joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f478c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x8c], 0
jne 0x4f482f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00522390
mov ecx, eax
mov dl, 1
mov eax, dword [0x480b20]
call fcn.0051b138
mov edx, dword [ebp - 4]
mov dword [edx + 0x8c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0048610c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + 0x2a4], eax
mov dword [edx + 0x2a0], 0x4f3fd8
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
call fcn.00522390
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
call fcn.00522390
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
cmp dword [eax + 0x9c], 0
jne 0x4f48c9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00522390
mov ecx, eax
mov dl, 1
mov eax, dword [0x480b20]
call fcn.0051b138
mov edx, dword [ebp - 4]
mov dword [edx + 0x9c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.0048610c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [eax + 0x2a4], edx
mov dword [eax + 0x2a0], 0x4f4048
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.00522390
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.00522390
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
cmp dword [eax + 0x94], 0
jne 0x4f494f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00522390
mov ecx, eax
mov dl, 1
mov eax, dword [0x48155c]
call fcn.0051b138
mov edx, dword [ebp - 4]
mov dword [edx + 0x94], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x278], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.00522390
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.00522390
push eax
call sub.user32.dll_ShowWindow
mov esp, ebp
pop ebp
ret
Function at 0x4fe440
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
mov dword [ebp - 8], edx
mov word [ebp - 2], ax
mov eax, dword [ebp - 8]
call fcn.00407614
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4fe4a7
push pe_nt_image_headers32
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x4fe49f
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x20c]
mov ecx, pe_nt_image_headers32
call fcn.004082b8
jmp 0x4fe4a7
mov eax, dword [ebp - 8]
call fcn.00407614
mov esp, ebp
pop ebp
ret
Function at 0x504cc0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x504e3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x5584e8], 0
mov word [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x45b72c]
call fcn.0045c878
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x504e13
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0045c960
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x2c]
mov ecx, 0xa
call fcn.004082b8
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov edx, 0x504e54
call fcn.00408468
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.0045cbec
test al, al
je 0x504dfd
lea ecx, [ebp - 4]
mov edx, 0x504ec8
mov eax, dword [ebp - 0xc]
call fcn.0045d474
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042721c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x504dfd
xor eax, eax
push ebp
push 0x504df6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x504ee0
mov eax, dword [ebp - 8]
push eax
call fcn.0040e8ac
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x504ddf
call dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x504ddf
mov eax, dword [ebp + 8]
push eax
call fcn.00504c4c
pop ecx
test eax, eax
je 0x504dc6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
jmp 0x504dcf
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 1
cmp eax, 1
sete byte [0x5584e8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504dfd
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504e1a
mov eax, dword [ebp - 0xc]
call fcn.0040598c
ret

Function at 0x504f08
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
push 0xa5
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x504f4d
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [0x5584e4]
je 0x504f45
push ebp
call fcn.00504cc0
pop ecx
mov eax, dword [ebp - 8]
mov dword [0x5584e4], eax
mov al, byte [0x5584e8]
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x504f54
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
mov al, byte [ebp - 0x10]
mov word [ebp - 2], ax
cmp word [ebp - 2], 0
je 0x504fa5
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x504f87
add word [ebp - 2], 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x504f99
add word [ebp - 2], 0x4000
test byte [ebp - 9], 0x20
je 0x504fa5
add word [ebp - 2], 0x8000
mov ax, word [ebp - 2]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5132f8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x55e318], 0
je 0x513445
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x558c60]
mov edx, dword [edx]
xor al, byte [edx + 0xc0]
je 0x513445
mov eax, dword [0x55e31c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x55e318]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x513414
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x55e318]
call fcn.0044550c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x513408
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1f2], 0
je 0x513408
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x68]
test al, al
je 0x513408
mov eax, dword [ebp - 0x14]
call fcn.00522390
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x513408
push ebp
call fcn.005132ac
pop ecx
test al, al
jne 0x513408
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.00405ce8
test al, al
je 0x513408
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x30]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00405ce8
cmp byte [ebp - 1], 0
je 0x513408
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x30]
call fcn.0040cdb4
test al, al
je 0x513408
mov edx, dword [ebp - 0x14]
mov eax, dword [0x55e31c]
call fcn.005126c4
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x513364
mov eax, dword [0x55e31c]
cmp dword [eax + 8], 0
jle 0x51342c
mov eax, dword [0x55e31c]
call fcn.005127a0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x513445
push ebp
mov eax, dword [ebp - 0x18]
call fcn.005130e8
pop ecx
test al, al
jne 0x513445
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x51dfec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call sub.user32.dll_GetMessagePos
call fcn.0040cd9c
mov dword [ebp - 0x1c], eax
movsx eax, word [ebp - 0x1c]
mov dword [ebp - 0x24], eax
movsx eax, word [ebp - 0x1a]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.005163c0
cmp dword [ebp - 0xc], 0
jne 0x51e042
push 0
push 0
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0051de1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x51e149
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
je 0x51e074
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x134], eax
jmp 0x51e086
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 8]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0xa]
cmp eax, 0x201
jge 0x51e0c5
add eax, 0xffffff5f
sub eax, 2
jb 0x51e0dd
dec eax
sub eax, 2
jb 0x51e0ef
dec eax
sub eax, 2
jb 0x51e0e6
jmp 0x51e0f8
add eax, 0xfffffdff
sub eax, 2
jb 0x51e0dd
dec eax
sub eax, 2
jb 0x51e0ef
dec eax
sub eax, 2
jb 0x51e0e6
jmp 0x51e0f8
mov byte [ebp - 0x12c], 0
jmp 0x51e0ff
mov byte [ebp - 0x12c], 2
jmp 0x51e0ff
mov byte [ebp - 0x12c], 1
jmp 0x51e0ff
mov byte [ebp - 0x12c], 0
lea eax, [ebp - 0x124]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [ebp - 0x124]
call fcn.004de57c
mov ebx, eax
call fcn.00511e50
or bx, ax
mov word [ebp - 0x12b], bx
lea eax, [ebp - 0x138]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, dword [ebp - 0xc]
call fcn.00518748
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
mov byte [ebp - 0xd], 1
jmp 0x51e14d
mov byte [ebp - 0xd], 0
mov al, byte [ebp - 0xd]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52da34
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004076f8
xor eax, eax
push ebp
push 0x52dc14
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0052c354
test al, al
je 0x52daaf
mov eax, dword [ebp - 8]
call fcn.00408224
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
xor eax, eax
mov al, byte [ebp - 9]
mov ax, word [eax*4 + 0x558674]
push eax
mov eax, dword [ebp - 4]
call fcn.0052d948
push eax
call sub.advapi32.dll_ReportEventW
jmp 0x52dbe9
mov eax, dword [ebp - 4]
call fcn.0052d948
cmp eax, 0xffffffff
je 0x52dbe9
lea eax, [ebp - 0x14]
mov edx, 0x52dc30
call fcn.00407a3c
xor eax, eax
mov al, byte [ebp - 9]
cmp eax, 4
ja case.default.0x52dad7
jmp dword [eax*4 + 0x52dade]
lea eax, [ebp - 0x14]
mov edx, 0x52dc84
call fcn.00408410
jmp 0x52db4a
lea eax, [ebp - 0x14]
mov edx, 0x52dc9c
call fcn.00408410
jmp 0x52db4a
lea eax, [ebp - 0x14]
mov edx, 0x52dcb8
call fcn.00408410
jmp 0x52db4a
lea eax, [ebp - 0x14]
mov edx, 0x52dcdc
call fcn.00408410
jmp 0x52db4a
lea eax, [ebp - 0x14]
mov edx, 0x52dd04
call fcn.00408410
jmp 0x52db4a
lea eax, [ebp - 0x14]
mov edx, 0x52dd2c
call fcn.00408410
push dword [ebp - 0x14]
push 0x52dd48
push 0x52dd5c
lea edx, [ebp - 0x24]
mov eax, dword [ebp + 0xc]
call fcn.0041f1e8
push dword [ebp - 0x24]
push 0x52dd48
push 0x52dd80
lea edx, [ebp - 0x28]
mov eax, dword [ebp + 8]
call fcn.0041f1e8
push dword [ebp - 0x28]
push 0x52dd48
push 0x52dd98
push dword [ebp - 8]
push 0x52dd48
push 0x52ddbc
lea eax, [ebp - 0x14]
mov edx, 0xc
call fcn.004084f0
lea eax, [ebp - 0x14]
call fcn.00407bcc
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x52dbc3
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_FlushFileBuffers
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52dc1b
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00407674
lea eax, [ebp - 0x14]
call fcn.00407614
lea eax, [ebp - 8]
call fcn.00407614
ret
Function at 0x52de74
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb64
xor eax, eax
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x494], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x490]
mov edx, dword [0x41936c]
call fcn.004089cc
xor eax, eax
push ebp
push 0x52dff2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x21c]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x52dfb6
mov eax, 0x558688
lea edx, [ebp - 0x21c]
mov ecx, 0x106
call fcn.004082b8
call fcn.00421fcc
fsub dword [0x52e000]
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x494]
call fcn.0052d750
mov eax, dword [ebp - 0x494]
lea edx, [ebp - 0xc]
call fcn.0041e588
lea eax, [ebp - 8]
mov ecx, 0x52e010
mov edx, dword [0x558688]
call fcn.00408468
lea ecx, [ebp - 0x490]
mov edx, 0x1ef
mov eax, dword [ebp - 8]
call fcn.0041faac
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x52dfb6
lea edx, [ebp - 0x498]
mov eax, dword [ebp - 0x47c]
call fcn.0041e588
mov eax, dword [ebp - 0x498]
mov edx, dword [ebp - 0xc]
call fcn.004085a0
jae 0x52df91
push dword [0x558688]
push 0x52e048
push dword [ebp - 0x47c]
lea eax, [ebp - 0x49c]
mov edx, 3
call fcn.004084f0
mov eax, dword [ebp - 0x49c]
call fcn.0041fb3c
lea eax, [ebp - 0x490]
call fcn.0041fafc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x52dfb0
lea eax, [ebp - 0x490]
call fcn.0041fb20
cmp dword [ebp - 0x10], 0
je 0x52df44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52dff9
lea eax, [ebp - 0x49c]
mov edx, 3
call fcn.00407674
lea eax, [ebp - 0x490]
mov edx, dword [0x41936c]
call fcn.00408aa4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00407674
ret

Function at 0x530c08
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [0x558690]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x146]
push eax
call sub.user32.dll_PostThreadMessageW
mov eax, dword [ebp + 8]
cmp byte [eax + 0x145], 0
je 0x530c4b
mov eax, dword [ebp + 8]
mov byte [eax + 0x145], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14a]
push eax
call sub.kernel32.dll_ResumeThread
pop ebp
ret 8

Function at 0x531720
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x88]
mov byte [ebp - 5], al
mov dl, 5
mov eax, dword [ebp - 4]
call fcn.005308d4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x54]
test al, al
je 0x531775
mov dl, 6
mov eax, dword [ebp - 4]
call fcn.005308d4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x62], 0
je 0x531780
mov eax, dword [ebp - 4]
mov byte [eax + 0x145], 1
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SuspendThread
jmp 0x531780
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.005308d4
pop ecx
pop ecx
pop ebp
ret
Function at 0x53575c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x114], 6
setae byte [ebp - 1]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x537c30
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004076f8
mov eax, dword [ebp - 8]
call fcn.004076f8
xor eax, eax
push ebp
push 0x537e43
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 5
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0041f98c
test al, al
je 0x537e19
xor eax, eax
push ebp
push 0x537e0d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 0x10], 0
je 0x537d31
lea eax, [ebp - 0x49]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404f60
xor eax, eax
mov dword [ebp - 0x41], eax
mov dword [ebp - 0x49], 0x3c
mov eax, dword [ebp - 4]
call fcn.00408224
mov dword [ebp - 0x39], eax
mov eax, dword [ebp - 8]
call fcn.00408224
mov dword [ebp - 0x35], eax
mov eax, 0x537e58
mov dword [ebp - 0x3d], eax
cmp byte [ebp + 0x14], 0
je 0x537cdd
xor eax, eax
mov dword [ebp - 0x2d], eax
lea eax, [ebp - 0x49]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x537e03
mov byte [ebp - 0xd], 0
cmp dword [ebp - 0xc], 0
je 0x537e03
cmp dword [ebp - 0x11], 0
je 0x537e03
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x11]
mov dword [eax], edx
cmp byte [ebp + 0xc], 0
je 0x537e03
push 0xffffffffffffffff
mov eax, dword [ebp - 0x11]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x11]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x537e03
lea eax, [ebp - 0x90]
xor ecx, ecx
mov edx, 0x44
call fcn.00404f60
mov dword [ebp - 0x90], 0x44
cmp byte [ebp + 0x14], 0
je 0x537d60
mov dword [ebp - 0x64], 1
mov word [ebp - 0x60], 0
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x90]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push 0x537e70
push dword [ebp - 4]
push 0x537e80
push dword [ebp - 8]
lea eax, [ebp - 0xa4]
mov edx, 4
call fcn.004084f0
mov eax, dword [ebp - 0xa4]
call fcn.00408224
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x537dff
mov byte [ebp - 0xd], 0
cmp byte [ebp + 0xc], 0
je 0x537de4
push 0xffffffffffffffff
mov eax, dword [ebp - 0xa0]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0xa0]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x9c]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp + 8], 0
je 0x537e03
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xa0]
mov ecx, 0x10
call fcn.004046f8
jmp 0x537e03
mov byte [ebp - 0xd], 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x537e1d
mov byte [ebp - 0xd], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537e4a
lea eax, [ebp - 0xa4]
call fcn.00407614
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407674
ret
Function at 0x54111c
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x541124
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x541393
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov al, byte [ebp - 1]
sub al, 2
jae 0x541368
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
lea eax, [ebp - 0x78]
mov edx, 0x5413b0
call fcn.00408468
mov eax, dword [ebp - 0x78]
call fcn.00535d98
cmp byte [ebp - 1], 0
jne 0x54118f
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
lea eax, [ebp - 0x7c]
mov edx, 0x5413e8
call fcn.00408468
mov eax, dword [ebp - 0x7c]
call fcn.00535d98
jmp 0x5411aa
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
lea eax, [ebp - 0x80]
mov edx, 0x541420
call fcn.00408468
mov eax, dword [ebp - 0x80]
call fcn.00535d98
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
jne 0x5411c9
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
lea eax, [ebp - 0x10]
mov edx, dword [0x55e4e8]
call fcn.00408468
jmp 0x5411e7
mov eax, dword [ebp - 8]
push dword [eax + 0xc]
push 0x541454
mov eax, dword [ebp - 8]
push dword [eax + 4]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004084f0
cmp byte [ebp - 1], 1
jne 0x5411fc
lea eax, [ebp - 0x14]
mov edx, 0x541464
call fcn.00407a3c
jmp 0x541209
lea eax, [ebp - 0x14]
mov edx, 0x541494
call fcn.00407a3c
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.0041f98c
test al, al
je 0x54134a
xor eax, eax
push ebp
push 0x541300
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.00404f60
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x101
mov word [ebp - 0x34], 0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0x5414c8
push dword [ebp - 0x14]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.004084f0
mov eax, dword [ebp - 0x84]
call fcn.00408224
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x5412b8
push 0xffffffffffffffff
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_CloseHandle_1
mov byte [ebp - 9], 1
jmp 0x5412f6
push 0x5414d8
push dword [ebp - 0x10]
push 0x5414c8
call sub.kernel32.dll_GetLastError_2
lea edx, [ebp - 0x8c]
call fcn.00423a20
push dword [ebp - 0x8c]
lea eax, [ebp - 0x88]
mov edx, 4
call fcn.004084f0
mov eax, dword [ebp - 0x88]
call fcn.00535d98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x541368
lea eax, [ebp - 0x98]
mov ecx, dword [ebp - 0x10]
mov edx, 0x541568
call fcn.00408468
mov eax, dword [ebp - 0x98]
call fcn.00535d98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54139a
lea eax, [ebp - 0x98]
mov edx, 9
call fcn.00407674
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407674
ret