joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d04bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4d056f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x105]
push eax
push ebx
push 0x4d0580
mov eax, edi
call fcn.00405538
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.0040b9d8
mov eax, dword [ebp - 0x10c]
call fcn.0040b204
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x105]
call fcn.0040b9d8
mov eax, dword [ebp - 0x110]
mov ecx, esi
mov edx, dword [ebp - 4]
call fcn.0040b2c8
inc ebx
mov eax, dword [esi]
call fcn.0040af08
test al, al
jne 0x4d04ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0576
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.00405070
ret
Function at 0x521194
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x5211e5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x5211cc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x5211bc
jmp 0x5211e5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x5211cd
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x535098
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
test dl, dl
je 0x5350ac
add esp, 0xfffffff0
call fcn.00404494
mov ebx, edx
mov esi, eax
mov byte [esi + 0x479], 1
xor edx, edx
mov eax, esi
call fcn.0051b994
call fcn.0053422c
push esi
push 0x53518c
call fcn.00467e38
mov dword [esi + 0x474], eax
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.004038a8
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
cmp byte [ebp - 0xa], 0x31
jne 0x535106
mov byte [esi + 0x470], 1
jmp 0x53510d
mov byte [esi + 0x470], 0
mov edx, dword [0x53514c]
mov eax, esi
call fcn.00535270
mov edx, dword [0x535150]
mov eax, esi
call fcn.00535304
mov byte [esi + 0x478], 0
mov eax, esi
test bl, bl
je 0x535143
call fcn.004044ec
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x537814
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x537893
mov eax, ebx
and eax, 0xff
bt dword [0x5f5e98], eax
jae 0x53786d
mov ecx, 1
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00537808
cmp byte [ebp - 1], 0
je 0x53788e
mov ecx, 3
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00537808
jmp 0x53788e
xor ecx, ecx
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00537808
cmp byte [ebp - 1], 0
je 0x53788e
mov ecx, 2
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.00537808
dec si
jne 0x537837
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x537898
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, eax
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
and edx, 0xff
bt dword [0x5f5e98], edx
jae 0x5378c7
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.00537808
pop ebx
ret
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.00537808
pop ebx
ret
Function at 0x53dc90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x53de66
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x53de4d
mov eax, dword [edi + 0x30]
call fcn.00405338
test eax, eax
jne 0x53dce6
mov eax, dword [edi + 0x34]
call fcn.00405338
test eax, eax
jne 0x53dce6
mov eax, edi
call fcn.0053df04
jmp 0x53de4d
cmp dword [edi + 0xa0], 0
jne 0x53dd1d
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.0040b7e0
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x6010f8]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x53dd54
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.0040b7e0
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x6010f8]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.0053df44
mov ebx, eax
test bl, bl
jne 0x53de02
mov eax, dword [edi + 0x30]
call fcn.00405338
test eax, eax
jne 0x53dd8c
mov eax, dword [edi + 0xc0]
call fcn.00405338
test eax, eax
je 0x53de02
mov eax, dword [edi + 0xc0]
call fcn.00405338
test eax, eax
je 0x53ddae
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.0040b7e0
jmp 0x53ddda
push dword [edi + 0x30]
push 0x53de80
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.004053f8
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.0040b7e0
push 7
lea eax, [ebp - 0x101]
push eax
call sub.KERNEL32.DLL_WinExec
cmp eax, 0x20
jb 0x53de02
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.0053df44
mov ebx, eax
test bl, bl
jne 0x53de0f
mov eax, edi
call fcn.0053df04
jmp 0x53de4d
mov eax, dword [edi + 0x58]
test eax, eax
je 0x53de1e
mov dword [edi + 0xa8], eax
jmp 0x53de28
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.0053dfbc
test al, al
je 0x53de4d
mov eax, edi
mov si, 0xffee
call fcn.00404324
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.0053e068
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53de6d
lea eax, [ebp - 0x108]
call fcn.0040504c
ret
Function at 0x558f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x28]
shr edx, 1
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x28]
shr ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.00402f58
add dword [ebp - 8], 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c]
shl eax, 2
sub eax, 5
test eax, eax
jl 0x55905f
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x5fbab4]
mov edx, 8
call fcn.00556540
mov ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
and eax, 0xff
xor ebx, dword [eax*4 + 0x5fbab4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x5fbab4]
mov edx, 0x10
call fcn.00556540
xor ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x18
mov eax, dword [eax*4 + 0x5fbab4]
mov edx, 0x18
call fcn.00556540
xor ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax], ebx
add dword [ebp - 8], 4
inc dword [ebp - 4]
dec dword [ebp - 0xc]
jne 0x558fe2
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x55c218
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x55c272
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5fdc3c]
cmp byte [eax], 0
je 0x55c242
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
jmp 0x55c25c
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405284
mov eax, dword [ebp - 4]
call fcn.00405538
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c279
lea eax, [ebp - 4]
call fcn.0040504c
ret

Function at 0x55c280
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x55c2df
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5fdc3c]
cmp byte [eax], 0
je 0x55c2ae
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
mov ebx, eax
jmp 0x55c2c9
push esi
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405284
mov eax, dword [ebp - 4]
call fcn.00405538
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c2e6
lea eax, [ebp - 4]
call fcn.0040504c
ret
Function at 0x55c360
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x55c3d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5fdc3c]
cmp byte [eax], 0
je 0x55c390
push esi
push ebx
call sub.KERNEL32.DLL_MoveFileW
mov ebx, eax
jmp 0x55c3bd
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405284
mov eax, dword [ebp - 4]
call fcn.00405538
push eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405284
mov eax, dword [ebp - 8]
call fcn.00405538
push eax
call sub.KERNEL32.DLL_MoveFileA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c3df
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405070
ret

Function at 0x55c688
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.0040897c
cmp ax, 0xffff
jne 0x55c6a9
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
mov dword [ebp - 8], ebx
push 6
push eax
push edi
call sub.KERNEL32.DLL_FindResourceA
test eax, eax
je 0x55c72a
push eax
push edi
call sub.KERNEL32.DLL_LoadResource
test eax, eax
je 0x55c72a
push eax
call sub.KERNEL32.DLL_LockResource
mov ebx, eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x55c6f0
inc eax
movzx edx, word [ebx]
add edx, edx
add ebx, edx
add ebx, 2
dec eax
jne 0x55c6e3
movzx esi, word [ebx]
add ebx, 2
cmp dword [ebp - 4], 0
je 0x55c72a
cmp dword [ebp + 8], 0
jle 0x55c72a
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.00427134
mov esi, eax
test esi, esi
jle 0x55c721
mov ecx, esi
add ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00408990
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x55d22c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x55d290
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004052cc
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.0040aa50
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d297
lea eax, [ebp - 0xc]
call fcn.0040504c
ret

Function at 0x55d2ec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
and al, 8
Function at 0x562d50
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x562dc7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00405300
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040b3e4
mov eax, dword [ebp - 4]
call fcn.00562c90
test al, al
je 0x562d97
mov byte [ebp - 5], 1
jmp 0x562dac
mov eax, dword [ebp - 0xc]
call fcn.00405538
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x562dce
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405070
ret

Function at 0x5630c4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x56311e
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x5fc8ec]
mov edx, dword [ebp - 0x10]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x5630ec
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x5632d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x56332d
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0xc]
call fcn.00563220
xor al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
call fcn.00563188
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
mov byte [eax], dl
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x5632f2
mov esp, ebp
pop ebp
ret
Function at 0x570084
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x570145
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x113]
mov edx, 0x570158
call fcn.0040b7e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
xor edx, edx
call fcn.00405b04
je 0x5700ec
lea eax, [ebp - 0x21c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
call fcn.00405300
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x108]
call fcn.0040b7e0
jmp 0x5700fd
lea eax, [ebp - 0x108]
push eax
push 0xff
call sub.KERNEL32.DLL_GetTempPathA
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x218]
mov ecx, 0x105
call fcn.00405928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57014c
lea eax, [ebp - 0x21c]
call fcn.0040504c
ret

Function at 0x576378
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x57649c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00569220
mov eax, dword [ebp - 4]
call fcn.00569280
mov eax, dword [ebp - 4]
call fcn.00574fc0
mov dl, 1
mov eax, dword [0x5596a0]
call fcn.00559cb4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x57647f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x60]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
xor eax, eax
call fcn.0056352c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
push ebp
push 0x576443
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
mov al, byte [eax + 5]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x5c]
mov eax, dword [ebp - 4]
call fcn.00571ccc
mov eax, dword [ebp - 4]
call fcn.005750a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x576469
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x576486
mov eax, dword [ebp - 8]
call fcn.0040411c
ret
Function at 0x579258
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
ret

Function at 0x579bac
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov ebx, eax
or esi, 0xffffffff
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.00405538
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x579be6
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, esi
pop esi
pop ebx
ret

Function at 0x579bec
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffe0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405528
xor eax, eax
push ebp
push 0x579d27
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00405538
push eax
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x579d11
push 0
push 0
push ebx
push edi
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, 0xffffffff
jne 0x579c60
push edi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x579d11
mov eax, dword [ebp + 8]
sub eax, ebx
xor edx, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
jne 0x579c7e
cmp dword [ebp - 0x20], 0
jae 0x579c84
jmp 0x579d11
jl 0x579d11
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
jmp 0x579ceb
cmp dword [ebp - 0xc], 1
jae 0x579ca2
push edi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x579d11
mov eax, dword [ebp - 0xc]
xor edx, edx
add eax, dword [ebp - 0x18]
adc edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x1c]
jne 0x579cb9
cmp eax, dword [ebp - 0x20]
jb 0x579cd0
jmp 0x579cbb
jl 0x579cd0
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x1020]
mov eax, esi
call fcn.00579854
jmp 0x579d07
lea edx, [ebp - 0x1020]
mov ecx, dword [ebp - 0xc]
mov eax, esi
call fcn.00579854
mov eax, dword [ebp - 0xc]
xor edx, edx
add dword [ebp - 0x18], eax
adc dword [ebp - 0x14], edx
push 0
lea eax, [ebp - 0xc]
push eax
push 0x1000
lea eax, [ebp - 0x1020]
push eax
push edi
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x579c94
push edi
call sub.KERNEL32.DLL_CloseHandle
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x579d2e
lea eax, [ebp - 4]
call fcn.0040504c
ret
Function at 0x58d4b8
Capabilities:
Find taskbar

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov dword [esp], 0x24
push 0
push 0x58d50c
call sub.user32.dll_FindWindowA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x58d4f9
push esp
push 4
call sub.shell32.dll_SHAppBarMessage
test eax, 1
jbe 0x58d4f9
push esp
push 5
call sub.shell32.dll_SHAppBarMessage
cmp eax, 1
je 0x58d4fd
xor eax, eax
jmp 0x58d4ff
mov al, 1
mov edx, dword [esp + 0xc]
mov dword [ebx], edx
add esp, 0x24
pop ebx
ret
Function at 0x59a4b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x59a5d0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.005e5a00
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, ebx
call fcn.00599d6c
test al, al
je 0x59a59b
mov edx, esi
mov eax, 0x59a5e8
call fcn.0047db48
test al, al
je 0x59a54f
cmp dword [ebp - 8], 0
je 0x59a533
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x59a516
cmp dword [ebx + 0x310], 0
jne 0x59a51f
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_BringWindowToTop
push 0
push 0
push 0x10
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SendMessageA
jmp 0x59a5b5
mov ebx, dword [0x5fde74]
mov ebx, dword [ebx]
lea edx, [ebp - 0x10]
mov eax, 0x14b
call ebx
mov eax, dword [ebp - 0x10]
call fcn.005e5a00
jmp 0x59a5b5
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x59a575
mov byte [ebx + 0x304], 1
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x300]
call fcn.0040a7f4
mov eax, dword [ebp - 0x14]
call fcn.00599c5c
jmp 0x59a5b5
mov eax, dword [ebp - 4]
push eax
push 0
push 0x400
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x59a5b5
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
push ebx
call sub.KERNEL32.DLL_CloseHandle
jmp 0x59a5b5
mov ebx, dword [0x5fde74]
mov ebx, dword [ebx]
lea edx, [ebp - 0x18]
mov eax, 0x14c
call ebx
mov eax, dword [ebp - 0x18]
call fcn.005e5a00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59a5d7
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405070
ret
Function at 0x59d0c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x59d1dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5fe374]
cmp dword [eax], 2
je 0x59d1bb
xor edx, edx
push ebp
push 0x59d1b1
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x10d]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x10d]
call fcn.0040b9d8
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 8]
mov edx, 0x59d1f4
call fcn.00445dd0
mov eax, dword [ebp - 8]
call fcn.00405538
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x59d1a7
xor edx, edx
push ebp
push 0x59d1a0
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x59d1fc
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x59d189
push 0
push 0
mov edx, dword [0x5fe158]
mov edx, dword [edx]
push edx
push 0x59d210
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59d1a7
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x59d1bb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59d1e3
lea eax, [ebp - 0x114]
call fcn.0040504c
lea eax, [ebp - 8]
call fcn.0040504c
ret