joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fe658
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40d534]
call fcn.00407b14
xor eax, eax
push ebp
push 0x4fe7a2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x69bdc0], 0
jne 0x4fe6ac
mov ecx, dword [0x6a1888]
mov dl, 1
mov eax, dword [0x40ee24]
call fcn.0041a33c
call fcn.00405bc0
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.0040491c
mov eax, ebx
call fcn.00406c28
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x4fe7b0
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00409efc
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x4fe6f3
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x4fe748
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4fe741
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.004070ec
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.00407084
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.00414160
test eax, eax
jne 0x4fe741
mov ebx, 0x15
jmp 0x4fe74d
mov ebx, 0x10
jmp 0x4fe74d
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x69bdc0]
call fcn.004fe4c4
mov eax, dword [ebp - 4]
call fcn.004fe4c4
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00409f14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe7a9
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00406e6c
lea eax, [ebp - 0xc]
mov edx, dword [0x40d534]
call fcn.00407bec
ret
Function at 0x50a150
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x70], 0
jne 0x50a168
mov eax, ebx
call fcn.00509e7c
cmp dword [ebx + 0x68], 0
jne 0x50a175
mov eax, ebx
call fcn.00509dd4
mov esi, dword [ebx + 0x70]
test esi, esi
je 0x50a32b
cmp dword [ebx + 0x68], 0
je 0x50a32b
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov dword [esp], eax
mov eax, dword [ebx + 0x70]
mov edx, dword [eax]
call dword [edx + 0x24]
mov dword [esp + 4], eax
lea edx, [esp + 0x1c]
mov eax, ebx
call fcn.00509d58
mov edx, dword [esp + 0x24]
mov ecx, edx
mov esi, dword [esp + 0x1c]
sub ecx, esi
mov eax, dword [esp]
cmp ecx, eax
je 0x50a1e8
mov ecx, dword [esp + 4]
sub ecx, dword [esp + 0x28]
add ecx, dword [esp + 0x20]
sar ecx, 1
jns 0x50a1d1
adc ecx, 0
push ecx
sub eax, edx
add eax, esi
sar eax, 1
jns 0x50a1dd
adc eax, 0
push eax
lea eax, [esp + 0x24]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0xe0]
test eax, eax
je 0x50a1fe
call fcn.004cdf0c
mov esi, eax
jmp 0x50a201
mov esi, dword [ebx + 0x50]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
and eax, 8
cmp eax, 8
jne 0x50a216
or esi, 0xffffffff
jmp 0x50a220
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x1c]
mov eax, dword [ebx + 0x68]
call fcn.004f1d04
mov edx, dword [esp + 0x20]
mov eax, dword [ebx + 0x68]
call fcn.004f1d40
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.004c45c8
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.004c45fc
xor eax, eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.004cdf0c
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.004cdf0c
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.004cdf0c
push eax
call sub.user32.dll_SetWindowLongW
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x70]
call fcn.00460284
call fcn.0045a64c
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.004cdf0c
push eax
mov eax, dword [0x6a19d0]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.004cdf0c
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x528c4c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x528cbd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x69ea58]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x528ca7
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00528c34
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5283ec]
call fcn.005296f0
mov dword [0x69eabc], eax
mov eax, dword [ebp - 4]
call fcn.00528be0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x528cc4
lea eax, [ebp - 8]
call fcn.00409efc
ret

Function at 0x528cec
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffd4c
mov esi, 0x4008
test cl, cl
je 0x528cff
or esi, 2
test dl, dl
je 0x528d08
or esi, 0
jmp 0x528d0b
or esi, 1
push esi
push 0x2b4
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [esp + 4]
add esp, 0x2b4
pop esi
ret

Function at 0x529fec
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffd4c
mov eax, esp
xor ecx, ecx
mov edx, 0x2b4
call fcn.0040491c
push 0x4001
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
push 0x52a088
call sub.shell32.dll_SHGetFileInfoW
mov dword [0x69ea50], eax
cmp dword [0x69ea50], 0
je 0x52a07f
cmp dword [0x69ea54], 0
jne 0x52a07f
xor ecx, ecx
mov dl, 1
mov eax, dword [0x59b82c]
call fcn.0059c700
mov dword [0x69ea54], eax
mov edx, dword [0x69ea50]
mov eax, dword [0x69ea54]
call fcn.004dd384
mov dl, 1
mov eax, dword [0x69ea54]
call fcn.004dd300
mov dl, 1
mov eax, dword [0x69ea54]
call fcn.0059e310
push 0xffffffffffffffff
mov eax, dword [0x69ea54]
call fcn.004dd3c0
push eax
call sub.comctl32.dll_ImageList_SetBkColor
add esp, 0x2b4
ret

Function at 0x52dddc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x6a853c
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x52ddfe
shr eax, 1
xor eax, 0xedb88320
jmp 0x52de00
shr eax, 1
dec edx
jne 0x52ddec
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x52dde5
mov byte [0x6a893c], 1
pop esi
pop ebx
ret

Function at 0x52de1c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x6a893c], 0
jne 0x52de33
call fcn.0052dddc
mov eax, edi
dec eax
test eax, eax
jl 0x52de5b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x6a853c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x52de3d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x530c04
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x530c9e.0
jmp dword [ecx*4 + 0x530c37]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x530c69
sub dl, 8
je 0x530c78
jmp case.0x530c9e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5308ac
jmp case.0x530c9e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x530904
jmp case.0x530c9e.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x530c9e.0
movzx ecx, byte [ecx + 0x530ca5]
jmp dword [ecx*4 + 0x530cb6]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5309b0
jmp case.0x530c9e.0
cmp dl, 3
jne 0x530ce3
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x530a08
jmp case.0x530c9e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5309c4
jmp case.0x530c9e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x530a4c
jmp case.0x530c9e.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x530d0e
sub dl, 8
je 0x530d1a
jmp case.0x530c9e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x530a78
jmp case.0x530c9e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x530ae4
jmp case.0x530c9e.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x530d39
sub dl, 8
je 0x530d45
jmp case.0x530c9e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x530ba0
jmp case.0x530c9e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x530bc8
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x530de7
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0052fdb0
test eax, eax
je 0x530de7
mov eax, ebx
call fcn.00530df0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x530d80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x530df0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x530e21
dec al
je 0x530e5c
dec al
je 0x530ea1
dec al
je 0x530f0a
jmp 0x530f94
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x530f94
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x530e31
jmp 0x530f94
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x530f94
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x530e6c
jmp 0x530f94
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x530f94
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x530ed0
xor ebp, ebp
jmp 0x530ee0
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x530ee9
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x530eb1
jmp 0x530f94
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x530f94
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x530f63
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0052de64
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x530f1e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x541540
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff824
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x7dc], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x541621
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406a5c
mov eax, dword [0x6a2428]
cmp dword [eax], 2
jne 0x5415d6
push edi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00406dc0
mov eax, dword [ebx]
mov dword [ebp - 0x7d8], eax
mov esi, dword [ebp - 0x7d8]
test esi, esi
je 0x5415a2
sub esi, 4
mov eax, dword [esi]
shr eax, 1
mov esi, eax
push esi
mov eax, dword [ebx]
call fcn.00406c28
push eax
push edi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
mov dword [ebp - 0x7d8], eax
mov eax, dword [ebp - 0x7d8]
test eax, eax
je 0x5415ca
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov edx, eax
dec edx
mov eax, ebx
call fcn.00406dc0
jmp 0x541608
lea eax, [ebp - 0x7d2]
push eax
push 0x3e8
push 0xd
push edi
call sub.user32.dll_SendMessageW
lea edx, [ebp - 0x7dc]
lea eax, [ebp - 0x7d2]
call fcn.00415b00
mov edx, dword [ebp - 0x7dc]
mov eax, ebx
call fcn.00407100
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x541628
lea eax, [ebp - 0x7dc]
call fcn.00406e64
ret
Function at 0x550090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4e4dbc]
call fcn.004eb2f0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0xffffff9e
push 0xffffffffffffffec
mov eax, dword [ebp - 8]
call fcn.004cdf0c
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80
or eax, 0x8000000
push eax
push 0xffffffffffffffec
mov eax, dword [ebp - 8]
call fcn.004cdf0c
push eax
call sub.user32.dll_SetWindowLongW
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004ec32c
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004ed258
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowRect
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.005df3a0
push eax
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.005df3b4
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x98]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
call fcn.005bcb7c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5501d5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00460284
call fcn.0045a64c
push eax
call sub.gdi32.dll_BitBlt
push 0x1fffffff
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x30]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.0040ae20
lea edx, [ebp - 0x30]
mov cl, 0xff
mov eax, dword [ebp - 0x10]
call fcn.005a01f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5501dc
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ReleaseDC
ret

Function at 0x55022c
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x55023c
call sub.user32.dll_FindWindowW
ret
Function at 0x56dcf4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x74], 0
jne 0x56dd0c
mov eax, ebx
call fcn.0056d4e0
cmp dword [ebx + 0x70], 0
jne 0x56dd19
mov eax, ebx
call fcn.0056d43c
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x56dedb
cmp dword [ebx + 0x70], 0
je 0x56dedb
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov dword [esp], eax
mov eax, dword [ebx + 0x74]
mov edx, dword [eax]
call dword [edx + 0x24]
mov dword [esp + 4], eax
lea edx, [esp + 0x1c]
mov eax, ebx
call fcn.0056d284
lea eax, [esp + 0x1c]
xor edx, edx
call fcn.005df3a0
cmp eax, dword [esp]
je 0x56dd9b
lea eax, [esp + 0x1c]
xor edx, edx
call fcn.005df3b4
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x56dd77
adc edx, 0
push edx
lea eax, [esp + 0x20]
xor edx, edx
call fcn.005df3a0
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x56dd90
adc edx, 0
push edx
lea eax, [esp + 0x24]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x56ddae
mov eax, dword [eax + 0x18]
call fcn.004cdf0c
mov esi, eax
jmp 0x56ddb1
mov esi, dword [ebx + 0x58]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
and eax, 8
cmp eax, 8
jne 0x56ddc6
or esi, 0xffffffff
jmp 0x56ddd0
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x1c]
mov eax, dword [ebx + 0x70]
call fcn.004f1d04
mov edx, dword [esp + 0x20]
mov eax, dword [ebx + 0x70]
call fcn.004f1d40
mov edx, dword [esp]
mov eax, dword [ebx + 0x70]
call fcn.004c45c8
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x70]
call fcn.004c45fc
xor eax, eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x70]
call fcn.004cdf0c
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x70]
call fcn.004cdf0c
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x70]
call fcn.004cdf0c
push eax
call sub.user32.dll_SetWindowLongW
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x74]
call fcn.00460284
call fcn.0045a64c
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x70]
call fcn.004cdf0c
push eax
mov eax, dword [0x6a19d0]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x70]
call fcn.004cdf0c
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x56e134
Capabilities:
Allocate or change rwx memory
Find taskbar
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa0
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.0040491c
lea eax, [esp + 0x3c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x56e36a
push 0
push 0x56e374
push 0
push eax
call sub.user32.dll_FindWindowExW
test eax, eax
je 0x56e36a
push 0
push 0x56e390
push 0
push eax
call sub.user32.dll_FindWindowExW
test eax, eax
je 0x56e36a
push 0
push 0x56e3ac
push 0
push eax
call sub.user32.dll_FindWindowExW
test eax, eax
je 0x56e36a
push 0
push 0x56e3cc
push 0
push eax
call sub.user32.dll_FindWindowExW
mov ebp, eax
test ebp, ebp
je 0x56e36a
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageW
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x56e36a
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x56e36a
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x56e36a
push 0x40
push 0x1000
push 0x1000
push 0
push edi
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x56e36a
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x56e356
inc ebx
push esi
push ebx
push 0x417
push ebp
call sub.user32.dll_SendMessageW
test eax, eax
je 0x56e34c
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x20]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x56e34c
test byte [esp + 0x21], 0xd
jne 0x56e34c
movzx eax, byte [esp + 0x20]
and al, 8
cmp al, 8
je 0x56e34c
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x30]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x56e34c
cmp dword [esp + 0xc], 0
je 0x56e34c
mov eax, dword [0x6a2020]
mov eax, dword [eax]
cmp byte [eax + 0xd3], 0
je 0x56e2e9
mov eax, dword [0x6a2020]
mov eax, dword [eax]
cmp dword [eax + 0x44], 0
je 0x56e2e9
mov eax, dword [0x6a2020]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.004cdf0c
mov dword [esp + 0x14], eax
jmp 0x56e2fa
mov eax, dword [0x6a2020]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x14]
jne 0x56e34c
push esi
push ebx
push 0x41d
push ebp
call sub.user32.dll_SendMessageW
test eax, eax
je 0x56e328
lea eax, [esp + 0xc]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0xc], 0
je 0x56e356
lea eax, [esp + 0x2c]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
call fcn.0040af04
jmp 0x56e356
cmp ebx, dword [esp + 4]
jl 0x56e242
push 0x8000
push 0
push esi
push edi
call sub.kernel32.dll_VirtualFreeEx
push edi
call sub.kernel32.dll_CloseHandle_1
add esp, 0x60
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5923d0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov dword [esp], edx
mov ebx, eax
mov eax, ebx
call fcn.005923bc
test eax, eax
jne 0x5923f5
mov eax, esi
xor edx, edx
call fcn.00406e74
jmp 0x592481
mov eax, ebx
call fcn.00592510
test al, al
je 0x59243d
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageW
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.00406fb0
test edi, edi
je 0x592432
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageW
jmp 0x592481
mov eax, esi
xor edx, edx
call fcn.00406e74
jmp 0x592481
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x592478
mov edi, dword [ebp + 0x270]
mov eax, dword [edi + 8]
cmp dword [eax + 8], 0
jle 0x592469
mov eax, edi
mov edx, dword [esp]
call fcn.00494fb4
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.00406e74
jmp 0x592481
mov eax, esi
mov edx, dword [ebp + 0x278]
call fcn.00406e74
jmp 0x592481
mov eax, esi
xor edx, edx
call fcn.00406e74
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x59427c
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.0040ae20
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageW
pop esi
pop ebx
ret