joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a130c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], edx
mov dl, byte [eax + 8]
cmp dl, 3
je 0x4a1499
xor esi, esi
xor edi, edi
mov ebx, dword [eax]
test dl, 2
mov dword [esp + 4], ebx
je 0x4a135d
movzx ebp, byte [ecx]
xor edx, edx
mov dl, byte [eax + 9]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
inc esi
movzx ebp, byte [ecx + 1]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
xor ebx, ebx
inc esi
mov bl, byte [ecx + 2]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
jmp 0x4a136e
xor edx, edx
xor ebx, ebx
mov bl, byte [ecx + 3]
mov dl, byte [eax + 9]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
test byte [eax + 8], 4
je 0x4a1384
xor edx, edx
mov dl, byte [eax + 9]
movzx ecx, byte [ecx + 4]
sub edx, ecx
mov dword [esp + esi*4 + 0xc], edx
inc esi
xor edx, edx
lea ecx, [esp + 0xc]
cmp esi, edx
jle 0x4a13a6
mov ebx, dword [ecx]
test ebx, ebx
jg 0x4a139a
xor ebx, ebx
mov dword [ecx], ebx
jmp 0x4a139e
mov di, 1
inc edx
add ecx, 4
cmp esi, edx
jg 0x4a138e
test di, di
je 0x4a1499
mov dl, byte [eax + 9]
sub dl, 2
je 0x4a13cf
sub dl, 2
je 0x4a13ef
sub dl, 4
je 0x4a1429
sub dl, 8
je 0x4a144d
jmp 0x4a1499
mov ecx, dword [eax + 4]
mov eax, dword [esp]
xor edx, edx
cmp ecx, edx
jbe 0x4a1499
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x4a13df
jmp 0x4a1499
mov edx, dword [esp]
mov esi, dword [eax + 4]
mov ecx, dword [esp + 0xc]
mov eax, 0xf0
sar eax, cl
and al, 0xf0
mov ecx, dword [esp + 0xc]
mov ebx, 0xf
sar ebx, cl
or al, bl
xor ebx, ebx
cmp esi, ebx
jbe 0x4a1499
mov ecx, dword [esp + 0xc]
inc ebx
shr byte [edx], cl
and byte [edx], al
inc edx
cmp esi, ebx
ja 0x4a1419
jmp 0x4a1499
mov edi, dword [esp]
mov ebp, dword [esp + 4]
imul ebp, esi
xor ebx, ebx
cmp ebp, ebx
jbe 0x4a1499
mov eax, ebx
xor edx, edx
div esi
mov ecx, dword [esp + edx*4 + 0xc]
shr byte [edi], cl
inc edi
inc ebx
cmp ebp, ebx
ja 0x4a1439
jmp 0x4a1499
mov ebx, dword [esp]
mov eax, esi
imul dword [esp + 4]
mov dword [esp + 8], eax
xor ebp, ebp
mov eax, dword [esp + 8]
cmp ebp, eax
jae 0x4a1499
movzx edi, byte [ebx]
shl edi, 8
xor eax, eax
mov al, byte [ebx + 1]
xor edx, edx
add di, ax
mov eax, ebp
div esi
inc ebp
mov ecx, dword [esp + edx*4 + 0xc]
shr di, cl
movzx eax, di
sar eax, 8
mov edx, edi
mov byte [ebx], al
inc ebx
and dl, 0xff
mov byte [ebx], dl
inc ebx
mov ecx, dword [esp + 8]
cmp ebp, ecx
jb 0x4a1464
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bd838
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bda98
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4bd89b
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004bd350
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040ebd8
cmp al, 1
jne 0x4bd89b
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004bd618
test al, al
je 0x4bda27
cmp dword [ebp - 8], 0
jge 0x4bd8b9
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004bd350
mov eax, dword [ebp - 0x210]
call fcn.004052d0
cmp ebx, eax
jge 0x4bd903
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004bd350
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x5b2ea8]
and eax, 0xff
bt dword [edx], eax
jae 0x4bd903
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4bd917
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004bd814
cmp ebx, dword [ebp - 8]
je 0x4bda19
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4bd943
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004042e8
and eax, 0x7f
movzx eax, word [eax*2 + 0x5ae668]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4bda06
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004042e8
and eax, 0x7f
movzx eax, word [eax*2 + 0x5ae668]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00453804
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004042e8
and eax, 0x7f
movzx eax, word [eax*2 + 0x5ae668]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00453804
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bda0d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4bda7a
cmp dword [ebp - 8], 0
jge 0x4bda32
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004bd350
mov eax, dword [ebp - 0x218]
call fcn.004052d0
cmp eax, dword [ebp - 8]
jg 0x4bda6c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004bd350
mov eax, dword [ebp - 0x21c]
call fcn.004052d0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004bd814
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bda9f
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00405018
ret
Function at 0x4ccd9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4cce4f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x105]
push eax
push ebx
push 0x4cce60
mov eax, edi
call fcn.004054d0
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.0040b17c
mov eax, dword [ebp - 0x10c]
call fcn.0040aa38
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x105]
call fcn.0040b17c
mov eax, dword [ebp - 0x110]
mov ecx, esi
mov edx, dword [ebp - 4]
call fcn.0040aad8
inc ebx
mov eax, dword [esi]
call fcn.0040a73c
test al, al
jne 0x4ccdce
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cce56
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.00405018
ret
Function at 0x51da44
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x51da95
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x51da7c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x51da6c
jmp 0x51da95
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x51da7d
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x52cd08
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52cee4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x105
mov eax, dword [ebp - 0x18]
call fcn.00402c7c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x52cd7f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
test eax, eax
je 0x52cd69
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.004051ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52cd86
mov eax, dword [ebp - 8]
call fcn.00402cac
ret
Function at 0x531c28
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
test dl, dl
je 0x531c3c
add esp, 0xfffffff0
call fcn.00404458
mov ebx, edx
mov esi, eax
mov byte [esi + 0x479], 1
xor edx, edx
mov eax, esi
call fcn.00518290
call fcn.00530dbc
push esi
push 0x531d1c
call fcn.00463cc8
mov dword [esi + 0x474], eax
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.0040387c
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
cmp byte [ebp - 0xa], 0x31
jne 0x531c96
mov byte [esi + 0x470], 1
jmp 0x531c9d
mov byte [esi + 0x470], 0
mov edx, dword [0x531cdc]
mov eax, esi
call fcn.00531e00
mov edx, dword [0x531ce0]
mov eax, esi
call fcn.00531e94
mov byte [esi + 0x478], 0
mov eax, esi
test bl, bl
je 0x531cd3
call fcn.004044b0
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5341d0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x53424f
mov eax, ebx
and eax, 0xff
bt dword [0x5b1e0c], eax
jae 0x534229
mov ecx, 1
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.005341c4
cmp byte [ebp - 1], 0
je 0x53424a
mov ecx, 3
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.005341c4
jmp 0x53424a
xor ecx, ecx
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.005341c4
cmp byte [ebp - 1], 0
je 0x53424a
mov ecx, 2
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.005341c4
dec si
jne 0x5341f3
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x534254
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, eax
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
and edx, 0xff
bt dword [0x5b1e0c], edx
jae 0x534283
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.005341c4
pop ebx
ret
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.005341c4
pop ebx
ret
Function at 0x53672c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
mov ebx, eax
mov edi, esp
mov edx, 1
mov eax, dword [ebx + 0x10]
call fcn.0042aea8
xor edx, edx
mov eax, dword [ebx + 0x10]
call fcn.0042ae78
mov edx, esi
mov eax, dword [ebx + 0x10]
call fcn.0042ad7c
dec dword [edi + 8]
dec dword [edi + 0xc]
mov edx, dword [edi]
add edx, 3
mov ecx, dword [edi + 4]
mov eax, ebx
call fcn.0042b834
mov edx, dword [edi + 8]
sub edx, 2
mov ecx, dword [edi + 4]
mov eax, ebx
call fcn.0042b7d4
mov ecx, dword [edi + 4]
add ecx, 3
mov edx, dword [edi]
mov eax, ebx
call fcn.0042b834
mov ecx, dword [edi + 0xc]
sub ecx, 2
mov edx, dword [edi]
mov eax, ebx
call fcn.0042b7d4
mov ecx, dword [edi + 4]
add ecx, 3
mov edx, dword [edi + 8]
mov eax, ebx
call fcn.0042b834
mov ecx, dword [edi + 0xc]
sub ecx, 2
mov edx, dword [edi + 8]
mov eax, ebx
call fcn.0042b7d4
mov edx, dword [edi]
add edx, 3
mov ecx, dword [edi + 0xc]
mov eax, ebx
call fcn.0042b834
mov edx, dword [edi + 8]
sub edx, 2
mov ecx, dword [edi + 0xc]
mov eax, ebx
call fcn.0042b7d4
push esi
mov byte [esp + 0x14], 0x1e
mov byte [esp + 0x15], 0x50
mov byte [esp + 0x16], 0xc8
mov byte [esp + 0x17], 0x50
mov byte [esp + 0x18], 0xc8
mov byte [esp + 0x19], 0x3c
mov byte [esp + 0x1a], 0xc8
mov byte [esp + 0x1b], 0x3c
mov byte [esp + 0x1c], 0
lea eax, [esp + 0x14]
push eax
push 8
mov ecx, dword [edi + 4]
mov edx, dword [edi]
mov eax, ebx
call fcn.005366b8
push esi
mov byte [esp + 0x14], 0xc8
mov byte [esp + 0x15], 0x50
mov byte [esp + 0x16], 0x1e
mov byte [esp + 0x17], 0x3c
mov byte [esp + 0x18], 0xc8
mov byte [esp + 0x19], 0x50
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1b], 0x3c
mov byte [esp + 0x1c], 0xc8
lea eax, [esp + 0x14]
push eax
push 8
mov edx, dword [edi + 8]
sub edx, 2
mov ecx, dword [edi + 4]
mov eax, ebx
call fcn.005366b8
push esi
mov byte [esp + 0x14], 0xc8
mov byte [esp + 0x15], 0x3c
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0x50
mov byte [esp + 0x18], 0xc8
mov byte [esp + 0x19], 0x3c
mov byte [esp + 0x1a], 0x1e
mov byte [esp + 0x1b], 0x50
mov byte [esp + 0x1c], 0xc8
lea eax, [esp + 0x14]
push eax
push 8
mov ecx, dword [edi + 0xc]
sub ecx, 2
mov edx, dword [edi]
mov eax, ebx
call fcn.005366b8
push esi
mov byte [esp + 0x14], 0
mov byte [esp + 0x15], 0x3c
mov byte [esp + 0x16], 0xc8
mov byte [esp + 0x17], 0x3c
mov byte [esp + 0x18], 0xc8
mov byte [esp + 0x19], 0x50
mov byte [esp + 0x1a], 0xc8
mov byte [esp + 0x1b], 0x50
mov byte [esp + 0x1c], 0x1e
lea eax, [esp + 0x14]
push eax
push 8
mov ecx, dword [edi + 0xc]
sub ecx, 2
mov edx, dword [edi + 8]
sub edx, 2
mov eax, ebx
call fcn.005366b8
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x54095c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x540b32
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x540b19
mov eax, dword [edi + 0x30]
call fcn.004052d0
test eax, eax
jne 0x5409b2
mov eax, dword [edi + 0x34]
call fcn.004052d0
test eax, eax
jne 0x5409b2
mov eax, edi
call fcn.00540bd0
jmp 0x540b19
cmp dword [edi + 0xa0], 0
jne 0x5409e9
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.0040af84
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5b53b0]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x540a20
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.0040af84
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5b53b0]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00540c10
mov ebx, eax
test bl, bl
jne 0x540ace
mov eax, dword [edi + 0x30]
call fcn.004052d0
test eax, eax
jne 0x540a58
mov eax, dword [edi + 0xc0]
call fcn.004052d0
test eax, eax
je 0x540ace
mov eax, dword [edi + 0xc0]
call fcn.004052d0
test eax, eax
je 0x540a7a
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.0040af84
jmp 0x540aa6
push dword [edi + 0x30]
push 0x540b4c
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00405390
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.0040af84
push 7
lea eax, [ebp - 0x101]
push eax
call sub.KERNEL32.DLL_WinExec
cmp eax, 0x20
jb 0x540ace
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00540c10
mov ebx, eax
test bl, bl
jne 0x540adb
mov eax, edi
call fcn.00540bd0
jmp 0x540b19
mov eax, dword [edi + 0x58]
test eax, eax
je 0x540aea
mov dword [edi + 0xa8], eax
jmp 0x540af4
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.00540c88
test al, al
je 0x540b19
mov eax, edi
mov si, 0xffee
call fcn.004042e8
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.00540d34
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x540b39
lea eax, [ebp - 0x108]
call fcn.00404ff4
ret
Function at 0x548e04
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
push 1
push 0x548e54
push 0x548e54
mov eax, ebx
call fcn.004054d0
push eax
push 0x548e58
mov eax, dword [0x5b2c34]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x548e3e
xor eax, eax
call fcn.005a1e8c
pop ebx
ret
mov eax, dword [0x5b2998]
mov eax, dword [eax]
mov eax, dword [eax + 0x3fc]
call fcn.005a1e8c
pop ebx
ret

Function at 0x550854
Capabilities:
Find taskbar

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov dword [esp], 0x24
push 0
push 0x5508a8
call sub.user32.dll_FindWindowA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x550895
push esp
push 4
call sub.shell32.dll_SHAppBarMessage
test eax, 1
jbe 0x550895
push esp
push 5
call sub.shell32.dll_SHAppBarMessage
cmp eax, 1
je 0x550899
xor eax, eax
jmp 0x55089b
mov al, 1
mov edx, dword [esp + 0xc]
mov dword [ebx], edx
add esp, 0x24
pop ebx
ret
Function at 0x55d05c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x55d17c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.005a1e8c
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, ebx
call fcn.0055c918
test al, al
je 0x55d147
mov edx, esi
mov eax, 0x55d194
call fcn.0047a6c4
test al, al
je 0x55d0fb
cmp dword [ebp - 8], 0
je 0x55d0df
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x55d0c2
cmp dword [ebx + 0x310], 0
jne 0x55d0cb
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_BringWindowToTop
push 0
push 0
push 0x10
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SendMessageA
jmp 0x55d161
mov ebx, dword [0x5b2a3c]
mov ebx, dword [ebx]
lea edx, [ebp - 0x10]
mov eax, 0x14b
call ebx
mov eax, dword [ebp - 0x10]
call fcn.005a1e8c
jmp 0x55d161
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x55d121
mov byte [ebx + 0x304], 1
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x300]
call fcn.0040a150
mov eax, dword [ebp - 0x14]
call fcn.0055c808
jmp 0x55d161
mov eax, dword [ebp - 4]
push eax
push 0
push 0x400
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x55d161
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
push ebx
call sub.KERNEL32.DLL_CloseHandle
jmp 0x55d161
mov ebx, dword [0x5b2a3c]
mov ebx, dword [ebx]
lea edx, [ebp - 0x18]
mov eax, 0x14c
call ebx
mov eax, dword [ebp - 0x18]
call fcn.005a1e8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d183
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405018
ret
Function at 0x55fbe4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x55fcf8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5b2eb8]
cmp dword [eax], 2
je 0x55fcd7
xor edx, edx
push ebp
push 0x55fccd
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x10d]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x10d]
call fcn.0040b17c
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 8]
mov edx, 0x55fd10
call fcn.00442d04
mov eax, dword [ebp - 8]
call fcn.004054d0
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x55fcc3
xor edx, edx
push ebp
push 0x55fcbc
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x55fd18
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x55fca5
push 0
push 0
mov edx, dword [0x5b2cc0]
mov edx, dword [edx]
push edx
push 0x55fd2c
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55fcc3
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55fcd7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55fcff
lea eax, [ebp - 0x114]
call fcn.00404ff4
lea eax, [ebp - 8]
call fcn.00404ff4
ret
Function at 0x59dd84
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov edi, edx
xor edx, edx
mov dword [esp], edx
cmp dword [eax + 4], 0
je 0x59de40
mov eax, dword [eax + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x3c]
add eax, dword [esp + 4]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x78]
add eax, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x18]
mov esi, eax
dec esi
test esi, esi
jb 0x59de40
inc esi
xor ebx, ebx
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x20]
mov edx, dword [esp + 0xc]
add eax, edx
mov ecx, ebx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, edx
mov dword [esp + 0x14], eax
push edi
mov eax, dword [esp + 0x18]
push eax
call sub.KERNEL32.DLL_lstrcmpA
test eax, eax
jne 0x59de3c
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x24]
mov eax, dword [esp + 0xc]
add edx, eax
mov ecx, ebx
add ecx, ecx
add edx, ecx
mov dx, word [edx]
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + 0x1c]
add ecx, eax
movzx edx, dx
shl edx, 2
add ecx, edx
mov edx, dword [ecx]
add edx, eax
mov dword [esp], edx
jmp 0x59de40
inc ebx
dec esi
jne 0x59dde1
mov eax, dword [esp]
add esp, 0x18
pop edi
pop esi
pop ebx
ret

Function at 0x59e794
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404ff4
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x59e828
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x59e823
xor eax, eax
push ebp
push 0x59e81c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x104
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push 0x59e864
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x59e805
mov edx, ebx
lea eax, [ebp - 0x10c]
call fcn.0040b17c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59e823
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
pop ebx
mov esp, ebp
pop ebp
ret