joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52c7c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52c928
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0051aa68
test eax, eax
je 0x52c90a
mov eax, dword [ebp - 4]
call fcn.0051aa68
test byte [eax + 0x2cc], 8
jne 0x52c90a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6d], 4
je 0x52c902
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x6d]
mov edx, dword [ebp - 4]
mov byte [edx + 0x6c], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x6d], 4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6c], 2
je 0x52c861
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6c], 1
je 0x52c861
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6c], 3
je 0x52c861
mov eax, dword [ebp - 4]
call fcn.0051aa68
lea edx, [ebp - 0x14]
call fcn.0043e744
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x14]
lea edi, [eax + 0x5c]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x102], 0
je 0x52c8b1
lea edx, [ebp - 0x18]
mov eax, dword [0x57f120]
mov eax, dword [eax]
call fcn.00464964
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
add eax, 0x88
mov ecx, 0x3f
call fcn.0040b2f8
mov eax, dword [0x57f120]
mov eax, dword [eax]
call fcn.00464700
push 0
mov eax, dword [0x57f120]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
jmp 0x52c8f2
mov eax, dword [ebp - 4]
call fcn.0051aa68
test eax, eax
je 0x52c8e2
mov eax, dword [ebp - 4]
call fcn.0051aa68
lea edx, [ebp - 0x1c]
call fcn.0043efb8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
add eax, 0x88
mov ecx, 0x3f
call fcn.0040b2f8
push 0
mov eax, dword [ebp - 4]
call fcn.0051aa24
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
add eax, 0x70
push eax
push 0
call sub.shell32.dll_Shell_NotifyIconA
jmp 0x52c90a
mov eax, dword [ebp - 4]
call fcn.0052c138
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52c92f
lea eax, [ebp - 0x1c]
call fcn.004048bc
lea eax, [ebp - 0x18]
call fcn.004048bc
ret
Function at 0x5477fc
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x14], eax
push 2
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x5478c2
mov word [ebx], 2
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_getsockname
inc eax
je 0x5478c2
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x1008
push 0xffff
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_getsockopt
inc eax
je 0x5478c2
cmp dword [ebx + 4], 0
jne 0x54788d
mov ebx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x5478ce
mov eax, ebx
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.004035c8
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_getpeername
mov ebx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x5478ce
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
or ebx, 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x55b300
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404d18
xor eax, eax
push ebp
push 0x55b388
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00404d28
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 8], eax
push 2
push 4
lea eax, [ebp - 8]
push eax
call sub.wsock32.dll_gethostbyaddr
mov ebx, eax
test ebx, ebx
je 0x55b366
mov eax, esi
mov edx, dword [ebx]
call fcn.00404a9c
jmp 0x55b36d
mov eax, esi
call fcn.004048bc
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b38f
lea eax, [ebp - 4]
call fcn.004048bc
ret

Function at 0x55b730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d18
xor eax, eax
push ebp
push 0x55b7b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404954
mov eax, dword [ebp - 4]
call fcn.00404b64
mov esi, eax
test esi, esi
jle 0x55b794
mov ebx, 1
lea eax, [ebp - 8]
call fcn.00404d34
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
xor dx, 0x4d2
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x55b777
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.00404910
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b7c0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048e0
ret
Function at 0x55c500
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d18
xor eax, eax
push ebp
push 0x55c705
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035c8
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404b14
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040f1dc
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
mov ecx, 0x55c71c
call fcn.00404bb0
mov dl, 1
mov eax, dword [0x412d38]
call fcn.004039b8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x55c6d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a8b0
test al, al
je 0x55c5df
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x55c626
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x124]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00409ec0
mov ecx, dword [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x55c5f1
mov edx, 0x55c730
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x55c649
mov edx, 0x55c744
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor ebx, ebx
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035c8
push 0x105
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d28
push eax
call sub.kernel32.dll_GetShortPathNameA
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404b14
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov edx, 0x55c758
call fcn.00404bb0
mov ecx, dword [ebp - 0x128]
lea edx, [ebx + 1]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c6da
mov eax, dword [ebp - 0xc]
call fcn.00403a14
ret

Function at 0x55ca30
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov edx, 0x40
call fcn.0040a6d0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x55ca75
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55ca7c
mov eax, dword [ebp - 8]
call fcn.0040a82c
ret
Function at 0x55fa78
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d18
xor eax, eax
push ebp
push 0x55fb01
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404954
mov eax, dword [ebp - 4]
call fcn.00404b64
mov esi, eax
test esi, esi
jle 0x55fadc
mov ebx, 1
lea eax, [ebp - 8]
call fcn.00404d34
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
xor dx, 0x4d2
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x55fabf
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.00404910
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55fb08
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048e0
ret
Function at 0x5600bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d18
xor eax, eax
push ebp
push 0x5602c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035c8
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404b14
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040f1dc
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
mov ecx, 0x5602d8
call fcn.00404bb0
mov dl, 1
mov eax, dword [0x412d38]
call fcn.004039b8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x56028f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a8b0
test al, al
je 0x56019b
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x5601e2
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x124]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00409ec0
mov ecx, dword [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x5601ad
mov edx, 0x5602ec
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x560205
mov edx, 0x560300
mov eax, dword [ebp - 0xc]
call fcn.00415d18
xor ebx, ebx
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035c8
push 0x105
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d28
push eax
call sub.kernel32.dll_GetShortPathNameA
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404b14
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov edx, 0x560314
call fcn.00404bb0
mov ecx, dword [ebp - 0x128]
lea edx, [ebx + 1]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x560296
mov eax, dword [ebp - 0xc]
call fcn.00403a14
ret
Function at 0x56031c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x560324
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x560505
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x57f29c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x5604ea
inc esi
xor ebx, ebx
lea ecx, [ebp - 8]
mov eax, dword [0x57f29c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c4]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00409ec0
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.005605fc
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404e50
test eax, eax
jle 0x5604e2
mov eax, dword [0x57f29c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b8]
mov dl, 1
call fcn.004d8a4c
mov eax, dword [0x57f2ac]
cmp byte [eax], 0
je 0x5603fb
lea ecx, [ebp - 0x14]
mov eax, dword [0x57f29c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c4]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x56051c
call fcn.00404bb0
mov edx, dword [ebp - 0x10]
mov eax, dword [0x598694]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
call fcn.00415d18
jmp 0x560438
lea ecx, [ebp - 0x18]
mov eax, dword [0x57f29c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c4]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0x18]
mov edx, 0x560530
call fcn.00404b6c
mov edx, dword [ebp - 0x18]
mov eax, dword [0x598694]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
call fcn.00415d18
lea ecx, [ebp - 0x1c]
mov eax, dword [0x57f29c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c4]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.0040ab28
test al, al
jne 0x5604ce
push 4
lea ecx, [ebp - 0x20]
mov eax, dword [0x57f29c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c4]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 0x20]
mov edx, 0x560550
call fcn.00404b6c
mov eax, dword [ebp - 0x20]
call fcn.00404d28
push eax
lea ecx, [ebp - 0x24]
mov eax, dword [0x57f29c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c4]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x24]
call fcn.00404d28
push eax
call sub.kernel32.dll_MoveFileExA
lea ecx, [ebp - 0x28]
mov eax, dword [0x57f29c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c4]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
call fcn.005600bc
mov eax, dword [0x57f29c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c4]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
inc ebx
dec esi
jne 0x56035c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56050c
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004048e0
ret
Function at 0x5605fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x5606a6
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x560659
push 0x90
lea eax, [ebp - 0x91]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x128]
lea eax, [ebp - 0x91]
call fcn.0040b474
mov eax, dword [ebp - 0x128]
mov edx, ebx
call fcn.00409ec0
jmp 0x560688
push 0x90
lea eax, [ebp - 0x122]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x122]
call fcn.0040b474
mov eax, dword [ebp - 0x12c]
mov edx, ebx
call fcn.00409ec0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5606ad
lea eax, [ebp - 0x12c]
mov edx, 2
call fcn.004048e0
ret

Function at 0x560fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x560fc8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404d18
xor eax, eax
push ebp
push 0x561bc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x467230]
call fcn.004673f4
mov ebx, eax
mov edx, 0x80000003
mov eax, ebx
call fcn.00467524
mov cl, 1
mov edx, 0x561bdc
mov eax, ebx
call fcn.004676d8
lea ecx, [ebp - 0x10]
mov edx, 0x561c08
mov eax, ebx
call fcn.00467dbc
mov eax, ebx
call fcn.00403a14
mov eax, dword [ebp - 0x10]
mov edx, 0x561c18
call fcn.00404c74
jne 0x561052
mov ecx, 0x561c28
mov edx, 0x561c34
mov eax, ebx
call fcn.00467d88
mov eax, dword [0x57f2d4]
mov byte [eax], 0
mov eax, dword [0x57f2d4]
cmp byte [eax], 0
jne 0x56107c
mov eax, dword [0x598694]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
mov edx, 0x561c44
call fcn.00415d18
jmp 0x561b9f
mov edx, dword [ebp - 4]
mov eax, dword [0x5986a4]
call fcn.004fbf78
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x56114c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x561135
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x561120
mov eax, dword [0x57f29c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b8]
mov dl, 1
call fcn.004d8a4c
mov eax, dword [0x57f2ac]
cmp byte [eax], 0
je 0x5610f8
mov eax, dword [0x598694]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
mov edx, 0x561c84
call fcn.00415d18
jmp 0x561113
mov eax, dword [0x598694]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
mov edx, 0x561c9c
call fcn.00415d18
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x561135
push 0
mov cx, word [0x561cbc]
mov dl, 1
mov eax, 0x561cc8
call fcn.00470888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561153
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561bcc
lea eax, [ebp - 0x158]
mov edx, 0x53
call fcn.004048e0
lea eax, [ebp - 8]
call fcn.004048bc
ret
Function at 0x561e50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
mov edx, ebx
mov eax, dword [0x5986a4]
call fcn.004fbf78
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x561f0e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x561ef7
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x561ee2
mov eax, dword [0x57f2ac]
cmp byte [eax], 0
je 0x561eba
mov eax, dword [0x598694]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
mov edx, 0x561f24
call fcn.00415d18
jmp 0x561ed5
mov eax, dword [0x598694]
mov eax, dword [eax + 0x2dc]
mov eax, dword [eax + 0x208]
mov edx, 0x561f3c
call fcn.00415d18
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x561ef7
push 0
mov cx, word [0x561f5c]
mov dl, 1
mov eax, 0x561f68
call fcn.00470888
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561f15
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x567d68
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov edx, 0x40
call fcn.0040a6d0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x567dad
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x567db4
mov eax, dword [ebp - 8]
call fcn.0040a82c
ret

Function at 0x569600
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d18
xor eax, eax
push ebp
push 0x569805
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035c8
push 0x105
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404b14
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040f1dc
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
mov ecx, 0x56981c
call fcn.00404bb0
mov dl, 1
mov eax, dword [0x412d38]
call fcn.004039b8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5697d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a8b0
test al, al
je 0x5696df
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x569726
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x124]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00409ec0
mov ecx, dword [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x5696f1
mov edx, 0x569830
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x569749
mov edx, 0x569844
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor ebx, ebx
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x105
call fcn.004035c8
push 0x105
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d28
push eax
call sub.kernel32.dll_GetShortPathNameA
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x111]
mov ecx, 0x105
call fcn.00404b14
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov edx, 0x569858
call fcn.00404bb0
mov ecx, dword [ebp - 0x128]
lea edx, [ebx + 1]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x54]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5697da
mov eax, dword [ebp - 0xc]
call fcn.00403a14
ret
Function at 0x569860
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5698e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.004035c8
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x5698fc
mov edx, ebx
call fcn.00404bb0
mov eax, dword [ebp - 0x24]
call fcn.00404d28
mov dword [ebp - 0x16], eax
mov eax, 0x569900
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5698ea
lea eax, [ebp - 0x24]
call fcn.004048bc
ret