joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52ab03
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x28], 0
jne 0x52ab50
mov dword [ebp - 0xc], esp
push 0x94cf0000
push 0xfffffff0
push dword [ebp + 8]
call dword [sym.imp.user32.dll_SetWindowLongA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x52ab50
push 6
call fcn.005fffca
add esp, 4
cmp dword [ebp + 0x10], 0
mov eax, 0
sete al
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x52ab90
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push dword [ebp + 8]
call dword [0x7ad415]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x52ab90
push 6
call fcn.005fffca
add esp, 4
cmp dword [ebp + 0x30], 0
jne 0x52aba1
mov dword [ebp + 0x2c], 0x400
cmp dword [ebp + 0x38], 0
jne 0x52abb2
mov dword [ebp + 0x34], 0x300
push 1
push 0x3c
push 1
push dword [ebp + 0x34]
push 1
push dword [ebp + 0x2c]
push 1
push 0x20
call fcn.004f73ef
cmp dword [ebp + 0x18], 0
jne 0x52abe0
mov dword [ebp + 0x14], 0x400
cmp dword [ebp + 0x20], 0
jne 0x52abf1
mov dword [ebp + 0x1c], 0x300
push 0
mov ebx, 0x2d4
call fcn.00607db0
add esp, 4
mov dword [ebp - 0x14], eax
fild dword [ebp - 0x14]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fild dword [ebp + 0x14]
fstp qword [ebp - 0x1c]
fsub qword [ebp - 0x1c]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
fdiv qword [0x76041d]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
call fcn.004c58cd
mov dword [ebp - 4], eax
push 0
mov ebx, 0x2d8
call fcn.00607dc0
add esp, 4
mov dword [ebp - 0x14], eax
fild dword [ebp - 0x14]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fild dword [ebp + 0x1c]
fstp qword [ebp - 0x1c]
fsub qword [ebp - 0x1c]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
fdiv qword [0x76041d]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
call fcn.004c58cd
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.user32.dll_MoveWindow]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x52aca6
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], esp
push 0x760402
push str.Shell_TrayWnd
call dword [sym.imp.user32.dll_FindWindowA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x52accf
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 0
push 0x1f5
push 0x312
push dword [ebp - 0x10]
call dword [0x7ad345]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x52ad03
push 6
call fcn.005fffca
add esp, 4
mov esp, ebp
pop ebp
ret 0x34
Function at 0x52f3b3
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.00601800
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x52f3f8
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.wsock32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x52f40f
mov eax, 0x760402
push eax
push 1
mov ebx, 0x130
call fcn.006015a0
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_GetUserNameA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x52f44b
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x52f479
mov eax, dword [ebp - 4]
test eax, eax
je 0x52f474
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x52f483
mov eax, 0x760402
jmp 0x52f483
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x52f494
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x534958
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
cmp dword [0x7ad21d], 0x5b8d80
jl 0x534982
mov dword [0x7ad21d], 0
push 0x760402
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.004cce90
add esp, 8
cmp eax, 0
je 0x5349df
mov dword [0x7ad21d], 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x5349c5
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [0x7ad221]
test ebx, ebx
je 0x5349d9
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [0x7ad221], eax
push 0x760402
push dword [0x7ad221]
call fcn.004cce90
add esp, 8
cmp eax, 0
jne 0x534a05
mov eax, 0xffffffff
jmp 0x534b61
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00601800
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x534a3a
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 4], eax
cmp dword [0x7ad21d], 0x5b8d80
jge 0x534b57
inc dword [0x7ad21d]
mov dword [ebp - 8], esp
push dword [0x7ad21d]
call dword [sym.imp.user32.dll_IsWindow]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x534a79
push 6
call fcn.005fffca
add esp, 4
test eax, eax
je 0x534b40
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
push dword [0x7ad21d]
call dword [sym.imp.user32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x534aae
push 6
call fcn.005fffca
add esp, 4
push 0x765487
push dword [ebp - 4]
push 0x765487
mov ecx, 3
call fcn.004c5686
add esp, 0xc
mov dword [ebp - 8], eax
push reloc.wsock32.dll_bind
push 0
push 0
push 0
push 0
push 0
push reloc.wsock32.dll_connect
push 0
mov eax, dword [0x7ad221]
test eax, eax
jne 0x534af2
mov eax, 0x760402
push eax
push reloc.wsock32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x534b06
mov eax, 0x760402
push eax
push 4
mov ebx, 0x148
call fcn.00604050
add esp, 0x34
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x534b2c
push ebx
call fcn.005fffbe
add esp, 4
cmp dword [ebp - 0xc], 0xffffffff
je 0x534b40
mov eax, dword [0x7ad21d]
jmp 0x534b61
push 0
mov ebx, 0x350
call fcn.00604120
add esp, 4
jmp 0x534a3e
mov eax, 0xffffffff
jmp 0x534b61
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x534b72
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8

Function at 0x535fa4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 2
push dword [ebp + 8]
call dword [sym.imp.user32.dll_MapVirtualKeyA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x535fdb
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x41
jl 0x535ff9
cmp dword [ebp - 4], 0x5a
jg 0x535ff9
mov eax, 1
jmp 0x535ffe
mov eax, 0
test eax, eax
je 0x53600a
add dword [ebp - 4], 0x20
mov eax, dword [ebp - 4]
jmp 0x536012
mov esp, ebp
pop ebp
ret 4
Function at 0x536ad8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.shlwapi.dll_PathFileExistsA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x536b05
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
mov eax, 0
sete al
jmp 0x536b19
mov esp, ebp
pop ebp
ret 4

Function at 0x537024
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x1bc
call fcn.00603860
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x537069
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x53707a
add eax, 8
push eax
call dword [sym.imp.user32.dll_GetKeyboardState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x537097
push 6
call fcn.005fffca
add esp, 4
test eax, eax
je 0x53720d
cmp dword [ebp + 0xc], 0
je 0x53718a
mov ebx, dword [ebp - 4]
call fcn.004c6a80
push ebx
push ecx
push 0x80000301
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9d4
call fcn.00603b40
add esp, 0x10
and eax, 0xff
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x760425]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.004c58cd
dec eax
jns 0x537101
push 4
call fcn.005fffca
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x537114
push 1
call fcn.005fffca
add esp, 4
add ebx, eax
mov dword [ebp - 0x1c], ebx
push 0x80000601
push 0x40000000
push 0
mov ebx, dword [ebp - 0x1c]
mov al, byte [ebx]
and eax, 0xff
mov dword [ebp - 0x24], eax
fild dword [ebp - 0x24]
fstp qword [ebp - 0x24]
push 0x80000601
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 2
mov ebx, 0x48
call fcn.006034f0
add esp, 0x1c
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
fld qword [ebp - 0x34]
fsub qword [0x760425]
ftst
fnstsw ax
test ah, 1
je 0x537172
fchs
fcomp qword [0x7638dd]
fnstsw ax
test ah, 0x41
mov eax, 0
setne al
jmp 0x537217
mov ebx, dword [ebp - 4]
call fcn.004c6a80
push ebx
push ecx
push 0x80000301
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9d4
call fcn.00603b40
add esp, 0x10
and eax, 0xff
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x760425]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.004c58cd
dec eax
jns 0x5371e2
push 4
call fcn.005fffca
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x5371f5
push 1
call fcn.005fffca
add esp, 4
add ebx, eax
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
cmp byte [ebx], 0x80
mov eax, 0
setae al
jmp 0x537217
mov eax, 0
jmp 0x537217
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x537228
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5372b6
Capabilities:
Swap mouse buttons

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push dword [ebp + 8]
call dword [sym.imp.user32.dll_SwapMouseButton]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x5372e1
push 6
call fcn.005fffca
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x543a70
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jne 0x543a91
mov dword [ebp + 0xc], 0x400
cmp dword [ebp + 0x18], 0
jne 0x543aa2
mov dword [ebp + 0x14], 0x300
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0x760402
call dword [sym.imp.user32.dll_FindWindowA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x543acb
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x94cf0000
push 0xfffffff0
push dword [ebp - 4]
call dword [sym.imp.user32.dll_SetWindowLongA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x543afa
push 6
call fcn.005fffca
add esp, 4
push 1
push 0x3c
push 1
push dword [ebp + 0x14]
push 1
push dword [ebp + 0xc]
push 1
push 0x20
call fcn.004f73ef
mov dword [ebp - 8], esp
push 0x760402
push str.Shell_TrayWnd
call dword [sym.imp.user32.dll_FindWindowA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x543b40
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0
push 0x1f5
push 0x312
push dword [ebp - 0xc]
call dword [0x7ad345]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x543b74
push 6
call fcn.005fffca
add esp, 4
mov esp, ebp
pop ebp
ret 0x14

Function at 0x543bd8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00601800
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x543c1d
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x543c48
push 6
call fcn.005fffca
add esp, 4
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x543c67
mov eax, 0x760402
push eax
push 2
mov ebx, 0x138
call fcn.006015c0
add esp, 0x1c
mov dword [ebp - 8], eax
push 0x760400
push dword [ebp - 8]
call fcn.004cce90
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x543cab
push ebx
call fcn.005fffbe
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x543ce5
push 0x760400
push dword [ebp - 4]
mov ecx, 2
call fcn.004c5686
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x543ce1
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x543d01
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x543d06
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x543d17
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x5465d8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
jne 0x546607
push 0
mov ebx, 0x2d4
call fcn.00607db0
add esp, 4
mov dword [ebp + 0x18], eax
cmp dword [ebp + 0x20], 0
jne 0x546626
push 0
mov ebx, 0x2d8
call fcn.00607dc0
add esp, 4
mov dword [ebp + 0x20], eax
mov ebx, dword [0x7ad241]
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov ebx, dword [0x7ad241]
add ebx, 4
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov ebx, dword [0x7ad241]
add ebx, 8
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov ebx, dword [0x7ad241]
add ebx, 0xc
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0x20]
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov dword [ebp - 8], esp
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x5466fd
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x5466af
push 6
call fcn.005fffca
add esp, 4
mov esp, ebp
pop ebp
ret 0x20
Function at 0x546d84
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 0
push 0x54727e
call dword [sym.imp.user32.dll_EnumWindows]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x546db6
push 6
call fcn.005fffca
add esp, 4
mov eax, dword [0x7ad245]
push eax
mov ebx, eax
call fcn.004c6a80
pop eax
sub ebx, eax
push ecx
push ebx
push eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.005fffc4
add esp, 4
pop esi
mov edi, eax
pop ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
test ecx, ecx
je 0x546e52
push eax
lodsd eax, dword [esi]
push esi
push edi
push ecx
push eax
push 0x14
call fcn.005fffc4
add esp, 4
pop esi
mov edi, eax
push eax
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
lodsd eax, dword [esi]
push esi
push edi
test eax, eax
je 0x546e23
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
stosd dword es:[edi], eax
lodsd eax, dword [esi]
push esi
push edi
test eax, eax
je 0x546e42
push eax
mov ebx, eax
call fcn.004c561b
inc eax
push eax
call fcn.005fffc4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
stosd dword es:[edi], eax
pop eax
pop ecx
pop edi
pop esi
stosd dword es:[edi], eax
dec ecx
jne 0x546dea
pop eax
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x546e73
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x546e6f
imul eax, dword [ebx]
jmp 0x546e64
mov ecx, eax
test ecx, ecx
je 0x546eb6
push ecx
push ebx
mov ebx, dword [ebx]
push ebx
add ebx, 0xc
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x546e91
push ebx
call fcn.005fffbe
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x546ea5
push ebx
call fcn.005fffbe
add esp, 4
pop ebx
call fcn.005fffbe
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x546e79
call fcn.005fffbe
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x7ad245]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x546ee5
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x546ee1
imul eax, dword [ebx]
jmp 0x546ed6
mov ecx, eax
test ecx, ecx
je 0x546f28
push ecx
push ebx
mov ebx, dword [ebx]
push ebx
add ebx, 0xc
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x546f03
push ebx
call fcn.005fffbe
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x546f17
push ebx
call fcn.005fffbe
add esp, 4
pop ebx
call fcn.005fffbe
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x546eeb
call fcn.005fffbe
add esp, 4
mov eax, 0x760403
mov dword [0x7ad245], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.004c6a67
jmp 0x546f49
mov esp, ebp
pop ebp
ret 4
Function at 0x547bbf
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00601800
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x547c06
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00601800
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
test ebx, ebx
je 0x547c43
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
push 0x760400
mov ebx, dword [ebp + 8]
push dword [ebx]
mov ecx, 2
call fcn.004c5686
add esp, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0xff
mov ebx, dword [ebp + 0x14]
push dword [ebx]
mov eax, 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, 0xff
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 0xff
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_GetVolumeInformationA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x547cb5
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x547cc8
push ebx
call fcn.005fffbe
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x547cda
mov eax, dword [ebp - 4]
jmp 0x547d20
mov eax, 0x760402
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x547cf2
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, 0x760402
push eax
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
test ebx, ebx
je 0x547d10
push ebx
call fcn.005fffbe
add esp, 4
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov eax, 0
jmp 0x547d20
mov esp, ebp
pop ebp
ret 0x14

Function at 0x54881f
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push dword [ebp + 8]
call fcn.005488b5
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x40
push 0x1000
push dword [ebp - 4]
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x548872
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x548887
add eax, 8
push eax
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x5488a7
push 6
call fcn.005fffca
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x5488af
mov esp, ebp
pop ebp
ret 4
Function at 0x54ebe9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x14], 1
jne 0x54ec08
mov dword [ebp + 0x14], 0
jmp 0x54ec25
cmp dword [ebp + 0x14], 2
jne 0x54ec1e
mov dword [ebp + 0x14], 7
jmp 0x54ec25
mov dword [ebp + 0x14], 1
mov dword [ebp - 4], esp
push dword [ebp + 0x14]
push 0x760402
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.shell32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x54ec60
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jne 0x54ec7c
mov eax, 0
jmp 0x54ec86
mov eax, 1
jmp 0x54ec86
mov esp, ebp
pop ebp
ret 0x14

Function at 0x54fabd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.kernel32.dll_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x54fb00
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x54fb2a
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x54fb5e
push 6
call fcn.005fffca
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x54fb66
mov esp, ebp
pop ebp
ret 4

Function at 0x552e14
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push dword [ebp + 0x20]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateRemoteThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x552e5e
push 6
call fcn.005fffca
add esp, 4
mov ebx, dword [ebp + 0x18]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push 0xffffffff
mov ebx, dword [ebp + 0x18]
push dword [ebx]
call dword [0x7ad2d9]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x552e8c
push 6
call fcn.005fffca
add esp, 4
mov dword [ebp - 8], esp
lea eax, [ebp - 4]
push eax
mov ebx, dword [ebp + 0x18]
push dword [ebx]
call dword [sym.imp.kernel32.dll_GetExitCodeThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x552eb4
push 6
call fcn.005fffca
add esp, 4
cmp dword [ebp + 0x1c], 0
jne 0x552ed1
mov ebx, dword [ebp + 0x18]
cmp dword [ebx], 0
je 0x552ed1
mov eax, 1
jmp 0x552ed6
mov eax, 0
test eax, eax
je 0x552f02
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 0x18]
push dword [ebx]
call dword [0x7ad2dd]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x552f02
push 6
call fcn.005fffca
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x552f0a
mov esp, ebp
pop ebp
ret 0x20

Function at 0x552f87
Capabilities:
Check for trap flag exception

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
pushfd
or dword [esp], 0x100
popfd
clc
call fcn.00552fac
Function at 0x55764f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x557696
cmp ebx, 0x20
je 0x557696
cmp ebx, 0xffffffe0
je 0x557696
jne 0x55769f
add eax, 1
cmp esi, eax
je 0x5576ac
jne 0x55767b
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x5576b0
jne 0x557677
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4