joyce8/EMBER2024-capa huggingface dataset:
Function at 0x504b08
Capabilities:
Create thread

Disassembly:
push ebx
push edi
push dword [0x6975bc]
xor edi, edi
call fcn.00522729
mov ebx, eax
cmp dword [esp + 0xc], edi
je 0x504bbd
push ebp
push esi
push 0x60
push 8
push dword [0x694170]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [esp + 0x14]
mov esi, eax
xor ebp, ebp
inc ebp
or dword [esi + 4], 0xffffffff
mov dword [esi], ebp
call fcn.005f614d
push dword [esp + 0x20]
mov dword [esi + 8], eax
call fcn.005f614d
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x40], eax
mov dword [esi + 0x24], ecx
mov eax, dword [ebx]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x58], ebp
test cl, 1
je 0x504bab
lea eax, [esp + 0x14]
push eax
push edi
push esi
push 0x504d45
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x504b99
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x504b9f
cmp dword [esp + 0x14], edi
je 0x504ba3
mov edi, esi
jmp 0x504bbb
push esi
call fcn.00504dfd
jmp 0x504bba
push esi
call fcn.00504bc4
push esi
mov edi, eax
call fcn.00504dfd
pop ecx
pop ecx
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
ret 0xc

Function at 0x504f3b
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push 0x504e8e
push 0x10
push 0x2c
call fcn.0052296d
push 0
push 0
push 8
mov dword [0x6959dc], eax
call fcn.00522794
cmp word [0x6959d4], 0
mov dword [0x6975c4], eax
jne 0x50501b
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
neg eax
push str.ws2_32.dll
sbb eax, eax
inc eax
mov word [0x6959d4], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x6959e0], eax
test eax, eax
je 0x50501b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x634e80
push eax
call esi
push 0x634e8c
push dword [0x6959e0]
mov dword [0x6959c4], eax
call esi
push str.getnameinfo
push dword [0x6959e0]
mov dword [0x6959c8], eax
call esi
push str.WSAStringToAddressA
push dword [0x6959e0]
mov dword [0x6959cc], eax
call esi
cmp dword [0x6959c4], 0
mov ecx, eax
mov dword [0x6959d0], ecx
pop esi
je 0x50501b
cmp dword [0x6959c8], 0
je 0x50501b
cmp dword [0x6959cc], 0
je 0x50501b
mov eax, dword [0x6959d8]
xor edx, edx
inc edx
test ecx, ecx
cmovne eax, edx
mov dword [0x6959d8], eax
add esp, 0x190
ret

Function at 0x5050e3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push esi
push edi
push 1
call ebx
movzx esi, ax
push 2
shr esi, 0xf
call ebx
mov edi, esi
or edi, 2
bt ax, 0xf
push 4
cmovae edi, esi
call ebx
mov cx, ax
mov eax, edi
or eax, 4
bt cx, 0xf
cmovae eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5056a0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x18]
push eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x30]
test esi, esi
jne 0x5056d8
push dword [edi]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov dword [esp + 0x10], 1
push dword [edi]
push esi
call fcn.0050c96d
test byte [edi + 0x14], 8
mov dword [esp + 0x14], eax
je 0x5057c9
call dword [sym.imp.USER32.dll_GetFocus]
cmp dword [edi], eax
jne 0x5057c9
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
sub ebp, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
test eax, eax
jle 0x5057f7
test ebp, ebp
jle 0x5057f7
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
test ebx, ebx
je 0x5057f7
push ebp
push dword [esp + 0x30]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x30], eax
test eax, eax
je 0x5057c0
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [edi + 0x10], 0
je 0x50576a
push 4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi + 0x10]
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x50577f
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push 2
pop eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
sub dword [esp + 0x20], eax
sub dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0xcc0020
xor eax, eax
push eax
push eax
push ebx
push ebp
push dword [esp + 0x40]
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [esp + 0x30]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x5057f7
cmp dword [edi + 0x10], ebx
je 0x5057e3
push 4
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi + 0x10]
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x5057f7
push ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
push dword [esp + 0x14]
push esi
call fcn.0050c94b
cmp dword [esp + 0x10], 0
je 0x505811
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x505819
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetMessagePos]
mov edi, dword [esp + 0x20]
mov esi, eax
push 0xfffffffffffffff4
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [edi]
mov dword [esp + 0x14], eax
call fcn.0050cb3f
push eax
call fcn.0050e3a7
push dword [0x6959ec]
mov dword [esp + 0x24], eax
call fcn.00522a43
mov ebp, eax
movsx ecx, si
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
push dword [edi]
shr esi, 0x10
movsx ecx, si
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
movzx esi, ax
push 0x12
shr esi, 0xf
call edi
mov ebx, esi
or ebx, 2
bt ax, 0xf
push 0x11
cmovae ebx, esi
call edi
mov ecx, 0x8000
and ax, cx
movzx esi, ax
mov eax, dword [esp + 0x14]
mov dword [ebp], eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 4], eax
call fcn.005050e3
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x28]
mov dword [ebp + 0xc], eax
mov eax, ebx
push 0x505904
push ebp
push dword [esp + 0x2c]
or eax, 4
test si, si
push dword [esp + 0x2c]
cmove eax, ebx
push dword [esp + 0x20]
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [ebp + 0x14], eax
movzx eax, word [esp + 0x44]
push 0x332c
mov dword [ebp + 0x18], eax
call fcn.00511dff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x50635b
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x6975cc]
call fcn.0052289b
mov ebx, eax
test ebx, ebx
je 0x5063bf
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x506384
push dword [esp + 0xc]
push ebx
call eax
jmp 0x5063bf
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.005236b0
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call fcn.004cc103
pop ecx
sub edi, eax
push edi
call fcn.00523740
pop edi
pop esi
pop ebx
ret 8
Function at 0x50a479
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push dword [0x6975d4]
call fcn.00522729
xor ebx, ebx
mov ebp, eax
cmp dword [0x6961c0], ebx
jne 0x50a50d
mov esi, 0xa8
push esi
push ebx
push 0x696118
call fcn.004d6ec0
add esp, 0xc
mov dword [0x69611c], esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0x696118], 0xa
mov dword [0x696120], 0x50a007
push 0x7f89
push ebx
mov dword [0x696190], 0x50cddd
mov dword [0x696194], 0x50cdb7
mov dword [0x696124], 0x50a026
mov dword [0x6961a8], 0x50a046
call esi
mov dword [0x6961c0], eax
test eax, eax
jne 0x50a50d
push 0x7f00
push ebx
call esi
mov dword [0x6961c0], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00512bf2
push ebx
push dword [0x69416c]
push 0xffffffffffffffff
push dword [ebp]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push 0x40000000
push dword [esp + 0x48]
push str.STATIC
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x50a5d9
push edi
push dword [esp + 0x14]
push dword [0x6975cc]
call fcn.005228d9
mov edi, eax
push 8
or dword [edi + 0x10], 0xffffffff
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
push 0
mov dword [edi + 0x14], eax
push dword [0x694170]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov esi, eax
push 0x696118
push ebx
push edi
push dword [esp + 0x20]
mov dword [esi], ecx
mov ecx, dword [esp + 0x40]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xc], ecx
mov byte [esi + 0x10], 0
mov dword [edi + 0x1c], esi
call fcn.0050cb6e
push 0x50a12c
push 0xfffffffffffffffc
push dword [edi]
mov ebx, eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 0x20

Function at 0x50b952
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push 0
push 0
push 0x1304
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x50b9c4
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, ebp
and ecx, dword [esp + 0x14]
push esi
push edi
push dword [ebx]
cmp ecx, 0xffffffff
cmove ebp, eax
call fcn.0050b0c3
push ebp
push dword [ebx]
mov edi, eax
call fcn.0050b09c
add esp, 0xc
mov esi, eax
push 0
push ebp
push 0x130c
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [ebx]
call fcn.0050b9e4
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x50bf0a
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
xor edi, edi
push edi
push edi
push 0x147
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
or eax, 0xffffffff
cmp ebx, eax
je 0x50bf99
push 0xfffffffffffffff0
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 1
jne 0x50bf99
push esi
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push edi
push dword [0x694170]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
lea ecx, [esi + 1]
push ecx
xor eax, eax
push edi
mov word [edi], ax
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push edi
or esi, 0xffffffff
push esi
push 0x158
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
push dword [0x694170]
cmp eax, esi
cmove ebx, esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
mov eax, ebx
pop ebp
cdq
pop ebx
ret 4

Function at 0x50dc3a
Capabilities:
Check os version

Disassembly:
sub esp, 0x34c
push ebp
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
mov esi, 0xc8
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x50dda3
mov eax, dword [esp + 0x1c]
sub eax, 1
je 0x50dd86
sub eax, 1
jne 0x50dda3
lea eax, [esp + 0x120]
xor edi, edi
push eax
call fcn.0050dbf3
pop ecx
test eax, eax
je 0x50dcb1
cmp byte [esp + 0x23a], 1
mov ecx, dword [esp + 0x124]
mov eax, dword [esp + 0x128]
mov ebp, dword [esp + 0x12c]
jne 0x50dce7
inc edi
jmp 0x50dce7
lea eax, [esp + 0x23c]
mov dword [esp + 0x23c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x50dda3
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x14]
inc edx
cmp byte [esp + 0x356], dl
cmove edi, edx
sub ecx, 3
je 0x50dd82
sub ecx, 1
je 0x50dd7e
sub ecx, 1
je 0x50dd60
sub ecx, 1
je 0x50dd24
sub ecx, 4
jne 0x50dda3
test eax, eax
jne 0x50dda3
cmp ebp, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x50dda3
sub eax, 0
je 0x50dd53
sub eax, 1
je 0x50dd46
sub eax, 1
je 0x50dd3f
sub eax, 1
jne 0x50dda3
push 0x69
pop esi
push 0x64
jmp 0x50dd58
push 0x5a
pop esi
push 0x5f
jmp 0x50dd4b
push 0x50
pop esi
push 0x55
test edi, edi
pop eax
cmove esi, eax
jmp 0x50dda3
push 0x4b
pop esi
push 0x46
test edi, edi
pop eax
cmovne esi, eax
jmp 0x50dda3
sub eax, 0
je 0x50dd7a
sub eax, 1
je 0x50dd76
sub eax, 1
jne 0x50dda3
push 0x41
pop esi
push 0x3c
jmp 0x50dd58
push 0x3c
jmp 0x50dda2
push 0x32
jmp 0x50dda2
push 0x14
jmp 0x50dda2
push 5
jmp 0x50dda2
mov eax, dword [esp + 0x14]
test eax, eax
je 0x50dda0
cmp eax, 0xa
je 0x50dd9c
cmp eax, 0x5a
jne 0x50dda3
push 0x28
jmp 0x50dda2
push 0x1e
jmp 0x50dda2
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x34c
ret
Function at 0x50e829
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x697600]
call fcn.0052289b
mov esi, eax
test esi, esi
je 0x50e905
cmp dword [ebp + 0xc], 0
je 0x50e875
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x50e866
cmp dword [esi + 0x1c], 0
jne 0x50e866
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x50e905
test byte [ebp + 0x10], 3
push ebx
push 4
pop ebx
je 0x50e893
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.0050f357
cmp dword [esi + 0x3c], 0xffffffff
je 0x50e8b7
xor eax, eax
cmp dword [esi + 0x3c], 0x1000000
sete al
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x50e8cf
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
mov eax, dword [ebp + 8]
test dword [ebp + 0x10], 0x2000000
je 0x50e8ea
test eax, eax
je 0x50e8e0
push 8
jmp 0x50e8f0
push 7
test ecx, ecx
pop eax
cmovne ebx, eax
jmp 0x50e8fb
test eax, eax
je 0x50e8f3
push 3
pop ebx
jmp 0x50e8fb
xor ebx, ebx
test ecx, ecx
setne bl
inc ebx
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x50f5c6
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x50f65c
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x50f659
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x50f659
lea eax, [esi - 1]
push eax
push dword [0x697600]
call fcn.0052289b
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x50f65b
mov ecx, dword [edi + 4]
add ecx, 4
pop esi
cmp word [ecx - 2], si
jne 0x50f649
mov edx, 0xfa01
cmp word [ecx], dx
je 0x50f654
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x50f639
jmp 0x50f659
and dword [esp + 0x10], 0
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x50f702
push eax
call esi
test al, al
jns 0x50f702
push 0x11
call esi
test al, al
js 0x50f702
push 0x10
call esi
test al, al
js 0x50f702
push 0x12
call esi
test al, al
js 0x50f702
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x50f702
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call fcn.004cd807
add esp, 0xc
test eax, eax
je 0x50f6d6
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call fcn.004cd807
add esp, 0xc
test eax, eax
jne 0x50f6ed
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x50f743
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call fcn.005f7594
pop ecx
pop ecx
test eax, eax
je 0x50f743
test ebp, ebp
je 0x50f726
push 0x11
call esi
test al, al
js 0x50f71e
push 0x10
call esi
test al, al
js 0x50f71e
push 0x12
call esi
test al, al
jns 0x50f726
push 1
push ebp
call fcn.0050f74f
test ebx, ebx
je 0x50f73a
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x50f743
test edi, edi
je 0x50f743
mov eax, dword [edi + 8]
jmp 0x50f745
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x510155
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x5101cd
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.005f3f19
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.004cc103
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x5101ae
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x5101ab
cmp ecx, 0x5c
je 0x5101ab
cmp ecx, 0x2f
jne 0x5101b8
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x510198
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x5101cf
xor eax, eax
leave
ret 4
Function at 0x510245
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebx
mov ebx, eax
mov eax, dword [0x6965fc]
push esi
push edi
test eax, eax
jne 0x51026b
push 0x510374
push 0x10
push 0x258
call fcn.0052296d
mov dword [0x6965fc], eax
mov edi, dword [esp + 0x10]
push edi
push eax
call fcn.005228d9
mov esi, eax
test esi, esi
je 0x51036c
cmp dword [esp + 0x14], ebx
mov eax, 0x61e260
push ebp
cmovne eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
test ebp, ebp
je 0x5102a3
xor ecx, ecx
cmp word [ebp], cx
jne 0x5102ac
mov ebp, 0x6354d4
mov dword [esp + 0x1c], ebp
push eax
call fcn.004cc103
push ebp
mov dword [esp + 0x20], eax
call fcn.004cc103
add eax, dword [esp + 0x20]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x694170]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x510359
push dword [esp + 0x14]
push ebp
call fcn.005f3ec6
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x51030c
mov eax, dword [esp + 0x14]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x51030c
push 0x61b390
push ebp
call fcn.005f3ee8
pop ecx
pop ecx
push dword [esp + 0x1c]
push ebp
call fcn.005f3ee8
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x510331
xor ecx, ecx
mov dword [esi + 4], ecx
jmp 0x510345
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
jne 0x510347
mov dword [esi + 4], 1
mov ebx, esi
push ebp
push ecx
push dword [0x694170]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x51036b
cmp edi, 0xffffffff
cmove edi, esi
push edi
push dword [0x6965fc]
call fcn.0052284c
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
ret 0xc

Function at 0x5104c9
Capabilities:
Copy file

Disassembly:
cmp dword [esp + 4], 0
je 0x5104e9
cmp dword [esp + 8], 0
je 0x5104e9
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x5104eb
xor eax, eax
ret 8

Function at 0x5104ee
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x510517
test byte [esp + 8], 2
je 0x51050b
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x510519
xor eax, eax
ret 8
Function at 0x5105b4
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x5106fc
xor ecx, ecx
cmp word [eax], cx
je 0x5106fc
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call fcn.005f3f19
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call fcn.004cc103
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x51060d
cmp eax, 3
jne 0x510647
cmp word [esp + 0xa], 0x3a
jne 0x510647
cmp eax, 2
jne 0x51062b
lea eax, [esp + 8]
push 0x61b390
push eax
call fcn.005f3ee8
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x5106fc
push 0xfffffffffffffffe
pop edi
jmp 0x5106fc
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x51065c
cmp ax, bx
jne 0x510666
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x51064f
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x5106a5
test byte [esp + 0x21c], 0x10
je 0x51068c
push 0xfffffffffffffffe
pop edi
jmp 0x51069c
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x5106fa
cmp word [esp + 0x10], bp
jne 0x5106b3
cmp word [esp + 0x12], bp
je 0x5106d2
cmp word [esp + 0x10], bx
jne 0x5106c1
cmp word [esp + 0x12], bx
je 0x5106d2
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x5106fa
cmp word [esp + 0x12], ax
jne 0x5106fa
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x5106e7
test al, 0x10
je 0x5106fa
jmp 0x5106f7
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x5106fa
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4