joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54d98b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
je 0x54d9ef
test esi, esi
je 0x54d9ef
push 5
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x54d9ef
and dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x54d9e9
push 5
push esi
push edi
call fcn.004dd610
and dword [ebp - 8], 0
lea eax, [ebp - 8]
add esp, 0xc
push eax
push dword [ebp - 4]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x54d9e9
mov al, 1
jmp 0x54d9f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop edi
pop esi
leave
ret

Function at 0x551ff3
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x20]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov dword [ebp - 8], ecx
lea eax, [esi + edi]
mov dword [ebp - 0x14], eax
cmp esi, eax
jge 0x55207e
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add edx, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
cmp ecx, edx
jge 0x552073
cmp ebx, edi
mov ecx, edi
mov edi, dword [ebp + 0x10]
cmovl ecx, ebx
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x24], edi
mov eax, edi
push 0xcc0020
push dword [ebp + 0x1c]
cmovl eax, dword [ebp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push ecx
push ebx
push esi
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
add ebx, dword [ebp + 0x24]
sub edi, dword [ebp + 0x24]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
cmp ebx, edx
jl 0x552033
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x20]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add esi, ebx
sub edi, ebx
mov dword [ebp + 0xc], edi
cmp esi, eax
jl 0x55201c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x553f0f
Capabilities:
Get disk information

Disassembly:
push 0x118
mov eax, 0x60741a
call fcn.004db4be
mov dword [ebp - 0x120], ecx
mov esi, 0x104
lea eax, [ebp - 0x114]
push esi
push 0
push eax
call fcn.004e0bc0
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov esi, dword [0x668294]
lea ebx, [ebp - 0x114]
xor edi, edi
mov dword [ebp - 0x11c], esi
and dword [ebp - 4], edi
mov eax, ebx
push eax
call fcn.00505070
pop ecx
cmp eax, 3
jne 0x553ff6
mov esi, dword [ebp - 0x120]
push 0
mov edx, ebx
lea ecx, [ebp - 0x118]
call fcn.00407b07
add ebx, 4
mov byte [ebp - 4], 1
push ebx
call fcn.00505070
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x124], eax
mov dword [esp], 0x637f74
call fcn.0040cf21
cmp eax, 0xffffffff
lea eax, [ebp - 0x118]
push eax
je 0x553fc5
lea ecx, [ebp - 0x11c]
call fcn.0040d242
jmp 0x553fcc
mov ecx, esi
call fcn.0042b3ea
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x118]
add ecx, 0xfffffff4
cmp ecx, 0x668010
je 0x553fe6
call fcn.00407965
inc edi
cmp dword [ebp - 0x124], 3
je 0x553f78
mov esi, dword [ebp - 0x11c]
cmp dword [esi - 8], 0
je 0x55400e
mov ecx, dword [ebp - 0x120]
lea eax, [ebp - 0x11c]
push eax
call fcn.0042b3ea
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x55401e
call fcn.00407965
mov eax, edi
call fcn.004db46d
ret

Function at 0x554026
Capabilities:
Create thread
Hide graphical window

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x1118], 0
jne 0x554063
push 0
push dword [edi + 0x5c0]
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [edi + 0x6a8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0x1128]
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [edi + 0x24]
pop edi
jmp fcn.0040834e
pop edi
ret

Function at 0x5545f5
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, 0x6074ca
call fcn.004db48b
mov edi, ecx
push 0
push dword [edi + 0x674]
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [edi + 0x54]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 8]
and dword [edi + 0x1148], 0
add ecx, 0xfffffff4
cmp ecx, 0x668010
je 0x554636
call fcn.00407965
call fcn.004db459
ret 4
Function at 0x554a70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x4a8], 1
jne 0x554bf7
push esi
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ebx + 0x54]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, 0xffffffff
je 0x554bf6
push edi
cmp esi, dword [ebx + 0x50c]
jae 0x554bf5
push esi
lea ecx, [ebx + 0x508]
call fcn.0041b97a
mov edi, dword [0x668294]
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov esi, dword [eax]
add esi, 0x3c
push esi
call fcn.0040d36e
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
call fcn.0040d242
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff4
cmp ecx, 0x668010
je 0x554af9
call fcn.00407965
mov ecx, dword [ebp - 8]
call fcn.00414841
test eax, eax
je 0x554b53
push esi
lea ecx, [ebp - 0x18]
call fcn.0040d36e
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 4]
push esi
push str._n__select___s_
push eax
call fcn.0040cefd
lea ecx, [esi - 0xc]
add esp, 0xc
cmp ecx, 0x668010
je 0x554b33
call fcn.00407965
mov edi, dword [ebp - 4]
push 1
push 0
push edi
push str.explorer.exe
push 0x634c74
push dword [0x674760]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x554bb1
mov eax, dword [0x668294]
push 0x8ca0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.0041129f
mov eax, dword [0x668294]
push 0x8ca1
push ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
call fcn.0041129f
mov esi, dword [ebp - 0x10]
push 0x30
push dword [ebp - 4]
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esi - 0xc]
mov esi, 0x668010
cmp ecx, esi
je 0x554ba2
call fcn.00407965
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff4
cmp ecx, esi
je 0x554bb1
call fcn.00407965
push 2
push dword [ebp - 0x14]
push 0x100c
push dword [ebx + 0x54]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 8]
mov esi, eax
add ecx, 0xfffffff4
mov dword [ebp - 0x14], esi
cmp ecx, 0x668010
je 0x554bdc
call fcn.00407965
lea ecx, [edi - 0xc]
cmp ecx, 0x668010
je 0x554bec
call fcn.00407965
cmp esi, 0xffffffff
jne 0x554aa8
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x555940
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, word [eax + 0xc]
cmp eax, 0x41
jne 0x5559b5
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x555a34
push ebx
lea esi, [edi + 0x54]
push dword [esi]
call dword [sym.imp.USER32.dll_SetFocus]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0xb
push dword [esi]
call ebx
mov ecx, edi
call fcn.005570ea
xor edi, edi
test eax, eax
jle 0x5559a8
mov ebx, eax
push 3
push 3
push edi
mov ecx, esi
call fcn.00429dec
inc edi
cmp edi, ebx
jl 0x555991
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0xb
push dword [esi]
call ebx
pop ebx
jmp 0x555a34
cmp eax, 0x2e
jne 0x555a34
mov esi, dword [edi + 0x54]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
jne 0x555a34
mov eax, dword [edi + 0x4a8]
test eax, eax
jne 0x5559d9
push eax
push 0x80c2
jmp 0x555a26
cmp eax, 1
jne 0x5559fd
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
push 0
jae 0x5559f6
push 0x80c7
jmp 0x555a26
push 0x80c6
jmp 0x555a26
lea ecx, [edi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x14]
test eax, eax
jne 0x555a34
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
push 0
jae 0x555a21
push 0x90b3
jmp 0x555a26
push 0x90b2
push 0x111
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x555a41
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx esi, word [eax + 0xc]
cmp esi, 0x2e
jne 0x555aa8
lea ecx, [edi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x14]
test eax, eax
jne 0x555b31
mov esi, dword [edi + 0x5c0]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
jne 0x555b31
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
push 0
jae 0x555a90
push 0x8cbc
jmp 0x555a95
push 0x8cbb
push 0x111
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x555b31
push 0x26
pop eax
mov dword [ebp + 0xc], eax
cmp si, ax
je 0x555ab8
cmp esi, 0x28
jne 0x555b31
push 2
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x5c0]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [0x673344]
test edx, edx
jle 0x555b31
lea ecx, [eax + 1]
dec eax
cmp si, word [ebp + 0xc]
cmovne eax, ecx
test eax, eax
jns 0x555aea
xor eax, eax
jmp 0x555af1
cmp eax, edx
jl 0x555af1
lea eax, [edx - 1]
push eax
mov ecx, 0x673340
call fcn.0042b6f7
mov esi, dword [eax]
test esi, esi
je 0x555b19
lock inc dword [esi + 0x34]
push 0
push dword [esi + 4]
push 0x102f
push dword [edi + 0x54]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0
push dword [edi + 0x54]
call dword [sym.imp.USER32.dll_InvalidateRect]
test esi, esi
je 0x555b31
mov ecx, esi
call fcn.00422d15
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x556500
Capabilities:
Get graphical window text

Disassembly:
push 0x2c
mov eax, 0x60777c
call fcn.004db48b
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x38]
call fcn.00427084
and dword [ebp - 4], 0
xorps xmm0, xmm0
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 2
push 0xffffffffffffffff
push 0x100c
push dword [esi + 0x54]
movlpd qword [ebp - 0x30], xmm0
call ebx
mov edi, eax
jmp 0x556590
push edi
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.0055701e
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x10]
test esi, esi
jne 0x55655a
mov byte [ebp - 4], 0
jmp 0x55658d
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.0042b636
mov eax, dword [esi + 0x24]
add dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
adc dword [ebp - 0x2c], 0
push 2
push edi
push 0x100c
push dword [eax + 0x54]
call ebx
mov ecx, esi
mov byte [ebp - 4], 0
mov edi, eax
call fcn.00416ed3
mov esi, dword [ebp - 0x14]
cmp edi, 0xffffffff
jne 0x55653d
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 1
push eax
push 0xd
push 0x784
push dword [0x674760]
call ebx
lea ecx, [ebp - 0x28]
call fcn.0041d45d
xor eax, eax
call fcn.004db459
ret 0x10

Function at 0x5565c1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push 2
mov ebx, ecx
push 0xffffffffffffffff
push 0x100c
mov dword [ebp - 0x14], ebx
push dword [ebx + 0x54]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x5566c1
push eax
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.0055701e
cmp dword [ebp - 8], 0
je 0x5566c1
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0041be56
mov ebx, dword [ebp - 0x10]
mov ecx, ebx
call fcn.00414841
test eax, eax
jne 0x55667c
mov eax, dword [0x668294]
push 0x8ca0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.0041129f
mov eax, dword [0x668294]
push 0x8ca1
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
call fcn.0041129f
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
push 0x30
push dword [ebp - 4]
push esi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esi - 0xc]
mov esi, 0x668010
cmp ecx, esi
je 0x55666b
call fcn.00407965
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff4
cmp ecx, esi
je 0x5566ad
call fcn.00407965
jmp 0x5566ad
push ebx
lea eax, [ebp - 0x10]
push str._n__select___s_
push eax
call fcn.0040cefd
mov ebx, dword [ebp - 0x10]
add esp, 0xc
push 1
push 0
push ebx
push str.explorer.exe
push 0x634c74
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, 0x668010
lea ecx, [ebx - 0xc]
cmp ecx, esi
je 0x5566b9
call fcn.00407965
mov ecx, dword [ebp - 8]
call fcn.00416ed3
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x557143
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov ebx, ecx
push eax
call fcn.00558310
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x557217
mov eax, dword [0x668294]
lea ecx, [ebp - 8]
mov dword [ebp - 4], eax
lea eax, [edi + 0x18]
push eax
call fcn.0040d36e
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call fcn.0040d242
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff4
cmp ecx, 0x668010
je 0x557195
call fcn.00407965
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.0055f56f
test eax, eax
jne 0x557220
mov eax, dword [0x668294]
push 0x8ca0
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 8], eax
call fcn.0041129f
mov eax, dword [0x668294]
push 0x8ca1
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
call fcn.0041129f
mov esi, dword [ebp - 0xc]
push 0x30
push dword [ebp - 8]
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esi - 0xc]
mov esi, 0x668010
cmp ecx, esi
je 0x5571f2
call fcn.00407965
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff4
cmp ecx, esi
je 0x557201
call fcn.00407965
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff4
cmp ecx, esi
je 0x557210
call fcn.00407965
mov ecx, edi
call fcn.00422d15
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
push esi
lea eax, [ebp - 4]
push str._n__root___s_
push eax
call fcn.0040cefd
mov esi, dword [ebp - 4]
add esp, 0xc
push 1
push 0
push esi
push str.explorer.exe
push 0x634c74
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esi - 0xc]
mov esi, 0x668010
cmp ecx, esi
je 0x55725d
call fcn.00407965
mov ecx, edi
call fcn.00422d15
jmp 0x557219

Function at 0x557266
Capabilities:
Get graphical window text

Disassembly:
push 0x2c
mov eax, 0x60794a
call fcn.004db48b
mov esi, ecx
cmp dword [esi + 0x1144], 0
jne 0x55733e
lea ecx, [ebp - 0x38]
mov dword [esi + 0x1144], 1
call fcn.00427084
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.00558310
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x557336
xorps xmm0, xmm0
xor ebx, ebx
movlpd qword [ebp - 0x30], xmm0
cmp dword [edi + 4], ebx
jbe 0x557311
push ebx
mov ecx, edi
call fcn.0042b614
mov esi, dword [eax]
mov dword [ebp - 0x14], esi
test esi, esi
je 0x5572d5
lock inc dword [esi + 4]
mov byte [ebp - 4], 2
test esi, esi
je 0x5572fc
cmp dword [esi + 0xc0], 0
jne 0x5572fc
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x28]
call fcn.0042b636
mov eax, dword [esi + 0x24]
add dword [ebp - 0x30], eax
adc dword [ebp - 0x2c], 0
mov byte [ebp - 4], 1
test esi, esi
je 0x55730b
mov ecx, esi
call fcn.00416ed3
inc ebx
cmp ebx, dword [edi + 4]
jb 0x5572c0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 1
push eax
push 0xd
push 0x784
push dword [0x674760]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, edi
call fcn.00422d15
lea ecx, [ebp - 0x28]
call fcn.0041d45d
xor eax, eax
call fcn.004db459
ret 0x10
Function at 0x558a2d
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
xor ebx, ebx
mov esi, ecx
inc ebx
push ebx
call fcn.00558a93
test eax, eax
je 0x558a8c
push 0
push ebx
push 3
mov ecx, esi
call fcn.0055cc5a
and dword [esi + 0x1148], 0
push 5
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x1128]
and dword [esi + 0x1134], 0
mov dword [esi + 0x112c], ebx
mov dword [esi + 0x1120], ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 5
mov ecx, esi
call fcn.0055891e
lea ecx, [esi + 0x24]
call fcn.0040834e
pop esi
xor eax, eax
pop ebx
ret 0x10

Function at 0x558bfb
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
call fcn.005549a1
test eax, eax
je 0x558c2a
mov ecx, edi
call fcn.00554987
push 5
push dword [edi + 0x7f0]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x84c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
ret 0x10

Function at 0x558c30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
lea ecx, [edi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x14]
test eax, eax
je 0x558c9c
push esi
mov ecx, edi
call fcn.00554994
mov eax, dword [0x668294]
push 0xea73
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.0041129f
mov esi, dword [ebp - 4]
push esi
push dword [edi + 0x640]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x558c81
call fcn.00407965
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x7f0]
call esi
push 5
push dword [edi + 0x84c]
call esi
pop esi
xor eax, eax
pop edi
leave
ret 0x10
Function at 0x55dd99
Capabilities:
Get graphical window text

Disassembly:
push 0x24
mov eax, 0x60832f
call fcn.004db48b
mov edi, ecx
cmp dword [edi + 0x1144], 0
jne 0x55de62
lea ecx, [ebp - 0x30]
mov dword [edi + 0x1144], 1
call fcn.00427084
and dword [ebp - 4], 0
xor ebx, ebx
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
cmp dword [edi + 0x5b0], ebx
jbe 0x55de3c
lea eax, [edi + 0x5ac]
push ebx
mov ecx, eax
call fcn.0042b614
mov esi, dword [eax]
mov dword [ebp - 0x10], esi
test esi, esi
je 0x55ddf7
lock inc dword [esi + 4]
mov byte [ebp - 4], 1
test esi, esi
je 0x55de1e
cmp dword [esi + 0xc0], 0
jne 0x55de1e
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.0042b636
mov eax, dword [esi + 0x24]
add dword [ebp - 0x28], eax
adc dword [ebp - 0x24], 0
mov byte [ebp - 4], 0
test esi, esi
je 0x55de2d
mov ecx, esi
call fcn.00416ed3
inc ebx
lea eax, [edi + 0x5ac]
cmp ebx, dword [edi + 0x5b0]
jb 0x55dde2
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 1
push eax
push 0xd
push 0x784
push dword [0x674760]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x20]
call fcn.0041d45d
xor eax, eax
call fcn.004db459
ret 0x10

Function at 0x55f3f2
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x20]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov dword [ebp - 8], ecx
lea eax, [esi + edi]
mov dword [ebp - 0x14], eax
cmp esi, eax
jge 0x55f47d
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add edx, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
cmp ecx, edx
jge 0x55f472
cmp ebx, edi
mov ecx, edi
mov edi, dword [ebp + 0x10]
cmovl ecx, ebx
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x24], edi
mov eax, edi
push 0xcc0020
push dword [ebp + 0x1c]
cmovl eax, dword [ebp + 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push ecx
push ebx
push esi
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
add ebx, dword [ebp + 0x24]
sub edi, dword [ebp + 0x24]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
cmp ebx, edx
jl 0x55f432
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x20]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add esi, ebx
sub edi, ebx
mov dword [ebp + 0xc], edi
cmp esi, eax
jl 0x55f41b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x55f4c1
Capabilities:
Create directory
Get file attributes

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x55f56b
xor eax, eax
cmp word [esi], ax
je 0x55f56b
push ebx
push edi
push 0x5c
pop ebx
push ebx
push esi
call fcn.004e115a
pop ecx
pop ecx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x55f52c
movzx eax, word [esi + 2]
cmp eax, 0x3a
jne 0x55f502
cmp word [esi + 4], bx
je 0x55f51e
cmp word [esi], bx
jne 0x55f52c
cmp ax, bx
jne 0x55f52c
lea eax, [edi + 4]
push ebx
push eax
call fcn.004e115a
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x55f535
lea eax, [edi + 2]
push ebx
push eax
call fcn.004e115a
pop ecx
pop ecx
mov edi, eax
test edi, edi
je 0x55f535
xor eax, eax
mov word [edi], ax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x55f552
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
test edi, edi
je 0x55f55d
mov word [edi], bx
test eax, eax
jne 0x55f51e
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
pop ebx
and eax, 0x10
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x55f56f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test ecx, ecx
je 0x55f58c
cmp word [ecx], 0
je 0x55f58c
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x55f58c
shr eax, 4
and eax, 1
ret
xor eax, eax
ret
Function at 0x566c2d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x667710]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov edx, 0x176
push edi
mov dword [ebp - 0x18], esi
mov ecx, dword [esi + 4]
call fcn.005672b0
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x8ae
push dword [esi + 4]
call ebx
mov ecx, dword [esi + 0xe0]
neg ecx
sbb ecx, ecx
and ecx, 5
push ecx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, 0x66840c
lea edi, [ebp - 0x14]
sub esp, 0x14
lea eax, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x18]
lea esi, [edi + 4]
push dword [esi]
lea ecx, [edi + 0x60]
call fcn.00433ed0
push 0x8ae
push dword [esi]
call ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.0040390c
cmp dword [edi + 0xe0], 0
push 0x40
pop eax
lea ecx, [eax + 0x40]
cmovne eax, ecx
lea ecx, [edi + 0x64]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
call fcn.00403895
push 0x42a
push dword [esi]
call ebx
push eax
lea ecx, [edi + 0x8c]
call fcn.0042ff9c
push dword [esi]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 1
push 0x658
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.004da623
leave
ret 0x10

Function at 0x566e0e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x566e33
cmp dword [edi + 0xe0], 0
je 0x566e2f
cmp dword [edi + 0xe8], 0
je 0x566e33
xor ebx, ebx
jmp 0x566e36
xor ebx, ebx
inc ebx
push 0x8ac
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
test esi, esi
je 0x566e67
cmp dword [edi + 0xe8], 0
jg 0x566e62
cmp dword [edi + 0xf8], 0
jle 0x566e67
xor esi, esi
inc esi
jmp 0x566e69
xor esi, esi
push 0x8ad
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x8ae
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, ebx
neg ecx
push 5
pop edx
sbb ecx, ecx
and ecx, edx
push ecx
push eax
call esi
push 5
xor eax, eax
test ebx, ebx
pop ecx
cmove eax, ecx
push eax
push dword [edi + 0x64]
call esi
push 1
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebx
pop ebp
ret 4