joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59efb0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x10
push 0
push 0
dec ecx
jne 0x59efb8
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x59f19d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call fcn.004377a8
lea eax, [ebp - 8]
mov edx, 0x59f1b8
call fcn.00407f58
lea edx, [ebp - 0x24]
mov eax, dword [0x669f08]
mov eax, dword [eax]
call fcn.00421b00
push dword [ebp - 0x24]
push 0x59f320
lea edx, [ebp - 0x28]
mov eax, dword [0x66a470]
mov eax, dword [eax]
call fcn.00421b00
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00408ea8
mov eax, dword [ebp - 0x20]
mov edx, 0x59f330
call fcn.00408f58
jbe 0x59f03b
lea eax, [ebp - 8]
mov edx, 0x59f344
call fcn.00408dc8
xor edx, edx
push ebp
push 0x59f137
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 8]
call fcn.00408cc0
mov eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x59f38c
xor eax, eax
call fcn.0059e4b0
cmp dword [ebp - 0x1c], 1
jl 0x59f111
lea eax, [ebp - 0x18]
push eax
xor eax, eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
mov cx, 0xc
mov edx, 1
call fcn.00439e0c
mov esi, dword [ebp - 0x1c]
dec esi
test esi, esi
jl 0x59f111
inc esi
xor ebx, ebx
push ebx
push 1
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 4]
mov edx, dword [edx + ebx*4]
mov edx, dword [edx + 4]
call fcn.004377a8
push esi
push edi
lea esi, [ebp - 0x74]
lea edi, [ebp - 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x84]
mov edx, dword [ebp - 4]
mov edx, dword [edx + ebx*4]
mov edx, dword [edx + 8]
call fcn.004377a8
push esi
push edi
lea esi, [ebp - 0x84]
lea edi, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x64]
lea ecx, [ebp - 0x44]
mov edx, 1
call fcn.00439ebc
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0043a1b0
add esp, 0x10
inc ebx
dec esi
jne 0x59f0a6
mov eax, edi
lea edx, [ebp - 0x18]
call fcn.0043237c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59f13e
lea eax, [ebp - 4]
mov edx, dword [0x59df3c]
call fcn.0040a1a4
ret
Function at 0x5b1634
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x5b175c
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.005b1520
mov eax, dword [esi]
call fcn.00409ecc
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41b200]
call fcn.0040a080
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.00404b3c
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.00404b3c
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00409ecc
mov dword [ebp - 0xc], eax
mov eax, dword [0x66a614]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.005a17d4
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.004053d4
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00409ecc
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.005a17b0
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.005a1334
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.005a17cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b1763
lea eax, [ebp - 4]
mov edx, dword [0x41b200]
call fcn.0040a1a4
ret
Function at 0x5f9688
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x5f96e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.005f95fc
test esi, esi
je 0x5f96ce
mov eax, dword [ebp - 4]
call fcn.00408bc4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x5f96c8
test al, 0x10
jne 0x5f96cc
xor ebx, ebx
jmp 0x5f96ce
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f96eb
lea eax, [ebp - 4]
call fcn.00407b30
ret

Function at 0x5f9c18
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 4], 5
ja 0x5f9c44
cmp dword [esp + 4], 5
jne 0x5f9c40
cmp dword [esp + 8], 1
jae 0x5f9c44
xor eax, eax
jmp 0x5f9c46
mov al, 1
add esp, 0x114
ret

Function at 0x5fa764
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, eax
mov eax, ecx
test esi, esi
je 0x5fa794
test edx, edx
jle 0x5fa794
xor eax, 0xffffffff
test edx, edx
jle 0x5fa791
mov ecx, eax
xor cl, byte [esi]
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x668498]
shr eax, 8
xor ecx, eax
mov eax, ecx
inc esi
dec edx
jne 0x5fa778
xor eax, 0xffffffff
pop esi
ret

Function at 0x5fa83c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov byte [ebp - 9], 1
cmp dword [ebp - 4], 0xffffffff
je 0x5fa97b
xor eax, eax
push ebp
push 0x5fa96d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00422390
lea edx, [ebp - 0x58]
mov ecx, 0x40
mov eax, dword [ebp - 4]
call fcn.00422338
mov ebx, eax
cmp ebx, 0x40
jne 0x5fa963
cmp word [ebp - 0x58], 0x5a4d
jne 0x5fa963
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00422390
test eax, eax
jl 0x5fa963
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 4]
call fcn.00422338
mov ebx, eax
cmp ebx, 4
jne 0x5fa963
cmp dword [ebp - 0x10], 0x4550
jne 0x5fa963
lea edx, [ebp - 0x6c]
mov ecx, 0x14
mov eax, dword [ebp - 4]
call fcn.00422338
mov ebx, eax
cmp ebx, 0x14
jne 0x5fa963
cmp word [ebp - 0x6c], 0x14c
jne 0x5fa963
movzx eax, word [ebp - 0x6a]
mov dword [ebp - 0x18], eax
mov ecx, 1
mov edx, 0xe0
mov eax, dword [ebp - 4]
call fcn.00422390
test eax, eax
jl 0x5fa963
mov byte [ebp - 9], 0
mov edi, dword [ebp - 0x18]
test edi, edi
jle 0x5fa878
lea edx, [ebp - 0x94]
mov ecx, 0x28
mov eax, dword [ebp - 4]
call fcn.00422338
mov ebx, eax
cmp ebx, 0x28
je 0x5fa94a
mov byte [ebp - 9], 1
jmp 0x5fa878
mov esi, dword [ebp - 0x80]
add esi, dword [ebp - 0x84]
cmp esi, dword [ebp - 8]
jbe 0x5fa95b
mov dword [ebp - 8], esi
dec edi
jne 0x5fa927
jmp 0x5fa878
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5fa97b
cmp byte [ebp - 9], 0
je 0x5fa986
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x600a3c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407c14
mov eax, dword [ebp - 8]
call fcn.00407c14
xor eax, eax
push ebp
push 0x600b57
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x600a84
lea eax, [ebp - 4]
mov edx, 0x600b74
call fcn.00407f58
cmp dword [ebp - 8], 0
jne 0x600a97
lea eax, [ebp - 8]
mov edx, 0x600b88
call fcn.00407f58
mov eax, dword [ebx + 0x68]
test eax, eax
je 0x600aa3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x600ad4
mov eax, dword [ebp - 0x10]
call fcn.00408bc4
push eax
push 0
call sub.kernel32.dll_GetTempPathW
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00408d48
mov eax, dword [ebp - 0x10]
call fcn.00408bc4
push eax
push ebx
call sub.kernel32.dll_GetTempPathW
jmp 0x600ae1
lea ecx, [ebp - 0x10]
mov dl, 1
mov eax, dword [ebx + 0x68]
call fcn.005f95fc
lea eax, [ebp - 0xc]
mov edx, 0x110
call fcn.00408d48
mov eax, dword [ebp - 0xc]
call fcn.00408bc4
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00408bc4
push eax
mov eax, dword [ebp - 0x10]
call fcn.00408bc4
push eax
call sub.kernel32.dll_GetTempFileNameW
test eax, eax
je 0x600b3c
mov eax, dword [ebp - 0xc]
call fcn.00408bc4
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00408c1c
mov eax, dword [ebp - 0xc]
call fcn.00422920
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00422a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x600b5e
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00407b90
ret
Function at 0x602670
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf4
mov byte [esp], dl
mov ebp, eax
mov esi, 0xff
mov dword [esp + 8], 0xff
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 0
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0
lea eax, [ebp + 4]
call fcn.00407b30
xor eax, eax
mov dword [ebp + 9], eax
mov word [esp + 0xc], 0
xor ebx, ebx
cmp word [ebp + 0xe], 0
je 0x602721
movzx eax, word [ebp + 0xe]
cmp ax, 0x41
jb 0x6026d5
cmp ax, 0x5a
jbe 0x6026ef
mov eax, dword [ebp + 0x10]
push eax
mov ecx, 0x2afb
mov dl, 1
mov eax, dword [0x5fc370]
call fcn.005fc66c
call fcn.00407228
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
movzx eax, word [ebp + 0xe]
sub eax, 0x41
cmp eax, 0x1f
ja 0x602705
bt edi, eax
jb 0x602721
mov eax, dword [ebp + 0x10]
push eax
mov ecx, 0x2afc
mov dl, 1
mov eax, dword [0x5fc370]
call fcn.005fc66c
call fcn.00407228
push 1
call sub.kernel32.dll_SetErrorMode
mov edi, eax
push 0
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [ebp + 9]
push eax
push esi
lea eax, [esp + 0x24]
push eax
mov eax, dword [ebp + 0x10]
call fcn.00408bc4
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
jne 0x602768
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x1f
jne 0x602789
cmp byte [esp], 0
je 0x602789
mov bl, 1
jmp 0x602789
lea eax, [ebp + 4]
lea edx, [esp + 0xc]
mov ecx, pe_nt_image_headers32
call fcn.00408c70
mov byte [ebp + 8], 0
mov edx, 7
mov eax, ebp
call fcn.0060293c
push edi
call sub.kernel32.dll_SetErrorMode
cmp word [ebp + 0xe], 0
je 0x6027a9
cmp word [ebp + 0xe], 0
je 0x6027ab
cmp dword [ebp + 0x2c], 0xffffffff
jne 0x6027a7
cmp dword [ebp + 0x28], 0xffffffff
je 0x6027ab
mov bl, 1
mov eax, ebx
add esp, 0x20c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x602808
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6028fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00423070
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00422bcc
lea eax, [ebp - 8]
mov edx, 0x602918
call fcn.00408dc8
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00420d10
mov eax, dword [ebp - 4]
mov edx, dword [ebx + 0x18]
call fcn.00408fb8
je 0x6028e3
mov eax, ebx
call fcn.00602604
mov eax, dword [ebp - 4]
test eax, eax
je 0x602876
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jne 0x602888
mov eax, dword [ebp - 4]
cmp word [eax + 2], 0x3a
sete al
jmp 0x60288a
xor eax, eax
test al, al
je 0x6028c6
mov eax, dword [ebp - 4]
movzx eax, word [eax]
mov word [ebx + 0xe], ax
mov eax, dword [ebp - 4]
call fcn.00408bc4
push eax
call sub.kernel32.dll_GetDriveTypeW
mov esi, eax
mov dword [ebx + 0x14], esi
cmp esi, 2
jne 0x6028cd
movzx eax, word [ebx + 0xe]
cmp ax, 0x41
je 0x6028c0
cmp ax, 0x42
jne 0x6028cd
mov byte [ebx + 0xd], 1
jmp 0x6028cd
mov eax, ebx
call fcn.00602604
lea eax, [ebx + 0x18]
mov edx, dword [ebp - 4]
call fcn.00407f10
lea eax, [ebx + 0x10]
mov edx, dword [ebp - 4]
call fcn.00407f10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x602905
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407b90
ret
Function at 0x60293c
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov esi, edx
mov ebx, eax
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
xor edi, edi
lea eax, [ebx + 0x38]
push eax
lea eax, [ebx + 0x1c]
push eax
lea eax, [esp + 8]
push eax
lea eax, [ebx + 0x24]
push eax
mov eax, dword [ebx + 0x10]
call fcn.00408bc4
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
test eax, eax
je 0x60298e
mov edi, dword [esp]
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [ebx + 0x10]
call fcn.00408bc4
push eax
mov eax, dword [0x66a038]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x602a20
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
test edi, edi
je 0x602a20
mov eax, dword [ebx + 0x1c]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x24]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x10]
xor edx, edx
call fcn.00409a30
call fcn.00409a30
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [ebx + 0x38]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x24]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x10]
xor edx, edx
call fcn.00409a30
call fcn.00409a30
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
test esi, 1
je 0x602a36
mov eax, dword [esp + 8]
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0xc]
mov dword [ebx + 0x34], eax
test esi, 2
je 0x602a4c
mov eax, dword [esp + 0x10]
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x2c], eax
test esi, 4
je 0x602a57
mov dword [ebx + 0x20], edi
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x604130
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xfffffffd
mov eax, ebx
test eax, eax
je 0x604150
sub eax, 4
mov eax, dword [eax]
dec eax
jle 0x60415d
cmp word [ebx + 2], 0x3a
sete al
jmp 0x60415f
xor eax, eax
test al, al
je 0x60417d
mov eax, 0x60423c
movzx edx, word [ebx]
cmp dx, 0xff
ja 0x604178
movzx edx, dx
bt dword [eax], edx
setb al
jmp 0x60417f
xor eax, eax
test al, al
je 0x604232
mov eax, ebx
call fcn.00408bc4
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 2
jne 0x604232
movzx edx, word [ebx]
mov eax, edx
mov ecx, edx
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x6041b3
mov eax, edx
and ax, 0xffdf
movzx edi, ax
sub edi, 0x41
push 3
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0x10], eax
push 0x60425c
call sub.kernel32.dll_LoadLibraryW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x604232
push 0x60426c
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040fc74
mov esi, eax
mov ebx, esi
test esi, esi
je 0x604229
xor eax, eax
push ebp
push 0x604222
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0xffff
push edi
mov eax, dword [ebp - 4]
push eax
call ebx
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x604229
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetErrorMode
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x60574c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x6058f6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x605786
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x6057f6
mov eax, edi
test eax, eax
je 0x605795
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x6057b9
lea edx, [ebp - 8]
mov eax, edi
call fcn.00422b30
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00422d1c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.00407f58
mov eax, dword [ebp - 8]
test eax, eax
je 0x6057c5
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x605804
mov eax, dword [ebp - 8]
call fcn.00408bc4
push eax
push 0
call sub.kernel32.dll_GetTempPathW
mov edi, eax
lea eax, [ebp - 8]
mov edx, edi
call fcn.00408d48
mov eax, dword [ebp - 8]
call fcn.00408bc4
push eax
push edi
call sub.kernel32.dll_GetTempPathW
jmp 0x605804
lea eax, [ebp - 8]
mov edx, dword [esi + 0xc]
mov edx, dword [edx + 0x68]
call fcn.00407f58
lea ecx, [ebp - 0x14]
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.005f95fc
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
call fcn.00407f58
lea eax, [ebp - 4]
mov edx, 0x110
call fcn.00408d48
mov eax, dword [ebp - 4]
call fcn.00408bc4
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00408bc4
push eax
mov eax, dword [ebp - 8]
call fcn.00408bc4
push eax
call sub.kernel32.dll_GetTempFileNameW
test eax, eax
je 0x6058ce
mov eax, dword [ebp - 4]
call fcn.00408bc4
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00408c1c
mov edx, dword [ebp - 0x18]
mov eax, esi
call fcn.0060715c
mov byte [esi + 0x39], 1
mov eax, dword [esi + 0xc]
cmp byte [eax + 0x6c], 2
jb 0x605892
lea eax, [ebp - 0x1c]
mov ecx, dword [esi + 0x24]
mov edx, 0x605914
call fcn.00408e20
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.00605428
lea eax, [esi + 0x46]
mov edx, dword [esi + 0x24]
call fcn.00407f10
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x42], 1
mov edx, 1
mov eax, esi
call fcn.00605948
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6058fd
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00407b90
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407b90
ret
Function at 0x605a04
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x605b3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 0xc]
cmp byte [eax + 0x6c], 2
jb 0x605a56
push 0x605b5c
push dword [edi + 0x46]
push 0x605b88
push esi
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00408ea8
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00605428
mov byte [edi + 0x39], 0
cmp byte [edi + 0x38], 0
je 0x605a67
mov eax, edi
call fcn.00605490
mov dl, 1
mov eax, dword [edi + 0x24]
call fcn.0042242c
test al, al
je 0x605ad6
mov dl, 1
mov eax, esi
call fcn.0042242c
test al, al
je 0x605ad6
mov eax, dword [edi + 0xc]
cmp byte [eax + 0x6c], 2
jb 0x605aa4
lea eax, [ebp - 0x10]
mov ecx, esi
mov edx, 0x605ba0
call fcn.00408e20
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00605428
mov edx, ebx
xor dl, 1
mov eax, esi
call fcn.005f96f4
test eax, eax
je 0x605ad6
mov eax, dword [edi + 0xc]
cmp byte [eax + 0x6c], 2
jb 0x605ad6
lea eax, [ebp - 0x14]
mov ecx, esi
mov edx, 0x605bcc
call fcn.00408e20
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.00605428
lea eax, [ebp - 4]
mov edx, dword [edi + 0x24]
call fcn.00407f58
lea eax, [ebp - 8]
mov edx, esi
call fcn.00407f58
mov eax, dword [ebp - 8]
call fcn.00408bc4
push eax
mov eax, dword [ebp - 4]
call fcn.00408bc4
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x605b22
lea eax, [edi + 0x24]
mov edx, esi
call fcn.00407f10
lea eax, [edi + 0x46]
mov edx, esi
call fcn.00407f10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x605b44
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00407b90
ret
Function at 0x61427c
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb8
mov dword [esp], ecx
mov esi, edx
mov ebx, eax
mov byte [esp + 4], 0
xor ecx, ecx
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
lea edx, [esp + 0x10]
mov ecx, 0x40
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
cmp eax, 0x40
jne 0x6142bb
cmp word [esp + 0x10], 0x5a4d
je 0x6142d3
push 1
mov ecx, 0x2a96
mov dl, 1
mov eax, dword [0x5fc370]
call fcn.005fc574
call fcn.00407228
xor ecx, ecx
mov edx, dword [esp + 0x4c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
lea edx, [esp + 0x50]
mov ecx, 0xf8
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
cmp eax, 0xf8
jne 0x614301
cmp dword [esp + 0x50], 0x4550
je 0x614319
push 1
mov ecx, 0x2a96
mov dl, 1
mov eax, dword [0x5fc370]
call fcn.005fc574
call fcn.00407228
mov eax, dword [esp + 0xd8]
test eax, eax
je 0x61432e
cmp dword [esp + 0xdc], 0
jne 0x614348
push 1
mov ecx, 0x2a9b
mov dl, 1
mov eax, dword [0x5fc370]
call fcn.005fc574
call fcn.00407228
jmp 0x61434c
mov dword [esp + 8], eax
movzx edi, word [esp + 0x56]
dec edi
test edi, edi
jl 0x614395
inc edi
mov edx, esi
mov ecx, 0x28
mov eax, ebx
mov ebp, dword [eax]
call dword [ebp + 0xc]
cmp eax, 0x28
je 0x614382
push 1
mov ecx, 0x2a9c
mov dl, 1
mov eax, dword [0x5fc370]
call fcn.005fc574
call fcn.00407228
mov eax, dword [esi + 0xc]
cmp eax, dword [esp + 8]
jne 0x614392
mov byte [esp + 4], 1
jmp 0x614395
dec edi
jne 0x614357
cmp byte [esp + 4], 0
jne 0x6143b4
push 1
mov ecx, 0x2a9b
mov dl, 1
mov eax, dword [0x5fc370]
call fcn.005fc574
call fcn.00407228
mov edx, dword [esi + 0x14]
xor ecx, ecx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
push ebx
mov ecx, dword [esi + 0x14]
mov eax, dword [esp + 4]
xor edx, edx
call fcn.006140ec
test al, al
jne 0x6143eb
push 1
mov ecx, 0x2a9d
mov dl, 1
mov eax, dword [0x5fc370]
call fcn.005fc574
call fcn.00407228
add esp, 0x148
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x617ca4
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov byte [esp], 0
test edi, edi
je 0x617d46
mov eax, edi
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x617ccb
cmp eax, 0x2ee0
jbe 0x617d46
jmp 0x617ccd
jle 0x617d46
xor esi, esi
mov eax, dword [edi + 4]
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x617d46
mov edx, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x617d46
add eax, 4
movzx edx, word [eax + 2]
add eax, 0xf4
mov ebp, edx
test ebp, ebp
jle 0x617d0e
mov edx, eax
mov ecx, dword [edx + 0x14]
add ecx, dword [edx + 0x10]
cmp esi, ecx
jae 0x617d08
mov esi, ecx
add eax, 0x28
dec ebp
jne 0x617cfa
mov eax, dword [edi + 4]
add eax, esi
mov edx, eax
cmp dword [edx], 0xc005a44
jne 0x617d46
movzx ecx, word [edx + 4]
movzx ebx, cx
add esi, ebx
movzx edx, cx
add eax, edx
mov edx, eax
cmp dword [edx], 0x2014b50
jne 0x617d46
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, edi
call fcn.004525e0
mov byte [esp], 1
movzx eax, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x617d50
Capabilities:
Parse pe header

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff8
mov edi, edx
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x617e0b
mov eax, edi
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x617d81
cmp eax, 0x2ee0
jbe 0x617e0b
jmp 0x617d87
jle 0x617e0b
xor esi, esi
mov eax, dword [edi + 4]
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x617e0b
mov dword [esp + 4], 0xffffd4ce
mov edx, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x617e0b
add eax, 4
movzx edx, word [eax + 2]
add eax, 0xf4
mov ecx, edx
test ecx, ecx
jle 0x617dd0
mov edx, eax
mov ebp, dword [edx + 0x14]
add ebp, dword [edx + 0x10]
cmp esi, ebp
jae 0x617dca
mov esi, ebp
add eax, 0x28
dec ecx
jne 0x617dbc
mov eax, dword [edi + 4]
add eax, esi
mov edx, eax
mov ecx, dword [edx]
cmp ecx, 0xc005a44
jne 0x617df3
mov ecx, edi
mov edx, eax
mov eax, dword [esp]
call fcn.00618274
mov dword [esp + 4], eax
jmp 0x617e0b
cmp ecx, 0x1005a44
jne 0x617e0b
mov ecx, edi
mov edx, eax
mov eax, dword [esp]
call fcn.00617efc
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
pop ecx
pop edx
pop ebp
pop edi
pop esi
ret