joyce8/EMBER2024-capa huggingface dataset:
Function at 0x519488
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov dl, 1
mov eax, dword [0x45539c]
call fcn.0045e9c4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51965b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x54]
cmp dword [eax + 8], 0
jle 0x51963a
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004604f0
mov eax, dword [ebp - 8]
call fcn.0045f2e4
mov eax, dword [eax + 0x48]
mov edx, esi
call fcn.00458844
cmp byte [ebp + 8], 0
je 0x519522
xor edx, edx
mov eax, ebx
call fcn.005183a8
mov edx, dword [eax]
call dword [edx + 0x30]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, ebx
call fcn.005183a8
mov edx, dword [eax]
call dword [edx + 0x24]
mov esi, eax
mov eax, ebx
call fcn.005182d8
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x51955e
xor edx, edx
mov eax, ebx
call fcn.005183a8
mov edx, dword [eax]
call dword [edx + 0x30]
mov esi, eax
mov eax, ebx
call fcn.005182d8
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor edx, edx
mov eax, ebx
call fcn.005183a8
mov edx, dword [eax]
call dword [edx + 0x24]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x30]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.00434c64
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
call fcn.0045f2e4
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.005182d8
dec eax
test eax, eax
jl 0x519612
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0051827c
push 0
lea eax, [ebp - 0x20]
push eax
mov edx, esi
mov eax, ebx
call fcn.005183d4
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x24]
imul esi
movzx edx, byte [ebp + 8]
imul edx
push eax
mov edx, esi
mov eax, ebx
call fcn.005183d4
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x30]
imul esi
movzx edx, byte [ebp + 8]
xor dl, 1
and edx, 0x7f
imul edx
xor ecx, ecx
pop edx
call fcn.00434c3c
mov eax, dword [ebp - 8]
call fcn.0045f2e4
mov edx, eax
lea ecx, [ebp - 0x20]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
inc esi
dec dword [ebp - 0x10]
jne 0x5195a8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0051827c
cmp byte [ebp + 0xc], 0
je 0x51963a
movzx eax, word [ebx + 0x58]
mov edx, 0x10
call fcn.0040ebdc
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00517a64
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519662
mov eax, dword [ebp - 8]
call fcn.004050dc
ret
Function at 0x528e34
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x72f258
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x528e56
shr eax, 1
xor eax, 0xedb88320
jmp 0x528e58
shr eax, 1
dec edx
jne 0x528e44
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x528e3d
mov byte [0x72f658], 1
pop esi
pop ebx
ret

Function at 0x528e74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x72f658], 0
jne 0x528e8b
call fcn.00528e34
mov eax, edi
dec eax
test eax, eax
jl 0x528eb3
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x72f258]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x528e95
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x52bc5c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x52bcf6.0
jmp dword [ecx*4 + 0x52bc8f]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x52bcc1
sub dl, 8
je 0x52bcd0
jmp case.0x52bcf6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x52b904
jmp case.0x52bcf6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x52b95c
jmp case.0x52bcf6.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x52bcf6.0
movzx ecx, byte [ecx + 0x52bcfd]
jmp dword [ecx*4 + 0x52bd0e]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x52ba08
jmp case.0x52bcf6.0
cmp dl, 3
jne 0x52bd3b
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x52ba60
jmp case.0x52bcf6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x52ba1c
jmp case.0x52bcf6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x52baa4
jmp case.0x52bcf6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x52bd66
sub dl, 8
je 0x52bd72
jmp case.0x52bcf6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x52bad0
jmp case.0x52bcf6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x52bb3c
jmp case.0x52bcf6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x52bd91
sub dl, 8
je 0x52bd9d
jmp case.0x52bcf6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x52bbf8
jmp case.0x52bcf6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x52bc20
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x52be3f
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0052ae08
test eax, eax
je 0x52be3f
mov eax, ebx
call fcn.0052be48
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x52bdd8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x52be48
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x52be79
dec al
je 0x52beb4
dec al
je 0x52bef9
dec al
je 0x52bf62
jmp 0x52bfec
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x52bfec
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x52be89
jmp 0x52bfec
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x52bfec
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x52bec4
jmp 0x52bfec
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x52bfec
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x52bf28
xor ebp, ebp
jmp 0x52bf38
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x52bf41
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x52bf09
jmp 0x52bfec
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x52bfec
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x52bfbb
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00528ebc
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x52bf76
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5427f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff828
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x7d8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5428aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406e9c
mov eax, dword [0x6a7a80]
cmp dword [eax], 2
jne 0x54285f
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00407234
mov eax, dword [ebx]
call fcn.004070a0
push eax
mov eax, dword [ebx]
call fcn.00407090
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.004070a0
mov edx, eax
dec edx
mov eax, ebx
call fcn.00407234
jmp 0x542891
lea eax, [ebp - 0x7d2]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageW
lea edx, [ebp - 0x7d8]
lea eax, [ebp - 0x7d2]
call fcn.00415b0c
mov edx, dword [ebp - 0x7d8]
mov eax, ebx
call fcn.00407574
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5428b1
lea eax, [ebp - 0x7d8]
call fcn.004072d8
ret
Function at 0x56d2dc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffa4
mov esi, dword [ebp + 8]
add esi, 0xffffff9c
xor eax, eax
push ebp
push 0x56d498
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045f2e4
mov eax, dword [eax + 0x40]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x78]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x68]
call fcn.0049dc08
call fcn.005680ac
mov edx, dword [ebp + 8]
mov dword [edx - 0x6c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x6c], 0
je 0x56d360
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x6c]
mov eax, dword [eax + 0x64]
call fcn.00458138
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045f2e4
mov eax, dword [eax + 0x40]
pop edx
call fcn.00458140
mov eax, dword [ebp + 8]
mov dword [eax - 0x70], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00457fc0
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.00415844
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x70]
push eax
push 0x5c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045f2e4
call fcn.00459a4c
push eax
call sub.gdi32.dll_GetObjectW
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00458070
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.004580ac
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.004580ac
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.004580ac
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x78]
mov eax, dword [eax + 0x10]
call fcn.00458138
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectW
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045f2e4
mov eax, dword [eax + 0x40]
pop edx
call fcn.00457f5c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x60]
call fcn.0045f2e4
mov eax, dword [eax + 0x40]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x74]
mov ecx, edx
shl edx, 6
add edx, ecx
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc8]
mov edx, dword [ecx + edx*4 + 0xb0]
call fcn.00457cf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56d49f
lea eax, [ebp - 4]
call fcn.004072d8
ret
Function at 0x58c040
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x72f84c
test esi, esi
jne 0x58c05a
xor eax, eax
jmp 0x58c14b
cmp dword [ebp], 0
jne 0x58c065
call fcn.0058bfd0
xor ebx, 0xffffffff
cmp edi, 8
jb 0x58c125
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x58c071
test edi, edi
jbe 0x58c146
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x58c129
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5953ac
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], eax
lea edi, [esp + 0xc]
mov dl, 1
mov eax, dword [0x5864a4]
call fcn.004050ac
mov dword [esp + 8], eax
mov eax, dword [esp]
call fcn.0045f3e4
cmp al, 7
jne 0x595488
mov edx, dword [esp]
mov eax, dword [esp + 8]
call fcn.0058a9d0
test al, al
je 0x595488
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x30]
dec eax
test eax, eax
jl 0x595488
inc eax
mov dword [esp + 0x10], eax
xor ebp, ebp
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x24]
mov esi, eax
dec esi
test esi, esi
jl 0x595481
inc esi
xor ebx, ebx
mov ecx, ebx
mov edx, ebp
mov eax, dword [esp + 8]
call fcn.0058aabc
mov dword [edi], eax
movzx eax, byte [edi]
movzx edx, byte [edi + 3]
imul edx
mov ecx, 0xff
xor edx, edx
div ecx
mov byte [edi], al
movzx eax, byte [edi + 1]
movzx edx, byte [edi + 3]
imul edx
mov ecx, 0xff
xor edx, edx
div ecx
mov byte [edi + 1], al
movzx eax, byte [edi + 2]
movzx edx, byte [edi + 3]
imul edx
mov ecx, 0xff
xor edx, edx
div ecx
mov byte [edi + 2], al
mov eax, dword [edi]
push eax
mov ecx, ebx
mov edx, ebp
mov eax, dword [esp + 0xc]
call fcn.0058aadc
inc ebx
dec esi
jne 0x59541e
inc ebp
dec dword [esp + 0x10]
jne 0x59540c
lea eax, [esp + 8]
call fcn.0041caa8
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x59a178
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
mov dword [ebp - 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4cfc30]
call fcn.004d6164
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0xffffff9e
push 0xffffffffffffffec
mov eax, dword [ebp - 8]
call fcn.004b8e10
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80
or eax, 0x8000000
push eax
push 0xffffffffffffffec
mov eax, dword [ebp - 8]
call fcn.004b8e10
push eax
call sub.user32.dll_SetWindowLongW
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004d71a0
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004d80cc
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowRect
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.005b681c
push eax
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.005b6830
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x98]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
call fcn.005621b8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x59a2ba
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.0045f2e4
call fcn.00459a4c
push eax
call sub.gdi32.dll_BitBlt
push 0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x30]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.0040b058
lea edx, [ebp - 0x30]
mov cl, 0xff
mov eax, dword [ebp - 0x10]
call fcn.00587688
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59a2c1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ReleaseDC
ret

Function at 0x59a30c
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x59a31c
call sub.user32.dll_FindWindowW
ret
Function at 0x5b4cec
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x74], 0
jne 0x5b4d04
mov eax, ebx
call fcn.005b4524
cmp dword [ebx + 0x70], 0
jne 0x5b4d11
mov eax, ebx
call fcn.005b4480
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x5b4ec4
cmp dword [ebx + 0x70], 0
je 0x5b4ec4
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x30]
mov dword [esp], eax
mov eax, dword [ebx + 0x74]
mov edx, dword [eax]
call dword [edx + 0x24]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.005b42c8
lea eax, [esp + 0x14]
xor edx, edx
call fcn.005b681c
cmp eax, dword [esp]
je 0x5b4d93
lea eax, [esp + 0x14]
xor edx, edx
call fcn.005b6830
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x5b4d6f
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.005b681c
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x5b4d88
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x5b4da6
mov eax, dword [eax + 0x18]
call fcn.004b8e10
mov esi, eax
jmp 0x5b4da9
mov esi, dword [ebx + 0x58]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
and eax, 8
cmp eax, 8
jne 0x5b4dbe
or esi, 0xffffffff
jmp 0x5b4dc8
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x70]
call fcn.004dcc2c
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x70]
call fcn.004dcc68
mov edx, dword [esp]
mov eax, dword [ebx + 0x70]
call fcn.004af508
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x70]
call fcn.004af53c
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.0040b088
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x70]
call fcn.004b8e10
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x70]
call fcn.004b8e10
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x70]
call fcn.004b8e10
push eax
call sub.user32.dll_SetWindowLongW
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x74]
call fcn.0045f2e4
call fcn.00459a4c
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x70]
call fcn.004b8e10
push eax
mov eax, dword [0x6a6cd4]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x70]
call fcn.004b8e10
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret