joyce8/EMBER2024-capa huggingface dataset:
Function at 0x517ccc
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x517e16
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00517194
xor eax, eax
push ebp
push 0x517df9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x517d31
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x517d31
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x517de3
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x517d44
call fcn.00404810
jmp 0x517e00
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x517de3
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x517de3
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004040c8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x517de3
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040d9f8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x517e30
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x58359c]
mov dl, 1
mov eax, dword [0x515cb8]
call fcn.0040e338
call fcn.00404764
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x517e00
mov eax, dword [ebp - 4]
call fcn.005171a4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x517e1d
lea eax, [ebp - 0x28]
call fcn.00404e10
ret
Function at 0x51da60
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51db50
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
mov dl, 1
mov eax, dword [0x41c644]
call fcn.00403e90
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], eax
xor eax, eax
push ebp
push 0x51db2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0x51d408
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x51db15
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00409eec
mov edx, eax
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0051db88
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ecx, eax
mov eax, dword [ebp - 8]
pop edx
mov edi, dword [eax]
call dword [edi + 0x3c]
inc ebx
dec esi
jne 0x51dad0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51db35
mov eax, dword [ebp - 4]
add eax, 0x58
call fcn.0040ff84
ret

Function at 0x51dde0
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
cmp dword [ebp + 0xc], 0
jne 0x51ddf5
cmp dword [ebp + 8], 0
jbe 0x51de64
jmp 0x51ddf7
jle 0x51de64
mov ebx, dword [ebp + 8]
push ebx
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
push ebx
push 0x51d3c8
call sub.user32.dll_EnumWindows
cmp dword [ebp - 4], 0
jbe 0x51de68
xor edx, edx
push ebp
push 0x51de5d
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x1f4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x51de46
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51de68
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x51e544
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push 0
push 0x51e558
call sub.user32.dll_FindWindowA
pop ebp
ret
Function at 0x51e7cc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x51e909
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41c644]
call fcn.00403e90
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51e8e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x6c]
call fcn.0040a36c
test al, al
je 0x51e829
mov edx, dword [esi + 0x6c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [esi + 0x6c]
call fcn.0040a584
lea eax, [ebp - 8]
push eax
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call fcn.00409df8
push dword [ebp - 0x10]
push 0x51e920
mov eax, dword [ebp - 8]
clc

Function at 0x51e93c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
mov ebx, edx
lea eax, [ebp - 0x84]
xor ecx, ecx
mov edx, 0x80
call fcn.0040374c
mov dword [ebp - 4], 0x80
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x84]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [ebp - 0x84]
mov ecx, 0x80
call fcn.00405080
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51e98c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
xor ecx, ecx
mov dword [ebp - 0x88], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x51ea13
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404e10
mov dword [ebp - 4], 0x80
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x84]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x51e9fa
lea eax, [ebp - 0x88]
lea edx, [ebp - 0x84]
mov ecx, 0x80
call fcn.00405080
mov eax, dword [ebp - 0x88]
call fcn.004052ec
mov edx, eax
mov eax, ebx
call fcn.00405008
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51ea1a
lea eax, [ebp - 0x88]
call fcn.00404e10
ret

Function at 0x51ed68
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
push edi
test dl, dl
je 0x51ed80
add esp, 0xfffffff0
call fcn.00404238
mov esi, ecx
mov ebx, edx
mov edi, eax
lea eax, [edi + 0x64]
mov edx, 0x51edf0
call fcn.00404e64
lea eax, [ebp - 0x190]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
lea eax, [edi + 0x58]
mov edx, 0x51ee00
call fcn.00404e64
mov dword [edi + 0x48], 0xffffffff
mov eax, edi
call fcn.0051f554
mov ecx, esi
xor edx, edx
mov eax, edi
call fcn.00427d04
mov eax, edi
test bl, bl
je 0x51eddf
call fcn.00404290
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51f094
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51f19a
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
cmp dword [ebx + 0x48], 0xffffffff
je 0x51f184
mov eax, dword [ebx + 0x64]
call fcn.004052ec
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.0051f03c
test al, al
je 0x51f118
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0051faa4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x64]
call fcn.00404e64
mov eax, ebx
call fcn.0051f03c
test al, al
je 0x51f107
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x51f118
mov eax, dword [ebx + 0x64]
call fcn.004052ec
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 8], eax
push 4
lea eax, [ebp - 8]
push eax
push 2
push 0
mov eax, dword [ebx + 0x48]
push eax
call sub.wsock32.dll_setsockopt
test eax, eax
je 0x51f147
xor eax, eax
mov dword [ebp - 8], eax
push 4
lea eax, [ebp - 8]
push eax
push 2
push 0
mov eax, dword [ebx + 0x48]
push eax
call sub.wsock32.dll_setsockopt
mov word [ebp - 0x18], 2
mov ax, word [ebx + 0x34]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x16], ax
mov eax, dword [ebx + 0x3c]
call fcn.004052ec
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x14], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx + 0x48]
push eax
call sub.wsock32.dll_sendto
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51f1a1
lea eax, [ebp - 0x1c]
call fcn.00404e10
ret
Function at 0x51f79c
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004052dc
xor eax, eax
push ebp
push 0x51f8a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404e10
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004099e0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00404ea8
cmp dword [ebp - 4], 0
je 0x51f87c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0051f59c
test al, al
je 0x51f819
mov eax, dword [ebp - 4]
call fcn.004052ec
push eax
call sub.wsock32.dll_inet_addr
inc eax
je 0x51f888
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404e64
jmp 0x51f888
mov eax, dword [ebp - 4]
call fcn.004052ec
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x51f888
mov esi, dword [ebp - 8]
push ebx
mov eax, dword [esi + 0xc]
mov edi, dword [eax]
xor eax, eax
mov al, byte [edi]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
xor eax, eax
mov al, byte [edi + 1]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
xor eax, eax
mov al, byte [edi + 2]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
xor eax, eax
mov al, byte [edi + 3]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x2c]
mov ecx, 3
mov eax, 0x51f8bc
call fcn.0040b314
jmp 0x51f888
mov eax, ebx
mov edx, 0x51f8d0
call fcn.00404e64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51f8ad
lea eax, [ebp - 0xc]
call fcn.00404e10
lea eax, [ebp - 4]
call fcn.00404e10
ret

Function at 0x51f948
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, edx
mov esi, eax
test bl, bl
je 0x51f97f
cmp dword [esi + 0x5c], 0
je 0x51fa04
mov eax, dword [esi + 0x5c]
mov edx, 0x51fa14
call fcn.00405238
je 0x51fa04
cmp dword [esi + 0x48], 0xffffffff
je 0x51fa04
test byte [esi + 0x1c], 0x10
jne 0x51fa04
test byte [esi + 0x1c], 1
jne 0x51fa04
mov eax, dword [esi + 0x64]
call fcn.004052ec
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x5c]
call fcn.004052ec
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 8], eax
test bl, bl
je 0x51f9ed
cmp byte [esi + 0x60], 0
jne 0x51fa04
push 8
lea eax, [ebp - 8]
push eax
push 5
push 0
mov eax, dword [esi + 0x48]
push eax
call sub.wsock32.dll_setsockopt
test eax, eax
sete al
mov byte [esi + 0x60], al
mov byte [ebp - 9], 0x40
push 1
lea eax, [ebp - 9]
push eax
push 3
push 0
mov eax, dword [esi + 0x48]
push eax
call sub.wsock32.dll_setsockopt
test eax, eax
jmp 0x51fa04
push 8
lea eax, [ebp - 8]
push eax
push 6
push 0
mov eax, dword [esi + 0x48]
push eax
call sub.wsock32.dll_setsockopt
mov byte [esi + 0x60], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51faa4
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x51fbcf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404e10
lea eax, [ebp - 0xc]
call fcn.00404e10
mov eax, 0x65
call fcn.00402be4
mov edi, eax
push 0x65
mov ebx, edi
push ebx
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x51fb5f
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0040adfc
push ebx
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movsx ebx, word [eax + 0xa]
dec ebx
test ebx, ebx
jl 0x51fb3f
inc ebx
xor esi, esi
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + esi]
call fcn.00409d0c
lea eax, [ebp - 0x18]
mov edx, 0x51fbe8
call fcn.004050f4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.004050f4
inc esi
dec ebx
jne 0x51fb0f
mov eax, dword [ebp - 0xc]
call fcn.004050ec
mov edx, eax
dec edx
lea eax, [ebp - 0xc]
call fcn.00405478
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00404e64
jmp 0x51fba0
call sub.wsock32.dll_WSAGetLastError
sub eax, 0x2734
je 0x51fb93
sub eax, 0xe
je 0x51fb84
sub eax, 0x2b
jne 0x51fba0
lea eax, [ebp - 0x10]
mov edx, 0x51fbf4
call fcn.00404ea8
jmp 0x51fba0
lea eax, [ebp - 0x10]
mov edx, 0x51fc10
call fcn.00404ea8
jmp 0x51fba0
lea eax, [ebp - 0x10]
mov edx, 0x51fc24
call fcn.00404ea8
mov edx, 0x65
mov eax, edi
call fcn.00402c14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51fbd6
lea eax, [ebp - 0x18]
call fcn.00404e10
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404e34
ret
Function at 0x52384c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x148]
mov ebx, dword [eax + 8]
dec ebx
cmp ebx, 0
jl 0x52387a
mov edx, ebx
mov eax, dword [esi + 0x148]
call fcn.0041e958
call fcn.00427c58
dec ebx
cmp ebx, 0xffffffff
jne 0x523862
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x5238a4
mov eax, dword [0x58343c]
mov eax, dword [eax]
call fcn.004decdc
push 1
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x1388
ja 0x5238b0
mov eax, dword [esi + 0x148]
cmp dword [eax + 8], 0
jg 0x523883
pop esi
pop ebx
pop ebp
ret

Function at 0x5238e4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, eax
lea eax, [ebp - 0x84]
xor ecx, ecx
mov edx, 0x80
call fcn.0040374c
mov dword [ebp - 4], 0x80
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x84]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x84]
mov ecx, 0x80
call fcn.004039d0
lea edx, [ebp - 0x108]
lea eax, [ebx + 0xfd]
mov cl, 0x1e
call fcn.0040363c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x523948
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, eax
lea eax, [ebp - 0x84]
xor ecx, ecx
mov edx, 0x80
call fcn.0040374c
mov dword [ebp - 4], 0x80
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x84]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x84]
mov ecx, 0x80
call fcn.004039d0
lea edx, [ebp - 0x108]
lea eax, [ebx + 0xde]
mov cl, 0x1e
call fcn.0040363c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x524794
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x5248d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x88]
sub eax, 1
jb 0x5247ea
je 0x5247f9
dec eax
je 0x524808
jmp 0x52482f
lea eax, [ebp - 4]
mov edx, 0x5248ec
call fcn.00404ea8
jmp 0x52482f
lea eax, [ebp - 4]
mov edx, 0x524900
call fcn.00404ea8
jmp 0x52482f
mov eax, dword [ebp - 0x94]
sub eax, 5
jne 0x524822
lea eax, [ebp - 4]
mov edx, 0x524918
call fcn.00404ea8
jmp 0x52482f
lea eax, [ebp - 4]
mov edx, 0x52492c
call fcn.00404ea8
push dword [ebp - 4]
push 0x524940
mov eax, dword [ebp - 0x8c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xbc]
call fcn.00409df8
push dword [ebp - 0xbc]
push 0x524954
lea eax, [ebp - 0xc0]
lea edx, [ebp - 0x84]
mov ecx, 0x80
call fcn.00405080
push dword [ebp - 0xc0]
push 0x524960
mov eax, ebx
mov edx, 6
call fcn.004051ac
mov dword [ebp - 0xb8], 0x20
lea eax, [ebp - 0xb8]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0xb0]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xac]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5248da
lea eax, [ebp - 0xc0]
mov edx, 2
call fcn.00404e34
lea eax, [ebp - 4]
call fcn.00404e10
ret
Function at 0x525760
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffac0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0xa0], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xbf], 0
lea edx, [ebp - 0x53d]
mov eax, dword [ebp - 4]
call fcn.00529014
xor edx, edx
push ebp
push 0x5257d5
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x15c]
call fcn.0051e528
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x15c]
call fcn.0051e544
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52580e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x11c]
xor edx, edx
call fcn.0049f64c
xor edx, edx
push ebp
push 0x525855
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp word [eax + 0x34a], 0
je 0x52584b
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34c]
call dword [ebx + 0x348]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52588e
xor edx, edx
push ebp
push 0x5258b3
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 7
mov eax, dword [ebp - 4]
call fcn.00525734
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5258ec
mov byte [ebp - 0x532], 3
xor edx, edx
push ebp
push 0x52591e
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x53d]
mov ecx, 0x539
mov eax, dword [ebp - 4]
call fcn.005274b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x525957
xor edx, edx
push ebp
push 0x525983
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5c5], 0
je 0x525979
mov eax, dword [ebp - 4]
call fcn.00525a50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5259bc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x528788
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffac0
push ebx
xor edx, edx
mov dword [ebp - 0x540], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x52888c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00528774
push 5
mov eax, dword [ebx + 0x15c]
call fcn.0051e528
push eax
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [ebx + 0x15c]
call fcn.0051e544
push eax
call sub.user32.dll_ShowWindow
lea edx, [ebp - 0x540]
mov eax, ebx
call fcn.00527194
mov edx, dword [ebp - 0x540]
mov eax, ebx
call fcn.0052ed54
mov edx, dword [ebx + 0x510]
mov eax, ebx
call fcn.0052e8b8
xor edx, edx
mov eax, dword [ebx + 0x128]
call fcn.0049f64c
mov dl, 1
mov eax, dword [ebx + 0x15c]
call fcn.0051de74
mov edx, 5
mov eax, dword [ebx + 0x15c]
call fcn.0051e568
mov dl, 1
mov eax, dword [ebx + 0x11c]
call fcn.0049f64c
xor edx, edx
mov eax, ebx
call fcn.00525734
cmp word [ebx + 0x5a], 0
je 0x52884d
mov edx, ebx
mov eax, dword [ebx + 0x5c]
call dword [ebx + 0x58]
lea edx, [ebp - 0x539]
mov eax, ebx
call fcn.00529014
mov byte [ebp - 0x52e], 1
lea edx, [ebp - 0x539]
mov ecx, 0x539
mov eax, ebx
call fcn.005274b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x528893
lea eax, [ebp - 0x540]
call fcn.00404e10
ret

Function at 0x528898
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff3c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5289cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xa4]
mov eax, dword [esi + 0x350]
call fcn.004099e0
cmp dword [ebp - 0xa4], 0
je 0x5289ac
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
jmp 0x528995
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 0xc0], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xac], eax
mov byte [ebp - 0xa8], 0
lea edx, [ebp - 0xc4]
mov ecx, 3
mov eax, 0x5289e4
call fcn.0040b314
mov eax, dword [ebp - 4]
mov edx, dword [esi + 0x350]
call fcn.00405238
jne 0x528986
xor eax, eax
push ebp
push 0x52897a
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
lea eax, [ebp - 0xa0]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5289ac
inc ebx
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, 0x3e8
jae 0x5289ac
lea eax, [ebp - 0xa0]
push eax
push ebx
push 0
call sub.user32.dll_EnumDisplaySettingsA
test eax, eax
jne 0x5288eb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5289d4
lea eax, [ebp - 0xa4]
call fcn.00404e10
lea eax, [ebp - 4]
call fcn.00404e10
ret
Function at 0x528f74
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffac4
push ebx
mov ebx, eax
mov edx, 5
mov eax, dword [ebx + 0x15c]
call fcn.0051e568
push 5
mov eax, dword [ebx + 0x15c]
call fcn.0051e528
push eax
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [ebx + 0x15c]
call fcn.0051e544
push eax
call sub.user32.dll_ShowWindow
mov edx, 2
mov eax, ebx
call fcn.00525734
lea edx, [ebp - 0x539]
mov eax, ebx
call fcn.00529014
mov byte [ebp - 0x52e], 1
lea edx, [ebp - 0x539]
mov ecx, 0x539
mov eax, ebx
call fcn.005274b0
cmp word [ebx + 0x5a], 0
je 0x528ff7
mov edx, ebx
mov eax, dword [ebx + 0x5c]
call dword [ebx + 0x58]
cmp word [ebx + 0x212], 0
je 0x52900f
mov edx, ebx
mov eax, dword [ebx + 0x214]
call dword [ebx + 0x210]
pop ebx
mov esp, ebp
pop ebp
ret