joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8a2a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
xor edi, edi
lea esi, [ebx + 0x1c]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4e8a42
mov eax, dword [esi]
push edi
push edi
push 3
push edi
push 7
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 0x34], eax
test eax, eax
je 0x4e8a78
cmp eax, 0xffffffff
je 0x4e8a78
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor edi, edi
mov dword [ebx + 0xc], eax
mov ecx, ebx
inc edi
call fcn.004e8ac0
jmp 0x4e8ab9
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], esi
jb 0x4e8a86
mov eax, dword [esi]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 4]
push str.win32PE__open_s_failed_err_d
call fcn.004e89df
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x4e8aa5
mov esi, dword [esi]
push esi
push str.win32PE__open_s_failed
call fcn.004e89df
mov edx, dword [ebx]
pop ecx
pop ecx
mov ecx, ebx
call dword [edx + 4]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4e8ac0
Capabilities:
Read file via mapping

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
push edi
push dword [esi + 0xc]
push edi
push 2
push edi
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x38], eax
test eax, eax
jne 0x4e8b16
add esi, 0x1c
cmp dword [esi + 0x14], 8
jb 0x4e8ae9
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.win32PE__CreateFileMapping_s_failed_err_d
call fcn.004e89df
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.win32PE__failed_to_open_file_mapping_error_d
call fcn.004e89df
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
ret
push dword [esi + 0xc]
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [esi + 0x10], ecx
test ecx, ecx
je 0x4e8afe
mov eax, dword [esi + 0xc]
xor edi, edi
add eax, ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
inc edi
jmp 0x4e8b11

Function at 0x4ec3c6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4044
call fcn.0056b970
mov eax, dword [0x654b34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0x5dcadc
push eax
call fcn.0057e396
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4ec3f8
xor al, al
jmp 0x4ec455
push edi
push 0
lea eax, [ebp - 0x4044]
push 0x4ecec5
push eax
call fcn.004ed014
mov edi, 0x4000
jmp 0x4ec427
push eax
lea eax, [ebp - 0x4004]
push eax
lea eax, [ebp - 0x4044]
push eax
call fcn.004ed036
push esi
push edi
lea eax, [ebp - 0x4004]
push 1
push eax
call fcn.0057e5cd
add esp, 0x1c
test eax, eax
jg 0x4ec413
lea ecx, [ebp - 0x4044]
push ecx
call fcn.004ecffd
push esi
call fcn.0057e774
pop ecx
pop ecx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0056ac5f
leave
ret
Function at 0x4ef184
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4ef191
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004ef197

Function at 0x50045c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x14]
push esi
xor esi, esi
push esi
push dword [0x668ecc]
mov eax, dword [ecx]
push dword [ebp + 8]
call dword [eax + 0x18]
test eax, eax
je 0x5004b2
push esi
push esi
push esi
push 0x515
call fcn.004f01c4
push str.jme__LaunchMeetingProcess__faield_to_check_digital_signature
call fcn.005004d9
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x17
call fcn.004f02fb
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x5004c0
push str.jme__LaunchMeetingProcess__check_digital_signature_ok
call fcn.005004f6
xor eax, eax
pop ecx
inc eax
pop esi
pop ebp
ret 4

Function at 0x500747
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi], ebx
jne 0x5007e8
push esi
call fcn.004d9206
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceExW]
movzx eax, ax
push eax
push 0x65
push 5
push dword [0x668ecc]
call esi
test eax, eax
jne 0x50078a
push 0x409
push 0x65
push 5
push dword [0x668ecc]
call esi
test eax, eax
je 0x5007e7
push eax
push dword [0x668ecc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5007b8
push ebx
push 0x5007eb
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [0x668ecc]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov dword [edi], eax
cmp dword [edi], ebx
je 0x5007e7
lea esi, [edi + 0xc]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x5007c9
mov eax, dword [esi]
push eax
push str.error_message_window_title:__s
call fcn.00500a82
cmp dword [esi + 0x14], 8
pop ecx
pop ecx
jb 0x5007de
mov esi, dword [esi]
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop esi
pop edi
pop ebx
ret
Function at 0x509ed4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [esi + 4], 0x8160
jne 0x509f32
mov eax, dword [esi + 0xc]
cmp dword [eax + 4], 0x100
jne 0x509f32
cmp dword [eax + 8], 9
jne 0x509f32
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x509f32
lea ecx, [edi - 0x148]
call fcn.0052f74c
cmp dword [esi + 0x10], eax
jne 0x509f32
lea ecx, [edi - 0x148]
call fcn.0052f6ab
push eax
call fcn.00550639
xor eax, eax
pop ecx
inc eax
jmp 0x509f34
xor eax, eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x5148d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
jne 0x5148e4
xor eax, eax
leave
ret
push esi
push edi
or edi, 0xffffffff
lea eax, [ebp + 8]
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
movsd qword [ebp - 0x18], xmm0
cmovne edi, dword [ebp + 0xc]
xor esi, esi
push edi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
call fcn.00514674
mov edx, dword [ebp + 8]
pop ecx
pop ecx
xor ecx, ecx
mov byte [ebp - 1], al
mov dword [ebp - 0xc], ecx
cmp edx, edi
jae 0x514a63
movsd xmm2, qword [0x624770]
movzx eax, word [edx]
mov dword [ebp + 8], eax
add eax, 0xffffffd0
cmp eax, 9
ja 0x51495d
mov eax, dword [ebp + 8]
sub esi, ecx
movsd xmm1, qword [ebp - 0x18]
add eax, 0xffffffd0
inc dword [ebp - 0xc]
mulsd xmm1, xmm2
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
movsd qword [ebp - 0x18], xmm1
jmp 0x514968
cmp word [edx], 0x2e
jne 0x51496f
test ecx, ecx
jne 0x51496f
inc ecx
add edx, 2
cmp edx, edi
jb 0x514928
cmp dword [ebp - 0xc], 0
push 0
mov dword [ebp - 8], esi
pop ecx
je 0x514a63
movzx eax, word [edx]
cmp eax, 0x65
je 0x51498c
cmp eax, 0x45
jne 0x5149f3
cmp edx, edi
jae 0x5149f3
add edx, 2
mov byte [ebp + 0xb], cl
mov esi, edx
movzx eax, word [edx]
sub eax, 0x2b
je 0x5149aa
dec eax
sub eax, 1
jne 0x5149af
mov byte [ebp + 0xb], 1
add edx, 2
mov esi, edx
cmp esi, edi
jae 0x5149df
movzx eax, word [edx]
mov ecx, eax
mov dword [ebp - 0xc], ecx
cmp ecx, 0x30
mov ecx, dword [ebp - 0x10]
jb 0x5149df
cmp eax, 0x39
ja 0x5149df
imul eax, ecx, 0xa
lea edx, [esi + 2]
mov ecx, dword [ebp - 0xc]
mov esi, edx
add ecx, 0xffffffd0
add ecx, eax
mov dword [ebp - 0x10], ecx
cmp edx, edi
jb 0x5149b3
mov ecx, dword [ebp - 8]
mov eax, ecx
sub eax, dword [ebp - 0x10]
add ecx, dword [ebp - 0x10]
cmp byte [ebp + 0xb], 0
cmovne ecx, eax
jmp 0x5149f6
mov ecx, dword [ebp - 8]
lea eax, [ecx + 0x3fd]
cmp eax, 0x7fd
ja 0x514a4e
cmp byte [ebp - 1], 0
movsd xmm1, qword [ebp - 0x18]
jne 0x514a15
xorps xmm1, xmmword [0x5f0590]
test ecx, ecx
jns 0x514a33
neg ecx
je 0x514a56
test cl, 1
je 0x514a26
divsd xmm1, xmm2
sar ecx, 1
movaps xmm0, xmm2
mulsd xmm2, xmm0
jne 0x514a1d
jmp 0x514a56
je 0x514a56
test cl, 1
je 0x514a41
movaps xmm0, xmm2
mulsd xmm1, xmm0
sar ecx, 1
movaps xmm0, xmm2
mulsd xmm2, xmm0
jne 0x514a35
jmp 0x514a56
movsd xmm1, qword [0x6247a0]
mov eax, dword [ebp + 0x10]
cmp edx, edi
cmovae edx, dword [ebp + 0xc]
movsd qword [eax], xmm1
pop edi
mov eax, edx
pop esi
leave
ret
Function at 0x527950
Capabilities:
Open clipboard

Disassembly:
push 0x4c
mov eax, 0x5c47d0
call fcn.0056b70f
mov esi, ecx
call fcn.0055192e
mov eax, dword [esi + 0x128]
mov edi, dword [esi + 0x12c]
cmp eax, edi
je 0x527a2a
xor ecx, ecx
cmp word [esi + 0x114], cx
jne 0x527a2a
cmp edi, eax
mov ebx, edi
mov ecx, esi
cmovge ebx, eax
cmovle edi, eax
sub edi, ebx
call fcn.0052e7f4
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [esi + 0x104]
lea edx, [ebp - 0x40]
push 0xffffffffffffffff
push 0
push edx
mov eax, dword [ecx]
call dword [eax + 0x10]
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x5279c5
mov eax, dword [eax]
lea eax, [eax + ebx*2]
push edi
push eax
lea ecx, [ebp - 0x28]
call fcn.004d47e7
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0054bbb8
pop ecx
lea ecx, [ebp - 0x28]
call fcn.00417a51
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00417a51
mov eax, dword [esi + 0x58]
shr eax, 1
test al, 1
je 0x527a24
mov ecx, dword [esi + 0x104]
lea edx, [ebp - 0x58]
push edi
push ebx
push edx
mov eax, dword [ecx]
call dword [eax + 0x14]
push eax
mov dword [ebp - 4], 2
call fcn.0054baf0
pop ecx
lea ecx, [ebp - 0x58]
call fcn.00417a51
call dword [sym.imp.USER32.dll_CloseClipboard]
call fcn.0056b6b9
ret

Function at 0x52b56c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov ebx, SysReAllocString
lea eax, [edi + 8]
mov dword [ebp - 4], eax
mov eax, dword [eax]
mov edi, dword [eax]
cmp eax, edi
je 0x52b5d7
mov ecx, dword [ebp - 8]
add ecx, 0x10
mov dword [ebp - 8], ecx
push esi
push ecx
lea ecx, [edi + 8]
call fcn.0052b4f9
cmp eax, 0x7fffffff
je 0x52b5b4
cmp ebx, eax
cmovg ebx, eax
cmp dword [edi + 8], 0
jne 0x52b5cb
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push edi
push eax
call fcn.00554722
mov edi, dword [eax]
jmp 0x52b5cd
mov edi, dword [edi]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp dword [eax], edi
jne 0x52b59e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebx + esi]
pop edi
sub ecx, eax
pop esi
mov eax, ecx
pop ebx
leave
ret
Function at 0x534c51
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 4], esi
je 0x534c9a
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + 4], 0x100
jne 0x534c9a
mov eax, dword [ebx + 8]
cmp eax, 3
je 0x534d3a
cmp eax, 9
je 0x534ce6
cmp eax, 0xd
je 0x534ce2
cmp eax, 0x1b
je 0x534d3a
cmp eax, 0x24
jbe 0x534c9a
cmp eax, 0x28
jbe 0x534ca3
cmp eax, 0x2b
je 0x534ce2
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x20]
test eax, eax
je 0x534cc9
mov ecx, dword [ebp + 8]
call fcn.0052e7f4
push esi
push 0x10002
push 0x127
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebx + 8], 0x25
je 0x534cd5
cmp dword [ebx + 8], 0x26
jne 0x534cd8
xor esi, esi
inc esi
push esi
mov ecx, edi
call fcn.0054780d
jmp 0x534c9a
push 1
jmp 0x534d3c
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
jne 0x534d32
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x20]
test eax, eax
je 0x534d20
mov ecx, dword [ebp + 8]
call fcn.0052e7f4
push esi
push 0x10002
push 0x127
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x10
call ebx
mov ecx, dword [edi + 4]
and eax, 0x8000
push eax
call fcn.0054790a
xor eax, eax
inc eax
jmp 0x534c9c
push 2
call fcn.0052e4e9
push eax
push dword [ebp + 8]
call fcn.00550bfa
add esp, 0xc
jmp 0x534d32

Function at 0x537fda
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push ebx
mov edi, ecx
mov ecx, esi
push 0xffffffffffffffff
call fcn.005499ce
test eax, eax
je 0x53801a
cmp dword [esi + 0x10], ebx
je 0x53801a
cmp eax, 0xffffffff
jne 0x538024
cmp dword [esi + 0x14], 8
jb 0x538007
mov esi, dword [esi]
push 1
push ebx
push ebx
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x53802d
mov eax, dword [edi + 0x9c]
test eax, eax
je 0x53802d
push ebx
push eax
mov ecx, edi
call fcn.0053859f
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x539801
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 8], ebx
push esi
mov ecx, dword [ebx + 0x138]
mov dword [ebp - 4], ecx
cmp eax, 0x20
je 0x539895
cmp eax, 0x21
je 0x539889
jle 0x53988d
cmp eax, 0x23
jle 0x53986d
cmp eax, 0x24
je 0x539889
cmp eax, 0x26
je 0x539853
cmp eax, 0x28
jne 0x53988d
mov eax, dword [ebx + 0x12c]
sub eax, dword [ebx + 0x128]
push 0x14
cdq
pop esi
idiv esi
dec eax
cmp ecx, eax
jge 0x539857
inc ecx
jmp 0x539868
test ecx, ecx
jg 0x539867
mov eax, dword [ebx + 0xa0]
shr eax, 4
not al
and eax, 1
jmp 0x5398ca
dec ecx
mov dword [ebp - 4], ecx
jmp 0x539895
mov eax, dword [ebx + 0x12c]
sub eax, dword [ebx + 0x128]
push 0x14
cdq
pop esi
idiv esi
dec eax
cmp ecx, eax
je 0x53988d
mov dword [ebp - 4], eax
jmp 0x539895
test ecx, ecx
jne 0x539891
xor eax, eax
jmp 0x5398ca
and dword [ebp - 4], 0
mov ebx, dword [ebx + 0xa0]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
call esi
movzx edi, ax
push 0x11
and edi, 0x8000
call esi
mov ecx, dword [ebp - 8]
and eax, 0x8000
push eax
push edi
push ebx
push dword [ebp - 4]
call fcn.005462cd
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x53befc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
test edi, edi
jne 0x53bf0e
xor eax, eax
jmp 0x53bf65
push ebx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
push 1
and ax, cx
mov ecx, dword [esi]
pop ebx
jne 0x53bf44
lea eax, [edi - 1]
cmp ecx, eax
jne 0x53bf40
mov ecx, dword [ebp + 8]
and dword [esi], 0
mov edx, dword [ecx]
lea eax, [ecx + 0x5c]
push eax
call dword [edx + 0x24]
xor eax, eax
jmp 0x53bf64
mov eax, ebx
jmp 0x53bf52
test ecx, ecx
jne 0x53bf4f
lea eax, [edi - 1]
xor ebx, ebx
jmp 0x53bf54
or eax, 0xffffffff
add eax, ecx
mov ecx, dword [ebp + 8]
mov dword [esi], eax
mov esi, dword [ecx]
lea edx, [ecx + 0x5c]
push edx
call dword [esi + 0x24]
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x53e3f0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 0x3c
mov eax, 0x5c5db6
call fcn.0056b70f
mov edi, ecx
test dword [edi + 0xa0], 0x800
jne 0x53e4e2
call fcn.0052e7f4
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
mov eax, dword [edi + 0x58]
xor ebx, ebx
shr eax, 1
test al, 1
je 0x53e437
movzx eax, word [0x664f44]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
jmp 0x53e439
mov esi, ebx
test esi, esi
jne 0x53e463
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x53e4dc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push 1
push eax
mov ecx, edi
call fcn.00545317
jmp 0x53e4d5
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00553dd0
pop ecx
pop ecx
mov ecx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.004178c5
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0054b96c
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00417c81
cmp dword [ebp - 0x30], 0
je 0x53e4c1
cmp dword [ebp - 0x2c], 8
lea ebx, [ebp - 0x40]
cmovae ebx, dword [ebp - 0x40]
push 1
push 1
push ebx
mov ecx, edi
call fcn.00545317
lea ecx, [ebp - 0x40]
call fcn.00417a51
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
call fcn.0056b6b9
ret
Function at 0x54747d
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00534076
mov ecx, dword [ebp + 8]
mov esi, eax
lea eax, [ebp + 8]
mov dword [ebp + 8], ecx
push eax
mov ecx, esi
call fcn.00545dd6
cmp dword [esi + 0x14], 0
jne 0x5474b5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x532420
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [esi + 0x14], eax
pop esi
pop ebp
ret

Function at 0x5486ba
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x654b34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], esi
mov eax, dword [ebx + 0x18]
shr eax, 7
test al, 1
je 0x5486f9
cmp dword [esi], 0
je 0x54882a
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x54882a
push 0xfffffffffffffff0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
jne 0x54882a
mov eax, dword [ebx + 0x18]
shr eax, 6
test al, 1
jne 0x548736
mov al, byte [ebx + 0x18]
not al
test al, 1
je 0x54882a
push dword [ebx]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x54874d
jmp 0x54882a
lea eax, [ebp - 0x14]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.0054522d
call fcn.005528bc
test eax, eax
je 0x54882a
push edi
mov edi, dword [esi]
xor ecx, ecx
test edi, edi
jne 0x548785
push ecx
push ecx
push 0x80000a0
push SysReAllocString
push ecx
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push ecx
mov ecx, esi
movups xmmword [ebp - 0x14], xmm0
call fcn.00527b50
mov edi, dword [esi]
mov edx, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
add eax, edx
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebx + ecx]
mov dword [ebp - 0x20], edx
push edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x458
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
push 0xffffffffffffffff
call fcn.00548637
and dword [ebp - 8], 0
mov esi, dword [sym.imp.USER32.dll_GetWindowDC]
push 0
call esi
mov ecx, dword [ebp - 0x18]
mov edi, eax
mov dword [ebp - 0xc], edi
mov ecx, dword [ecx]
push ecx
mov dword [ebp - 0x2c], ecx
call esi
push 0xcc0020
push dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x20]
push edi
push ebx
push dword [ebp - 0x24]
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
lea ecx, [ebp - 0x30]
call fcn.00521a42
lea ecx, [ebp - 0xc]
call fcn.00521a42
mov ecx, dword [ebp - 0x28]
pop edi
cmp dword [ecx + 4], 0xffffffff
jne 0x548824
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ecx + 4], eax
call dword [sym.imp.dwmapi.dll_DwmFlush]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0056ac5f
leave
ret 8
Function at 0x599b81
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005996cd

Function at 0x59fb0b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x654b34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x665c9c]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x666918]
cmp eax, dword [ecx + 4]
jg 0x59fd6e
cmp dword [0x666914], 0
je 0x59fb60
push 0x6554a0
mov ecx, ebx
call fcn.004144cf
xor eax, eax
inc eax
jmp 0x59fd5e
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0056dc10
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x602d10
lea ecx, [ebp - 0x264]
call fcn.00417c00
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x27c]
call fcn.00417c00
push 0x5c
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.004d0e43
add esp, 0x10
lea ecx, [ebp - 0x27c]
call fcn.00417a51
lea ecx, [ebp - 0x264]
call fcn.00417a51
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
lea ecx, [ebp - 0x264]
cmovae eax, dword [ebp - 0x228]
push eax
call fcn.00417c00
lea eax, [ebp - 0x264]
push eax
call fcn.004cfc7f
pop ecx
mov esi, eax
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x24c], esi
call fcn.00417a51
lea ecx, [esi + 1]
mov dword [ebp - 0x248], edi
push ecx
lea eax, [ebp - 0x248]
push eax
call fcn.0059f9a0
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.0059f831
mov esi, dword [ebp - 0x248]
add esp, 0x10
test al, al
jne 0x59fd45
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
push esi
push dword [ebp - 0x24c]
cmovae eax, dword [ebp - 0x228]
push edi
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x59fd45
lea eax, [ebp - 0x210]
mov dword [ebp - 0x244], edi
push eax
lea eax, [ebp - 0x244]
mov dword [ebp - 0x210], edi
push eax
push 0x60de24
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x59fd45
mov ecx, dword [ebp - 0x244]
test ecx, ecx
je 0x59fd45
movzx eax, word [ecx + 0x10]
push eax
movzx eax, word [ecx + 0x12]
push eax
lea eax, [ebp - 0x240]
push str._d._d
push eax
call fcn.004d2a12
push 0xfde9
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.004d326c
add esp, 0x1c
mov ecx, 0x6554a0
push eax
call fcn.0041627d
lea ecx, [ebp - 0x264]
call fcn.00417c81
inc edi
mov ecx, ebx
push 0x6554a0
mov dword [0x666914], edi
call fcn.004144cf
cmp dword [ebp - 0x22c], 8
lea eax, [ebp - 0x240]
cmovae eax, dword [ebp - 0x240]
push eax
push str.osVersion_is:__s
call fcn.005a07e4
pop ecx
pop ecx
lea ecx, [ebp - 0x240]
call fcn.00417a51
test esi, esi
je 0x59fd50
push esi
call fcn.0056b239
pop ecx
lea ecx, [ebp - 0x228]
call fcn.00417a51
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0056ac5f
leave
ret 4
mov esi, 0x666918
push esi
call fcn.0056aeab
cmp dword [0x666918], 0xffffffff
pop ecx
jne 0x59fb43
push 0x5cdc04
call fcn.0056b224
push esi
call fcn.0056ae61
pop ecx
pop ecx
jmp 0x59fb43
Function at 0x5a2805
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
xor eax, eax
push esi
push eax
push esi
push 0x5a2ac5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x5a2838
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.JMT__CPostDataParamThread::CreateThread_error__x_
call fcn.005a2b08
pop ecx
pop ecx
xor eax, eax
pop esi
ret
mov eax, dword [esi]
pop esi
ret