joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bb804
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x5bb825
test edi, 0x40000
je 0x5bb83f
test bl, bl
jne 0x5bb8c0
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x5bb8c0
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x5bb872
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x5bb887
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x5bb896
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x5bb8a7
cmp byte [esp + 2], 0
je 0x5bb8c0
cmp byte [esp + 2], 0
je 0x5bb8b8
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x5bb8c0
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5bbb68
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x5bbb8e
mov eax, esp
push eax
push 0x5bbb30
call sub.user32.dll_EnumWindows
jmp 0x5bbba1
mov eax, esp
push eax
push 0x5bbb10
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x5bbc64
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x5bbcb4]
test bl, 4
je 0x5bbc78
or si, 1
test bl, 8
je 0x5bbc81
or si, 4
test bl, 1
je 0x5bbc8a
or si, 8
test bl, 2
je 0x5bbc93
or si, 0x10
test bl, 0x10
je 0x5bbc9c
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5bbcac
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x5bbcb8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x5bbcf4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5bbcd3
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5bbce3
or bx, 4
test esi, 0x20000000
je 0x5bbcef
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x5c4f60
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5c4f72
add esp, 0xfffffff0
call fcn.00408de4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c0114
mov eax, dword [0x5e0b9c]
mov dword [eax + 4], ebx
mov dword [eax], 0x5c5428
mov eax, dword [0x5e0bac]
mov dword [eax + 4], ebx
mov dword [eax], 0x5c5434
mov eax, ebx
call fcn.005c5440
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x488974]
call fcn.0040872c
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x488974]
call fcn.0040872c
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x488974]
call fcn.0040872c
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x488974]
call fcn.0040872c
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x488974]
call fcn.0040872c
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5bfa30
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x4f56b0]
call fcn.004fb814
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4f56b0]
call fcn.004fb814
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4f56b0]
call fcn.004fb814
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4f56b0]
call fcn.004fb814
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x4f56b0]
call fcn.004fb814
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.005c5a1c
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c584c
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c584c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c584c
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c584c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c584c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c50f2
call fcn.00408e3c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5c55ec
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c5797
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5c5778
mov dl, 1
mov eax, dword [0x48c2f4]
call fcn.004af854
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.0040a52c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5c5767
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0052e0b4
test al, al
je 0x5c575a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5c57a8
lea eax, [ebp - 0x394]
call fcn.00424fdc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5c575a
xor eax, eax
push ebp
push 0x5c5753
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5c5818
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5c573c
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040b0dc
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5c573c
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040b0dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c575a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5c565d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004af778
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c579e
lea eax, [ebp - 0x3a0]
call fcn.0040a52c
ret

Function at 0x5c6350
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5e80b8]
cmp byte [eax + 0xc5], 0
jne 0x5c63c2
cmp dword [0x5e80dc], 0
jne 0x5c6382
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x5e09dc]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5e80dc], eax
cmp dword [0x5e80d8], 0
jne 0x5c639d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x5e80d8], eax
cmp dword [0x5e80e0], 0
jne 0x5c63c2
push esp
push 0
push 0
mov eax, dword [0x5e09d8]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x5e80e0], eax
pop edx
ret
Function at 0x5c67e4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5c67fb
add esp, 0xfffffff0
call fcn.00408de4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c0114
mov eax, dword [0x5e0a4c]
cmp byte [eax], 0
jne 0x5c6828
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x5e0da4]
cmp word [eax + 2], 0
jne 0x5c6842
mov eax, dword [0x5e0da4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005c8abc
mov eax, dword [0x5e0ed8]
cmp word [eax + 2], 0
jne 0x5c685c
mov eax, dword [0x5e0ed8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005c8cc0
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4f56b0]
call fcn.004fb814
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5c9238
mov dl, 1
mov eax, dword [0x488974]
call fcn.0040872c
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x488974]
call fcn.0040872c
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4fa0d8]
call fcn.00504f34
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5c6a44
mov eax, dword [0x5e0c50]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.005053cc
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5c9520
mov dl, 1
mov eax, dword [0x488974]
call fcn.0040872c
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5e0c50]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00424ddc
test eax, eax
je 0x5c6976
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00424c34
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00424dc0
test eax, eax
je 0x5c698e
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040b0dc
push ebx
push 0x5c8498
call fcn.005bbc48
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x5e0a4c]
cmp byte [eax], 0
jne 0x5c69df
mov eax, ebx
call fcn.005c6c2c
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005c9758
mov eax, ebx
call fcn.005ca3b8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c6a3c
call fcn.00408e3c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c6f70
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5c7012
cmp dword [ebx + 0xac], 0
jne 0x5c700c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5c6eac
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5c700c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5c6fd2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5c700c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004aae14
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5c6fe1
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5c7250
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x5e80b8]
cmp dword [eax + 0x188], 0
je 0x5c73ca
test bl, bl
jne 0x5c7315
cmp dword [esi + 0xb4], 0
jne 0x5c730a
mov eax, esi
call fcn.005ca208
push eax
push 0x5c7144
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5c72db
mov eax, dword [0x5e80b8]
cmp byte [eax + 0xeb], 0
je 0x5c72db
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5c72bc
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c72db
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c72c4
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c730a
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004aae14
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c72ea
inc dword [esi + 0xb4]
jmp 0x5c73ca
cmp dword [esi + 0xb4], 0
jle 0x5c73ca
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5c73ca
cmp dword [esi + 0x58], 0
je 0x5c737f
mov eax, dword [0x5e80b8]
cmp byte [eax + 0xeb], 0
je 0x5c737f
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5c7360
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c737f
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c7368
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c73ae
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004aae14
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c738e
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5b8aa8]
call fcn.0040c950
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5c8024
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5c8081
cmp byte [ebx + 0xeb], 0
jne 0x5c8081
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a6b4
mov eax, dword [esi]
test eax, eax
je 0x5c806e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5c808e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a90c
jmp 0x5c808e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a90c
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5c9940
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5c99b1
mov eax, esi
call fcn.00527c0c
test al, al
je 0x5c99b1
mov eax, dword [ebx + 0x98]
call fcn.00527838
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5c99b1
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x128]
test al, al
je 0x5c99a2
push 0
mov eax, dword [ebx + 0x98]
call fcn.00527838
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.0051e368
jmp 0x5c99b1
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005c9778
pop esi
pop ebx
ret
Function at 0x5ce2a4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5ce31e
mov eax, dword [ebx + 8]
call fcn.00527838
mov ecx, eax
mov dl, 1
mov eax, dword [0x533d8c]
call fcn.00521a14
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.00538a38
mov dword [esi + 0x2c4], ebx
mov dword [esi + 0x2c0], 0x5cdb74
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.00527838
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.00527838
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5ce394
mov eax, dword [ebx + 8]
call fcn.00527838
mov ecx, eax
mov dl, 1
mov eax, dword [0x533d8c]
call fcn.00521a14
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.00538a38
mov dword [esi + 0x2c4], ebx
mov dword [esi + 0x2c0], 0x5cdbc0
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00527838
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.00527838
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5ce400
mov eax, dword [ebx + 8]
call fcn.00527838
mov ecx, eax
mov dl, 1
mov eax, dword [0x53481c]
call fcn.00521a14
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x298], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.00527838
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.00527838
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x5d19d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
xor edx, edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x70], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5d1ad4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00407c54
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00407c54
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a954
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040b038
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x5d1a9c
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x68], 0x11
call sub.kernel32.dll_GetLastError_2
lea ecx, [ebp - 0x70]
xor edx, edx
call fcn.00428760
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0x11
lea edx, [ebp - 0x6c]
mov ecx, 1
mov eax, 0x5d1aec
call fcn.004250ac
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x5e0c1c]
call fcn.004081a8
call fcn.004082a8
call fcn.00407008
jmp 0x5d1aae
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d1adb
lea eax, [ebp - 0x70]
call fcn.0040a52c
lea eax, [ebp - 0x5c]
call fcn.0040a52c
lea eax, [ebp - 4]
call fcn.0040a52c
ret

Function at 0x5d1b38
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5d1bac
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20e]
push eax
push 0
push 0
push 0x24
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, eax
jne 0x5d1b84
lea eax, [ebp - 4]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.0040b0dc
jmp 0x5d1b8c
lea eax, [ebp - 4]
call fcn.0040a52c
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a90c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d1bb3
lea eax, [ebp - 4]
call fcn.0040a52c
ret
Function at 0x10008ee0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
push str.ADVAPI32.dll
mov byte [esp + 0x18], 1
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.OpenProcessToken
push edi
call esi
push str.AdjustTokenPrivileges
push edi
mov ebx, eax
call esi
push str.LookupPrivilegeValueA
push edi
mov dword [esp + 0x24], eax
call esi
push str.kernel32.dll
mov dword [esp + 0x1c], eax
call ebp
push str.GetCurrentProcess
push eax
mov dword [esp + 0x28], eax
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x28
call eax
push eax
call ebx
test eax, eax
jne 0x10008f4e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
neg edx
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 1
sbb edx, edx
push eax
and edx, 2
push ecx
push 0
mov dword [esp + 0x3c], edx
call dword [esp + 0x24]
mov eax, dword [esp + 0x10]
push 0
push 0
lea edx, [esp + 0x2c]
push 0x10
push edx
push 0
push eax
call dword [esp + 0x34]
push str.KERNEL32.dll
call ebp
push str.GetLastError
push eax
call esi
call eax
test eax, eax
je 0x10008fa5
mov byte [esp + 0x14], 0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x10008fbd
push edi
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10008fc8
push eax
call esi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
and eax, 0xff
pop ebx
add esp, 0x24
ret

Function at 0x43b63f
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x43b3c1
dec eax
call fcn.0043b68b
add eax, 0x9c824a20
sub ebx, 0xeda5428e
add ebx, eax
xor dword [ecx], edx
inc eax
and eax, eax
sub esp, 4
mov dword [esp], 0xfb043b31
pop eax
inc ecx
or ebx, ebx
sub esp, 4
mov dword [esp], eax
pop ebx
add eax, ebx
cmp ecx, edi
jne fcn.0043b63f
or eax, ebx
and ebx, ebx
ret
Function at 0x401390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4013eb
cmp byte [esi + ebx - 1], 0xa
je 0x4013bf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x405084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret