joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5524c8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x6d733c]
cmp byte [eax + 0xb1], 0
jne 0x552540
cmp dword [0x6d735c], 0
jne 0x5524fd
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x6c7f80]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x6d735c], eax
cmp dword [0x6d7358], 0
jne 0x552518
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x6d7358], eax
cmp dword [0x6d7360], 0
jne 0x552540
lea eax, [ebp - 4]
push eax
push 0
push 0
mov eax, dword [0x6c7f7c]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x6d7360], eax
pop ecx
pop ebp
ret

Function at 0x552640
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.005525d8
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x552661
xor eax, eax
call fcn.00552610
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x55267b
mov al, 1
call fcn.00552610
mov esp, ebp
pop ebp
ret

Function at 0x5532a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x178], 0
je 0x553382
mov eax, dword [ebp - 4]
cmp dword [eax + 0x98], 0
jne 0x553379
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x178]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x5531a0
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
cmp dword [eax + 8], 0
je 0x553379
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0xffffffec
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_GetWindowLongW
mov dword [ebp - 0x20], eax
test byte [ebp - 0x20], 8
je 0x553333
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x553379
mov dword [ebp - 0xc], eax
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.004471a4
push eax
call sub.user32.dll_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x553348
mov eax, dword [ebp - 4]
inc dword [eax + 0x98]
mov esp, ebp
pop ebp
ret
Function at 0x55364c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x6d733c]
cmp dword [eax + 0x178], 0
je 0x55380d
cmp byte [ebp - 5], 0
jne 0x55372f
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa0], 0
jne 0x553721
mov eax, dword [ebp - 4]
call fcn.00556edc
push eax
push 0x553538
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x5536e4
mov eax, dword [0x6d733c]
cmp byte [eax + 0xd7], 0
je 0x5536e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
call fcn.00408ce0
cmp eax, 0
jl 0x5536e4
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_ShowWindow
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x5536c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x553721
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 1
cmc
sbb eax, eax
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.004471a4
push eax
call sub.user32.dll_ShowOwnedPopups
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x5536f9
mov eax, dword [ebp - 4]
inc dword [eax + 0xa0]
jmp 0x55380d
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa0], 0
jle 0x55380d
mov eax, dword [ebp - 4]
dec dword [eax + 0xa0]
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa0], 0
jne 0x55380d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x5537a5
mov eax, dword [0x6d733c]
cmp byte [eax + 0xd7], 0
je 0x5537a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
call fcn.00408ce0
cmp eax, 0
jl 0x5537a5
mov dword [ebp - 0xc], eax
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_ShowWindow
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x553785
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x5537e2
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 1
cmc
sbb eax, eax
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.004471a4
push eax
call sub.user32.dll_ShowOwnedPopups
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x5537ba
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, dword [ebp - 4]
add eax, 0xdc
mov ecx, 1
mov edx, dword [0x5421d0]
call fcn.00408e8c
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x554638
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xb0], 0
je 0x5546c2
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd7], 0
jne 0x5546c2
push pe_nt_image_headers32
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 8]
call fcn.00407060
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5546a9
mov eax, dword [ebp - 0x10]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5546d3
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x90]
call fcn.004072b8
jmp 0x5546d3
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x90]
call fcn.004072b8
mov esp, ebp
pop ebp
ret

Function at 0x556498
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x88], 0
je 0x556522
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.004ae624
test al, al
je 0x556522
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.004ae08c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x556522
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
mov edx, dword [eax]
call dword [edx + 0x108]
test al, al
je 0x556512
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.004ae08c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.004a2544
jmp 0x556522
mov cl, 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x78]
mov eax, dword [ebp - 4]
call fcn.00556260
pop ecx
pop ebp
ret
Function at 0x55e67c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x8c], 0
jne 0x55e71f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004ae08c
mov ecx, eax
mov dl, 1
mov eax, dword [0x4be75c]
call fcn.004a6db4
mov edx, dword [ebp - 4]
mov dword [edx + 0x8c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004c5cb8
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + 0x2a4], eax
mov dword [edx + 0x2a0], 0x55dec8
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
call fcn.004ae08c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
call fcn.004ae08c
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
cmp dword [eax + 0x9c], 0
jne 0x55e7b9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004ae08c
mov ecx, eax
mov dl, 1
mov eax, dword [0x4be75c]
call fcn.004a6db4
mov edx, dword [ebp - 4]
mov dword [edx + 0x9c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.004c5cb8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [eax + 0x2a4], edx
mov dword [eax + 0x2a0], 0x55df38
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.004ae08c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.004ae08c
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
cmp dword [eax + 0x94], 0
jne 0x55e83f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004ae08c
mov ecx, eax
mov dl, 1
mov eax, dword [0x4bf198]
call fcn.004a6db4
mov edx, dword [ebp - 4]
mov dword [edx + 0x94], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x278], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.004ae08c
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.004ae08c
push eax
call sub.user32.dll_ShowWindow
mov esp, ebp
pop ebp
ret
Function at 0x569010
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56907b
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
lea eax, [ebp - 0x14]
push eax
push 0x1004
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, 7
call fcn.00407b6c
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.0041fb48
mov word [ebp - 6], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x569082
lea eax, [ebp - 0x18]
call fcn.00406ed8
ret

Function at 0x56aa4c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
test dl, dl
je 0x56aa5e
add esp, 0xfffffff0
call fcn.00405840
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00405204
mov eax, dword [ebp - 4]
add eax, 0xc
mov edx, dword [ebp + 8]
call fcn.004072b8
mov eax, dword [ebp + 8]
call fcn.00407ac0
push eax
xor eax, eax
mov al, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateMutexW
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x56aabd
mov ecx, dword [0x6d11b8]
mov dl, 1
mov eax, dword [0x56a534]
call fcn.00562788
call fcn.004065b4
call sub.kernel32.dll_GetLastError_2
cmp eax, 0xb7
sete al
mov edx, dword [ebp - 4]
mov byte [edx + 4], al
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x56aae8
call fcn.00405898
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x56b490
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56b553
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00407ac0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x56b53d
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
call fcn.00407c44
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00407ac0
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x56b53d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x56b564
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x56b53d
cmp dword [ebp - 0x14], 0x34
jne 0x56b53d
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56b55a
lea eax, [ebp - 0x1c]
call fcn.00406ed8
ret
Function at 0x56ed14
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
push 0x56ed74
call sub.kernel32.dll_GetModuleHandleW_2
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x56ed63
push 0x56ed90
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040e438
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x56ed58
mov eax, dword [ebp - 4]
push eax
call dword [ebp - 0x10]
mov byte [ebp - 5], 1
jmp 0x56ed6c
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemInfo_1
jmp 0x56ed6c
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x56eddc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56efdc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.0056bb88
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x14]
mov dword [0x6c9e18], eax
mov eax, dword [ebp - 0xc]
mov dword [0x6c9e1c], eax
mov eax, dword [ebp - 0x24]
mov dword [0x6c9e20], eax
mov eax, dword [0x6d1458]
cmp dword [eax], 2
sete byte [0x6c95f9]
push 0x56efe8
call sub.kernel32.dll_GetModuleHandleW_2
lea edx, [ebp - 4]
call fcn.0056b268
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x6c95f9], 0
jne 0x56ee6b
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0056b490
test al, al
je 0x56ee6b
mov eax, dword [ebp - 0x4c]
mov dword [0x7588f0], eax
jmp 0x56ee72
xor eax, eax
mov dword [0x7588f0], eax
call fcn.0056ea70
and eax, 0x7f
cmp eax, 0x14
ja case.0x56ee83.0
jmp dword [eax*4 + 0x56ee8a]
mov byte [0x6c95f4], 1
jmp case.0x56ee83.0
mov byte [0x6c95f5], 1
jmp case.0x56ee83.0
mov byte [0x6c95f6], 1
jmp case.0x56ee83.0
mov byte [0x6c95f7], 1
jmp case.0x56ee83.0
mov byte [0x6c95f8], 1
jmp case.0x56ee83.0
mov byte [0x6c95fa], 1
mov byte [0x6c95fb], 1
jmp case.0x56ee83.0
mov byte [0x6c95fa], 1
mov byte [0x6c95fc], 1
jmp case.0x56ee83.0
mov byte [0x6c95fa], 1
mov byte [0x6c95fc], 1
mov byte [0x6c95fd], 1
jmp case.0x56ee83.0
mov byte [0x6c95fe], 1
jmp case.0x56ee83.0
mov byte [0x6c95ff], 1
jmp case.0x56ee83.0
mov byte [0x6c9600], 1
jmp case.0x56ee83.0
mov byte [0x6c9601], 1
jmp case.0x56ee83.0
mov byte [0x6c9602], 1
jmp case.0x56ee83.0
mov byte [0x6c9603], 1
jmp case.0x56ee83.0
mov byte [0x6c9604], 1
jmp case.0x56ee83.0
mov byte [0x6c9605], 1
jmp case.0x56ee83.0
mov byte [0x6c9606], 1
jmp case.0x56ee83.0
mov byte [0x6c9607], 1
jmp case.0x56ee83.0
mov byte [0x6c9608], 1
jmp case.0x56ee83.0
mov byte [0x6c9609], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56efe3
lea eax, [ebp - 4]
call fcn.00406ed8
ret
Function at 0x586c5c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetVersionExW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp dword [ebp - 0x108], 2
sete byte [0x758919]
cmp dword [ebp - 0x114], 6
setae byte [0x758918]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x58ccc4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
test dl, dl
je 0x58ccdc
add esp, 0xfffffff0
call fcn.00405840
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x58ce0f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp + 0xc]
shl eax, 3
call fcn.004046a4
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 0xc]
dec eax
test eax, eax
jl 0x58cdf9
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004cd044
xor eax, eax
push ebp
push 0x58cde6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004cd044
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea eax, [eax + edx*8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x20]
mov dword [edx], eax
mov eax, dword [ebp - 0x20]
add eax, 4
mov edx, dword [ebp - 0x18]
call fcn.00407ba8
jmp 0x58cdb1
mov eax, dword [ebp - 0x20]
add eax, 4
mov ecx, 1
mov edx, 1
call fcn.00407ed4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 4]
call fcn.004073d0
dec eax
jle 0x58cdcb
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 4]
cmp word [eax], 0x5f
je 0x58cd9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58cded
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58ce16
lea eax, [ebp - 0x18]
call fcn.00406f20
ret
Function at 0x5d1204
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x5d121f
add esp, 0xfffffff0
call fcn.00405840
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5d1319
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, 0x5d1350
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov cl, 1
xor edx, edx
call fcn.005da26c
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0x400
call fcn.00593d78
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x5d12ae
push 0x5d1380
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040509c
mov eax, dword [ebp - 0x1c]
push eax
push 0x5d13bc
push 0
push 1
mov eax, 0x5d13e8
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea eax, [ebp - 0x24]
push eax
push 0
mov ecx, 0x5d140c
mov dl, 1
mov eax, dword [0x5e1044]
call fcn.005ea38c
call fcn.004065b4
xor eax, eax
push ebp
push 0x5d12f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
and eax, 2
cmp eax, 2
sete al
push eax
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x8c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d12fb
mov eax, dword [ebp - 0x14]
push eax
call fcn.005943ac
ret
Function at 0x61f270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x61f2fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00407c44
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407ac0
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x61f2dc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00407c44
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.005fb5d4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004072b8
jmp 0x61f2e4
mov eax, dword [ebp - 4]
call fcn.00406ed8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f301
lea eax, [ebp - 0xc]
call fcn.00406ed8
ret

Function at 0x62d140
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406ed8
mov dword [ebp - 8], 0xf
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x62d177
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00407060
mov esp, ebp
pop ebp
ret

Function at 0x65b110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
test dl, dl
je 0x65b127
add esp, 0xfffffff0
call fcn.00405840
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x65b1b7
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00405204
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0065b744
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.004072b8
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
add eax, 0x10
mov edx, 0x65b1ec
call fcn.00407d1c
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x65a624]
call fcn.0065be2c
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65b1be
lea eax, [ebp - 0xc]
call fcn.00406ed8
ret