joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5493a4
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa8
mov dword [esp + 4], edx
mov dword [esp], eax
lea edi, [esp + 0xc]
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_GetSystemInfo
mov esi, dword [esp + 0x1c]
call sub.kernel32.dll_GetCurrentProcessId
mov ebp, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
xor ebx, ebx
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov eax, dword [edi]
shr eax, 0x10
shl eax, 0x10
mov dword [edi], eax
mov eax, ebx
shl eax, 0x10
sub dword [edi], eax
mov eax, dword [edi]
xor edx, edx
div esi
imul esi
mov dword [edi], eax
push 4
push 0x3000
push esi
mov eax, dword [edi]
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x549438
mov eax, dword [edi]
cmp eax, dword [esp + 0x10]
je 0x549438
push 0x8000
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_VirtualFree_1
inc ebx
jmp 0x5494d4
cmp dword [esp + 0x10], 0
jne 0x5494dd
push 0x1c
lea eax, [esp + 0x40]
push eax
mov eax, dword [edi]
push eax
call sub.kernel32.dll_VirtualQuery_1
cmp dword [esp + 0x48], 0x118
jb 0x5494cf
mov eax, dword [esp + 0x50]
and eax, 4
cmp eax, 4
jne 0x5494cf
mov eax, ebp
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
push edx
push eax
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov eax, dword [eax]
cmp edx, dword [esp + 4]
jne 0x54948a
cmp eax, dword [esp]
pop edx
pop eax
jne 0x5494cf
mov eax, ebp
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
push edx
push eax
mov eax, dword [edi]
mov edx, dword [eax + 0x114]
mov eax, dword [eax + 0x110]
cmp edx, dword [esp + 4]
jne 0x5494b7
cmp eax, dword [esp]
pop edx
pop eax
jne 0x5494cf
mov eax, dword [edi]
add eax, 8
mov edx, dword [esp]
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004036dc
je 0x5494dd
inc ebx
xor eax, eax
mov dword [edi], eax
cmp ebx, 0x14
jle 0x5493dd
xor eax, eax
mov dword [esp + 8], eax
cmp dword [esp + 0x10], 0
je 0x54955b
mov eax, dword [edi]
cmp eax, dword [esp + 0x10]
jne 0x549581
mov eax, ebp
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
mov ecx, dword [edi]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [edi]
add eax, 8
mov edx, dword [esp]
call fcn.00403630
mov eax, ebp
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
mov ecx, dword [edi]
mov dword [ecx + 0x110], eax
mov dword [ecx + 0x114], edx
mov eax, dword [edi]
mov dword [eax + 0x108], 1
mov eax, dword [edi]
add eax, 0x118
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
mov dword [eax], 1
jmp 0x549581
cmp dword [edi], 0
je 0x549581
mov eax, dword [edi]
inc dword [eax + 0x108]
mov eax, dword [edi]
add eax, 0x118
mov dword [esp + 8], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x108]
mov edx, dword [esp + 4]
mov dword [edx], eax
mov eax, dword [esp + 8]
add esp, 0x58
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x54c03c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x54c1fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.0040374c
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x582868], eax
mov eax, dword [ebp - 0xc]
mov dword [0x58286c], eax
mov eax, dword [ebp - 0x24]
mov dword [0x582870], eax
mov eax, dword [0x5837d8]
cmp dword [eax], 2
sete byte [0x582398]
push 0x54c208
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.0054c98c
cmp byte [0x582398], 0
jne 0x54c0c8
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0054c9bc
test al, al
je 0x54c0c8
mov eax, dword [ebp - 0x4c]
mov dword [0x589a10], eax
jmp 0x54c0cf
xor eax, eax
mov dword [0x589a10], eax
call fcn.0054bdb4
and eax, 0x7f
cmp eax, 0x10
ja case.0x54c0e0.0
jmp dword [eax*4 + 0x54c0e7]
mov byte [0x582384], 1
jmp case.0x54c0e0.0
mov byte [0x582388], 1
jmp case.0x54c0e0.0
mov byte [0x58238c], 1
jmp case.0x54c0e0.0
mov byte [0x582390], 1
jmp case.0x54c0e0.0
mov byte [0x582394], 1
jmp case.0x54c0e0.0
mov byte [0x58239c], 1
mov byte [0x5823a0], 1
jmp case.0x54c0e0.0
mov byte [0x58239c], 1
mov byte [0x5823a4], 1
jmp case.0x54c0e0.0
mov byte [0x58239c], 1
mov byte [0x5823a4], 1
mov byte [0x5823a8], 1
jmp case.0x54c0e0.0
mov byte [0x5823ac], 1
jmp case.0x54c0e0.0
mov byte [0x5823b0], 1
jmp case.0x54c0e0.0
mov byte [0x5823b4], 1
jmp case.0x54c0e0.0
mov byte [0x5823b8], 1
jmp case.0x54c0e0.0
mov byte [0x5823bc], 1
jmp case.0x54c0e0.0
mov byte [0x5823c0], 1
jmp case.0x54c0e0.0
mov byte [0x5823c4], 1
jmp case.0x54c0e0.0
mov byte [0x5823c8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54c203
lea eax, [ebp - 4]
call fcn.00404e10
ret

Function at 0x54c9bc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x54ca63
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.004052ec
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x54ca4d
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00405478
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.004052ec
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x54ca4d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x54ca74
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x54ca4d
cmp dword [ebp - 8], 0x34
jne 0x54ca4d
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54ca6a
lea eax, [ebp - 0x10]
call fcn.00404e10
ret
Function at 0x54d3a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
call fcn.0054d354
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x54d420
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [0x589a40], eax
mov dword [ebp - 4], 0x54d2e0
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x54d420
xor eax, eax
push ebp
push 0x54d419
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d420
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualProtect
ret
mov esp, ebp
pop ebp
ret

Function at 0x54d424
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
call fcn.0054d354
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x54d493
mov eax, dword [0x589a40]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x54d493
xor eax, eax
push ebp
push 0x54d48c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d493
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_VirtualProtect
ret
mov esp, ebp
pop ebp
ret
Function at 0x558080
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
cmp dl, byte [ebx + 0x30]
je 0x5580e3
mov byte [ebx + 0x30], dl
test dl, dl
je 0x5580d8
mov dword [ebx + 0x38], 0x58
mov eax, dword [ebx + 0xd4]
mov dword [ebx + 0x3c], eax
xor eax, eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], 7
mov dword [ebx + 0x48], 0x40a
lea eax, [ebx + 0x38]
push eax
push 0
call sub.shell32.dll_Shell_NotifyIconA
test eax, eax
je 0x5580e3
push 0
push 0x5580e8
call sub.user32.dll_FindWindowA
mov dword [ebx + 0x104], eax
jmp 0x5580e3
lea eax, [ebx + 0x38]
push eax
push 2
call sub.shell32.dll_Shell_NotifyIconA
pop ebx
pop ebp
ret

Function at 0x558240
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [0x55827c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x558259
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x558268
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x558277
or bl, 2
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x55a4f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov dl, 1
mov eax, dword [0x4845a8]
call fcn.0048af28
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x55a6cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x54]
cmp dword [eax + 8], 0
jle 0x55a6aa
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0048c3ac
mov eax, dword [ebp - 8]
call fcn.0048b4f0
mov eax, dword [eax + 0x14]
mov edx, esi
call fcn.00485d44
cmp byte [ebp + 8], 0
je 0x55a592
xor edx, edx
mov eax, ebx
call fcn.00559480
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.00559480
mov edx, dword [eax]
call dword [edx + 0x20]
mov esi, eax
mov eax, ebx
call fcn.005593b0
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x55a5ce
xor edx, edx
mov eax, ebx
call fcn.00559480
mov edx, dword [eax]
call dword [edx + 0x2c]
mov esi, eax
mov eax, ebx
call fcn.005593b0
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.00559480
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.0041d2a4
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
call fcn.0048b4f0
pop edx
call fcn.004860e8
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.005593b0
dec eax
test eax, eax
jl 0x55a682
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00559354
push 0
lea eax, [ebp - 0x20]
push eax
mov edx, esi
mov eax, ebx
call fcn.005594ac
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x20]
imul esi
xor edx, edx
mov dl, byte [ebp + 8]
imul edx
push eax
mov edx, esi
mov eax, ebx
call fcn.005594ac
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
imul esi
mov dl, byte [ebp + 8]
xor dl, 1
and edx, 0x7f
imul edx
xor ecx, ecx
pop edx
call fcn.0041d27c
mov eax, dword [ebp - 8]
call fcn.0048b4f0
mov edx, eax
lea ecx, [ebp - 0x20]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
inc esi
dec dword [ebp - 0x10]
jne 0x55a618
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00559354
cmp byte [ebp + 0xc], 0
je 0x55a6aa
movzx eax, word [ebx + 0x58]
mov edx, 0x10
call fcn.004810c8
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00558b44
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55a6d2
mov eax, dword [ebp - 8]
call fcn.00403ec0
ret
Function at 0x56c204
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004052dc
mov eax, dword [ebp - 8]
call fcn.004052dc
xor eax, eax
push ebp
push 0x56c2e7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004099e0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0040a780
mov eax, dword [ebp - 0x10]
mov edx, 0x56c2fc
call fcn.00405238
je 0x56c2cc
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0040a780
mov eax, dword [ebp - 0x14]
mov edx, 0x56c314
call fcn.00405238
je 0x56c2cc
mov eax, dword [ebp - 0xc]
call fcn.004050ec
test eax, eax
jle 0x56c2cc
mov eax, dword [ebp - 8]
call fcn.004050ec
test eax, eax
jle 0x56c2b1
push 5
push 0
mov eax, dword [ebp - 8]
call fcn.004052ec
push eax
mov eax, dword [ebp - 0xc]
call fcn.004052ec
push eax
push 0x56c324
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x56c2cc
push 5
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004052ec
push eax
push 0x56c324
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56c2ee
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404e34
ret
Function at 0x56cd80
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x56cd88
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56d086
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x56d056
mov byte [ebp - 0x1d], 0
xor eax, eax
push ebp
push 0x56d04c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.0052fb30
lea eax, [ebp - 0x10]
mov ecx, 0x56d09c
mov edx, dword [ebp - 0xc]
call fcn.00405138
mov eax, dword [ebp - 0x10]
call fcn.0040a36c
test al, al
je 0x56d042
xor eax, eax
push ebp
push 0x56ce25
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80
mov eax, dword [ebp - 0x10]
call fcn.004052ec
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56ce2f
mov dl, 1
mov eax, dword [0x41c644]
call fcn.00403e90
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x56d03b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x56ce72
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56cef2
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
cmp esi, 0
jl 0x56cf7b
lea ecx, [ebp - 0x30]
mov edx, esi
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.004099e0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x1c]
call fcn.004097b8
cmp dword [ebp - 0x1c], 0
je 0x56cf75
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x56cf75
inc ebx
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x34]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x1c]
call fcn.00405430
test eax, eax
jle 0x56cf6f
mov edx, esi
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov byte [ebp - 0x1d], 1
jmp 0x56cf75
inc dword [ebp - 0x18]
dec ebx
jne 0x56cf42
dec esi
cmp esi, 0xffffffff
jne 0x56cf02
cmp byte [ebp - 0x1d], 0
je 0x56d025
xor eax, eax
push ebp
push 0x56cfa8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56d025
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56d042
mov eax, dword [ebp - 0x14]
call fcn.00403ec0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56d056
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56d08d
lea eax, [ebp - 0x3c]
mov edx, 7
call fcn.00404e34
lea eax, [ebp - 0x1c]
call fcn.00404e10
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404e34
ret
Function at 0x56d0d8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x56d0e0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56d387
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
xor eax, eax
push ebp
push 0x56d355
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.0052fb30
lea eax, [ebp - 0xc]
mov ecx, 0x56d3a0
mov edx, dword [ebp - 8]
call fcn.00405138
mov eax, dword [ebp - 0xc]
call fcn.0040a36c
test al, al
je 0x56d34b
xor eax, eax
push ebp
push 0x56d16a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80
mov eax, dword [ebp - 0xc]
call fcn.004052ec
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56d174
mov dl, 1
mov eax, dword [0x41c644]
call fcn.00403e90
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x56d344
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x56d1b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56d237
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x56d284
lea ecx, [ebp - 0x24]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004097b8
mov edx, dword [ebp - 0x20]
mov eax, 0x56d3d0
call fcn.00405430
test eax, eax
jle 0x56d27e
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov byte [ebp - 0x11], 1
dec ebx
cmp ebx, 0xffffffff
jne 0x56d247
cmp byte [ebp - 0x11], 0
je 0x56d32e
xor eax, eax
push ebp
push 0x56d2b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56d32e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56d34b
mov eax, dword [ebp - 0x10]
call fcn.00403ec0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56d35f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56d38e
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.00404e34
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404e34
ret
Function at 0x56e4e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x56e4e9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004052dc
xor eax, eax
push ebp
push 0x56e744
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x56e754
push 0x56e768
call sub.user32.dll_FindWindowA
test eax, eax
je 0x56e71e
dec ebx
je 0x56e53d
dec ebx
je 0x56e599
dec ebx
je 0x56e603
jmp 0x56e70e
mov edx, dword [0x5049c0]
mov eax, 0xc
call fcn.00405d78
mov ebx, eax
mov edx, 0xc
mov eax, ebx
call fcn.004083fc
mov eax, dword [0x582ecc]
mov eax, dword [eax]
mov eax, dword [eax + 0x40]
mov dword [ebx], eax
mov eax, dword [0x582ecc]
mov eax, dword [eax]
mov eax, dword [eax + 0x4c]
mov dword [ebx + 4], eax
lea eax, [ebx + 8]
mov edx, dword [ebp - 8]
call fcn.00404e64
push ebx
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x56e060
xor edx, edx
xor eax, eax
call fcn.00404dc4
jmp 0x56e71e
xor eax, eax
push ebp
push 0x56e5e4
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004052ec
push eax
push 0x56e774
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x56e5d7
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0056e4e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56e71e
xor eax, eax
push ebp
push 0x56e6c5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, 0x56e784
call fcn.00500334
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.004166f4
push 0
push 0x56e7a4
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00411ec8
add esp, 0x10
push 0
push 0x56e7ac
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00411ec8
add esp, 0x10
mov eax, dword [0x582ecc]
mov eax, dword [eax]
mov eax, dword [eax + 0x40]
push eax
push 0x56e7b8
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00411ec8
add esp, 0x10
mov eax, dword [0x582ecc]
mov eax, dword [eax]
mov eax, dword [eax + 0x4c]
push eax
push 0x56e7c4
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00411ec8
add esp, 0x10
push 0xffffffffffffffff
push 0x56e7d0
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00411ec8
add esp, 0x10
lea eax, [ebp - 8]
push eax
push 0x56e7dc
lea eax, [ebp - 0x20]
push eax
push 0
call fcn.00411ec8
add esp, 0x10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56e71e
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0056e4e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56e74b
lea eax, [ebp - 0x24]
call fcn.00406b64
lea eax, [ebp - 0x20]
call fcn.00411ec0
lea eax, [ebp - 8]
call fcn.00404e10
ret
Function at 0x56f698
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x84], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x56f768
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x56f6c4
xor esi, esi
jmp 0x56f6c9
mov esi, 5
push 0
push 0x56f778
call sub.user32.dll_FindWindowA
mov edi, eax
push 5
push edi
call sub.user32.dll_GetWindow
mov edi, eax
test edi, edi
jbe 0x56f74f
lea eax, [ebp - 0x80]
xor ecx, ecx
mov edx, 0x80
call fcn.0040374c
push 0x80
lea eax, [ebp - 0x80]
push eax
push edi
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x56f74f
push 0x80
lea eax, [ebp - 0x80]
push eax
call sub.user32.dll_CharUpperBuffA
lea eax, [ebp - 0x84]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.00405080
mov eax, dword [ebp - 0x84]
mov edx, 0x56f790
call fcn.00405238
jne 0x56f74f
push esi
push edi
call sub.user32.dll_ShowWindow
xor bl, 1
neg bl
sbb eax, eax
push eax
push edi
call sub.user32.dll_EnableWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56f76f
lea eax, [ebp - 0x84]
call fcn.00404e10
ret