joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d7960
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d7a1a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405398
mov eax, dword [0x59ed54]
cmp dword [eax], 2
jne 0x4d79cf
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004055e0
mov eax, dword [ebx]
call fcn.00405504
push eax
mov eax, dword [ebx]
call fcn.004054f4
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405504
mov edx, eax
dec edx
mov eax, ebx
call fcn.004055e0
jmp 0x4d7a01
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040a360
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.004054e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7a21
lea eax, [ebp - 0x3f0]
call fcn.00404c8c
ret
Function at 0x4f56d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4f5745
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x59dcf8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4f572f
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004f56c4
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4f3d68]
call fcn.004f66fc
mov dword [0x59dd60], eax
mov eax, dword [ebp - 4]
call fcn.004f5508
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f574c
lea eax, [ebp - 8]
call fcn.004068d4
ret

Function at 0x4f654c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040513c
xor eax, eax
push ebp
push 0x4f66c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x4f3ae0]
call fcn.00416a30
test eax, eax
jl 0x4f65b9
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.004f57c8
and eax, 0x7f
mov eax, dword [eax*4 + 0x59dcf8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x4f663f
mov eax, dword [ebx]
call fcn.00404f4c
test eax, eax
jle 0x4f663f
lea edx, [ebp - 0x20]
mov eax, dword [ebx]
call fcn.005566a0
mov edx, dword [ebp - 0x20]
mov eax, ebx
call fcn.00404ce0
mov eax, dword [ebx]
call fcn.00404f4c
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x4f65f4
mov eax, ebx
mov edx, 0x4f66d8
call fcn.00404f54
mov eax, dword [ebx]
call fcn.00404f4c
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x24]
mov eax, dword [ebx]
call fcn.00409ffc
mov eax, dword [ebp - 0x24]
call fcn.00405be0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x28]
call fcn.004f56c4
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x4f667d
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea edx, [ebp - 0x30]
xor ecx, ecx
mov eax, 0x4f66e4
call fcn.0040a878
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00404ce0
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x408564]
call fcn.0040d3c4
call fcn.004045fc
mov eax, dword [ebp - 0x10]
call fcn.004f64c4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4f6695
lea eax, [ebp - 4]
call fcn.0040f048
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f66c7
lea eax, [ebp - 0x28]
call fcn.004068d4
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404cb0
lea eax, [ebp - 8]
call fcn.00404c8c
ret
Function at 0x4f736c
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x3c
call fcn.00403698
mov dword [esp], 0x3c
mov eax, dword [0x59eb58]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc
mov eax, dword [ebx + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 5
push esp
call sub.shell32.dll_ShellExecuteExA
add esp, 0x3c
pop ebx
ret

Function at 0x4f7f2c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f8098
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x59ed30]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x59ed30]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.00465844
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.004780c8
xor edx, edx
push ebp
push 0x4f807b
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4f7fe9
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.004068d4
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x368]
call fcn.004f5f0c
push eax
mov eax, dword [0x59eb58]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x4f7fdf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.004046a8
jmp 0x4f8082
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f8027
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00477c94
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004f7dc0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x4f8001
push 0
mov edx, 0x4f7d58
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.0047784c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8082
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00478114
mov eax, dword [0x59ed30]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.00465844
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f809f
lea eax, [ebp - 0x10]
call fcn.004068d4
ret
Function at 0x4fc5bc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push dword [ebp + 0xc]
push dword [ebp + 8]
lea ecx, [ebp - 8]
lea edx, [ebp - 6]
lea eax, [ebp - 4]
call fcn.0040b4b4
push 2
lea eax, [ebp - 0x12]
push eax
push 0x100d
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
xor eax, eax
mov al, byte [ebp - 0x12]
sub eax, 0x30
jne 0x4fc641
mov cx, 1
mov dx, 1
mov ax, word [ebp - 4]
call fcn.0040b334
fstp qword [ebp - 0x10]
wait
push 0
push 7
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.0040b514
movzx eax, ax
dec eax
cdq
push edx
push eax
fld qword [ebp + 8]
fsub qword [ebp - 0x10]
call fcn.00403034
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
call fcn.00405c30
inc eax
mov word [ebp - 2], ax
jmp 0x4fc655
push dword [ebp + 0xc]
push dword [ebp + 8]
lea ecx, [ebp - 8]
lea edx, [ebp - 2]
lea eax, [ebp - 4]
call fcn.004e9b5c
cmp word [ebp - 2], 0
je 0x4fc660
dec word [ebp - 2]
mov ax, word [ebp - 2]
mov esp, ebp
pop ebp
ret 8

Function at 0x4fd5ac
Capabilities:
Get geographical location

Disassembly:
push ecx
mov dl, byte [eax + 0x290]
cmp dl, 7
jne 0x4fd5d8
push 2
lea eax, [esp + 4]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
xor eax, eax
mov al, byte [esp]
sub eax, 0x30
pop edx
ret
xor eax, eax
mov al, dl
pop edx
ret
Function at 0x5063ac
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004641b8
push 0
mov eax, ebx
call fcn.0044dda8
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x311], 1
pop ebx
ret

Function at 0x50a2ec
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x60], 0
jne 0x50a304
mov eax, ebx
call fcn.0050a0cc
cmp dword [ebx + 0x54], 0
jne 0x50a311
mov eax, ebx
call fcn.0050a02c
mov esi, dword [ebx + 0x60]
test esi, esi
je 0x50a49a
cmp dword [ebx + 0x54], 0
je 0x50a49a
mov edx, esp
mov eax, esi
call fcn.00555c8c
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.00509fb0
mov edx, dword [esp + 0x1c]
mov ecx, edx
mov esi, dword [esp + 0x14]
sub ecx, esi
mov eax, dword [esp]
cmp ecx, eax
je 0x50a377
mov ecx, dword [esp + 4]
sub ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x18]
sar ecx, 1
jns 0x50a360
adc ecx, 0
push ecx
sub eax, edx
add eax, esi
sar eax, 1
jns 0x50a36c
adc eax, 0
push eax
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x68]
mov eax, dword [eax + 0xd8]
test eax, eax
je 0x50a38d
call fcn.0044dda8
mov esi, eax
jmp 0x50a390
mov esi, dword [ebx + 0x64]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x50a3a1
or esi, 0xffffffff
jmp 0x50a3ab
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x54]
call fcn.00446c70
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x54]
call fcn.00446c94
mov edx, dword [esp]
mov eax, dword [ebx + 0x54]
call fcn.00446cbc
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x54]
call fcn.00446ce0
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00555cd8
mov edx, ebp
lea eax, [esp + 0x10]
call fcn.0055639c
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x54]
call fcn.0044dda8
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x54]
call fcn.0044dda8
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x54]
call fcn.0044dda8
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x60]
call fcn.0042c83c
call fcn.0042822c
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x54]
call fcn.0044dda8
push eax
call dword [0x5a15cc]
push 4
mov eax, dword [ebx + 0x54]
call fcn.0044dda8
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x510bdc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], 0xffffffff
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0050e138
mov ebx, eax
lea eax, [ebp - 0x28]
xor edx, edx
call fcn.00555d3c
mov esi, eax
mov eax, ebx
add eax, eax
mov edx, esi
sub edx, eax
mov dword [ebp - 0x10], edx
cmp edi, dword [ebp - 0x24]
jl 0x510d1c
cmp edi, dword [ebp - 0x1c]
jge 0x510d1c
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0050e538
mov eax, ebx
add eax, eax
cmp esi, eax
jg 0x510c58
mov ebx, esi
sar ebx, 1
jns 0x510c58
adc ebx, 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 8]
jg 0x510c71
add eax, ebx
cmp eax, dword [ebp - 8]
jle 0x510c71
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x510d1c
mov eax, dword [ebp - 0x20]
mov edx, eax
sub edx, ebx
cmp edx, dword [ebp - 8]
jg 0x510c8e
cmp eax, dword [ebp - 8]
jle 0x510c8e
mov dword [ebp - 0xc], 1
jmp 0x510d1c
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jl 0x510c9f
mov dword [ebp - 0xc], 0xffffffff
jmp 0x510d1c
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jl 0x510cbb
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jle 0x510cbb
mov dword [ebp - 0xc], 5
jmp 0x510d1c
mov eax, dword [ebp - 0x28]
add eax, ebx
cmp eax, dword [ebp - 8]
jg 0x510ceb
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jge 0x510ceb
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x510ce2
mov dword [ebp - 0xc], 4
jmp 0x510d1c
mov dword [ebp - 0xc], 2
jmp 0x510d1c
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jg 0x510d1c
mov eax, dword [ebp - 0x20]
sub eax, ebx
cmp eax, dword [ebp - 8]
jle 0x510d1c
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x510d15
mov dword [ebp - 0xc], 4
jmp 0x510d1c
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x510d28
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0050e138
mov ebx, eax
lea eax, [ebp - 0x24]
xor edx, edx
call fcn.00555d50
mov esi, eax
mov eax, ebx
add eax, eax
mov edx, esi
sub edx, eax
mov dword [ebp - 0xc], edx
cmp edi, dword [ebp - 0x24]
jl 0x510e64
cmp edi, dword [ebp - 0x1c]
jge 0x510e64
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0050e538
mov eax, ebx
add eax, eax
cmp esi, eax
jg 0x510da0
mov ebx, esi
sar ebx, 1
jns 0x510da0
adc ebx, 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jg 0x510db9
add eax, ebx
cmp eax, dword [ebp + 8]
jle 0x510db9
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x510e64
mov eax, dword [ebp - 0x18]
mov edx, eax
sub edx, ebx
cmp edx, dword [ebp + 8]
jg 0x510dd6
cmp eax, dword [ebp + 8]
jle 0x510dd6
mov dword [ebp - 8], 1
jmp 0x510e64
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x510de7
mov dword [ebp - 8], 0xffffffff
jmp 0x510e64
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jl 0x510e03
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jle 0x510e03
mov dword [ebp - 8], 5
jmp 0x510e64
mov eax, dword [ebp - 0x20]
add eax, ebx
cmp eax, dword [ebp + 8]
jg 0x510e33
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jge 0x510e33
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x510e2a
mov dword [ebp - 8], 4
jmp 0x510e64
mov dword [ebp - 8], 2
jmp 0x510e64
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jg 0x510e64
mov eax, dword [ebp - 0x18]
sub eax, ebx
cmp eax, dword [ebp + 8]
jle 0x510e64
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x510e5d
mov dword [ebp - 8], 4
jmp 0x510e64
mov dword [ebp - 8], 3
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x543138
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x5431d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x4c], edx
lea eax, [ebx + 8]
mov edx, esi
call fcn.00404ce0
lea esi, [ebp - 0x10]
lea edi, [ebx + 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 8]
call fcn.004093a8
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0xc]
call fcn.00404ce0
mov eax, dword [ebx + 0xc]
call fcn.00404f4c
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x3c]
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x24], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5431de
lea eax, [ebp - 0x14]
call fcn.00404c8c
ret

Function at 0x544aa4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x544b48
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
lea eax, [ebp - 8]
lea edx, [esi + esi*4]
mov ecx, dword [ebx + 0x1c4]
mov edx, dword [ecx + edx*4 + 0x10]
call fcn.00404d24
cmp word [ebx + 0x1d2], 0
je 0x544afb
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [ebx + 0x1d4]
call dword [ebx + 0x1d0]
cmp dword [ebp - 8], 0
setne al
and al, byte [ebp - 1]
je 0x544b32
xor eax, eax
mov al, byte [ebx + 0x1c8]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040514c
push eax
push 0x544b58
mov eax, dword [0x59eb58]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x544b4f
lea eax, [ebp - 8]
call fcn.00404c8c
ret
Function at 0x54859c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5486df
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x30c]
mov dl, 1
mov eax, dword [0x52ed84]
call fcn.0052ff88
mov esi, eax
mov edx, 0x46
mov eax, esi
call fcn.00446ce0
mov dl, 2
mov eax, esi
call fcn.0046b7d0
mov dl, 1
mov eax, esi
call fcn.0046b7a0
mov edx, 0x5486f8
mov eax, dword [esi + 0x1e0]
call fcn.005696b0
lea eax, [ebp - 4]
push eax
mov edi, ebx
and edi, 0x7f
mov eax, dword [edi*4 + 0x59dcf8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
push 2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.004f56c4
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.004f5d54
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00447530
mov eax, dword [ebp - 4]
call fcn.004f64c4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
xor ecx, ecx
xor edx, edx
call fcn.004f57e4
mov ecx, eax
mov edx, 1
mov eax, esi
call fcn.00533254
lea eax, [ebp - 8]
call fcn.0040f048
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x314]
mov eax, esi
call fcn.005317d0
mov dword [esi + 0xc], edi
mov dl, 1
mov eax, esi
call fcn.00446a14
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [esi + 0x124], eax
mov dword [esi + 0x120], 0x5487ac
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x30c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, esi
call fcn.005484c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5486e6
lea eax, [ebp - 0x10]
call fcn.004068d4
lea eax, [ebp - 0xc]
call fcn.00404c8c
ret

Function at 0x548704
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
mov edx, 0xff00000c
call fcn.004476a0
cmp dword [0x59e3d8], 0
jne 0x54874e
push 0x4000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x5487a8
call sub.shell32.dll_SHGetFileInfoA
mov dword [0x59e3d8], eax
cmp dword [0x59e3d8], 0
je 0x54877e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov edx, dword [0x59e3d8]
call fcn.00454794
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov edx, 0x1fffffff
call fcn.004c1cc0
push ebp
xor eax, eax
call fcn.0054859c
pop ecx
push ebp
mov al, 1
call fcn.0054859c
pop ecx
push ebp
mov al, 0xe
call fcn.0054859c
pop ecx
push ebp
mov al, 2
call fcn.0054859c
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x58c2f4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov edi, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x58c30b
mov eax, ebx
call fcn.0058bc70
cmp dword [ebx + 0x68], 0
jne 0x58c318
mov eax, ebx
call fcn.0058bbf4
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x58c4a6
cmp dword [ebx + 0x68], 0
je 0x58c4a6
mov edx, esp
mov eax, esi
call fcn.00555c8c
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.0058bac0
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00555d3c
cmp eax, dword [esp]
je 0x58c38d
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00555d50
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x58c369
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.00555d3c
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x58c382
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x58c3a0
mov eax, dword [eax + 0x28]
call fcn.0044dda8
mov esi, eax
jmp 0x58c3a3
mov esi, dword [ebx + 0x5c]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x58c3b4
or esi, 0xffffffff
jmp 0x58c3be
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.00446c70
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.00446c94
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.00446cbc
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00446ce0
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00555cd8
mov edx, edi
lea eax, [esp + 0x10]
call fcn.0055639c
push 0x61b
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0044dda8
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0044dda8
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0044dda8
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0042c83c
call fcn.0042822c
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0044dda8
push eax
call dword [0x5a15cc]
push 4
mov eax, dword [ebx + 0x68]
call fcn.0044dda8
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop edi
pop esi
pop ebx
ret