joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dacc4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x4dacdc
mov eax, ebx
call fcn.004da538
cmp dword [ebx + 0x68], 0
jne 0x4dace9
mov eax, ebx
call fcn.004da494
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x4dae9c
cmp dword [ebx + 0x68], 0
je 0x4dae9c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.004da2f8
lea eax, [esp + 0x14]
xor edx, edx
call fcn.005279a8
cmp eax, dword [esp]
je 0x4dad6b
lea eax, [esp + 0x14]
xor edx, edx
call fcn.005279bc
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4dad47
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.005279a8
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4dad60
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4dad7e
mov eax, dword [eax + 0x18]
call fcn.00461e10
mov esi, eax
jmp 0x4dad81
mov esi, dword [ebx + 0x50]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
and eax, 8
cmp eax, 8
jne 0x4dad96
or esi, 0xffffffff
jmp 0x4dada0
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.00475e8c
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.00475ec8
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.00459324
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00459358
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00407ecc
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00461e10
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00461e10
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00461e10
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.00437b04
call fcn.00432ef8
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00461e10
push eax
mov eax, dword [0x5d1718]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.00461e10
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4db0dc
Capabilities:
Allocate or change rwx memory
Find taskbar
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa0
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.00403b60
lea eax, [esp + 0x3c]
push eax
call sub.kernel32.dll_GetSystemInfo
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x4db2d5
push 0
push 0x4db2e0
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4db2d5
push 0
push 0x4db2f0
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4db2d5
push 0
push 0x4db300
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4db2d5
push 0
push 0x4db310
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebp, eax
test ebp, ebp
je 0x4db2d5
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageA
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x4db2d5
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x4db2d5
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x4db2d5
push 0x40
push 0x1000
push 0x1000
push 0
push edi
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x4db2d5
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x4db2c1
inc ebx
push esi
push ebx
push 0x417
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4db2b7
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x20]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4db2b7
test byte [esp + 0x21], 0xd
jne 0x4db2b7
movzx eax, byte [esp + 0x20]
and al, 8
cmp al, 8
je 0x4db2b7
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x30]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4db2b7
cmp dword [esp + 0xc], 0
je 0x4db2b7
mov eax, dword [0x5d1c60]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x14]
jne 0x4db2b7
push esi
push ebx
push 0x41d
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4db293
lea eax, [esp + 0xc]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0xc], 0
je 0x4db2c1
lea eax, [esp + 0x2c]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
call fcn.00407f28
jmp 0x4db2c1
cmp ebx, dword [esp + 4]
jl 0x4db1ea
push 0x8000
push 0
push esi
push edi
call sub.kernel32.dll_VirtualFreeEx
push edi
call sub.kernel32.dll_CloseHandle_1
add esp, 0x60
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f6874
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.004f6860
test eax, eax
jne 0x4f6895
mov eax, esi
call fcn.00405698
jmp 0x4f6926
mov eax, ebx
call fcn.004f69bc
test al, al
je 0x4f68db
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.00405788
test edi, edi
je 0x4f68d2
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
jmp 0x4f6926
mov eax, esi
call fcn.00405698
jmp 0x4f6926
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x4f691f
mov eax, dword [ebp + 0x250]
call fcn.00420de4
test eax, eax
jle 0x4f690d
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x250]
mov edx, edi
call fcn.00483ed0
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.004056ec
jmp 0x4f6926
mov eax, esi
mov edx, dword [ebx + 0x78]
mov edx, dword [edx + 0x258]
call fcn.004056ec
jmp 0x4f6926
mov eax, esi
call fcn.00405698
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4f8620
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.00407eb0
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret
Function at 0x527dfc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x5d1c60]
mov eax, dword [eax]
call fcn.00479064
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, esi
jb 0x527e07
pop esi
pop ebx
ret

Function at 0x5283b0
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.0040b1a4
test al, al
je 0x528437
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00403b60
or esi, 0x100
test esi, esi
jns 0x5283eb
call fcn.004045fc
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00405b28
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x528437
mov dl, 1
mov eax, dword [0x430b48]
call fcn.00439160
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00439570
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x528437
mov eax, esp
call fcn.004118cc
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret

Function at 0x528750
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x5d84d4
test esi, esi
jne 0x52876a
xor eax, eax
jmp 0x52885b
cmp dword [ebp], 0
jne 0x528775
call fcn.005286e0
xor ebx, 0xffffffff
cmp edi, 8
jb 0x528835
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x528781
test edi, edi
jbe 0x528856
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x528839
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x53244c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5324bb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00405698
push 0xff
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
jbe 0x53249b
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00405908
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004056ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5324c2
lea eax, [ebp - 4]
call fcn.00405698
ret

Function at 0x53251c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x53258b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00405698
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jbe 0x53256b
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00405908
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004056ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x532592
lea eax, [ebp - 4]
call fcn.00405698
ret

Function at 0x54fa70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x54fb07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00405db8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405b28
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405958
test eax, eax
jns 0x54fab7
call fcn.004045fc
push eax
call sub.kernel32.dll_GetTempPathA
test eax, eax
jns 0x54fac6
call fcn.004045fc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405db8
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, dword [0x533eb0]
call fcn.00532fcc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004056ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54fb0e
lea eax, [ebp - 0xc]
call fcn.00405698
ret

Function at 0x553a74
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x553ae5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00553a50
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00550edc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
call fcn.00550938
mov eax, dword [ebp - 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x553aec
lea eax, [ebp - 0x14]
call fcn.00405698
ret
Function at 0x55d10c
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
movzx ebx, bl
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
movzx edx, dl
movzx eax, al
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax*8 + 0x5cf5e8]
movzx eax, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x55d144
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x55d15c
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x55d155
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403b60
xor edx, edx
mov eax, 0x5cf7e8
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
movzx ecx, cl
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x55d1c3
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x55d17a
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x55d404
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x55d41d
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x55d416
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x55d42f
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x55d428
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.0055cffc
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x55d449
movzx eax, byte [ebp - 0xa]
movzx edx, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 9]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
add edx, edx
add edx, edx
movzx eax, byte [ebp - 8]
movzx ecx, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 7]
movzx edx, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 6]
and al, 0xf
add eax, eax
add eax, eax
movzx edx, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
movzx edx, byte [esi]
call fcn.0055d10c
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x55d4d1
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x55d4ef
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.0055d08c
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x55d519
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x55d530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x55d549
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x55d542
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x55d55d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0055cefc
test bl, bl
jne 0x55d637
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x5d93f4
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x55d595
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x55d5aa
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0055d404
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x55d5dd
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x55d58a
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x55d601
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x55d613
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x55d628
jmp 0x55d6f8
cmp bl, 1
jne 0x55d6f8
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x5d944e
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x55d657
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x55d66c
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0055d404
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x55d69f
sub ebx, 6
inc dword [ebp - 8]
jne 0x55d64c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x55d6c7
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x55d6d9
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x55d6ee
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0055cf7c
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x55e72c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x55e934
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0x104
lea eax, [ebp - 0x10c]
push eax
push esi
call sub.user32.dll_GetClassNameA
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x10c]
call fcn.0040b8a4
mov eax, dword [ebp - 0x110]
mov edx, 0x55e94c
call fcn.00405ac0
je 0x55e7ee
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x10c]
call fcn.0040b8a4
mov eax, dword [ebp - 0x114]
mov edx, 0x55e95c
call fcn.00405ac0
je 0x55e7ee
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x10c]
call fcn.0040b8a4
mov eax, dword [ebp - 0x118]
mov edx, 0x55e974
call fcn.00405ac0
jne 0x55e909
xor ebx, ebx
xor eax, eax
mov dword [0x5d945c], eax
lea edx, [ebp - 0x11c]
lea eax, [ebp - 0x10c]
call fcn.0040b8a4
mov eax, dword [ebp - 0x11c]
mov edx, 0x55e94c
call fcn.00405ac0
jne 0x55e8d6
push 0x104
lea eax, [ebp - 0x10c]
push eax
push esi
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 4]
lea eax, [ebp - 0x10c]
call fcn.0040b8a4
push 0
push 0x55e98c
push 0
push esi
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0
push 0x55e994
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
cmp byte [0x5d9458], 0
je 0x55e89e
push 0
push 0x55e9a4
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0
push 0x55e9b4
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0
push 0x55e9c0
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
jmp 0x55e8d6
push 0
push 0x55de8c
push esi
call sub.user32.dll_EnumChildWindows
cmp dword [0x5d945c], 0
je 0x55e909
push 0
push 0x55e9c8
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0
push 0x55e9c0
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x55e909
lea eax, [ebp - 0x10c]
push eax
push 0x104
push 0xd
push ebx
call sub.user32.dll_SendMessageA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10c]
call fcn.0040b8a4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0055df70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55e93b
lea eax, [ebp - 0x11c]
mov edx, 4
call fcn.004056bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004056bc
ret
Function at 0x55fe3c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x411f00]
call fcn.00406328
xor eax, eax
push ebp
push 0x55ffdd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5cf860], 0
jne 0x55fe97
mov ecx, dword [0x5d15fc]
mov dl, 1
mov eax, dword [0x4092b4]
call fcn.0040fb48
call fcn.00404fe8
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403b60
mov eax, ebx
call fcn.00406070
mov dword [ebp - 0x24], eax
mov esi, 0x55ffec
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.004077ec
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00406080
test eax, eax
jle 0x55ff80
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x55ff6c
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405908
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x55ff12
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405920
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x55ff28
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405920
mov eax, dword [ebp - 0x54]
call fcn.00405b28
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405908
mov eax, dword [ebp - 0x58]
call fcn.00405b28
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x55ff6e
xor eax, eax
test al, al
je 0x55ff79
mov ebx, 0x15
jmp 0x55ff85
mov ebx, 0x10
jmp 0x55ff85
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x5cf860]
call fcn.0055fcbc
mov eax, dword [ebp - 4]
call fcn.0055fcbc
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00407804
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55ffe4
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.004056bc
lea eax, [ebp - 0xc]
mov edx, dword [0x411f00]
call fcn.004063f8
ret