joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e2dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49e53c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x49e33f
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0049ddf4
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040ed84
cmp al, 1
jne 0x49e33f
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0049e0bc
test al, al
je 0x49e4cb
cmp dword [ebp - 8], 0
jge 0x49e35d
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0049ddf4
mov eax, dword [ebp - 0x210]
call fcn.0040557c
cmp ebx, eax
jge 0x49e3a7
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0049ddf4
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x7a8ca4]
and eax, 0xff
bt dword [edx], eax
jae 0x49e3a7
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x49e3bb
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049e2b8
cmp ebx, dword [ebp - 8]
je 0x49e4bd
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x49e3e7
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004046a4
and eax, 0x7f
movzx eax, word [eax*2 + 0x6fc400]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x49e4aa
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004046a4
and eax, 0x7f
movzx eax, word [eax*2 + 0x6fc400]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00478884
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004046a4
and eax, 0x7f
movzx eax, word [eax*2 + 0x6fc400]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00478884
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e4b1
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x49e51e
cmp dword [ebp - 8], 0
jge 0x49e4d6
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0049ddf4
mov eax, dword [ebp - 0x218]
call fcn.0040557c
cmp eax, dword [ebp - 8]
jg 0x49e510
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0049ddf4
mov eax, dword [ebp - 0x21c]
call fcn.0040557c
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0049e2b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e543
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004052e0
ret
Function at 0x4c4954
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c4a71
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
mov dword [ebx + 0xc], edx
mov esi, eax
mov dword [ebx + 8], esi
push esi
mov eax, dword [ebx + 0xc]
push eax
lea eax, [ebp - 8]
mov ecx, 2
mov edx, dword [0x4bbf9c]
call fcn.004067f8
add esp, 8
mov eax, dword [ebx + 0xc]
dec eax
test eax, eax
jl 0x4c49e0
inc eax
mov dword [ebp - 0xc], eax
xor esi, esi
mov edx, dword [ebx + 8]
dec edx
test edx, edx
jl 0x4c49da
inc edx
xor eax, eax
mov ecx, dword [ebp - 4]
sub ecx, esi
mov edi, dword [ebx + 4]
mov edi, dword [edi + eax*4]
mov cl, byte [edi + ecx - 1]
push ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + esi*4]
lea edi, [ecx + eax]
pop ecx
mov byte [edi], cl
inc eax
dec edx
jne 0x4c49ba
inc esi
dec dword [ebp - 0xc]
jne 0x4c49af
lea eax, [ebx + 4]
mov edx, dword [ebp - 8]
mov ecx, dword [0x4bbf9c]
call fcn.00406840
lea ecx, [ebp - 0x14]
xor edx, edx
xor eax, eax
call fcn.0041a3c8
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x1c], eax
lea ecx, [ebp - 0x14]
mov edx, dword [ebx + 8]
xor eax, eax
call fcn.0041a3c8
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x24], eax
lea ecx, [ebp - 0x14]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.0041a3c8
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x2c], eax
lea ecx, [ebp - 0x14]
mov edx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
call fcn.0041a3c8
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x34], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4a78
lea eax, [ebp - 8]
mov edx, dword [0x4bbf9c]
call fcn.00406804
ret
Function at 0x4c4a80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c4b9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov esi, dword [ebp - 4]
mov dword [ebx + 8], esi
push esi
mov eax, dword [ebx + 0xc]
push eax
lea eax, [ebp - 8]
mov ecx, 2
mov edx, dword [0x4bbf9c]
call fcn.004067f8
add esp, 8
mov eax, dword [ebx + 0xc]
dec eax
test eax, eax
jl 0x4c4b0a
inc eax
mov dword [ebp - 0xc], eax
xor esi, esi
mov edx, dword [ebx + 8]
dec edx
test edx, edx
jl 0x4c4b04
inc edx
xor eax, eax
mov ecx, dword [ebp - 4]
sub ecx, eax
mov edi, dword [ebx + 4]
mov ecx, dword [edi + ecx*4 - 4]
mov cl, byte [ecx + esi]
push ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + esi*4]
lea edi, [ecx + eax]
pop ecx
mov byte [edi], cl
inc eax
dec edx
jne 0x4c4ae4
inc esi
dec dword [ebp - 0xc]
jne 0x4c4ad9
lea eax, [ebx + 4]
mov edx, dword [ebp - 8]
mov ecx, dword [0x4bbf9c]
call fcn.00406840
lea ecx, [ebp - 0x14]
xor edx, edx
xor eax, eax
call fcn.0041a3c8
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x1c], eax
lea ecx, [ebp - 0x14]
mov edx, dword [ebx + 8]
xor eax, eax
call fcn.0041a3c8
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x24], eax
lea ecx, [ebp - 0x14]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.0041a3c8
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x2c], eax
lea ecx, [ebp - 0x14]
mov edx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
call fcn.0041a3c8
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x34], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4ba2
lea eax, [ebp - 8]
mov edx, dword [0x4bbf9c]
call fcn.00406804
ret
Function at 0x4c4bac
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4c4c60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 0xc]
push eax
lea eax, [ebp - 4]
mov ecx, 2
mov edx, dword [0x4bbf9c]
call fcn.004067f8
add esp, 8
mov edi, dword [ebx + 0xc]
dec edi
test edi, edi
jl 0x4c4c0b
inc edi
xor esi, esi
mov eax, dword [ebx + 0xc]
dec eax
sub eax, esi
mov edx, dword [ebx + 4]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
mov edx, dword [edx + esi*4]
mov ecx, dword [ebx + 8]
call fcn.00402d40
inc esi
dec edi
jne 0x4c4bed
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
mov ecx, dword [0x4bbf9c]
call fcn.00406840
mov eax, dword [ebx + 0xc]
dec eax
sub eax, dword [ebx + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0xc]
dec eax
sub eax, dword [ebx + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [ebx + 0xc]
dec eax
sub eax, dword [ebx + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [ebx + 0xc]
dec eax
sub eax, dword [ebx + 0x30]
mov dword [ebx + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4c67
lea eax, [ebp - 4]
mov edx, dword [0x4bbf9c]
call fcn.00406804
ret
Function at 0x4ec774
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4ec7a2
mov eax, ebx
call fcn.004ed228
cmp dword [ebx + 0x40], 0
je 0x4ec79b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4ec813
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4ec805
cmp dword [ebx + 8], 0
je 0x4ec7c4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4ec7d6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4ec805
cmp dword [ebx + 8], 0
je 0x4ec7b7
cmp eax, 3
je 0x4ec7e9
dec eax
jne 0x4ec7b7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4ec7b7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4ec7b7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4ec831
cmp dword [ebx + 0x14], 0xcc
je 0x4ec831
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004ec83c
pop ebx
ret

Function at 0x4fe558
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4fe586
mov eax, ebx
call fcn.004feffc
cmp dword [ebx + 0x3c], 0
je 0x4fe57f
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4fe5f7
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x4fe5e9
cmp dword [ebx + 8], 0
je 0x4fe5a8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x4fe5ba
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4fe5e9
cmp dword [ebx + 8], 0
je 0x4fe59b
cmp eax, 3
je 0x4fe5cd
dec eax
jne 0x4fe59b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4fe59b
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x4fe59b
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4fe615
cmp dword [ebx + 0x10], 0xcc
je 0x4fe615
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004fe620
pop ebx
ret
Function at 0x508a24
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x7a9cd8
test esi, esi
jne 0x508a3e
xor eax, eax
jmp 0x508b40
cmp dword [ebp], 0
jne 0x508a49
call fcn.005089b4
xor ebx, 0xffffffff
cmp edi, 8
jb 0x508b19
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x508a55
test edi, edi
jbe 0x508b3b
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x508b1d
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x538528
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x538592
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.0040b0cc
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00538234
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x538599
lea eax, [ebp - 0x10c]
call fcn.004052bc
ret

Function at 0x539f08
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x418858]
call fcn.00405ccc
xor eax, eax
push ebp
push 0x53a04c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x700afc], 0
jne 0x539f5b
mov ecx, dword [0x7a7ea8]
mov dl, 1
mov eax, dword [0x408cb0]
call fcn.0040e43c
call fcn.00404c74
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004035b8
mov eax, ebx
call fcn.00405b7c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x53a05c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406ef0
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405b8c
test eax, eax
jle 0x539ff3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x539fec
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00405544
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0040552c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00409b80
test eax, eax
jne 0x539fec
mov ebx, 0x15
jmp 0x539ff8
mov ebx, 0x10
jmp 0x539ff8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x700afc]
call fcn.00539e60
mov eax, dword [ebp - 8]
call fcn.00539e60
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406f08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53a053
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004052e0
lea eax, [ebp - 0x10]
mov edx, dword [0x418858]
call fcn.00405d9c
ret
Function at 0x53e0ac
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, eax
test byte [ebx + 0x1c], 0x10
jne 0x53e159
mov cl, 1
mov dl, 1
mov eax, dword [0x538c58]
call fcn.004249a4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53e122
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0053e300
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00424be0
mov eax, dword [ebp - 4]
mov dword [eax + 0x44], ebx
mov edx, dword [ebx]
mov edx, dword [edx + 0x30]
mov dword [eax + 0x40], edx
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0053e3b4
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 8]
mov dword [eax + 0x1c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53e139
push 0
mov eax, dword [ebx + 0x58]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [ebx + 0x58]
mov byte [eax + 0xf], 1
call fcn.00424e20
mov eax, dword [ebp - 4]
mov dword [ebx + 0x58], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54a720
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x54a7d7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040577c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x54a762
call fcn.00404d20
jmp 0x54a7de
mov eax, ebx
call fcn.00402a94
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.0040577c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x54a78b
call fcn.00404d20
jmp 0x54a7de
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x54a7e8
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x54a7ac
call fcn.00404d20
jmp 0x54a7de
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54a7de
mov eax, dword [ebp - 8]
call fcn.00402ab4
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54aa34
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54aa9c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.004035b8
test ebx, ebx
jne 0x54aa71
mov word [ebp - 2], 0
lea ebx, [ebp - 2]
or esi, 0x4008
push esi
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push ebx
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x160]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54aaa8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54ad8c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
push 0x54aef0
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x54aee6
xor eax, eax
push ebp
push 0x54aedf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x54aefc
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
push 0x4000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x54aefc
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
push 0x8000
push 0x10
push 0x10
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, esi
call fcn.0043113c
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, edi
call fcn.0043113c
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x10
push 0x10
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, esi
call fcn.0043113c
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, edi
call fcn.0043113c
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
mov byte [0x700c9c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54aee6
cmp dword [ebp - 4], 0
je 0x54aede
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x54af00
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
call fcn.0054a714
test al, al
je 0x54af2c
cmp dword [0x7aae90], 0x40047
jl 0x54af2c
cmp byte [0x700c9c], 0
jne 0x54af2c
call fcn.0054ad8c
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x700ca0]
or eax, 0x4000
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x54af5c
call sub.shell32.dll_SHGetFileInfoA
add esp, 0x160
pop ebx
ret

Function at 0x54af47
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
call fcn.0054a714
test al, al
je 0x54af2c
cmp dword [0x7aae90], 0x40047
jl 0x54af2c
cmp byte [0x700c9c], 0
jne 0x54af2c
call fcn.0054ad8c
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x700ca0]
or eax, 0x4000
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x54af5c
call sub.shell32.dll_SHGetFileInfoA
add esp, 0x160
pop ebx
ret
Function at 0x54dfc0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov edi, edx
mov ebx, eax
mov eax, dword [edi + 8]
xor edx, edx
mov dword [edi + 0xc], edx
mov eax, dword [eax + 8]
cmp eax, 0xffffff9b
jg 0x54e001
je 0x54e07b
sub eax, 0xffffff91
je 0x54e161
sub eax, 2
je 0x54e161
sub eax, 4
je 0x54e0c9
jmp 0x54e1a0
sub eax, 0xffffff9c
je 0x54e014
sub eax, 0x5f
je 0x54e173
jmp 0x54e1a0
mov edx, edi
mov eax, ebx
call fcn.00459688
mov ebp, dword [edi + 8]
cmp byte [ebx + 0x274], 0
je 0x54e1a9
mov eax, dword [ebp + 0x14]
cmp eax, 0x2000
je 0x54e042
cmp eax, 0x1000
jne 0x54e1a9
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 0x22c]
call fcn.0045752c
mov edx, eax
cmp dword [ebp + 0x14], 0x2000
sete cl
mov eax, ebx
mov si, 0xffa8
call fcn.004046a4
test al, al
jne 0x54e1a9
mov dword [edi + 0xc], 1
jmp 0x54e1a9
mov edx, edi
mov eax, ebx
call fcn.00459688
mov esi, dword [edi + 8]
cmp byte [ebx + 0x274], 0
je 0x54e1a9
mov eax, dword [esi + 0x14]
cmp eax, 0x2000
je 0x54e0a9
cmp eax, 0x1000
jne 0x54e1a9
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x22c]
call fcn.0045752c
mov edx, eax
mov eax, ebx
mov si, 0xffa9
call fcn.004046a4
jmp 0x54e1a9
cmp byte [ebx + 0x382], 0
jne 0x54e156
cmp byte [ebx + 0x27a], 0
je 0x54e156
cmp byte [ebx + 0x215], 3
jne 0x54e156
cmp byte [ebx + 0x381], 0
jne 0x54e156
mov eax, dword [edi + 8]
mov ebp, dword [eax + 0x2c]
lea ecx, [esp + 8]
mov dl, 2
mov eax, ebp
call fcn.00457390
push esp
call sub.user32.dll_GetCursorPos
lea ecx, [esp + 0x18]
mov edx, esp
mov eax, ebx
call fcn.00471a88
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
push dword [esp + 4]
push dword [esp + 4]
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x54e14d
mov edx, ebp
mov eax, ebx
mov si, 0xffb2
call fcn.004046a4
test al, al
jne 0x54e1a9
mov dword [edi + 0xc], 1
jmp 0x54e1a9
mov edx, edi
mov eax, ebx
call fcn.00459688
jmp 0x54e1a9
mov byte [ebx + 0x3d1], 1
mov edx, edi
mov eax, ebx
call fcn.00459688
jmp 0x54e1a9
push esp
call sub.user32.dll_GetCursorPos
lea ecx, [esp + 0x18]
mov edx, esp
mov eax, ebx
call fcn.00471a88
lea edx, [esp + 0x18]
mov eax, ebx
mov si, 0xffa7
call fcn.004046a4
mov edx, edi
mov eax, ebx
call fcn.00459688
jmp 0x54e1a9
mov edx, edi
mov eax, ebx
call fcn.00459688
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret