joyce8/EMBER2024-capa huggingface dataset:
Function at 0x568e20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00405164
xor eax, eax
push ebp
push 0x56902b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 4]
mov edx, 0x569044
call fcn.00404fc0
mov eax, dword [ebp - 0x6c]
call fcn.00592d9c
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.0040360c
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], 1
xor edx, edx
push ebp
push 0x568fee
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405174
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 0xffffffffffffffff
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 5], 0
je 0x568fa4
xor esi, esi
xor edi, edi
mov eax, 0x56905c
call fcn.00592d9c
jmp 0x568f56
mov eax, dword [ebp - 0xc]
call fcn.00572068
mov edi, eax
test edi, edi
jbe 0x568f4b
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x78], edi
mov byte [ebp - 0x74], 0
lea edx, [ebp - 0x78]
xor ecx, ecx
mov eax, 0x569074
call fcn.0040d808
mov eax, dword [ebp - 0x70]
call fcn.00592d9c
mov bl, 1
jmp 0x568f5f
inc esi
push 0x3e8
call sub.kernel32.dll_Sleep_1
cmp esi, 0xf
jge 0x568f5f
test bl, bl
je 0x568f17
test bl, bl
je 0x568f7f
push edi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
cmp eax, 0xffffffff
je 0x568fa4
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x568fa4
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 0xb
lea edx, [ebp - 0x78]
xor ecx, ecx
mov eax, 0x569088
call fcn.0040d808
mov eax, dword [ebp - 0x7c]
call fcn.00592d9c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
push 0x5690a0
push dword [ebp - 4]
push 0x5690b4
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x84]
call fcn.0040c5f0
push dword [ebp - 0x84]
lea eax, [ebp - 0x80]
mov edx, 4
call fcn.00405034
mov eax, dword [ebp - 0x80]
call fcn.00592d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x568ff8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x569032
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00404cd8
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.00404cd8
lea eax, [ebp - 0xc]
call fcn.00404cb4
ret
Function at 0x5722b0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
xor edx, edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405164
lea eax, [ebp - 0x15c]
mov edx, dword [0x40b000]
call fcn.004058a8
xor eax, eax
push ebp
push 0x57243a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x160]
mov ecx, 0x572450
mov edx, dword [ebp - 4]
call fcn.00404fc0
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x15c]
mov edx, 0x3f
call fcn.0040cc04
mov ebx, eax
test ebx, ebx
jne 0x5723de
mov eax, dword [ebp - 0x154]
and eax, 0x10
cmp eax, 0x10
je 0x572395
push dword [ebp - 4]
push 0x572460
push dword [ebp - 0x150]
lea eax, [ebp - 0x164]
mov edx, 3
call fcn.00405034
mov eax, dword [ebp - 0x164]
xor edx, edx
call fcn.0040cb70
push dword [ebp - 4]
push 0x572460
push dword [ebp - 0x150]
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00405034
mov eax, dword [ebp - 0x168]
call fcn.0040cc94
jmp 0x5723c9
mov eax, dword [ebp - 0x150]
cmp byte [eax], 0x2e
je 0x5723c9
push dword [ebp - 4]
push 0x572460
push dword [ebp - 0x150]
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00405034
mov eax, dword [ebp - 0x16c]
call fcn.005722b0
lea eax, [ebp - 0x15c]
call fcn.0040cc54
mov ebx, eax
test ebx, ebx
je 0x572331
lea eax, [ebp - 0x15c]
call fcn.0040cc78
mov eax, dword [ebp - 4]
call fcn.0040d0a8
test al, al
jne 0x572403
mov eax, dword [ebp - 4]
call fcn.00405174
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x572441
lea eax, [ebp - 0x16c]
mov edx, 4
call fcn.00404cd8
lea eax, [ebp - 0x15c]
mov edx, dword [0x40b000]
call fcn.00405978
lea eax, [ebp - 4]
call fcn.00404cb4
ret
Function at 0x57bc64
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x57bd03
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.0040d2f0
mov edx, dword [ebp - 0x108]
lea eax, [ebx + 0x18]
call fcn.00404d08
lea edx, [ebp - 0x10c]
mov eax, dword [ebx + 0x18]
call fcn.00411410
mov edx, dword [ebp - 0x10c]
lea eax, [ebx + 0x18]
mov ecx, 0x57bd18
call fcn.00404fc0
mov eax, dword [ebx + 0x18]
call fcn.0040ca74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57bd0a
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.00404cd8
ret

Function at 0x57c0b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x57c1e9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0x10], eax
cmp byte [ebx + 0x14], 0
je 0x57c0e8
lea eax, [ebx + 0xc]
mov ecx, 0x57c200
mov edx, dword [ebx + 0x18]
call fcn.00404fc0
jmp 0x57c0f8
lea eax, [ebx + 0xc]
mov ecx, 0x57c220
mov edx, dword [ebx + 0x18]
call fcn.00404fc0
mov eax, dword [ebx + 0xc]
call fcn.0040ca40
test al, al
je 0x57c10c
mov eax, dword [ebx + 0xc]
call fcn.0040cc94
push 0
push 0
mov cl, 1
mov dl, 1
mov eax, dword [0x597d1c]
call fcn.005983e4
mov esi, eax
mov dword [esi + 0x20], 1
cmp byte [ebx + 0x14], 0
je 0x57c13c
lea eax, [esi + 8]
mov edx, 0x57c23c
call fcn.00404d08
jmp 0x57c1a7
lea eax, [ebp - 4]
call fcn.0057bf88
test al, al
jne 0x57c150
lea eax, [ebp - 4]
call fcn.00404cb4
mov eax, dword [ebp - 4]
call fcn.00405174
mov edx, 0x57c268
call fcn.0040d1d0
test eax, eax
jne 0x57c175
lea eax, [esi + 8]
mov edx, 0x57c278
call fcn.00404d08
jmp 0x57c1a7
mov eax, dword [ebp - 4]
call fcn.00405174
mov edx, 0x57c2a8
call fcn.0040d1d0
test eax, eax
jne 0x57c19a
lea eax, [esi + 8]
mov edx, 0x57c2b8
call fcn.00404d08
jmp 0x57c1a7
lea eax, [esi + 8]
mov edx, 0x57c2f0
call fcn.00404d08
lea eax, [esi + 0x10]
mov edx, dword [ebx + 0xc]
call fcn.00404d08
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], 0x57c974
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], 0x57c33c
mov edx, esi
mov eax, dword [ebx + 0x24]
call fcn.0059817c
mov dword [ebx + 0x20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57c1f0
lea eax, [ebp - 4]
call fcn.00404cb4
ret

Function at 0x582864
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
add esp, 0xfffffff0
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, dword [esp]
mov edx, dword [esp + 4]
add eax, 1
adc edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
fild qword [esp]
fld xword [0x5828d8]
fdivp st(1)
fstp qword [esp + 8]
wait
fld qword [esp + 8]
fldln2
fxch st(1)
fyl2x
fstp st(0)
call sub.kernel32.dll_GetTickCount_1
mov edx, eax
sub edx, ebx
cmp edx, 0x3e8
jae 0x5828c3
cmp ebx, eax
jbe 0x58287e
fild qword [esp]
fdiv dword [0x5828e4]
call fcn.004033d4
add esp, 0x10
pop ebx
ret
Function at 0x582934
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
add esp, 0xfffffff0
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, dword [esp]
mov edx, dword [esp + 4]
add eax, 1
adc edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
fild qword [esp]
fld xword [0x5829a8]
fdivp st(1)
fstp qword [esp + 8]
wait
fld qword [esp + 8]
fldln2
fxch st(1)
fyl2x
fstp st(0)
call sub.kernel32.dll_GetTickCount_1
mov edx, eax
sub edx, ebx
cmp edx, 0x3e8
jae 0x582993
cmp ebx, eax
jbe 0x58294e
fild qword [esp]
fdiv dword [0x5829b4]
call fcn.004033d4
add esp, 0x10
pop ebx
ret
Function at 0x59068c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405164
xor eax, eax
push ebp
push 0x5907bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404cb4
cmp dword [ebp - 4], 0
je 0x5907a7
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00405174
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5907a7
mov eax, dword [ebp - 8]
call fcn.00402e04
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5907a0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5907cc
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
shr esi, 0x10
mov dx, word [eax + 8]
and dx, 0xffff
mov word [ebp - 0x1a], dx
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0x1c], dx
mov di, word [eax + 0xc]
and di, 0xffff
push ebx
movzx eax, si
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
movzx eax, word [ebp - 0x1a]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
movzx eax, word [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
movzx eax, di
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x3c]
mov ecx, 3
mov eax, 0x5907d8
call fcn.0040d808
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5907a7
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00402e34
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5907c4
lea eax, [ebp - 4]
call fcn.00404cb4
ret
Function at 0x5907e4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x590974
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00404cb4
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
call fcn.00404d4c
mov dword [ebp - 0x24], 0xff
mov eax, dword [ebp - 4]
call fcn.00404f74
test eax, eax
jle 0x590959
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.00405174
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jbe 0x590937
mov eax, dword [ebp - 0x1c]
call fcn.00402e04
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x590930
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x590917
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x590980
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5908ee
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.00408314
movzx eax, ax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
lea edx, [ebp - 0x44]
mov ecx, 2
mov eax, 0x5909a4
call fcn.0040d808
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.00404d4c
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x28]
call fcn.00405174
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x590917
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0040d2f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x590937
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00402e34
ret
mov eax, dword [ebp - 8]
mov edx, 0x5909cc
call fcn.004050c0
jne 0x590959
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x590959
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0059068c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59097b
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00404cd8
ret

Function at 0x592298
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, esi
call fcn.00404cb4
cmp ebx, 0xffffffff
je 0x5922ed
mov eax, 0x104
call fcn.0040d304
mov dword [esp + 4], eax
push esp
push edi
push ebx
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, dword [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x5922e4
mov edx, esi
mov eax, dword [esp + 4]
call fcn.0040d2f0
mov eax, dword [esp + 4]
call fcn.0040d360
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5926e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405164
xor eax, eax
push ebp
push 0x592811
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404cb4
cmp dword [ebp - 4], 0
je 0x5927fb
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00405174
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5927fb
mov eax, dword [ebp - 8]
call fcn.00402e04
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5927f4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x592820
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
shr esi, 0x10
mov dx, word [eax + 8]
and dx, 0xffff
mov word [ebp - 0x1a], dx
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0x1c], dx
mov di, word [eax + 0xc]
and di, 0xffff
push ebx
movzx eax, si
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
movzx eax, word [ebp - 0x1a]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
movzx eax, word [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
movzx eax, di
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x3c]
mov ecx, 3
mov eax, 0x59282c
call fcn.0040d808
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5927fb
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00402e34
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x592818
lea eax, [ebp - 4]
call fcn.00404cb4
ret
Function at 0x592ba8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x592d38
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00404cb4
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
call fcn.00404d4c
mov dword [ebp - 0x24], 0xff
mov eax, dword [ebp - 4]
call fcn.00404f74
test eax, eax
jle 0x592d1d
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.00405174
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jbe 0x592cfb
mov eax, dword [ebp - 0x1c]
call fcn.00402e04
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x592cf4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x592cdb
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x592d44
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x592cb2
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.00408314
movzx eax, ax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
lea edx, [ebp - 0x44]
mov ecx, 2
mov eax, 0x592d68
call fcn.0040d808
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.00404d4c
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x28]
call fcn.00405174
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x592cdb
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0040d2f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x592cfb
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00402e34
ret
mov eax, dword [ebp - 8]
mov edx, 0x592d90
call fcn.004050c0
jne 0x592d1d
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x592d1d
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005926e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x592d3f
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00404cd8
ret
Function at 0x59389c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x593908
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c]
mov edx, 0x3c
call fcn.00408328
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov eax, 0x59391c
mov dword [ebp - 0x30], eax
mov eax, ebx
call fcn.00405174
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 1
mov eax, esi
call fcn.00405174
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x593912
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x593924
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, eax
push 1
push 0
push 0
mov eax, esi
call fcn.00405174
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
cmp ebx, 0x20
ja 0x59395b
cmp dword [0x5ad98c], 0
je 0x59395b
mov edx, esi
mov eax, dword [0x5ad98c]
call fcn.0059389c
pop esi
pop ebx
ret

Function at 0x5942fc
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
mov eax, 0x594390
call fcn.00594250
mov eax, dword [ebx]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x594380
xor eax, eax
push ebp
push 0x594379
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0xc], 0x103
jne 0x594362
push 1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x594362
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x594380
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x595634
Capabilities:
Hide graphical window

Disassembly:
push ebx
push 0
mov eax, dword [0x5a8550]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x5a8550]
mov eax, dword [eax]
mov ebx, dword [eax + 0x30]
push ebx
call sub.user32.dll_GetWindowLongA
and eax, 0xfffbffff
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x5a8550]
push ebx
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x5a8550]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x5a8550]
mov eax, dword [eax]
mov ebx, dword [eax + 0x44]
test ebx, ebx
je 0x5956a5
push 0
mov eax, dword [0x5a8550]
mov eax, ebx
call fcn.00453c68
push eax
call sub.user32.dll_ShowWindow
mov al, 1
call fcn.005926c0
pop ebx
ret
Function at 0x595820
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov ebx, edx
mov esi, eax
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.0040360c
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
cmp byte [ebp - 1], 0
je 0x59585b
mov word [ebp - 0x1c], 1
jmp 0x595861
mov word [ebp - 0x1c], 0
xor eax, eax
push ebp
push 0x5958d0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, esi
call fcn.00405174
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test bl, bl
jne 0x59589a
mov bl, 1
jmp 0x5958c6
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5958e3
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x596c34
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040360c
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 1
xor eax, eax
push ebp
push 0x596cd3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, esi
call fcn.00405174
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test bl, bl
jne 0x596c9d
mov bl, 1
jmp 0x596cc9
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x596ce6
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret