joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50434d
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x840
push ebx
push ebp
push esi
push edi
push dword [0x6b3d38]
xor esi, esi
mov dword [esp + 0x14], esi
call fcn.0052eed9
mov ebp, dword [esp + 0x854]
xor edi, edi
inc edi
mov ebx, eax
mov dword [esp + 0x20], ebx
cmp word [ebp + 0x20], di
jne 0x5043bc
push esi
push esi
push dword [ebp]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
cmp esi, 0xffffffff
je 0x50451e
lea eax, [ebp + 0x28]
push 0x18
push eax
call fcn.0052f888
pop ecx
pop ecx
mov ecx, eax
mov dword [esp + 0x10], edi
mov dword [ecx], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], ebp
mov eax, dword [ebp + 0x24]
mov dword [ebx + 4], eax
mov dword [ebx], ecx
jmp 0x50451e
cmp word [ebp + 0x22], si
je 0x5043f0
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x1c
push eax
lea eax, [esp + 0x38]
push eax
push esi
push 0x800
lea eax, [esp + 0x60]
push eax
push dword [ebp]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x50441c
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x10
push eax
lea eax, [esp + 0x28]
push eax
push esi
push 0x800
lea eax, [esp + 0x60]
push eax
push dword [ebp]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
mov dword [esp + 0x14], eax
test edi, edi
jle 0x50451e
lea ebx, [ebp + 0x28]
mov dword [esp + 0x10], 2
mov esi, dword [ebx]
jmp 0x504460
xor eax, eax
cmp word [ebp + 0x22], ax
je 0x504445
push dword [esp + 0x1c]
lea eax, [esp + 0x38]
jmp 0x50444d
push dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
lea eax, [esi + 0xc]
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x504466
mov esi, dword [esi]
test esi, esi
jne 0x504433
jmp 0x504470
lea ebx, [esi + 8]
test esi, esi
jne 0x5044af
lea ebx, [ebp + 0x28]
push 0x40
push ebx
call fcn.0052f888
mov ebx, eax
mov eax, dword [esp + 0x18]
pop ecx
pop ecx
mov dword [ebx], eax
lea edi, [ebx + 4]
mov dword [ebx + 0x24], ebp
mov al, byte [ebp + 0x22]
mov byte [ebx + 0x20], al
xor eax, eax
cmp word [ebp + 0x22], ax
je 0x5044a5
push 7
pop ecx
lea esi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
jmp 0x5044b1
lea esi, [esp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x50449f
xor eax, eax
cmp dword [ebx + 0x2c], 0
jne 0x5044df
push edi
push eax
push dword [0x6b00f0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
lea ecx, [esp + 0x54]
mov dword [ebx + 0x2c], eax
push ecx
push eax
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x504512
mov eax, dword [ebx + 0x30]
add eax, edi
push eax
push dword [ebx + 0x2c]
push 8
push dword [0x6b00f0]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
lea eax, [esp + 0x50]
push edi
push eax
mov eax, dword [ebx + 0x30]
add eax, ecx
mov dword [ebx + 0x2c], ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [ebx + 0x30], edi
mov eax, dword [esp + 0x20]
mov dword [eax], ebx
mov ecx, dword [ebp + 0x24]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x840
ret
Function at 0x504678
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [esi], 1
jne 0x50469e
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
jmp 0x5046db
cmp dword [esi + 0x2c], ebx
je 0x5046db
mov edi, dword [ebp + 0x10]
cmp edi, dword [esi + 0x30]
jle 0x5046ae
mov edi, dword [esi + 0x30]
push edi
push dword [esi + 0x34]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0x30], edi
add esp, 0xc
add dword [esi + 0x34], edi
cmp dword [esi + 0x30], ebx
jne 0x5046db
push dword [esi + 0x2c]
push ebx
push dword [0x6b00f0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 0x2c], ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x504748
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push ebx
push dword [0x6b1798]
xor ebp, ebp
call fcn.0052f558
mov esi, eax
test esi, esi
je 0x504849
cmp dword [esp + 0x18], 0xffff
push edi
ja 0x504835
mov edi, dword [esp + 0x20]
test edi, 0x10000000
je 0x50478d
push 0x17
and edi, 0xefffffff
jmp 0x50478f
push 2
pop eax
mov dword [esp + 0x18], eax
test edi, edi
jne 0x504799
inc edi
push ebp
push edi
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x504833
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0x8004667e
push ebp
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jle 0x504824
push dword [esp + 0x1c]
lea eax, [esi + 4]
push dword [esp + 0x28]
push eax
push eax
xor eax, eax
cmp dword [esp + 0x28], 0x17
push ebp
sete al
push eax
call fcn.005050ee
test eax, eax
je 0x504824
cmp edi, 1
jne 0x5047ff
push 0x64
push ebp
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x504824
xor eax, eax
mov dword [esi], ebp
cmp dword [esp + 0x18], 0x17
mov word [esi + 0x20], di
sete al
mov word [esi + 0x22], ax
cmp ebx, 0xffffffff
jne 0x50481d
mov dword [esi + 0x24], esi
jmp 0x504820
mov dword [esi + 0x24], ebx
mov ebp, esi
jmp 0x50482d
push ebp
call dword [sym.imp.WS2_32.dll_closesocket]
xor ebp, ebp
test ebp, ebp
jne 0x504848
jmp 0x504835
xor ebp, ebp
cmp ebx, 0xffffffff
je 0x50483c
mov esi, ebx
push esi
push dword [0x6b1798]
call fcn.0052f4ca
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x504d67
Capabilities:
Get socket status
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x920
xor eax, eax
inc eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ebx
cmp dword [edi], eax
jne 0x504dea
mov esi, dword [edi + 8]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
lea eax, [ebp - 0x120]
mov dword [ebp - 0x11c], esi
push eax
lea eax, [esi + 1]
mov dword [ebp - 0xc], ebx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x504de1
je 0x504de6
lea eax, [ebp - 0x120]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x504de6
lea eax, [ebp + 8]
push eax
push 0x4004667f
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x504de1
cmp dword [ebp + 8], ebx
je 0x504de1
push 2
jmp 0x504de3
push 4
pop esi
jmp 0x504e44
mov esi, ebx
jmp 0x504e44
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x800
lea eax, [ebp - 0x920]
push eax
push dword [edi + 0x28]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp + 8], eax
test eax, eax
jle 0x504e44
push 2
pop esi
push eax
push ebx
push dword [0x6b00f0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
push ecx
mov dword [edi + 0x30], ecx
lea ecx, [ebp - 0x920]
push ecx
push eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x34], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x504e4f
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
lea eax, [ebp - 0x100]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0xff
push eax
mov dword [0x6b3d3c], esi
mov dword [0x6b3d4c], esi
mov dword [0x6b3d50], edi
mov dword [0x6b3d54], esi
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x504efb
cmp edi, 0x10000000
jne 0x504ed7
cmp dword [0x6b1794], esi
je 0x504efb
mov eax, dword [0x6b17b0]
test eax, eax
je 0x504eb3
push eax
call dword [0x6b17a0]
mov dword [0x6b17b0], esi
push 0x6b17b0
push esi
push esi
lea eax, [ebp - 0x100]
push eax
call dword [0x6b179c]
test eax, eax
jne 0x504efb
mov eax, dword [0x6b17b0]
mov dword [0x6b3d54], eax
jmp 0x504ef8
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x504efb
push 0x10
push eax
push 0x6b3d40
call sub.MSVCRT.dll_memcpy
add esp, 0xc
xor esi, esi
inc esi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x50507d
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
cmp eax, 0xffffffff
jne 0x5050a0
lea eax, [ebp + 0xc]
push eax
push 0x4004667f
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x5050e7
push 2
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5050e0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2745
je 0x5050e4
cmp eax, 0x2746
je 0x5050e4
cmp eax, 0x2749
je 0x5050e4
cmp eax, 0x274a
je 0x5050e4
xor esi, esi
jmp 0x5050e7
test esi, esi
jne 0x5050e7
push 0xfffffffffffffffe
pop esi
mov eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x50537c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x6b3d7c]
call fcn.0052f519
mov ebx, eax
test ebx, ebx
je 0x5053e0
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x5053a5
push dword [esp + 0xc]
push ebx
call eax
jmp 0x5053e0
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.0052fd30
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.0052fe10
pop edi
pop esi
pop ebx
ret 8

Function at 0x5054d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 1
call edi
mov ebx, 0x8000
test bx, ax
je 0x5054ee
inc esi
push 2
call edi
test bx, ax
je 0x5054fa
or esi, 2
push 4
call edi
test bx, ax
je 0x505506
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x505a9c
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x18]
push eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x30]
test esi, esi
jne 0x505ad4
push dword [edi]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov dword [esp + 0x10], 1
push dword [edi]
push esi
call fcn.00512898
test byte [edi + 0x14], 8
mov dword [esp + 0x14], eax
je 0x505bc5
call dword [sym.imp.USER32.dll_GetFocus]
cmp dword [edi], eax
jne 0x505bc5
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
sub ebp, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
test eax, eax
jle 0x505bf3
test ebp, ebp
jle 0x505bf3
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
test ebx, ebx
je 0x505bf3
push ebp
push dword [esp + 0x30]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x30], eax
test eax, eax
je 0x505bbc
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [edi + 0x10], 0
je 0x505b66
push 4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi + 0x10]
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x505b7b
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push 2
pop eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
sub dword [esp + 0x20], eax
sub dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0xcc0020
xor eax, eax
push eax
push eax
push ebx
push ebp
push dword [esp + 0x40]
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [esp + 0x30]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x505bf3
cmp dword [edi + 0x10], ebx
je 0x505bdf
push 4
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi + 0x10]
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x505bf3
push ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
push dword [esp + 0x14]
push esi
call fcn.00512876
cmp dword [esp + 0x10], 0
je 0x505c0d
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x505c15
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetMessagePos]
mov edi, dword [esp + 0x20]
mov esi, eax
push 0xfffffffffffffff4
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [edi]
mov dword [esp + 0x14], eax
call fcn.00512a6c
push eax
call fcn.005143b8
push dword [0x6b17cc]
mov dword [esp + 0x24], eax
call fcn.0052f029
mov ebp, eax
movsx ecx, si
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
push dword [edi]
shr esi, 0x10
movsx ecx, si
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
mov edi, 0x8000
test di, ax
je 0x505c89
inc ebx
push 0x12
call esi
test di, ax
je 0x505c95
or ebx, 2
push 0x11
call esi
test di, ax
je 0x505ca1
or ebx, 4
mov eax, dword [esp + 0x14]
mov dword [ebp], eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 4], eax
call fcn.005054d4
push 0x505cf6
push ebp
push dword [esp + 0x2c]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x34]
push dword [esp + 0x2c]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x3c]
push dword [esp + 0x20]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0x44]
movzx eax, ax
push 0x332c
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x18], eax
call fcn.00518c4b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x50d32b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push 0
push 0
push 0x1304
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x50d39d
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
cmp ebx, 0xffffffff
jne 0x50d354
mov ebx, eax
push dword [ebp]
call fcn.0050caad
push ebx
push dword [ebp]
mov edi, eax
call fcn.0050ca84
add esp, 0xc
mov esi, eax
push 0
push ebx
push 0x130c
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [ebp]
call fcn.0050d3bd
pop ecx
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x50f59e
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x6b3d60]
call fcn.0052eed9
xor ebp, ebp
mov esi, eax
cmp dword [0x6b2a00], ebp
jne 0x50f67a
xor ebx, ebx
inc ebx
mov dword [0x6b2a00], ebx
call fcn.005131ec
mov edi, 0xa4
push edi
push ebp
push 0x6b2a08
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x6b2a08], 0x13
lea eax, [esp + 0x10]
mov dword [0x6b2a0c], edi
mov dword [0x6b2a18], 0x50f4e9
mov dword [0x6b2a1c], 0x50f834
push eax
mov dword [0x6b2a70], 0x50f4c4
mov dword [0x6b2a74], 0x50f77f
mov dword [0x6b2a14], 0x50f49f
mov dword [0x6b2a98], 0x50f504
mov dword [0x6b2aac], ebx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x50f67a
cmp dword [esp + 0x20], ebx
je 0x50f662
cmp dword [esp + 0x20], 2
jne 0x50f67a
cmp dword [esp + 0x14], 5
jae 0x50f66a
mov dword [0x6b2aac], ebp
jmp 0x50f67a
jne 0x50f67a
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
and dword [0x6b2aac], eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.00519af1
mov eax, dword [esp + 0x140]
push ebp
push dword [0x6b00f4]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebp
push str.BUTTON
push ebp
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x50f750
push dword [esp + 0x128]
push dword [0x6b3d7c]
call fcn.0052f558
mov edi, dword [esp + 0x13c]
mov esi, eax
mov dword [esi + 0x10], edi
test edi, edi
je 0x50f71f
push edi
call fcn.005296a5
test eax, eax
je 0x50f71f
push ebp
push ebp
push edi
call fcn.00529263
mov dword [esi + 0x18], eax
jmp 0x50f722
mov dword [esi + 0x18], ebp
push 0x50f1ee
push 0xfffffffffffffffc
push ebx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x6b2a08
push ebx
push esi
push dword [esp + 0x134]
mov dword [0x6b2a04], eax
call fcn.00512a9b
mov ebx, eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x114
ret 0x1c
Function at 0x511d7a
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
push ebx
push ebp
push esi
push edi
push dword [0x6b3d60]
call fcn.0052eed9
cmp dword [0x6b2d80], 0
mov edi, eax
mov esi, 0x50010000
jne 0x511ee2
mov ebx, 0xa4
push ebx
push 0
push 0x6b2d88
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x6b2d88], 0x1b
mov dword [0x6b2d8c], ebx
mov dword [0x6b2d90], 0x5116ea
mov dword [0x6b2d94], 0x511a2f
mov dword [0x6b2dac], 0x511467
mov dword [0x6b2dbc], 0x511a25
mov dword [0x6b2db4], 0x5119d0
mov dword [0x6b2db0], 0x512061
mov dword [0x6b2d9c], 0x512548
mov dword [0x6b2d98], 0x511c76
mov dword [0x6b2da0], 0x511cc0
mov dword [0x6b2da4], 0x512579
mov dword [0x6b2dc8], 0x511bed
mov dword [0x6b2dcc], 0x512501
mov dword [0x6b2dc0], 0x511b5c
mov dword [0x6b2dc4], 0x5123ae
mov dword [0x6b2e00], 0x5121fb
mov dword [0x6b2e04], 0x511a74
mov dword [0x6b2e08], 0x51224e
mov dword [0x6b2e0c], 0x511b00
mov dword [0x6b2e10], 0x5122c0
mov dword [0x6b2e14], 0x511b3a
mov dword [0x6b2df8], 0x511acf
mov dword [0x6b2e28], 0x5122e2
call fcn.005131ec
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x511ed8
cmp dword [esp + 0x24], 2
jne 0x511ed8
cmp dword [esp + 0x18], 6
jb 0x511ed8
mov eax, dword [0x6b17b8]
mov dword [0x6b2d84], eax
mov dword [0x6b2d80], 1
test byte [esp + 0x140], 2
jne 0x511ef1
mov esi, 0x50010002
test byte [esp + 0x140], 1
jne 0x511efe
or esi, 5
test byte [esp + 0x140], 0x20
je 0x511f0b
or esi, 0x20
push 0x1f4
push 0
push dword [0x6b00f0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x13c]
push eax
call fcn.00519af1
test ebp, ebp
je 0x51204e
push 0
push dword [0x6b00f4]
push 0xffffffffffffffff
push dword [edi]
push dword [esp + 0x14c]
push dword [esp + 0x14c]
push dword [esp + 0x14c]
push dword [esp + 0x14c]
push esi
push 0
push str.SysTreeView32
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x512052
push dword [esp + 0x12c]
push dword [0x6b3d7c]
call fcn.0052f558
push 0x5125c2
push 0xfffffffffffffffc
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 4
push 4
push 0x112c
push ebx
mov dword [0x6b2e2c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x6b2d88
push ebx
push edi
push dword [esp + 0x138]
mov dword [edi + 0x14], ebp
mov dword [edi + 0x18], 0x19
call fcn.00512a9b
mov ebx, eax
mov eax, 0x100
test dword [esp + 0x140], eax
je 0x512052
or esi, eax
push esi
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowLongW]
test dword [esp + 0x140], 0x10000
je 0x512052
call fcn.00514140
cmp eax, 0x3c
jg 0x512021
push edi
call fcn.0051190c
pop ecx
push 0
push 2
push 0x1108
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x51203e
push eax
push dword [edi]
call fcn.00513dae
push edi
push str.PB_3State
push dword [edi]
call dword [sym.imp.USER32.dll_SetPropW]
jmp 0x512052
mov ebx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x118
ret 0x18
Function at 0x51365a
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
lea eax, [ebp - 0x208]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [ebp + 8]
or eax, 0x4000
push eax
push 0x2b4
lea eax, [ebp - 0x4bc]
push eax
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret 4
Function at 0x51395c
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x6b2e40], 0
jne 0x513a2d
push ebx
push ebp
push esi
xor ebp, ebp
inc ebp
push 0x6b3d88
mov dword [0x6b2e40], ebp
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov eax, 0x640
push eax
push 8
push dword [0x6b00f0]
mov dword [0x6b3304], eax
mov dword [0x6b2e44], 0x1f4
call esi
mov dword [0x6b3314], eax
mov eax, dword [0x6b2e44]
add eax, eax
push eax
push 8
push dword [0x6b00f0]
call esi
xor ebx, ebx
mov dword [0x6b3310], eax
push 0x6b3320
mov dword [0x6b3308], ebx
mov dword [0x6b330c], ebp
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push ebp
push ebx
call esi
push ebx
push ebx
push ebp
push ebx
mov dword [0x6b3338], eax
call esi
mov dword [0x6b333c], eax
cmp dword [0x6b3338], ebx
je 0x513a24
test eax, eax
je 0x513a24
lea eax, [esp + 0xc]
mov dword [0x6b3318], ebx
push eax
push ebx
push ebx
push 0x51345f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6b331c], eax
jmp 0x513a2a
mov dword [0x6b3318], ebp
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x514140
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x5142b6
mov eax, dword [esp + 0x24]
dec eax
je 0x514299
dec eax
jne 0x5142b6
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.005140f9
pop ecx
test eax, eax
je 0x5141f7
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x5141ba
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x514295
dec ebx
je 0x514291
dec ebx
je 0x514270
dec ebx
je 0x51422a
sub ebx, 4
jne 0x5142b6
test edi, edi
jne 0x5142b6
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x5142b6
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x5141ba
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x5141b5
sub edi, 0
je 0x514262
dec edi
je 0x514254
dec edi
je 0x514246
dec edi
jne 0x5142b6
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x5142b6
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x5142b6
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x5142b6
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x5142b6
sub edi, 0
je 0x51428d
dec edi
je 0x514289
dec edi
jne 0x5142b6
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x5142b6
push 0x3c
jmp 0x5142b5
push 0x32
jmp 0x5142b5
push 0x14
jmp 0x5142b5
push 5
jmp 0x5142b5
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x5142b3
cmp eax, 0xa
je 0x5142af
cmp eax, 0x5a
jne 0x5142b6
push 0x28
jmp 0x5142b5
push 0x1e
jmp 0x5142b5
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret