joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401788
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x412284]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp word [eax], 0x22
je 0x4017a5
push 0x20
jmp 0x4017aa
push 0x22
add eax, 4
pop ecx
push ecx
push eax
call fcn.00401be9
pop ecx
pop ecx
test eax, eax
jne 0x4017c4
mov dword [ebp - 0x72c], 0x410b14
jmp 0x4017e8
lea esi, [eax + 2]
jmp 0x4017da
push 8
push eax
call fcn.0040278b
pop ecx
pop ecx
test eax, eax
je 0x4017e2
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x4017c9
mov dword [ebp - 0x72c], esi
mov edi, 0x104
push edi
mov esi, 0x413b60
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [0x413b60], 0x22
je 0x40180e
mov dword [ebp - 0x724], esi
jmp 0x40181b
mov dword [ebp - 0x724], 0x413b62
sub eax, 2
mov edx, dword [ebp - 0x724]
xor ecx, ecx
lea ebx, [ebp - 0x720]
mov word [edx + eax*2], cx
mov byte [0x412ec0], 0x50
call fcn.00401116
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
push str.Failed_to_find_shebang
push eax
invalid
invalid
clc
invalid

Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x75a5cda4
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
pop ebp
ret 4
Function at 0x75a5db53
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret 4
Function at 0x555032
Capabilities:
Get common file path

Disassembly:
push 0x25c
mov eax, 0x6b03b8
call fcn.0066d8f7
mov esi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x218]
push eax
xor edi, edi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x55506a
lea eax, [ebp - 0x218]
push eax
call fcn.005b9bd7
mov edi, eax
lea ecx, [ebp - 0x240]
call fcn.005761e7
and dword [ebp - 4], 0
lea eax, [ebp - 0x240]
push eax
push esi
call fcn.0055459b
lea ecx, [ebp - 0x240]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call fcn.005b9bd7
mov esi, eax
shl edi, 0x10
push 0x411720
lea ecx, [ebp - 0x268]
add esi, edi
call fcn.0057706c
push esi
push eax
mov byte [ebp - 4], 1
call fcn.005b9bd7
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0
call fcn.00576231
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00576231
call fcn.0066d97a
ret 4
Function at 0x577126
Capabilities:
Query environment variable

Disassembly:
push 0x234
mov eax, 0x6b5ce1
call fcn.0066d88e
mov edi, ecx
lea ecx, [ebp - 0x28]
call fcn.0056ab15
and dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x28]
call fcn.005b9bd7
mov ecx, eax
call fcn.005b9bd7
lea ecx, [ebp - 0x28]
call fcn.005b9bd7
mov esi, dword [eax + 0xc]
lea ecx, [ebp - 0x28]
call fcn.005b9bd7
mov eax, dword [eax + 8]
push esi
mov esi, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
push eax
push dword [edi + 8]
call esi
lea ecx, [ebp - 0x28]
mov ebx, eax
call fcn.005b9bd7
cmp ebx, dword [eax + 0xc]
jbe 0x5771b8
push ebx
lea ecx, [ebp - 0x28]
call fcn.005b9bd7
mov ecx, eax
call fcn.005b9bd7
lea ecx, [ebp - 0x28]
call fcn.005b9bd7
mov ebx, dword [eax + 0xc]
lea ecx, [ebp - 0x28]
call fcn.005b9bd7
mov eax, dword [eax + 8]
push ebx
push eax
push dword [edi + 8]
call esi
mov ebx, eax
test ebx, ebx
jne 0x5771f5
push 0x41c8d8
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.005b9bd7
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x134]
lea edi, [ebp - 0x134]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.005b9bd7
lea ecx, [ebp - 0x28]
call fcn.005b9bd7
push eax
mov ecx, edi
call fcn.005b9bd7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00520932
call fcn.0066d966
ret
Function at 0x579c59
Capabilities:
Set registry value

Disassembly:
push 0x270
mov eax, 0x6b6336
call fcn.0066d88e
mov esi, ecx
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x3c]
call fcn.005761e7
mov edi, dword [ebp + 0xc]
and dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0x3c]
call fcn.005b9bd7
lea ecx, [ebp - 0x3c]
call fcn.00577126
push edi
lea ecx, [ebp - 0x3c]
call fcn.005b9bd7
mov bl, al
neg bl
sbb bl, bl
inc bl
cmp dword [esi + 0x30], 0
jne 0x579ce8
test bl, bl
mov eax, 0x41cff8
jne 0x579cb3
mov eax, 0x41cff0
push eax
push 0x41d490
lea eax, [ebp - 0x27c]
push 0x3a
push eax
call fcn.005b9bd7
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x170]
lea edi, [ebp - 0x170]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.005b9bd7
mov ecx, dword [ebp + 8]
call fcn.00576060
cmp eax, 0x3fff
jbe 0x579d31
test bl, bl
mov edi, 0x41cff8
jne 0x579d05
mov edi, 0x41cff0
lea ecx, [esi + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
mov eax, dword [esi + 0x34]
push dword [eax*4 + 0x6e5594]
lea eax, [ebp - 0x27c]
push edi
push 0x41d420
push 0x1d
push eax
call fcn.005b9bd7
add esp, 0x18
jmp 0x579cca
mov ecx, edi
call fcn.00576275
test al, al
je 0x579d59
push 0x4183c8
lea ecx, [ebp - 0x64]
call fcn.0057706c
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], 1
jmp 0x579d5c
mov dword [ebp - 0x10], edi
mov ecx, edi
call fcn.00576060
mov ecx, dword [ebp - 0x10]
lea eax, [eax + eax + 2]
push eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov ecx, dword [ebp + 8]
push eax
xor eax, eax
test bl, bl
setne al
inc eax
push eax
push 0
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push dword [esi + 0x30]
call dword [sym.imp.advapi32.dll_RegSetValueExW]
and dword [ebp - 4], 0
test byte [ebp - 0x14], 1
mov edi, eax
je 0x579da2
lea ecx, [ebp - 0x64]
call fcn.00576231
test edi, edi
jle 0x579db4
and edi, 0xffff
or edi, 0x80070000
test edi, edi
jge 0x579e04
test bl, bl
mov ebx, 0x41cff8
jne 0x579dc4
mov ebx, 0x41cff0
lea ecx, [esi + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov ecx, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x34]
push dword [eax*4 + 0x6e5594]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov ecx, dword [ebp + 8]
push eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push ebx
push 0x41d3b8
lea eax, [ebp - 0x27c]
push edi
push eax
call fcn.005b9bd7
add esp, 0x20
jmp 0x579cca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00576231
call fcn.0066d966
ret 8
Function at 0x57ac78
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x464
mov eax, 0x6b651d
call fcn.0066d88e
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x30], ebx
jne 0x57acc4
push 0x41dbb8
lea eax, [ebp - 0x364]
push 0x3a
push eax
call fcn.005b9bd7
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
lea edi, [ebp - 0x258]
rep movsd dword es:[edi], dword [esi]
push 0x6c2560
lea eax, [ebp - 0x258]
push eax
call fcn.005b9bd7
call fcn.005799a2
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ebx
call fcn.005761e7
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.005b9bd7
cmp dword [ebp - 0x10], ebx
je 0x57ad3e
mov edi, 0x100
dec dword [ebp - 0x10]
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], edi
call fcn.005b9bd7
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x40]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push dword [ebp - 0x10]
push dword [esi + 0x30]
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
cmp eax, ebx
jle 0x57ad26
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x57ad52
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
call fcn.005b9bd7
cmp dword [ebp - 0x10], ebx
jne 0x57acec
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00576231
call fcn.0066d966
ret 4
lea ecx, [esi + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
mov eax, dword [esi + 0x34]
push dword [eax*4 + 0x6e5594]
lea eax, [ebp - 0x470]
push 0x41db60
push dword [ebp - 0x14]
push eax
call fcn.005b9bd7
add esp, 0x14
push 0x43
pop ecx
mov esi, eax
lea edi, [ebp - 0x14c]
rep movsd dword es:[edi], dword [esi]
push 0x6c2560
lea eax, [ebp - 0x14c]
jmp 0x57acbe
Function at 0x57ad99
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x464
mov eax, 0x6b6543
call fcn.0066d88e
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x30], ebx
jne 0x57ade5
push 0x41dc78
lea eax, [ebp - 0x364]
push 0x3a
push eax
call fcn.005b9bd7
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
lea edi, [ebp - 0x258]
rep movsd dword es:[edi], dword [esi]
push 0x6c2560
lea eax, [ebp - 0x258]
push eax
call fcn.005b9bd7
call fcn.00579a4b
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ebx
call fcn.005761e7
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.005b9bd7
cmp dword [ebp - 0x10], ebx
je 0x57ae5f
mov edi, 0x4000
dec dword [ebp - 0x10]
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], edi
call fcn.005b9bd7
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x40]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push dword [ebp - 0x10]
push dword [esi + 0x30]
call dword [sym.imp.advapi32.dll_RegEnumValueW]
cmp eax, ebx
jle 0x57ae47
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x57ae73
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
call fcn.005b9bd7
cmp dword [ebp - 0x10], ebx
jne 0x57ae0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00576231
call fcn.0066d966
ret 4
lea ecx, [esi + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
mov eax, dword [esi + 0x34]
push dword [eax*4 + 0x6e5594]
lea eax, [ebp - 0x470]
push 0x41dc20
push dword [ebp - 0x14]
push eax
call fcn.005b9bd7
add esp, 0x14
push 0x43
pop ecx
mov esi, eax
lea edi, [ebp - 0x14c]
rep movsd dword es:[edi], dword [esi]
push 0x6c2560
lea eax, [ebp - 0x14c]
jmp 0x57addf
Function at 0x57aeba
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x490
mov eax, 0x6b6571
call fcn.0066d88e
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x30], ebx
jne 0x57af06
push 0x41dce0
lea eax, [ebp - 0x390]
push 0x3a
push eax
call fcn.005b9bd7
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
lea edi, [ebp - 0x178]
rep movsd dword es:[edi], dword [esi]
push 0x6c2560
lea eax, [ebp - 0x178]
push eax
call fcn.005b9bd7
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x10], 1
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
push eax
push dword [esi + 0x30]
call edi
cmp eax, ebx
jle 0x57af40
and eax, 0xffff
or eax, 0x80070000
cmp eax, 0x80070002
mov dword [ebp - 0x14], eax
je 0x57b071
cmp dword [ebp - 0x18], 7
jne 0x57b071
cmp eax, ebx
jge 0x57af8a
mov ecx, dword [ebp + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
lea ecx, [esi + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x41d4f0
push dword [ebp - 0x14]
lea eax, [ebp - 0x390]
push eax
call fcn.005b9bd7
add esp, 0x14
jmp 0x57aee8
mov eax, dword [ebp - 0x10]
inc eax
inc eax
mov dword [ebp - 0x10], eax
shr eax, 1
push eax
lea ecx, [ebp - 0x6c]
call fcn.0057984b
lea eax, [ebp - 0x10]
push eax
push ebx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], ebx
call fcn.005b9bd7
mov ecx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push dword [esi + 0x30]
call edi
cmp eax, ebx
jle 0x57afcf
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jge 0x57b019
mov ecx, dword [ebp + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
lea ecx, [esi + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x41d4f0
lea eax, [ebp - 0x49c]
push edi
push eax
call fcn.005b9bd7
add esp, 0x14
push 0x43
pop ecx
mov esi, eax
lea edi, [ebp - 0x284]
rep movsd dword es:[edi], dword [esi]
push 0x6c2560
lea eax, [ebp - 0x284]
jmp 0x57af00
push ebx
lea ecx, [ebp - 0x6c]
call fcn.005b9bd7
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.005761e7
mov byte [ebp - 4], 1
push esi
lea ecx, [ebp - 0x40]
call fcn.005b9bd7
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
push eax
call fcn.005b9bd7
lea ecx, [ebp - 0x40]
call fcn.00576060
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x57b030
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.00576231
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.005798ba
mov al, 1
jmp 0x57b073
xor al, al
call fcn.0066d966
ret 8
Function at 0x57cacc
Capabilities:
Get graphical window text

Disassembly:
push 0x458
mov eax, 0x6b6a0e
call fcn.0066d88e
push 0x40322c
lea ecx, [ebp - 0x34]
call fcn.0057706c
mov esi, dword [ebp + 0xc]
and dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.005b9bd7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00576231
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jne 0x57cb53
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
je 0x57cbaf
push edi
push 0x41e4c0
push eax
lea eax, [ebp - 0x358]
push eax
call fcn.005b9bd7
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
lea edi, [ebp - 0x24c]
rep movsd dword es:[edi], dword [esi]
push 0x6c2560
lea eax, [ebp - 0x24c]
push eax
call fcn.005b9bd7
jle 0x57cbaf
inc eax
push eax
mov ecx, esi
call fcn.005b9bd7
mov ecx, esi
call fcn.0057605c
push eax
mov ecx, esi
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x57cbaf
push edi
push 0x41e478
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x464]
push eax
call fcn.005b9bd7
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
lea edi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
push 0x6c2560
lea eax, [ebp - 0x140]
jmp 0x57cb4d
call fcn.0066d966
ret 8
Function at 0x57d573
Capabilities:
Enumerate process modules

Disassembly:
push 0x2a0
mov eax, 0x6b6b96
call fcn.0066d8c1
mov ecx, dword [ebp + 0x10]
call fcn.00695772
mov ecx, dword [ebp + 0x14]
call fcn.0055f853
lea ecx, [ebp - 0x6c]
call fcn.0058bbc8
xor ebx, ebx
push 0x40322c
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], ebx
call fcn.0057706c
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 2
push ebx
push 0x410
call fcn.005b9bd7
mov esi, 0x400
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], 0x1000
call fcn.0057c5cb
mov byte [ebp - 4], 4
push esi
lea ecx, [ebp - 0x44]
call fcn.005b9bd7
mov esi, dword [ebp - 0x64]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x38]
shl eax, 2
push eax
push ebx
lea ecx, [ebp - 0x44]
call fcn.005b9bd7
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x57d620
mov esi, dword [ebp - 0x14]
shr esi, 2
cmp dword [ebp - 0x38], esi
jb 0x57d5e5
jmp 0x57d6ad
cmp byte [ebp + 0xc], bl
je 0x57d639
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.0057c63a
mov byte [ebp - 4], bl
jmp 0x57d6d4
push dword [ebp + 8]
push 0x41e728
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x2ac]
push eax
call fcn.005b9bd7
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
lea edi, [ebp - 0x1a0]
push 0x6c2560
lea eax, [ebp - 0x1a0]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.005b9bd7
dec esi
push esi
call fcn.005b9bd7
mov edi, dword [eax]
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], edi
call fcn.005b9bd7
lea eax, [ebp - 0x94]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
call fcn.0057ccb5
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x94]
push eax
call fcn.005b9bd7
cmp esi, ebx
lea ecx, [ebp - 0x44]
ja 0x57d675
jmp 0x57d628
lea ecx, [ebp - 0x94]
call fcn.00576231
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.0058bcd2
call fcn.0066d966
ret 0x10

Function at 0x57d8db
Capabilities:
Shutdown system

Disassembly:
push esi
push 2
push 2
xor esi, esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x57d8f4
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret
Function at 0x57db10
Capabilities:
Get common file path
Get file version info

Disassembly:
push 0x27c
mov eax, 0x6b6bef
call fcn.0066d88e
xor ebx, ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.005761e7
push 0x104
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], ebx
call fcn.005b9bd7
lea ecx, [ebp - 0x48]
call fcn.0057605c
push eax
lea ecx, [ebp - 0x48]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x57db94
push 0x41e920
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.005b9bd7
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x17c]
lea edi, [ebp - 0x17c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.005b9bd7
mov esi, 0x402e78
push esi
lea ecx, [ebp - 0x70]
call fcn.0057706c
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.005b9bd7
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], bl
call fcn.00576231
push 0x41e90c
lea ecx, [ebp - 0x70]
call fcn.0057706c
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.005b9bd7
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], bl
call fcn.00576231
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x48]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
jbe 0x57dc5b
push 1
push 0xde
push 0x41e8e4
push edi
call fcn.0058b7f6
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x57dc5b
push eax
push edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x48]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x57dc53
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x57dc53
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
cmp eax, dword [ebp + 8]
sbb eax, eax
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
call fcn.005b9bd7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00576231
mov eax, dword [ebp - 0x1c]
call fcn.0066d966
ret 4

Function at 0x580a4d
Capabilities:
Allocate thread local storage

Disassembly:
push 0x21c
mov eax, 0x6b7503
call fcn.0066d88e
mov esi, ecx
mov dword [ebp - 0x10], esi
or dword [esi], 0xffffffff
push dword [0x72d8a4]
lea ecx, [esi + 4]
push 0x18
push 0x41f4c0
push 0x50
call fcn.005b9bd7
and dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x580ac5
push 0x41f4ac
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.005b9bd7
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x11c]
lea edi, [ebp - 0x11c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.005b9bd7
mov eax, esi
call fcn.0066d966
ret
Function at 0x586e5f
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push 0x423628
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
mov esi, eax
test esi, esi
jne 0x586e88
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 5
je 0x586e88
xor bl, bl
jmp 0x586e95
test esi, esi
mov bl, 1
je 0x586e95
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
ret