joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ff984
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x3c
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
mov esi, ecx
call fcn.0064f890
add esp, 0xc
mov dword [ebp - 0x58], 0x3c
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
push esi
call fcn.0040d595
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x58]
push ecx
push ebx
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x4ff9ef
mov eax, dword [ebp - 0x4c]
push 3
pop esi
sub eax, esi
je 0x4ffa10
sub eax, 1
je 0x4ffa0b
sub eax, 1
je 0x4ff9f1
mov esi, ebx
lea ecx, [ebp - 0x1c]
call fcn.0040d475
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0064c681
mov esp, ebp
pop ebp
ret
push 2
pop esi
jmp 0x4ff9f1
xor esi, esi
inc esi
jmp 0x4ff9f1

Function at 0x5002a7
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
lea esi, [edi + 0x10]
je 0x5002dd
push esi
push str.Mutex__s_already_created
push 0x64
mov edx, 0x7c1
mov ecx, 0x17d8441
call fcn.004fae82
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x5002e7
mov eax, dword [esi]
push eax
mov eax, dword [ebp + 8]
push 0
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
cmp eax, 0xb7
jne 0x500322
push esi
push str.Got_handle_to_existing_mutex__s
push 0x64
mov edx, 0x7c1
mov ecx, 0x17d8442
call fcn.004fae82
cmp dword [edi + 4], 0
jne 0x5002d3
lea eax, [esp + 0xc]
mov ecx, 0x17d8443
push eax
push esi
push str.Failed_to_create_the_mutex__s:_LastError:_0x_x
push 0x64
call fcn.004fe085
xor al, al
jmp 0x5002d5

Function at 0x5006dc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x20], 0
je 0x500761
cmp dword [esi + 0x10], 0x3fff
jbe 0x500714
push ecx
push ecx
lea ecx, [ebp - 0x398]
call fcn.00500878
jmp 0x500773
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x50071e
mov eax, dword [esi]
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x50074f
lea ecx, [edi + 8]
push ecx
lea ecx, [ebp + 0xc]
push ecx
push esi
push ecx
push eax
push ecx
lea ecx, [ebp - 0x398]
call fcn.0050088d
jmp 0x500773
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0064c681
mov esp, ebp
pop ebp
ret 8
push str.ORegistryKey.SetValue_failure:_Cannot_set_DWORD_value._The_registry_key_is_closed_or_not_set
push 0x3a
lea ecx, [ebp - 0x398]
call fcn.004253fc
push 0x811494
lea eax, [ebp - 0x398]
push eax
call fcn.0064f293
int3
Function at 0x5013b8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x101
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x394], eax
call fcn.00414b29
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x5013eb
mov eax, dword [esi]
lea ecx, [ebp - 0x394]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x50141b
push 0
push dword [ebp - 0x394]
mov ecx, esi
call fcn.00414b29
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0064c681
mov esp, ebp
pop ebp
ret
push str.Failed_to_get_current_computername.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x390]
call fcn.004fac1f
push 0x811494
lea eax, [ebp - 0x390]
push eax
call fcn.0064f293
int3

Function at 0x503044
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a0
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x39c], 0
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [esi + 0x20], 0xffffffff
je 0x5030d1
push 0
lea ecx, [ebp - 0x39c]
push ecx
push dword [ebp + 0xc]
push eax
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5030ba
mov ecx, dword [ebp + 0xc]
call fcn.00414a80
mov dword [ebp - 0x3a0], eax
lea eax, [ebp - 0x39c]
push eax
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x3a0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea ecx, [ebp - 0x398]
call fcn.00503398
jmp 0x5030e3
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x39c]
xor ecx, ebp
pop esi
call fcn.0064c681
mov esp, ebp
pop ebp
ret 0xc
push str.trying_to_read_from_a_file_thats_not_open
push 0x15
lea ecx, [ebp - 0x398]
call fcn.00413a99
push 0x811494
lea eax, [ebp - 0x398]
push eax
call fcn.0064f293
int3

Function at 0x5067b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x20]
mov edx, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x506818
and dword [ebp - 0x394], 0
lea ecx, [ebp - 0x394]
push 0
push ecx
push dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x506808
push str.write_to_file_failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x390]
call fcn.004fde80
jmp 0x506825
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0064c681
mov esp, ebp
pop ebp
ret 8
push ecx
push ecx
lea ecx, [ebp - 0x390]
call fcn.004fbcb0
push 0x811494
lea eax, [ebp - 0x390]
push eax
call fcn.0064f293
int3
Function at 0x5068d1
Capabilities:
Initialize winhttp library

Disassembly:
push 0x3b4
mov eax, 0x6a437e
call fcn.0064d018
mov esi, ecx
mov dword [ebp - 0x3bc], esi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov ebx, dword [ebp + 8]
mov dword [esi], vtable.RefCounted.0
mov dword [ebp - 0x3c0], esi
mov dword [ebp - 0x3b8], edi
mov dword [esi + 4], eax
push ecx
mov dword [ebp - 4], eax
lea ecx, [esi + 0xc]
push eax
mov dword [esi], 0x75d458
mov word [esi + 8], ax
call fcn.004f980d
xor edx, edx
xor eax, eax
push 7
mov dword [esi + 0x38], edx
pop ecx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], ecx
mov word [esi + 0x3c], ax
mov dword [esi + 0x68], ecx
xor ecx, ecx
mov dword [esi + 0x64], edx
mov word [esi + 0x54], cx
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 3
push edi
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edx
call fcn.0040d595
lea edi, [esi + 0x84]
xor ecx, ecx
mov dword [edi + 0xc], ecx
xor eax, eax
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], ecx
mov byte [edi + 0x18], cl
mov dword [edi + 0x1c], 0x5e
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 5
mov dword [esi + 0xa4], ecx
mov dword [esi + 0xa8], ecx
mov dword [esi + 0xb0], ecx
mov dword [esi + 0xb4], ecx
mov dword [esi + 0xb8], 0x57
mov dword [esi + 0xac], ecx
cmp dword [ebx + 0x14], 8
jb 0x5069a3
mov ebx, dword [ebx]
push ecx
push ecx
push ecx
push ecx
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 0xa4], eax
test eax, eax
je 0x5069e4
push dword [ebp - 0x3b8]
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00506b59
push eax
lea ecx, [esi + 0x54]
call fcn.0040d3a8
lea ecx, [ebp - 0x28]
call fcn.0040d475
mov eax, esi
call fcn.0064cfc2
ret 0x14
push str.Failed_to_Open_Win_Http_session
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x79
lea ecx, [ebp - 0x3b4]
call fcn.00414a60
push 0x811494
lea eax, [ebp - 0x3b4]
push eax
call fcn.0064f293
int3
Function at 0x506d8e
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax + 0x10], edi
jne 0x506db6
mov eax, edi
jmp 0x506dbe
cmp dword [eax + 0x14], 8
jb 0x506dbe
mov eax, dword [eax]
lea ecx, [edx + 0x54]
cmp dword [ecx + 0x14], 8
jb 0x506dc9
mov ecx, dword [ecx]
push edi
push edi
push edi
push edi
push ecx
push eax
push dword [edx + 0xa8]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
cmp dword [esi], edi
je 0x506de8
call fcn.0050686e
mov eax, dword [esi]
jmp 0x506dea
mov dword [esi], eax
test eax, eax
jne 0x506df7
call fcn.00506837
test eax, eax
je 0x506e52
mov eax, dword [esi]
mov dword [ebp - 0x394], 1
pop edi
pop esi
test eax, eax
jne 0x506e0e
call fcn.00506837
push 4
lea ecx, [ebp - 0x394]
push ecx
push 0x4d
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x506e42
push str.Failed_to_set_the_auto_logon_option
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x8b
lea ecx, [ebp - 0x390]
call fcn.004fac1f
jmp 0x506e6b
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0064c681
mov esp, ebp
pop ebp
ret 8
push str.Failed_to_open_get_request_for_given_file
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x7c
lea ecx, [ebp - 0x390]
call fcn.005016d9
push 0x811494
lea eax, [ebp - 0x390]
push eax
call fcn.0064f293
int3
Function at 0x507b14
Capabilities:
Prompt user for credentials

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c8
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x9a8], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x9b4], eax
xor edi, edi
mov eax, dword [ebp + 0x14]
push 0x404
mov dword [ebp - 0x9ac], eax
lea eax, [ebp - 0x60c]
push edi
push eax
mov dword [ebp - 0x99c], edi
mov dword [ebp - 0x9a4], edi
mov dword [ebp - 0x9a0], edi
call fcn.0064f890
push 0x202
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.0064f890
mov dword [ebp - 0x9b0], edi
xor eax, eax
lea edi, [ebp - 0x9c8]
add esp, 0x18
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 0xac]
mov edi, dword [ebp - 0x9a8]
mov dword [ebp - 0x9c4], eax
lea eax, [ebp - 0x9a0]
push eax
lea eax, [ebp - 0x9a4]
mov dword [ebp - 0x9c8], 0x14
push eax
lea eax, [ebp - 0x99c]
push eax
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryAuthSchemes]
test eax, eax
je 0x507d0b
test byte [ebp - 0x99c], 4
jne 0x507bfa
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea ecx, [ebp - 0x998]
call fcn.005017ba
jmp 0x507d27
mov cl, byte [ebp + 0x18]
xor eax, eax
movzx esi, cl
mov edx, 0x52e
add esi, 0x4008a
test cl, cl
cmove edx, eax
mov eax, dword [ebp - 0x9ac]
cmp dword [eax + 0x14], 8
jb 0x507c20
mov eax, dword [eax]
push esi
lea ecx, [ebp - 0x9b0]
xor esi, esi
push ecx
push 0x101
lea ecx, [ebp - 0x208]
push ecx
push 0x202
lea ecx, [ebp - 0x60c]
push ecx
push edx
push esi
push eax
lea eax, [ebp - 0x9c8]
push eax
call dword [sym.imp.credui.dll_CredUIPromptForCredentialsW]
test eax, eax
je 0x507c77
push str.Failed_to_obtain_the_user_credentials
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x8e
lea ecx, [ebp - 0x998]
call fcn.0040e515
jmp 0x507d27
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x60c]
push eax
push 4
push esi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpSetCredentials]
test eax, eax
jne 0x507cb2
push str.Failed_to_Set_the_credentials
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x85
lea ecx, [ebp - 0x998]
call fcn.005080a1
jmp 0x507d27
cmp dword [ebx + 0x14], 8
mov eax, ebx
mov dword [ebx + 0x10], esi
jb 0x507cbf
mov eax, dword [ebx]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x60c]
push eax
mov ecx, ebx
call fcn.0040d32d
mov eax, dword [ebp - 0x9b4]
mov ecx, eax
pop edi
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], esi
pop esi
pop ebx
jb 0x507ce8
mov ecx, dword [eax]
xor edx, edx
mov word [ecx], dx
lea ecx, [ebp - 0x208]
push ecx
mov ecx, eax
call fcn.0040d32d
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0064c681
mov esp, ebp
pop ebp
ret 0x14
push str.Failed_to_get_the_server_authentication_schemes
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x8c
lea ecx, [ebp - 0x998]
call fcn.004fcc97
push 0x811494
lea eax, [ebp - 0x998]
push eax
call fcn.0064f293
int3
Function at 0x509041
Capabilities:
Set registry value

Disassembly:
push 0x3c8
mov eax, 0x6a467b
call fcn.0064d018
mov dword [ebp - 0x3d0], ecx
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x40]
mov edi, dword [ebp + 8]
mov edx, esi
and dword [ebp - 0x3d4], 0
call fcn.004ff259
push eax
lea ecx, [ebp - 0x28]
call fcn.0040d3df
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 2
call fcn.0040d475
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x50908f
mov ecx, dword [esi]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov edx, dword [esi + 0x10]
cmovae eax, dword [ebp - 0x28]
cmp dword [ebp - 0x18], edx
jne 0x5090b7
push dword [ebp - 0x18]
push ecx
push eax
call fcn.0040b7a0
add esp, 0xc
test eax, eax
jne 0x5090b7
xor bl, bl
jmp 0x5090b9
mov bl, 1
mov ecx, dword [ebp - 0x3d0]
cmp dword [ecx + 0x20], 0
je 0x509194
cmp dword [edi + 0x10], 0x3fff
jbe 0x509104
test bl, bl
mov edx, 0x75d7dc
mov eax, str.EXPAND_SZ
cmove eax, edx
mov dword [ebp - 0x3d0], eax
lea eax, [ecx + 8]
push eax
lea eax, [ebp - 0x3d0]
push eax
push ecx
push ecx
lea ecx, [ebp - 0x3cc]
call fcn.005097f6
jmp 0x5091bd
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x509112
mov ecx, 0x75d8bc
jmp 0x50911c
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x50911c
mov ecx, dword [esi]
cmp dword [edi + 0x14], 8
mov edx, edi
jb 0x509126
mov edx, dword [edi]
lea eax, [eax*2 + 2]
push eax
push ecx
movzx eax, bl
inc eax
push eax
mov eax, dword [ebp - 0x3d0]
push 0
push edx
push dword [eax + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, eax
test edx, edx
je 0x509184
test bl, bl
mov eax, 0x75d7dc
mov ecx, str.EXPAND_SZ
cmove ecx, eax
mov eax, dword [ebp - 0x3d0]
add eax, 8
mov dword [ebp - 0x3d4], ecx
push eax
push esi
push edi
lea eax, [ebp - 0x3d4]
push eax
push ecx
push edx
push ecx
lea ecx, [ebp - 0x3cc]
call fcn.00509815
jmp 0x5091bd
lea ecx, [ebp - 0x28]
call fcn.0040d475
call fcn.0064cfc2
ret 0xc
mov ecx, 0x75d7dc
test bl, bl
mov eax, str.EXPAND_SZ
cmove eax, ecx
mov dword [ebp - 0x3d0], eax
lea eax, [ebp - 0x3d0]
push eax
push ecx
push ecx
lea ecx, [ebp - 0x3cc]
call fcn.005097da
push 0x811494
lea eax, [ebp - 0x3cc]
push eax
call fcn.0064f293
int3
Function at 0x50b50d
Capabilities:
Create process on windows

Disassembly:
push 0x7c4
mov eax, 0x6a4915
call fcn.0064d018
mov eax, ecx
mov dword [ebp - 0x774], eax
cmp dword [eax + 4], 0xffffffff
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x77c], esi
je 0x50b545
push 0
call fcn.0050b752
test al, al
je 0x50b6e3
and dword [ebp - 0x18], 0
xor eax, eax
push 7
pop edx
mov dword [ebp - 0x14], edx
mov word [ebp - 0x28], ax
and dword [ebp - 4], eax
cmp dword [esi + 0x10], eax
je 0x50b5c0
cmp dword [ebx + 0x10], eax
je 0x50b5cf
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x50b56c
mov eax, dword [ebx]
push 0x20
pop ecx
cmp cx, word [eax]
je 0x50b5c0
and dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], edx
mov word [ebp - 0x40], ax
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.004fbfe1
push ebx
lea eax, [ebp - 0x40]
mov edx, 0x75e378
push eax
lea ecx, [ebp - 0x58]
call fcn.00501719
push eax
lea ecx, [ebp - 0x28]
call fcn.0040d3a8
lea ecx, [ebp - 0x58]
call fcn.0040d475
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.0040d475
jmp 0x50b5cf
cmp dword [ebx + 0x10], 0
je 0x50b5cf
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040d37a
push 0x44
pop edi
push edi
lea eax, [ebp - 0x7d0]
push 0
push eax
call fcn.0064f890
mov dword [ebp - 0x7d0], edi
xor eax, eax
lea edi, [ebp - 0x78c]
xor edx, edx
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x774]
cmp dword [edi + 0x1c], edx
jne 0x50b607
mov eax, edx
jmp 0x50b612
lea eax, [edi + 0xc]
cmp dword [eax + 0x14], 8
jb 0x50b612
mov eax, dword [eax]
cmp dword [ebp - 0x18], edx
jne 0x50b61f
mov dword [ebp - 0x774], edx
jmp 0x50b630
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
mov dword [ebp - 0x774], ecx
cmp dword [esi + 0x10], edx
jne 0x50b639
mov esi, edx
jmp 0x50b64f
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x778], esi
jb 0x50b649
mov esi, dword [esi]
jmp 0x50b64f
mov esi, dword [ebp - 0x778]
lea ecx, [ebp - 0x78c]
push ecx
lea ecx, [ebp - 0x7d0]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
or eax, 0x8000000
push eax
push 0
push 0
push 0
push dword [ebp - 0x774]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x50b6b5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push ebx
push dword [ebp - 0x77c]
push ecx
call esi
push eax
push ecx
lea ecx, [ebp - 0x770]
call fcn.0050a6df
push 0x811494
lea eax, [ebp - 0x770]
jmp 0x50b700
mov eax, dword [ebp - 0x78c]
push dword [ebp - 0x788]
mov dword [edi + 4], eax
mov dword [edi + 8], 0x103
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x28]
call fcn.0040d475
xor eax, eax
call fcn.0064cfc2
ret 0x14
push str.Attempting_to_start_a_new_process_when_the_process_has_already_been_started
push 0x43
lea ecx, [ebp - 0x3e4]
call fcn.0050bf72
push 0x811494
lea eax, [ebp - 0x3e4]
push eax
call fcn.0064f293
int3
Function at 0x50ba47
Capabilities:
Enumerate gui resources

Disassembly:
push 0x3a8
mov eax, 0x6a499e
call fcn.0064d018
mov ebx, edx
xor eax, eax
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 4], eax
cmp dword [ebx + 0x14], 8
mov dword [ebx + 0x10], eax
mov eax, ebx
jb 0x50ba7c
mov eax, dword [ebx]
xor edx, edx
mov dword [ebp - 0x3ac], ecx
mov word [eax], dx
lea eax, [ebp - 0x3a8]
mov dword [ebp - 0x3b0], eax
lea eax, [ebp - 0x3b4]
push eax
push 0x50ba15
mov dword [ebp - 0x3b4], ecx
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x50babd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x50bb59
mov esi, dword [ebp - 0x3a8]
cmp esi, dword [ebp - 0x3a4]
je 0x50bb27
push 3
push dword [esi]
call dword [sym.imp.USER32.dll_GetAncestor]
mov edi, eax
test edi, edi
jne 0x50bafd
push 2
push dword [esi]
call dword [sym.imp.USER32.dll_GetAncestor]
mov edi, eax
test edi, edi
jne 0x50bafd
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_GetAncestor]
mov edi, eax
test edi, edi
jne 0x50bafd
mov edi, dword [esi]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x50bb16
mov edx, ebx
mov ecx, edi
call fcn.0050bb85
cmp dword [ebx + 0x10], 0
ja 0x50bb21
add esi, 4
cmp esi, dword [ebp - 0x3a4]
jne 0x50bacb
mov esi, dword [ebp - 0x3a8]
test esi, esi
je 0x50bb53
mov eax, dword [ebp - 0x3a0]
mov ecx, esi
sub eax, ecx
and eax, 0xfffffffc
cmp eax, 0x1000
jb 0x50bb4c
mov esi, dword [esi - 4]
sub ecx, esi
lea eax, [ecx - 4]
cmp eax, 0x1f
ja 0x50bb7f
push esi
call fcn.0064e37d
pop ecx
call fcn.0064cfc2
ret
lea ecx, [ebp - 0x3ac]
push ecx
push ecx
push eax
push ecx
lea ecx, [ebp - 0x39c]
call fcn.0050bfd0
push 0x811494
lea eax, [ebp - 0x39c]
push eax
call fcn.0064f293
call fcn.00670791
int3

Function at 0x50bb85
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
push edi
mov edi, ecx
mov eax, esi
mov dword [ebp - 0x394], edi
and dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x50bbb2
mov eax, dword [esi]
xor ecx, ecx
push ecx
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jne 0x50bbd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x50bc27
jmp 0x50bc17
jle 0x50bc17
push 0
push eax
mov ecx, esi
call fcn.00414b29
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x50bbec
mov esi, dword [esi]
inc eax
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x50bc17
lea eax, [ebp - 0x394]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea ecx, [ebp - 0x390]
call fcn.0050c00e
jmp 0x50bc3c
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0064c681
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x394]
push ecx
push ecx
push eax
push ecx
lea ecx, [ebp - 0x390]
call fcn.0050bfef
push 0x811494
lea eax, [ebp - 0x390]
push eax
call fcn.0064f293
int3
Function at 0x50bdea
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3d0
mov eax, dword [0x816078]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [ebp - 0x394], al
push edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 4], 0xffffffff
je 0x50be26
push 0
call fcn.0050b752
test al, al
je 0x50bf0b
lea eax, [ebp - 0x394]
push eax
push edi
push ebx
push ecx
push ecx
call fcn.0050c069
push 0x3c
lea eax, [ebp - 0x3d0]
push 0
push eax
call fcn.0064f890
and dword [ebp - 0x3c8], 0
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x3d0], 0x3c
cmp byte [ebp - 0x394], cl
mov eax, str.runas
cmove eax, ecx
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0x3c4], eax
mov eax, ebx
jb 0x50be7a
mov eax, dword [ebx]
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x3c0], eax
mov eax, edi
jb 0x50be8a
mov eax, dword [edi]
xor ecx, ecx
mov dword [ebp - 0x3bc], eax
inc ecx
mov dword [ebp - 0x3cc], 0x340
cmp byte [ebp + 0x18], 0
mov eax, 0x8000000
cmovne eax, ecx
mov dword [ebp - 0x3b4], eax
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x50bee6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 8], eax
cmp eax, 0x4c7
jne 0x50bed4
xor al, al
jmp 0x50bef8
push edi
push ebx
push ecx
push eax
push ecx
lea ecx, [ebp - 0x390]
call fcn.0050c17f
jmp 0x50bf1d
mov ecx, dword [ebp - 0x398]
mov al, 1
mov dword [esi + 4], ecx
mov dword [esi + 8], 0x103
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0064c681
mov esp, ebp
pop ebp
ret 0x14
push str.Attempting_to_start_a_new_process_when_the_process_has_already_been_started
push 0x43
lea ecx, [ebp - 0x390]
call fcn.0050bf72
push 0x811494
lea eax, [ebp - 0x390]
push eax
call fcn.0064f293
int3

Function at 0x50cb06
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3a4
mov eax, dword [0x816078]
xor eax, esp
mov dword [esp + 0x3a0], eax
push esi
mov esi, ecx
xor ecx, ecx
mov dword [esp + 8], ecx
mov eax, esi
mov dword [esp + 0xc], ecx
cmp dword [esi + 0x14], 8
jb 0x50cb37
mov eax, dword [esi]
push ecx
push ecx
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x50cb64
mov ecx, dword [esp + 0x3a4]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop esi
xor ecx, esp
call fcn.0064c681
mov esp, ebp
pop ebp
ret
push esi
push str.Failed_to_check_free_space_in_drive___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.004fcb0f
push 0x811494
lea eax, [esp + 0x14]
push eax
call fcn.0064f293
int3