joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42cd0e
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x5a4]
sub esp, 0x624
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x5a0], eax
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push esi
mov esi, dword [ebp + 0x5ac]
push esi
mov dword [ebp - 0x80], esi
call ebx
test eax, eax
je 0x42ce7d
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42ce7d
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp - 0x76]
push edi
push eax
mov word [ebp - 0x78], di
call fcn.0045fa70
push esi
lea eax, [ebp + 0x192]
push edi
push eax
mov word [ebp + 0x190], di
call fcn.0045fa70
add esp, 0x18
lea eax, [ebp + 0x190]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call fcn.0042c96e
pop ecx
pop ecx
mov dword [ebp - 0x7c], edi
push esi
lea eax, [ebp + 0x39a]
push edi
push eax
mov word [ebp + 0x398], di
call fcn.0045fa70
add esp, 0xc
cmp dword [ebp - 0x7c], edi
lea eax, [ebp - 0x78]
jne 0x42cde4
push eax
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp + 0x398]
push str._s_s.del
push eax
call fcn.00460936
add esp, 0x10
jmp 0x42ce03
push dword [ebp - 0x7c]
push eax
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp + 0x398]
push str._s_s.del_d
push eax
call fcn.00460936
add esp, 0x14
lea eax, [ebp + 0x398]
push eax
call ebx
test eax, eax
je 0x42ce2f
lea eax, [ebp + 0x398]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, edi
jne 0x42ce2f
cmp dword [ebp - 0x7c], 0xa
jge 0x42ce7c
inc dword [ebp - 0x7c]
jmp 0x42cda6
mov esi, dword [ebp - 0x80]
lea eax, [ebp + 0x398]
push eax
push esi
call fcn.00461bc4
pop ecx
pop ecx
lea eax, [ebp + 0x398]
push eax
call ebx
test eax, eax
je 0x42ce5a
push 5
push edi
lea eax, [ebp + 0x398]
push eax
jmp 0x42ce76
push esi
call ebx
test eax, eax
je 0x42ce7c
push str.SmartCloudIME.users
push esi
call fcn.00460605
test eax, eax
pop ecx
pop ecx
je 0x42ce7c
push 5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
mov ecx, dword [ebp + 0x5a0]
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
add ebp, 0x5a4
leave
ret
Function at 0x42ce94
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
lea eax, [ebp - 8]
push eax
xor edi, edi
mov esi, 0xf003f
push esi
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call ebx
test eax, eax
je 0x42cec9
xor eax, eax
jmp 0x42cf2a
lea eax, [ebp - 4]
push eax
push esi
push edi
push str.RunOnce
push dword [ebp - 8]
call ebx
test eax, eax
je 0x42cef9
push edi
lea eax, [ebp - 4]
push eax
push edi
push esi
push edi
push edi
push edi
push str.RunOnceEx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x42cec5
push dword [ebp + 0xc]
call fcn.0045fe9a
pop ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push 1
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42cf83
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x90], eax
push esi
mov esi, dword [ebp + 0x9c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42d079
push ebx
push edi
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push 1
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x42cfe0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea esi, [ebx + 1]
push esi
call fcn.00442ee2
and dword [ebp - 0x80], 0
pop ecx
push 0
lea ecx, [ebp - 0x80]
push ecx
push esi
push eax
push edi
mov dword [ebp - 0x78], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xe
pop ecx
mov esi, str.identifierBegin:abcdefghijklmnopqrstuvwxyz:identifierEnd
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0xcb
xor edi, edi
lea eax, [ebp - 0x3b]
push edi
push eax
call fcn.0045fa70
lea eax, [ebp - 0x74]
push eax
call fcn.0045f620
add esp, 0x10
cmp ebx, edi
jle 0x42d066
mov ecx, dword [ebp - 0x78]
add ecx, edi
mov dl, byte [ecx]
cmp dl, byte [ebp - 0x74]
jne 0x42d061
xor esi, esi
test eax, eax
mov dword [ebp - 0x7c], esi
jle 0x42d061
mov dl, byte [ecx + esi]
cmp dl, byte [ebp + esi - 0x74]
jne 0x42d061
inc dword [ebp - 0x7c]
cmp dword [ebp - 0x7c], eax
je 0x42d08f
inc esi
cmp esi, eax
jl 0x42d04b
inc edi
cmp edi, ebx
jl 0x42d036
cmp dword [ebp - 0x78], 0
je 0x42d075
push dword [ebp - 0x78]
call fcn.00402ac9
pop ecx
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
pop esi
call fcn.0045fa14
add ebp, 0x94
leave
ret
cmp dword [ebp - 0x78], 0
je 0x42d09e
push dword [ebp - 0x78]
call fcn.00402ac9
pop ecx
xor eax, eax
inc eax
jmp 0x42d077
Function at 0x42d0a3
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push 0x11c
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.0045fa70
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
jne 0x42d0fe
xor eax, eax
inc eax
cmp dword [ebp - 0x78], 0
je 0x42d0f6
cmp dword [ebp - 0x78], eax
jne 0x42d0fe
cmp byte [ebp + 0x9a], al
je 0x42d100
xor eax, eax
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0xa0
leave
ret

Function at 0x42d115
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x1588]
mov eax, 0x1608
call fcn.00461c80
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x1584], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1590]
mov esi, 0x206
xor ebx, ebx
push esi
lea eax, [ebp + 0x137e]
push ebx
push eax
mov word [ebp + 0x137c], bx
call fcn.0045fa70
push edi
lea eax, [ebp + 0x137c]
push 0x4c3d68
push eax
call fcn.00460936
lea eax, [ebp + 0x137c]
push eax
call fcn.0045fe9a
lea ecx, [eax - 1]
add esp, 0x1c
test ecx, ecx
jle 0x42d194
lea eax, [ebp + eax*2 + 0x137c]
cmp word [eax - 2], 0x5c
je 0x42d194
mov word [eax], 0x5c
lea eax, [ebp + 0x137c]
push eax
lea eax, [ebp + 0x1d4]
push 0x4c6ad0
push eax
call fcn.00460936
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1d4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x80], eax
je 0x42d272
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x42d272
cmp word [ebp - 0x50], 0x2e
je 0x42d1cc
cmp word [ebp - 0x4e], bx
je 0x42d1cc
cmp word [ebp - 0x4e], 0x2e
jne 0x42d1fb
cmp word [ebp - 0x4c], bx
je 0x42d1cc
test byte [ebp - 0x7c], 0x10
je 0x42d241
push esi
lea eax, [ebp + 0x1176]
push ebx
push eax
mov word [ebp + 0x1174], bx
call fcn.0045fa70
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x137c]
push eax
lea eax, [ebp + 0x1174]
push 0x4c582c
push eax
call fcn.00460936
lea eax, [ebp + 0x1174]
push eax
call fcn.0042d115
add esp, 0x20
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x137c]
push eax
lea eax, [ebp + 0x9a4]
push 0x4c3cf0
push eax
call fcn.00460936
add esp, 0x10
lea eax, [ebp + 0x9a4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x42d1cc
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x20
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp + 0x1584]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
add ebp, 0x1588
leave
ret
Function at 0x42d2a3
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1380]
mov eax, 0x1400
call fcn.00461c80
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x137c], eax
push ebx
mov ebx, dword [ebp + 0x138c]
push esi
mov esi, dword [ebp + 0x1388]
push esi
lea eax, [ebp + 0x1d4]
push 0x4c6ad0
push eax
call fcn.00460936
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1d4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x80], eax
je 0x42d39e
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x42d39e
cmp word [ebp - 0x50], 0x2e
je 0x42d302
cmp word [ebp - 0x4e], 0
je 0x42d302
cmp word [ebp - 0x4e], 0x2e
jne 0x42d333
cmp word [ebp - 0x4c], 0
je 0x42d302
and word [ebp + 0x1174], 0
push 0x206
lea eax, [ebp + 0x1176]
push 0
push eax
call fcn.0045fa70
lea eax, [ebp - 0x50]
push eax
push esi
lea eax, [ebp + 0x9a4]
push 0x4c3cf0
push eax
call fcn.00460936
lea eax, [ebp + 0x1174]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0042ca6d
lea eax, [ebp + 0x1174]
push ebx
push eax
call fcn.004615f0
add esp, 0x2c
test eax, eax
jne 0x42d302
lea eax, [ebp + 0x9a4]
push eax
call fcn.0042cd0e
pop ecx
jmp 0x42d302
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x137c]
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
add ebp, 0x1380
leave
ret

Function at 0x42d597
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xf60]
sub esp, 0xfe0
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0xf5c], eax
push esi
mov esi, dword [ebp + 0xf68]
push 0x7d0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Program_FilesInternet_Exploreriexplore.exe
push 0x4cb88c
call fcn.0045fe9a
pop ecx
lea eax, [ebp + eax*2 - 0x44]
push eax
call fcn.0045fd44
lea eax, [ebp - 0x44]
push esi
push eax
call fcn.0045fd1a
push 0x3c
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.0045fa70
add esp, 0x1c
xor ecx, ecx
inc ecx
push ecx
push 0
push 0
mov eax, 0x4c919c
push esi
push eax
push 0
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x7c], 0x200
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x64], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
pop esi
ja 0x42d633
lea eax, [ebp - 0x44]
push eax
call fcn.0042c6af
pop ecx
mov ecx, dword [ebp + 0xf5c]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0xf60
leave
ret

Function at 0x42d648
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0045fe9a
test eax, eax
pop ecx
je 0x42d6a0
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.0045fa70
add esp, 0xc
xor ecx, ecx
inc ecx
push ecx
push 0
push 0
mov eax, 0x4c919c
push esi
push eax
push 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0x200
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x42d6a0
push esi
call fcn.0042c6af
pop ecx
pop esi
leave
ret
Function at 0x42d7d6
Capabilities:
Get common file path

Disassembly:
call fcn.0042c588
test eax, eax
je 0x42d7e4
jmp fcn.0042d597
jmp fcn.0042d734

Function at 0x42e45e
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
sub esp, 0x11c
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x11c], eax
push 0x2c
mov eax, 0x4beec8
call fcn.004603b7
mov edi, dword [ebp + 0x128]
lea eax, [ebp - 0x38]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x11c
lea eax, [ebp]
push ebx
push eax
call fcn.0045fa70
add esp, 0xc
lea eax, [ebp]
push eax
mov dword [ebp], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x4df45c
mov ecx, edi
call fcn.00401130
mov eax, dword [ebp + 4]
xor ecx, ecx
inc ecx
sub eax, 4
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ecx
je 0x42e5e8
dec eax
je 0x42e5b0
dec eax
je 0x42e518
sub eax, 4
je 0x42e4fa
push str.Unknown_Operating_System
jmp 0x42e61e
cmp byte [ebp + 0x11a], cl
mov ecx, edi
jne 0x42e50e
push str.Microsoft_Windows_10_Insider_Preview
jmp 0x42e620
push str.Microsoft_Windows_Server_Technical_Preview
jmp 0x42e620
mov eax, dword [ebp + 8]
sub eax, ebx
je 0x42e598
dec eax
je 0x42e57a
dec eax
je 0x42e543
cmp byte [ebp + 0x11a], cl
mov ecx, edi
jne 0x42e539
push str.Microsoft_Windows_8.1
jmp 0x42e620
push str.Microsoft_Windows_Server_2012_R2
jmp 0x42e620
cmp byte [ebp + 0x11a], cl
jne 0x42e570
push 4
push 6
call fcn.0042e1a5
test eax, eax
pop ecx
pop ecx
mov ecx, edi
je 0x42e566
push str.Microsoft_Windows_10
jmp 0x42e620
push str.Microsoft_Windows_8
jmp 0x42e620
push str.Microsoft_Windows_Server_2012
jmp 0x42e61e
cmp byte [ebp + 0x11a], cl
mov ecx, edi
jne 0x42e58e
push str.Microsoft_Windows_7
jmp 0x42e620
push str.Microsoft_Windows_Server_2008_R2
jmp 0x42e620
cmp byte [ebp + 0x11a], cl
mov ecx, edi
jne 0x42e5a9
push str.Microsoft_Windows_Vista
jmp 0x42e620
push str.Microsoft_Windows_Server_2008
jmp 0x42e620
mov eax, dword [ebp + 8]
sub eax, ebx
je 0x42e5e1
dec eax
je 0x42e5da
dec eax
jne 0x42e625
cmp byte [ebp + 0x11a], cl
jne 0x42e5d3
cmp word [ebp - 0x38], 9
jne 0x42e5d3
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x42e61e
push 0x4cb924
jmp 0x42e61e
push str.Microsoft_Windows_XP
jmp 0x42e61e
push str.Microsoft_Windows_2000
jmp 0x42e61e
cmp dword [ebp + 8], ebx
je 0x42e607
cmp dword [ebp + 8], 0xa
je 0x42e600
cmp dword [ebp + 8], 0x5a
jne 0x42e625
push str.Microsoft_Windows_Me
jmp 0x42e61e
push str.Microsoft_Windows_98
jmp 0x42e61e
cmp dword [ebp + 0x10], 2
jne 0x42e614
push str.Microsoft_Windows_NT_4.0
jmp 0x42e61e
cmp dword [ebp + 0x10], ecx
jne 0x42e625
push str.Microsoft_Windows_95
mov ecx, edi
call fcn.00401300
cmp dword [ebp + 0x12c], ebx
je 0x42e644
push 0x4cae04
mov ecx, edi
call fcn.00401f50
lea eax, [ebp + 0x14]
push eax
mov ecx, edi
call fcn.00401f50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x11c]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x120
leave
ret
Function at 0x42edd0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x42ff86
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 8
mov eax, 0x4bf106
call fcn.004603b7
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 0x24c]
xor esi, esi
push 0x206
lea eax, [ebp + 0x3a]
push esi
push eax
mov word [ebp + 0x38], si
call fcn.0045fa70
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push esi
push 0x19
lea eax, [ebp + 0x38]
push eax
push esi
call edi
test eax, eax
je 0x430031
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebp + 0x1c]
call fcn.00401130
push 0x4df450
lea ecx, [ebp + 0x1c]
mov dword [ebp - 4], esi
call fcn.00401f50
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x430007
lea eax, [ebp + 0x20]
mov ecx, dword [ebp - 0x10]
push ebx
push eax
call fcn.0042fc64
cmp eax, esi
push esi
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 0x1c]
push 1
je 0x430028
call fcn.00401330
mov eax, dword [ebp - 0x14]
jmp 0x43008a
or dword [ebp - 4], 0xffffffff
call fcn.00401330
push esi
push 0x10
lea eax, [ebp + 0x38]
push eax
push esi
call edi
test eax, eax
je 0x430088
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebp]
call fcn.00401130
xor edi, edi
inc edi
push 0x4df450
lea ecx, [ebp]
mov dword [ebp - 4], edi
call fcn.00401f50
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x43006a
lea eax, [ebp + 4]
mov ecx, dword [ebp - 0x10]
push ebx
push eax
call fcn.0042fc64
push esi
lea ecx, [ebp]
push edi
mov ebx, eax
call fcn.00401330
cmp ebx, esi
je 0x430088
mov eax, ebx
jmp 0x43008a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x244
leave
ret 4

Function at 0x43067b
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x43062e
push edi
push edi
mov dword [0x4f4cc8], edi
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x20]
push ecx
push eax
call esi
lea eax, [ebp - 0x30]
push eax
push ebx
call esi
mov eax, dword [ebp - 8]
mov ecx, dword [0x4f4cc8]
sub eax, dword [ebp - 0x10]
cmp ecx, 1
jle 0x430700
cmp ecx, edi
jle 0x430700
mov esi, 0x4f4c30
mov edx, dword [esi]
cmp edx, eax
jle 0x4306fa
mov eax, edx
add esi, 0x10
dec ecx
jne 0x4306f2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430760
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x20]
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x10]
push ecx
push eax
call esi
lea eax, [ebp - 0x30]
push eax
push edi
call esi
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
pop edi
pop esi
leave
ret

Function at 0x4307aa
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x20]
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x10]
push ecx
push eax
call esi
lea eax, [ebp - 0x30]
push eax
push edi
call esi
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret

Function at 0x4307f4
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x20]
push ecx
push eax
call esi
lea eax, [ebp - 0x30]
push eax
push edi
call esi
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret
Function at 0x430859
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xb94]
sub esp, 0xc14
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0xb90], eax
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp + 0x782]
push edi
push eax
mov word [ebp + 0x780], di
call fcn.0045fa70
lea eax, [ebp + 0x780]
push str.C:log_
push eax
call fcn.0045fd44
push 0x3e6
lea eax, [ebp - 0x76]
push edi
push eax
mov word [ebp - 0x78], di
call fcn.0045fa70
lea eax, [ebp + 0x780]
push eax
lea eax, [ebp + 0x578]
push str._sgswb.log
push eax
call fcn.00460936
push esi
lea eax, [ebp + 0x372]
push edi
push eax
mov word [ebp + 0x370], di
call fcn.0045fa70
push esi
lea eax, [ebp + 0x98a]
push edi
push eax
mov word [ebp + 0x988], di
call fcn.0045fa70
add esp, 0x44
push 0x104
lea eax, [ebp + 0x988]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x988]
push 0x5c
push eax
call fcn.0045fc14
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
mov word [eax], di
pop ecx
lea eax, [ebp + 0x578]
push eax
call esi
test eax, eax
je 0x430a31
lea eax, [ebp + 0x988]
push ebx
push eax
call fcn.0045fe9a
lea eax, [ebp + eax*2 + 0x98a]
push eax
lea eax, [ebp + 0x370]
push eax
call fcn.0045fd44
lea eax, [ebp + 0x370]
push eax
lea eax, [ebp + 0x780]
push eax
lea eax, [ebp + 0x578]
push str._s_s.txt
push eax
call fcn.00460936
lea eax, [ebp + 0xba0]
push eax
push dword [ebp + 0xb9c]
lea eax, [ebp - 0x78]
push 0x1f3
push eax
call fcn.004671b5
add esp, 0x2c
lea eax, [ebp + 0x578]
push eax
mov word [ebp + 0x36e], di
mov dword [ebp - 0x7c], edi
call esi
xor ebx, ebx
inc ebx
test eax, eax
je 0x4309b3
mov dword [ebp - 0x7c], ebx
lea eax, [ebp + 0x578]
push 0x4cc100
push eax
call fcn.00463f4f
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x430a30
cmp dword [ebp - 0x7c], edi
jne 0x4309e8
push esi
push 2
lea eax, [ebp - 0x80]
push ebx
push eax
mov dword [ebp - 0x80], 0xfeff
call fcn.00467061
add esp, 0x10
lea eax, [ebp - 0x78]
push eax
call fcn.0045fe9a
push esi
add eax, eax
push eax
lea eax, [ebp - 0x78]
push ebx
push eax
call fcn.00467061
push esi
push 2
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x7c], 0xd
call fcn.00467061
push esi
push 2
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x7c], 0xa
call fcn.00467061
push esi
call fcn.00463844
add esp, 0x38
pop ebx
mov ecx, dword [ebp + 0xb90]
pop edi
xor ecx, ebp
pop esi
call fcn.0045fa14
add ebp, 0xb94
leave
ret