joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f4d88
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x63550c
test esi, esi
jne 0x4f4da2
xor eax, eax
jmp 0x4f4e93
cmp dword [ebp], 0
jne 0x4f4dad
call fcn.004f4d18
xor ebx, 0xffffffff
cmp edi, 8
jb 0x4f4e6d
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x4f4db9
test edi, edi
jbe 0x4f4e8e
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x4f4e71
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x502650
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x635518
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x502672
shr eax, 1
xor eax, 0xedb88320
jmp 0x502674
shr eax, 1
dec edx
jne 0x502660
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x502659
mov byte [0x635918], 1
pop esi
pop ebx
ret

Function at 0x502690
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x635918], 0
jne 0x5026a7
call fcn.00502650
mov eax, edi
dec eax
test eax, eax
jl 0x5026cf
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x635518]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5026b1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x505478
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x505512.0
jmp dword [ecx*4 + 0x5054ab]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5054dd
sub dl, 8
je 0x5054ec
jmp case.0x505512.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x505120
jmp case.0x505512.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x505178
jmp case.0x505512.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x505512.0
movzx ecx, byte [ecx + 0x505519]
jmp dword [ecx*4 + 0x50552a]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x505224
jmp case.0x505512.0
cmp dl, 3
jne 0x505557
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x50527c
jmp case.0x505512.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x505238
jmp case.0x505512.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5052c0
jmp case.0x505512.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x505582
sub dl, 8
je 0x50558e
jmp case.0x505512.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x5052ec
jmp case.0x505512.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x505358
jmp case.0x505512.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5055ad
sub dl, 8
je 0x5055b9
jmp case.0x505512.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x505414
jmp case.0x505512.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x50543c
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x50565b
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00504624
test eax, eax
je 0x50565b
mov eax, ebx
call fcn.00505664
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x5055f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x505664
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x505695
dec al
je 0x5056d0
dec al
je 0x505715
dec al
je 0x50577e
jmp 0x505808
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x505808
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5056a5
jmp 0x505808
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x505808
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5056e0
jmp 0x505808
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x505808
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x505744
xor ebp, ebp
jmp 0x505754
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x50575d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x505725
jmp 0x505808
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x505808
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5057d7
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005026d8
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x505792
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x511200
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff828
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x7d8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5112ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406a68
mov eax, dword [0x62f7e0]
cmp dword [eax], 2
jne 0x51126f
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00406d5c
mov eax, dword [ebx]
call fcn.00406c44
push eax
mov eax, dword [ebx]
call fcn.00406c34
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00406c44
mov edx, eax
dec edx
mov eax, ebx
call fcn.00406d5c
jmp 0x5112a1
lea eax, [ebp - 0x7d2]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageW
lea edx, [ebp - 0x7d8]
lea eax, [ebp - 0x7d2]
call fcn.004154f4
mov edx, dword [ebp - 0x7d8]
mov eax, ebx
call fcn.0040709c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5112c1
lea eax, [ebp - 0x7d8]
call fcn.00406e00
ret
Function at 0x53b204
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.0053b1f0
test eax, eax
jne 0x53b227
mov eax, esi
xor edx, edx
call fcn.00406e10
jmp 0x53b2bc
mov eax, ebx
call fcn.0053b354
test al, al
je 0x53b26f
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageW
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.00406f4c
test edi, edi
je 0x53b264
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageW
jmp 0x53b2bc
mov eax, esi
xor edx, edx
call fcn.00406e10
jmp 0x53b2bc
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x53b2b3
mov eax, dword [ebp + 0x270]
call fcn.004384c0
test eax, eax
jle 0x53b2a1
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x270]
mov edx, edi
call fcn.0048b9e0
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.00406e10
jmp 0x53b2bc
mov eax, esi
mov edx, dword [ebx + 0x78]
mov edx, dword [edx + 0x278]
call fcn.00406e10
jmp 0x53b2bc
mov eax, esi
xor edx, edx
call fcn.00406e10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x53d0b4
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.0040ab40
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageW
pop esi
pop ebx
ret

Function at 0x543620
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x543691
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x62cb68]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x54367b
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00543608
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x542dc0]
call fcn.005440c4
mov dword [0x62cbcc], eax
mov eax, dword [ebp - 4]
call fcn.005435b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x543698
lea eax, [ebp - 8]
call fcn.00409c50
ret

Function at 0x5436c0
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffd4c
mov esi, 0x4008
test cl, cl
je 0x5436d3
or esi, 2
test dl, dl
je 0x5436dc
or esi, 0
jmp 0x5436df
or esi, 1
push esi
push 0x2b4
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [esp + 4]
add esp, 0x2b4
pop esi
ret
Function at 0x5449c0
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffd4c
mov eax, esp
xor ecx, ecx
mov edx, 0x2b4
call fcn.00404a70
push 0x4001
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
push 0x544a5c
call sub.shell32.dll_SHGetFileInfoW
mov dword [0x62cb60], eax
cmp dword [0x62cb60], 0
je 0x544a53
cmp dword [0x62cb64], 0
jne 0x544a53
xor ecx, ecx
mov dl, 1
mov eax, dword [0x546834]
call fcn.00547700
mov dword [0x62cb64], eax
mov edx, dword [0x62cb60]
mov eax, dword [0x62cb64]
call fcn.004ca538
mov dl, 1
mov eax, dword [0x62cb64]
call fcn.004ca4b4
mov dl, 1
mov eax, dword [0x62cb64]
call fcn.005491dc
push 0xffffffffffffffff
mov eax, dword [0x62cb64]
call fcn.004ca574
push eax
call sub.comctl32.dll_ImageList_SetBkColor
add esp, 0x2b4
ret
Function at 0x570fbc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x70], 0
jne 0x570fd4
mov eax, ebx
call fcn.00570d1c
cmp dword [ebx + 0x68], 0
jne 0x570fe1
mov eax, ebx
call fcn.00570c74
mov esi, dword [ebx + 0x70]
test esi, esi
je 0x571188
cmp dword [ebx + 0x68], 0
je 0x571188
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov dword [esp], eax
mov eax, dword [ebx + 0x70]
mov edx, dword [eax]
call dword [edx + 0x24]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.00570bf8
mov edx, dword [esp + 0x1c]
mov ecx, edx
mov esi, dword [esp + 0x14]
sub ecx, esi
mov eax, dword [esp]
cmp ecx, eax
je 0x571054
mov ecx, dword [esp + 4]
sub ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x18]
sar ecx, 1
jns 0x57103d
adc ecx, 0
push ecx
sub eax, edx
add eax, esi
sar eax, 1
jns 0x571049
adc eax, 0
push eax
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0xe0]
test eax, eax
je 0x57106a
call fcn.004bb0e0
mov esi, eax
jmp 0x57106d
mov esi, dword [ebx + 0x50]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
and eax, 8
cmp eax, 8
jne 0x571082
or esi, 0xffffffff
jmp 0x57108c
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.004deeb8
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.004deef4
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.004b17d4
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.004b1808
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.0040ab70
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.004bb0e0
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.004bb0e0
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.004bb0e0
push eax
call sub.user32.dll_SetWindowLongW
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x70]
call fcn.0045f8dc
call fcn.0045a044
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.004bb0e0
push eax
mov eax, dword [0x62ede4]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.004bb0e0
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x575ffc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4d1f70]
call fcn.004d84a4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0xffffff9e
push 0xffffffffffffffec
mov eax, dword [ebp - 8]
call fcn.004bb0e0
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80
or eax, 0x8000000
push eax
push 0xffffffffffffffec
mov eax, dword [ebp - 8]
call fcn.004bb0e0
push eax
call sub.user32.dll_SetWindowLongW
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004d94e0
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004da40c
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowRect
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.00594f38
push eax
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.00594f4c
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x98]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
call fcn.0056afdc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x576141
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.0045f8dc
call fcn.0045a044
push eax
call sub.gdi32.dll_BitBlt
push 0x1fffffff
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x30]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.0040ab40
lea edx, [ebp - 0x30]
mov cl, 0xff
mov eax, dword [ebp - 0x10]
call fcn.0054a550
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x576148
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ReleaseDC
ret

Function at 0x576190
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x5761a0
call sub.user32.dll_FindWindowW
ret
Function at 0x593310
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x74], 0
jne 0x593328
mov eax, ebx
call fcn.00592b24
cmp dword [ebx + 0x70], 0
jne 0x593335
mov eax, ebx
call fcn.00592a80
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x5934e8
cmp dword [ebx + 0x70], 0
je 0x5934e8
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov dword [esp], eax
mov eax, dword [ebx + 0x74]
mov edx, dword [eax]
call dword [edx + 0x24]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.005928c8
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00594f38
cmp eax, dword [esp]
je 0x5933b7
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00594f4c
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x593393
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.00594f38
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x5933ac
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x5933ca
mov eax, dword [eax + 0x18]
call fcn.004bb0e0
mov esi, eax
jmp 0x5933cd
mov esi, dword [ebx + 0x58]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
and eax, 8
cmp eax, 8
jne 0x5933e2
or esi, 0xffffffff
jmp 0x5933ec
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x70]
call fcn.004deeb8
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x70]
call fcn.004deef4
mov edx, dword [esp]
mov eax, dword [ebx + 0x70]
call fcn.004b17d4
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x70]
call fcn.004b1808
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.0040ab70
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x70]
call fcn.004bb0e0
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x70]
call fcn.004bb0e0
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x70]
call fcn.004bb0e0
push eax
call sub.user32.dll_SetWindowLongW
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x74]
call fcn.0045f8dc
call fcn.0045a044
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x70]
call fcn.004bb0e0
push eax
mov eax, dword [0x62ede4]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x70]
call fcn.004bb0e0
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x593728
Capabilities:
Allocate or change rwx memory
Find taskbar
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa0
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.00404a70
lea eax, [esp + 0x3c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x59395e
push 0
push 0x593968
push 0
push eax
call sub.user32.dll_FindWindowExW
test eax, eax
je 0x59395e
push 0
push 0x593984
push 0
push eax
call sub.user32.dll_FindWindowExW
test eax, eax
je 0x59395e
push 0
push 0x5939a0
push 0
push eax
call sub.user32.dll_FindWindowExW
test eax, eax
je 0x59395e
push 0
push 0x5939c0
push 0
push eax
call sub.user32.dll_FindWindowExW
mov ebp, eax
test ebp, ebp
je 0x59395e
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageW
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x59395e
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x59395e
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x59395e
push 0x40
push 0x1000
push 0x1000
push 0
push edi
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x59395e
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x59394a
inc ebx
push esi
push ebx
push 0x417
push ebp
call sub.user32.dll_SendMessageW
test eax, eax
je 0x593940
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x20]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x593940
test byte [esp + 0x21], 0xd
jne 0x593940
movzx eax, byte [esp + 0x20]
and al, 8
cmp al, 8
je 0x593940
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x30]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x593940
cmp dword [esp + 0xc], 0
je 0x593940
mov eax, dword [0x62f410]
mov eax, dword [eax]
cmp byte [eax + 0xd3], 0
je 0x5938dd
mov eax, dword [0x62f410]
mov eax, dword [eax]
cmp dword [eax + 0x44], 0
je 0x5938dd
mov eax, dword [0x62f410]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.004bb0e0
mov dword [esp + 0x14], eax
jmp 0x5938ee
mov eax, dword [0x62f410]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x14]
jne 0x593940
push esi
push ebx
push 0x41d
push ebp
call sub.user32.dll_SendMessageW
test eax, eax
je 0x59391c
lea eax, [esp + 0xc]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0xc], 0
je 0x59394a
lea eax, [esp + 0x2c]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
call fcn.0040ac2c
jmp 0x59394a
cmp ebx, dword [esp + 4]
jl 0x593836
push 0x8000
push 0
push esi
push edi
call sub.kernel32.dll_VirtualFreeEx
push edi
call sub.kernel32.dll_CloseHandle_1
add esp, 0x60
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x595b68
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd48
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00414aa8
test al, al
je 0x595bef
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x2b4
call fcn.00404a70
or esi, 0x100
test esi, esi
jns 0x595ba3
call fcn.00404fc4
push esi
push 0x2b4
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00406e9c
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x595bef
mov dl, 1
mov eax, dword [0x4562c0]
call fcn.004615d4
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00461a68
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x20]
test al, al
je 0x595bef
mov eax, esp
call fcn.0041ca80
mov eax, dword [esp]
add esp, 0x2b8
pop esi
pop ebx
ret