joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4beb2c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4bebe6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004053a4
mov eax, dword [0x7252c0]
cmp dword [eax], 2
jne 0x4beb9b
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004058f4
mov eax, dword [ebx]
call fcn.0040558c
push eax
mov eax, dword [ebx]
call fcn.0040557c
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.0040558c
mov edx, eax
dec edx
mov eax, ebx
call fcn.004058f4
jmp 0x4bebcd
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040af6c
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.0040556c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bebed
lea eax, [ebp - 0x3f0]
call fcn.00404c88
ret
Function at 0x4c8138
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x4c8148
call sub.user32.dll_FindWindowA
ret
Function at 0x4e4b18
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x4e4b30
mov eax, ebx
call fcn.004e438c
cmp dword [ebx + 0x68], 0
jne 0x4e4b3d
mov eax, ebx
call fcn.004e42e8
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x4e4cf0
cmp dword [ebx + 0x68], 0
je 0x4e4cf0
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.004e4158
lea eax, [esp + 0x14]
xor edx, edx
call fcn.0055035c
cmp eax, dword [esp]
je 0x4e4bbf
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00550370
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4e4b9b
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.0055035c
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4e4bb4
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4e4bd2
mov eax, dword [eax + 0x18]
call fcn.0047cd04
mov esi, eax
jmp 0x4e4bd5
mov esi, dword [ebx + 0x50]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
and eax, 8
cmp eax, 8
jne 0x4e4bea
or esi, 0xffffffff
jmp 0x4e4bf4
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.00475a70
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.00475a94
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.00475abc
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00475ae0
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00407538
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0047cd04
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0047cd04
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0047cd04
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0042f954
call fcn.0042ac50
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0047cd04
push eax
mov eax, dword [0x724a20]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.0047cd04
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e4f34
Capabilities:
Allocate or change rwx memory
Find taskbar
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa0
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.00403734
lea eax, [esp + 0x3c]
push eax
call sub.kernel32.dll_GetSystemInfo
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x4e513d
push 0
push 0x4e5148
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4e513d
push 0
push 0x4e5158
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4e513d
push 0
push 0x4e5168
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4e513d
push 0
push 0x4e5178
push 0
push eax
call sub.user32.dll_FindWindowExA
mov edi, eax
test edi, edi
je 0x4e513d
push 0
push 0
push 0x418
push edi
call sub.user32.dll_SendMessageA
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x4e513d
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push edi
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x4e513d
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x4e513d
push 0x40
push 0x1000
push 0x1000
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x4e513d
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x4e5125
inc ebx
mov eax, dword [esp + 0xc]
push eax
push ebx
push 0x417
push edi
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4e511b
lea eax, [esp + 0x10]
push eax
push 0x18
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
push eax
push esi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4e511b
test byte [esp + 0x21], 0xd
jne 0x4e511b
mov al, byte [esp + 0x20]
and al, 8
cmp al, 8
je 0x4e511b
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x30]
push eax
push esi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4e511b
cmp dword [esp + 0x10], 0
je 0x4e511b
mov eax, dword [0x724f40]
mov eax, dword [eax]
mov ebp, dword [eax + 0x30]
cmp ebp, dword [esp + 0x14]
jne 0x4e511b
mov eax, dword [esp + 0xc]
push eax
push ebx
push 0x41d
push edi
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4e50f7
lea eax, [esp + 0x10]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x18]
push eax
push esi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0x10], 0
je 0x4e5125
lea eax, [esp + 0x2c]
push eax
push edi
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
call fcn.0040757c
jmp 0x4e5125
cmp ebx, dword [esp + 4]
jl 0x4e5047
push 0x8000
push 0
mov eax, dword [esp + 0x14]
push eax
push esi
call sub.kernel32.dll_VirtualFreeEx
push esi
call sub.kernel32.dll_CloseHandle_1
add esp, 0x60
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x50fd88
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.0050fd74
test eax, eax
jne 0x50fda9
mov eax, esi
call fcn.00404c88
jmp 0x50fe3a
mov eax, ebx
call fcn.0050fed0
test al, al
je 0x50fdef
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.00404d78
test edi, edi
je 0x50fde6
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
jmp 0x50fe3a
mov eax, esi
call fcn.00404c88
jmp 0x50fe3a
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x50fe33
mov eax, dword [ebp + 0x208]
call fcn.0041e7f0
test eax, eax
jle 0x50fe21
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x208]
mov edx, edi
call fcn.0044ba78
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.00404cdc
jmp 0x50fe3a
mov eax, esi
mov edx, dword [ebx + 0x78]
mov edx, dword [edx + 0x210]
call fcn.00404cdc
jmp 0x50fe3a
mov eax, esi
call fcn.00404c88
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x511a80
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.0040751c
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret
Function at 0x53ba2c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x53ba9d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x6f17e0]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x53ba87
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0053ba1c
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x53b7f4]
call fcn.0053bac4
mov dword [0x6f1844], eax
mov eax, dword [ebp - 4]
call fcn.0053b9cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53baa4
lea eax, [ebp - 8]
call fcn.00406d08
ret

Function at 0x53bc9f
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffea0
mov eax, esp
xor ecx, ecx
mov edx, 0x160
call fcn.00403734
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x53bd14
call sub.shell32.dll_SHGetFileInfoA
mov dword [0x6f17d8], eax
cmp dword [0x6f17d8], 0
je 0x53bd0c
cmp dword [0x6f17dc], 0
jne 0x53bd0c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4ad1a8]
call fcn.004ad9c0
mov dword [0x6f17dc], eax
mov edx, dword [0x6f17d8]
mov eax, dword [0x6f17dc]
call fcn.0048a5c4
mov eax, dword [0x6f17dc]
mov byte [eax + 0x42], 1
mov dl, 1
mov eax, dword [0x6f17dc]
call fcn.004af2e8
push 0xffffffffffffffff
mov eax, dword [0x6f17dc]
call fcn.0048a600
push eax
call sub.comctl32.dll_ImageList_SetBkColor
add esp, 0x160
ret

Function at 0x546178
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x214], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x546244
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404c88
xor eax, eax
push ebp
push 0x546216
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push esi
lea eax, [ebp - 0x20a]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
jne 0x5461d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x546220
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00405550
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call fcn.005460a0
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.0040ef34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x546220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54624b
lea eax, [ebp - 0x214]
call fcn.004053a4
lea eax, [ebp - 0x210]
call fcn.00404c88
ret

Function at 0x546254
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5462ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, 5
call fcn.00546178
mov eax, dword [ebx]
call fcn.00404f58
cmp eax, 2
jge 0x5462a4
lea eax, [ebp - 4]
push eax
mov ecx, 0x5462d0
mov edx, 0x5462e4
mov eax, 0x80000001
call fcn.00545f7c
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.0040ef34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5462c1
lea eax, [ebp - 4]
call fcn.00404c88
ret
Function at 0x546328
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x54638e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, 0x1a
call fcn.00546178
mov eax, dword [ebx]
call fcn.00404f58
cmp eax, 2
jge 0x546378
lea eax, [ebp - 4]
push eax
mov ecx, 0x5463a4
mov edx, 0x5463b4
mov eax, 0x80000001
call fcn.00545f7c
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.0040ef34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x546395
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x5463f8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5464e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404c88
xor eax, eax
push ebp
push 0x54647c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x5464fc
mov edx, 0x546514
mov eax, 0x80000001
call fcn.00545f7c
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call fcn.0040556c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.005460a0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040ef34
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00404cdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x546486
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404f58
cmp eax, 2
jge 0x5464b8
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x5464fc
mov edx, 0x546514
mov eax, 0x80000001
call fcn.00545f7c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0040ef34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5464ea
lea eax, [ebp - 0x14]
call fcn.00404c88
lea eax, [ebp - 0x10]
call fcn.004053a4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404cac
ret

Function at 0x546558
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5465bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
xor eax, eax
call fcn.00546178
mov eax, dword [ebx]
call fcn.00404f58
cmp eax, 2
jge 0x5465a5
lea eax, [ebp - 4]
push eax
mov ecx, 0x5465d0
mov edx, 0x5465e0
mov eax, 0x80000001
call fcn.00545f7c
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.0040ef34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5465c2
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x546878
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov eax, 0x105
push esp
push eax
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404f08
mov eax, dword [ebx]
call fcn.00404f58
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x5468b7
mov eax, ebx
mov edx, 0x5468c8
call fcn.00404f60
add esp, 0x108
pop ebx
ret
Function at 0x5480f8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x548101
mov eax, dword [ebp - 4]
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405148
mov eax, dword [ebp - 8]
call fcn.00405148
xor eax, eax
push ebp
push 0x54823b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
push ebp
push 0x548216
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404f58
cmp eax, 4
jl 0x548164
mov eax, dword [ebp - 8]
call fcn.00404f58
cmp eax, 4
jge 0x548171
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x548220
mov eax, dword [ebp - 4]
call fcn.0040a6f4
test al, al
jne 0x54818a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x548220
lea eax, [ebp - 0x27]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403734
lea eax, [ebp - 0x1028]
xor ecx, ecx
mov edx, 0x1001
call fcn.00403734
lea eax, [ebp - 0x1028]
mov edx, dword [ebp - 4]
call fcn.0040adfc
lea eax, [ebp - 0x2029]
xor ecx, ecx
mov edx, 0x1001
call fcn.00403734
lea eax, [ebp - 0x2029]
mov edx, dword [ebp - 8]
call fcn.0040adfc
xor eax, eax
mov dword [ebp - 0x27], eax
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x1f], eax
lea eax, [ebp - 0x2029]
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x23], 2
mov word [ebp - 0x17], 0x414
lea eax, [ebp - 0x27]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x548220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x548242
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cac
ret

Function at 0x550cf4
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.0040a6f4
test al, al
je 0x550d7b
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00403734
or esi, 0x100
test esi, esi
jns 0x550d2f
call fcn.00403db4
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00405158
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x550d7b
mov dl, 1
mov eax, dword [0x4288d0]
call fcn.00431084
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00431490
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x550d7b
mov eax, esp
call fcn.0040fee4
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x5597f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405148
mov eax, dword [ebp - 8]
call fcn.00405148
mov eax, dword [ebp + 8]
call fcn.00405148
lea esi, [ebp - 0x48]
xor eax, eax
push ebp
push 0x5599be
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x559984
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor ecx, ecx
mov edx, 0x3c
call fcn.00403734
mov dword [esi], 0x3c
mov dword [esi + 4], 0x440
mov eax, dword [0x724f40]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
call fcn.00405158
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.00405158
mov dword [esi + 0x14], eax
cmp dword [ebp + 8], 0
je 0x55989c
mov eax, dword [ebp + 8]
call fcn.00405158
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
push esi
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x55991b
cmp dword [esi + 0x20], 0x20
jbe 0x55991b
xor ebx, ebx
jmp 0x5598c0
inc ebx
mov eax, dword [0x724f40]
mov eax, dword [eax]
call fcn.0046f1bc
cmp ebx, 0xa0
jge 0x5598da
push 0x24
mov eax, dword [esi + 0x38]
push eax
call sub.user32.dll_WaitForInputIdle
cmp eax, 0x102
je 0x5598b3
mov ebx, dword [esi + 0x38]
test ebx, ebx
jbe 0x559905
push ebx
call sub.kernel32.dll_GetProcessId
mov edx, dword [0x7270e0]
mov dword [edx + 0x32c], eax
mov dword [ebp - 0xc], 1
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x55997a
mov eax, dword [0x7270e0]
xor edx, edx
mov dword [eax + 0x32c], edx
mov dword [ebp - 0xc], 1
jmp 0x55997a
mov dword [ebp - 0xc], 0xffffffff
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
push 0x41030
push 0x5599dc
push dword [ebp - 4]
push 0x559a2c
push 0x559a38
push 0x559a38
lea edx, [ebp - 0x50]
mov eax, ebx
call fcn.0040daa4
push dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
mov edx, 6
call fcn.00405018
mov eax, dword [ebp - 0x4c]
call fcn.00405158
mov edx, eax
mov ecx, 0x559a3c
mov eax, dword [0x724f40]
mov eax, dword [eax]
call fcn.0046f508
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55998e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5599c5
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.00404cac
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cac
lea eax, [ebp + 8]
call fcn.00404c88
ret
Function at 0x55bc04
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405148
mov eax, dword [ebp - 8]
call fcn.00405148
mov eax, dword [ebp + 8]
call fcn.00405148
lea esi, [ebp - 0x48]
xor eax, eax
push ebp
push 0x55bdca
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x55bd90
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor ecx, ecx
mov edx, 0x3c
call fcn.00403734
mov dword [esi], 0x3c
mov dword [esi + 4], 0x440
mov eax, dword [0x724f40]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
call fcn.00405158
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.00405158
mov dword [esi + 0x14], eax
cmp dword [ebp + 8], 0
je 0x55bca8
mov eax, dword [ebp + 8]
call fcn.00405158
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
push esi
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x55bd27
cmp dword [esi + 0x20], 0x20
jbe 0x55bd27
xor ebx, ebx
jmp 0x55bccc
inc ebx
mov eax, dword [0x724f40]
mov eax, dword [eax]
call fcn.0046f1bc
cmp ebx, 0xa0
jge 0x55bce6
push 0x24
mov eax, dword [esi + 0x38]
push eax
call sub.user32.dll_WaitForInputIdle
cmp eax, 0x102
je 0x55bcbf
mov ebx, dword [esi + 0x38]
test ebx, ebx
jbe 0x55bd11
push ebx
call sub.kernel32.dll_GetProcessId_1
mov edx, dword [0x727134]
mov dword [edx + 0x35c], eax
mov dword [ebp - 0xc], 1
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x55bd86
mov eax, dword [0x727134]
xor edx, edx
mov dword [eax + 0x35c], edx
mov dword [ebp - 0xc], 1
jmp 0x55bd86
mov dword [ebp - 0xc], 0xffffffff
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
push 0x41030
push 0x55bde8
push dword [ebp - 4]
push 0x55be38
push 0x55be44
push 0x55be44
lea edx, [ebp - 0x50]
mov eax, ebx
call fcn.0040daa4
push dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
mov edx, 6
call fcn.00405018
mov eax, dword [ebp - 0x4c]
call fcn.00405158
mov edx, eax
mov ecx, 0x55be48
mov eax, dword [0x724f40]
mov eax, dword [eax]
call fcn.0046f508
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55bd9a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55bdd1
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.00404cac
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cac
lea eax, [ebp + 8]
call fcn.00404c88
ret
Function at 0x55c744
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405148
mov eax, dword [ebp - 8]
call fcn.00405148
xor eax, eax
push ebp
push 0x55c7d3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x55c7ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040a6f4
test al, al
je 0x55c7a4
push 0
mov eax, dword [ebp - 8]
call fcn.00405158
push eax
mov eax, dword [ebp - 4]
call fcn.00405158
push eax
call sub.kernel32.dll_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55c7b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c7da
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cac
ret