joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5981d198
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
xor edx, edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.59804070
xor eax, eax
push ebp
push 0x5981d2f8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x2000
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.59804080
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, eax
lea eax, [ebp - 0x16c]
mov edx, ebx
and edx, 0xff
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x16c]
lea eax, [ebp - 0x170]
call fcn.59802854
lea eax, [ebp - 0x174]
mov edx, ebx
and edx, 0xff00
shr edx, 8
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x174]
lea eax, [ebp - 0x170]
mov cl, 2
call fcn.59802824
lea edx, [ebp - 0x170]
lea eax, [ebp - 8]
call fcn.59803e34
mov eax, dword [ebp - 8]
mov edx, 0x5981d310
call fcn.59803fcc
jne 0x5981d259
mov bl, 1
jmp 0x5981d2d2
mov eax, dword [ebp - 8]
mov edx, 0x5981d31c
call fcn.59803fcc
jne 0x5981d26c
mov bl, 2
jmp 0x5981d2d2
mov eax, dword [ebp - 8]
mov edx, 0x5981d328
call fcn.59803fcc
jne 0x5981d28b
mov eax, ebx
call fcn.59805cc4
test ax, ax
jne 0x5981d28b
mov bl, 3
jmp 0x5981d2d2
mov eax, dword [ebp - 8]
mov edx, 0x5981d328
call fcn.59803fcc
jne 0x5981d2aa
mov eax, ebx
call fcn.59805cc4
test ax, ax
jbe 0x5981d2aa
mov bl, 4
jmp 0x5981d2d2
lea edx, [ebp - 0x178]
mov eax, dword [ebp - 4]
call fcn.59816f50
mov eax, dword [ebp - 0x178]
mov edx, 0x5981d334
call fcn.59806280
test al, al
je 0x5981d2d0
mov bl, 1
jmp 0x5981d2d2
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5981d2ff
lea eax, [ebp - 0x178]
call fcn.59803bf0
lea eax, [ebp - 8]
mov edx, 2
call fcn.59803c14
ret
Function at 0x5981d344
Capabilities:
Get file attributes
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.59804070
xor eax, eax
push ebp
push 0x5981d436
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x4010
cmp byte [ebp - 5], 0
je 0x5981d383
or esi, 1
jmp 0x5981d386
or esi, 0
test bl, bl
je 0x5981d3cd
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.59816f88
mov edx, 0x5981d450
mov eax, dword [ebp - 0xc]
call fcn.59806280
test al, al
jne 0x5981d3bb
mov edx, 0x5981d460
mov eax, dword [ebp - 0xc]
call fcn.59806280
test al, al
jne 0x5981d3bb
xor ebx, ebx
jmp 0x5981d3bd
mov bl, 1
test bl, bl
je 0x5981d3cd
or esi, 0x100
or esi, 0x8000
push esi
push 0x160
lea eax, [ebp - 0x16c]
push eax
mov eax, dword [ebp - 4]
call fcn.59804080
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesA
push eax
push edi
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
test esi, esi
jne 0x5981d3fb
xor ebx, ebx
jmp 0x5981d418
test bl, bl
je 0x5981d407
mov ebx, dword [ebp - 0x16c]
jmp 0x5981d418
push 0
mov eax, dword [ebp - 0x168]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIcon
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5981d43d
lea eax, [ebp - 0xc]
call fcn.59803bf0
lea eax, [ebp - 4]
call fcn.59803bf0
ret
Function at 0x59826f50
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.5981ad20
test al, al
je 0x59827016
mov eax, dword [ebp - 4]
cmp byte [eax + 0x79], 0
jne 0x59827004
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x54]
xor eax, eax
push ebp
push 0x59826ffd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x70], 0
je 0x59826fd9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x59826fd9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
mov edx, dword [eax]
call dword [edx + 0x80]
test eax, eax
je 0x59826fe7
mov eax, dword [ebp - 4]
push eax
push 0x59826e50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
mov edx, dword [eax]
call dword [edx + 0x80]
push eax
call sub.user32.dll_EnumThreadWindows
jmp 0x59826fe7
mov eax, dword [ebp - 4]
push eax
push 0x59826e50
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59827016
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x58]
ret
mov ecx, 0x59827028
mov edx, 0x30000
mov eax, dword [ebp - 4]
call fcn.5981a6a8
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x5982c4b8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x5982c4c0
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x5982c62f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x4c], 0
jne 0x5982c5f8
mov eax, ebx
call fcn.5981ad20
test al, al
je 0x5982c5f8
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x80]
mov esi, eax
call sub.kernel32.dll_GetCurrentProcessId
cmp esi, eax
je 0x5982c520
lea eax, [ebp - 0x30]
call fcn.598075b8
cmp byte [ebp - 0x20], 0
je 0x5982c530
cmp dword [ebx + 0x34], 0x80000000
jb 0x5982c530
mov eax, dword [ebx + 0x34]
call fcn.59807f24
mov dword [ebx + 0x4c], eax
jmp 0x5982c5e4
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0x30]
call fcn.598052dc
lea ecx, [ebp - 0x10]
mov edx, 0x10
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xa8]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x5982c5c3
push 2
lea ecx, [ebp - 2]
mov edx, dword [ebx + 0x34]
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x104]
test al, al
je 0x5982c5e4
cmp word [ebp - 2], 0x5a4d
jne 0x5982c5e4
push 4
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x34]
add edx, 0x3c
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x104]
test al, al
je 0x5982c5e4
mov eax, dword [ebx + 0x34]
add eax, dword [ebp - 8]
mov dword [ebx + 0x4c], eax
push 4
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x4c]
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x104]
test al, al
je 0x5982c5bc
cmp dword [ebp - 8], 0x4550
je 0x5982c5e4
xor eax, eax
mov dword [ebx + 0x4c], eax
jmp 0x5982c5e4
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
pop ecx
call fcn.5981a6a8
cmp dword [ebx + 0x4c], 0
jne 0x5982c5f8
xor ecx, ecx
mov edx, 2
mov eax, ebx
call fcn.5981a6a8
mov ebx, dword [ebx + 0x4c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5982c636
lea eax, [ebp - 0x34]
call fcn.59803bf0
lea eax, [ebp - 0x30]
mov edx, dword [0x598074c8]
call fcn.59804590
lea eax, [ebp - 0x10]
call fcn.598052c4
lea eax, [ebp - 0xc]
call fcn.598052c4
ret
Function at 0x5982f6b4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5982f7b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5983c8f4]
mov byte [eax], 1
mov eax, 8
call fcn.59802598
mov ebx, eax
mov dword [ebx], esi
mov eax, dword [ebp - 4]
mov dword [ebx + 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0x5982f628
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x5982f753
mov edx, 8
mov eax, ebx
call fcn.598025b8
call sub.kernel32.dll_GetLastError
push eax
push 0
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5981e718]
call fcn.598209b8
mov edx, eax
test edx, edx
je 0x5982f74a
sub edx, 0xffffff98
mov eax, edi
call fcn.598052dc
jmp 0x5982f798
lea ecx, [ebp - 0x10]
mov dl, 1
mov eax, esi
call fcn.59822a08
mov edx, dword [ebp - 0x10]
mov al, 5
call fcn.59820308
mov ebx, eax
mov byte [ebx + 0x44], 1
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x48], eax
lea eax, [ebp - 0x14]
call fcn.5983541c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x64]
call fcn.598052dc
mov eax, edi
mov edx, ebx
test edx, edx
je 0x5982f793
sub edx, 0xffffff98
call fcn.598052dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5982f7bd
lea eax, [ebp - 0x14]
call fcn.598052c4
lea eax, [ebp - 0x10]
call fcn.598052c4
ret

Function at 0x5983732c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
push ebx
push esi
mov ecx, dword [ebp - 4]
jecxz 0x59837375
mov eax, dword [ebp - 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov esi, dword [ebp - 0xc]
mov ebx, edx
shr ebx, 0x18
xor bl, byte [esi]
inc esi
shld edx, eax, 8
shl eax, 8
xor edx, dword [ebx*4 + 0x5983c3d8]
xor eax, dword [ebx*4 + 0x5983bfd8]
dec ecx
jne 0x5983734d
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov dword [ebx + 4], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x59837410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
mov eax, 1
shl eax, cl
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
mov eax, 0x34879012
mov edx, 0x69afe9a7
add edx, eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
add ecx, 4
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ecx]
mov dword [ebp - 8], esi
add ecx, 4
mov esi, dword [ecx]
mov dword [ebp - 0xc], esi
add ecx, 4
mov esi, dword [ecx]
mov dword [ebp - 0x10], esi
add ecx, 4
mov ecx, dword [ecx]
mov dword [ebp - 0x14], ecx
xor ecx, ecx
test ebx, ebx
jbe 0x598374a6
add ecx, dword [ebp - 4]
mov esi, edx
shl esi, 4
mov edi, dword [ebp - 8]
xor edi, edx
add esi, edi
mov edi, edx
shr edi, 5
xor edi, ecx
add esi, edi
add esi, dword [ebp - 0xc]
add eax, esi
mov esi, eax
shl esi, 4
mov edi, dword [ebp - 0x10]
xor edi, eax
add esi, edi
mov edi, eax
shr edi, 5
xor edi, ecx
add esi, edi
add esi, dword [ebp - 0x14]
add edx, esi
dec ebx
test ebx, ebx
ja 0x5983746a
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
add ecx, 4
mov dword [ecx], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x598374bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov eax, 0x34879012
mov edx, 0x69afe9a7
add edx, eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp - 4]
shl ebx, cl
mov ecx, dword [ebp + 0x10]
mov eax, 1
shl eax, cl
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
add ecx, 4
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ecx]
mov dword [ebp - 8], esi
add ecx, 4
mov esi, dword [ecx]
mov dword [ebp - 0xc], esi
add ecx, 4
mov esi, dword [ecx]
mov dword [ebp - 0x10], esi
add ecx, 4
mov ecx, dword [ecx]
cmp dword [ebp + 0x10], 0
jbe 0x59837555
mov esi, eax
shl esi, 4
mov edi, dword [ebp - 0x10]
xor edi, eax
add esi, edi
mov edi, eax
shr edi, 5
xor edi, ebx
add esi, edi
add esi, ecx
sub edx, esi
mov esi, edx
shl esi, 4
mov edi, dword [ebp - 8]
xor edi, edx
add esi, edi
mov edi, edx
shr edi, 5
xor edi, ebx
add esi, edi
add esi, dword [ebp - 0xc]
sub eax, esi
sub ebx, dword [ebp - 4]
dec dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0
ja 0x59837516
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
add ecx, 4
mov dword [ecx], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x59837568
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov edx, dword [ebp + 8]
cmp dword [ebp + 0xc], 1
jb 0x59837631
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov esi, edx
mov eax, dword [ebp + 0xc]
shr eax, 3
mov ebx, eax
test ebx, ebx
jbe 0x598375ec
mov eax, dword [esi]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 2
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
call fcn.59837410
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
add esi, 8
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
add eax, dword [ebp - 0x10]
adc edx, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
dec ebx
jne 0x598375a3
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 2
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
call fcn.59837410
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov edx, esi
mov eax, dword [ebp + 0xc]
and eax, 7
mov ebx, eax
test ebx, ebx
jbe 0x59837631
lea eax, [ebp - 0x18]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x59837628
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x5983763c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
cmp dword [ebp + 0x10], 1
jb 0x5983770f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov edi, edx
mov eax, dword [ebp + 0x10]
shr eax, 3
mov ebx, eax
test ebx, ebx
jbe 0x598376c7
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov eax, dword [edi + 4]
mov dword [ebp - 4], eax
push 2
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
call fcn.598374bc
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
add edi, 8
add esi, 8
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
add eax, dword [ebp - 0x10]
adc edx, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
dec ebx
jne 0x5983767b
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 2
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
call fcn.59837410
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov edx, edi
mov eax, dword [ebp + 0x10]
and eax, 7
mov ebx, eax
test ebx, ebx
jbe 0x5983770f
lea eax, [ebp - 0x18]
mov cl, byte [edx]
xor cl, byte [eax]
mov byte [esi], cl
inc edx
inc esi
inc eax
dec ebx
jne 0x59837703
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x598379dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
push ebx
xor eax, eax
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x318], eax
xor eax, eax
push ebp
push 0x59837b59
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.59816038
mov ebx, eax
test ebx, ebx
je 0x59837b2a
mov eax, dword [0x5983c9f4]
mov eax, dword [eax]
mov dword [0x5983c7ec], eax
mov eax, 0x5983dba8
call fcn.59803bf0
push 0x104
lea eax, [ebp - 0x310]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
test eax, eax
je 0x59837a67
lea eax, [ebp - 0x105]
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.5980d6a0
mov eax, 0x5983dba8
lea edx, [ebp - 0x105]
call fcn.59803dc8
cmp dword [0x5983dba8], 0
jne 0x59837a9f
lea eax, [ebp - 0x318]
call fcn.5983541c
mov eax, dword [ebp - 0x318]
lea edx, [ebp - 0x314]
mov ecx, dword [eax]
call dword [ecx + 0xa0]
mov edx, dword [ebp - 0x314]
mov eax, 0x5983dba8
call fcn.59803c44
mov eax, 0x5983dbac
call fcn.59803bf0
mov eax, 0x5983dbb0
call fcn.59803bf0
push 0x104
lea eax, [ebp - 0x310]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x59837b2a
lea edx, [ebp - 0x105]
lea eax, [ebp - 0x310]
mov ecx, 0x104
call fcn.598379b0
lea eax, [ebp - 0x41c]
lea edx, [ebp - 0x105]
call fcn.598029bc
lea edx, [ebp - 0x41c]
lea eax, [ebp - 0x31c]
call fcn.59803e34
mov edx, dword [ebp - 0x31c]
mov eax, 0x5983dbac
mov ecx, 0x59837b70
call fcn.59803ed4
mov eax, 0x5983dbb0
mov ecx, dword [0x5983dbac]
mov edx, 0x59837b7c
call fcn.59803ed4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59837b60
lea eax, [ebp - 0x31c]
call fcn.59803bf0
lea eax, [ebp - 0x318]
call fcn.598052c4
lea eax, [ebp - 0x314]
call fcn.59803bf0
ret

Function at 0x59837ce8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce8
push ebx
xor eax, eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x59837d9a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x59837db0
call fcn.59803c88
push 0x104
lea eax, [ebp - 0x314]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x59837d67
lea edx, [ebp - 0x109]
lea eax, [ebp - 0x314]
mov ecx, 0x104
call fcn.598379b0
lea eax, [ebp - 0x318]
lea edx, [ebp - 0x109]
call fcn.59803dc8
mov edx, dword [ebp - 0x318]
lea eax, [ebp - 4]
mov ecx, 0x59837dc8
call fcn.59803ed4
mov edx, dword [0x5983dba8]
mov eax, dword [ebp - 4]
call fcn.59806280
neg al
sbb ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59837da1
lea eax, [ebp - 0x318]
call fcn.59803bf0
lea eax, [ebp - 4]
call fcn.59803bf0
ret
Function at 0x59837dd8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd0
push ebx
xor eax, eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x324], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x59837feb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x59838004
call fcn.59803c88
lea eax, [ebp - 8]
mov edx, 0x5983801c
call fcn.59803c88
lea eax, [ebp - 0xc]
mov edx, 0x59838030
call fcn.59803c88
lea eax, [ebp - 0x10]
mov edx, 0x59838048
call fcn.59803c88
push 0x104
lea eax, [ebp - 0x320]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x59837f63
lea edx, [ebp - 0x115]
lea eax, [ebp - 0x320]
mov ecx, 0x104
call fcn.598379b0
lea eax, [ebp - 0x424]
lea ebx, [ebp - 0x115]
mov edx, ebx
call fcn.598029bc
lea edx, [ebp - 0x424]
lea eax, [ebp - 0x324]
call fcn.59803e34
push dword [ebp - 0x324]
push 0x5983805c
push dword [ebp - 4]
lea eax, [ebp - 4]
mov edx, 3
call fcn.59803f48
lea eax, [ebp - 0x424]
mov edx, ebx
call fcn.598029bc
lea edx, [ebp - 0x424]
lea eax, [ebp - 0x428]
call fcn.59803e34
push dword [ebp - 0x428]
push 0x5983805c
push dword [ebp - 8]
lea eax, [ebp - 8]
mov edx, 3
call fcn.59803f48
lea eax, [ebp - 0x424]
mov edx, ebx
call fcn.598029bc
lea edx, [ebp - 0x424]
lea eax, [ebp - 0x42c]
call fcn.59803e34
push dword [ebp - 0x42c]
push 0x5983805c
push dword [ebp - 0xc]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.59803f48
lea eax, [ebp - 0x424]
mov edx, ebx
call fcn.598029bc
lea edx, [ebp - 0x424]
lea eax, [ebp - 0x430]
call fcn.59803e34
push dword [ebp - 0x430]
push 0x5983805c
push dword [ebp - 0x10]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.59803f48
mov edx, dword [0x5983dba8]
mov eax, dword [ebp - 4]
call fcn.59806280
test al, al
jne 0x59837faf
mov edx, dword [0x5983dba8]
mov eax, dword [ebp - 8]
call fcn.59806280
test al, al
jne 0x59837faf
mov edx, dword [0x5983dba8]
mov eax, dword [ebp - 0xc]
call fcn.59806280
test al, al
jne 0x59837faf
mov edx, dword [0x5983dba8]
mov eax, dword [ebp - 0x10]
call fcn.59806280
test al, al
jne 0x59837faf
xor eax, eax
jmp 0x59837fb1
mov al, 1
neg al
sbb ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59837ff2
lea eax, [ebp - 0x430]
mov edx, 3
call fcn.59803c14
lea eax, [ebp - 0x324]
call fcn.59803bf0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.59803c14
ret
Function at 0x598382e8
Capabilities:
Get common file path

Disassembly:
add esp, 0xfffffdf4
mov eax, esp
xor ecx, ecx
mov edx, 0x20a
call fcn.598028d0
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x598383c5
mov eax, esp
jmp 0x5983831a
add eax, 2
cmp word [eax], 0
jne 0x59838317
mov word [eax], 0x5c
add eax, 2
mov word [eax], 0x6d
add eax, 2
mov word [eax], 0x63
add eax, 2
mov word [eax], 0x69
add eax, 2
mov word [eax], 0x73
add eax, 2
mov word [eax], 0x61
add eax, 2
mov word [eax], 0x66
add eax, 2
mov word [eax], 0x65
add eax, 2
mov word [eax], 0x2e
add eax, 2
mov word [eax], 0x64
add eax, 2
mov word [eax], 0x72
add eax, 2
mov word [eax], 0x76
cmp dword [0x5983db6c], 0
jne 0x598383a6
push 0
push 2
push 4
push 0
push 1
push 0x80000000
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_CreateFileW
mov dword [0x5983c7f4], eax
jmp 0x598383c5
push 0
push 2
push 4
push 0
push 1
push 0x80000000
lea eax, [esp + 0x18]
push eax
call dword [0x5983db6c]
mov dword [0x5983c7f4], eax
add esp, 0x20c
ret

Function at 0x59839f7c
Capabilities:
Read file on windows

Disassembly:
push ebx
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x59839f83
mov eax, dword [esp + 0x8000]
add esp, 0xfffffdec
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
push 0x104
lea eax, [esp + 0x10]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
test eax, eax
je 0x5983a047
cmp dword [0x5983db6c], 0
jne 0x59839fe8
push 0
push 0
push 3
push 0
push 7
push 0x80000000
lea eax, [esp + 0x24]
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
jmp 0x5983a004
push 0
push 0
push 3
push 0
push 7
push 0x80000000
lea eax, [esp + 0x24]
push eax
call dword [0x5983db6c]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5983a047
push 0
lea eax, [esp + 0xc]
push eax
push 0x7fff
lea eax, [esp + 0x222]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x5983a041
mov ax, word [esp + 8]
push eax
lea eax, [esp + 0x21a]
push eax
call fcn.59837718
mov dword [esp], eax
mov dword [esp + 4], edx
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x8218
pop ebx
ret