joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a208
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x5d5e14]
cmp dword [eax + 0x30], 0
je 0x49a2b2
cmp dword [ebx + 0x94], 0
jne 0x49a2ac
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x49a198
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x49a2ac
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x49a272
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x49a2ac
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004306cc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x49a281
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x49ae10
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x49ae45
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00414e64
jmp 0x49ae52
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00414dc8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x49c00c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x49c04d
mov eax, esi
call fcn.00481ce8
test al, al
je 0x49c04d
mov eax, dword [ebx + 0x84]
call fcn.004819e4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x49c04d
push 0
mov eax, dword [ebx + 0x84]
call fcn.004819e4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x49ce78
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x42cdf8]
call fcn.00415a74
xor eax, eax
push ebp
push 0x49cfbc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5ccaec], 0
jne 0x49cecb
mov ecx, dword [0x5d1ab8]
mov dl, 1
mov eax, dword [0x419fd4]
call fcn.0041f184
call fcn.004146e8
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004137f8
mov eax, ebx
call fcn.00415694
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x49cfcc
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00416e30
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004156a4
test eax, eax
jle 0x49cf63
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x49cf5c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00414ffc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00414fe4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0041af44
test eax, eax
jne 0x49cf5c
mov ebx, 0x15
jmp 0x49cf68
mov ebx, 0x10
jmp 0x49cf68
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x5ccaec]
call fcn.0049cdd0
mov eax, dword [ebp - 8]
call fcn.0049cdd0
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00416e48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49cfc3
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00414d98
lea eax, [ebp - 0x10]
mov edx, dword [0x42cdf8]
call fcn.00415b44
ret
Function at 0x4b3818
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4b3820
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b3a12
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4b3a28
mov eax, esi
call fcn.004b16a4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00414dc8
lea ecx, [ebp - 0x10]
mov edx, 0x4b3a3c
mov eax, esi
call fcn.004b16a4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00414dc8
lea ecx, [ebp - 0x14]
mov edx, 0x4b3a54
mov eax, esi
call fcn.004b16a4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00414dc8
lea ecx, [ebp - 0x18]
mov edx, 0x4b3a70
mov eax, esi
call fcn.004b16a4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00414dc8
lea ecx, [ebp - 0x1c]
mov edx, 0x4b3a8c
mov eax, esi
call fcn.004b16a4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00414dc8
lea ecx, [ebp - 0x24]
mov edx, 0x4b3aa4
mov eax, esi
call fcn.004b16a4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0041afb4
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0041b608
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4b3abc
mov eax, esi
call fcn.004b16a4
mov eax, dword [ebp - 0x28]
call fcn.004ab040
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4b3acc
mov eax, esi
call fcn.004b16a4
mov eax, dword [ebp - 0x2c]
call fcn.004ab040
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4b3ae4
mov eax, esi
call fcn.004b16a4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0041b608
inc eax
je 0x4b39b5
lea ecx, [ebp - 0x34]
mov edx, 0x4b3ae4
mov eax, esi
call fcn.004b16a4
mov eax, dword [ebp - 0x34]
call fcn.0041b5cc
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0041cecc
fstp qword [ebp - 0x3c]
wait
call fcn.0041d23c
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4b39d0
lea ecx, [ebp - 0x40]
mov edx, 0x4b3ae4
mov eax, esi
call fcn.004b16a4
mov eax, dword [ebp - 0x40]
call fcn.004ab040
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4b3af4
mov eax, esi
call fcn.004b16a4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00414dc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3a19
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00414d98
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00414d98
ret
Function at 0x514bd4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x514bf1
add esp, 0xfffffff0
call fcn.004141bc
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x514d8d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0050b3e0
test al, al
jne 0x514c2e
mov ecx, 0x514dc0
mov dl, 1
mov eax, dword [0x4ffadc]
call fcn.0041f0c8
call fcn.004146e8
xor eax, eax
push ebp
push 0x514c5a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00509e8c
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00509d78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x514c7a
mov eax, dword [ebp - 0x10]
mov edx, 0x514dfc
call fcn.004157c0
je 0x514c97
mov eax, esi
mov edx, 0x514dfc
call fcn.004157c0
jne 0x514cbb
mov eax, edi
mov edx, 0x514e0c
call fcn.004157c0
je 0x514cbb
mov ecx, 0x514de4
mov dl, 1
mov eax, dword [0x4ffd84]
call fcn.0041f0c8
call fcn.004146e8
mov eax, edi
xor edx, edx
call fcn.004157c0
jne 0x514ce8
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.004157c0
je 0x514ce8
mov ecx, 0x514de4
mov dl, 1
mov eax, dword [0x4ffd84]
call fcn.0041f0c8
call fcn.004146e8
mov eax, dword [ebp - 0x10]
mov edx, 0x514e4c
call fcn.004157c0
jne 0x514d1b
mov eax, edi
mov edx, 0x514e58
call fcn.004157c0
je 0x514d1b
mov ecx, 0x514de4
mov dl, 1
mov eax, dword [0x4ffd84]
call fcn.0041f0c8
call fcn.004146e8
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00512cc4
lea eax, [ebx + 4]
mov edx, esi
call fcn.004154bc
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.004154bc
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.004154bc
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.004154bc
lea eax, [ebx + 8]
call fcn.00415480
mov byte [ebx + 0xc], 2
xor eax, eax
mov dword [ebx + 0x30], eax
mov al, byte [ebp + 8]
mov byte [ebx + 0x34], al
mov ax, word [0x514ea4]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x514d94
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00415498
ret
Function at 0x516688
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x5166a5
add esp, 0xfffffff0
call fcn.004141bc
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x516840
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0050b3e0
test al, al
jne 0x5166e2
mov ecx, 0x516874
mov dl, 1
mov eax, dword [0x4ffadc]
call fcn.0041f0c8
call fcn.004146e8
xor eax, eax
push ebp
push 0x51670e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00509e8c
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00509d78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51672e
mov eax, edi
xor edx, edx
call fcn.004157c0
jne 0x51675b
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.004157c0
je 0x51675b
mov ecx, 0x516898
mov dl, 1
mov eax, dword [0x4ffd84]
call fcn.0041f0c8
call fcn.004146e8
mov eax, dword [ebp - 0x10]
mov edx, 0x5168b0
call fcn.004157c0
jne 0x51678e
mov eax, edi
mov edx, 0x5168bc
call fcn.004157c0
je 0x51678e
mov ecx, 0x516898
mov dl, 1
mov eax, dword [0x4ffd84]
call fcn.0041f0c8
call fcn.004146e8
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00512cc4
lea eax, [ebx + 4]
mov edx, esi
call fcn.004154bc
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.004154bc
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.004154bc
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.004154bc
lea eax, [ebx + 8]
call fcn.00415480
mov byte [ebx + 0xc], 1
mov dl, 1
mov eax, dword [0x42d8f0]
call fcn.00413e04
mov dword [ebx + 0x38], eax
mov dl, 1
mov eax, dword [0x42d8f0]
call fcn.00413e04
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x42d8f0]
call fcn.00413e04
mov dword [ebx + 0x34], eax
push ebx
mov eax, dword [ebx + 0x38]
push eax
mov ax, word [0x516908]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x502b00]
call fcn.00511f1c
mov dword [ebx + 0x3c], eax
mov ax, word [0x51690c]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x516847
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00415498
ret
Function at 0x51929c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x5192be
add esp, 0xfffffff0
call fcn.004141bc
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x519429
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0050b3e0
test al, al
jne 0x5192fb
mov ecx, 0x51945c
mov dl, 1
mov eax, dword [0x4ffadc]
call fcn.0041f0c8
call fcn.004146e8
push dword [0x5cddd0]
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xbc]
push dword [ebp - 0x10]
push dword [0x5cddd0]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00415778
mov eax, dword [ebp - 0xc]
call fcn.0050beb8
test al, al
jne 0x5193cd
push dword [0x5cddcc]
push dword [ebp + 8]
push dword [0x5cddcc]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00415778
mov eax, dword [ebp - 0x14]
call fcn.0050beb8
test al, al
jne 0x5193cd
push dword [0x5cddd0]
lea edx, [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xb8]
push dword [ebp - 0x1c]
push dword [0x5cddd0]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00415778
mov eax, dword [ebp - 0x18]
call fcn.0050bfd0
test al, al
jne 0x5193cd
push dword [0x5cddcc]
push edi
push dword [0x5cddcc]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00415778
mov eax, dword [ebp - 0x20]
call fcn.0050bfd0
test al, al
jne 0x5193cd
mov ecx, 0x51945c
mov dl, 1
mov eax, dword [0x4ffadc]
call fcn.0041f0c8
call fcn.004146e8
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00512cc4
lea eax, [ebx + 4]
mov edx, esi
call fcn.004154bc
lea eax, [ebx + 8]
call fcn.00415480
lea eax, [ebx + 0x30]
mov edx, edi
call fcn.004154bc
lea eax, [ebx + 0x34]
mov edx, dword [ebp + 8]
call fcn.004154bc
mov byte [ebx + 0xc], 0xc
mov ax, word [0x519478]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519430
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00415498
ret

Function at 0x54df2c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54dfa7
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push 0x59
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x54df8e
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00414fe4
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.0041ad8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54dfae
lea eax, [ebp - 0x104]
call fcn.00414d74
ret
Function at 0x55b1bc
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x55b2d2
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x55b298
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.004137f8
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 1
mov dword [ebp - 0xc], 1
mov eax, esi
call fcn.00415234
mov edi, eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push edi
call sub.wininet.dll_InternetCrackUrlA
mov eax, dword [ebp - 0x30]
add eax, 0xfffffffd
sub eax, 2
jb 0x55b261
mov dword [ebp - 0x44], esi
mov byte [ebp - 0x40], 0xb
lea eax, [ebp - 0x44]
push eax
push 0
push 0
lea edx, [ebp - 0x48]
mov eax, dword [0x5d1c28]
call fcn.00417384
mov ecx, dword [ebp - 0x48]
mov dl, 1
mov eax, dword [0x55a74c]
call fcn.0055ae20
call fcn.004146e8
mov eax, dword [ebp - 0x30]
mov dword [ebx + 0x64], eax
movzx eax, word [ebp - 0x24]
mov dword [ebx + 0x60], eax
lea eax, [ebx + 0x58]
push eax
mov edx, dword [ebp - 0x2c]
sub edx, edi
inc edx
mov ecx, dword [ebp - 0x28]
mov eax, esi
call fcn.00415294
lea eax, [ebx + 0x5c]
push eax
mov edx, dword [ebp - 0x10]
sub edx, edi
inc edx
mov ecx, dword [ebp - 0xc]
mov eax, esi
call fcn.00415294
jmp 0x55b2b2
xor eax, eax
mov dword [ebx + 0x60], eax
lea eax, [ebx + 0x58]
call fcn.00414d74
lea eax, [ebx + 0x5c]
call fcn.00414d74
xor eax, eax
mov dword [ebx + 0x64], eax
lea eax, [ebx + 0x3c]
mov edx, esi
call fcn.00414dc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b2d9
lea eax, [ebp - 0x48]
call fcn.00414d74
ret
Function at 0x55b4d0
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
test dl, dl
je 0x55b5fb
mov eax, dword [ebp - 4]
cmp byte [eax + 0x39], 0
jne 0x55b632
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.00415034
test eax, eax
jle 0x55b505
mov ebx, 3
jmp 0x55b507
xor ebx, ebx
push 0
call sub.wininet.dll_InternetAttemptConnect
test eax, eax
je 0x55b517
call fcn.0041f09c
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c]
call fcn.00415234
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
call fcn.00415234
push eax
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00415234
push eax
call sub.wininet.dll_InternetOpenA
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x70], esi
test esi, esi
setne dl
xor dl, 1
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0055afc4
xor eax, eax
push ebp
push 0x55b5d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0
push 3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54]
call fcn.00415234
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call fcn.00415234
push eax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x60]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
call fcn.00415234
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
push eax
call sub.wininet.dll_InternetConnectA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x74], ebx
test ebx, ebx
setne dl
xor dl, 1
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0055afc4
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55b632
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
test eax, eax
je 0x55b60b
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x74], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
test eax, eax
je 0x55b623
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x70], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x578928
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x5d2130]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x57893c
Capabilities:
Hide graphical window

Disassembly:
push 9
mov eax, dword [0x5d2130]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x5d2130]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, dword [0x5d2130]
mov eax, dword [eax]
cmp byte [eax + 0x5b], 0
jne 0x578991
mov eax, dword [0x5d2130]
mov eax, dword [eax]
mov byte [eax + 0x5b], 1
mov eax, dword [0x5d2130]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x578991
mov edx, dword [0x5d2130]
mov dl, 1
call fcn.0049480c
ret
Function at 0x579080
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
test dl, dl
je 0x579094
add esp, 0xfffffff0
call fcn.004141bc
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00439bc4
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x34], eax
mov eax, esi
test bl, bl
je 0x5790cc
call fcn.00414214
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x57fa48
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x57fb02
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00415480
mov eax, dword [0x5d1bc4]
cmp byte [eax], 0
je 0x57fab7
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00415a0c
mov eax, dword [ebx]
call fcn.004156a4
push eax
mov eax, dword [ebx]
call fcn.00415694
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.004156a4
mov edx, eax
dec edx
mov eax, ebx
call fcn.00415a0c
jmp 0x57fae9
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0041c068
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00415618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57fb09
lea eax, [ebp - 0x3f0]
call fcn.00414d74
ret

Function at 0x582cdc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x582d36
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.00582d40
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x582d3d
ret
Function at 0x589184
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_IsWindow
test eax, eax
jne 0x5891ba
jmp 0x589260
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov eax, esp
push eax
push 0
push 0x419
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
test esi, 2
jbe 0x5891fe
mov edx, dword [ebx + 0x4c]
cmp dword [edx + 0x17c], 0
je 0x5891fe
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 0x17c]
mov eax, dword [eax + 0x14]
jmp 0x58920e
mov edx, dword [ebx + 0x4c]
mov edx, dword [edx + 0x178]
test edx, edx
je 0x58920e
mov eax, dword [edx + 0x14]
test eax, eax
je 0x589227
push eax
push 2
push 5
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0xc]
mov eax, ebx
call fcn.00585b28
jmp 0x589260
mov dl, 1
mov eax, dword [0x43b9fc]
call fcn.0043da04
mov esi, eax
mov edx, dword [edi + 0x10]
mov eax, esi
call fcn.0043e51c
mov eax, dword [ebx + 0x4c]
mov edx, dword [eax + 0xbc]
mov eax, dword [esi + 0x10]
call fcn.0043d5b4
mov edx, esp
mov eax, esi
call fcn.0043e108
mov eax, esi
call fcn.00413e34
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x58ba64
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.004819e4
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x279], 0
xor edx, edx
mov eax, ebx
call fcn.0047afd0
pop ebx
ret