joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50f874
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5c82f0]
cmp byte [eax + 0xb1], 0
jne 0x50f8ec
cmp dword [0x5c8310], 0
jne 0x50f8a9
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x5bf4c0]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5c8310], eax
cmp dword [0x5c830c], 0
jne 0x50f8c4
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x5c830c], eax
cmp dword [0x5c8314], 0
jne 0x50f8ec
lea eax, [ebp - 4]
push eax
push 0
push 0
mov eax, dword [0x5bf4bc]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x5c8314], eax
pop ecx
pop ebp
ret

Function at 0x50f9ec
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.0050f984
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x50fa0d
xor eax, eax
call fcn.0050f9bc
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x50fa27
mov al, 1
call fcn.0050f9bc
mov esp, ebp
pop ebp
ret

Function at 0x51064c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x178], 0
je 0x51072e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x98], 0
jne 0x510725
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x178]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x51054c
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
cmp dword [eax + 8], 0
je 0x510725
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0xffffffec
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_GetWindowLongW
mov dword [ebp - 0x20], eax
test byte [ebp - 0x20], 8
je 0x5106df
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x510725
mov dword [ebp - 0xc], eax
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.0044877c
push eax
call sub.user32.dll_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x5106f4
mov eax, dword [ebp - 4]
inc dword [eax + 0x98]
mov esp, ebp
pop ebp
ret
Function at 0x5109f8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x5c82f0]
cmp dword [eax + 0x178], 0
je 0x510bb9
cmp byte [ebp - 5], 0
jne 0x510adb
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa0], 0
jne 0x510acd
mov eax, dword [ebp - 4]
call fcn.00514288
push eax
push 0x5108e4
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x510a90
mov eax, dword [0x5c82f0]
cmp byte [eax + 0xd7], 0
je 0x510a90
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
call fcn.00409540
cmp eax, 0
jl 0x510a90
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_ShowWindow
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x510a70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x510acd
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 1
cmc
sbb eax, eax
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.0044877c
push eax
call sub.user32.dll_ShowOwnedPopups
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x510aa5
mov eax, dword [ebp - 4]
inc dword [eax + 0xa0]
jmp 0x510bb9
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa0], 0
jle 0x510bb9
mov eax, dword [ebp - 4]
dec dword [eax + 0xa0]
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa0], 0
jne 0x510bb9
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x510b51
mov eax, dword [0x5c82f0]
cmp byte [eax + 0xd7], 0
je 0x510b51
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
call fcn.00409540
cmp eax, 0
jl 0x510b51
mov dword [ebp - 0xc], eax
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_ShowWindow
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x510b31
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x510b8e
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 1
cmc
sbb eax, eax
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.0044877c
push eax
call sub.user32.dll_ShowOwnedPopups
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x510b66
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, dword [ebp - 4]
add eax, 0xdc
mov ecx, 1
mov edx, dword [0x4ffb24]
call fcn.004096ec
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x5119e4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xb0], 0
je 0x511a6e
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd7], 0
jne 0x511a6e
push pe_nt_image_headers32
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 8]
call fcn.00407880
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x511a55
mov eax, dword [ebp - 0x10]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x511a7f
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x90]
call fcn.00407ad8
jmp 0x511a7f
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x90]
call fcn.00407ad8
mov esp, ebp
pop ebp
ret

Function at 0x513844
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x88], 0
je 0x5138ce
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.00547294
test al, al
je 0x5138ce
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.00546cfc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5138ce
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
mov edx, dword [eax]
call dword [edx + 0x108]
test al, al
je 0x5138be
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.00546cfc
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.0053b20c
jmp 0x5138ce
mov cl, 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x78]
mov eax, dword [ebp - 4]
call fcn.0051360c
pop ecx
pop ebp
ret
Function at 0x519094
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x8c], 0
jne 0x519137
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00546cfc
mov ecx, eax
mov dl, 1
mov eax, dword [0x4881d0]
call fcn.0053fa7c
mov edx, dword [ebp - 4]
mov dword [edx + 0x8c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0048d7bc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + 0x2a4], eax
mov dword [edx + 0x2a0], 0x5188e0
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
call fcn.00546cfc
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
call fcn.00546cfc
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
cmp dword [eax + 0x9c], 0
jne 0x5191d1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00546cfc
mov ecx, eax
mov dl, 1
mov eax, dword [0x4881d0]
call fcn.0053fa7c
mov edx, dword [ebp - 4]
mov dword [edx + 0x9c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.0048d7bc
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [eax + 0x2a4], edx
mov dword [eax + 0x2a0], 0x518950
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.00546cfc
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.00546cfc
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
cmp dword [eax + 0x94], 0
jne 0x519257
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00546cfc
mov ecx, eax
mov dl, 1
mov eax, dword [0x488c0c]
call fcn.0053fa7c
mov edx, dword [ebp - 4]
mov dword [edx + 0x94], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x278], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.00546cfc
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.00546cfc
push eax
call sub.user32.dll_ShowWindow
mov esp, ebp
pop ebp
ret
Function at 0x522d48
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
mov dword [ebp - 8], edx
mov word [ebp - 2], ax
mov eax, dword [ebp - 8]
call fcn.004076f8
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x522daf
push pe_nt_image_headers32
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x522da7
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x20c]
mov ecx, pe_nt_image_headers32
call fcn.004083f0
jmp 0x522daf
mov eax, dword [ebp - 8]
call fcn.004076f8
mov esp, ebp
pop ebp
ret
Function at 0x5295c8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x529745
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x5bf650], 0
mov word [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x4626ec]
call fcn.00463838
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x52971b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00463920
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x2c]
mov ecx, 0xa
call fcn.004083f0
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov edx, 0x52975c
call fcn.004085a0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.00463bac
test al, al
je 0x529705
lea ecx, [ebp - 4]
mov edx, 0x5297d0
mov eax, dword [ebp - 0xc]
call fcn.00464434
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042a48c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x529705
xor eax, eax
push ebp
push 0x5296fe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x5297e8
mov eax, dword [ebp - 8]
push eax
call fcn.0040f838
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x5296e7
call dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5296e7
mov eax, dword [ebp + 8]
push eax
call fcn.00529554
pop ecx
test eax, eax
je 0x5296ce
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
jmp 0x5296d7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 1
cmp eax, 1
sete byte [0x5bf650]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529705
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529722
mov eax, dword [ebp - 0xc]
call fcn.00405a54
ret

Function at 0x529810
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
push 0xa5
mov eax, dword [0x5c1d9c]
mov eax, dword [eax]
call eax
test ax, ax
jge 0x529859
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [0x5bf64c]
je 0x529851
push ebp
call fcn.005295c8
pop ecx
mov eax, dword [ebp - 8]
mov dword [0x5bf64c], eax
mov al, byte [0x5bf650]
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x542958
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call sub.user32.dll_GetMessagePos
call fcn.0040d128
mov dword [ebp - 0x1c], eax
movsx eax, word [ebp - 0x1c]
mov dword [ebp - 0x24], eax
movsx eax, word [ebp - 0x1a]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.0053ad04
cmp dword [ebp - 0xc], 0
jne 0x5429ae
push 0
push 0
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.00542788
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x542ab5
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
je 0x5429e0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x134], eax
jmp 0x5429f2
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 8]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0xa]
cmp eax, 0x201
jge 0x542a31
add eax, 0xffffff5f
sub eax, 2
jb 0x542a49
dec eax
sub eax, 2
jb 0x542a5b
dec eax
sub eax, 2
jb 0x542a52
jmp 0x542a64
add eax, 0xfffffdff
sub eax, 2
jb 0x542a49
dec eax
sub eax, 2
jb 0x542a5b
dec eax
sub eax, 2
jb 0x542a52
jmp 0x542a64
mov byte [ebp - 0x12c], 0
jmp 0x542a6b
mov byte [ebp - 0x12c], 2
jmp 0x542a6b
mov byte [ebp - 0x12c], 1
jmp 0x542a6b
mov byte [ebp - 0x12c], 0
lea eax, [ebp - 0x124]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [ebp - 0x124]
call fcn.00502e78
mov ebx, eax
call fcn.00536790
or bx, ax
mov word [ebp - 0x12b], bx
lea eax, [ebp - 0x138]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, dword [ebp - 0xc]
call fcn.0053d08c
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
mov byte [ebp - 0xd], 1
jmp 0x542ab9
mov byte [ebp - 0xd], 0
mov al, byte [ebp - 0xd]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x552384
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004077dc
xor eax, eax
push ebp
push 0x552564
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00550ca4
test al, al
je 0x5523ff
mov eax, dword [ebp - 8]
call fcn.00408344
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
xor eax, eax
mov al, byte [ebp - 9]
mov ax, word [eax*4 + 0x5bf7dc]
push eax
mov eax, dword [ebp - 4]
call fcn.00552298
push eax
call sub.advapi32.dll_ReportEventW
jmp 0x552539
mov eax, dword [ebp - 4]
call fcn.00552298
cmp eax, 0xffffffff
je 0x552539
lea eax, [ebp - 0x14]
mov edx, 0x552580
call fcn.00407b20
xor eax, eax
mov al, byte [ebp - 9]
cmp eax, 4
ja case.default.0x552427
jmp dword [eax*4 + 0x55242e]
lea eax, [ebp - 0x14]
mov edx, 0x5525d4
call fcn.00408548
jmp 0x55249a
lea eax, [ebp - 0x14]
mov edx, 0x5525ec
call fcn.00408548
jmp 0x55249a
lea eax, [ebp - 0x14]
mov edx, 0x552608
call fcn.00408548
jmp 0x55249a
lea eax, [ebp - 0x14]
mov edx, 0x55262c
call fcn.00408548
jmp 0x55249a
lea eax, [ebp - 0x14]
mov edx, 0x552654
call fcn.00408548
jmp 0x55249a
lea eax, [ebp - 0x14]
mov edx, 0x55267c
call fcn.00408548
push dword [ebp - 0x14]
push 0x552698
push 0x5526ac
lea edx, [ebp - 0x24]
mov eax, dword [ebp + 0xc]
call fcn.00420be4
push dword [ebp - 0x24]
push 0x552698
push 0x5526d0
lea edx, [ebp - 0x28]
mov eax, dword [ebp + 8]
call fcn.00420be4
push dword [ebp - 0x28]
push 0x552698
push 0x5526e8
push dword [ebp - 8]
push 0x552698
push 0x55270c
lea eax, [ebp - 0x14]
mov edx, 0xc
call fcn.00408628
lea eax, [ebp - 0x14]
call fcn.00407cb0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x552513
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_FlushFileBuffers
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55256b
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00407758
lea eax, [ebp - 0x14]
call fcn.004076f8
lea eax, [ebp - 8]
call fcn.004076f8
ret
Function at 0x5527c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb64
xor eax, eax
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x494], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x490]
mov edx, dword [0x41a9a8]
call fcn.00408b04
xor eax, eax
push ebp
push 0x552942
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x21c]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x552906
mov eax, 0x5bf7f0
lea edx, [ebp - 0x21c]
mov ecx, 0x106
call fcn.004083f0
call fcn.00424c44
fsub dword [0x552950]
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x494]
call fcn.005520a0
mov eax, dword [ebp - 0x494]
lea edx, [ebp - 0xc]
call fcn.0041ff84
lea eax, [ebp - 8]
mov ecx, 0x552960
mov edx, dword [0x5bf7f0]
call fcn.004085a0
lea ecx, [ebp - 0x490]
mov edx, 0x1ef
mov eax, dword [ebp - 8]
call fcn.00421568
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x552906
lea edx, [ebp - 0x498]
mov eax, dword [ebp - 0x47c]
call fcn.0041ff84
mov eax, dword [ebp - 0x498]
mov edx, dword [ebp - 0xc]
call fcn.004086d8
jae 0x5528e1
push dword [0x5bf7f0]
push 0x552998
push dword [ebp - 0x47c]
lea eax, [ebp - 0x49c]
mov edx, 3
call fcn.00408628
mov eax, dword [ebp - 0x49c]
call fcn.004215f8
lea eax, [ebp - 0x490]
call fcn.004215b8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x552900
lea eax, [ebp - 0x490]
call fcn.004215dc
cmp dword [ebp - 0x10], 0
je 0x552894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x552949
lea eax, [ebp - 0x49c]
mov edx, 3
call fcn.00407758
lea eax, [ebp - 0x490]
mov edx, dword [0x41a9a8]
call fcn.00408bdc
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00407758
ret

Function at 0x555558
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [0x5bf7f8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x146]
push eax
call sub.user32.dll_PostThreadMessageW
mov eax, dword [ebp + 8]
cmp byte [eax + 0x145], 0
je 0x55559b
mov eax, dword [ebp + 8]
mov byte [eax + 0x145], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14a]
push eax
call sub.kernel32.dll_ResumeThread
pop ebp
ret 8

Function at 0x556070
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x88]
mov byte [ebp - 5], al
mov dl, 5
mov eax, dword [ebp - 4]
call fcn.00555224
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x54]
test al, al
je 0x5560c5
mov dl, 6
mov eax, dword [ebp - 4]
call fcn.00555224
mov eax, dword [ebp - 4]
cmp byte [eax + 0x62], 0
je 0x5560d0
mov eax, dword [ebp - 4]
mov byte [eax + 0x145], 1
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SuspendThread
jmp 0x5560d0
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.00555224
pop ecx
pop ecx
pop ebp
ret
Function at 0x560868
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
test dl, dl
je 0x56087a
add esp, 0xfffffff0
call fcn.00406060
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00405a24
movzx edx, word [ebp + 8]
mov eax, dword [ebp - 0xc]
call fcn.004211e4
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0xffffffff
jne 0x5608ad
call fcn.00429980
mov ax, word [ebp + 8]
and ax, 0xf
cmp ax, 2
jne 0x5608cb
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x14], 1
jmp 0x5608d9
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x14], 4
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
jne 0x56091f
mov eax, dword [ebp - 4]
call fcn.00560a08
mov ecx, dword [0x5c2014]
mov dl, 1
mov eax, dword [0x56055c]
call fcn.00572104
call fcn.00406dd4
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x56095d
mov eax, dword [ebp - 4]
call fcn.00560a08
mov ecx, dword [0x5c2490]
mov dl, 1
mov eax, dword [0x560614]
call fcn.00572104
call fcn.00406dd4
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x56099c
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebp - 4]
call fcn.00560a08
mov ecx, dword [0x5c22cc]
mov dl, 1
mov eax, dword [0x560614]
call fcn.00572104
call fcn.00406dd4
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0044da2c
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x5609c2
call fcn.004060b8
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x560c44
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x560c76
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x560c6b
test byte [ebp - 0xc], 0x10
je 0x560c6f
xor eax, eax
jmp 0x560c71
mov al, 1
mov byte [ebp - 5], al
jmp 0x560c7a
mov byte [ebp - 5], 0
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret