joyce8/EMBER2024-capa huggingface dataset:
Function at 0x523144
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405130
mov eax, dword [ebp - 8]
call fcn.00405130
mov eax, dword [ebp - 0xc]
call fcn.00405130
mov eax, dword [ebp + 0xc]
call fcn.00405130
xor eax, eax
push ebp
push 0x523207
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040972c
cmp dword [ebp - 0x10], 0
je 0x5231e4
mov eax, 0x1400
call fcn.00402874
mov ebx, eax
mov eax, dword [ebp + 0xc]
call fcn.00405140
push eax
push 0x1400
push ebx
mov eax, dword [ebp - 0xc]
call fcn.00405140
push eax
mov eax, dword [ebp - 8]
call fcn.00405140
push eax
mov eax, dword [ebp - 4]
call fcn.00405140
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov eax, dword [ebp + 8]
mov edx, ebx
call fcn.00404e78
mov eax, ebx
call fcn.00402894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52320e
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404ca4
lea eax, [ebp + 0xc]
call fcn.00404c80
ret

Function at 0x523dd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x523e98
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x523eac
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x523ec0
mov eax, 0x523ed0
call fcn.00523144
lea edx, [ebp - 0x10]
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a0968
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040a5a0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x523ee0
call fcn.00404f8c
mov eax, dword [ebp - 4]
mov edx, 0x523ef8
call fcn.0040508c
je 0x523e7d
mov eax, dword [ebp - 8]
call fcn.0040a15c
test al, al
je 0x523e7d
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00405140
push eax
push 0x523efc
push 0x523f0c
push 0
call sub.shell32.dll_ShellExecuteA
push 0x523eac
mov ecx, 0x523ef8
mov edx, 0x523ec0
mov eax, 0x523ed0
call fcn.00523218
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x523e9f
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404ca4
ret
Function at 0x529698
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
xor edx, edx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x6c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x52974b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x64
lea eax, [ebp - 0x65]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
lea edx, [ebp - 0x65]
mov ecx, 0x65
call fcn.00404ef0
mov eax, dword [ebx]
call fcn.00404f40
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x5296f0
mov eax, ebx
mov edx, 0x529760
call fcn.00404f48
lea eax, [ebp - 0x6c]
call fcn.00529780
mov eax, dword [ebp - 0x6c]
mov edx, 0x52976c
call fcn.0040508c
jb 0x529730
lea edx, [ebp - 0x74]
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a0968
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x70]
call fcn.0040a5a0
mov edx, dword [ebp - 0x70]
mov eax, ebx
mov ecx, 0x529778
call fcn.00404f8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529752
lea eax, [ebp - 0x74]
mov edx, 3
call fcn.00404ca4
ret

Function at 0x529820
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
xor edx, edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x408], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5298fd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x400
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
lea edx, [ebp - 0x401]
mov ecx, 0x401
call fcn.00404ef0
mov eax, dword [ebx]
call fcn.00404f40
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x52988d
mov eax, ebx
mov edx, 0x529914
call fcn.00404f48
lea eax, [ebp - 0x408]
call fcn.00529780
mov eax, dword [ebp - 0x408]
mov edx, 0x529920
call fcn.0040508c
jne 0x5298df
lea edx, [ebp - 0x410]
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a0968
mov eax, dword [ebp - 0x410]
lea edx, [ebp - 0x40c]
call fcn.0040a5a0
mov edx, dword [ebp - 0x40c]
mov eax, ebx
mov ecx, 0x52992c
call fcn.00404f8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529904
lea eax, [ebp - 0x410]
mov edx, 3
call fcn.00404ca4
ret
Function at 0x529934
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405130
mov eax, dword [ebp - 8]
call fcn.00405130
mov eax, dword [ebp - 0xc]
call fcn.00405130
xor eax, eax
push ebp
push 0x529a8e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x5299f8
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x529aa4
call fcn.00405284
mov edx, eax
inc edx
mov ecx, 0x7fffffff
mov eax, dword [ebp - 4]
call fcn.004051a0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x529aa4
call fcn.00405284
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004051a0
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x529aa4
call fcn.00405284
mov edx, eax
inc edx
mov ecx, 0x7fffffff
mov eax, dword [ebp - 8]
call fcn.004051a0
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x529aa4
call fcn.00405284
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004051a0
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 2
mov eax, 0x529aa8
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0xc]
mov eax, 0x529ab4
call fcn.00405284
dec eax
je 0x529a3c
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x529ab4
call fcn.00404f8c
mov eax, dword [ebp - 0xc]
call fcn.00405140
mov dword [ebp - 0x18], eax
mov eax, 0x529aa8
mov dword [ebp - 0x10], eax
push 1
mov eax, dword [ebp - 4]
call fcn.00405140
push eax
mov eax, dword [ebp - 8]
call fcn.00405140
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
call sub.mpr.dll_WNetAddConnection3A
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529a95
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ca4
ret
Function at 0x529ab8
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405130
mov eax, dword [ebp - 8]
call fcn.00405130
mov eax, dword [ebp - 0xc]
call fcn.00405130
mov eax, dword [ebp + 8]
call fcn.00405130
xor eax, eax
push ebp
push 0x529cad
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, 0x529cc8
call fcn.00405284
cmp eax, 3
jle 0x529b78
mov edx, dword [ebp - 8]
mov eax, 0x529cd4
call fcn.00405284
dec eax
jne 0x529b78
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.004051a0
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0x10]
mov eax, 0x529ce0
call fcn.00405284
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.004051a0
mov edx, 0x7d0
mov eax, dword [ebp - 0x10]
call fcn.004a3ad4
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x529c7d
xor ebx, ebx
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, dword [ebp - 8]
call fcn.004051a0
mov edx, dword [ebp - 0x34]
mov eax, 0x529ce0
call fcn.00405284
dec eax
jge 0x529bb5
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
call fcn.00529934
mov ebx, eax
jmp 0x529c7d
cmp dword [ebp - 8], 0
je 0x529c7d
cmp dword [ebp - 0xc], 0
je 0x529c7d
lea eax, [ebp - 0x38]
call fcn.00529780
mov eax, dword [ebp - 0x38]
mov edx, 0x529cec
call fcn.0040508c
jne 0x529bea
mov eax, 0x529cf4
mov dword [ebp - 0x14], eax
jmp 0x529c13
lea eax, [ebp - 0x3c]
call fcn.00529780
mov eax, dword [ebp - 0x3c]
mov edx, 0x529d10
call fcn.0040508c
jne 0x529c0b
mov eax, 0x529d14
mov dword [ebp - 0x14], eax
jmp 0x529c13
mov eax, 0x529d2c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 4], 0
je 0x529c26
mov eax, dword [ebp - 4]
call fcn.00405140
mov dword [ebp - 0x20], eax
jmp 0x529c2b
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
call fcn.00405140
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 1
mov eax, dword [0x67da58]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0049e248
push 1
mov eax, dword [ebp - 0xc]
call fcn.00405140
push eax
mov eax, dword [ebp + 8]
call fcn.00405140
push eax
lea eax, [ebp - 0x30]
push eax
call sub.mpr.dll_WNetAddConnection2A
test eax, eax
sete bl
mov eax, dword [0x67da58]
mov eax, dword [eax]
xor edx, edx
call fcn.0049e248
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529cb4
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00404ca4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404ca4
lea eax, [ebp + 8]
call fcn.00404c80
ret
Function at 0x52a444
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
xor eax, eax
mov dword [0x67c528], eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
cmp dword [0x67c528], 0
jne 0x52a498
mov eax, dword [0x67d730]
mov eax, dword [eax]
call fcn.004a01ac
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x52a494
cmp eax, dword [esp]
pop edx
pop eax
ja 0x52a456
jmp 0x52a498
pop edx
pop eax
jg 0x52a456
pop esi
pop ebx
ret

Function at 0x52a49c
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
mov ebx, edx
push 0x1000
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetWindowTextA
mov eax, ebx
mov edx, esp
mov ecx, 0x1001
call fcn.00404ef0
add esp, 0x1004
pop ebx
ret
Function at 0x530efc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53115c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x530f5f
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00530a2c
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040ebac
cmp al, 1
jne 0x530f5f
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00530cdc
test al, al
je 0x5310eb
cmp dword [ebp - 8], 0
jge 0x530f7d
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00530a2c
mov eax, dword [ebp - 0x210]
call fcn.00404f40
cmp ebx, eax
jge 0x530fc7
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00530a2c
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x67da84]
and eax, 0xff
bt dword [edx], eax
jae 0x530fc7
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x530fdb
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00530ed8
cmp ebx, dword [ebp - 8]
je 0x5310dd
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x531007
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004040ec
and eax, 0x7f
movzx eax, word [eax*2 + 0x67c550]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x5310ca
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004040ec
and eax, 0x7f
movzx eax, word [eax*2 + 0x67c550]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00485df4
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004040ec
and eax, 0x7f
movzx eax, word [eax*2 + 0x67c550]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00485df4
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5310d1
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x53113e
cmp dword [ebp - 8], 0
jge 0x5310f6
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00530a2c
mov eax, dword [ebp - 0x218]
call fcn.00404f40
cmp eax, dword [ebp - 8]
jg 0x531130
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00530a2c
mov eax, dword [ebp - 0x21c]
call fcn.00404f40
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00530ed8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x531163
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404ca4
ret
Function at 0x54a7a0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], edx
cmp dword [eax + 0x198], 0
je 0x54a812
mov eax, ebx
call fcn.0042e134
mov esi, eax
mov eax, ebx
call fcn.0042e14c
mov edi, eax
mov eax, ebx
call fcn.0042da78
call fcn.00430738
call fcn.0042b86c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push edi
push esi
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
jmp 0x54a89e
test ebx, ebx
je 0x54a89e
mov eax, ebx
call fcn.0042e134
test eax, eax
jne 0x54a830
mov eax, ebx
call fcn.0042e14c
test eax, eax
je 0x54a89e
mov eax, ebx
call fcn.0042e134
mov esi, eax
mov eax, ebx
call fcn.0042e14c
mov edi, eax
mov eax, ebx
call fcn.0042da78
call fcn.00430738
call fcn.0042b86c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
cdq
idiv esi
mov ebx, eax
test ebx, ebx
jl 0x54a89e
inc ebx
mov dword [ebp - 0x10], 0
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push edi
push esi
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
imul esi
add eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
inc dword [ebp - 0x10]
dec ebx
jne 0x54a873
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x554334
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405130
mov eax, dword [ebp - 8]
call fcn.00405130
mov eax, dword [ebp - 0xc]
call fcn.00405130
mov eax, dword [ebp + 0xc]
call fcn.00405130
xor eax, eax
push ebp
push 0x554407
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404c80
cmp dword [ebp - 4], 0
je 0x5543e4
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040972c
cmp dword [ebp - 0x10], 0
je 0x5543e4
mov eax, 0x400
call fcn.00402874
mov ebx, eax
mov eax, dword [ebp + 0xc]
call fcn.00405140
push eax
push 0x400
push ebx
mov eax, dword [ebp - 0xc]
call fcn.00405140
push eax
mov eax, dword [ebp - 8]
call fcn.00405140
push eax
mov eax, dword [ebp - 4]
call fcn.00405140
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov eax, esi
mov edx, ebx
call fcn.00404e78
mov eax, ebx
call fcn.00402894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55440e
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404ca4
lea eax, [ebp + 0xc]
call fcn.00404c80
ret
Function at 0x56491c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x564925
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405130
xor eax, eax
push ebp
push 0x564aaa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404c80
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x564ac0
call fcn.00405284
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004051a0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 8]
call fcn.0040972c
lea eax, [ebp - 0x20]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x564ac0
call fcn.00405284
mov edx, eax
inc edx
mov ecx, 0xff
mov eax, dword [ebp - 4]
call fcn.004051a0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
call fcn.0040972c
mov edx, dword [ebp - 0x18]
mov eax, 0x564ac0
call fcn.00405284
dec eax
jge 0x5649cb
lea eax, [ebp - 0x18]
mov edx, 0x564ac0
call fcn.00404f48
lea eax, [ebp - 0x24]
push eax
mov edx, dword [ebp - 0x18]
mov eax, 0x564ac0
call fcn.00405284
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.004051a0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xc]
call fcn.0040972c
lea eax, [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x18]
mov eax, 0x564ac0
call fcn.00405284
mov edx, eax
inc edx
mov ecx, 0xff
mov eax, dword [ebp - 0x18]
call fcn.004051a0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x10]
call fcn.0040972c
push 0x564acc
push dword [ebp - 0xc]
push 0x564adc
push dword [ebp - 8]
push 0x564aec
mov eax, dword [ebx + 0x34c]
push dword [eax + 0xc]
push 0
lea eax, [ebp - 0x14]
mov edx, 7
call fcn.00405000
xor ecx, ecx
mov dl, 1
mov eax, dword [0x520c78]
call fcn.00523f8c
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x248]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call fcn.00524f10
xor edx, edx
mov eax, dword [ebx + 0x30]
call fcn.004b2d38
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov dl, 1
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x564ab1
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.00404ca4
ret
Function at 0x57bf9e
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
push 0
push 0x1fe
push 0x111
push 0
push 0x57bff8
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SendMessageA
xor esi, esi
inc esi
cmp esi, 0x32
jg 0x57bfd6
push 0x57c008
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
ja 0x57bfd6
mov eax, 0x64
call fcn.0052a444
jmp 0x57bfb2
test ebx, ebx
jbe 0x57bff5
jmp 0x57bfec
push ebx
call sub.user32.dll_SetForegroundWindow
mov eax, 0x64
call fcn.0052a444
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
jne 0x57bfdc
pop esi
pop ebx
ret

Function at 0x57c018
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405130
xor eax, eax
push ebp
push 0x57c1c6
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00435eb0
call fcn.00435a28
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x57c1ab
cmp dword [ebp - 4], 0
jne 0x57c079
call fcn.00435eb0
call fcn.00435978
push eax
call fcn.00435eb0
call fcn.00435a28
lea ecx, [ebp - 4]
pop edx
mov ebx, dword [eax]
call dword [ebx + 0xc]
push 0
push 0x1fe
push 0x111
push 0
push 0x57c1d4
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SendMessageA
xor ebx, ebx
inc ebx
cmp ebx, 0x64
jg 0x57c0bb
mov eax, 0x64
call fcn.0052a444
push 0x57c1e4
push 0
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
jbe 0x57c099
test esi, esi
jbe 0x57c0da
jmp 0x57c0d1
push esi
call sub.user32.dll_SetForegroundWindow
mov eax, 0x64
call fcn.0052a444
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
jne 0x57c0c1
mov eax, dword [ebp - 4]
call fcn.00405140
xor edx, edx
call fcn.0050d268
mov eax, 0xa
call fcn.0052a444
mov eax, 0x57c1f4
xor edx, edx
call fcn.0050d268
mov eax, 0xa
call fcn.0052a444
xor ebx, ebx
mov edx, dword [ebp - 4]
mov eax, 0x57c208
call fcn.00405284
dec eax
jne 0x57c158
lea eax, [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.004051a0
mov al, byte [0x57c20c]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, 0x57c218
mov edx, 0x57c228
mov eax, dword [ebp - 4]
call fcn.0040f7a4
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404d18
lea eax, [ebp - 4]
mov edx, 0x57c234
call fcn.00404f48
mov eax, dword [ebp - 4]
call fcn.00405140
push eax
push 0
call sub.user32.dll_FindWindowA
test eax, eax
jbe 0x57c17e
or ebx, 0xffffffff
jmp 0x57c190
inc ebx
cmp ebx, 0x32
jg 0x57c190
mov eax, 0x64
call fcn.0052a444
jmp 0x57c165
inc ebx
jne 0x57c1ab
push 0
push 0
push 0x10
push 0x57c1e4
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57c1cd
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ca4
ret
Function at 0x5803e8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405130
xor eax, eax
push ebp
push 0x580472
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x14]
mov ecx, 0x580488
mov edx, dword [ebp - 4]
call fcn.00404f8c
mov eax, dword [ebp - 0x14]
call fcn.00405140
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov edx, ebx
mov eax, 8
call fcn.00409c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x580479
lea eax, [ebp - 0x14]
call fcn.00404c80
lea eax, [ebp - 4]
call fcn.00404c80
ret

Function at 0x588f84
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405130
xor eax, eax
push ebp
push 0x588fd5
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00405140
push eax
push 0x588fe0
push 0x588ff0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x588fdc
lea eax, [ebp - 4]
call fcn.00404c80
ret

Function at 0x58f3d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405130
mov eax, dword [ebp - 8]
call fcn.00405130
xor eax, eax
push ebp
push 0x58f497
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x58f4ac
call fcn.0040508c
je 0x58f436
mov eax, dword [ebp - 8]
mov edx, 0x58f4b8
call fcn.0040508c
je 0x58f436
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405140
push eax
push 0x58f4bc
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x58f47c
mov eax, dword [ebp - 8]
mov edx, 0x58f4b8
call fcn.0040508c
jne 0x58f449
xor ebx, ebx
jmp 0x58f44e
mov ebx, 1
mov eax, dword [ebp - 8]
mov edx, 0x58f4ac
call fcn.0040508c
jne 0x58f46e
push 0
mov ecx, ebx
or edx, 0xffffffff
mov eax, dword [ebp - 4]
call fcn.0058f7ac
jmp 0x58f47c
push 0
mov ecx, ebx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0058f7ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58f49e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ca4
ret

Function at 0x58f774
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, edx
push 0xff
lea edx, [ebp - 0x100]
push edx
push eax
call sub.user32.dll_GetWindowTextA
mov eax, ebx
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404ef0
pop ebx
mov esp, ebp
pop ebp
ret