joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e3a90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6288d6
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x6ec7c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x78]
push str.EnableNamespaceExtension
call fcn.00562ae0
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 0
call dword [0x63f5ac]
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x6fce70
call fcn.0041de10
mov esi, eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
call fcn.004c32a0
add esp, 4
cmp dword [esi + 0x14], 7
mov byte [ebp - 4], 3
jbe 0x4e3b0d
mov esi, dword [esi]
cmp dword [eax + 0x14], 7
jbe 0x4e3b15
mov eax, dword [eax]
push esi
push eax
mov ecx, 0x660798
test edi, edi
mov eax, 0x642690
cmove eax, ecx
push eax
lea eax, [ebp - 0x7c]
push str.regsvr32.exe__s_s___s_s_
push eax
call dword [0x63f5a0]
mov ecx, dword [ebp - 0x14]
add esp, 0x14
mov byte [ebp - 4], 2
cmp ecx, 7
jbe 0x4e3b73
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e3b69
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e3bb7
push ecx
push edx
call fcn.00604b8c
add esp, 8
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
cmp ecx, 7
jbe 0x4e3bc7
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e3bbd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4e3bbd
call dword [0x63e2e0]
push ecx
push edx
call fcn.00604b8c
add esp, 8
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [ebp - 0x7c]
lea ecx, [ebp - 0x8c]
push ecx
lea ecx, [ebp - 0xd0]
xorps xmm0, xmm0
push ecx
push 0
push 0
push 0x20
push 0
movups xmmword [ebp - 0x8c], xmm0
mov eax, dword [eax - 0xc]
lea ecx, [ebp - 0x7c]
push 0
push 0
inc eax
push eax
call dword [0x63f428]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x7c]
mov esi, eax
call dword [0x63f480]
test esi, esi
je 0x4e3c3d
push dword [ebp - 0x88]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x8c]
call esi
xor esi, esi
jmp 0x4e3c45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x7c]
call dword [0x63f5a8]
lea ecx, [ebp - 0x78]
call fcn.005630c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00604ed9
mov esp, ebp
pop ebp
ret
Function at 0x4e3c80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6288d6
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x6ec7c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x78]
push str.EnableShellExtension
call fcn.00562ae0
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], 0
call dword [0x63f5ac]
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x6fce70
call fcn.0041e010
mov esi, eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
call fcn.004c32a0
add esp, 4
cmp dword [esi + 0x14], 7
mov byte [ebp - 4], 3
jbe 0x4e3cfd
mov esi, dword [esi]
cmp dword [eax + 0x14], 7
jbe 0x4e3d05
mov eax, dword [eax]
push esi
push eax
mov ecx, 0x660798
test edi, edi
mov eax, 0x642690
cmove eax, ecx
push eax
lea eax, [ebp - 0x7c]
push str.regsvr32.exe__s_s___s_s_
push eax
call dword [0x63f5a0]
mov ecx, dword [ebp - 0x14]
add esp, 0x14
mov byte [ebp - 4], 2
cmp ecx, 7
jbe 0x4e3d63
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e3d59
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e3da7
push ecx
push edx
call fcn.00604b8c
add esp, 8
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
cmp ecx, 7
jbe 0x4e3db7
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e3dad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4e3dad
call dword [0x63e2e0]
push ecx
push edx
call fcn.00604b8c
add esp, 8
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [ebp - 0x7c]
lea ecx, [ebp - 0x8c]
push ecx
lea ecx, [ebp - 0xd0]
xorps xmm0, xmm0
push ecx
push 0
push 0
push 0x20
push 0
movups xmmword [ebp - 0x8c], xmm0
mov eax, dword [eax - 0xc]
lea ecx, [ebp - 0x7c]
push 0
push 0
inc eax
push eax
call dword [0x63f428]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x7c]
mov esi, eax
call dword [0x63f480]
test esi, esi
je 0x4e3e2d
push dword [ebp - 0x88]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x8c]
call esi
xor esi, esi
jmp 0x4e3e35
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x7c]
call dword [0x63f5a8]
lea ecx, [ebp - 0x78]
call fcn.005630c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00604ed9
mov esp, ebp
pop ebp
ret
Function at 0x4e53f0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x628b23
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x6ec7c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x84], edi
lea ecx, [edi + 8]
mov dword [ebp - 0x88], edi
call fcn.004e84e0
mov dword [edi + 4], vtable.CRegLoadable.0
lea ecx, [ebp - 0x48]
mov dword [edi + 4], vtable.CRegPersist.0
mov dword [edi], vtable.CShellSettingsBase::CFileViewSettings.0
mov dword [edi + 4], vtable.CShellSettingsBase::CFileViewSettings.1.0
push 0x660bf0
mov dword [edi + 0x28], vtable.CShellSettingsBase::CColumnSettings.0
mov dword [edi + 0x2c], vtable.CShellSettingsBase::CColumnSettings.1.0
call fcn.00562ae0
lea ecx, [ebp - 0x48]
mov dword [edi + 0x34], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x38], 0xfa
mov dword [edi + 0x3c], 0x64
mov dword [edi + 0x40], 0x50
mov dword [edi + 0x44], 0x32
call fcn.005630c0
push str.CShellSettingsBase::CFileViewSettings::CFileViewSettings
lea ecx, [ebp - 0x80]
mov dword [ebp - 4], 0
call fcn.00562ae0
lea ecx, [ebp - 0x80]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 1
mov dword [edi + 0x24], 1
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0xff
mov dword [edi + 0x10], 0xff0000
mov dword [edi + 0x14], 0x808080
mov dword [edi + 0x18], 0xff00ff
call fcn.005630c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00604ed9
mov esp, ebp
pop ebp
ret
Function at 0x4f2660
Capabilities:
Check os version

Disassembly:
sub esp, 0x3c
mov eax, dword [0x6ec7c0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
push str.CWin7TaskbarWrapper::Activate
call fcn.00562ae0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
call esi
mov bl, al
call esi
shr ax, 8
cmp bl, 6
ja 0x4f26a1
jne 0x4f269d
test ax, ax
jne 0x4f26a1
xor esi, esi
jmp 0x4f26d7
mov ecx, dword [edi + 0x84]
lea esi, [edi + 0x84]
test ecx, ecx
je 0x4f26bd
mov dword [esi], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push esi
push 0x66397c
push 0x17
push 0
push 0x693bd0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, 1
lea ecx, [esp + 0xc]
call fcn.005630c0
mov ecx, dword [esp + 0x44]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00604ed9
add esp, 0x3c
ret
Function at 0x4f2a60
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x150]
sub esp, 0x150
push 0xffffffffffffffff
push 0x62a445
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x6ec7c0]
xor eax, ebp
mov dword [ebp + 0x14c], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x158]
lea ecx, [ebp + 0x114]
mov dword [ebp - 0x18], esi
push str.GetWinVersionString
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.00562ae0
mov ecx, esi
mov dword [ebp - 4], 1
call dword [0x63f5ac]
push 0x110
lea eax, [ebp + 4]
mov dword [ebp - 0x14], 1
push 0
push eax
mov dword [ebp], 0x114
call fcn.0060ddfb
add esp, 0xc
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4f2c90
mov eax, dword [ebp + 0x10]
sub eax, 1
je 0x4f2c03
sub eax, 1
jne 0x4f2c90
push str.Windows
mov ecx, esi
call dword [0x63f5a4]
mov eax, dword [ebp + 4]
add eax, 0xfffffffd
cmp eax, 7
ja case.0x4f2b2d.7
jmp dword [eax*4 + 0x4f2cc0]
push str._NT_3.x
jmp 0x4f2b9f
push str._NT_4.0
jmp 0x4f2b9f
cmp dword [ebp + 8], 0
mov eax, str._2000
mov ecx, 0x663a4c
cmovne eax, ecx
push eax
jmp 0x4f2b9f
mov eax, dword [ebp + 8]
cmp eax, 3
ja case.default.0x4f2b5e
jmp dword [eax*4 + 0x4f2ce0]
push str._Vista
jmp 0x4f2b9f
push 0x663a64
jmp 0x4f2b9f
push 0x663a6c
jmp 0x4f2b9f
push str._8.1
jmp 0x4f2b9f
cmp dword [ebp + 0xc], 0x55f0
mov ecx, esi
jb 0x4f2b93
push 0x663a80
jmp 0x4f2ba1
push 0x663a88
jmp 0x4f2ba1
push str.__NT_based_
mov ecx, esi
call dword [0x63f4bc]
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.004f29c0
add esp, 8
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call dword [0x63f4e0]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [0x63f5a8]
cmp word [ebp + 0x14], 0
je 0x4f2c90
lea ecx, [ebp - 0x10]
call dword [0x63f5ac]
lea eax, [ebp + 0x14]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x10]
push 0x663aa8
push eax
call dword [0x63f5a0]
add esp, 0xc
lea eax, [ebp - 0x10]
jmp 0x4f2c7e
push str.Windows
mov ecx, esi
call dword [0x63f5a4]
mov eax, dword [ebp + 8]
mov ecx, esi
test eax, eax
je 0x4f2c4a
cmp eax, 0xa
je 0x4f2c31
cmp eax, 0x5a
je 0x4f2c2a
push str._9x_Me
jmp 0x4f2c63
push 0x663a08
jmp 0x4f2c63
push 0x6639f4
call dword [0x63f4bc]
cmp word [ebp + 0x14], 0x41
jne 0x4f2c69
push str.__SE_
jmp 0x4f2c61
push 0x6639dc
call dword [0x63f4bc]
cmp word [ebp + 0x14], 0x43
jne 0x4f2c69
push str.__OSR2_
mov ecx, esi
call dword [0x63f4bc]
movzx eax, word [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004f29c0
add esp, 8
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call dword [0x63f4e0]
lea ecx, [ebp - 0x10]
call dword [0x63f5a8]
lea ecx, [ebp + 0x114]
call fcn.005630c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x14c]
xor ecx, ebp
call fcn.00604ed9
lea esp, [ebp + 0x150]
pop ebp
ret
Function at 0x503690
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62bc30
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x6ec7c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x50], esi
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x4c], eax
call fcn.00603bcb
mov dword [esi], vtable.CMemDC.0
mov dword [ebp - 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], vtable.CBitmap.0
lea ebx, [esi + 0x20]
mov byte [ebp - 4], 1
push 0x666d00
lea ecx, [ebp - 0x48]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
call fcn.00562ae0
xor eax, eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], 0
mov ecx, dword [edi + 0xc]
test ecx, ecx
mov byte [ebp - 4], 2
sete al
mov dword [esi + 0x30], eax
test ecx, ecx
jne 0x5037ae
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x50374b
mov eax, dword [edi]
mov ecx, edi
push ebx
call dword [eax + 0x58]
jmp 0x503753
push eax
push ebx
call dword [sym.imp.USER32.dll_CopyRect]
push dword [edi + 4]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, esi
call fcn.00603bc5
mov ecx, dword [ebx + 0xc]
sub ecx, dword [ebx + 4]
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
push ecx
push eax
push dword [edi + 4]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
lea edi, [esi + 0x10]
push eax
mov ecx, edi
call fcn.006038b9
test edi, edi
jne 0x50378d
xor eax, eax
jmp 0x503790
mov eax, dword [edi + 4]
push eax
push dword [esi + 4]
call fcn.00603bdd
push dword [esi + 0x24]
mov dword [esi + 0x18], eax
mov ecx, esi
push dword [ebx]
lea eax, [ebp - 0x5c]
push eax
call fcn.00604586
jmp 0x5037c0
mov ecx, dword [edi + 0xc]
mov dword [esi + 0xc], ecx
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
lea ecx, [ebp - 0x48]
call fcn.005630c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00604ed9
mov esp, ebp
pop ebp
ret 8
Function at 0x507df0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62c12e
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x6ec7c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x68], ebx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x58]
push str.CSCBButton::Paint
mov dword [ebp - 0x5c], esi
call fcn.00562ae0
mov eax, dword [ebx + 8]
mov edx, 0xb
mov ecx, dword [ebx + 0xc]
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
mov dword [ebp - 0x20], eax
add eax, edx
mov dword [ebp - 0x1c], ecx
add ecx, edx
cmp dword [ebx], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
je 0x507e69
push 0x14
call edi
push eax
push 0x10
jmp 0x507e76
cmp dword [ebx + 4], 0
je 0x507e84
push 0x10
call edi
push eax
push 0x14
call edi
push eax
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.00604370
push dword [esi + 8]
call dword [sym.imp.GDI32.dll_GetTextColor]
mov esi, dword [esi]
push 0x12
mov dword [ebp - 0x70], eax
call edi
mov edi, dword [ebp - 0x5c]
mov ecx, edi
push eax
call dword [esi + 0x38]
push 1
mov ecx, edi
call fcn.00603e71
mov ebx, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], vtable.CFont.0
push 0x58
push dword [edi + 8]
mov byte [ebp - 4], 1
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 0x60
push 0x3c
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0
push str.Marlett
push eax
lea ecx, [ebp - 0x64]
call fcn.00604670
mov eax, dword [edi]
lea ecx, [ebp - 0x64]
push ecx
mov ecx, edi
call dword [eax + 0x30]
push 0x662dec
lea ecx, [ebp - 0x6c]
mov edi, eax
call dword [0x63ea98]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x5c]
mov byte [ebp - 4], 2
push dword [eax - 0xc]
mov esi, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
add esi, 2
mov edx, dword [edx]
add ecx, 2
push eax
push esi
mov esi, dword [ebp - 0x5c]
push ecx
mov ecx, esi
call dword [edx + 0x64]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call dword [0x63f5a8]
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x30]
push ebx
mov ecx, esi
call fcn.00603e71
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0x70]
call dword [eax + 0x38]
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], vtable.CFont.0
call fcn.00415590
lea ecx, [ebp - 0x58]
call fcn.005630c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00604ed9
mov esp, ebp
pop ebp
ret 4
Function at 0x521950
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x6ec7c0]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
push 0x3bc
push 0
lea eax, [esi + 0x80]
push eax
call fcn.0060ddfb
push 0x110
lea eax, [esp + 0x18]
mov dword [esi + 0x43c], 0
push 0
push eax
mov dword [esi + 0x440], 1
mov dword [esi + 0x444], 1
mov dword [esi + 0x484], 0
mov dword [esi + 0x488], 1
mov dword [esi + 0x448], 0
mov dword [esi + 0x468], 0
mov dword [esi + 0x480], 0
mov dword [esi + 0x450], 0
mov dword [esi + 0x48c], 0
mov dword [esp + 0x1c], 0x114
call fcn.0060ddfb
add esp, 0x18
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x14], 2
jne 0x521a33
cmp dword [esp + 8], 5
jb 0x521a33
mov dword [esi + 0x44c], 1
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00604ed9
add esp, 0x118
ret
mov ecx, dword [esp + 0x118]
mov dword [esi + 0x44c], 0
pop esi
xor ecx, esp
call fcn.00604ed9
add esp, 0x118
ret

Function at 0x5238b7
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_KillTimer]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xac]
test eax, eax
je 0x5238d5
push eax
push dword [esi + 0x20]
call ebx
mov dword [esi + 0xac], 0
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x5238ef
push eax
push dword [esi + 0x20]
call ebx
mov dword [esi + 0xb0], 0
mov eax, dword [esi + 0xa8]
test eax, eax
je 0x523909
push eax
push dword [esi + 0x20]
call ebx
mov dword [esi + 0xa8], 0
push 0
mov ecx, esi
mov dword [esi + 0xc8], 0
call fcn.00603979
push 0
push dword [esi + 0xd8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
ret

Function at 0x523a50
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 0xd8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
pop esi
jmp fcn.00603b29

Function at 0x5240a0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 0xd8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
pop esi
jmp fcn.00603b23
Function at 0x52aa60
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x630680
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x6ec7c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x60]
push str.CFsBrowserIcons::GetIcon
mov dword [ebp - 0x64], esi
call fcn.00562ae0
test byte [esi + 0x20], 0x10
mov ecx, 0x10
push dword [esi + 0x30]
mov eax, 0x80
mov dword [ebp - 4], 0
cmovne eax, ecx
mov ecx, edi
or eax, 0x60000
push eax
call fcn.004e1960
mov esi, eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x64]
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
mov edx, dword [eax + 0x34]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x68], eax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x52aaf0
sub ecx, dword [ebp - 0x68]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00414450
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 1
je 0x52abc1
push 0
push str._ftype_Plugin__ftype_
lea ecx, [ebp - 0x28]
call fcn.00428ec0
cmp eax, 0xffffffff
je 0x52ab4f
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x64]
push dword [eax + 0x30]
call dword [0x63ea98]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.004e1bb0
lea ecx, [ebp - 0x64]
jmp 0x52abb9
push 0
push str._ftype_Link__ftype_
lea ecx, [ebp - 0x28]
call fcn.00428ec0
cmp eax, 0xffffffff
je 0x52ab85
push 0x64371c
lea ecx, [ebp - 0x64]
call dword [0x63ea98]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.004e1bb0
lea ecx, [ebp - 0x64]
jmp 0x52abb9
push 0
push str._ftype_Message__ftype_
lea ecx, [ebp - 0x28]
call fcn.00428ec0
cmp eax, 0xffffffff
je 0x52abc1
push 0x65f7d4
lea ecx, [ebp - 0x68]
call dword [0x63ea98]
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 4
push eax
mov ecx, edi
call fcn.004e1bb0
lea ecx, [ebp - 0x68]
mov esi, eax
call dword [0x63f5a8]
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x52abfd
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x52abf3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x52abf3
call dword [0x63e2e0]
push ecx
push edx
call fcn.00604b8c
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.005630c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00604ed9
mov esp, ebp
pop ebp
ret 4
Function at 0x558c00
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
movzx ecx, word [edx]
test cx, cx
je 0x558c31
push esi
mov esi, ecx
movzx ecx, si
lea edx, [edx + 2]
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
movzx ecx, word [edx]
mov esi, ecx
test cx, cx
jne 0x558c11
pop esi
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret

Function at 0x565f60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x636af0
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x6ec7c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.CProcessHolder::CProcessHolder
lea ecx, [ebp - 0x114]
call fcn.00562ae0
cmp byte [esi + 8], 0
je 0x566055
push str.CProcessHolder::CloseProcess
lea ecx, [ebp - 0xdc]
call fcn.00562ae0
push 0x7b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.CProcessHolder::WaitForExit
lea ecx, [ebp - 0x80]
call fcn.00562ae0
push str.CProcessHolder::IsProcessStarted
lea ecx, [ebp - 0x48]
call fcn.00562ae0
cmp dword [esi], 0
lea ecx, [ebp - 0x48]
je 0x566021
call fcn.005630c0
push 0x2710
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x566001
mov eax, str.Wait___ok.
jmp 0x56602b
cmp eax, 0x102
jne 0x56600f
mov eax, str.Timeout.
jmp 0x56602b
cmp eax, 0x80
je 0x56607a
cmp eax, 0xffffffff
je 0x5660a8
jmp 0x566026
call fcn.005630c0
mov eax, 0x6793f8
push eax
lea ecx, [ebp - 0x80]
call fcn.00563760
lea ecx, [ebp - 0x80]
call fcn.005630c0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xdc]
mov dword [esi], 0
call fcn.005630c0
lea ecx, [ebp - 0x114]
call fcn.005630c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00604ed9
mov esp, ebp
pop ebp
ret
push 0x678de0
lea ecx, [ebp - 0x80]
call fcn.00563760
push 0
push 0
push 0
push str.Wait_abandoned.
lea ecx, [ebp - 0x34]
call fcn.005652e0
push 0x6b1e48
lea eax, [ebp - 0x34]
push eax
call fcn.0060dddd
push 0x678e38
lea ecx, [ebp - 0x80]
call fcn.00563760
push 0
push 0
push 0
push str.Wait_failed.
lea ecx, [ebp - 0xa4]
call fcn.005652e0
push 0x6b1e48
lea eax, [ebp - 0xa4]
push eax
call fcn.0060dddd
int3