joyce8/EMBER2024-capa huggingface dataset:
Function at 0x506dd0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [ebp - 0x10], 0
call fcn.004a75f0
cmp al, 0
je 0x506e01
call fcn.004a7620
mov dword [ebp - 0x10], eax
jmp 0x506e20
mov dword [0x579f3c], 0
push 0
push 0x5037a0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x579f3c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
push str.HWND
call fcn.0040e8d0
pop ecx
push eax
push str.HWND
lea ecx, [ebp - 8]
call fcn.0040cb20
cmp dword [ebp - 8], 0
je 0x506e52
mov ebx, dword [ebp - 8]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
call fcn.0040ece0
pop ecx
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00503700
pop ecx
pop ecx
cmp dword [ebp - 0xc], 0
je 0x506e7d
mov ecx, dword [ebp - 0xc]
call fcn.0040c8f0
cmp dword [ebp - 8], 0
je 0x506e8b
mov ecx, dword [ebp - 8]
call fcn.0040c8f0
lea esp, [ebp - 4]
pop ebx
pop ebp
ret

Function at 0x514180
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 8
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
cmp byte [0x5acd44], 0
jne 0x5141c4
mov dword [0x5acd54], 0
push 0x5acd48
push 0x401fb0
push 0x5acd54
call fcn.0053b120
add esp, 0xc
mov byte [0x5acd44], 1
cmp byte [0x5acd5c], 0
jne 0x5141e0
mov edx, dword [0x5494f8]
mov dword [0x5acd58], edx
mov byte [0x5acd5c], 1
mov ebx, dword [0x5acd54]
mov eax, dword [ebp + 8]
mov edx, dword [eax]
cmp ebx, edx
jne 0x5141fa
mov eax, dword [0x5acd58]
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
mov eax, dword [0x5494f4]
mov dword [ebp - 8], eax
mov dword [ebp - 8], 0x500
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 0xc], eax
movzx eax, word [ebp - 0xc]
sub eax, 0x404
je 0x514242
sub eax, 0xd
je 0x514239
sub eax, 0x3f3
je 0x514242
sub eax, 0x400
je 0x514242
sub eax, 0x400
je 0x514242
jmp 0x514249
mov dword [ebp - 8], 0xa01
jmp 0x514249
mov dword [ebp - 8], 0x423
mov eax, dword [ebp - 8]
mov dword [0x5acd58], eax
mov eax, dword [ebp - 8]
lea esp, [ebp - 4]
pop ebx
pop ebp
ret

Function at 0x514300
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [ebp - 8], 0x500
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 0xc], eax
movzx eax, word [ebp - 0xc]
sub eax, 0x404
je 0x514356
sub eax, 0xd
je 0x51434d
sub eax, 0x3f3
je 0x514356
sub eax, 0x400
je 0x514356
sub eax, 0x400
je 0x514356
jmp 0x51435d
mov dword [ebp - 8], 0xa01
jmp 0x51435d
mov dword [ebp - 8], 0x423
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x514370
mov edx, dword [ebp - 4]
inc dword [edx]
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00513f70
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x514390
mov ecx, dword [ebp - 4]
call fcn.0040c8f0
mov eax, dword [ebp + 8]
leave
ret
Function at 0x51d1f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, 0xcccccccc
mov dword [esp], eax
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 0
je 0x51d21b
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
mov dword [ebp - 4], edx
jmp 0x51d229
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
mov dword [ebp - 4], edx
test dword [ebp - 4], 0x8000
je 0x51d239
mov eax, 1
leave
ret
mov eax, 0
leave
ret

Function at 0x51d2f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop ecx
mov dword [ebp - 8], 0
call fcn.0052fe80
cmp al, 0
je 0x51d374
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
push dword [ebp - 0x14]
call fcn.0053fd10
pop ecx
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
call fcn.0040cbb0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
call fcn.0040cda0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
call fcn.0040d2e0
cmp dword [ebp - 0x10], 0
je 0x51d364
mov ecx, dword [ebp - 0x10]
call fcn.0040c8f0
cmp dword [ebp - 0xc], 0
je 0x51d3a3
mov ecx, dword [ebp - 0xc]
call fcn.0040c8f0
jmp 0x51d3a3
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
call fcn.0053ffa0
pop ecx
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 8]
call fcn.0040cb20
call fcn.00514260
cmp dword [ebp - 8], 0
je 0x51d3a3
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
lea ecx, [ebp - 8]
call fcn.0040cd50
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x51d3bb
mov ecx, dword [ebp - 8]
call fcn.0040c8f0
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x51d430
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc18
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0x306
rep stosd dword es:[edi], eax
pop edi
pop ecx
cmp dword [ebp + 0xc], 0
jne 0x51d45f
mov eax, 0
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
call fcn.0052fe80
cmp al, 0
je 0x51d4f9
push 0x400
lea eax, [ebp - 0x404]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040c990
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0xc18], eax
mov dword [ebp - 0x408], 0
cmp dword [ebp - 0xc18], 0
jle 0x51d4d0
push dword [ebp - 0xc18]
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x408]
call fcn.0040cb20
cmp dword [ebp - 0x408], 0
je 0x51d4d0
mov ebx, dword [ebp - 0x408]
mov edx, dword [0x5494f8]
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0x408]
call fcn.0040cd50
mov ebx, eax
cmp dword [ebp - 0x408], 0
je 0x51d4f1
mov ecx, dword [ebp - 0x408]
call fcn.0040c8f0
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
mov dword [ebp - 0xc0c], 0
cmp dword [ebp - 0xc0c], 0
je 0x51d517
mov ecx, dword [ebp - 0xc0c]
call fcn.0040c8f0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc0c], eax
lea eax, [ebp - 0xc14]
push eax
lea ecx, [ebp - 0xc0c]
call fcn.0040cf40
push 0x400
lea eax, [ebp - 0xc08]
push eax
lea ecx, [ebp - 0xc14]
call fcn.0040d280
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0xc1c], eax
cmp dword [ebp - 0xc14], 0
je 0x51d56a
mov ecx, dword [ebp - 0xc14]
call fcn.0040c8f0
mov dword [ebp - 0xc10], 0
cmp dword [ebp - 0xc1c], 0
jle 0x51d5ad
push dword [ebp - 0xc1c]
lea eax, [ebp - 0xc08]
push eax
lea ecx, [ebp - 0xc10]
call fcn.0040cbb0
cmp dword [ebp - 0xc10], 0
je 0x51d5ad
mov ebx, dword [ebp - 0xc10]
mov edx, dword [0x549500]
mov dword [ebx + 0x10], edx
lea ecx, [ebp - 0xc10]
call fcn.0040cd50
mov ebx, eax
cmp dword [ebp - 0xc10], 0
je 0x51d5ce
mov ecx, dword [ebp - 0xc10]
call fcn.0040c8f0
cmp dword [ebp - 0xc0c], 0
je 0x51d5e2
mov ecx, dword [ebp - 0xc0c]
call fcn.0040c8f0
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x51d5f0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop ecx
cmp dword [ebp + 0xc], 0
jne 0x51d611
leave
ret
call fcn.0052fe80
cmp al, 0
je 0x51d679
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x51d62b
mov edx, dword [ebp - 4]
inc dword [edx]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x51d63c
mov edx, dword [ebp - 8]
inc dword [edx]
lea ecx, [ebp - 8]
call fcn.0040d250
push eax
lea ecx, [ebp - 4]
call fcn.0040d250
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp dword [ebp - 8], 0
je 0x51d662
mov ecx, dword [ebp - 8]
call fcn.0040c8f0
cmp dword [ebp - 4], 0
je 0x51d703
mov ecx, dword [ebp - 4]
call fcn.0040c8f0
jmp 0x51d703
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x51d68a
mov edx, dword [ebp - 0xc]
inc dword [edx]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
call fcn.0040cf40
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x51d6a7
mov edx, dword [ebp - 0x14]
inc dword [edx]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040cf40
lea ecx, [ebp - 0x18]
call fcn.0040d280
push eax
lea ecx, [ebp - 0x10]
call fcn.0040d280
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp dword [ebp - 0x18], 0
je 0x51d6d9
mov ecx, dword [ebp - 0x18]
call fcn.0040c8f0
cmp dword [ebp - 0x14], 0
je 0x51d6e7
mov ecx, dword [ebp - 0x14]
call fcn.0040c8f0
cmp dword [ebp - 0x10], 0
je 0x51d6f5
mov ecx, dword [ebp - 0x10]
call fcn.0040c8f0
cmp dword [ebp - 0xc], 0
je 0x51d703
mov ecx, dword [ebp - 0xc]
call fcn.0040c8f0
leave
ret
Function at 0x520320
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop ecx
mov dword [ebp - 0x18], ecx
push 0x58b4fc
call sym.X86RunHoudini.exe_CreateInstance
pop ecx
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 0x18]
mov dword [edx + 0x18], eax
push 0x58b594
call sym.X86RunHoudini.exe_CreateInstance
pop ecx
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [edx + 0x18], eax
push 0x58b62c
call sym.X86RunHoudini.exe_CreateInstance
pop ecx
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp - 0x18]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x50], 1
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x24], 0
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x34], 0
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x35], 0
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x36], 0
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x44], 1
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x48], 0
mov dword [0x58b6c4], 0
mov dword [0x58b6c8], 0
mov dword [0x58b6cc], 0
call fcn.00471210
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5204b8
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5204b8
call fcn.0052fe80
cmp al, 0
je 0x520464
mov edx, dword [ebp - 8]
add edx, 1
lea edx, [edx + edx]
push edx
call fcn.0053b090
pop ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
add eax, 1
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
add ecx, 0x28
call fcn.0040cbb0
push dword [ebp - 0xc]
call fcn.0053b0a0
pop ecx
jmp 0x5204b8
mov eax, dword [ebp - 8]
add eax, 1
push eax
call fcn.0053b090
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, 1
push eax
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push dword [ebp - 8]
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
add ecx, 0x28
call fcn.0040cb20
call fcn.00514260
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x28], 0
je 0x5204af
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x28]
mov dword [edx + 0x10], eax
push dword [ebp - 0x14]
call fcn.0053b0a0
pop ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x50], 0
jne 0x5204ca
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x4c], 1
jmp 0x5204d1
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x4c], 0
leave
ret
Function at 0x527ff0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0x50
push dword [ebp + 8]
push 0x40000038
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x51
push eax
push 0x40000039
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0xa2
push eax
push 0x4000003a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0xf3
push eax
push 0x4000003b
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x144
push eax
push 0x4000003c
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x195
push eax
push 0x4000003d
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x1e6
push eax
push 0x4000003e
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x237
push eax
push 0x4000003f
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x288
push eax
push 0x40000040
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x2d9
push eax
push 0x40000041
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x32a
push eax
push 0x40000042
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x50
mov eax, dword [ebp + 8]
add eax, 0x37b
push eax
push 0x40000043
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov eax, dword [ebp + 8]
mov byte [eax + 3], 0
push dword [ebp + 8]
call fcn.00540470
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x54], 0
mov eax, dword [ebp + 8]
add eax, 0x51
push eax
call fcn.00540470
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0xa5], 0
mov eax, dword [ebp + 8]
add eax, 0xa2
push eax
call fcn.00540470
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0xf6], 0
mov eax, dword [ebp + 8]
add eax, 0xf3
push eax
call fcn.00540470
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x147], 0
mov eax, dword [ebp + 8]
add eax, 0x144
push eax
call fcn.00540470
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x198], 0
mov eax, dword [ebp + 8]
add eax, 0x195
push eax
call fcn.00540470
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x1e9], 0
mov eax, dword [ebp + 8]
add eax, 0x1e6
push eax
call fcn.00540470
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x23a], 0
mov eax, dword [ebp + 8]
add eax, 0x237
push eax
call fcn.00540470
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x28b], 0
mov eax, dword [ebp + 8]
add eax, 0x288
push eax
call fcn.00540470
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x2dc], 0
mov eax, dword [ebp + 8]
add eax, 0x2d9
push eax
call fcn.00540470
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x32d], 0
mov eax, dword [ebp + 8]
add eax, 0x32a
push eax
call fcn.00540470
pop ecx
mov eax, dword [ebp + 8]
mov byte [eax + 0x37e], 0
mov eax, dword [ebp + 8]
add eax, 0x37b
push eax
call fcn.00540470
pop ecx
leave
ret
Function at 0x532e00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, 0xcccccccc
mov dword [esp], eax
push dword [ebp + 0xc]
call sym.X86RunHoudini.exe_ConvertToWin32KeyCode
pop ecx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp ax, 0
jge 0x532e32
mov eax, 1
leave
ret
mov eax, 0
leave
ret

Function at 0x532fa0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
sub esp, 0x78
push ecx
lea edi, [esp + 4]
mov eax, 0xcccccccc
mov ecx, 0x1e
rep stosd dword es:[edi], eax
pop ecx
push dword [ebp + 0xc]
call fcn.00532e40
pop ecx
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x532fd6
mov eax, dword [ebp - 0x70]
lea esp, [ebp - 8]
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0xc], 0
push dword [ebp + 0xc]
call sym.X86RunHoudini.exe_ConvertToWin32KeyCode
pop ecx
mov dword [ebp - 0x74], eax
push 0
movsx eax, word [ebp - 0x74]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 0x78], eax
shl dword [ebp - 0x78], 0x10
call fcn.0052fe80
cmp al, 0
je 0x533038
lea edi, [ebp - 0x4c]
mov eax, 0
mov ecx, 0x10
rep stosd dword es:[edi], eax
push 0x20
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
mov dword [ebp - 0x7c], eax
push dword [ebp - 0x7c]
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xc]
call fcn.0040cbb0
jmp 0x533079
lea edi, [ebp - 0x6c]
mov eax, 0
mov ecx, 8
rep stosd dword es:[edi], eax
push 0x20
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
mov dword [ebp - 0x80], eax
push dword [ebp - 0x80]
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0xc]
call fcn.0040cb20
call fcn.00514260
cmp dword [ebp - 0xc], 0
je 0x533079
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x10], eax
lea ecx, [ebp - 0xc]
call fcn.0040cd50
mov ebx, eax
cmp dword [ebp - 0xc], 0
je 0x533091
mov ecx, dword [ebp - 0xc]
call fcn.0040c8f0
mov eax, ebx
lea esp, [ebp - 8]
pop edi
pop ebx
pop ebp
ret
Function at 0x538cb0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
je 0x538cd5
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [edx + 0xc]
jmp 0x538cda
mov eax, 0
cmp eax, 0
jne 0x538ceb
push 0x6a
mov ecx, dword [ebp - 4]
call fcn.00539630
leave
ret
mov ecx, dword [ebp - 4]
add ecx, 0x3c
call fcn.0040d250
push eax
push 0x8010
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x538d3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x538d3e
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x69
mov ecx, dword [ebp - 4]
call fcn.00539630
leave
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x14], 1
push str.ApplicationFree
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], eax
push 0x8010
push 0
push 0
push 2
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
push str.ApplicationExecute
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
push str.ApplicationDone
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 4]
cmp edx, 0
je 0x538db2
add edx, 4
mov edx, edx
push edx
call fcn.00539770
pop ecx
leave
ret
Function at 0x53bbf0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x5ae92c]
sub esp, 0x104
test eax, eax
jle 0x53bc0f
inc eax
mov dword [0x5ae92c], eax
xor ax, ax
add esp, 0x104
ret
push esi
push str.QuickTime.qts
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x53bc45
lea ecx, [esp + 4]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x53bc45
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
jmp 0x53bcc4
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x53bcc4
push ebp
push edi
mov edi, 0x593b3c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.QuickTime.qts
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov esi, eax
pop ebp
test esi, esi
mov dword [0x5ae930], esi
jne 0x53bcde
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xfffff7d3
jmp 0x53bd5f
push str._CallComponentFunctionWithStorage
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
mov dword [0x593aec], eax
je 0x53bd5a
mov ecx, dword [0x5ae930]
push str._CallComponent
push ecx
call esi
test eax, eax
mov dword [0x593ae8], eax
je 0x53bd5a
mov edx, dword [0x5ae930]
push str.theQuickTimeDispatcher
push edx
call esi
test eax, eax
mov dword [0x593ae4], eax
je 0x53bd5a
mov eax, dword [esp + 0x10c]
mov dword [0x593ae0], 0
push eax
call fcn.0053ba70
mov esi, eax
add esp, 4
test si, si
jne 0x53bd5f
mov eax, dword [0x5ae92c]
inc eax
mov dword [0x5ae92c], eax
mov ax, si
pop esi
add esp, 0x104
ret
mov esi, 0xfffff7d2
mov eax, dword [0x5ae930]
test eax, eax
je 0x53bd79
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x5ae930], 0
mov eax, 0x53ba90
mov dword [0x593ae0], 0x53bdb0
mov dword [0x593ae8], eax
mov dword [0x593aec], eax
mov dword [0x593ae4], eax
mov ax, si
pop esi
add esp, 0x104
ret
Function at 0x5408e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x595518
push 0x5419a0
push dword fs:[0]
mov dword fs:[0], esp
push eax
push ebx
sub esp, 0x48
mov dword [ebp - 0x14], esp
mov dword [ebp - 4], 0
push ebp
mov eax, 0xffffffff
push eax
push eax
push 0x541be0
push dword fs:[0]
mov dword fs:[0], esp
sub esp, 0x20
and esp, 0xffffffe0
push 0x594548
call fcn.00541c50
pop ecx
call fcn.005415d0
test eax, eax
jne 0x540949
push 0xffffffffffffffff
call fcn.005403d0
pop ecx
push section..CRT
call fcn.00542040
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
test ebx, ebx
je 0x540966
add ebx, dword [0x5b0c64]
lea edx, [ebp - 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test dword [ebp - 0x34], 1
je 0x540980
movzx eax, word [ebp - 0x30]
jmp 0x540985
mov eax, 0xa
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.005403d0
pop ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x5409c4
lea esp, [ebp - 0x18]
pop ebx
pop ecx
pop dword fs:[0]
add esp, 0xc
pop ebp
ret