joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fdc40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7ad9b3
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x89b044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
push 0x14
call fcn.00704930
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4fdc8f
mov ecx, dword [ebp - 0x18]
call fcn.00508e30
mov dword [ebp - 0x20], eax
jmp 0x4fdc96
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00403670
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 4]
mov dword [edx + 8], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 0x479
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0x4f7970
push 0
push 0
call fcn.007263d8
add esp, 0x18
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405ef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4ff420
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7adc96
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x89b044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push str.CMainUI::OnCreate__CDialogBuilder::Create_MainUI.xml__failed
call fcn.00608b30
add esp, 4
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0
call fcn.00432bb0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
push 1
push 0
push str.mainui
push str.open_fail
call fcn.00403df0
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.00402730
lea ecx, [ebp - 0x10]
push ecx
call fcn.00408df0
add esp, 4
lea ecx, [ebp - 0x10]
call fcn.00403b90
movzx edx, al
test edx, edx
jne 0x4ff4df
push 0
push 0
push 0x7edc00
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 5
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.00406470
push eax
push 0x7edc2c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4ff508
push 0
push 0
push 0x7edc38
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 5
push 0
push 0
push str.http:__www.ludashi.com
push 0x7edc98
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x10]
call fcn.00405ef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x535dd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 1
lea ecx, [ebp + 8]
call fcn.00508b50
push eax
lea ecx, [ebp + 8]
call fcn.00508b30
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
push 4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x539ef0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x29c
call fcn.00406890
push 2
lea ecx, [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
push 0
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0xc]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 8]
mov dword [ecx + 0xc], eax
push 0x88
push SysReAllocString
push 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.005a4a10
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x80
push 0xffffffffffffffec
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x539fb5
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 4], eax
jmp 0x539f98
push 5
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x5506d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
lea eax, [ebp - 4]
push eax
call fcn.004bb400
mov ecx, eax
call fcn.0043e1b0
push 1
push 0
push 0
lea ecx, [ebp - 4]
call fcn.00405e80
push eax
push 0x7f59f0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.00405ef0
mov esp, ebp
pop ebp
ret

Function at 0x557c00
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b6fab
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x89b044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
shl eax, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x10], 0
je 0x557c50
mov ecx, dword [ebp - 0x14]
or ecx, 0x1000000
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x1c]
call fcn.00405e90
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x40
mov edx, dword [ebp - 0x18]
shl edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00403b40
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00403ba0
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x18]
je 0x557c66
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00405d50
mov ecx, dword [ebp - 0x24]
or ecx, 1
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00405ef0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x565fa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b812b
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x89b044]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], ecx
xor eax, eax
mov word [ebp - 0x224], ax
push 0x206
push 0
lea ecx, [ebp - 0x222]
push ecx
call fcn.007202b0
add esp, 0xc
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0x104
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x7f6d0c
push 0x7f6d18
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x56602c
xor eax, eax
xor edx, edx
jmp 0x566081
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x248]
call fcn.00403bf0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x24c]
call fcn.00566830
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.00403c30
mov eax, dword [ebp - 0x22c]
mov edx, dword [ebp - 0x228]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0071fe0b
mov esp, ebp
pop ebp
ret
Function at 0x566630
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b8204
mov eax, dword fs:[0]
push eax
sub esp, 0x2dc
mov eax, dword [0x89b044]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2e0], ecx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
push 0x7f6e3c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004e64f0
add esp, 0xc
mov dword [ebp - 4], 0
lea edx, [ebp - 0x2a4]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00403c80
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00405320
mov byte [ebp - 4], 1
push 0x7f6f90
lea ecx, [ebp - 0x4c]
call fcn.0041edc0
cmp dword [ebp - 0x30], 0xffffffff
je 0x5667ee
mov ecx, dword [ebp - 0x2a4]
and ecx, 0x10
je 0x56678c
mov edx, dword [ebp - 0x2a4]
and edx, 0x400
jne 0x56678a
push 0x7f6f94
lea eax, [ebp - 0x278]
push eax
call fcn.00723784
add esp, 8
test eax, eax
je 0x56678a
push 0x7f6f98
lea ecx, [ebp - 0x278]
push ecx
call fcn.00723784
add esp, 8
test eax, eax
je 0x56678a
push 0x7f6fa0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x2dc]
push eax
call fcn.004e64f0
add esp, 0xc
mov dword [ebp - 0x2e4], eax
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp - 0x2e8], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x2e8]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00403c60
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2dc]
call fcn.00403c30
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041edc0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x2e0]
call fcn.00566630
jmp 0x5667cb
lea edx, [ebp - 0x278]
push edx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c0]
push ecx
call fcn.004e64f0
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c0]
call fcn.00403c80
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c0]
call fcn.00403c30
lea edx, [ebp - 0x2a4]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x5666cb
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.00403c30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403c30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0071fe0b
mov esp, ebp
pop ebp
ret 4
Function at 0x566830
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b824a
mov eax, dword fs:[0]
push eax
sub esp, 0x2d4
mov eax, dword [0x89b044]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
push 0x7f6fa4
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004e64f0
add esp, 0xc
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28c]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00403c80
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
je 0x566a25
mov eax, dword [ebp - 0x28c]
and eax, 0x10
je 0x566980
mov ecx, dword [ebp - 0x28c]
and ecx, 0x400
jne 0x56697b
push 0x7f6fb0
lea edx, [ebp - 0x260]
push edx
call fcn.00723784
add esp, 8
test eax, eax
je 0x56697b
push 0x7f6fb4
lea eax, [ebp - 0x260]
push eax
call fcn.00723784
add esp, 8
test eax, eax
je 0x56697b
push 0x7f6fbc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x2b0]
push edx
call fcn.004e64f0
add esp, 0xc
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x2d8], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2d8]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00403c60
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2b0]
call fcn.00403c30
lea edx, [ebp - 0x260]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0041edc0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2d0]
call fcn.00566830
add eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
adc ecx, edx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
jmp 0x566a02
mov edx, dword [ebp - 0x26c]
mov dword [ebp - 0x294], edx
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x3c]
add ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x38]
adc edx, dword [ebp - 0x290]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x260]
push ecx
push 0x7f6fc0
lea ecx, [ebp - 0x2c4]
call fcn.0044ee40
mov dword [ebp - 0x2dc], eax
mov edx, dword [ebp - 0x2dc]
mov dword [ebp - 0x2e0], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2e0]
push eax
call fcn.0044eed0
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c4]
call fcn.0044eeb0
lea ecx, [ebp - 0x28c]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x5668ae
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x2cc], ecx
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c8], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403c30
mov eax, dword [ebp - 0x2cc]
mov edx, dword [ebp - 0x2c8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0071fe0b
mov esp, ebp
pop ebp
ret 4
Function at 0x566ac0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
call fcn.00566e80
add esp, 4
lea ecx, [ebp - 4]
call fcn.00403b90
movzx ecx, al
test ecx, ecx
je 0x566af5
mov dword [ebp - 8], 0
lea ecx, [ebp - 4]
call fcn.00405ef0
mov eax, dword [ebp - 8]
jmp 0x566b2e
lea ecx, [ebp - 4]
call fcn.00405e80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x566b1c
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 4]
call fcn.00405ef0
mov eax, dword [ebp - 0xc]
jmp 0x566b2e
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 4]
call fcn.00405ef0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x566b40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b827a
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x89b044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
call fcn.00566c30
test eax, eax
jne 0x566b91
push 0x7f6ff8
call fcn.006090a0
add esp, 4
push 8
call fcn.00569100
mov ecx, eax
call fcn.00559600
jmp 0x566c1a
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00566f90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00405e80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x566be2
mov dword [ebp - 0x14], 0
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push 0x566a70
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 4]
mov eax, dword [edx + 4]
call eax
jmp 0x566c0b
mov dword [ebp - 0x18], 0
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push 0x566aa0
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 4]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405ef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x567050
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b835e
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x89b044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], ecx
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x54]
call fcn.00566f90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.00405e80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5670c0
push 7
call fcn.00569100
mov ecx, eax
call fcn.00559600
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00405ef0
jmp 0x56719b
push 5
call fcn.00569100
mov ecx, eax
call fcn.00559600
mov dword [ebp - 0x48], 0
push 0x38
push 0
lea ecx, [ebp - 0x44]
push ecx
call fcn.007202b0
add esp, 0xc
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x4c]
call fcn.00405e80
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], str._install
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
lea edx, [ebp - 0x48]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x56714b
push 7
call fcn.00569100
mov ecx, eax
call fcn.00559600
jmp 0x56718c
push 6
call fcn.00569100
mov ecx, eax
call fcn.00559600
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.00566ac0
test eax, eax
je 0x56717e
push 8
call fcn.00569100
mov ecx, eax
call fcn.00559600
jmp 0x56718c
push 7
call fcn.00569100
mov ecx, eax
call fcn.00559600
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00405ef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x567290
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b83a4
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x89b044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
call fcn.00567380
test eax, eax
jne 0x5672e1
push 0x7f71b8
call fcn.006090a0
add esp, 4
push 8
call fcn.00569100
mov ecx, eax
call fcn.00559d00
jmp 0x56736a
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.005673a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00405e80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x567332
mov dword [ebp - 0x14], 0
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push 0x567240
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 4]
mov eax, dword [edx + 4]
call eax
jmp 0x56735b
mov dword [ebp - 0x18], 0
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push 0x567270
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 4]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405ef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5675b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
call fcn.00567710
add esp, 4
lea ecx, [ebp - 4]
call fcn.00403b90
movzx ecx, al
test ecx, ecx
je 0x5675e5
mov dword [ebp - 8], 0
lea ecx, [ebp - 4]
call fcn.00405ef0
mov eax, dword [ebp - 8]
jmp 0x56761e
lea ecx, [ebp - 4]
call fcn.00405e80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x56760c
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 4]
call fcn.00405ef0
mov eax, dword [ebp - 0xc]
jmp 0x56761e
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 4]
call fcn.00405ef0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x567880
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b8488
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x89b044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], ecx
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x54]
call fcn.005673a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.00405e80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5678f0
push 7
call fcn.00569100
mov ecx, eax
call fcn.00559d00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00405ef0
jmp 0x5679cb
push 5
call fcn.00569100
mov ecx, eax
call fcn.00559d00
mov dword [ebp - 0x48], 0
push 0x38
push 0
lea ecx, [ebp - 0x44]
push ecx
call fcn.007202b0
add esp, 0xc
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x4c]
call fcn.00405e80
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0x7f732c
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
lea edx, [ebp - 0x48]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x56797b
push 7
call fcn.00569100
mov ecx, eax
call fcn.00559d00
jmp 0x5679bc
push 6
call fcn.00569100
mov ecx, eax
call fcn.00559d00
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.005675b0
test eax, eax
je 0x5679ae
push 8
call fcn.00569100
mov ecx, eax
call fcn.00559d00
jmp 0x5679bc
push 7
call fcn.00569100
mov ecx, eax
call fcn.00559d00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00405ef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x567ac0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b84ce
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x89b044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00568a20
test eax, eax
jne 0x567b14
push 0x7f736c
call fcn.006090a0
add esp, 4
push 8
call fcn.00569100
mov ecx, eax
call fcn.0055a420
jmp 0x567b9d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00568080
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00405e80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x567b65
mov dword [ebp - 0x14], 0
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push 0x567a70
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 4]
mov eax, dword [edx + 4]
call eax
jmp 0x567b8e
mov dword [ebp - 0x18], 0
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push 0x567aa0
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 4]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405ef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret