joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ffdc4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x50000a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, 0x15
xor ebx, ebx
jmp 0x4ffe07
cmp ebx, 0x14
jbe 0x4ffdfc
call fcn.004046a8
cmp ax, word [ebx*8 + 0x55a280]
je 0x4ffe0e
inc ebx
mov edx, edi
dec edx
cmp ebx, edx
jl 0x4ffdf2
mov edx, edi
dec edx
cmp ebx, edx
jne 0x4ffe5a
xor ebx, ebx
cmp edi, ebx
jle 0x4ffe5a
cmp ebx, 0x14
jbe 0x4ffe25
call fcn.004046a8
movzx edx, word [ebx*8 + 0x55a280]
mov ecx, edx
and cx, 0x3ff
mov esi, eax
and si, 0x3ff
cmp cx, si
jne 0x4ffe55
cmp ebx, 0x14
jbe 0x4ffe4a
call fcn.004046a8
movzx edx, dx
shr edx, 0xa
cmp edx, 1
je 0x4ffe5a
inc ebx
cmp edi, ebx
jg 0x4ffe1b
mov eax, edi
dec eax
cmp ebx, eax
jne 0x4ffe63
xor ebx, ebx
cmp eax, ebx
jle 0x4ffe87
lea eax, [ebp - 4]
cmp ebx, 0x14
jbe 0x4ffe74
call fcn.004046a8
lea edx, [ebx*8 + 0x55a283]
call fcn.004059a0
mov dword [ebp - 0xc], 1
mov eax, 0x500024
call fcn.004ffca0
mov esi, eax
test esi, esi
jl 0x4fff28
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.004034a4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
call fcn.0040a494
mov edx, dword [ebp - 8]
mov eax, 0x500034
call fcn.00405d18
mov esi, eax
test esi, esi
je 0x4fff28
lea eax, [ebp - 8]
push eax
lea edx, [esi + 1]
mov ecx, 0x7fffffff
mov eax, dword [ebp - 8]
call fcn.00405c34
mov eax, dword [ebp - 8]
mov edx, 0x500040
call fcn.00405b64
jne 0x4ffef3
lea eax, [ebp - 8]
mov edx, 0x50004c
call fcn.004057d4
or edx, 0xffffffff
mov eax, dword [ebp - 8]
call fcn.0040b16c
mov ebx, eax
test ebx, ebx
jl 0x4fff28
cmp edi, ebx
jle 0x4fff28
lea eax, [ebp - 4]
cmp ebx, 0x14
jbe 0x4fff15
call fcn.004046a8
lea edx, [ebx*8 + 0x55a283]
call fcn.004059a0
mov dword [ebp - 0xc], 2
cmp ebx, 0xffffffff
jne 0x4fff65
or esi, 0xffffffff
inc esi
lea eax, [ebp - 0x14]
cmp esi, 0x14
jbe 0x4fff3e
call fcn.004046a8
lea edx, [esi*8 + 0x55a283]
call fcn.004059a0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00405b64
jne 0x4fff60
mov ebx, esi
mov dword [ebp - 0xc], 3
cmp esi, 0x14
jl 0x4fff30
cmp ebx, 0xffffffff
je 0x4fff6f
cmp ebx, 0x15
jl 0x4fff71
xor ebx, ebx
mov dword [0x560820], ebx
mov esi, ebx
cmp esi, 0x14
jbe 0x4fff83
call fcn.004046a8
movzx eax, byte [esi*8 + 0x55a282]
mov dword [0x56081c], eax
mov eax, dword [0x55a778]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
call fcn.00485cc4
test al, al
jne 0x4fffb8
mov eax, dword [0x55a778]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
call fcn.00485cd0
cmp dword [ebp - 0xc], 0
jle 0x4fffe2
cmp ebx, 0x14
jbe 0x4fffc8
call fcn.004046a8
movzx edx, byte [esi*8 + 0x55a282]
mov eax, dword [0x55a778]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
call fcn.004849a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x500011
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405760
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405760
ret
Function at 0x50143c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bbc
lea eax, [ebp - 0x168]
mov edx, dword [0x4095f4]
call fcn.00406514
xor eax, eax
push ebp
push 0x5015dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x169], 0
mov byte [ebp - 0x16a], 1
mov eax, dword [ebp - 4]
call fcn.0040b524
test al, al
je 0x5015a6
lea ecx, [ebp - 0x170]
mov edx, 0x5015fc
mov eax, dword [ebp - 4]
call fcn.004fe830
mov eax, dword [ebp - 0x170]
lea ecx, [ebp - 0x168]
mov edx, 0x2f
call fcn.0040b608
mov edi, eax
test edi, edi
jns 0x5014d8
call fcn.004046a8
xor eax, eax
push ebp
push 0x501587
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
jne 0x50156e
lea ecx, [ebp - 0x174]
mov edx, dword [ebp - 0x154]
mov eax, dword [ebp - 4]
call fcn.004fe830
mov eax, dword [ebp - 0x174]
mov edx, 0x20
call fcn.0040b55c
lea ecx, [ebp - 0x178]
mov edx, dword [ebp - 0x154]
mov eax, dword [ebp - 4]
call fcn.004fe830
mov esi, dword [ebp - 0x178]
mov dword [ebp - 0x17c], esi
mov eax, dword [ebp - 0x17c]
call fcn.00405bcc
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x501554
mov byte [ebp - 0x16a], 0
lea eax, [ebp - 0x168]
call fcn.0040b658
mov edi, eax
test edi, edi
jns 0x50156a
call fcn.004046a8
test edi, edi
je 0x5014ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50158e
lea eax, [ebp - 0x168]
call fcn.0040b67c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5015e4
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.00405760
lea eax, [ebp - 0x168]
mov edx, dword [0x4095f4]
call fcn.004065e4
lea eax, [ebp - 4]
call fcn.0040573c
ret

Function at 0x501794
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x2c]
xor eax, eax
push ebp
push 0x50181c
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp + 0x28]
push eax
mov eax, dword [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateProcessA
mov esi, eax
test esi, esi
jne 0x5017ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x501828
push 0x7d
call sub.kernel32.dll_Sleep_2
mov eax, dword [ebx + 8]
test eax, eax
jns 0x5017f8
call fcn.004046a8
call fcn.005016e0
test al, al
jne 0x5017e5
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x501828
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0x28
Function at 0x501834
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x30]
xor eax, eax
push ebp
push 0x5018c0
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp + 0x2c]
push eax
mov eax, dword [ebp + 0x28]
push eax
mov eax, dword [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_CreateProcessAsUserA
mov esi, eax
test esi, esi
jne 0x501890
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5018cc
push 0x7d
call sub.kernel32.dll_Sleep_2
mov eax, dword [ebx + 8]
test eax, eax
jns 0x50189c
call fcn.004046a8
call fcn.005016e0
test al, al
jne 0x501889
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5018cc
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0x2c
Function at 0x504ecc
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bbc
lea eax, [ebp - 0x10]
mov edx, dword [0x504e18]
call fcn.00406514
xor eax, eax
push ebp
push 0x504f91
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004057d4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004057d4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x504e38
call sub.user32.dll_EnumWindows
cmp dword [ebp - 0xc], 0
je 0x504f66
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea eax, [ebp - 0x18]
push eax
push 0
push 1
movzx eax, word [0x504fa0]
push eax
mov ecx, 0x504fac
mov dl, 1
mov eax, dword [0x504258]
call fcn.005042c0
call fcn.005045ac
cmp ax, 5
jne 0x504f68
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504f98
lea eax, [ebp - 0x10]
mov edx, dword [0x504e18]
call fcn.004065e4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405760
ret

Function at 0x5050c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x505150
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x104
call fcn.0040bce0
mov esi, eax
push 0x104
push esi
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esi
call fcn.00405934
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x505116
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x505133
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.004106ec
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405790
mov eax, esi
call fcn.0040bd2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x505157
lea eax, [ebp - 8]
call fcn.0040573c
ret
Function at 0x50b178
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
xor ecx, ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
xor eax, eax
push ebp
push 0x50b2bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040573c
lea eax, [ebp - 4]
mov edx, dword [0x560884]
mov edx, dword [edx + 4]
call fcn.004057d4
xor eax, eax
push ebp
push 0x50b290
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x50b224
cmp dword [ebp - 0x8c], 1
jne 0x50b224
cmp dword [ebp - 0x94], 0xa
jne 0x50b224
lea ecx, [ebp - 0xa0]
mov edx, 0x50b2d0
mov eax, dword [ebp - 4]
call fcn.004fe830
mov edx, dword [ebp - 0xa0]
lea eax, [ebp - 4]
call fcn.004057d4
call fcn.00405140
jmp 0x50b297
call fcn.004fd964
sub al, 2
jb 0x50b233
sub al, 0xa
jb 0x50b256
jmp 0x50b277
lea ecx, [ebp - 0xa4]
mov edx, 0x50b2e0
mov eax, dword [ebp - 4]
call fcn.004fe830
mov edx, dword [ebp - 0xa4]
lea eax, [ebp - 4]
call fcn.004057d4
jmp 0x50b277
lea ecx, [ebp - 0xa8]
mov edx, 0x50b2f0
mov eax, dword [ebp - 4]
call fcn.004fe830
mov edx, dword [ebp - 0xa8]
lea eax, [ebp - 4]
call fcn.004057d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50b297
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405790
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50b2c4
lea eax, [ebp - 0xa8]
mov edx, 3
call fcn.00405760
lea eax, [ebp - 4]
call fcn.0040573c
ret

Function at 0x50b620
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bbc
mov eax, dword [ebp - 8]
call fcn.00405bbc
mov eax, dword [ebp - 0xc]
call fcn.00405bbc
xor eax, eax
push ebp
push 0x50b72b
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004fe830
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004fe830
push 0
mov eax, dword [ebp - 0x14]
call fcn.00405bcc
push eax
mov eax, dword [ebp - 0x10]
call fcn.00405bcc
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x50b6fb
push 0
push 0x50b744
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0040b0b0
push dword [ebp - 0x20]
push 0x50b754
push dword [ebp - 0x10]
push 0x50b76c
push dword [ebp - 0x14]
push 0x50b77c
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00405ad0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00406120
mov eax, dword [ebp - 0x18]
movzx ecx, word [0x50b78c]
mov dl, 1
call fcn.004fde7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50b732
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00405760
lea eax, [ebp - 0x18]
call fcn.00405f44
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405760
ret
Function at 0x50b790
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bbc
mov eax, dword [ebp - 8]
call fcn.00405bbc
xor eax, eax
push ebp
push 0x50b7fd
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004fe830
mov eax, dword [ebp - 0xc]
call fcn.00405bcc
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50b804
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405760
ret

Function at 0x50b80c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bbc
mov eax, dword [ebp - 8]
call fcn.00405bbc
xor eax, eax
push ebp
push 0x50b8f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004fe830
mov eax, dword [ebp - 0xc]
call fcn.0040b500
test al, al
je 0x50b8cd
push 0x20
mov eax, dword [ebp - 0xc]
call fcn.00405bcc
mov esi, eax
push esi
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA_1
cmp eax, 0xffffffff
jne 0x50b88b
xor ebx, ebx
jmp 0x50b891
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
jne 0x50b8cd
push 0
push 0x50b910
push dword [ebp - 0xc]
push 0x50b920
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405ad0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00406120
mov eax, dword [ebp - 0x10]
movzx ecx, word [0x50b93c]
mov dl, 1
call fcn.004fde7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50b8ff
lea eax, [ebp - 0x14]
call fcn.0040573c
lea eax, [ebp - 0x10]
call fcn.00405f44
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405760
ret
Function at 0x514f44
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x515137
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x51511e
mov eax, dword [edi + 0x30]
test eax, eax
je 0x514f82
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x514fa2
mov eax, dword [edi + 0x34]
test eax, eax
je 0x514f92
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x514fa2
mov eax, edi
call fcn.005151d8
jmp 0x51511e
cmp dword [edi + 0xa0], 0
jne 0x514fd9
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.0040bb24
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5608a8]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x515010
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.0040bb24
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5608a8]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00515218
mov ebx, eax
test bl, bl
jne 0x5150d3
mov eax, dword [edi + 0x30]
test eax, eax
je 0x515039
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x515053
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x51504c
sub eax, 4
mov eax, dword [eax]
test eax, eax
sete al
jmp 0x515055
xor eax, eax
test al, al
jne 0x5150d3
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x515068
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x51507f
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.0040bb24
jmp 0x5150ab
push dword [edi + 0x30]
push 0x515154
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00405ad0
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.0040bb24
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x5150d3
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00515218
mov ebx, eax
test bl, bl
jne 0x5150e0
mov eax, edi
call fcn.005151d8
jmp 0x51511e
mov eax, dword [edi + 0x58]
test eax, eax
je 0x5150ef
mov dword [edi + 0xa8], eax
jmp 0x5150f9
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.00515290
test al, al
je 0x51511e
mov eax, edi
mov si, 0xffee
call fcn.004049dc
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.005154f0
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51513e
lea eax, [ebp - 0x108]
call fcn.0040573c
ret
Function at 0x52cc44
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bbc
mov eax, dword [ebp - 8]
call fcn.00405bbc
xor eax, eax
push ebp
push 0x52cd88
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403b7c
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 0xa
test bl, bl
je 0x52ccaf
lea eax, [ebp - 0xc]
mov edx, 0x52cda0
call fcn.004057d4
jmp 0x52ccbc
lea eax, [ebp - 0xc]
mov edx, 0x52cdc0
call fcn.004057d4
push 0
call sub.kernel32.dll_SetLastError
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x8000020
push 0
push 0
push 0
push dword [ebp - 8]
push 0x52cde0
push 0x52cdec
push dword [ebp - 0xc]
push 0x52cdf8
push dword [ebp - 4]
push 0x52cdec
lea eax, [ebp - 0x68]
mov edx, 7
call fcn.00405ad0
mov eax, dword [ebp - 0x68]
call fcn.00405bcc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x52cd65
xor eax, eax
push ebp
push 0x52cd5e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_GetExitCodeProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52cd65
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52cd8f
lea eax, [ebp - 0x68]
call fcn.0040573c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405760
ret
Function at 0x5351d4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bbc
mov eax, dword [ebp - 8]
call fcn.00405bbc
xor eax, eax
push ebp
push 0x53534a
push dword fs:[eax]
mov dword fs:[eax], esp
or ebx, 0xffffffff
push ebx
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x535364
call fcn.00405a54
mov eax, dword [ebp - 0x10]
call fcn.00405bcc
push eax
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004fe830
mov eax, dword [ebp - 0x14]
call fcn.00405bcc
push eax
call sub.kernel32.dll_CopyFileA
mov dl, 1
mov eax, dword [0x42c3b0]
call fcn.0042c51c
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0042c5f8
mov byte [ebx + 0xc], 0
call fcn.004fd964
cmp al, 2
jne 0x535277
xor ecx, ecx
mov edx, 0x535380
mov eax, ebx
call fcn.0042c660
jmp 0x535285
xor ecx, ecx
mov edx, 0x5353b8
mov eax, ebx
call fcn.0042c660
lea ecx, [ebp - 0x18]
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.00446354
mov eax, dword [ebp - 0x18]
mov edx, 0x5353f4
call fcn.0040a6a0
test eax, eax
jne 0x5352b5
lea eax, [ebp - 0xc]
mov edx, 0x535400
call fcn.004057d4
jmp 0x5352bd
lea eax, [ebp - 0xc]
call fcn.0040573c
mov esi, dword [ebp - 4]
test esi, esi
je 0x5352c9
sub esi, 4
mov esi, dword [esi]
lea ecx, [ebp - 0x1c]
mov edx, esi
sub edx, 4
mov eax, dword [ebp - 4]
call fcn.00446338
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.00405a08
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0042cc9c
mov eax, ebx
call fcn.0042c5c8
mov eax, ebx
call fcn.004047e0
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov edx, 0x535364
call fcn.00405a54
mov eax, dword [ebp - 0x20]
call fcn.00405bcc
push eax
call sub.gdi32.dll_AddFontResourceA
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_PostMessageA
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x535351
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00405760
ret
Function at 0x541724
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x541881
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edx
mov word [ebp - 0x10], 0
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00544244
call fcn.004fd964
sub al, 2
jae 0x5417a9
push 0xff
lea eax, [ebp - 0x25c]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x25c]
mov ecx, pe_nt_image_headers32
call fcn.004059ac
mov eax, dword [ebp - 0x260]
mov ecx, 0xff
xor edx, edx
call fcn.00405c34
lea eax, [ebx + 0x3cc]
mov edx, dword [ebp - 0xc]
call fcn.00405790
lea ecx, [ebp - 4]
mov edx, 0x541898
mov eax, dword [ebp - 0xc]
call fcn.004fe830
mov eax, dword [ebp - 4]
call fcn.0040b500
test al, al
je 0x54182c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x15c]
call fcn.0040388c
mov edx, 2
lea eax, [ebp - 0x15c]
call fcn.00403f3c
call fcn.00403228
test eax, eax
jne 0x541821
lea edx, [ebp - 0xe]
lea eax, [ebp - 0x15c]
call fcn.00403c18
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x15c]
call fcn.00403c18
lea eax, [ebp - 0x15c]
call fcn.00403954
call fcn.00403228
movsx ebx, word [ebp - 0x10]
jmp 0x54185b
mov word [ebp - 0x10], 1
mov esi, 0x1e
mov ebx, dword [0x55a668]
call fcn.004ffdbc
movzx edx, byte [ebx]
cmp eax, edx
jne 0x541851
movzx eax, word [ebx + 2]
mov word [ebp - 0x10], ax
add ebx, 0xc
dec esi
jne 0x54183d
movsx ebx, word [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x541888
lea eax, [ebp - 0x260]
call fcn.0040573c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405760
ret

Function at 0x543ae8
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405bbc
xor eax, eax
push ebp
push 0x543be7
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0xc]
mov edx, 0x543c00
call fcn.004057d4
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004057d4
lea eax, [ebp - 0x11]
push eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004fed50
test al, al
jne 0x543b4a
xor ebx, ebx
jmp 0x543bcc
lea eax, [ebp - 0x265]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405bcc
push eax
mov eax, dword [ebp - 4]
call fcn.00405bcc
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
jne 0x543b72
xor ebx, ebx
jmp 0x543bcc
lea eax, [ebp - 4]
lea edx, [ebp - 0x265]
mov ecx, 0x105
call fcn.004059ac
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x160]
call fcn.0040388c
mov edx, 1
lea eax, [ebp - 0x160]
call fcn.00403f58
call fcn.00403228
test eax, eax
jne 0x543bbe
xor ebx, ebx
lea eax, [ebp - 0x160]
call fcn.00403954
call fcn.00403094
mov eax, dword [ebp - 4]
call fcn.00405bcc
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x543bee
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405760
ret