joyce8/EMBER2024-capa huggingface dataset:
Function at 0x556630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af993
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0
mov dword [esi + 0x88], edi
mov dword [esi + 0x78], 0
call fcn.004174cb
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
movzx eax, ax
push eax
call fcn.004176e1
call fcn.00416adc
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x556722
call fcn.00414e1f
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x5566bb
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 8], 0
push eax
lea ecx, [ebp - 0x18]
call fcn.0041751a
call fcn.00416adc
lea ecx, [ebp - 0x18]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call fcn.00417749
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x556722
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x55674c
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x55674c
cmp dword [0x62202c], 0
je 0x55674c
or dword [eax + 8], 0x400000
push 0
push edi
push eax
mov ecx, esi
call fcn.00419bdc
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417506
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x556780
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af9be
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], 0
call fcn.004174cb
push 0x69
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.004176e1
call fcn.00416adc
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x556863
call fcn.00414e1f
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x5567fc
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x20]
call fcn.0041751a
call fcn.00416adc
lea ecx, [ebp - 0x20]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.00417749
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x556863
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x55688d
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x55688d
cmp dword [0x62202c], 0
je 0x55688d
or dword [eax + 8], 0x400000
push 0
push dword [esi + 0x88]
mov ecx, esi
push eax
call fcn.00419f11
mov ecx, esi
call fcn.00419c52
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417506
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x556cc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5afa6e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0
mov dword [esi + 0x88], edi
mov dword [esi + 0x78], 0
call fcn.004174cb
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
movzx eax, ax
push eax
call fcn.004176e1
call fcn.00416adc
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x556db2
call fcn.00414e1f
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x556d4b
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 8], 0
push eax
lea ecx, [ebp - 0x18]
call fcn.0041751a
call fcn.00416adc
lea ecx, [ebp - 0x18]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call fcn.00417749
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x556db2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x556ddc
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x556ddc
cmp dword [0x62202c], 0
je 0x556ddc
or dword [eax + 8], 0x400000
push 0
push edi
push eax
mov ecx, esi
call fcn.00419bdc
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417506
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x556e20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5afa99
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x78], 0
call fcn.004174cb
push 0x68
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.004176e1
call fcn.00416adc
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x556f03
call fcn.00414e1f
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x556e9c
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x20]
call fcn.0041751a
call fcn.00416adc
lea ecx, [ebp - 0x20]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.00417749
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x556f03
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax], 1
jne 0x556f2d
mov ecx, 0xffff
cmp word [eax + 2], cx
jne 0x556f2d
cmp dword [0x62202c], 0
je 0x556f2d
or dword [eax + 8], 0x400000
push 0
push dword [esi + 0x88]
mov ecx, esi
push eax
call fcn.00419f11
mov ecx, esi
call fcn.00419c52
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417506
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x55d230
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5afeba
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
push esi
push edi
mov eax, dword [0x616040]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp ebx, 1
jne 0x55d333
push 0
push 0x69
lea ecx, [esp + 0x1c]
call fcn.004196f8
mov dword [esp + 0x14], vtable.CDlgProgress.0
mov dword [esp + 0xac], 0
mov eax, dword [ebp + 0x14]
lea ecx, [esp + 0x14]
mov dword [esp + 0xd8], 0
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], 0x1fbd
mov dword [esp + 0xb8], 0x1fb2
mov dword [esp + 0xbc], 0x23c1
mov dword [esp + 0xc0], esi
call fcn.00556780
mov edx, dword [esp + 0xc8]
test edx, edx
je 0x55d2ef
mov ecx, dword [ebp + 0x10]
call fcn.00547e40
mov ebx, 2
mov dword [esp + 0x14], vtable.CDlgProgress.0
mov dword [esp + 0xd8], 1
mov ecx, dword [esp + 0xac]
test ecx, ecx
je 0x55d314
mov eax, dword [ecx]
push 1
call dword [eax + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0xac], 0
mov dword [esp + 0xd8], 0xffffffff
call fcn.00419745
cmp ebx, 2
jne 0x55d359
mov eax, dword [esi + 0x1d4]
mov edi, dword [eax + 8]
mov esi, dword [eax + 4]
test edi, edi
jle 0x55d359
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [esi + 0x90]
dec edi
jne 0x55d348
mov eax, ebx
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x567780
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b06eb
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, cl
push 0x20001
mov edx, 0x1e240
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0058f590
add esp, 4
mov byte [ebp - 4], 1
mov ecx, 0x5e9af0
mov esi, dword [ebp - 0x18]
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x5677fa
test dx, dx
je 0x5677f6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x5677fa
add eax, 4
add ecx, 4
test dx, dx
jne 0x5677d4
xor eax, eax
jmp 0x5677ff
sbb eax, eax
or eax, 1
or edi, 0xffffffff
test eax, eax
jne 0x567906
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARECanonIJ_Scan_Utility
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 0x10], 0
jne 0x56783c
xor bl, bl
jmp 0x567908
test bl, bl
jne 0x5678d5
call fcn.00414e1f
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x567860
push 0x80004005
call fcn.00402740
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
mov edx, str.TempDir
push eax
call fcn.0058b690
add esp, 4
test eax, eax
je 0x5678b5
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00403bd0
add esp, 8
test al, al
je 0x5678b5
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0
call fcn.00402b60
jmp 0x567906
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5678d5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 1
push 0
push str.TempDir
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], 0
mov bl, 1
add esi, 0xfffffff0
mov byte [ebp - 4], 0
mov ecx, edi
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x567925
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x567946
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x569990
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x616040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWARECanonIJ_Scan_Utility
push SysReAllocString
mov dword [ebp - 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
movzx eax, ax
push eax
push str._04x
lea eax, [ebp - 0x24]
push 0x10
push eax
call fcn.00529ebd
lea eax, [ebp - 0x24]
push 0x10
push eax
call fcn.00528e42
add esp, 0x18
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x24]
push eax
push 1
push 0
push esi
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00527e2c
mov esp, ebp
pop ebp
ret

Function at 0x569a50
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b0944
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0xd], dl
mov ebx, ecx
push 0x20001
mov edx, 0x1e240
lea ecx, [ebp - 0x1c]
call fcn.0058f590
add esp, 4
mov esi, dword [ebp - 0x1c]
mov edi, 0x5e9af0
mov eax, esi
lea esp, [esp]
mov cx, word [eax]
cmp cx, word [edi]
jne 0x569ac6
test cx, cx
je 0x569ac2
mov cx, word [eax + 2]
cmp cx, word [edi + 2]
jne 0x569ac6
add eax, 4
add edi, 4
test cx, cx
jne 0x569aa0
xor eax, eax
jmp 0x569acb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x569b64
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARECanonIJ_Scan_Utility
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x569b03
xor bl, bl
jmp 0x569b66
cmp byte [ebp - 0xd], 0
jne 0x569b3b
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 4
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push ecx
push 0
push 0
push str.OCRLang
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x569b38
cmp ebx, dword [ebp - 0x18]
je 0x569b54
mov eax, dword [ebp - 0x14]
push 4
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push ecx
push 4
push 0
push str.OCRLang
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], 0
mov bl, 1
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x569b87
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5799f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1675
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0
mov dword [edi + 0x88], ebx
call fcn.004174cb
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
movzx eax, ax
push eax
call fcn.004176e1
call fcn.00416adc
mov eax, dword [eax + 4]
cmp word [eax + 0xd4], 0
jbe 0x579adc
call fcn.00414e1f
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x579a75
push 0x80004005
call fcn.00402740
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 8], 0
push eax
lea ecx, [ebp - 0x18]
call fcn.0041751a
call fcn.00416adc
lea ecx, [ebp - 0x18]
mov eax, dword [eax + 4]
movzx eax, word [eax + 0xd4]
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call fcn.00417749
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x579adc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp word [esi], 1
jne 0x579b10
mov eax, 0xffff
cmp word [esi + 2], ax
jne 0x579b10
mov ecx, dword [edi + 0x88]
test ecx, ecx
je 0x579b10
cmp dword [ecx + 0x20], 0
je 0x579b10
call fcn.00414821
or dword [esi + 8], eax
push 0
push ebx
push esi
mov ecx, edi
call fcn.00419bdc
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00417506
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x57cb10
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b19d6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x18]
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [esi + 0x18]
push eax
call fcn.0040a670
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
sub eax, 0x10
push eax
call fcn.00403660
add esp, 4
add eax, 0x10
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x585b90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b20c7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x616040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.00414e1f
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x585be8
push 0x80004005
call fcn.00402740
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [ebp - 0x10], 1
call fcn.00403500
test edi, edi
je 0x585c35
push esi
mov edx, 0x5e9af0
mov ecx, edi
call fcn.0058b690
mov eax, dword [esi]
add esp, 4
cmp dword [eax - 0xc], 0
je 0x585c35
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x585c35
mov ecx, esi
call fcn.00403500
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x585ef0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2139
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x616040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2d4], edx
mov ebx, ecx
push dword [ebx]
mov dword [ebp - 0x2cc], 0
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.00402f60
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c8]
mov esi, dword [eax - 0xc]
test esi, esi
jns 0x585f62
push 0x80070057
call fcn.00402740
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x585f85
push esi
lea ecx, [ebp - 0x2c8]
call fcn.00402c20
mov eax, dword [ebp - 0x2c8]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.005299a2
mov eax, dword [ebp - 0x2c8]
add esp, 8
cmp esi, dword [eax - 8]
jg 0x585f58
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x2c8]
mov word [eax + esi*2], cx
mov ecx, 0x5ed77c
mov eax, dword [ebp - 0x2c8]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x585fdd
test dx, dx
je 0x585fd9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x585fdd
add eax, 4
add ecx, 4
test dx, dx
jne 0x585fb7
xor eax, eax
jmp 0x585fe2
sbb eax, eax
or eax, 1
test eax, eax
jne 0x585ff5
push eax
push dword [ebx]
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconW]
jmp 0x5860de
push 0x2b4
lea eax, [ebp - 0x2c4]
push 0
push eax
call fcn.0052d120
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp - 0x2c4]
add esp, 0xc
push 0x4000
push 0x2b4
push eax
push 0
push dword [ebx]
call edi
test eax, eax
je 0x586091
cmp dword [ebp - 0x2d4], 2
mov eax, 1
mov dword [ebp - 0x2d0], 0
jne 0x586049
mov eax, 2
lea ecx, [ebp - 0x2d0]
push ecx
push 0x5edab0
push eax
call dword [sym.imp.SHELL32.dll_SHGetImageList]
test eax, eax
jne 0x58607b
mov eax, dword [ebp - 0x2d0]
lea edx, [ebp - 0x2cc]
push edx
push 1
push dword [ebp - 0x2c0]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x2d0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebp - 0x2d0], 0
mov esi, dword [ebp - 0x2cc]
test esi, esi
jne 0x5860e6
push 0x100
push 0x2b4
lea eax, [ebp - 0x2c4]
push eax
push esi
push dword [ebx]
call edi
mov esi, dword [ebp - 0x2c4]
test esi, esi
je 0x5860c3
mov dword [ebp - 0x2cc], esi
jmp 0x5860c9
mov esi, dword [ebp - 0x2cc]
test esi, esi
jne 0x5860e6
call fcn.00416adc
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconW]
mov esi, eax
mov dword [ebp - 0x2cc], esi
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edi, dword [ebp - 0x2c8]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x58610d
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527e2c
mov esp, ebp
pop ebp
ret