joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54b9a4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x54bb03
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x5ec2c8], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x4b8238]
call fcn.004b9270
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x54bad9
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004b931c
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.00407da4
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x54bb1c
call fcn.00407f54
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004b9380
test al, al
je 0x54bac3
lea ecx, [ebp - 4]
mov edx, 0x54bb90
mov eax, dword [ebp - 0xc]
call fcn.004b978c
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00426210
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x54bac3
xor edx, edx
push ebp
push 0x54babc
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x54bba8
mov eax, dword [ebp - 8]
push eax
call fcn.0040d814
test eax, eax
je 0x54baa5
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x54baa5
call fcn.0054b930
test eax, eax
je 0x54ba95
mov eax, dword [ebx + 0x50]
jmp 0x54ba98
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x5ec2c8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54bac3
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54bae0
mov eax, dword [ebp - 0xc]
call fcn.004052d4
ret

Function at 0x54bc0c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x54bc53
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x54bc36
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x54bc47
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x54bc53
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x5560c4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x5560eb
test edi, 0x40000
je 0x556105
test bl, bl
jne 0x556194
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x556194
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x556138
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x556154
mov eax, esi
mov edx, 0xffffffec
mov ecx, 0x40000
or ecx, edi
push ecx
push edx
push eax
call sub.user32.dll_SetWindowLongW
jmp 0x55616a
mov eax, esi
mov edx, 0xffffffec
mov ecx, 0xfffbffff
and ecx, edi
push ecx
push edx
push eax
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x55617b
cmp byte [esp + 2], 0
je 0x556194
cmp byte [esp + 2], 0
je 0x55618c
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x556194
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x556444
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x55646a
mov eax, esp
push eax
push 0x55640c
call sub.user32.dll_EnumWindows
jmp 0x55647d
mov eax, esp
push eax
push 0x5563ec
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x556540
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x556590]
test bl, 4
je 0x556554
or si, 1
test bl, 8
je 0x55655d
or si, 4
test bl, 1
je 0x556566
or si, 8
test bl, 2
je 0x55656f
or si, 0x10
test bl, 0x10
je 0x556578
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x556588
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x556594
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x5565d0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5565af
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5565bf
or bx, 4
test esi, 0x20000000
je 0x5565cb
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x556624
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.005565d4
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret
Function at 0x55c96c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, dword [esi + 8]
dec eax
je 0x55c982
sub eax, 2
je 0x55c9c8
jmp 0x55ca0a
mov eax, ebx
call fcn.004edafc
call fcn.00556038
test eax, eax
je 0x55c99b
mov byte [ebx + 0x2b3], 2
jmp 0x55c9bc
mov eax, ebx
call fcn.004edafc
push eax
call sub.user32.dll_IsZoomed
test eax, eax
je 0x55c9b5
mov byte [ebx + 0x2b3], 3
jmp 0x55c9bc
mov byte [ebx + 0x2b3], 1
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
pop esi
pop ebx
ret
cmp byte [ebx + 0x2b3], 0
je 0x55ca13
movzx eax, byte [ebx + 0x2b3]
mov eax, dword [eax*4 + 0x5ec354]
push eax
mov eax, ebx
call fcn.004edafc
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x2b3], 0
mov eax, dword [0x5f3328]
cmp ebx, dword [eax + 0x48]
jne 0x55ca13
mov eax, dword [0x5f3328]
mov byte [eax + 0x38], 0
pop esi
pop ebx
ret
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
pop esi
pop ebx
ret
Function at 0x55ed8c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x55ed9e
add esp, 0xfffffff0
call fcn.00405844
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0049da78
mov eax, dword [0x5ed200]
mov dword [eax + 4], ebx
mov dword [eax], 0x55f1cc
mov eax, dword [0x5ed20c]
mov dword [eax + 4], ebx
mov dword [eax], 0x55f1d8
mov eax, ebx
call fcn.0055f1e4
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x46e170]
call fcn.004052a4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x46e170]
call fcn.004052a4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x46e170]
call fcn.004052a4
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x46e170]
call fcn.004052a4
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x46e170]
call fcn.004052a4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x48], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x60]
push eax
mov eax, 0x55a02c
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x4bc714]
call fcn.004c25e0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4bc714]
call fcn.004c25e0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4bc714]
call fcn.004c25e0
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x4bc714]
call fcn.004c25e0
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4bc714]
call fcn.004c25e0
mov dword [ebx + 0x90], eax
mov eax, ebx
call fcn.0055f7d4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x55f5f0
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x55f5f0
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x55f5f0
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x55f5f0
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x55f5f0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x55ef1b
call fcn.0040589c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x55f390
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55f53b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x55f51c
mov dl, 1
mov eax, dword [0x471904]
call fcn.004926cc
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.00406e8c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x55f50b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004f3f58
test al, al
je 0x55f4fe
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x55f54c
lea eax, [ebp - 0x394]
call fcn.0041e60c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x55f4fe
xor eax, eax
push ebp
push 0x55f4f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x55f5bc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x55f4e0
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00407da4
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x44]
jne 0x55f4e0
mov eax, dword [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00407da4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55f4fe
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x55f401
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.00492608
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55f542
lea eax, [ebp - 0x3a0]
call fcn.00406e8c
ret

Function at 0x5600f4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5f3328]
cmp byte [eax + 0xb1], 0
jne 0x560166
cmp dword [0x5f3348], 0
jne 0x560126
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x5ec3dc]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5f3348], eax
cmp dword [0x5f3344], 0
jne 0x560141
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x5f3344], eax
cmp dword [0x5f334c], 0
jne 0x560166
push esp
push 0
push 0
mov eax, dword [0x5ec3d8]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x5f334c], eax
pop edx
ret
Function at 0x560430
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x560447
add esp, 0xfffffff0
call fcn.00405844
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0049da78
mov eax, dword [0x5ed0cc]
cmp byte [eax], 0
jne 0x560474
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x184], al
mov eax, dword [0x5ed3c0]
cmp word [eax + 2], 0
jne 0x56048e
mov eax, dword [0x5ed3c0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005625dc
mov eax, dword [0x5ed4e4]
cmp word [eax + 2], 0
jne 0x5604a8
mov eax, dword [0x5ed4e4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005627e0
mov byte [ebx + 0x39], 0
mov dl, 1
mov eax, dword [0x4bc714]
call fcn.004c25e0
mov esi, eax
mov dword [ebx + 0x40], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x562c5c
mov dl, 1
mov eax, dword [0x46e170]
call fcn.004052a4
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x46e170]
call fcn.004052a4
mov dword [ebx + 0xb4], eax
xor eax, eax
mov dword [ebx + 0x64], eax
xor eax, eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x60], 0xff000018
mov dword [ebx + 0x7c], 0x1f4
mov byte [ebx + 0x80], 1
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x78], 0x9c4
mov byte [ebx + 0x8c], 0
mov byte [ebx + 0xa9], 1
mov byte [ebx + 0xc0], 1
mov dl, 1
mov eax, dword [0x4c0eec]
call fcn.004cb3a8
mov esi, eax
mov dword [ebx + 0xa4], esi
push 0x56068c
mov eax, dword [0x5ed290]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004cb7a4
mov eax, dword [ebx + 0xa4]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x562f1c
mov dl, 1
mov eax, dword [0x46e170]
call fcn.004052a4
mov dword [ebx + 0x9c], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5ed290]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0041e358
test eax, eax
je 0x5605bc
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0041e160
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0041e33c
test eax, eax
je 0x5605d4
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x90]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00407da4
push ebx
push 0x561fb8
call fcn.00556524
mov dword [ebx + 0x180], eax
mov byte [ebx + 0xd4], 0
mov eax, dword [0x5ed0cc]
cmp byte [eax], 0
jne 0x560625
mov eax, ebx
call fcn.0056084c
mov byte [ebx + 0x5d], 1
mov byte [ebx + 0x5e], 1
mov byte [ebx + 0x5f], 1
mov byte [ebx + 0xaa], 1
mov byte [ebx + 0xd5], 0
mov byte [ebx + 0xe0], 0
xor eax, eax
mov dword [ebx + 0xd8], eax
mov byte [ebx + 0xd7], 0
xor eax, eax
mov dword [ebx + 0xac], eax
mov eax, ebx
call fcn.00563164
mov eax, ebx
call fcn.00563d90
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x560682
call fcn.0040589c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x560b84
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x560c30
cmp dword [ebx + 0x98], 0
jne 0x560c2a
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x560abc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x560c2a
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x560bf0
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x560c2a
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.0048e844
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x560bff
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x560e50
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5f3328]
cmp dword [eax + 0x178], 0
je 0x560fb5
test bl, bl
jne 0x560f03
cmp dword [esi + 0xa0], 0
jne 0x560ef8
mov eax, esi
call fcn.00563be0
push eax
push 0x560d5c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x560ec9
mov eax, dword [0x5f3328]
cmp byte [eax + 0xd7], 0
je 0x560ec9
mov eax, dword [esi + 0xdc]
call fcn.0040903c
mov edi, eax
cmp edi, 0
jl 0x560ec9
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x560eb2
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x560ef8
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.0048e844
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x560ed8
inc dword [esi + 0xa0]
jmp 0x560fb5
cmp dword [esi + 0xa0], 0
jle 0x560fb5
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x560fb5
cmp dword [esi + 0x48], 0
je 0x560f60
mov eax, dword [0x5f3328]
cmp byte [eax + 0xd7], 0
je 0x560f60
mov eax, dword [esi + 0xdc]
call fcn.0040903c
mov edi, eax
cmp edi, 0
jl 0x560f60
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x560f49
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x560f8f
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.0048e844
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x560f6f
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x552e24]
call fcn.00409250
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x561bd4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb0], 0
je 0x561c31
cmp byte [ebx + 0xd7], 0
jne 0x561c31
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00407014
mov eax, dword [esi]
test eax, eax
je 0x561c1e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x561c3e
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.0040726c
jmp 0x561c3e
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.0040726c
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x56334c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x5633ba
mov eax, esi
call fcn.004edeb0
test al, al
je 0x5633ba
mov eax, dword [ebx + 0x88]
call fcn.004edafc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5633ba
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x110]
test al, al
je 0x5633ae
push 0
mov eax, dword [ebx + 0x88]
call fcn.004edafc
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.004e4b78
jmp 0x5633ba
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.00563184
pop esi
pop ebx
ret
Function at 0x572208
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x572211
mov eax, dword [ebp - 4]
add esp, 0xfffffffc
xor edx, edx
mov dword [ebp - 0x10008], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x572292
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10002]
push eax
push 0x7fff
call sub.kernel32.dll_GetCurrentDirectoryW
mov ecx, eax
lea edx, [ebp - 0x10002]
mov eax, dword [ebp - 4]
call fcn.00407014
lea edx, [ebp - 0x10008]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.005725f8
mov edx, dword [ebp - 0x10008]
mov eax, dword [ebp - 4]
call fcn.0040726c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x572299
lea eax, [ebp - 0x10008]
call fcn.00406e8c
ret

Function at 0x57243c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
xor edx, edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5724b7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20e]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathW
test eax, eax
jbe 0x572499
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.00407da4
mov eax, dword [ebp - 0x214]
mov edx, dword [ebp - 4]
call fcn.005725f8
jmp 0x57249e
call fcn.00425840
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5724be
lea eax, [ebp - 0x214]
call fcn.00406e8c
ret

Function at 0x5724c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
xor ecx, ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x57254e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x212]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00407ce8
push eax
lea eax, [ebp - 0x218]
call fcn.0057243c
mov eax, dword [ebp - 0x218]
call fcn.00407ce8
push eax
call sub.kernel32.dll_GetTempFileNameW
test eax, eax
jbe 0x572530
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00407da4
jmp 0x572535
call fcn.00425840
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x572555
lea eax, [ebp - 0x218]
call fcn.00406e8c
ret

Function at 0x572688
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407ce8
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x572838
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x572905
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp - 4], 0
je 0x5728ef
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5728e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x572894
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x104
jle 0x5728ba
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x572920
call fcn.00407f54
mov eax, dword [ebp - 0x18]
call fcn.00407ce8
mov dword [ebp - 0x10], eax
jmp 0x5728c5
mov eax, dword [ebp - 4]
call fcn.00407ce8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5728ef
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57290c
lea eax, [ebp - 0x18]
call fcn.00406e8c
ret

Function at 0x572958
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5729eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x57298e
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x104
jle 0x5729b4
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x572a08
call fcn.00407f54
mov eax, dword [ebp - 0x18]
call fcn.00407ce8
mov dword [ebp - 0x10], eax
jmp 0x5729bf
mov eax, dword [ebp - 4]
call fcn.00407ce8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFileAttributesW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5729f2
lea eax, [ebp - 0x18]
call fcn.00406e8c
ret