joyce8/EMBER2024-capa huggingface dataset:
Function at 0x537140
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov byte [esp], cl
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00537850
imul eax, ebx, 0x1e
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x2b2
dec eax
mov dword [esp + 8], eax
cmp byte [esp], 0
je 0x537185
mov eax, dword [esp + 8]
mov ecx, 0x1e
cdq
idiv ecx
imul eax, eax, 0x1e
mov dword [esp + 8], eax
mov eax, dword [esi + 0x404]
mov eax, dword [eax + 0xc]
dec eax
cmp eax, dword [esp + 8]
jge 0x537199
mov dword [esp + 8], eax
mov ebx, dword [esp + 4]
mov edi, dword [esp + 8]
sub edi, ebx
jl 0x537242
inc edi
mov ecx, ebx
sub ecx, dword [esp + 4]
mov eax, ecx
mov ebp, 0x1e
cdq
idiv ebp
mov ebp, edx
mov eax, ecx
mov ecx, 0x1e
cdq
idiv ecx
mov dword [esp + 0xc], eax
mov eax, ebp
shl eax, 2
lea eax, [eax + eax*2]
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
shl eax, 2
lea eax, [eax + eax*2]
inc eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
add eax, 0xc
dec eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
add eax, 0xc
dec eax
mov dword [esp + 0x1c], eax
imul eax, dword [esp + 0xc], 0xd
push eax
mov edx, ebx
mov eax, dword [esi + 0x404]
call fcn.0052f834
and eax, 0xff
inc eax
shl eax, 2
lea eax, [eax + eax*2]
push eax
push 0
push 0xc
push 0xc
push 2
imul ecx, ebp, 0xd
mov edx, dword [esi + 0x8d8]
mov eax, dword [esi + 0x8e0]
call fcn.004e35b0
inc ebx
dec edi
jne 0x5371aa
cmp byte [esp], 0
je 0x53726c
mov ebx, dword [esp + 8]
inc ebx
mov eax, dword [esi + 0x404]
mov edi, dword [eax + 0xc]
dec edi
sub edi, ebx
jl 0x53726c
inc edi
mov eax, ebx
cdq
push edx
push eax
mov eax, esi
call fcn.005350ac
inc ebx
dec edi
jne 0x53725c
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5407d4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x54083b
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthA
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 8]
call fcn.00405320
push edi
mov eax, dword [ebp - 8]
call fcn.00405194
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404d28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x540842
lea eax, [ebp - 8]
call fcn.00404cd4
ret
Function at 0x544ed0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x544f5a
xor edx, edx
push ebp
push 0x544f3b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x544f5a
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x5462e0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405184
mov eax, dword [ebp - 8]
call fcn.00405184
xor eax, eax
push ebp
push 0x5463fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 8]
call fcn.00405194
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 3
mov eax, 0x54640c
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00405194
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5463e2
xor eax, eax
push ebp
push 0x5463db
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x5463bb
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x5463bf
xor eax, eax
jmp 0x5463c1
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5463e2
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x546404
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cf8
ret
Function at 0x546414
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405184
mov eax, dword [ebp - 8]
call fcn.00405184
mov eax, dword [ebp - 0xc]
call fcn.00405184
mov eax, dword [ebp + 0xc]
call fcn.00405184
xor eax, eax
push ebp
push 0x546588
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x2c], 0x14
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x44], 2
mov eax, dword [ebp - 8]
call fcn.00405194
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 3
mov eax, 0x54659c
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00405194
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x546565
xor eax, eax
push ebp
push 0x54655e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00405194
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405194
push eax
mov ax, word [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00405194
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x546547
push ebx
lea eax, [ebp - 0x2c]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x54653e
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x546542
xor eax, eax
jmp 0x546544
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x546565
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54658f
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404cf8
lea eax, [ebp + 0xc]
call fcn.00404cd4
ret
Function at 0x5465a4
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x54666c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x546670
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x54666c
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x546663
xor eax, eax
push ebp
push 0x54665c
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x546663
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x546864
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x546a7f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x105
mov eax, dword [ebp - 0x18]
call fcn.00402e64
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5468e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x5468cb
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.00404ecc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5468e8
mov eax, dword [ebp - 8]
call fcn.00402e94
ret

Function at 0x547da7
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffff4
mov bl, 2
mov eax, esp
xor ecx, ecx
mov edx, 0xa
call fcn.0040362c
push 0xa
lea eax, [esp + 4]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x547dc3
cmp byte [esp], 0x31
jne 0x547dc1
mov bl, 1
jmp 0x547dc3
xor ebx, ebx
mov eax, ebx
add esp, 0xc
pop ebx
ret
Function at 0x54926c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00452474
test al, al
je 0x549318
mov byte [esp + 4], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
jmp 0x5492fe
cmp word [esi + 0x5da], 0
je 0x5492b8
push esp
lea eax, [esp + 8]
push eax
mov ecx, edi
mov edx, esi
mov eax, dword [esi + 0x5dc]
call dword [esi + 0x5d8]
cmp byte [esp + 4], 0
jne 0x5492d5
cmp dword [esp], 0
jbe 0x5492d1
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, dword [esp]
ja 0x5492d5
xor ebx, ebx
jmp 0x5492d7
mov bl, 1
test bl, bl
jne 0x549318
mov eax, dword [0x5cfe00]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x549318
mov eax, dword [0x5cfe00]
mov eax, dword [eax]
call fcn.0046cad0
push 1
call sub.kernel32.dll_Sleep_1
cmp byte [esi + 0x5cf], 0
jne 0x549318
mov edx, 0xfffffdf3
mov eax, esi
call fcn.0053c6b0
cmp eax, 4
jne 0x549298
test bl, bl
sete al
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x54ce30
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x54ce38
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x54cf81
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41bc08]
call fcn.00403d78
mov ebx, eax
mov edx, 0x54cf98
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x54cfb4
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x54cfcc
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov dl, 1
mov eax, dword [0x522534]
call fcn.00403d78
mov esi, eax
lea edx, [ebp - 4]
mov eax, esi
call fcn.00522770
mov eax, esi
call fcn.00403da8
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004032f8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040cd34
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x54cfe4
call fcn.00404fe0
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x54cf52
inc eax
mov dword [ebp - 0xc], eax
xor esi, esi
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00404fe0
mov eax, dword [ebp - 0x18]
call fcn.0040ca7c
test al, al
je 0x54cf4c
push 0
lea ecx, [ebp - 0x24]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
call fcn.00404fe0
mov eax, dword [ebp - 0x20]
call fcn.00405194
push eax
lea ecx, [ebp - 0x2c]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
call fcn.00404fe0
mov eax, dword [ebp - 0x28]
call fcn.00405194
push eax
call sub.kernel32.dll_CopyFileA
inc esi
dec dword [ebp - 0xc]
jne 0x54ced9
mov eax, ebx
call fcn.00403da8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54cf88
lea eax, [ebp - 0x2c]
mov edx, 8
call fcn.00404cf8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cf8
ret
Function at 0x564fc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x565034
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c]
mov edx, 0x3c
call fcn.0040840c
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov eax, 0x565048
mov dword [ebp - 0x30], eax
ror byte [ebx + 0x187e8c3], 1
ljmp 0x45c7
loopne 0x565015
add byte [eax], al
add byte [ebx + 0x176e8c6], cl
ljmp 0x458d
les edx, [eax - 0x18]
xchg esi, eax
or ebp, ebp
push dword [ebx]
rcr byte [edx + 0x59], 0x59
mov dword fs:[eax], edx
jmp 0x56503e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x569c08
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405184
mov eax, dword [ebp - 8]
call fcn.00405184
mov eax, dword [ebp + 0xc]
call fcn.00405184
mov eax, dword [ebp + 8]
call fcn.00405184
xor eax, eax
push ebp
push 0x569da0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x6c]
xor eax, eax
call fcn.004032f8
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
call fcn.0040cd34
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x10]
mov ecx, 0x569db8
call fcn.00404fe0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xa4], eax
mov byte [ebp - 0xa0], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x9c], eax
mov byte [ebp - 0x98], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x94], eax
mov byte [ebp - 0x90], 0xb
mov eax, dword [ebx + 4]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 0x88], 0
mov eax, 0x569dd4
mov dword [ebp - 0x84], eax
mov byte [ebp - 0x80], 0xb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x78], 0xb
mov eax, dword [ebp + 8]
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x70], 0xb
lea edx, [ebp - 0xa4]
mov ecx, 6
mov eax, 0x569de4
call fcn.0040d608
mov eax, dword [ebp - 0x10]
call fcn.0040ca7c
test al, al
je 0x569d6b
mov eax, dword [ebp - 0x10]
call fcn.004f3350
test al, al
je 0x569d6b
lea eax, [ebp - 0x64]
mov edx, 0x10
call fcn.0040840c
lea eax, [ebp - 0x54]
mov edx, 0x44
call fcn.0040840c
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 1
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405194
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x569d6b
mov eax, dword [ebp - 0x64]
mov dword [ebx + 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x569da7
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.00404cf8
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404cf8
lea eax, [ebp + 8]
mov edx, 2
call fcn.00404cf8
ret
Function at 0x5762ac
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
test eax, eax
je 0x576373
xor edx, edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], edx
xor edx, edx
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], edx
xor edx, edx
mov dword [eax + 0x30], edx
mov dword [eax + 0x34], edx
xor edx, edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
xor edx, edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], edx
xor edx, edx
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
xor edx, edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
xor edx, edx
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
xor edx, edx
push ebp
push 0x57633c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
test eax, eax
je 0x576332
cmp dword [eax + 0x60], 0
je 0x576332
mov eax, dword [eax + 0x60]
call fcn.00572eac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x576346
xor eax, eax
push ebp
push 0x576369
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.00573ac8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x576373
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x588e70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
test dl, dl
je 0x588f26
push 0xffffffffffffffec
mov eax, dword [0x5cfe00]
mov eax, dword [eax]
mov esi, dword [eax + 0x30]
push esi
call sub.user32.dll_GetWindowLongA
or eax, 0x40000
and eax, 0xffffff7f
push eax
push 0xffffffffffffffec
mov eax, dword [0x5cfe00]
push esi
call sub.user32.dll_SetWindowLongA
mov eax, dword [0x5cfe00]
mov eax, dword [eax]
call fcn.0046c654
mov eax, ebx
call fcn.00588f68
mov eax, dword [0x5cfb9c]
cmp byte [eax], 0
je 0x588ed1
mov eax, dword [0x5cfb9c]
mov byte [eax], 0
jmp 0x588edd
mov eax, dword [0x5cfe00]
mov eax, dword [eax]
call fcn.0046c754
xor eax, eax
call fcn.005ae474
xor eax, eax
push ebp
push 0x588f1a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5d0030]
mov eax, dword [eax]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x588f10
mov eax, dword [0x5d0030]
mov eax, dword [eax]
push eax
call sub.user32.dll_DestroyWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x588f3c
mov al, 1
call fcn.005ae474
push 0
mov eax, ebx
call fcn.00452170
push eax
call sub.user32.dll_ShowWindow
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5ac2c8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405184
xor eax, eax
push ebp
push 0x5ac3f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404cd4
cmp dword [ebp - 4], 0
je 0x5ac3e3
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00405194
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5ac3e3
mov eax, dword [ebp - 8]
call fcn.00402e64
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5ac3dc
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5ac408
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
shr esi, 0x10
mov dx, word [eax + 8]
and dx, 0xffff
mov word [ebp - 0x1a], dx
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0x1c], dx
mov di, word [eax + 0xc]
and di, 0xffff
push ebx
movzx eax, si
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
movzx eax, word [ebp - 0x1a]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
movzx eax, word [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
movzx eax, di
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x3c]
mov ecx, 3
mov eax, 0x5ac414
call fcn.0040d608
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac3e3
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00402e94
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac400
lea eax, [ebp - 4]
call fcn.00404cd4
ret
Function at 0x5ac420
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ac5b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00404cd4
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
call fcn.00404d6c
mov dword [ebp - 0x24], 0xff
mov eax, dword [ebp - 4]
call fcn.00404f94
test eax, eax
jle 0x5ac595
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.00405194
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jbe 0x5ac573
mov eax, dword [ebp - 0x1c]
call fcn.00402e64
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5ac56c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x5ac553
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x5ac5bc
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5ac52a
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.004083f8
movzx eax, ax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
lea edx, [ebp - 0x44]
mov ecx, 2
mov eax, 0x5ac5e0
call fcn.0040d608
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.00404d6c
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x28]
call fcn.00405194
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5ac553
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0040d0f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac573
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00402e94
ret
mov eax, dword [ebp - 8]
mov edx, 0x5ac608
call fcn.004050e0
jne 0x5ac595
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x5ac595
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005ac2c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac5b7
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00404cf8
ret