joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4caa20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4caa51
dec al
je 0x4caa8d
dec al
je 0x4caad1
dec al
je 0x4cab3c
jmp 0x4cabc6
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4cabc6
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4caa61
jmp 0x4cabc6
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4cabc6
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4caa9d
jmp 0x4cabc6
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4cabc6
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4caaff
xor ebp, ebp
jmp 0x4cab10
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4cab19
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4caae1
jmp 0x4cabc6
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4cabc6
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4cab94
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004c7c98
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4cab50
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d1530
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4d155e
mov eax, ebx
call fcn.004d1fe4
cmp dword [ebx + 0x40], 0
je 0x4d1557
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4d15cf
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4d15c1
cmp dword [ebx + 8], 0
je 0x4d1580
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4d1592
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4d15c1
cmp dword [ebx + 8], 0
je 0x4d1573
cmp eax, 3
je 0x4d15a5
dec eax
jne 0x4d1573
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4d1573
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4d1573
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4d15ed
cmp dword [ebx + 0x14], 0xcc
je 0x4d15ed
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004d15f8
pop ebx
ret

Function at 0x4e7430
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a0], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e7581
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4e747c
cmp dword [ebp - 0x8c], 1
je 0x4e7480
xor ebx, ebx
jmp 0x4e7482
mov bl, 1
mov dl, 1
mov eax, dword [0x443c90]
call fcn.00443d60
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e755c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.00443e00
test bl, bl
je 0x4e74bf
mov edx, 0x4e7598
mov eax, dword [ebp - 4]
call fcn.00443f88
jmp 0x4e74cc
mov edx, 0x4e75cc
mov eax, dword [ebp - 4]
call fcn.00443f88
lea ecx, [ebp - 0x1a0]
mov edx, 0x4e7604
mov eax, dword [ebp - 4]
call fcn.004441b8
mov edx, dword [ebp - 0x1a0]
lea eax, [esi + 0x1c]
call fcn.00404488
lea ecx, [ebp - 0x1a4]
mov edx, 0x4e761c
mov eax, dword [ebp - 4]
call fcn.004441b8
mov edx, dword [ebp - 0x1a4]
lea eax, [esi + 0x20]
call fcn.00404488
mov eax, dword [ebp - 4]
call fcn.00443dd0
cmp dword [esi + 0x1c], 0
jne 0x4e7546
mov dword [ebp - 8], 0xff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x19c]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [esi + 0x1c]
lea edx, [ebp - 0x19c]
mov ecx, pe_nt_image_headers32
call fcn.004046a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7563
mov eax, dword [ebp - 4]
call fcn.00403600
ret
Function at 0x4eeee8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x419744]
call fcn.00404e2c
xor eax, eax
push ebp
push 0x4ef02c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5ab884], 0
jne 0x4eef3b
mov ecx, dword [0x5ae528]
mov dl, 1
mov eax, dword [0x407cc0]
call fcn.0040ce84
call fcn.00403dcc
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f70
mov eax, ebx
call fcn.00404c9c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4ef03c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405ef8
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404cac
test eax, eax
jle 0x4eefd3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4eefcc
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004046bc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004046a4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408b6c
test eax, eax
jne 0x4eefcc
mov ebx, 0x15
jmp 0x4eefd8
mov ebx, 0x10
jmp 0x4eefd8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x5ab884]
call fcn.004eee40
mov eax, dword [ebp - 8]
call fcn.004eee40
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405f10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef033
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404458
lea eax, [ebp - 0x10]
mov edx, dword [0x419744]
call fcn.00404efc
ret
Function at 0x4f71f0
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x4f7209
add esp, 0xfffffff0
call fcn.00403964
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4f7321
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00425a64
lea eax, [ebx + 0x30]
mov edx, dword [ebp + 8]
call fcn.00404488
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebx + 0x30]
call fcn.004048f4
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
mov dword [ebx + 0x34], esi
cmp esi, 0xffffffff
jne 0x4f7272
mov ecx, dword [ebx + 0x30]
lea eax, [ebp - 8]
mov edx, 0x4f7354
call fcn.00404740
mov eax, dword [ebp - 8]
call fcn.004f71d8
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebx + 0x34]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
mov dword [ebx + 0x38], esi
test esi, esi
jne 0x4f7298
mov eax, 0x4f736c
call fcn.004f71d8
push 0
push 0
push 0
push 4
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0x4f72bc
mov eax, 0x4f7390
call fcn.004f71d8
mov eax, dword [ebx + 0x3c]
mov dword [ebx + 0x40], eax
mov ax, word [eax]
not ax
cmp ax, 0x5a4d
jne 0x4f72d8
mov eax, 0x4f73b0
call fcn.004f71d8
mov eax, dword [ebx + 0x40]
mov edx, dword [ebx + 0x40]
add eax, dword [edx + 0x3c]
mov dword [ebx + 0x44], eax
push 0xf8
mov eax, dword [ebx + 0x44]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x4f7301
mov eax, dword [ebx + 0x44]
cmp dword [eax], 0x4550
je 0x4f730b
mov eax, 0x4f73d4
call fcn.004f71d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7328
lea eax, [ebp - 8]
call fcn.00404434
ret
Function at 0x4f8bb4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f8cf5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, esi
mov eax, dword [ebp + 8]
call fcn.004f6e90
lea eax, [ebp - 8]
push eax
mov eax, esi
call fcn.004048f4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4f8cda
mov eax, dword [ebp - 8]
call fcn.00408908
mov ebx, eax
push ebx
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.004048f4
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4f8d08
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4f8c46
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.0040462c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4f8d30
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4f8c68
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.0040462c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4f8d54
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4f8c8a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
call fcn.0040462c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040280c
lea edx, [ebp - 0x14]
mov eax, dword [edi]
call fcn.00408bdc
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.00404488
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00408bdc
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00404488
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
call fcn.00408bdc
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
call fcn.00404488
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8cfc
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404458
ret

Function at 0x4f9f64
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov ebx, eax
mov eax, edi
call fcn.00404434
mov eax, ebx
call fcn.00409430
test al, al
je 0x4f9fe0
push esp
mov eax, ebx
call fcn.004048f4
mov ebp, eax
push ebp
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [esp], eax
cmp dword [esp], 0
jbe 0x4f9fe0
mov eax, dword [esp]
call fcn.00408908
mov esi, eax
push esi
mov eax, dword [esp + 4]
push eax
push 0
push ebp
call sub.version.dll_GetFileVersionInfoA
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0x4f9fe8
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4f9fd6
mov eax, edi
mov edx, dword [esp + 8]
call fcn.0040462c
mov edx, dword [esp]
mov eax, esi
call fcn.0040280c
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4fb4d8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, edx
push esp
and eax, 0x7f
mov eax, dword [eax*4 + 0x5ab9c0]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [esp + 4]
call fcn.00409cec
add esp, 0x10c
pop ebx
ret

Function at 0x4fbc28
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov ebx, eax
mov eax, edi
call fcn.00404434
mov eax, ebx
call fcn.00409430
test al, al
je 0x4fbca4
push esp
mov eax, ebx
call fcn.004048f4
mov ebp, eax
push ebp
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [esp], eax
cmp dword [esp], 0
jbe 0x4fbca4
mov eax, dword [esp]
call fcn.00408908
mov esi, eax
push esi
mov eax, dword [esp + 4]
push eax
push 0
push ebp
call sub.version.dll_GetFileVersionInfoA
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0x4fbcac
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4fbc9a
mov eax, edi
mov edx, dword [esp + 8]
call fcn.0040462c
mov edx, dword [esp]
mov eax, esi
call fcn.0040280c
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4fd270
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004fcff0
lea edx, [ebp - 6]
mov ecx, 2
mov eax, ebx
call fcn.004fcfc8
cmp word [ebp - 6], 0x5a4d
je 0x4fd2ad
mov eax, 0x4fd3e8
call fcn.004fd0f8
mov edx, 0x3c
mov eax, ebx
call fcn.004fcff0
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, ebx
call fcn.004fcfc8
cmp dword [ebp - 0xc], 0
jne 0x4fd2d8
mov eax, 0x4fd40c
call fcn.004fd0f8
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004fcff0
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, ebx
call fcn.004fcfc8
cmp dword [ebp - 0x10], 0x4550
je 0x4fd304
mov eax, 0x4fd430
call fcn.004fd0f8
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, ebx
call fcn.004fcfc8
movzx eax, word [ebp - 0x18]
cmp eax, 0xe0
je 0x4fd328
mov eax, 0x4fd454
call fcn.004fd0f8
lea edx, [ebp - 0x108]
mov ecx, 0xe0
mov eax, ebx
call fcn.004fcfc8
cmp word [ebp - 0x108], 0x10b
je 0x4fd34f
mov eax, 0x4fd478
call fcn.004fd0f8
cmp dword [ebp - 0x98], 0
je 0x4fd361
cmp dword [ebp - 0x94], 0
jne 0x4fd36b
mov eax, 0x4fd49c
call fcn.004fd0f8
mov eax, dword [ebp - 0x98]
mov dword [edi], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
movzx esi, word [ebp - 0x26]
dec esi
test esi, esi
jl 0x4fd3c4
inc esi
lea edx, [ebp - 0x130]
mov ecx, 0x28
mov eax, ebx
call fcn.004fcfc8
mov eax, dword [edi]
cmp eax, dword [ebp - 0x124]
jne 0x4fd3c1
cmp dword [ebp - 0x120], 0
je 0x4fd3c1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x11c]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x120]
mov dword [eax], edx
jmp 0x4fd3c4
dec esi
jne 0x4fd384
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4fd3d6
mov eax, 0x4fd4b8
call fcn.004fd0f8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5121fc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x222], 0
je 0x512223
mov ecx, edi
mov dl, 1
mov eax, dword [0x511040]
call fcn.005110a4
mov dword [edi + 0x294], eax
jmp 0x51232c
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
cmp byte [edi + 0x22b], 0
je 0x512264
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp dx, word [edi + 0x226]
jbe 0x512259
mov edx, eax
sub dl, byte [edi + 0x226]
mov eax, edi
call fcn.005117ac
jmp 0x51229a
xor edx, edx
mov eax, edi
call fcn.005117ac
jmp 0x51229a
movzx edx, word [edi + 0x226]
mov ecx, 0x64
sub ecx, edx
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp ecx, edx
jle 0x512291
mov edx, eax
add dl, byte [edi + 0x226]
mov eax, edi
call fcn.005117ac
jmp 0x51229a
mov dl, 0x64
mov eax, edi
call fcn.005117ac
cmp byte [edi + 0x22b], 0
je 0x5122ac
cmp byte [edi + 0x22a], 0
je 0x5122be
cmp byte [edi + 0x22b], 0
jne 0x5122c9
cmp byte [edi + 0x22a], 0x64
jne 0x5122c9
mov bl, byte [edi + 0x224]
xor bl, 1
jmp 0x5122f9
mov eax, dword [0x5ae974]
mov eax, dword [eax]
call fcn.004a12b8
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
movzx edx, word [edi + 0x228]
cmp eax, edx
ja 0x5122f9
cmp byte [edi + 0x224], 0
jne 0x5122f9
cmp byte [edi + 0x2a0], 0
je 0x5122c9
test bl, bl
jne 0x512313
cmp byte [edi + 0x224], 0
jne 0x512313
cmp byte [edi + 0x2a0], 0
je 0x512225
cmp byte [edi + 0x2a0], 0
jne 0x512325
cmp byte [edi + 0x224], 0
jne 0x51232c
mov eax, edi
call fcn.00512620
pop edi
pop esi
pop ebx
ret

Function at 0x5166f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x516769
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x5ac1d4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x516753
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.005166e8
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5144f8]
call fcn.005175b8
mov dword [0x5ac23c], eax
mov eax, dword [ebp - 4]
call fcn.00516574
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x516770
lea eax, [ebp - 8]
call fcn.00405ef8
ret

Function at 0x516808
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x51681b
or esi, 2
test dl, dl
je 0x516824
or esi, 0
jmp 0x516827
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret
Function at 0x517444
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004048e4
xor eax, eax
push ebp
push 0x51759c
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x5142e0]
call fcn.004187f0
test eax, eax
jl 0x5174ab
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.005167ec
and eax, 0x7f
mov eax, dword [eax*4 + 0x5ac1d4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x51750e
mov eax, dword [ebx]
call fcn.004046f4
test eax, eax
jle 0x51750e
mov eax, dword [ebx]
call fcn.004046f4
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x5174d2
mov eax, ebx
mov edx, 0x5175b4
call fcn.004046fc
mov eax, dword [ebx]
call fcn.004046f4
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.004052bc
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.005166e8
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x517559
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x5ae570]
call fcn.004063d8
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040a1dc
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404488
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x407cc0]
call fcn.0040cdc8
call fcn.00403dcc
mov eax, dword [ebp - 8]
call fcn.005173bc
mov ebx, eax
test edi, edi
je 0x51756e
mov eax, edi
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5175a3
lea eax, [ebp - 0x1c]
call fcn.00404434
lea eax, [ebp - 0x18]
call fcn.00405ef8
lea eax, [ebp - 0x14]
call fcn.00404434
lea eax, [ebp - 4]
call fcn.00404434
ret

Function at 0x518180
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x3c
call fcn.00402f70
mov dword [esp], 0x3c
mov eax, dword [0x5ae974]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc
mov eax, dword [ebx + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 5
push esp
call sub.shell32.dll_ShellExecuteExA
add esp, 0x3c
pop ebx
ret
Function at 0x518628
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
test dl, dl
je 0x51863f
add esp, 0xfffffff0
call fcn.00403964
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00456a48
xor eax, eax
mov dword [ebx + 0x340], eax
xor edx, edx
mov eax, ebx
call fcn.00457544
mov al, byte [0x518718]
mov byte [ebx + 0x344], al
mov byte [ebx + 0x244], 1
mov byte [ebx + 0x34d], 1
mov byte [ebx + 0x34e], 0
xor eax, eax
mov dword [ebx + 0x350], eax
xor eax, eax
mov dword [ebx + 0x354], eax
mov byte [ebx + 0x359], 0
mov byte [ebx + 0x35a], 1
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x51871c
call sub.shell32.dll_SHGetFileInfoA
mov dword [ebx + 0x348], eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x5147b8]
call fcn.0051825c
mov esi, eax
mov dword [ebx + 0x35c], esi
mov al, byte [esi + 0x24]
or al, byte [0x518720]
mov byte [esi + 0x24], al
lea eax, [ebx + 0x338]
mov edx, 0x51872c
call fcn.00404488
mov byte [ebx + 0x34c], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x51870f
call fcn.004039bc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x518c9c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x518e06
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5aebd8]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x5aebd8]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0049f32c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00456654
xor edx, edx
push ebp
push 0x518de9
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x518d59
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00405ef8
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.00516e04
push eax
mov eax, dword [0x5ae974]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x518d4f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00403e78
jmp 0x518df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x518d95
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00456234
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00518b2c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x518d71
push 0
mov edx, 0x518ac4
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00455dec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518df0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.004566a0
mov eax, dword [0x5aebd8]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.0049f32c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518e0d
lea eax, [ebp - 0x10]
call fcn.00405ef8
ret