joyce8/EMBER2024-capa huggingface dataset:
Function at 0x522654
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x522700
cmp dword [ebx + 0x98], 0
jne 0x5226fa
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x52258c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x5226fa
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5226c0
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5226fa
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.00449038
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5226cf
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x522920
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5d12fc]
cmp dword [eax + 0x178], 0
je 0x522a85
test bl, bl
jne 0x5229d3
cmp dword [esi + 0xa0], 0
jne 0x5229c8
mov eax, esi
call fcn.0052581c
push eax
push 0x52282c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x522999
mov eax, dword [0x5d12fc]
cmp byte [eax + 0xd7], 0
je 0x522999
mov eax, dword [esi + 0xdc]
call fcn.004091f4
mov edi, eax
cmp edi, 0
jl 0x522999
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x522982
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5229c8
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00449038
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5229a8
inc dword [esi + 0xa0]
jmp 0x522a85
cmp dword [esi + 0xa0], 0
jle 0x522a85
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x522a85
cmp dword [esi + 0x48], 0
je 0x522a30
mov eax, dword [0x5d12fc]
cmp byte [eax + 0xd7], 0
je 0x522a30
mov eax, dword [esi + 0xdc]
call fcn.004091f4
mov edi, eax
cmp edi, 0
jl 0x522a30
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x522a19
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x522a5f
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00449038
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x522a3f
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x514a18]
call fcn.004093a0
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x5236d8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb0], 0
je 0x523743
cmp byte [ebx + 0xd7], 0
jne 0x523743
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004073c4
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x523730
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x523750
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.0040761c
jmp 0x523750
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.0040761c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x524f88
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x524ff6
mov eax, esi
call fcn.004a4960
test al, al
je 0x524ff6
mov eax, dword [ebx + 0x88]
call fcn.004a45ac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x524ff6
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x108]
test al, al
je 0x524fea
push 0
mov eax, dword [ebx + 0x88]
call fcn.004a45ac
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.0049b390
jmp 0x524ff6
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.00524dc0
pop esi
pop ebx
ret
Function at 0x529750
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5297ca
mov eax, dword [ebx + 8]
call fcn.004a45ac
mov ecx, eax
mov dl, 1
mov eax, dword [0x4b03f8]
call fcn.0049e998
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.004b4a90
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2a0], 0x529048
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.004a45ac
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.004a45ac
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x529840
mov eax, dword [ebx + 8]
call fcn.004a45ac
mov ecx, eax
mov dl, 1
mov eax, dword [0x4b03f8]
call fcn.0049e998
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.004b4a90
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2a0], 0x529094
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.004a45ac
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.004a45ac
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5298ac
mov eax, dword [ebx + 8]
call fcn.004a45ac
mov ecx, eax
mov dl, 1
mov eax, dword [0x4b0e34]
call fcn.0049e998
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x278], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.004a45ac
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.004a45ac
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x52f4bc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x52f4d4
add esp, 0xfffffff0
call fcn.00405bfc
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x52f5ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.004045d4
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x52f5d8
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004b85c8
xor eax, eax
push ebp
push 0x52f5c5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004b85c8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00408008
jmp 0x52f596
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.00408334
mov eax, dword [ebx + 4]
call fcn.0040772c
dec eax
jle 0x52f5aa
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x52f584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52f5cc
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52f5f5
lea eax, [ebp - 4]
call fcn.00407284
ret

Function at 0x530634
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.0052fbf0
test byte [ebx + 0x2ad], 4
jne 0x5306c9
mov edx, esp
mov eax, ebx
call fcn.0049ad00
push esp
mov eax, ebx
call fcn.004a4344
push eax
push 0
mov eax, ebx
test eax, eax
je 0x530669
sub eax, 0xfffffd0c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x288]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x29c], 0
jne 0x53069a
mov ecx, dword [0x5cb560]
mov dl, 1
mov eax, dword [0x4b7f44]
call fcn.00425354
call fcn.00406970
mov eax, ebx
call fcn.005312c4
cmp byte [ebx + 0x61], 0
jne 0x5306d0
mov eax, ebx
call fcn.004a45ac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5306d0
push 0
mov eax, ebx
call fcn.004a45ac
push eax
call sub.user32.dll_ShowWindow
jmp 0x5306d0
mov eax, ebx
call fcn.004a0214
add esp, 0x10
pop ebx
ret
Function at 0x538eac
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x538f13
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthW
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 4]
call fcn.004080a4
push edi
mov eax, dword [ebp - 4]
call fcn.00407f38
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040761c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x538f1a
lea eax, [ebp - 4]
call fcn.0040723c
ret

Function at 0x541e84
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xfffffecc
cmp byte [0x5ca4fc], 0
jne 0x541f61
mov byte [0x5ca4fc], 1
xor eax, eax
mov dword [0x5ca4e4], eax
mov dword [esp + 0xc], 0x114
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 3
ja 0x541ecc
cmp dword [esp + 0x10], 3
jne 0x541f37
cmp dword [esp + 0x14], 0x33
jbe 0x541f37
mov dword [esp + 4], 0x12
push esp
push 0x20019
push 0
push 0x541f68
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x541f61
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x541fc8
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x541f61
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp word [esp + 0x120], 0x31
jne 0x541f61
cmp word [esp + 0x122], 0
jne 0x541f61
jmp 0x541f4c
push 0
push 0x541fc8
push 0x541fd4
call sub.kernel32.dll_GetProfileIntW
test eax, eax
je 0x541f61
mov eax, dword [0x5ca4e0]
call fcn.00407f38
push eax
call sub.kernel32.dll_LoadLibraryW
mov dword [0x5ca4e4], eax
add esp, 0x134
ret
Function at 0x5475e8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x547616
mov eax, ebx
call fcn.005480a4
cmp dword [ebx + 0x40], 0
je 0x54760f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x547687
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x547679
cmp dword [ebx + 8], 0
je 0x547638
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x54764a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x547679
cmp dword [ebx + 8], 0
je 0x54762b
cmp eax, 3
je 0x54765d
dec eax
jne 0x54762b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x54762b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x54762b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5476a5
cmp dword [ebx + 0x14], 0xcc
je 0x5476a5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005476b0
pop ebx
ret
Function at 0x559d64
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a99c
mov eax, dword [ebp + 8]
call fcn.00407320
xor eax, eax
push ebp
push 0x559eb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
call fcn.005583f4
test al, al
je 0x559e93
xor eax, eax
push ebp
push 0x559e85
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040a928
push eax
push 0x559ed0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax]
cmp dword [ebp - 8], 0
je 0x559e7b
xor eax, eax
push ebp
push 0x559e74
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x46fd4c]
call fcn.00479324
mov ebx, eax
mov edx, dword [ebp + 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.00446c20
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, ebx
call fcn.00479c44
call fcn.00474008
push eax
push esi
push 0
push 0
push 1
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov edx, dword [ebp + 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x559e7b
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 8]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x559e93
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x559ec0
lea eax, [ebp - 8]
call fcn.0040a928
lea eax, [ebp - 4]
call fcn.0040a928
lea eax, [ebp + 8]
call fcn.0040723c
ret
Function at 0x55ad44
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407320
xor eax, eax
push ebp
push 0x55af06
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
mov dl, 1
mov eax, dword [0x4637e0]
call fcn.004658a8
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x55aed7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x18]
call fcn.00465990
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x55af24
call fcn.0040817c
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
call fcn.00465ae8
lea ecx, [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004664a4
mov eax, dword [ebp - 0x18]
call fcn.00465960
push 0x55af24
push dword [ebp - 4]
push 0x55af54
push dword [ebp - 8]
push 0x55af64
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00408204
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
call fcn.00465ae8
lea ecx, [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004664a4
mov eax, dword [ebp - 0x18]
call fcn.00465960
cmp dword [ebp - 8], 0
je 0x55aec1
mov edx, dword [ebp - 8]
mov eax, 0x55af98
call fcn.00408498
test eax, eax
jle 0x55ae79
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x55af98
call fcn.00408498
mov ecx, eax
sub ecx, 2
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004082ec
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x55ae5a
sub ebx, 4
mov ebx, dword [ebx]
mov esi, dword [ebp - 8]
test esi, esi
je 0x55ae66
sub esi, 4
mov esi, dword [esi]
lea eax, [ebp - 0xc]
push eax
lea edx, [ebx + 1]
mov ecx, esi
mov eax, dword [ebp - 8]
call fcn.004082ec
jmp 0x55ae8c
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00407664
lea eax, [ebp - 0xc]
call fcn.0040723c
mov byte [ebp - 0x11], 1
push 5
push 0x55af9c
mov eax, dword [ebp - 0xc]
call fcn.00407f38
push eax
mov eax, dword [ebp - 0x10]
call fcn.00407f38
push eax
push 0x55afa0
mov eax, dword [0x5cb6ec]
mov eax, dword [eax]
mov eax, dword [eax + 0x178]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55aede
mov eax, dword [ebp - 0x18]
call fcn.004055f0
ret
Function at 0x55afac
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov ebx, ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a99c
xor eax, eax
push ebp
push 0x55b102
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x230]
call fcn.0040a928
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x48]
call fcn.0040aa38
mov eax, dword [ebp - 0x230]
call fcn.005583f4
test al, al
je 0x55b0ce
test bl, bl
je 0x55b046
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
push 2
push 7
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xd8]
call fcn.0040aa38
jmp 0x55b063
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 7
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xd8]
call fcn.0040aa38
xor esi, esi
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
push 0x200
lea eax, [ebp - 0x22c]
push eax
push ebx
call sub.user32.dll_GetClassNameW
mov eax, 0x55b11c
call fcn.00407f38
push eax
lea eax, [ebp - 0x22c]
push eax
call sub.kernel32.dll_lstrcmpW
test eax, eax
jne 0x55b0a2
mov esi, ebx
mov eax, dword [0x5cb6ec]
mov eax, dword [eax]
call fcn.00523ca4
call sub.kernel32.dll_GetTickCount_1
test esi, esi
jne 0x55b0c0
sub eax, edi
cmp eax, 0x1b58
jbe 0x55b06c
test esi, esi
je 0x55b0ce
mov eax, dword [ebp - 0x2c]
push eax
push esi
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b109
lea eax, [ebp - 0x230]
call fcn.0040a928
lea eax, [ebp - 0x28]
mov edx, dword [0x4012e0]
mov ecx, 2
call fcn.004087a8
lea eax, [ebp - 4]
call fcn.0040a928
ret

Function at 0x55c148
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407320
xor eax, eax
push ebp
push 0x55c198
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407f38
push eax
push 0x55c1a4
push ebx
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c19f
lea eax, [ebp - 4]
call fcn.0040723c
ret
Function at 0x55cad4
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407320
mov eax, dword [ebp - 8]
call fcn.00407320
xor eax, eax
push ebp
push 0x55cb62
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x55cb3b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00407f38
push eax
mov eax, dword [ebp - 4]
call fcn.00407f38
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55cb47
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55cb69
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040729c
ret

Function at 0x55d150
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404fe0
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x104
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], 1
mov eax, 0x104
call fcn.00420b08
mov ebx, eax
xor eax, eax
push ebp
push 0x55d1d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor ecx, ecx
mov edx, 0x208
call fcn.00404fe0
push 0xffffffffffffffff
push esi
push ebx
mov eax, dword [ebp - 0x38]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x55d1c1
mov dword [ebp - 4], ebx
jmp 0x55d1c9
mov eax, 0x55d1e8
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d1de
ret
Function at 0x55d1ec
Capabilities:
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407320
xor eax, eax
push ebp
push 0x55d30b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryW
mov eax, dword [ebp - 0xc]
call fcn.004045ec
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryW
mov esi, eax
test esi, esi
je 0x55d26a
lea eax, [ebp - 0x10]
mov edx, dword [ebx + 4]
call fcn.00407f90
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004082b4
jne 0x55d26a
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 8]
call fcn.00407f90
mov eax, ebx
call fcn.00404608
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x55d2e8
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.wininet.dll_FindNextUrlCacheEntryW
call sub.kernel32.dll_GetLastError_2
mov edi, eax
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x7a
jne 0x55d2e0
mov eax, dword [ebp - 0xc]
call fcn.004045ec
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
call sub.wininet.dll_FindNextUrlCacheEntryW
test eax, eax
je 0x55d2d9
lea eax, [ebp - 0x14]
mov edx, dword [ebx + 4]
call fcn.00407f90
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004082b4
jne 0x55d2d9
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 8]
call fcn.00407f90
jmp 0x55d2e8
mov eax, ebx
call fcn.00404608
cmp edi, 0x103
jne 0x55d279
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d312
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040729c
lea eax, [ebp - 4]
call fcn.0040723c
ret