joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5097fc
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x148], ecx
mov esi, edx
mov ebx, eax
lea edi, [ebp - 0x144]
xor eax, eax
push ebp
push 0x509931
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
lea eax, [ebp - 0x148]
mov ecx, 0x509948
mov edx, esi
call fcn.0040502c
mov eax, dword [ebp - 0x148]
call fcn.004051e0
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x509908
xor eax, eax
push ebp
push 0x509901
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [edi], 0x10
je 0x5098c7
cmp byte [edi + 0x2c], 0x2e
jne 0x509889
mov al, byte [edi + 0x2d]
test al, al
je 0x5098dc
sub al, 0x2e
je 0x5098dc
push esi
lea eax, [ebp - 0x150]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.00404f74
push dword [ebp - 0x150]
push 0x509954
lea eax, [ebp - 0x14c]
mov edx, 3
call fcn.004050a0
mov edx, dword [ebp - 0x14c]
mov eax, ebx
call fcn.005097fc
jmp 0x5098dc
mov eax, dword [edi + 0x1c]
mov edx, eax
neg eax
add eax, dword [edi + 0x20]
xor edx, edx
add dword [ebx + 0x48], eax
adc dword [ebx + 0x4c], edx
inc dword [ebx + 0x50]
push edi
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x509873
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509908
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509938
lea eax, [ebp - 0x150]
call fcn.00404d04
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.00404d28
ret

Function at 0x50cdec
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov edx, 2
mov eax, 0x50ced8
call fcn.004cf0dc
cmp dword [ebx + 0x48], 0
je 0x50ce0c
mov eax, ebx
call fcn.0050cf34
cmp dword [ebx + 0x30], 0
je 0x50ceca
test byte [ebx + 0x1c], 0x10
jne 0x50ceca
push 0
push 0
push 0
call fcn.0040748c
mov esi, eax
mov dword [ebx + 0x40], esi
test esi, esi
jne 0x50ce4a
mov ecx, 0x50cef0
mov dl, 1
mov eax, dword [0x4087d8]
call fcn.0040daa4
call fcn.00404674
push 0xffffffffffffffff
mov eax, dword [ebx + 0x40]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, 0x118
call fcn.00402b10
mov esi, eax
mov dword [ebx + 0x3c], esi
mov eax, dword [ebx + 0x38]
mov dword [esi], eax
mov eax, dword [ebx + 0x40]
mov dword [esi + 4], eax
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x110], eax
mov al, byte [ebx + 0x44]
mov byte [esi + 0x114], al
mov eax, dword [ebx + 0x30]
call fcn.004051e0
mov edx, eax
lea eax, [esi + 8]
call fcn.0040a660
lea eax, [ebx + 0x4c]
push eax
push 0
mov eax, dword [ebx + 0x3c]
push eax
push 0x50cd18
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov esi, eax
mov dword [ebx + 0x48], esi
test esi, esi
jne 0x50ceca
mov ecx, 0x50cf14
mov dl, 1
mov eax, dword [0x4087d8]
call fcn.0040daa4
call fcn.00404674
pop esi
pop ebx
ret
Function at 0x50d644
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, eax
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
sete al
mov byte [ebx + 0x438], al
cmp byte [ebx + 0x438], 0
je 0x50d67f
cmp dword [esp + 4], 5
jb 0x50d67f
cmp dword [esp + 8], 1
jae 0x50d683
xor eax, eax
jmp 0x50d685
mov al, 1
mov byte [ebx + 0x439], al
add esp, 0x94
pop ebx
ret

Function at 0x514200
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffc4
mov ebx, eax
mov esi, esp
mov eax, esi
xor ecx, ecx
mov edx, 0x3c
call fcn.004035d4
mov dword [esi], 0x3c
mov dword [esi + 4], 0x44c
call sub.user32.dll_GetDesktopWindow
mov dword [esi + 8], eax
mov eax, 0x51426c
mov dword [esi + 0xc], eax
mov eax, ebx
call fcn.004051e0
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 1
xor eax, eax
mov dword [esi + 0x20], eax
xor eax, eax
mov dword [esi + 0x24], eax
push esi
call sub.shell32.dll_ShellExecuteEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x3c
pop esi
pop ebx
ret

Function at 0x514278
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffc4
mov ebx, eax
mov esi, esp
mov eax, esi
xor ecx, ecx
mov edx, 0x3c
call fcn.004035d4
mov dword [esi], 0x3c
mov dword [esi + 4], 0x44c
call sub.user32.dll_GetDesktopWindow
mov dword [esi + 8], eax
mov eax, 0x5142dc
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 1
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
push esi
call sub.shell32.dll_ShellExecuteEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x3c
pop esi
pop ebx
ret

Function at 0x515854
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
mov edi, esp
mov ebp, 0x58fd60
mov eax, dword [ebp]
mov dword [ebx + 4], eax
push edi
call sub.kernel32.dll_GetLocalTime
mov ecx, dword [ebp]
and ecx, 0xf
mov esi, dword [ebx + 4]
shl esi, cl
mov ax, word [edi + 8]
or ax, word [edi + 0xc]
movzx eax, ax
shl eax, 0x10
mov dx, word [edi + 0xa]
or dx, word [edi + 0xe]
movzx edx, dx
or eax, edx
xor esi, eax
mov dword [ebx + 4], esi
mov dword [ebp], esi
inc dword [ebp]
cmp dword [ebx + 4], 0
je 0x515864
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x51888c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x5189c2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx], 0x1000
jle 0x5188eb
lea edx, [ebp - 0x100c]
mov eax, dword [0x59200c]
call fcn.00406e68
mov ecx, dword [ebp - 0x100c]
mov dl, 1
mov eax, dword [0x4087d8]
call fcn.0040daa4
call fcn.00404674
xor ecx, ecx
mov eax, dword [ebx]
mov dword [ebp - 8], eax
mov al, byte [ebp + 8]
mov byte [ebp + ecx - 0x1008], al
inc ecx
cmp dword [ebx], 0x7f
jle 0x518942
mov eax, dword [ebx]
mov esi, 0xff
cdq
idiv esi
mov esi, eax
test esi, esi
jne 0x518917
mov esi, 1
mov eax, esi
or al, 0x80
mov byte [ebp + ecx - 0x1008], al
add ecx, esi
mov eax, esi
test eax, eax
jle 0x51893d
mov edx, dword [ebx]
and dl, 0xff
mov byte [ebp + ecx - 0x1008], dl
shr dword [ebx], 8
dec ecx
dec eax
jne 0x51892a
inc esi
add ecx, esi
jmp 0x51894c
mov eax, dword [ebx]
mov byte [ebp + ecx - 0x1008], al
inc ecx
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebx], eax
cmp dword [ebx], 0x1000
jle 0x518982
lea edx, [ebp - 0x1010]
mov eax, dword [0x59200c]
call fcn.00406e68
mov ecx, dword [ebp - 0x1010]
mov dl, 1
mov eax, dword [0x4087d8]
call fcn.0040daa4
call fcn.00404674
lea edx, [ebp + ecx - 0x1008]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00402d30
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1008]
call fcn.00402d30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5189c9
lea eax, [ebp - 0x1010]
mov edx, 2
call fcn.00404d28
ret
Function at 0x533188
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x533343
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
je 0x5331d1
mov eax, dword [ebp - 8]
mov edx, 0x53335c
call fcn.00404d58
jmp 0x5332d0
mov esi, 0x533370
lea edi, [ebp - 0x110]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1a8], 0
jne 0x533208
push 0xff
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x593668]
push eax
call sub.kernel32.dll_GetModuleFileNameA
jmp 0x53321c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x1a8]
lea eax, [ebp - 0x110]
call fcn.0040a6e8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x533244
mov eax, dword [ebp - 8]
mov edx, 0x533478
call fcn.00404d58
jmp 0x5332d0
lea eax, [ebx + 1]
call fcn.0040a86c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5332c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 0
lea eax, [ebp - 0x110]
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x533283
mov eax, dword [ebp - 8]
mov edx, 0x533498
call fcn.00404d58
jmp 0x5332b3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x190], 9
jne 0x5332a2
mov eax, dword [ebp - 8]
push eax
mov ecx, ebx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00532d98
jmp 0x5332b3
mov eax, dword [ebp - 8]
push eax
mov ecx, ebx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00532f4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5332d0
mov eax, dword [ebp - 0x10]
call fcn.0040a8c8
ret
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004096f0
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 8]
call fcn.00404d58
mov eax, dword [ebp - 4]
cmp byte [eax + 0x198], 0
je 0x533325
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
call fcn.0053359c
push dword [ebp - 0x118]
push 0x5334c4
mov eax, dword [ebp - 8]
push dword [eax]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.004050a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53334a
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.00404d28
ret
Function at 0x53c538
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x53c541
mov eax, dword [ebp - 4]
add esp, 0xffffff88
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051d0
xor eax, eax
push ebp
push 0x53c644
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov byte [ebp - 0x19], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0
push 0x10000080
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 4]
call fcn.00405238
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x53c62e
lea eax, [ebp - 0x7c]
call fcn.0053c9cc
push 0
lea eax, [ebp - 0xc]
push eax
push 0x2000
lea eax, [ebp - 0x207c]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x53c5da
push esi
call sub.kernel32.dll_CloseHandle_1
jmp 0x53c62e
lea edx, [ebp - 0x207c]
lea eax, [ebp - 0x7c]
mov ecx, dword [ebp - 0xc]
call fcn.0053ca30
mov eax, dword [ebp - 0xc]
xor edx, edx
add dword [ebp - 0x18], eax
adc dword [ebp - 0x14], edx
cmp word [ebp + 0xa], 0
je 0x53c60c
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea edx, [ebp - 0x19]
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
cmp byte [ebp - 0x19], 0
jne 0x53c62e
cmp dword [ebp - 0xc], 0x2000
je 0x53c5b6
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x7c]
call fcn.0053ca70
push esi
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53c64b
lea eax, [ebp - 4]
call fcn.00404d04
ret
Function at 0x53c9cc
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
lea eax, [ebx + 0x1c]
xor ecx, ecx
mov edx, 0x40
call fcn.004035d4
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov dword [ebx + 0x10], 0xc3d2e1f0
pop ebx
ret

Function at 0x5474b8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, edx
xor eax, eax
push ebp
push 0x547570
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x441938]
call fcn.00441a38
mov esi, eax
mov edx, 0x80000001
mov eax, esi
call fcn.00441ad8
xor ecx, ecx
mov edx, 0x547588
mov eax, esi
call fcn.00441b3c
test al, al
je 0x547547
test bl, bl
je 0x54750f
mov edx, 0x5475c0
mov eax, esi
call fcn.00441e18
jmp 0x547547
push 0x5475d0
lea edx, [ebp - 8]
mov eax, dword [0x5924f8]
mov eax, dword [eax]
call fcn.00495454
push dword [ebp - 8]
push 0x5475dc
lea eax, [ebp - 4]
mov edx, 3
call fcn.004050a0
mov ecx, dword [ebp - 4]
mov edx, 0x5475c0
mov eax, esi
call fcn.00441eb0
mov eax, esi
call fcn.00441aa8
mov eax, esi
call fcn.00403e94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547577
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d28
ret
Function at 0x55140c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x551424
add esp, 0xfffffff0
call fcn.0040420c
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x551633
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403e64
push edi
push 0x5513cc
mov eax, 0x551660
call fcn.004cb5c4
mov edx, dword [0x59231c]
mov dword [edx], eax
mov eax, dword [0x59231c]
mov eax, dword [eax]
xor edx, edx
push edx
push eax
lea eax, [ebp - 8]
call fcn.00409aec
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x551678
call fcn.0040502c
mov eax, dword [ebp - 4]
mov edx, 2
call fcn.004cf0dc
mov dl, 1
mov eax, dword [0x4da2c0]
call fcn.004da330
mov dword [edi + 0x44], eax
xor edx, edx
mov eax, 0x551690
call fcn.004cf0dc
mov dl, 1
mov eax, dword [0x4e2bec]
call fcn.004e30dc
mov dword [edi + 0x50], eax
xor edx, edx
mov eax, 0x5516a8
call fcn.004cf0dc
mov ecx, dword [edi + 0x50]
mov dl, 1
mov eax, dword [0x4f5970]
call fcn.004f5a9c
mov esi, eax
mov dword [edi + 0x4c], esi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], 0x5534c4
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], 0x55a800
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], 0x558734
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], 0x552328
xor edx, edx
mov eax, 0x5516c4
call fcn.004cf0dc
mov dl, 1
mov eax, dword [0x4183a4]
call fcn.00403e64
mov dword [edi + 0xc], eax
mov dl, 1
mov eax, dword [0x4183a4]
call fcn.00403e64
mov dword [edi + 4], eax
mov dl, 1
mov eax, dword [0x4183a4]
call fcn.00403e64
mov dword [edi + 8], eax
mov dl, 1
mov eax, dword [0x4183a4]
call fcn.00403e64
mov dword [edi + 0x90], eax
mov ecx, 0x1f4
mov dl, 1
mov eax, dword [0x4cc2f0]
call fcn.004cc350
mov esi, eax
mov dword [edi + 0x14], esi
push edi
push 0x55a39c
mov eax, esi
call fcn.004cc4a4
xor eax, eax
mov dword [edi + 0xc0], eax
mov dword [edi + 0xc4], eax
xor eax, eax
mov dword [edi + 0xc8], eax
xor eax, eax
mov dword [edi + 0xd0], eax
mov eax, dword [0x5921a0]
xor edx, edx
mov dword [eax], edx
xor eax, eax
mov dword [edi + 0x30], eax
xor eax, eax
mov dword [edi + 0x10], eax
xor eax, eax
mov dword [edi + 0x54], eax
mov byte [edi + 0xd9], 0
mov byte [edi + 0xd8], 0
mov byte [edi + 0xe8], 0
mov byte [edi + 0x24], 0
mov byte [edi + 0x25], 0
xor edx, edx
mov eax, 0x5516d8
call fcn.004cf0dc
mov dl, 1
mov eax, dword [0x4ca990]
call fcn.004ca9fc
mov edx, dword [0x5923b4]
mov dword [edx], eax
mov edx, dword [0x5923d0]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
mov ecx, 0x5516ec
call fcn.0040502c
mov edx, dword [ebp - 0xc]
mov eax, dword [0x5923b4]
mov eax, dword [eax]
call fcn.004cadc0
call fcn.00402fa0
mov eax, 0x1e
call fcn.004035f4
mov byte [edi + 0x40], al
mov eax, dword [0x592388]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55163a
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404d28
ret
Function at 0x5555ec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004051d0
mov eax, dword [ebp - 8]
call fcn.004051d0
xor eax, eax
push ebp
push 0x5556b6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
je 0x555629
xor ebx, ebx
jmp 0x55562e
mov ebx, 1
mov al, byte [0x5556c4]
push eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x5556d0
mov eax, dword [ebp - 4]
call fcn.0040f014
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00404d9c
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x5556dc
call fcn.0040502c
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.004cf0dc
cmp byte [ebp + 0xc], 0
jne 0x555684
push ebx
mov eax, dword [ebp - 4]
call fcn.004051e0
push eax
call sub.kernel32.dll_WinExec
jmp 0x55569b
mov eax, dword [0x59263c]
mov eax, dword [eax]
mov ecx, dword [eax + 0x1a4]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00497534
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5556bd
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404d28
ret
Function at 0x55adec
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov eax, dword [ebp - 4]
call fcn.004051d0
xor eax, eax
push ebp
push 0x55ae94
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x55aea8
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00409a00
push dword [ebp - 0x18]
push 0x55aec0
push dword [ebp - 4]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004050a0
mov eax, dword [ebp - 0x14]
mov edx, 2
call fcn.004cf0dc
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 4]
call fcn.00404fe0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.004051e0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 0x55ad88
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55ae9b
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404d28
lea eax, [ebp - 4]
call fcn.00404d04
ret
Function at 0x55be90
Capabilities:
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x55c160
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0xa1], 0
mov byte [ebx + 0xa2], 0
mov byte [ebx + 0x9a], 0
lea eax, [ebx + 0x10]
mov edx, 0x55c174
call fcn.00404d58
lea eax, [ebx + 0x14]
mov edx, 0x55c1d4
call fcn.00404d58
lea eax, [ebx + 0x30]
mov edx, 0x55c1f0
call fcn.00404d58
lea edx, [ebp - 4]
mov eax, 0x55c200
call fcn.004c9250
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.00404d58
mov word [ebx + 0x10c], 7
mov word [ebx + 0xfe], 7
mov word [ebx + 0xa4], 0xa
mov word [ebx + 0xa6], 0x1e
mov word [ebx + 0xa8], 0xf
mov word [ebx + 0x100], 0
mov word [ebx + 0x102], 0
mov word [ebx + 0x104], 0x1e
mov word [ebx + 0x106], 0x1e
mov word [ebx + 0x108], 0x64
mov word [ebx + 0xaa], 0x3c
mov word [ebx + 0xac], 3
xor eax, eax
mov dword [ebx + 0x1b0], eax
xor eax, eax
mov dword [ebx + 0x1a8], eax
xor eax, eax
mov dword [ebx + 0x1ac], eax
mov dword [ebx + 0x1a4], 0x1e
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0x9d], 0
mov byte [ebx + 0x9e], 0
mov byte [ebx + 0x8d], 0
mov dword [ebx + 0x19c], 0x1f4
xor eax, eax
mov dword [ebx + 0x138], eax
lea eax, [ebx + 0x74]
mov edx, 0x55c214
call fcn.00404d58
lea eax, [ebx + 0x48]
call fcn.00404d04
mov dword [ebx + 0x12c], 0xccffff
xor eax, eax
mov dword [ebx + 0x140], eax
mov dword [ebx + 0x144], 0x8000
mov dword [ebx + 0x148], 0x800000
mov dword [ebx + 0x150], 0xff
mov dword [ebx + 0x128], 0xffffff
mov dword [ebx + 0x134], 0xff00
mov dword [ebx + 0x154], 0xeeeeee
mov dword [ebx + 0x138], 0xff
mov dword [ebx + 0x13c], 0xff0000
mov dword [ebx + 0x114], 0xff0000
mov dword [ebx + 0x118], 0xffff
mov dword [ebx + 0x11c], 0xffffff
mov dword [ebx + 0x124], 0xff00
mov dword [ebx + 0x120], 0xff
xor eax, eax
mov dword [ebx + 0x130], eax
mov dword [ebx + 0x14c], 0x80
mov word [ebx + 0xae], 7
mov byte [ebx + 0x97], 0xa
mov word [ebx + 0x10e], 0
mov word [ebx + 0x110], 0x754e
lea eax, [ebx + 0x50]
mov edx, 0x55c234
call fcn.00404d58
lea eax, [ebx + 0x70]
mov edx, 0x55c268
call fcn.00404d58
lea eax, [ebx + 0x24]
mov edx, 0x55c28c
call fcn.00404d58
lea eax, [ebx + 0x20]
mov edx, dword [ebx + 0x24]
call fcn.00404d58
lea eax, [ebx + 0x28]
mov edx, dword [ebx + 0x24]
call fcn.00404d58
lea eax, [ebx + 0x2c]
mov edx, dword [ebx + 0x24]
call fcn.00404d58
lea eax, [ebx + 0x48]
mov edx, 0x55c2a4
call fcn.00404d58
mov byte [ebx + 0xb5], 0
mov byte [ebx + 0xb6], 1
mov byte [ebx + 0xb7], 1
mov byte [ebx + 0xb8], 1
mov byte [ebx + 0xb9], 1
mov byte [ebx + 0xba], 1
mov byte [ebx + 0xbb], 0
mov byte [ebx + 0xe8], 1
lea eax, [ebx + 0x18]
mov edx, 0x55c2c0
call fcn.00404d58
call fcn.0040baa4
call fcn.00403054
mov dword [ebx + 0x1a0], eax
lea eax, [ebx + 0x7c]
mov edx, 0x55c2d8
call fcn.00404d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c167
lea eax, [ebp - 4]
call fcn.00404d04
ret
Function at 0x564d48
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x946], 1
lea eax, [ebx + 0x8e0]
push eax
push 0
call sub.shell32.dll_Shell_NotifyIcon
push 0
mov eax, dword [0x5924f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, ebx
call fcn.0048e294
mov eax, ebx
call fcn.00475170
pop ebx
ret

Function at 0x564d84
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x9ac], 0
jne 0x564dd7
push 1
mov eax, dword [0x5924f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov dl, 1
mov eax, ebx
call fcn.0048e294
mov eax, ebx
call fcn.00475170
mov eax, dword [0x5924f8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetForegroundWindow
lea eax, [ebx + 0x8e0]
push eax
push 2
call sub.shell32.dll_Shell_NotifyIcon
mov byte [ebx + 0x946], 0
pop ebx
ret
Function at 0x56dc34
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff2c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004051d0
xor eax, eax
push ebp
push 0x56de4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x59263c]
mov eax, dword [eax]
cmp byte [eax + 0xbb], 0
je 0x56dcac
lea eax, [ebp - 0xc4]
push eax
call sub.kernel32.dll_GetTimeZoneInformation
call fcn.0040baa4
fild dword [ebp - 0xc4]
fdiv dword [0x56de58]
faddp st(1)
fstp qword [ebp - 0x18]
wait
jmp 0x56dcb5
call fcn.0040baa4
fstp qword [ebp - 0x18]
wait
cmp dword [ebx + 0xbc], 0xffffffff
jne 0x56ddb0
mov eax, dword [0x59263c]
mov eax, dword [eax]
mov eax, dword [eax + 0x78]
call fcn.00498774
test al, al
je 0x56de1f
mov eax, dword [0x59263c]
mov eax, dword [eax]
cmp byte [eax + 0xb5], 0
je 0x56de1f
mov eax, dword [0x59263c]
mov eax, dword [eax]
push dword [eax + 0x78]
push dword [ebx + 0x3c]
push 0x56de64
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea edx, [ebp - 0xc8]
mov eax, 0x56de70
call fcn.0040c8c0
push dword [ebp - 0xc8]
push 0x56de88
lea eax, [ebp - 8]
mov edx, 5
call fcn.004050a0
push 0
push 0x10000080
push 4
push 0
push 1
push 0x40000000
lea eax, [ebp - 8]
call fcn.00405238
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
mov dword [ebx + 0xbc], esi
cmp esi, 0xffffffff
je 0x56de1f
push 0x56de98
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea edx, [ebp - 0xcc]
mov eax, 0x56deb8
call fcn.0040c8c0
push dword [ebp - 0xcc]
push 0x56dedc
lea eax, [ebp - 8]
mov edx, 3
call fcn.004050a0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404fe0
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebx + 0xbc]
push eax
call sub.kernel32.dll_WriteFile
mov eax, dword [0x59263c]
mov eax, dword [eax]
cmp byte [eax + 0xba], 0
je 0x56dde7
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea edx, [ebp - 0xd0]
mov eax, 0x56dee8
call fcn.0040c8c0
mov edx, dword [ebp - 0xd0]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.0040502c
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404fe0
add eax, 2
push eax
lea eax, [ebp - 0xd4]
mov ecx, 0x56dedc
mov edx, dword [ebp - 4]
call fcn.0040502c
mov eax, dword [ebp - 0xd4]
push eax
mov eax, dword [ebx + 0xbc]
push eax
call sub.kernel32.dll_WriteFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56de51
lea eax, [ebp - 0xd4]
mov edx, 4
call fcn.00404d28
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d28
ret