joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58b108
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0xa0], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x58b210
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x88], 2
sete byte [edi]
mov eax, dword [ebp - 0x94]
test eax, eax
jns 0x58b169
call fcn.004049ac
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 0x90]
test eax, eax
jns 0x58b17d
call fcn.004049ac
mov dword [ebx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jne 0x58b1a3
cmp dword [ebx], 0xa
jne 0x58b1a3
cmp byte [edi], 0
jne 0x58b1a3
cmp dword [ebp - 0x8c], 0x40a08ae
jb 0x58b1a3
mov dword [ebx], 0xb
xor eax, eax
mov dword [esi], eax
mov ebx, 0xa
mov eax, ebx
cdq
push edx
push eax
lea eax, [ebp - 0x9c]
call fcn.0058a178
mov eax, dword [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0x84]
mov ecx, 0x80
call fcn.00405cb4
mov edx, dword [ebp - 0xa0]
pop eax
call fcn.00406020
test eax, eax
je 0x58b1ed
mov dword [esi], ebx
jmp 0x58b1f2
dec ebx
test ebx, ebx
jne 0x58b1ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58b217
lea eax, [ebp - 0xa0]
mov edx, 2
call fcn.00405a68
ret

Function at 0x58ba4c
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffe8
xor ebx, ebx
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x58bac8
lea eax, [esp + 0xc]
push eax
push 0x58bad0
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x58ba84
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x58bac8
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
jne 0x58babd
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x58bac8
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
mov eax, ebx
add esp, 0x18
pop ebx
ret
Function at 0x58bb3c
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov edx, 0x58bcf4
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58bd0c
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58bd20
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58bd3c
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58bd5c
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58bd70
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58bd88
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58bda8
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58bdc4
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58bddc
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58bdf4
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58be14
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58be30
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58be44
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58be58
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58be78
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58be94
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov edx, 0x58beac
mov ecx, 4
mov eax, esi
call fcn.0058bae4
test al, al
je 0x58bcee
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x58bec8
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff64
mov ebp, edx
mov esi, eax
xor ebx, ebx
mov dword [esp + 8], 0x94
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0xc], 6
jb 0x58bfb1
xor eax, eax
mov dword [esp + 4], eax
push esi
push 0
push 0x400
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x58bfb1
lea eax, [esp + 4]
push eax
push 0x18
push edi
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x58bfab
xor esi, esi
xor eax, eax
mov dword [esp], eax
push esp
push 0
push 0
push 0x19
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x58bf60
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
jne 0x58bf60
cmp dword [esp], 0
je 0x58bf60
mov eax, dword [esp]
push eax
push 0
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
push esp
mov eax, dword [esp + 4]
push eax
push esi
push 0x19
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x58bf97
mov eax, dword [esi]
push eax
call sub.advapi32.dll_GetSidSubAuthorityCount
test eax, eax
je 0x58bf97
movzx ebx, byte [eax]
dec ebx
push ebx
mov eax, dword [esi]
push eax
call sub.advapi32.dll_GetSidSubAuthority
mov eax, dword [eax]
mov dword [ebp], eax
mov bl, 1
test esi, esi
je 0x58bfa1
push esi
call sub.kernel32.dll_LocalFree
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
push edi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
add esp, 0x9c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x58e478
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ec4
mov eax, dword [ebp - 8]
call fcn.00405ec4
xor eax, eax
push ebp
push 0x58e511
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00405ed4
push eax
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x58e4f4
push 4
mov eax, dword [ebp - 8]
call fcn.00405ed4
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
jbe 0x58e4ee
lea eax, [ebp - 0x24]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x58e4e8
mov esi, dword [ebp - 0x20]
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58e518
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405a68
ret

Function at 0x58e998
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
xor ecx, ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ec4
xor eax, eax
push ebp
push 0x58ea75
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x58e9d5
lea eax, [ebp - 8]
mov edx, 0x58ea8c
call fcn.00405adc
jmp 0x58e9e2
lea eax, [ebp - 8]
mov edx, 0x58eaa0
call fcn.00405adc
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403d20
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405d5c
mov eax, dword [ebp - 0x60]
call fcn.00405ed4
push eax
mov eax, dword [ebp - 4]
call fcn.00405ed4
push eax
call sub.kernel32.dll_CreateProcessA
call fcn.00411374
mov ebx, eax
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp ebx, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58ea7c
lea eax, [ebp - 0x60]
call fcn.00405a44
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405a68
ret
Function at 0x58f374
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ec4
mov eax, dword [ebp - 8]
call fcn.00405ec4
xor eax, eax
push ebp
push 0x58f4c9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp - 4], 0
jne 0x58f3be
cmp dword [ebp - 8], 0
je 0x58f4a1
mov eax, 0x104
call fcn.00402fb0
mov edi, eax
mov eax, 0x104
call fcn.00402fb0
mov dword [ebp - 0x10], eax
call sub.user32.dll_GetDesktopWindow
push 5
push eax
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
je 0x58f492
push 0x104
push edi
push esi
call sub.user32.dll_GetClassNameA
push 0x104
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.user32.dll_GetWindowTextA
cmp dword [ebp - 4], 0
je 0x58f42c
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00405c3c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00410338
test eax, eax
setne byte [ebp - 0xa]
jmp 0x58f430
mov byte [ebp - 0xa], 1
cmp dword [ebp - 8], 0
je 0x58f454
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00405c3c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00410338
test eax, eax
setne byte [ebp - 0xb]
jmp 0x58f458
mov byte [ebp - 0xb], 1
movzx ebx, byte [ebp - 0xa]
and bl, byte [ebp - 0xb]
test byte [ebp - 9], bl
je 0x58f47c
push 0
push 0
push 0x1f
push esi
call sub.user32.dll_PostMessageA
push 0
push 0
push 0x10
push esi
call sub.user32.dll_PostMessageA
test bl, bl
jne 0x58f492
push 2
push esi
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
jne 0x58f3ee
mov eax, dword [ebp - 0x10]
call fcn.00402fcc
mov eax, edi
call fcn.00402fcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58f4d0
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405a68
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405a68
ret

Function at 0x58f4dc
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov eax, dword [0x5d510c]
cmp dword [eax], 2
jne 0x58f556
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x58f556
lea eax, [esp + 0xc]
push eax
push 0x58f56c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x58f556
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret
Function at 0x58fb7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ec4
xor eax, eax
push ebp
push 0x58fcda
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00405a44
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x58fbc6
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x58fbf5
mov ebx, 1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
xor edx, dword [ebp - 0xc]
call fcn.00405c2c
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00405d10
inc dword [ebp - 0xc]
inc ebx
dec esi
jne 0x58fbd1
lea eax, [ebp - 4]
mov edx, dword [edi]
call fcn.00405adc
mov eax, edi
call fcn.00405a44
mov eax, dword [ebp - 4]
test eax, eax
je 0x58fc12
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x58fcaa
mov ebx, 1
mov eax, ebx
and eax, 0x80000001
jns 0x58fc2f
dec eax
or eax, 0xfffffffe
inc eax
dec eax
jne 0x58fca2
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.00403b80
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.00403b50
lea edx, [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.00405ca8
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov edx, 0x58fcf0
call fcn.00405d5c
mov eax, dword [ebp - 0x24]
call fcn.0040b2d4
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00405c2c
mov edx, dword [ebp - 0x20]
mov eax, edi
call fcn.00405d10
inc ebx
dec esi
jne 0x58fc21
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58fce1
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00405a68
lea eax, [ebp - 0x10]
call fcn.00405a44
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405a68
ret
Function at 0x5922c4
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00405ec4
xor eax, eax
push ebp
push 0x5923cb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x5923dc
push 0x5923ec
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.0059225c
mov edi, eax
test edi, edi
jle 0x5923b0
lea eax, [ebp - 8]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405f3c
lea eax, [ebp - 0x10]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 8]
call fcn.00405ed4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x5923b0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x59235c
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, edi
lea edx, [edi + 1]
mov eax, dword [ebp - 4]
call fcn.00405f3c
test esi, esi
je 0x592390
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 8]
call fcn.00405ed4
push eax
mov eax, dword [ebp - 0x10]
push eax
call esi
test eax, eax
sete bl
jmp 0x5923a7
mov eax, dword [ebp - 8]
call fcn.00405ed4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5923d2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405a68
ret
Function at 0x593a5c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00405ec4
xor eax, eax
push ebp
push 0x593bfe
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x593bd1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.00595528
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x593bdb
cmp byte [0x5dbc8c], 0
jne 0x593bd0
mov eax, dword [ebp + 8]
call fcn.0058efb8
lea edx, [ebp - 4]
call fcn.0058f0a0
cmp dword [0x5dbd74], 3
jne 0x593b03
push dword [ebp - 4]
push dword [0x5dbd14]
push 0x593c18
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405dd8
jmp 0x593b1e
push dword [ebp - 4]
push dword [0x5dbd10]
push 0x593c18
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405dd8
push 2
mov eax, dword [ebp - 4]
call fcn.00405ed4
push eax
call sub.kernel32.dll_SetFileAttributesA
lea edx, [ebp - 8]
mov eax, 0x593c24
call fcn.0058ff78
mov eax, dword [ebp - 8]
call fcn.00593654
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004c956c
push dword [ebp - 4]
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.00589cac
push dword [ebp - 0xc]
push 0x593c4c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405dd8
mov eax, dword [0x5dbd88]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x593bd0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040bb78
mov eax, dword [ebp - 0x10]
call fcn.0040b8e4
test al, al
je 0x593bd0
lea edx, [ebp - 0x14]
mov eax, 0x593c24
call fcn.0058ff78
mov eax, dword [ebp - 0x14]
call fcn.00593654
push eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040bb78
mov eax, dword [ebp - 0x18]
pop edx
call fcn.004c956c
movzx ecx, byte [0x5dbc8d]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00591a88
ret
Function at 0x593c54
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ec4
xor eax, eax
push ebp
push 0x593dec
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x593dbd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00412b5c
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x41c918]
call fcn.00422268
mov ebx, eax
push 0xffff
lea eax, [ebp - 0x10]
mov ecx, 0x593e04
mov edx, dword [ebp - 4]
call fcn.00405d5c
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x41c918]
call fcn.00422268
mov dword [ebp - 8], eax
mov eax, dword [0x5d87f8]
call fcn.0058fcf4
call fcn.00402fb0
mov esi, eax
mov eax, dword [0x5d87f8]
call fcn.0058fcf4
mov ecx, eax
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [0x5d87f8]
call fcn.0058fcf4
mov ecx, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0x10]
mov eax, esi
call fcn.00402fcc
mov eax, ebx
call fcn.00404ae4
push 0x20
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41c918]
call fcn.00422268
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
call fcn.00402fb0
mov esi, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0x10]
mov eax, ebx
call fcn.00404ae4
mov eax, dword [ebp - 8]
call fcn.00404ae4
lea eax, [ebp - 0x14]
mov ecx, 0x593e10
mov edx, dword [ebp - 4]
call fcn.00405d5c
mov eax, dword [ebp - 0x14]
call fcn.00405ed4
push eax
mov eax, dword [ebp - 4]
call fcn.00405ed4
mov ebx, eax
push ebx
call sub.kernel32.dll_MoveFileA
push ebx
lea eax, [ebp - 0x18]
mov ecx, 0x593e04
mov edx, dword [ebp - 4]
call fcn.00405d5c
mov eax, dword [ebp - 0x18]
call fcn.00405ed4
push eax
call sub.kernel32.dll_MoveFileA
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x593dc9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x593df3
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00405a68
lea eax, [ebp - 4]
call fcn.00405a44
ret

Function at 0x594e88
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x90], 5
jb 0x594eb7
mov bl, 1
jmp 0x594ecb
cmp dword [ebp - 0x90], 4
jne 0x594ecb
cmp dword [ebp - 0x8c], 0x5a
jb 0x594ecb
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b39d8
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, eax
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 6
jb 0x5b39f9
mov al, 1
jmp 0x5b39fb
xor eax, eax
test al, al
je 0x5b3a0a
mov eax, ebx
call fcn.00487728
movzx eax, byte [eax + 8]
add esp, 0x94
pop ebx
ret

Function at 0x5b3a14
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 4]
cmp eax, 5
jbe 0x5b3a34
mov al, 1
jmp 0x5b3a4a
cmp eax, 5
jae 0x5b3a3d
xor eax, eax
jmp 0x5b3a4a
cmp dword [esp + 8], 1
jb 0x5b3a48
mov al, 1
jmp 0x5b3a4a
xor eax, eax
add esp, 0x94
ret
Function at 0x5b9dfc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ec4
xor eax, eax
push ebp
push 0x5b9f7f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.005b3f80
mov eax, dword [ebp - 8]
call fcn.005b3f94
mov ebx, eax
test ebx, ebx
je 0x5b9ebf
mov byte [ebx + 0x370], 1
mov eax, ebx
call fcn.00482244
mov eax, dword [0x5d4d3c]
xor edx, edx
mov dword [eax], edx
push 0
mov eax, ebx
call fcn.0046fc84
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [0x5d466c]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [0x5d4670]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x5d4d74]
mov eax, dword [eax]
call fcn.00485f0c
cmp ebx, dword [0x5d4668]
jne 0x5b9e9d
xor eax, eax
mov dword [0x5d4668], eax
xor eax, eax
mov dword [0x5d466c], eax
mov eax, 0x5dbe04
call fcn.00405a44
mov eax, ebx
call fcn.0047d620
mov dword [0x5dbdf4], eax
mov eax, ebx
call fcn.0047d640
mov dword [0x5dbdf8], eax
mov eax, dword [ebp - 4]
call fcn.005b3f94
mov ebx, eax
test ebx, ebx
je 0x5b9f5d
mov byte [ebx + 0x370], 1
mov eax, ebx
call fcn.00482244
mov eax, dword [0x5d4d3c]
xor edx, edx
mov dword [eax], edx
push 0
mov eax, ebx
call fcn.0046fc84
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [0x5d466c]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [0x5d4670]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x5d4d74]
mov eax, dword [eax]
call fcn.00485f0c
mov eax, dword [ebp - 4]
call fcn.005b3770
cmp ebx, dword [0x5d4668]
jne 0x5b9f3b
xor eax, eax
mov dword [0x5d4668], eax
xor eax, eax
mov dword [0x5d466c], eax
mov eax, 0x5dbe04
call fcn.00405a44
mov eax, ebx
call fcn.0047d620
mov dword [0x5dbdf4], eax
mov eax, ebx
call fcn.0047d640
mov dword [0x5dbdf8], eax
xor eax, eax
call fcn.005b3770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b9f86
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405a68
ret
Function at 0x5b9f8c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405ec4
mov eax, dword [ebp - 8]
call fcn.00405ec4
xor eax, eax
push ebp
push 0x5ba0ed
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.004031b8
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040bb78
mov eax, dword [ebp - 0x10]
call fcn.00403148
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040ab58
mov edx, dword [ebp - 0x14]
mov eax, dword [0x5dbdec]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5ba041
push 0
mov edx, ebx
mov eax, dword [0x5dbdec]
mov ecx, dword [eax]
call dword [ecx + 0x18]
call fcn.0046fc84
push eax
call sub.user32.dll_ShowWindow
mov edx, ebx
mov eax, dword [0x5dbdec]
mov ecx, dword [eax]
call dword [ecx + 0x18]
call fcn.00404ae4
xor ecx, ecx
mov edx, ebx
mov eax, dword [0x5dbdec]
mov esi, dword [eax]
call dword [esi + 0x24]
mov eax, dword [0x5d4d74]
mov eax, dword [eax]
call fcn.00485f0c
jmp 0x5ba05b
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040ab58
mov edx, dword [ebp - 0x18]
mov eax, dword [0x5dbdec]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov ebx, eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x5ba284]
call fcn.005ba8b4
mov esi, eax
mov ecx, esi
mov edx, ebx
mov eax, dword [0x5dbdec]
mov ebx, dword [eax]
call dword [ebx + 0x24]
mov dl, 1
mov eax, dword [0x41c6f4]
call fcn.00404ab4
mov ebx, eax
lea eax, [ebp - 0x1c]
mov ecx, 0x5ba104
mov edx, dword [ebp - 8]
call fcn.00405d5c
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00420508
mov edx, dword [ebp - 0x20]
lea eax, [esi + 0x37c]
call fcn.00405a98
mov eax, ebx
call fcn.00404ae4
mov eax, esi
call fcn.0046fc84
mov ebx, eax
mov eax, dword [ebp - 0xc]
call fcn.00403148
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ba0f4
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00405a68
ret