joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495b34
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x495c12
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00495904
xor edx, edx
push ebp
push 0x495bf5
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x495bbe
mov edx, ebx
mov eax, dword [0x417754]
call fcn.0041bd74
test al, al
je 0x495bae
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.0041bc48
call fcn.00403508
jmp 0x495bfc
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x495b79
lea edx, [ebp - 8]
mov eax, dword [0x5bafcc]
call fcn.00404b64
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4063f4]
call fcn.00409e3c
call fcn.00403468
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495bfc
mov eax, dword [ebp - 4]
call fcn.004958d8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495c19
lea eax, [ebp - 8]
call fcn.00403a10
ret

Function at 0x495c20
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00495904
xor eax, eax
push ebp
push 0x495c78
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495c7f
mov eax, dword [ebp - 4]
call fcn.004958d8
ret

Function at 0x495c88
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00495904
xor edx, edx
push ebp
push 0x495cdd
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495ce4
mov eax, dword [ebp - 4]
call fcn.004958d8
ret
Function at 0x495d54
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00495904
xor eax, eax
push ebp
push 0x495dc9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004958bc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0041bd48
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x495db3
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495dd0
mov eax, dword [ebp - 4]
call fcn.004958d8
ret

Function at 0x495dd8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00495904
xor eax, eax
push ebp
push 0x495e4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004958bc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x495e37
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495e54
mov eax, dword [ebp - 4]
call fcn.004958d8
ret

Function at 0x495ea8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00495904
xor eax, eax
push ebp
push 0x495eec
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495ef3
mov eax, dword [ebp - 4]
call fcn.004958d8
ret
Function at 0x4a4668
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 0x10]
call fcn.00403e40
mov eax, dword [ebp + 0xc]
call fcn.00403e40
mov eax, dword [ebp + 8]
call fcn.00403e40
xor eax, eax
push ebp
push 0x4a4727
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, esi
mov dl, 1
mov eax, dword [0x4a3e9c]
call fcn.004a44ec
mov ebx, eax
mov dword [ebx + 8], edi
mov eax, dword [ebp - 4]
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10]
mov edx, dword [ebp + 0x10]
call fcn.00403a64
lea eax, [ebx + 0x14]
mov edx, dword [ebp + 0xc]
call fcn.00403a64
mov eax, dword [ebp + 0x2c]
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x1c]
mov edx, dword [ebp + 8]
call fcn.00403a64
mov eax, dword [ebp + 0x28]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x34], eax
mov edx, ebx
mov eax, dword [esi + 8]
call fcn.0040e0c0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a472e
lea eax, [ebp + 8]
mov edx, 3
call fcn.00403a34
ret
Function at 0x4a7924
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x204], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a7abb
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004a73f4
mov eax, dword [ebp - 0x204]
lea edx, [esi + 1]
call fcn.0040a6a4
cmp al, 2
jne 0x4a796a
dec esi
mov eax, ebx
call fcn.004a7708
test al, al
je 0x4a7a5b
test esi, esi
jge 0x4a797f
xor esi, esi
lea edi, [esi + 1]
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004a73f4
mov eax, dword [ebp - 0x204]
call fcn.00403c8c
cmp edi, eax
jge 0x4a79c6
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004a73f4
mov eax, dword [ebp - 0x204]
mov al, byte [eax + edi - 1]
mov edx, dword [0x5bb8dc]
and eax, 0xff
bt dword [edx], eax
jae 0x4a79c6
inc edi
mov eax, dword [ebx + 0x138]
cmp esi, eax
jl 0x4a79d4
mov esi, eax
mov edi, esi
mov ecx, edi
mov edx, edi
mov eax, ebx
call fcn.004a7900
cmp edi, esi
je 0x4a7a53
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, 0x100
lea eax, [ebp - 0x200]
mov byte [eax], 0
inc eax
dec edx
jne 0x4a79fa
mov byte [ebp - 0x1f0], 0x81
mov byte [ebp - 0x1db], 0x81
lea eax, [ebp - 0x200]
push eax
call sub.user32.dll_SetKeyboardState
push 1
push 0x25
push 0x100
mov eax, ebx
call fcn.004276fc
push eax
call sub.user32.dll_SendMessageA
push 1
push 0x25
push 0x101
mov eax, ebx
call fcn.004276fc
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
mov dword [ebx + 0x140], esi
jmp 0x4a7aa2
test esi, esi
jge 0x4a7a61
xor esi, esi
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004a73f4
mov eax, dword [ebp - 0x204]
call fcn.00403c8c
cmp esi, eax
jl 0x4a7a97
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.004a73f4
mov eax, dword [ebp - 0x204]
call fcn.00403c8c
mov esi, eax
mov ecx, esi
mov edx, esi
mov eax, ebx
call fcn.004a7900
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7ac2
lea eax, [ebp - 0x204]
call fcn.00403a10
ret
Function at 0x4f5248
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e50
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
setne byte [ebp - 5]
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4f8ba8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f8c6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5bb528]
cmp dword [eax], 0
je 0x4f8bf5
push 0
mov eax, dword [0x5bb528]
mov eax, dword [eax]
call fcn.004276fc
push eax
call sub.user32.dll_ShowWindow
mov dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x280]
call fcn.00456d84
mov eax, dword [0x5bb4b0]
mov eax, dword [eax]
mov ecx, dword [eax + 0x34]
mov edx, dword [0x5bb7e0]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.00403cd8
mov edx, dword [0x5bb578]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.0049c328
test eax, eax
jne 0x4f8c55
lea eax, [ebp - 8]
mov edx, dword [0x5bb544]
mov edx, dword [edx]
call fcn.00403aa8
mov eax, dword [0x5bb018]
mov eax, dword [eax]
call fcn.004276fc
push eax
mov eax, dword [ebp - 8]
call fcn.00403e50
mov edx, eax
mov ecx, 1
pop eax
call fcn.0054fef4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8c72
lea eax, [ebp - 8]
call fcn.00403a10
ret

Function at 0x4fd18c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x5bb528]
cmp dword [eax], 0
je 0x4fd1de
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x280]
cmp byte [eax + 0xc0], 0
je 0x4fd1ca
push 0
mov eax, dword [0x5bb528]
mov eax, dword [eax]
call fcn.004276fc
push eax
call sub.user32.dll_ShowWindow
jmp 0x4fd1de
push 4
mov eax, dword [0x5bb528]
mov eax, dword [eax]
call fcn.004276fc
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ecx
pop ebp
ret
Function at 0x504e2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x504fb2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x5b9998], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a4]
mov eax, dword [eax + 0x130]
call fcn.0044f500
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a4]
mov eax, dword [eax + 0x130]
call fcn.0044f4e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x42c]
call fcn.0043a6b4
mov edx, eax
mov eax, dword [0x5bcef0]
call fcn.004a519c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x504f81
mov eax, dword [ebp - 0xc]
call fcn.004a4fd4
dec eax
test eax, eax
jl 0x504f25
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a4]
mov eax, dword [eax + 0x130]
call fcn.0044f404
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004a5004
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0044f084
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004a5020
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004a5090
mov edx, eax
xor dl, 1
mov eax, dword [ebp - 8]
call fcn.0044f024
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x504eb9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a4]
mov eax, dword [eax + 0x130]
call fcn.0044f440
test eax, eax
jle 0x504f81
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a4]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.0044f470
mov cl, 1
mov edx, 3
call fcn.0044f194
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a4]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.0044f470
mov cl, 1
mov edx, 2
call fcn.0044f194
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3a4]
mov eax, dword [eax + 0x130]
call fcn.0044f6dc
mov byte [0x5b9998], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504fb9
lea eax, [ebp - 0x1c]
call fcn.00403a10
ret
Function at 0x515aec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e40
xor eax, eax
push ebp
push 0x515c7b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00403e50
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x515c35
mov eax, dword [ebp - 8]
call fcn.004026a8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x515c2e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x515bdb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00402b14
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403e50
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x515ba1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
lea ecx, [eax + 0x240]
mov eax, dword [ebp - 0x14]
movzx edx, word [eax]
mov eax, dword [ebp - 0x10]
call fcn.00540c9c
jmp 0x515bd1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x240]
mov edx, dword [eax]
call dword [edx + 0x94]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x240]
mov eax, dword [eax + 0x154]
mov edx, 0x515c94
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x515c15
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515c65
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.004026c0
ret
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x240]
mov edx, dword [eax]
call dword [edx + 0x94]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x240]
mov eax, dword [eax + 0x154]
mov edx, 0x515cdc
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515c82
lea eax, [ebp - 4]
call fcn.00403a10
ret
Function at 0x529dc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x5bd06c]
push eax
call sub.user32.dll_ScreenToClient
mov eax, dword [ebp - 0x28]
sub eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x24]
sub eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
cmp byte [ebp - 5], 0
je 0x529ed4
mov eax, dword [ebp - 0x14]
sar eax, 1
jns 0x529e2c
adc eax, 0
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
sar eax, 1
jns 0x529e3c
adc eax, 0
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5bd0f0], eax
mov eax, dword [ebp - 0x10]
mov dword [0x5bd0f4], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x14]
mov dword [0x5bd108], eax
mov eax, dword [ebp - 0x10]
mov dword [0x5bd10c], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5bd120], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
mov dword [0x5bd124], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x14]
mov dword [0x5bd138], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
mov dword [0x5bd13c], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x5bd150], eax
mov eax, dword [ebp - 0x10]
mov dword [0x5bd154], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x5bd168], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
mov dword [0x5bd16c], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5bd180], eax
mov eax, dword [ebp - 0x20]
mov dword [0x5bd184], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x14]
mov dword [0x5bd198], eax
mov eax, dword [ebp - 0x20]
mov dword [0x5bd19c], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
push 0
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov eax, dword [eax*8 + 0x5bd0fc]
push eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov eax, dword [eax*8 + 0x5bd0f8]
push eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov eax, dword [eax*8 + 0x5bd0f4]
push eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov eax, dword [eax*8 + 0x5bd0f0]
push eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov eax, dword [eax*8 + 0x5bd0e8]
push eax
call sub.user32.dll_MoveWindow
cmp byte [ebp - 5], 0
je 0x529f43
push 5
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov eax, dword [eax*8 + 0x5bd0e8]
push eax
call sub.user32.dll_ShowWindow
jmp 0x529f58
push 0
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov eax, dword [eax*8 + 0x5bd0e8]
push eax
call sub.user32.dll_ShowWindow
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 8
jl 0x529ed9
mov esp, ebp
pop ebp
ret
Function at 0x52ad34
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403e40
mov eax, dword [ebp - 8]
call fcn.00403e40
xor eax, eax
push ebp
push 0x52ae37
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x55
call fcn.004026a8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, 0x54
call fcn.00402b14
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, dword [ebp + 0x30]
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp + 0x2c]
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov eax, dword [ebp + 0x28]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 0x24]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x18], eax
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x20], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x30], eax
mov al, byte [ebp + 8]
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x34], al
mov edx, dword [ebp - 0x10]
mov eax, dword [0x5bd084]
call fcn.0040e0c0
mov edx, dword [ebp - 8]
mov eax, dword [0x5bd088]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, dword [ebp - 4]
mov eax, dword [0x5bd08c]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, dword [ebp - 4]
mov eax, dword [0x5bd090]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52ae3e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403a34
ret
Function at 0x533ed8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x533f75
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x23
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00403c3c
cmp dword [ebx], 0
jne 0x533f40
mov eax, ebx
mov edx, dword [0x5ba308]
call fcn.00403aa8
jmp 0x533f5c
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.00533e98
mov edx, dword [ebp - 0x110]
mov eax, ebx
mov ecx, esi
call fcn.00403cd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533f7c
lea eax, [ebp - 0x110]
call fcn.00403a10
ret

Function at 0x533f84
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x534021
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x1a
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00403c3c
cmp dword [ebx], 0
jne 0x533fec
mov eax, ebx
mov edx, dword [0x5ba308]
call fcn.00403aa8
jmp 0x534008
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.00533e98
mov edx, dword [ebp - 0x110]
mov eax, ebx
mov ecx, esi
call fcn.00403cd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534028
lea eax, [ebp - 0x110]
call fcn.00403a10
ret

Function at 0x534030
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5340cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 5
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00403c3c
cmp dword [ebx], 0
jne 0x534098
mov eax, ebx
mov edx, dword [0x5ba308]
call fcn.00403aa8
jmp 0x5340b4
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.00533e98
mov edx, dword [ebp - 0x110]
mov eax, ebx
mov ecx, esi
call fcn.00403cd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5340d4
lea eax, [ebp - 0x110]
call fcn.00403a10
ret
Function at 0x534b28
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x534bfe
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403aa8
lea eax, [ebp - 8]
call fcn.00403e5c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00403e50
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x534be8
mov eax, ebx
call fcn.004026a8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x534be1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00403e50
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x534bcb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x534c10
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x534bcb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534be8
mov eax, dword [ebp - 0x10]
call fcn.004026c0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534c05
lea eax, [ebp - 8]
call fcn.00403a10
ret

Function at 0x53683c
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
or edi, 0xffffffff
cmp edx, 0x40
jl 0x536895
mov ecx, eax
cmp word [ecx], 0x5a4d
jne 0x536895
mov ecx, eax
mov esi, dword [ecx + 0x3c]
mov ebx, esi
add ebx, 0x78
cmp edx, ebx
jl 0x536895
add eax, esi
mov ecx, dword [eax]
mov edx, ecx
and edx, 0xffff
cmp edx, 0x454e
jne 0x536879
mov edi, 0xca
jmp 0x536895
cmp edx, 0x454c
jne 0x536888
mov edi, 0xc9
jmp 0x536895
cmp ecx, 0x4550
jne 0x536895
mov edi, 0xc8
mov eax, edi
pop edi
pop esi
pop ebx
ret