x104], ebx
mov dword [eax + 0x10], ebx
cmp dword [eax + 0x14], 0x10
jb 0x5b37a9
mov eax, dword [eax]
mov byte [eax], bl
lea eax, [esi + 0x24]
mov dword [eax + 0x10], ebx
cmp dword [eax + 0x14], 0x10
jb 0x5b37b9
mov eax, dword [eax]
push edi
push dword [ebp + 0xc]
lea ecx, [esi + 0xe4]
mov byte [eax], bl
call fcn.00449300
mov eax, dword [ebp + 0x10]
lea edi, [esi + 0x10c]
cmp dword [eax + 0x10], ebx
je 0x5b37e0
push eax
mov ecx, edi
call fcn.00449300
push dword [ebp + 8]
mov ecx, esi
call fcn.005b32c6
cmp dword [esi + 0x11c], ebx
je 0x5b3807
push edi
call fcn.005b78f9
pop ecx
test al, al
je 0x5b3807
push 1
push edi
call fcn.005b8eaa
pop ecx
pop ecx
lea eax, [ebp - 4]
mov byte [esi + 0x20], 1
push eax
push ebx
push esi
push fcn.005b22cb
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x12c], eax
pop edi
cmp dword [esi + 0x150], ebx
jne 0x5b3835
cmp dword [esi + 0x154], ebx
je 0x5b383c
mov ecx, esi
call fcn.005b3933
pop esi
mov al, 1
pop ebx
leave
ret 0xc

Function at 0x5b38cc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x11c], ebx
je 0x5b38fb
push edi
lea edi, [esi + 0x10c]
push edi
call fcn.005b78f9
pop ecx
test al, al
je 0x5b38fa
push 1
push edi
call fcn.005b8eaa
pop ecx
pop ecx
pop edi
lea eax, [ebp - 4]
mov byte [esi + 0x20], 1
push eax
push ebx
push esi
push 0x5b23a9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x12c], eax
cmp dword [esi + 0x150], ebx
jne 0x5b3928
cmp dword [esi + 0x154], ebx
je 0x5b392f
mov ecx, esi
call fcn.005b3933
pop esi
pop ebx
leave
ret
Function at 0x5b4fd4
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10018
call fcn.00629030
mov eax, dword [0x70d514]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push 0x208
push ebx
mov dword [ebp - 0x1000c], eax
mov dword [ebp - 0x10010], 0x104
call fcn.0062fb22
mov dword [ebp - 0x10014], eax
lea eax, [ebp - 0x10014]
push eax
push esi
call fcn.005ba392
mov edi, dword [ebp - 0x10014]
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 1
push accept
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x5b5088
lea eax, [ebp - 0x10014]
push eax
push dword [ebp - 0x1000c]
call fcn.005ba392
mov edi, dword [ebp - 0x10014]
pop ecx
pop ecx
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push edi
call ebx
cmp eax, 0xffffffff
jne 0x5b50a6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
test edi, edi
je 0x5b5095
push edi
call fcn.0062fb07
pop ecx
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00628f0a
leave
ret
mov edi, eax
push 0
lea eax, [ebp - 0x10008]
push eax
push 0xffff
lea eax, [ebp - 0x10004]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne bl
test eax, eax
je 0x5b510e
cmp dword [ebp - 0x10008], 0
je 0x5b511c
push 0
lea eax, [ebp - 0x10018]
push eax
push dword [ebp - 0x10008]
lea eax, [ebp - 0x10004]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
xor ecx, ecx
movzx ebx, al
mov eax, dword [ebp - 0x10008]
cmp dword [ebp - 0x10018], eax
cmovne ebx, ecx
jmp 0x5b5114
mov eax, dword [ebp - 0x10008]
test eax, eax
je 0x5b511c
test bl, bl
jne 0x5b50a8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov edi, dword [ebp - 0x10014]
jmp 0x5b508a

Function at 0x5b534b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x14
mov eax, 0x656822
call fcn.00628f4a
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
push dword [ebp + 8]
call fcn.005ba392
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.005ba392
add esp, 0x10
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x5b53c9
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push 0
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5b53c9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 0x10]
push eax
push dword [ebp + 0x10]
call fcn.005b97c9
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x5b53d8
push dword [ebp - 0x18]
call fcn.0062fb07
pop ecx
cmp dword [ebp - 0x20], 0
je 0x5b53e7
push dword [ebp - 0x20]
call fcn.0062fb07
pop ecx
call fcn.00628f18
ret
Function at 0x5b78f9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
lea eax, [ebp - 8]
and dword [ebp - 4], 0
push ebx
push eax
push dword [ebp + 8]
call fcn.005ba392
pop ecx
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
cmp dword [ebp - 8], 0
je 0x5b7933
push dword [ebp - 8]
call fcn.0062fb07
pop ecx
mov al, bl
pop ebx
leave
ret
Function at 0x5b7968
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Terminate process

Disassembly:
push 0x84
mov eax, 0x656fc5
call fcn.00628f7d
cmp byte [0x70d234], 0
jne 0x5b798a
mov al, byte [0x713338]
jmp 0x5b7b3e
lea eax, [ebp - 0x28]
push eax
call fcn.005b7573
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x5b7b2e
call fcn.005b73d4
push eax
lea ecx, [ebp - 0x28]
call fcn.005a7c64
test al, al
jne 0x5b7b2e
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x30]
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.005b9daa
push eax
call fcn.005ba392
mov esi, dword [ebp - 0x30]
pop ecx
pop ecx
push esi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x34], edi
test edi, edi
jne 0x5b79ed
xor bl, bl
jmp 0x5b7a07
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x5b7a13
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x713338], bl
mov byte [0x70d234], 0
jmp 0x5b7b21
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.005ba392
pop ecx
pop ecx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
call fcn.005b42f0
push dword [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x3c]
push esi
push edi
call fcn.00634f83
mov eax, dword [ebp - 0x38]
add esp, 0xc
jmp 0x5b7a4c
cmp word [edi + eax*2], 0x5c
je 0x5b7a53
sub eax, 1
jns 0x5b7a45
jmp 0x5b7a59
xor ecx, ecx
mov word [edi + eax*2], cx
push 0x44
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.0062c160
add esp, 0xc
mov dword [ebp - 0x90], 0x44
xor eax, eax
mov dword [ebp - 0x64], ebx
mov word [ebp - 0x60], ax
push ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x90]
push eax
push edi
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x5b7afc
push 0x7d0
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x5b7adf
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x5b7aea
cmp dword [ebp - 0x2c], 0x66
jne 0x5b7aea
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x713338], bl
jmp 0x5b7b0f
push 0
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov byte [0x70d234], 0
test edi, edi
je 0x5b7b21
push edi
call fcn.0062fb07
pop ecx
test esi, esi
je 0x5b7b34
push esi
call fcn.0062fb07
pop ecx
jmp 0x5b7b34
mov byte [0x70d234], bl
lea ecx, [ebp - 0x28]
call fcn.00449330
mov al, bl
call fcn.00628f2c
ret
Function at 0x5b7b44
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa00
mov eax, dword [0x70d514]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 2
mov dword [ebp - 0xa00], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x5b7be1
lea eax, [ebp - 0xa00]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x5b7be1
mov ebx, 0x3e8
lea eax, [ebp - 0x9dc]
push ebx
push eax
lea eax, [ebp - 0x3ec]
push eax
call fcn.00634997
lea eax, [ebp - 0x3ec]
jmp 0x5b7bc2
push ebx
lea eax, [ebp - 0x9dc]
push eax
lea eax, [ebp - 0x7d4]
push eax
call fcn.00634997
lea eax, [ebp - 0x7d4]
push edi
push eax
call fcn.00634fd0
add esp, 0x14
test eax, eax
je 0x5b7bf9
lea eax, [ebp - 0xa00]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x5b7ba8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00628f0a
leave
ret
mov al, 1
jmp 0x5b7bea