joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441b18
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, 1
je 0x441c5c
test byte [0x50f701], 1
je 0x441b48
mov bl, 1
push 0x201
push 0x10
call fcn.00441a9c
add esp, 8
test byte [0x50f701], 8
je 0x441b65
mov bl, 1
push 0x201
push 0xa3
call fcn.00441a9c
add esp, 8
test byte [0x50f701], 4
je 0x441b82
mov bl, 1
push 0x201
push 0xa2
call fcn.00441a9c
add esp, 8
test byte [0x50f701], 0x40
je 0x441b9c
mov bl, 1
push 0x201
push 0x5b
call fcn.00441a9c
add esp, 8
test byte [0x50f701], 0x10
je 0x441bb9
mov bl, 1
push 0x201
push 0xa4
call fcn.00441a9c
add esp, 8
test byte [0x50f701], 0x20
je 0x441bd6
mov bl, 1
push 0x201
push 0xa5
call fcn.00441a9c
add esp, 8
test byte [0x50f701], 0x80
je 0x441c0d
push 0x14
call sub.USER32.dll_GetKeyState
test ax, ax
jne 0x441c39
push 0x201
push 0x14
call fcn.00441a9c
add esp, 8
push 0x202
push 0x14
call fcn.00441a9c
add esp, 8
mov bl, 1
jmp 0x441c39
push 0x14
call sub.USER32.dll_GetKeyState
test ax, ax
je 0x441c39
push 0x201
push 0x14
call fcn.00441a9c
add esp, 8
push 0x202
push 0x14
call fcn.00441a9c
add esp, 8
mov bl, 1
test bl, bl
je 0x441c5c
push 0
push 0
call fcn.004013d8
add esp, 8
push 0x64
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.004013d8
add esp, 8
test esi, 2
je 0x441d97
test byte [0x50f701], 1
je 0x441c80
push 0x202
push 0x10
call fcn.00441a9c
add esp, 8
test byte [0x50f701], 8
je 0x441c9b
push 0x202
push 0xa3
call fcn.00441a9c
add esp, 8
test byte [0x50f701], 4
je 0x441cb6
push 0x202
push 0xa2
call fcn.00441a9c
add esp, 8
test byte [0x50f701], 0x40
je 0x441cce
push 0x202
push 0x5b
call fcn.00441a9c
add esp, 8
test byte [0x50f701], 0x10
je 0x441ce9
push 0x202
push 0xa4
call fcn.00441a9c
add esp, 8
test byte [0x50f701], 0x20
je 0x441d04
push 0x202
push 0xa5
call fcn.00441a9c
add esp, 8
test byte [0x50f701], 0x80
je 0x441d39
push 0x14
call sub.USER32.dll_GetKeyState
test ax, ax
jne 0x441d63
push 0x201
push 0x14
call fcn.00441a9c
add esp, 8
push 0x202
push 0x14
call fcn.00441a9c
add esp, 8
jmp 0x441d63
push 0x14
call sub.USER32.dll_GetKeyState
test ax, ax
je 0x441d63
push 0x201
push 0x14
call fcn.00441a9c
add esp, 8
push 0x202
push 0x14
call fcn.00441a9c
add esp, 8
test byte [0x50f701], 0x7d
je 0x441d97
and dword [0x50f700], 0xffff82ff
push 0
push 0
call fcn.004013d8
add esp, 8
push 0x64
call sub.KERNEL32.dll_Sleep
push 0
push 0
call fcn.004013d8
add esp, 8
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x441da0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0
call fcn.00401260
push eax
push 0
push 0
push 6
push 0
push ebx
call fcn.0040151c
add esp, 0xc
push eax
push 5
push 0
push ebx
call fcn.0040151c
add esp, 0xc
push eax
push 7
push 0
push ebx
call fcn.0040151c
add esp, 0xc
push eax
push 8
push 0
push ebx
call fcn.0040151c
add esp, 0xc
push eax
push 0x90800000
push 0x5d239b
push 0x50f725
push 0x8000008
call sub.USER32.dll_CreateWindowExA
mov esi, eax
push 0xda0000
push 0xffffffffffffffeb
push esi
call sub.USER32.dll_SetWindowLongA
push 0
mov eax, dword [0x50f710]
test eax, eax
jns 0x441e22
add eax, 3
sar eax, 2
mov ecx, dword [0x50f70c]
test ecx, ecx
lea edx, [eax + eax*2]
push edx
jns 0x441e36
add ecx, 3
sar ecx, 2
shl ecx, 2
push ecx
push 3
push 0x64
push esi
call fcn.004443f8
add esp, 0x18
push 0
push ebx
call sub.USER32.dll_ShowWindow
pop esi
pop ebx
pop ebp
ret

Function at 0x444f94
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push ecx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edx
test eax, eax
je 0x444fac
mov cl, byte [eax]
test cl, cl
jne 0x444fac
xor eax, eax
lea edx, [ebp - 4]
push edx
push 0
push 2
mov ecx, dword [ebp + 0x10]
push ecx
push eax
mov eax, dword [ebp + 8]
push eax
call sub.ADVAPI32.dll_LogonUserA
dec eax
jne 0x444fd9
mov eax, dword [ebp - 4]
test eax, eax
je 0x444fd5
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
jmp 0x444fde
call sub.KERNEL32.dll_GetLastError
pop ecx
pop ebp
ret

Function at 0x44533c
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], 0x200
mov eax, dword [ebp + 0x10]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x445383
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
lea esi, [ebp - 0x20c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x445398
lea eax, [ebp - 0x20c]
push eax
call fcn.004451d0
pop ecx
test al, al
jne 0x445398
xor eax, eax
jmp 0x4453c7
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
push edx
push ecx
lea eax, [ebp - 0x20c]
lea edx, [ebp - 4]
push eax
push edx
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push ecx
push eax
push 0
call sub.ADVAPI32.dll_LookupAccountNameA
test eax, eax
jne 0x4453c5
xor eax, eax
jmp 0x4453c7
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446068
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9c4
mov ecx, 0x80
lea eax, [ebp - 0x23c]
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x23c]
mov byte [ebp - 1], 0
push esi
xor ebx, ebx
mov esi, 0x50fa5b
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x43c]
push esi
mov esi, 0x50fc5b
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x63c]
push esi
mov esi, 0x50fe5b
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x3c]
push esi
mov esi, 0x51005b
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004453d0
add esp, 8
test al, al
jne 0x4460ed
mov ebx, 0xfffffd9d
jmp 0x4462e9
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x3c]
push eax
push edx
lea ecx, [ebp - 0x63c]
push 0x5d2b60
push ecx
call fcn.004d26c8
add esp, 0x10
test esi, esi
jne 0x446285
push 1
lea eax, [ebp - 0x43c]
push 0x200
push eax
lea edx, [ebp - 0x63c]
push 0x5d2b65
push edx
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
jne 0x446149
mov ebx, 0xfffffd9a
jmp 0x4462e9
lea eax, [ebp - 0x43c]
push eax
call fcn.004d58e0
pop ecx
push 0x5d2b76
lea edx, [ebp - 0x43c]
push edx
call fcn.004ce0fd
add esp, 8
test eax, eax
je 0x446170
mov bl, 1
lea eax, [ebp - 0x63c]
lea edx, [ebp - 0x43c]
push eax
push 0x5d2b7b
push edx
call fcn.004d26c8
add esp, 0xc
lea ecx, [ebp - 0x43c]
lea eax, [ebp - 0x43c]
push 1
push 0x200
push ecx
push 0x5d2b82
push eax
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x4461ba
mov byte [ebp - 1], 1
test bl, bl
je 0x446285
mov dl, byte [ebp - 1]
test dl, dl
je 0x446285
lea ecx, [ebp - 0x63c]
lea eax, [ebp - 0x43c]
push ecx
push 0x5d2b93
push eax
call fcn.004d26c8
add esp, 0xc
lea edx, [ebp - 0x43c]
push edx
push 0x80000002
call fcn.004069a0
add esp, 8
lea ecx, [ebp - 0x23c]
push ecx
push 0x5d2b9a
lea eax, [ebp - 0x43c]
push eax
call fcn.004d26c8
add esp, 0xc
lea edx, [ebp - 0x43c]
lea ecx, [ebp - 0x63c]
push edx
push 0
push ecx
push 0x80000002
call fcn.00407420
add esp, 0x10
test al, al
jne 0x446242
mov ebx, 0xfffffd97
jmp 0x4462e9
lea eax, [ebp - 0x63c]
lea edx, [ebp - 0x43c]
push eax
push 0x5d2ba1
push edx
call fcn.004d26c8
add esp, 0xc
lea ecx, [ebp - 0x23c]
lea eax, [ebp - 0x43c]
push ecx
push 0
push eax
push 0x80000002
call fcn.00407420
add esp, 0x10
test al, al
jne 0x446285
mov ebx, 0xfffffd93
jmp 0x4462e9
push 1
lea eax, [ebp - 0x43c]
push 0x200
push eax
lea edx, [ebp - 0x63c]
push 0x5d2ba8
push edx
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
jne 0x4462b7
mov ebx, 0xfffffd90
jmp 0x4462e9
mov al, byte [ebp - 0x43c]
test al, al
jne 0x4462c8
mov ebx, 0xfffffd8d
jmp 0x4462e9
xor ebx, ebx
test esi, esi
je 0x4462e9
push 0x200
push esi
lea eax, [ebp - 0x43c]
push eax
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
test eax, eax
jne 0x4462e9
mov ebx, 0xfffffd89
test ebx, ebx
je 0x4462f4
test esi, esi
je 0x4462f4
mov byte [esi], 0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4527cc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push ebx
call sub.USER32.dll_GetClassNameA
lea eax, [ebp - 0x100]
mov edx, 0x5d3aa4
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x45283e
test cl, cl
je 0x452816
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x45283e
add eax, 2
add edx, 2
test cl, cl
jne 0x4527fa
jne 0x45283e
mov eax, ebx
push 0
push 0x5d3ab1
push 0
push eax
call sub.USER32.dll_FindWindowExA
mov ebx, eax
mov eax, ebx
push 0
push 0x5d3aba
push 0
push eax
call sub.USER32.dll_FindWindowExA
mov ebx, eax
lea eax, [ebp - 0x100]
mov edx, 0x5d3abf
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x45287a
test cl, cl
je 0x452865
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x45287a
add eax, 2
add edx, 2
test cl, cl
jne 0x452849
jne 0x45287a
mov eax, ebx
push 0
push 0x5d3ac8
push 0
push eax
call sub.USER32.dll_FindWindowExA
mov ebx, eax
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x45289d
test esi, esi
je 0x452888
mov byte [esi], 0
push esi
push 0x200
push 0xd
push ebx
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x4528ef
push ebx
call fcn.004527c4
pop ecx
push esi
push 0
push 0xc
push ebx
call sub.USER32.dll_SendMessageA
push ebx
push ebx
call sub.USER32.dll_GetDlgCtrlID
and ax, 0xffff
movzx edx, ax
or edx, 0x3000000
push edx
push 0x111
push ebx
call sub.USER32.dll_GetParent
push eax
call sub.USER32.dll_SendMessageA
push 0
call sub.KERNEL32.dll_Sleep
push 0x32
call sub.KERNEL32.dll_Sleep
push 0
call sub.KERNEL32.dll_Sleep
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452c58
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov ecx, 0xa
push ebx
push esi
push edi
lea edi, [ebp - 0x2c]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push esi
mov esi, 0x51bb50
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
test ebx, ebx
jne 0x452c85
xor eax, eax
jmp 0x452e14
mov edx, dword [ebp + 0xc]
dec edx
je 0x452c9d
dec edx
je 0x452cb7
dec edx
je 0x452ccd
dec edx
je 0x452d47
jmp 0x452dbc
push 0x104
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
test eax, eax
jne 0x452dc0
xor eax, eax
jmp 0x452e14
push ebx
call fcn.00445ff4
pop ecx
test eax, eax
je 0x452dc0
xor eax, eax
jmp 0x452e14
push 1
push 0x104
push ebx
lea edx, [ebp - 0x2c]
push 0x5d3acd
push edx
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x452cf9
mov cl, byte [ebx]
test cl, cl
jne 0x452dc0
push 0x5d3add
call fcn.004d96cc
pop ecx
mov edi, eax
test edi, edi
jne 0x452d22
push esi
mov esi, 0x5d3aea
mov edi, ebx
mov eax, edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x452dc0
push esi
xor eax, eax
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, ebx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x452dc0
push 1
push 0x104
push ebx
lea eax, [ebp - 0x2c]
push 0x5d3afb
push eax
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x452d6f
mov dl, byte [ebx]
test dl, dl
jne 0x452dc0
push 0x5d3b11
call fcn.004d96cc
pop ecx
mov edi, eax
test edi, edi
jne 0x452d97
push esi
mov esi, 0x5d3b23
mov edi, ebx
mov eax, edi
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x452dc0
push esi
xor eax, eax
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, ebx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x452dc0
xor eax, eax
jmp 0x452e14
mov dl, byte [ebx]
test dl, dl
jne 0x452dca
xor eax, eax
jmp 0x452e14
test esi, 0x100
je 0x452dfc
push ebx
call fcn.004cdfec
pop ecx
test eax, eax
je 0x452dfc
push ebx
call fcn.004cdfec
pop ecx
movsx edx, byte [ebx + eax - 1]
cmp edx, 0x5c
je 0x452dfc
push 0x5d3b3a
push ebx
call fcn.004cdf10
add esp, 8
test esi, 0x200
je 0x452e12
push 0x5d3b3c
push ebx
call fcn.004cdf10
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4565c8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ax, word [0x51be8f]
mov word [ebp - 3], ax
mov al, byte [0x51be91]
mov byte [ebp - 1], al
lea edx, [ebp - 3]
push edx
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 2
jne 0x456629
test ebx, ebx
jne 0x456628
test esi, esi
je 0x456621
xor eax, eax
push esi
lea edi, [ebp - 3]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, 1
jmp 0x456643
dec ebx
dec byte [ebp - 3]
movsx eax, byte [ebp - 3]
cmp eax, 0x43
je 0x45663a
cmp eax, 0x63
jne 0x4565e9
test esi, esi
je 0x456641
mov byte [esi], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4585e8
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov eax, 0x51c0ed
call fcn.004d08c0
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 0xffffff9c
mov word [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push eax
push 0
push 2
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call sub.ADVAPI32.dll_LogonUserA
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x45865c
test ebx, ebx
je 0x458770
call sub.KERNEL32.dll_GetLastError
push eax
push 0x5d488b
push ebx
call fcn.004d26c8
add esp, 0xc
jmp 0x458770
mov edx, dword [ebp - 0x28]
push edx
call fcn.004584dc
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x458691
test ebx, ebx
je 0x458770
call sub.KERNEL32.dll_GetLastError
push eax
push 0x5d4894
push ebx
call fcn.004d26c8
add esp, 0xc
jmp 0x458770
push 0
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x28]
push edx
push esi
call fcn.00445c70
add esp, 0x10
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x4586d3
test ebx, ebx
je 0x458770
call sub.KERNEL32.dll_GetLastError
push eax
mov eax, dword [ebp - 0x30]
push eax
push 0x5d489d
push ebx
call fcn.004d26c8
add esp, 0x10
jmp 0x458770
push 0x44
push 0
lea edx, [ebp - 0x74]
push edx
call fcn.004cde6c
add esp, 0xc
mov dword [ebp - 0x74], 0x44
test byte [ebp + 0x21], 1
je 0x4586f7
mov dword [ebp - 0x6c], 0x5d48a9
lea ecx, [ebp - 0x84]
lea eax, [ebp - 0x74]
push ecx
push eax
push 0
push 0
push 0
push 1
push 0
push 0
mov edx, dword [ebp + 0x14]
push edx
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call sub.ADVAPI32.dll_CreateProcessAsUserA
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x458748
mov dword [ebp - 0x30], 0xffffff3b
test ebx, ebx
je 0x458770
call sub.KERNEL32.dll_GetLastError
push eax
push 0x5d48cb
push ebx
call fcn.004d26c8
add esp, 0xc
jmp 0x458770
mov edx, dword [ebp - 0x80]
push edx
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 0x84]
push ecx
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4587c6
push 0
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x28]
push eax
call fcn.00445c94
add esp, 0xc
mov edx, dword [ebp - 0x28]
test edx, edx
je 0x458792
mov ecx, dword [ebp - 0x28]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov word [ebp - 0x14], 0
jmp 0x4587b9
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x90]
mov esi, dword [ebp - 0x8c]
mov ebx, dword [ebp - 0x88]
pop ebp
ret
Function at 0x45ccd8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.0045cc6c
mov esi, eax
push esi
push ebx
push 0x5d5972
lea eax, [ebp - 0x24]
push eax
call fcn.004d26c8
add esp, 0x10
test byte [0x516435], 4
je 0x45cd1d
lea edx, [ebp - 0x24]
push edx
push 0x5d597c
push 0x516438
call fcn.00451598
add esp, 0xc
push ebx
push 0x5d5988
lea ecx, [ebp - 0x24]
push ecx
call fcn.004d26c8
add esp, 0xc
test ebx, 0x10000
je 0x45cd6c
push 0xa1
call sub.USER32.dll_GetAsyncKeyState
test ax, ax
je 0x45cd6c
and ebx, 0xfffeffff
test byte [0x516435], 4
je 0x45cd6c
push 0x5d5997
push 0x5d598b
push 0x516438
call fcn.00451598
add esp, 0xc
test esi, 0x80000
je 0x45ced0
test bl, 2
jne 0x45ced0
test esi, 0x10000
je 0x45cddd
and ebx, 0xffff1fff
lea eax, [ebp - 0x24]
or ebx, 0x4000
push ebx
push 0x5d59a4
push eax
call fcn.004d26c8
add esp, 0xc
test byte [0x516435], 4
je 0x45cdc6
lea edx, [ebp - 0x24]
push edx
push 0x5d59a7
push 0x516438
call fcn.00451598
add esp, 0xc
push ebx
push 0x5d59b6
lea ecx, [ebp - 0x24]
push ecx
call fcn.004d26c8
add esp, 0xc
jmp 0x45ced0
push 0x13
call fcn.0045c530
pop ecx
call fcn.0045c140
call fcn.00484ff0
call fcn.004762fc
call fcn.0045c148
test bh, 0x40
jne 0x45ce52
test bh, 8
jne 0x45ce52
and ebx, 0xfffff8ff
lea eax, [ebp - 0x24]
or ebx, 0x400
push ebx
push 0x5d59b9
push eax
call fcn.004d26c8
add esp, 0xc
test byte [0x516435], 4
je 0x45ce40
lea edx, [ebp - 0x24]
push edx
push 0x5d59bc
push 0x516438
call fcn.00451598
add esp, 0xc
push ebx
push 0x5d59cc
lea ecx, [ebp - 0x24]
push ecx
call fcn.004d26c8
add esp, 0xc
test bh, 2
je 0x45ce7c
test esi, 0x200
jne 0x45ced0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push 0x29
call fcn.00462da8
add esp, 0x1c
jmp 0x45cf96
test bh, 4
je 0x45cea6
test esi, 0x400
jne 0x45ced0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x24]
push edx
push 0x29
call fcn.00462c84
add esp, 0x1c
jmp 0x45cf96
test bh, 1
je 0x45ced0
test esi, 0x100
jne 0x45ced0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
push ecx
push 0x29
call fcn.00462b98
add esp, 0x1c
jmp 0x45cf96
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1b9
call fcn.00462c84
xor eax, eax
add esp, 0x1c
xor edi, edi
mov dword [ebp - 4], eax
test bl, 1
je 0x45cef8
or edi, 1
test bh, 0x40
je 0x45cf05
or edi, 0x100
jmp 0x45cf43
test bh, 0x80
je 0x45cf12
or edi, 0x200
jmp 0x45cf43
test bh, 0x20
je 0x45cf2e
or edi, 0x10
mov eax, dword [0x51b4bc]
cmp eax, 0xffffff
je 0x45cf43
mov dword [ebp - 4], eax
or edi, 0x40
jmp 0x45cf43
or edi, 0x20
mov eax, dword [0x51b4b8]
cmp eax, 0xffffff
je 0x45cf43
mov dword [ebp - 4], eax
or edi, 0x40
test esi, 0x400
je 0x45cf51
or edi, 0x1000
push edi
push esi
push ebx
push 0x5d59cf
lea edx, [ebp - 0x24]
push edx
call fcn.004d26c8
add esp, 0x14
test byte [0x516435], 4
je 0x45cf84
lea ecx, [ebp - 0x24]
push ecx
push 0x5d59e0
push 0x516438
call fcn.00451598
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push edi
call fcn.00455d3c
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45dc9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
mov eax, 0x51c678
push ebx
push esi
push edi
call fcn.004d08c0
mov word [ebp - 0x14], 8
mov dl, byte [0x519bf1]
test dl, dl
je 0x45dd07
test byte [0x516435], 4
je 0x45dce2
push 0x5d5cc8
push 0x5d5cb4
push 0x516438
call fcn.00451598
add esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push 0xc
call fcn.00462b98
add esp, 0x1c
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
jmp 0x45dd9d
test byte [0x516435], 4
je 0x45dd27
push 0x5d5cdb
push 0x5d5cc9
push 0x516438
call fcn.00451598
add esp, 0xc
push 0
push 0xb
lea eax, [ebp - 0x424]
push eax
call fcn.004415e8
add esp, 0xc
test eax, eax
jle 0x45dd67
lea edx, [ebp - 0x424]
lea ecx, [ebp - 0x824]
push edx
push 0x5d5cdc
push ecx
call fcn.004d26c8
add esp, 0xc
push 5
lea eax, [ebp - 0x824]
push eax
call sub.KERNEL32.dll_WinExec
mov word [ebp - 0x14], 0
jmp 0x45dd8e
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x830]
mov esi, dword [ebp - 0x82c]
mov ebx, dword [ebp - 0x828]
pop ebp
ret
Function at 0x45de2c
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
mov eax, 0x51c68c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.004d08c0
mov word [ebp - 0x14], 8
test ebx, ebx
jne 0x45de80
test byte [0x516435], 4
je 0x45de6f
push 0x5d5d1b
push 0x5d5d0f
push 0x516438
call fcn.00451598
add esp, 0xc
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x45e03a
mov cl, byte [ebx]
test cl, cl
jne 0x45deba
test byte [0x516435], 4
je 0x45dea6
push 0x5d5d2c
push 0x5d5d20
push 0x516438
call fcn.00451598
add esp, 0xc
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x45e03a
mov cl, byte [0x519bf1]
test cl, cl
je 0x45df04
test byte [0x516435], 4
je 0x45dee0
push ebx
push 0x5d5d2f
push 0x516438
call fcn.00451598
add esp, 0xc
push 0
push 0
push 0
push 0
push 0
push ebx
push 0xb
call fcn.00462b98
add esp, 0x1c
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x45e03a
test byte [0x516435], 4
je 0x45df20
push ebx
push 0x5d5d3d
push 0x516438
call fcn.00451598
add esp, 0xc
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
lea esi, [ebp - 0x128]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movsx eax, byte [ebp - 0x128]
cmp eax, 0x30
jne 0x45df62
mov dl, byte [ebp - 0x127]
test dl, dl
jne 0x45df62
mov byte [ebp - 0x128], 0
movsx ecx, byte [ebp - 0x128]
cmp ecx, 0xffffffac
jne 0x45df75
mov byte [ebp - 0x128], 0
push 1
push 0x5d5d6e
push 0x5d5d5f
push 0x5d5d49
push 0x80000001
call fcn.00406a5c
add esp, 0x14
push 1
push 0x5d5d94
push 0x5d5d86
push 0x5d5d70
push 0x80000001
call fcn.00406a5c
add esp, 0x14
lea eax, [ebp - 0x128]
push 1
push eax
push 0x5d5dac
push 0x5d5d96
push 0x80000001
call fcn.00406a5c
add esp, 0x14
push 3
lea edx, [ebp - 0x128]
push edx
push 0
push 0x14
call sub.USER32.dll_SystemParametersInfoA
test eax, eax
je 0x45e007
push 1
push 0
call sub.USER32.dll_GetDesktopWindow
push eax
call sub.USER32.dll_InvalidateRect
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x45e03a
mov word [ebp - 0x14], 0
jmp 0x45e02e
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x134]
mov esi, dword [ebp - 0x130]
mov ebx, dword [ebp - 0x12c]
pop ebp
ret