joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5579a0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x3ec
push esi
push eax
call fcn.005827d0
mov esi, eax
add esp, 4
test esi, esi
je 0x5579cd
mov ecx, dword [esi + 0xbf4]
push ecx
call fcn.00502a60
add esp, 4
test eax, eax
jne 0x5579df
push 0
call fcn.00421c80
add esp, 4
pop esi
add esp, 0x3ec
ret
push ebx
push ebp
push edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebx, eax
cmp ebx, dword [esi + 0x884]
je 0x5579fe
cmp ebx, dword [esi + 0x888]
jne 0x557bff
mov eax, dword [esi + 0x8b0]
push 0
lea edx, [esp + 0x14]
push edx
push eax
push ebx
call fcn.004883e0
mov eax, dword [esp + 0x20]
add esp, 0x10
test eax, eax
jle 0x557a31
mov ecx, dword [esi + 0xbf4]
mov eax, dword [ecx + 0x21c8]
test eax, eax
je 0x557bb5
mov edx, dword [esi + 0xbf4]
mov ecx, dword [edx + 0x21bc]
mov eax, ecx
test eax, eax
je 0x557bb5
mov ebp, 1
lea esp, [esp]
cmp dword [eax + 0x1c], ebp
je 0x557af3
mov eax, dword [eax + 0x40]
test eax, eax
jne 0x557a50
mov edi, dword [ecx + 0x44]
test edi, edi
je 0x557bb5
lea eax, [esp + 0x14]
push 0x3e7
push eax
mov dword [edi + 0x1c], ebp
call fcn.00423a00
mov ecx, dword [edi]
push ecx
lea edx, [esp + 0x20]
push str._msg__s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esi]
push 0
push 0
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.005578a0
push esi
mov edi, eax
call fcn.00582ac0
add esp, 0x28
test eax, eax
je 0x557c09
test edi, edi
je 0x557adc
lea edx, [esp + 0x14]
push edx
push 0
push 0xc
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x7d000
push 0x7d000
push ebp
push ebx
call fcn.00488690
add esp, 0x10
mov eax, dword [esi + 0xbf4]
pop edi
mov dword [eax + 0x21c8], ebp
pop ebp
pop ebx
pop esi
add esp, 0x3ec
ret
mov edi, dword [eax + 0x44]
mov dword [eax + 0x1c], 0
mov eax, dword [esi + 0xbf4]
mov ecx, dword [eax + 0x21bc]
cmp edi, dword [ecx + 0x44]
jne 0x557a63
mov ecx, dword [esi + 0x71c]
mov eax, 2
cmp ecx, eax
jne 0x557b40
cmp dword [esi + 0x720], eax
jne 0x557b40
mov edx, dword [str._msg]
mov ax, word [0x5f0334]
mov dword [esp + 0x14], edx
mov word [esp + 0x18], ax
jmp 0x557b52
lea ecx, [esp + 0x14]
push 0x3e7
push ecx
call fcn.00423a00
add esp, 8
mov eax, dword [esi]
push 0
push 0
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.005578a0
push esi
mov edi, eax
call fcn.00582ac0
add esp, 0x14
test eax, eax
je 0x557c09
test edi, edi
je 0x557b9e
lea ecx, [esp + 0x14]
push ecx
push 0
push 0xc
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x7d000
push 0x7d000
push ebp
push ebx
call fcn.00488690
add esp, 0x10
mov edx, dword [esi + 0xbf4]
pop edi
mov dword [edx + 0x21c8], ebp
pop ebp
pop ebx
pop esi
add esp, 0x3ec
ret
lea ecx, [esp + 0x14]
push 0x3e7
push ecx
call fcn.00423a00
add esp, 8
lea edx, [esp + 0x14]
push edx
push 0x3e6
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi]
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.005578a0
add esp, 0x10
test eax, eax
je 0x557c09
push esi
call fcn.00582ac0
add esp, 4
test eax, eax
je 0x557c09
push 0
call fcn.00421c80
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x3ec
ret
Function at 0x557c70
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x3f4
push edi
push eax
call fcn.005827d0
mov edi, eax
add esp, 4
test edi, edi
jne 0x557c94
xor eax, eax
pop edi
add esp, 0x3f4
ret
mov ecx, dword [edi + 0xbf4]
push ecx
call fcn.00502a60
add esp, 4
test eax, eax
je 0x557c8a
push esi
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
cmp esi, dword [edi + 0x884]
je 0x557ccb
cmp esi, dword [edi + 0x888]
je 0x557ccb
pop esi
xor eax, eax
pop edi
add esp, 0x3f4
ret
mov ecx, dword [edi + 0x8b0]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
push ecx
push esi
call fcn.00488760
mov eax, dword [esp + 0x1c]
add esp, 0x10
test eax, eax
mov dword [esp + 0x10], eax
jge 0x557d01
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov eax, dword [edi + 0x8b0]
push 0
lea edx, [esp + 0xc]
push edx
push eax
push esi
call fcn.004883e0
mov eax, dword [esp + 0x18]
add esp, 0x10
test eax, eax
jle 0x557cc0
lea ecx, [esp + 0x14]
push 0x3e7
push ecx
call fcn.00423a00
add esp, 8
lea edx, [esp + 0x14]
push edx
push 0x3e6
push 0xd
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
mov dword [esp + 8], eax
jle 0x557cc0
push 5
mov byte [esp + eax + 0x18], 0
lea eax, [esp + 0x18]
push str._msg
push eax
call fcn.005e325e
add esp, 0xc
test eax, eax
jne 0x557d7c
pop esi
mov eax, 1
pop edi
add esp, 0x3f4
ret
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 8]
jg 0x557cc0
dec eax
jns 0x557d8f
xor eax, eax
mov dl, byte [esp + eax + 0x14]
xor ecx, ecx
cmp dl, 0x20
setne cl
pop esi
pop edi
mov eax, ecx
add esp, 0x3f4
ret
Function at 0x55a050
Capabilities:
Capture screenshot
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
jl 0x55a05d
cmp eax, 0x32
jl 0x55a05f
xor eax, eax
mov dword [esp + 0xc], eax
jmp fcn.00559740
Function at 0x55e4d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
cmp edi, 0x29
jne 0x55e5dd
mov eax, dword [0x643ffc]
test eax, eax
jne 0x55e601
mov esi, dword [esp + 0x1c]
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x55e5ff
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x55e5ff
mov cx, word [esi + 0xe]
cmp cx, 1
lea eax, [esi + 0x28]
mov dword [esp + 0x20], eax
jb 0x55e544
cmp cx, 8
ja 0x55e544
mov edx, 1
shl edx, cl
lea eax, [eax + edx*4]
mov dword [esp + 0x20], eax
mov ebx, dword [esi + 4]
push ebp
mov ebp, dword [esi + 8]
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetDC]
test eax, eax
mov dword [esp + 0x10], eax
je 0x55e5d1
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x55e5c4
mov ecx, dword [esp + 0x10]
push ebp
push ebx
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [esp + 0x14], eax
je 0x55e5bd
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x24]
push 0xcc0020
push 0
push esi
push edx
push ebp
push ebx
push 0
push 0
push ebp
push ebx
push 0
push 0
push edi
mov dword [esp + 0x4c], eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
mov eax, dword [esp + 0x18]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x10]
push ecx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov esi, dword [esp + 0x24]
mov edx, dword [esi + 0x1c]
xor eax, eax
test edx, edx
jle 0x55e5ff
lea ecx, [esi + 0x24]
lea ecx, [ecx]
cmp dword [ecx], edi
je 0x55e608
inc eax
add ecx, 0x7bc
cmp eax, edx
jl 0x55e5f0
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xc
ret
imul eax, eax, 0x7bc
mov eax, dword [eax + esi + 0x34c]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x55fed0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x643ed8]
sub esp, 0x10
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x419
push ecx
call esi
cmp eax, 0xffffffff
je 0x55ff2b
lea edx, [esp + 4]
push edx
push eax
mov eax, dword [0x643ed8]
push 0x41d
push eax
call esi
test eax, eax
je 0x55ff2b
mov edx, dword [0x643ed8]
push 1
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x643ed8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
add esp, 0x10
ret
Function at 0x564920
Capabilities:
Hide graphical window

Disassembly:
call fcn.005648a0
test eax, eax
je 0x56498a
mov eax, dword [0x645320]
mov ecx, dword [0x645324]
push 0
push eax
push 0x80b4
push ecx
push 0
push 0
push 0
push 0
push 0x42000000
push 0x5e6c98
push str.mIRC_ToolBar
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x643ed8], eax
je 0x56498a
push 0
call fcn.00561350
add esp, 4
test eax, eax
jne 0x56498d
mov edx, dword [0x643ed8]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x643ed8], 0
xor eax, eax
ret
mov eax, dword [0x63c814]
push eax
push str.toolbar
push str.toolbar.ini
call fcn.00560390
mov eax, dword [0x60a1f0]
add esp, 0xc
test eax, eax
je 0x5649c3
mov ecx, dword [0x643ed8]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x643ed8]
ret
mov edx, dword [0x643ed8]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x643ed8]
ret

Function at 0x5656e0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.0053d2f0
add esp, 4
test eax, eax
je 0x5657cd
mov eax, dword [esi + 0x3a4]
test eax, eax
push ebx
push edi
push 0
je 0x56578a
push 0x15be
call fcn.00421db0
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
add esp, 8
push eax
mov eax, dword [esi]
push 0
push 0xc
push 0x79
push eax
call edi
mov eax, dword [esi + 0x344]
test eax, eax
push 0
je 0x565759
mov ecx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x78
push ecx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov edx, dword [esi]
push 0
push 0x77
push edx
call edi
push eax
call ebx
pop edi
pop ebx
pop esi
ret
push 0x15bf
call fcn.00421db0
add esp, 8
push eax
mov eax, dword [esi]
push 0
push 0xc
push 0x77
push eax
call edi
mov ecx, dword [esi]
push 5
push 0x77
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebx
pop esi
ret
push 0x15bd
call fcn.00421db0
mov edx, dword [esi]
add esp, 8
push eax
push 0
push 0xc
push 0x79
push edx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x78
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi]
push 0
push 0x77
push ecx
call edi
push eax
call ebx
pop edi
pop ebx
pop esi
ret
Function at 0x5657d0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.0049c8e0
add esp, 4
test eax, eax
je 0x5658aa
mov eax, dword [esi + 0x488]
test eax, eax
push ebx
push edi
push 0
je 0x565867
push 0x15be
call fcn.00421db0
add esp, 8
push eax
mov eax, dword [esi]
push 0
push 0xc
push 0x79
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ecx, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push 0x78
push ecx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov edx, dword [esi]
push 5
push 0x77
push edx
call edi
push eax
call ebx
mov eax, dword [esi + 0x448]
test eax, eax
je 0x565853
mov eax, dword [esi]
push 1
push 0x77
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop ebx
pop esi
ret
mov ecx, dword [esi]
push 0
push 0x77
push ecx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop ebx
pop esi
ret
push 0x15bd
call fcn.00421db0
mov edx, dword [esi]
add esp, 8
push eax
push 0
push 0xc
push 0x79
push edx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x78
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi]
push 0
push 0x77
push ecx
call edi
push eax
call ebx
pop edi
pop ebx
pop esi
ret
Function at 0x5698d0
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
mov eax, dword [0x645324]
push esi
push edi
push 0x80
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov dword [0x644698], 0
call edi
xor esi, esi
mov si, ax
push 0x11
and esi, 0x8000
sub esi, 0x8000
neg esi
sbb esi, esi
inc esi
call edi
test ah, ah
jns 0x56994b
mov eax, dword [0x63aad8]
test eax, eax
je 0x56992d
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov eax, 1
pop esi
ret
mov ecx, dword [0x645324]
push 1
push 0
push 0x8043
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x569a30
mov eax, dword [0x60a244]
test eax, eax
jne 0x56996a
mov eax, dword [0x60a240]
test eax, eax
je 0x569966
test esi, esi
je 0x56996a
pop edi
xor eax, eax
pop esi
ret
test esi, esi
je 0x569961
push 1
call fcn.00569470
add esp, 4
test eax, eax
je 0x569961
mov eax, dword [0x60a240]
test eax, eax
push 6
je 0x5699ab
test esi, esi
je 0x569990
mov edx, dword [0x645324]
push edx
jmp 0x5699d1
mov eax, dword [0x645324]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
mov ecx, dword [0x645324]
push 0
push ecx
call esi
jmp 0x5699d7
test esi, esi
je 0x5699ca
mov edx, dword [0x645324]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push edx
call esi
mov eax, dword [0x645324]
push 0
push eax
call esi
jmp 0x5699d7
mov ecx, dword [0x645324]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x63aad0]
test eax, eax
je 0x569a30
mov esi, dword [0x64531c]
test esi, esi
je 0x569a30
mov edi, dword [sym.imp.USER32.dll_IsIconic]
push ebx
mov ebx, dword [sym.imp.USER32.dll_IsWindowVisible]
mov edx, dword [esi]
push edx
call fcn.00582c10
add esp, 4
test eax, eax
jne 0x569a25
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x569a25
mov ecx, dword [esi]
push ecx
call ebx
test eax, eax
je 0x569a25
mov edx, dword [esi]
push 1
push edx
call fcn.004a5ab0
add esp, 8
mov esi, dword [esi + 0xe54]
test esi, esi
jne 0x5699f7
pop ebx
pop edi
mov eax, 1
pop esi
ret
Function at 0x569a40
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x60a244]
test eax, eax
je 0x569a60
mov eax, dword [0x644578]
test eax, eax
je 0x569a56
push 5
jmp 0x569a58
push 1
call fcn.00569470
add esp, 4
mov eax, dword [0x60a240]
test eax, eax
push esi
je 0x569af5
mov eax, dword [0x645324]
mov esi, dword [sym.imp.USER32.dll_IsIconic]
push eax
call esi
test eax, eax
jne 0x569abd
mov ecx, dword [0x645324]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x569abd
mov eax, dword [0x644578]
test eax, eax
je 0x569b4d
mov eax, dword [0x60a244]
test eax, eax
jne 0x569ab1
push 2
call fcn.00569470
add esp, 4
push 0
call fcn.005697e0
add esp, 4
pop esi
ret
push 1
call fcn.00569470
mov edx, dword [0x645324]
add esp, 4
test eax, eax
je 0x569b44
push edx
call esi
test eax, eax
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
jne 0x569ae8
mov eax, dword [0x645324]
push 7
push eax
call esi
mov ecx, dword [0x645324]
push 0
push ecx
call esi
pop esi
ret
mov eax, dword [0x644578]
test eax, eax
je 0x569b4d
mov eax, dword [0x645324]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x569b34
mov ecx, dword [0x645324]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x569b34
mov eax, dword [0x60a244]
test eax, eax
jne 0x569b4d
push 2
call fcn.00569470
add esp, 4
pop esi
ret
push 2
call fcn.00569470
mov edx, dword [0x645324]
add esp, 4
push 7
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x569c00
Capabilities:
Find taskbar

Disassembly:
mov eax, dword [0x60bf90]
sub esp, 0x10
test eax, eax
jne 0x569dcc
mov eax, dword [0x63aad8]
test eax, eax
je 0x569c24
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
add esp, 0x10
ret
mov eax, dword [0x6446a4]
test eax, eax
jne 0x569dcc
movzx eax, byte [esp + 0x14]
cmp eax, 2
mov dword [0x6446a4], 1
jl 0x569dc2
cmp eax, 3
jle 0x569c6a
cmp eax, 5
jne 0x569dc2
call fcn.00568bb0
mov dword [0x6446a4], 0
add esp, 0x10
ret
cmp eax, 2
jne 0x569c7e
mov eax, dword [0x644580]
test eax, eax
je 0x569dc2
jmp 0x569c90
cmp eax, 3
jne 0x569c90
mov eax, dword [0x644580]
test eax, eax
jne 0x569dc2
mov eax, dword [0x644698]
test eax, eax
jne 0x569dc2
push ebx
push ebp
push esi
push edi
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x569d91
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x569d6a
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
mov ebp, dword [sym.imp.USER32.dll_WindowFromPoint]
lea ebx, [ebx]
cmp esi, dword [0x645324]
je 0x569d72
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x569d5b
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x569d5b
push esi
call fcn.00569ea0
add esp, 4
test eax, eax
jne 0x569d5b
lea eax, [esp + 0x10]
push eax
push esi
call ebx
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
sub eax, edi
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x1c]
sar ecx, 1
add ecx, edi
mov edi, dword [esp + 0x14]
sub eax, edi
cdq
sub eax, edx
sar eax, 1
add eax, edi
push eax
push ecx
call ebp
cmp eax, esi
je 0x569d6a
push eax
push esi
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne 0x569d6a
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x569cf0
cmp esi, dword [0x645324]
jne 0x569d91
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x569d91
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x569d91
call fcn.005698d0
test eax, eax
jne 0x569dbe
mov eax, dword [0x63aad0]
test eax, eax
je 0x569db4
mov ecx, dword [0x645324]
push 2
push 0
push 0x8043
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x569dbe
push 1
call fcn.005697e0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x6446a4], 0
add esp, 0x10
ret
Function at 0x56b2b0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
jns 0x56b2d1
mov eax, dword [0x645320]
push 0x47
push eax
call esi
test eax, eax
jne 0x56b2da
push 0x7f00
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
pop esi
ret
Function at 0x575500
Capabilities:
Enumerate network shares

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax]
push ecx
call fcn.005cd600
add esp, 4
cmp al, 0x41
mov byte [esp + 3], al
jb 0x575673
cmp al, 0x5a
ja 0x575673
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 1
push 1
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
jne 0x575673
push ebx
push ebp
mov ebx, 0x640
push ebx
mov dword [esp + 0x1c], eax
call fcn.005cc381
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x57565f
push esi
push edi
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
push ebp
lea ecx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], ebx
call sub.MPR.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x5755a5
mov eax, dword [esp + 0x18]
push eax
push ebp
mov ebx, eax
call fcn.005ce1f4
add esp, 8
test eax, eax
je 0x575650
mov ebp, eax
jmp 0x575561
test eax, eax
jne 0x575650
mov eax, dword [esp + 0x14]
xor esi, esi
test eax, eax
jle 0x575561
lea edi, [ebp + 0x10]
lea ebx, [ebx]
mov eax, dword [edi]
test eax, eax
je 0x5755db
movzx eax, byte [eax]
push eax
call fcn.005cd600
movzx ecx, byte [esp + 0x17]
add esp, 4
cmp ecx, eax
je 0x5755ec
mov eax, dword [esp + 0x14]
inc esi
add edi, 0x20
cmp esi, eax
jl 0x5755c0
jmp 0x575561
mov edi, dword [esp + 0x28]
shl esi, 5
mov esi, dword [esi + ebp + 0x14]
mov ecx, edi
lea esp, [esp]
mov al, byte [esi]
inc esi
mov byte [ecx], al
inc ecx
test al, al
jne 0x575600
mov eax, dword [esp + 0x2c]
cmp byte [eax + 1], 0x3a
jne 0x575648
mov cl, byte [eax + 2]
add eax, 2
cmp cl, 0x5c
jne 0x575648
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x575621
sub eax, edx
dec edi
jmp 0x575630
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x575630
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x20], 1
test ebp, ebp
pop edi
pop esi
je 0x57565f
push ebp
call fcn.005cc393
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call sub.MPR.dll_WNetCloseEnum
mov eax, dword [esp + 0x18]
pop ebp
pop ebx
add esp, 0x14
ret
xor eax, eax
add esp, 0x14
ret
Function at 0x575b40
Capabilities:
Terminate process

Disassembly:
sub esp, 0x3e8
push esi
call fcn.005cc2b8
cdq
mov ecx, 0x3e8
idiv ecx
mov eax, dword [esp + 0x3f0]
or esi, 0xffffffff
test eax, eax
jne 0x575b69
mov esi, 3
jmp 0x575bc4
cmp eax, 1
jne 0x575b8e
xor eax, eax
cmp edx, 0x1f4
setg al
add eax, 4
mov esi, eax
mov eax, dword [0x638ae8]
test eax, eax
je 0x575bc4
call fcn.004e1880
jmp 0x575bc4
cmp eax, 2
jne 0x575ba5
xor ecx, ecx
cmp edx, 0x1f4
setg cl
add ecx, 6
mov esi, ecx
jmp 0x575bc4
cmp eax, 3
jne 0x575bb1
mov esi, 8
jmp 0x575bc4
cmp eax, 4
jne 0x575bc4
xor eax, eax
cmp edx, 0x1f4
setg al
inc eax
mov esi, eax
lea ecx, [esp + 4]
push 0x3e7
push ecx
call fcn.00423a00
lea edx, [esp + 0xc]
push esi
push edx
call fcn.00425200
add esp, 0x10
cmp eax, 1
pop esi
push 0
je 0x575bee
call fcn.005cc26b
lea eax, [esp + 4]
push 2
push eax
call fcn.005756e0
add esp, 0xc
add esp, 0x3e8
ret
Function at 0x580a50
Capabilities:
Delete directory

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xfa4
push esi
push eax
lea ecx, [esp + 0xc]
push 0x3e7
push ecx
call fcn.00423900
mov al, byte [esp + 0x14]
add esp, 0xc
test al, al
je 0x580d34
mov eax, dword [0x637f14]
test eax, eax
je 0x580d00
lea edx, [esp + 8]
push edx
push 0x3e7
lea eax, [esp + 0xbc8]
push eax
push 0x5e6c98
push str.store
push str.update
call fcn.004c9870
lea ecx, [esp + 0x20]
push ecx
push 0x3e7
lea edx, [esp + 0x7f8]
push edx
push 0x5e6c98
push 0x5f0dec
push str.update
call fcn.004c9870
mov al, byte [esp + 0xbf0]
add esp, 0x30
test al, al
je 0x580d00
mov al, byte [esp + 0x7d8]
test al, al
je 0x580d00
lea eax, [esp + 8]
push eax
push 0x3e7
lea ecx, [esp + 0x3f8]
push ecx
push 0x5e6c98
push 0x5e9244
push str.update
call fcn.004c9870
lea edx, [esp + 0x408]
push edx
call fcn.005cbe51
mov esi, eax
lea eax, [esp + 0x24]
push eax
push str.updating
push str.state
push str.update
call fcn.004c9500
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push 0
call fcn.004c9500
lea edx, [esp + 0x814]
push edx
call fcn.00426e70
add esp, 0x40
test eax, eax
je 0x580d00
push 0x637bf8
lea eax, [esp + 0x3f4]
push 0x3e7
push eax
call fcn.00423900
lea eax, [esp + 0x3fc]
add esp, 0xc
mov dword [esp + 4], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x580b96
push 2
sub eax, edx
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x7e0]
push edx
push eax
lea eax, [esp + 0x400]
push eax
call fcn.00580160
mov eax, dword [esp + 0x18]
add esp, 0x14
test eax, eax
jne 0x580d00
test esi, esi
je 0x580c67
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x7d8]
push ecx
lea edx, [esp + 0x3f4]
push str._sbackup_
push edx
call esi
lea eax, [esp + 0x3fc]
push 2
push eax
call fcn.00425b60
add esp, 0x14
test eax, eax
jne 0x580c20
lea ecx, [esp + 0x7d8]
push ecx
lea edx, [esp + 0x3f4]
push str._sbackups_
push edx
call esi
add esp, 0xc
lea eax, [esp + 0x3f0]
push eax
call fcn.00426e70
add esp, 4
test eax, eax
je 0x580d00
lea ecx, [esp + 0x3f0]
push ecx
lea edx, [esp + 0x7dc]
push str._svista_
push edx
call esi
lea eax, [esp + 0x7e4]
push eax
call fcn.00426e70
add esp, 0x10
test eax, eax
je 0x580d00
lea eax, [esp + 0xbc0]
mov dword [esp + 4], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x580c80
push 1
sub eax, edx
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x7e0]
push edx
push eax
lea eax, [esp + 0xbd0]
push eax
call fcn.00580160
add esp, 0x14
lea ecx, [esp + 0xbc0]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [esp + 4]
test eax, eax
jne 0x580d00
mov al, byte [esp + 8]
test al, al
je 0x580cf3
lea edx, [esp + 8]
push edx
push str.finished
push str.state
push str.update
call fcn.004c9500
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
call fcn.004c9500
add esp, 0x20
mov eax, 1
pop esi
add esp, 0xfa4
ret
mov al, byte [esp + 8]
test al, al
je 0x580d34
lea ecx, [esp + 8]
push ecx
push str.failed
push str.state
push str.update
call fcn.004c9500
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
call fcn.004c9500
add esp, 0x20
xor eax, eax
pop esi
add esp, 0xfa4
ret