joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51c1c4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff828
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x7d8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x51c27e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407420
mov eax, dword [0x5c2df0]
cmp dword [eax], 2
jne 0x51c233
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00407714
mov eax, dword [ebx]
call fcn.004075fc
push eax
mov eax, dword [ebx]
call fcn.004075ec
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.004075fc
mov edx, eax
dec edx
mov eax, ebx
call fcn.00407714
jmp 0x51c265
lea eax, [ebp - 0x7d2]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageW
lea edx, [ebp - 0x7d8]
lea eax, [ebp - 0x7d2]
call fcn.00415454
mov edx, dword [ebp - 0x7d8]
mov eax, ebx
call fcn.00407a44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c285
lea eax, [ebp - 0x7d8]
call fcn.004077b8
ret
Function at 0x53e3a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffa4
mov esi, dword [ebp + 8]
add esi, 0xffffff9c
xor eax, eax
push ebp
push 0x53e560
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045dbc4
mov eax, dword [eax + 0x40]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x78]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x68]
call fcn.004a07c0
call fcn.00539398
mov edx, dword [ebp + 8]
mov dword [edx - 0x6c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x6c], 0
je 0x53e42c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x6c]
mov eax, dword [eax + 0x64]
call fcn.00456a18
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045dbc4
mov eax, dword [eax + 0x40]
pop edx
call fcn.00456a20
mov eax, dword [ebp + 8]
mov dword [eax - 0x70], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.004568a0
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.004151c4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x70]
push eax
push 0x5c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045dbc4
call fcn.0045832c
push eax
call sub.gdi32.dll_GetObjectW
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00456950
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.0045698c
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.0045698c
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.0045698c
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00456a18
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectW
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045dbc4
mov eax, dword [eax + 0x40]
pop edx
call fcn.0045683c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045dbc4
mov eax, dword [eax + 0x40]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x74]
shl edx, 5
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xa4]
mov edx, dword [ecx + edx*8 + 0xac]
call fcn.004565d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53e567
lea eax, [ebp - 4]
call fcn.004077b8
ret
Function at 0x55a3fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x5c8afc
test esi, esi
jne 0x55a416
xor eax, eax
jmp 0x55a507
cmp dword [ebp], 0
jne 0x55a421
call fcn.0055a38c
xor ebx, 0xffffffff
cmp edi, 8
jb 0x55a4e1
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x55a42d
test edi, edi
jbe 0x55a502
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x55a4e5
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x568390
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4d285c]
call fcn.004d8d90
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0xffffff9e
push 0xffffffffffffffec
mov eax, dword [ebp - 8]
call fcn.004bb9cc
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80
or eax, 0x8000000
push eax
push 0xffffffffffffffec
mov eax, dword [ebp - 8]
call fcn.004bb9cc
push eax
call sub.user32.dll_SetWindowLongW
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004d9dcc
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004dacf8
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowRect
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.005830e8
push eax
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.005830fc
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x98]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
call fcn.005334fc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5684d2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.0045dbc4
call fcn.0045832c
push eax
call sub.gdi32.dll_BitBlt
push 0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x30]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.0040b500
lea edx, [ebp - 0x30]
mov cl, 0xff
mov eax, dword [ebp - 0x10]
call fcn.00556320
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5684d9
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ReleaseDC
ret

Function at 0x568558
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x568568
call sub.user32.dll_FindWindowW
ret
Function at 0x581658
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x74], 0
jne 0x581670
mov eax, ebx
call fcn.00580eac
cmp dword [ebx + 0x70], 0
jne 0x58167d
mov eax, ebx
call fcn.00580e08
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x581830
cmp dword [ebx + 0x70], 0
je 0x581830
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov dword [esp], eax
mov eax, dword [ebx + 0x74]
mov edx, dword [eax]
call dword [edx + 0x24]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.00580c6c
lea eax, [esp + 0x14]
xor edx, edx
call fcn.005830e8
cmp eax, dword [esp]
je 0x5816ff
lea eax, [esp + 0x14]
xor edx, edx
call fcn.005830fc
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x5816db
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.005830e8
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x5816f4
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x581712
mov eax, dword [eax + 0x10]
call fcn.004bb9cc
mov esi, eax
jmp 0x581715
mov esi, dword [ebx + 0x58]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
and eax, 8
cmp eax, 8
jne 0x58172a
or esi, 0xffffffff
jmp 0x581734
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x70]
call fcn.004df7a4
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x70]
call fcn.004df7e0
mov edx, dword [esp]
mov eax, dword [ebx + 0x70]
call fcn.004b20c0
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x70]
call fcn.004b20f4
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.0040b530
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x70]
call fcn.004bb9cc
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x70]
call fcn.004bb9cc
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x70]
call fcn.004bb9cc
push eax
call sub.user32.dll_SetWindowLongW
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x74]
call fcn.0045dbc4
call fcn.0045832c
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x70]
call fcn.004bb9cc
push eax
mov eax, dword [0x5c2788]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x70]
call fcn.004bb9cc
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x581a70
Capabilities:
Allocate or change rwx memory
Find taskbar
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa0
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.00404e64
lea eax, [esp + 0x3c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x581ca6
push 0
push 0x581cb0
push 0
push eax
call sub.user32.dll_FindWindowExW
test eax, eax
je 0x581ca6
push 0
push 0x581ccc
push 0
push eax
call sub.user32.dll_FindWindowExW
test eax, eax
je 0x581ca6
push 0
push 0x581ce8
push 0
push eax
call sub.user32.dll_FindWindowExW
test eax, eax
je 0x581ca6
push 0
push 0x581d08
push 0
push eax
call sub.user32.dll_FindWindowExW
mov ebp, eax
test ebp, ebp
je 0x581ca6
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageW
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x581ca6
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x581ca6
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x581ca6
push 0x40
push 0x1000
push 0x1000
push 0
push edi
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x581ca6
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x581c92
inc ebx
push esi
push ebx
push 0x417
push ebp
call sub.user32.dll_SendMessageW
test eax, eax
je 0x581c88
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x20]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x581c88
test byte [esp + 0x21], 0xd
jne 0x581c88
movzx eax, byte [esp + 0x20]
and al, 8
cmp al, 8
je 0x581c88
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x30]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x581c88
cmp dword [esp + 0xc], 0
je 0x581c88
mov eax, dword [0x5c2b78]
mov eax, dword [eax]
cmp byte [eax + 0xd3], 0
je 0x581c25
mov eax, dword [0x5c2b78]
mov eax, dword [eax]
cmp dword [eax + 0x44], 0
je 0x581c25
mov eax, dword [0x5c2b78]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.004bb9cc
mov dword [esp + 0x14], eax
jmp 0x581c36
mov eax, dword [0x5c2b78]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x14]
jne 0x581c88
push esi
push ebx
push 0x41d
push ebp
call sub.user32.dll_SendMessageW
test eax, eax
je 0x581c64
lea eax, [esp + 0xc]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0xc], 0
je 0x581c92
lea eax, [esp + 0x2c]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
call fcn.0040b5ec
jmp 0x581c92
cmp ebx, dword [esp + 4]
jl 0x581b7e
push 0x8000
push 0
push esi
push edi
call sub.kernel32.dll_VirtualFreeEx
push edi
call sub.kernel32.dll_CloseHandle_1
add esp, 0x60
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5836c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x5c2b78]
mov eax, dword [eax]
call fcn.004e3598
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, esi
jb 0x5836d3
pop esi
pop ebx
ret

Function at 0x583c44
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd48
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00414b70
test al, al
je 0x583ccb
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x2b4
call fcn.00404e64
or esi, 0x100
test esi, esi
jns 0x583c7f
call fcn.00405678
push esi
push 0x2b4
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00407854
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x583ccb
mov dl, 1
mov eax, dword [0x4545a8]
call fcn.0045f8bc
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.0045fd50
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x20]
test al, al
je 0x583ccb
mov eax, esp
call fcn.0041b7cc
mov eax, dword [esp]
add esp, 0x2b8
pop esi
pop ebx
ret
Function at 0x5a51c4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.005a51b0
test eax, eax
jne 0x5a51e7
mov eax, esi
xor edx, edx
call fcn.004077c8
jmp 0x5a527c
mov eax, ebx
call fcn.005a5314
test al, al
je 0x5a522f
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageW
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.00407904
test edi, edi
je 0x5a5224
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageW
jmp 0x5a527c
mov eax, esi
xor edx, edx
call fcn.004077c8
jmp 0x5a527c
mov ebp, dword [ebx + 0x70]
test ebp, ebp
je 0x5a5273
mov eax, dword [ebp + 0x270]
call fcn.00436c64
test eax, eax
jle 0x5a5261
mov eax, dword [ebx + 0x70]
mov eax, dword [eax + 0x270]
mov edx, edi
call fcn.0048c340
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.004077c8
jmp 0x5a527c
mov eax, esi
mov edx, dword [ebx + 0x70]
mov edx, dword [edx + 0x278]
call fcn.004077c8
jmp 0x5a527c
mov eax, esi
xor edx, edx
call fcn.004077c8
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5a6f94
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.0040b500
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageW
pop esi
pop ebx
ret
Function at 0x5ab5e4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004077b0
xor eax, eax
push ebp
push 0x5ab765
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.0050c114
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.0050c134
mov ebx, eax
jmp 0x5ab731
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.004079c8
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.00414ea4
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x234]
call fcn.0041375c
mov eax, dword [ebp - 0x234]
push eax
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 4]
call fcn.0041375c
mov edx, dword [ebp - 0x240]
pop eax
call fcn.00407ea0
je 0x5ab708
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.004079c8
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.0041375c
mov eax, dword [ebp - 0x244]
push eax
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 4]
call fcn.0041375c
mov edx, dword [ebp - 0x24c]
pop eax
call fcn.00407ea0
jne 0x5ab722
push 0
mov eax, dword [ebp - 0x228]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.0050c154
mov ebx, eax
test ebx, ebx
jne 0x5ab663
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ab76c
lea eax, [ebp - 0x24c]
mov edx, 7
call fcn.004077c0
lea eax, [ebp - 4]
call fcn.004077b8
ret
Function at 0x5ab778
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff340
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xcc0], ecx
mov dword [ebp - 0xcb4], ecx
mov dword [ebp - 0xcb8], ecx
mov dword [ebp - 0xcbc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004077b0
lea esi, [ebp - 0xc]
xor eax, eax
push ebp
push 0x5ab919
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xcb4]
mov eax, ebx
call fcn.005ab57c
push dword [ebp - 0xcb4]
push 0x5ab934
lea edx, [ebp - 0xcbc]
xor eax, eax
call fcn.004045f4
mov eax, dword [ebp - 0xcbc]
lea edx, [ebp - 0xcb8]
call fcn.00414ea4
push dword [ebp - 0xcb8]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00407d80
mov eax, dword [0x5c2c6c]
mov byte [eax], 0
lea edx, [ebp - 0xcc0]
xor eax, eax
call fcn.004045f4
mov edx, dword [ebp - 0xcc0]
lea eax, [ebp - 0x260]
call fcn.00404a70
mov edx, 1
lea eax, [ebp - 0x260]
call fcn.00405008
mov eax, dword [0x5c2c6c]
mov byte [eax], 1
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x4b0]
call fcn.00404a70
mov edx, 1
lea eax, [ebp - 0x4b0]
call fcn.00405024
mov edx, 0x819400
lea eax, [ebp - 0x260]
call fcn.00405030
push esi
lea edx, [ebp - 0xcb0]
mov ecx, 0x800
lea eax, [ebp - 0x260]
call fcn.00404bd4
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0xcb0]
mov ecx, dword [esi]
lea eax, [ebp - 0x4b0]
call fcn.00404bf4
cmp dword [esi], 0
je 0x5ab8ad
mov eax, dword [esi]
cmp eax, dword [ebp - 0x10]
je 0x5ab873
lea eax, [ebp - 0x260]
call fcn.00404c14
lea eax, [ebp - 0x4b0]
call fcn.00404c14
push 5
push 0
mov eax, dword [ebp - 4]
call fcn.00407854
push eax
mov eax, dword [ebp - 8]
call fcn.00407854
push eax
push 0x5ab944
mov eax, dword [0x5c8bbc]
call fcn.004bb9cc
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ab920
lea eax, [ebp - 0xcc0]
mov edx, 4
call fcn.004077c0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004077c0
ret
Function at 0x5abca0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x5abd82
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5abd65
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040a62c
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x5abd44
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x5c8bbc]
call fcn.004bb9cc
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, ebx
mov edx, 0x104
call fcn.00407b44
mov eax, dword [ebx]
call fcn.00407854
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
jne 0x5abd2e
mov ecx, 0x5abd9c
mov dl, 1
mov eax, dword [0x40f060]
call fcn.00418d4c
call fcn.00406290
mov eax, dword [ebx]
call fcn.00407854
push eax
call sub.kernel32.dll_lstrlenW_1
mov edx, eax
mov eax, ebx
call fcn.00407b44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5abd6c
cmp dword [ebp - 8], 0
je 0x5abd64
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret

Function at 0x5ac58c
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x5ac594
push ebx
push esi
xor eax, eax
push ebp
push 0x5ac9f5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
push ebp
push 0x5ac658
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
call fcn.0040a62c
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x5ac637
lea eax, [ebp - 0x28]
push eax
push 0x26
mov eax, dword [0x5c8bbc]
call fcn.004bb9cc
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x18]
mov edx, 0x104
call fcn.00407b44
mov eax, dword [ebp - 0x18]
call fcn.00407854
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
jne 0x5ac61f
mov ecx, 0x5aca10
mov dl, 1
mov eax, dword [0x40f060]
call fcn.00418d4c
call fcn.00406290
mov eax, dword [ebp - 0x18]
call fcn.00407854
push eax
call sub.kernel32.dll_lstrlenW_1
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00407b44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ac65f
cmp dword [ebp - 0x28], 0
je 0x5ac657
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret