joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56d0e8
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x56d104
cmp dword [esi + 4], 0
je 0x56d131
test byte [ebx + 0x55], 1
jne 0x56d123
mov eax, ebx
call fcn.0056bc88
test eax, eax
jne 0x56d123
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x56d241
mov edx, esi
mov eax, ebx
call fcn.0056cc0c
jmp 0x56d241
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x56d23a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0056ef90
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00569810
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0056d0e8
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0056ef90
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56d241
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5739b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x64a51c]
cmp byte [eax + 0xc], 0
je 0x573b1d
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x573b16
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x64ddc8], 0
jne 0x573a04
push 0x573b24
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x573b2c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x64ddc8], eax
cmp dword [0x6477b0], 0
jne 0x573aff
push 0x573b3c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x6477b0], eax
cmp dword [0x6477b0], 0
je 0x573aff
push 0x573b48
mov eax, dword [0x6477b0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x64ddcc], eax
push 0x573b58
mov eax, dword [0x6477b0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x64ddd0], eax
push 0x573b6c
mov eax, dword [0x6477b0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x64ddd4], eax
push 0x573b84
mov eax, dword [0x6477b0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x64ddd8], eax
push 0x573b9c
mov eax, dword [0x6477b0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x64dddc], eax
push 0x573bb0
mov eax, dword [0x6477b0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x64dde0], eax
push 0x573bc8
mov eax, dword [0x6477b0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x64dde4], eax
push 0x573be0
mov eax, dword [0x6477b0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x64dde8], eax
push 0x573bfc
mov eax, dword [0x6477b0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x64ddec], eax
push 0x573c08
mov eax, dword [0x6477b0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x64ddf0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x573b1d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x578658
Capabilities:
Hash data using murmur3

Disassembly:
add esi, 0xd91af1b6
call fcn.005d848d
mov dword [0x64a8f3], edi
call fcn.005ae451
and dword [0x64aa07], edx
call fcn.005ab5c6
neg esi
rol eax, 4
ror ecx, 1
rol ecx, 1
ror eax, 4
neg esi
call fcn.00514584
call fcn.00553e7f
sub esi, 0xd91af1b6
xchg ebx, esi
sub dword [0x64a76c], edx
call fcn.005d5cd2
and dword [0x64a9d2], 0x7d0c5dc4
mov dword [0x64a9b5], edx
xor eax, 0x9e866a52
push eax
not ebx
xor edi, 0x8f58325
add ebx, 0x8a05b194
sub ebx, dword [0x64ac7f]
neg esi
or dword [0x64a717], edi
xchg ecx, esi
call fcn.005c2029
or edx, dword [0x64aba8]
add byte fs:[ecx], dh
add eax, 0x64a66b
Function at 0x5786e4
Capabilities:
Hash data using murmur3

Disassembly:
add byte fs:[ecx], dh
add eax, 0x64a66b
neg eax
or dword [0x64a791], esi
rol edx, 6
call fcn.006197bf
call fcn.005eceb5
ror edx, 6
neg eax
or dword [0x64a86a], ebx
xchg ecx, esi
neg esi
sub ebx, 0x8a05b194
xor edi, 0x8f58325
not ebx
call dword [sym.imp.kernel32.dll_GetProcAddress]
xor dword [0x64a967], edx
add ecx, 0xd6a668ae
inc eax
not eax
call fcn.005b6692
or dword [0x64a6d9], edi
xor eax, 0xca168edb
rol esi, 0xd
call fcn.0051d779
xor edx, ecx
mov dword [0x64a80d], ecx
not eax
xor dword [0x64a73e], eax
xchg edi, edx
xchg edi, edx
not eax
or dword [0x64a9fc], edi
xor edx, ecx
call fcn.0052e050
ror esi, 0xd
xor eax, 0xca168edb
call fcn.005aab89
not eax
dec eax
sub ecx, 0xd6a668ae
xor dword [0x64a653], eax
add esp, 0x10
call fcn.005ff0c6
and dword [0x64a6a8], 0x205e15fb
sub eax, esp
add esi, 0xa9815691
xor dword [0x64aade], ecx
xor esi, dword [0x64ad42]
or edx, dword [0x64ab82]
call fcn.0050e971
rol edi, 0x12
dec ebx
ror eax, 3
add ecx, 0x5def6967
rol ebx, 0x18
call fcn.005af226
ror ebx, 0x18
sub ecx, 0x5def6967
rol eax, 3
inc ebx
ror edi, 0x12
or dword [0x64aad9], edi
sub esi, 0xa9815691
add eax, esp
call fcn.00558cb5
mov edx, 0xd032c8c5
dec ecx
xor edi, dword [0x64acfd]
not edx
sub dword [0x64a85a], eax
xor edx, 0xe53deac2
sub eax, ebx
xor ebx, esi
call fcn.005c3cc2
xor eax, 0x1b0ea44a
ror ebx, 0xb
add edx, 0x16fded50
mov dword [0x64aa34], edi
sub ebx, dword [0x64af08]
rol ebx, 0x15
or edi, dword [0x64ad32]
ror ecx, 0xd
rol ecx, 0xd
ror ebx, 0x15
sub edx, 0x16fded50
rol ebx, 0xb
xor eax, 0x1b0ea44a
call fcn.00516400
xor ebx, esi
add eax, ebx
xor edx, 0xe53deac2
sub dword [0x64a72d], edi
not edx
inc ecx
xor edx, 0x242d74a4
call fcn.00584ba2
rol esi, 0x1c
xor esi, ecx
call fcn.005e0836
ror eax, 6
sub ecx, dword [0x64af3d]
rol ecx, 0x1b
xor eax, edi
rol ebx, 0x19
sub ecx, ebp
add eax, dword [0x64ac37]
and dword [0x64a931], 0x5bce9835
call fcn.00591d03
xor dword [0x64a64c], eax
call fcn.005d0794
call fcn.005b9cc6
and dword [0x64a9be], ecx
sub dword [0x64aa36], 0xb2566b
add ecx, ebp
ror ebx, 0x19
xor eax, edi
ror ecx, 0x1b
rol eax, 6
call fcn.006077e5
xor esi, ecx
ror esi, 0x1c
call fcn.00532fa4
add edx, 0xbe043df
mov dword [0x64a67b], 0x51da53bd
or esi, dword [0x64adf4]
xchg eax, edx
rol edx, 8
or dword [0x64a612], edi
and dword [0x64a795], ecx
add ebx, dword [0x64acb6]
xor esi, ebx
xor edi, dword [0x64abdb]
not esi
xor eax, 0x8b797c6c
dec ecx
xor eax, 0xc92079a2
rol edi, 0xa
sub dword [0x64a977], esi
rol edx, 0x1a
call fcn.0053e2e1
inc edx
xor ebx, eax
call fcn.005be17d
invalid
invalid

Function at 0x580154
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x5801a4]
test si, 4
je 0x580168
or bl, 1
test si, 8
je 0x580172
or bl, 4
test si, 1
je 0x58017c
or bl, 8
test si, 2
je 0x580186
or bl, 0x10
test si, 0x10
je 0x580190
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x58019f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x5801a8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x5801e0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5801c1
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5801d0
or bl, 4
test esi, 0x20000000
je 0x5801db
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x5868a4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5868b6
add esp, 0xfffffff0
call fcn.00503f44
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.005285f4
mov eax, dword [0x649f1c]
mov dword [eax + 4], ebx
mov dword [eax], 0x586c48
mov eax, dword [0x649f30]
mov dword [eax + 4], ebx
mov dword [eax], 0x586c54
mov eax, ebx
call fcn.00586c60
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x51a7ec]
call fcn.00503b9c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x51a7ec]
call fcn.00503b9c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x51a7ec]
call fcn.00503b9c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x51a7ec]
call fcn.00503b9c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x51a7ec]
call fcn.00503b9c
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x583078
push eax
push 0
push 0
mov eax, dword [0x64a198]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x52a0b8]
call fcn.0052b8f0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x52a0b8]
call fcn.0052b8f0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x52a0b8]
call fcn.0052b8f0
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00587164
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x586fe4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x586fe4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x586fe4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5869f3
call fcn.00503f9c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x586dc8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x586f73
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x586f54
mov dl, 1
mov eax, dword [0x51affc]
call fcn.00503b9c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00504b1c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x586f43
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00573d10
test al, al
je 0x586f36
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x586f84
lea eax, [ebp - 0x254]
call fcn.0050b9c0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x586f36
xor eax, eax
push ebp
push 0x586f2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x586fbc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x586f18
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00504d9c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x586f18
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00504d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x586f36
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x586e39
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0051fff4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x586f7a
lea eax, [ebp - 0x260]
call fcn.00504b1c
ret

Function at 0x587904
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x64de14]
cmp byte [eax + 0xa5], 0
jne 0x587975
cmp dword [0x64de2c], 0
jne 0x587936
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x5878c0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x64de2c], eax
cmp dword [0x64de28], 0
jne 0x587951
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x64de28], eax
cmp dword [0x64de30], 0
jne 0x587975
push esp
push 0
push 0
push 0x587864
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x64de30], eax
pop edx
ret
Function at 0x588008
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x64de14]
cmp dword [eax + 0x30], 0
je 0x5880b2
cmp dword [ebx + 0x94], 0
jne 0x5880ac
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x587f98
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x5880ac
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x588072
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5880ac
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0051d434
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x588081
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x588c10
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x588c45
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00504c0c
jmp 0x588c52
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00504b70
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x589e1c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x589e5d
mov eax, esi
call fcn.0056f294
test al, al
je 0x589e5d
mov eax, dword [ebx + 0x84]
call fcn.0056ef90
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x589e5d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0056ef90
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x58ad54
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x519c08]
call fcn.00505690
xor eax, eax
push ebp
push 0x58ae98
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6479e4], 0
jne 0x58ada7
mov ecx, dword [0x649da8]
mov dl, 1
mov eax, dword [0x5098c0]
call fcn.0050e75c
call fcn.00504470
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00503594
mov eax, ebx
call fcn.00505404
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x58aea8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00506a3c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00505414
test eax, eax
jle 0x58ae3f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x58ae38
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00504db4
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00504d9c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0050a7c8
test eax, eax
jne 0x58ae38
mov ebx, 0x15
jmp 0x58ae44
mov ebx, 0x10
jmp 0x58ae44
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x6479e4]
call fcn.0058ac50
mov eax, dword [ebp - 8]
call fcn.0058ac50
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00506a54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58ae9f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00504b40
lea eax, [ebp - 0x10]
mov edx, dword [0x519c08]
call fcn.00505760
ret

Function at 0x58dea8
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, eax
cmp dword [ebx + 0x4c], 0
jne 0x58df05
push 0x4000
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x58df10
call sub.shell32.dll_SHGetFileInfoA
push eax
call sub.comctl32.dll_ImageList_Duplicate
mov esi, eax
mov eax, esi
call fcn.00533ec8
mov eax, ebx
call fcn.0058dc2c
push eax
mov eax, ebx
call fcn.0058dc7c
push eax
push esi
call sub.comctl32.dll_ImageList_SetIconSize
mov eax, dword [ebx + 0x34]
push eax
push esi
call sub.comctl32.dll_ImageList_SetBkColor
mov dword [ebx + 0x4c], esi
add esp, 0x160
pop esi
pop ebx
ret
Function at 0x591e98
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00504fdc
xor eax, eax
push ebp
push 0x591f18
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
mov edx, 0x3c
call fcn.005080dc
mov dword [ebp - 0x40], 0x3c
xor eax, eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, 0x591f24
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
call fcn.00504fec
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 8
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x591f1f
lea eax, [ebp - 4]
call fcn.00504b1c
ret

Function at 0x59246c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x5924ed
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0x5924fc
push 0x5924fc
mov eax, ebx
call fcn.00504fec
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta bl
mov eax, ebx
xor al, 1
and al, byte [ebp - 1]
je 0x5924d7
push 0
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 8]
call fcn.00592964
mov eax, dword [ebp - 8]
mov cx, word [0x592500]
mov dl, 1
call fcn.00538f50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5924f4
lea eax, [ebp - 8]
call fcn.00504b1c
ret

Function at 0x592534
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffa4
mov ebx, ecx
mov edi, edx
mov esi, eax
lea eax, [esp + 0x4c]
mov edx, 0x10
call fcn.005080dc
lea eax, [esp + 8]
mov edx, 0x44
call fcn.005080dc
mov dword [esp + 8], 0x44
mov dword [esp + 0x34], 1
mov word [esp + 0x38], bx
mov ebx, 0x30
test esi, esi
jne 0x592581
xor eax, eax
mov dword [esp], eax
jmp 0x59258b
mov eax, esi
call fcn.00504fec
mov dword [esp], eax
test edi, edi
jne 0x592597
xor eax, eax
mov dword [esp + 4], eax
jmp 0x5925a2
mov eax, edi
call fcn.00504fec
mov dword [esp + 4], eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push ebx
push 0
push 0
push 0
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push eax
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x5925f2
push 0xffffffffffffffff
mov eax, dword [esp + 0x50]
push eax
call sub.user32.dll_WaitForInputIdle
mov eax, dword [esp + 0x50]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp + 0x4c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, ebx
add esp, 0x5c
pop edi
pop esi
pop ebx
ret
Function at 0x592718
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x5927bc
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x592775
dec ecx
jne 0x5927b7
cmp eax, 4
jg 0x592751
mov eax, 4
jmp 0x5927bf
cmp eax, 5
jne 0x592761
test edx, edx
jne 0x592761
mov eax, 5
jmp 0x5927bf
cmp eax, 5
jne 0x592770
dec edx
jne 0x592770
mov eax, 6
jmp 0x5927bf
or eax, 0xffffffff
jmp 0x5927bf
cmp eax, 4
jne 0x592782
test edx, edx
jne 0x592782
xor eax, eax
jmp 0x5927bf
cmp eax, 4
jne 0x5927a1
cmp edx, 0xa
jne 0x5927a1
cmp byte [esp + 0x15], 0x41
jne 0x59279a
mov eax, 2
jmp 0x5927bf
mov eax, 1
jmp 0x5927bf
cmp eax, 4
jne 0x5927b2
cmp edx, 0x5a
jne 0x5927b2
mov eax, 3
jmp 0x5927bf
or eax, 0xffffffff
jmp 0x5927bf
or eax, 0xffffffff
jmp 0x5927bf
or eax, 0xffffffff
add esp, 0x94
ret

Function at 0x592804
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5928e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00504b1c
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00504bb4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00504fec
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x5928cf
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5928c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00502e10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x5928f4
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5928af
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0050aa78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5928cf
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00502e40
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5928ec
lea eax, [ebp - 0x14]
call fcn.00504b1c
ret

Function at 0x592a38
Capabilities:
Terminate process

Disassembly:
push ebx
add esp, 0xfffffff4
mov ebx, eax
mov byte [esp], 0
lea eax, [esp + 8]
push eax
push 0x1388
push 2
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageTimeoutA
push ebx
call sub.user32.dll_IsWindow
test eax, eax
je 0x592aa4
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 4], 0
je 0x592aa4
mov eax, dword [esp + 4]
push eax
push 0
push 0x401
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x592aa4
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp], al
push ebx
call sub.kernel32.dll_CloseHandle
mov al, byte [esp]
add esp, 0xc
pop ebx
ret