joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c7bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 0x81
int1
push eax
adc eax, 0xe1810001
xchg edi, eax
add byte [eax], al
Function at 0x5e9c80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5e9cfd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.005d67c0
mov eax, dword [ebp - 4]
call fcn.005d6130
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x30]
mov ebx, dword [eax + 0xc]
dec ebx
cmp ebx, 0
jl 0x5e9ce4
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 4]
mov esi, dword [eax + ebx*4]
mov eax, dword [esi + 4]
cmp eax, dword [ebp - 8]
jne 0x5e9cde
mov eax, dword [esi]
mov edx, dword [ebp - 4]
call fcn.0040abf0
je 0x5e9ce7
dec ebx
cmp ebx, 0xffffffff
jne 0x5e9cc1
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e9d04
lea eax, [ebp - 4]
call fcn.0040a1ec
ret

Function at 0x5fc0fc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ebx, ebx
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x5fc148
cmp dword [ebp - 0x104], 2
jne 0x5fc148
cmp dword [ebp - 0x110], 5
ja 0x5fc146
cmp dword [ebp - 0x110], 5
jne 0x5fc148
cmp dword [ebp - 0x10c], 1
jb 0x5fc148
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5fc150
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00424308
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ff108
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00424308
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x60331c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00424308
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x605128
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
push 0x200
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x605168
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.0040b318
jmp 0x60516f
mov eax, ebx
call fcn.0040a1c8
add esp, 0x2b4
pop esi
pop ebx
ret

Function at 0x605178
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6cbf50]
or eax, 0x4001
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x6051b7
mov eax, dword [esp + 4]
jmp 0x6051b9
xor eax, eax
add esp, 0x2b4
pop esi
pop ebx
ret
Function at 0x6051c4
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6cbf58]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x605208
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x6051fd
mov eax, dword [esp + 4]
jmp 0x6051ff
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x6051e7
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6cbf58]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x605208
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x6051fd
mov eax, dword [esp + 4]
jmp 0x6051ff
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x6056a4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
test dl, dl
je 0x6056b8
add esp, 0xfffffff0
call fcn.00408a40
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00515554
mov eax, dword [0x605758]
not eax
and dword [esi + 0x60], eax
mov edx, 0x79
mov eax, esi
call fcn.005118b8
mov edx, 0x61
mov eax, esi
call fcn.005118ec
xor edx, edx
mov eax, esi
call fcn.005125ec
mov dl, 1
mov eax, esi
call fcn.0051b718
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 6
jae 0x605714
mov dx, 0xfffe
mov eax, esi
call fcn.00512634
push 0
lea eax, [ebp - 0x5c]
push eax
push 0x5c
push 0x1f
call sub.user32.dll_SystemParametersInfoW
test eax, eax
je 0x60573a
lea eax, [ebp - 0x5c]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov edx, eax
mov eax, dword [esi + 0x74]
call fcn.004ee4cc
mov eax, esi
test bl, bl
je 0x60574f
call fcn.00408a98
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x607178
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00424308
add esp, 0x208
pop ebx
ret

Function at 0x60a690
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x60b37c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040b278
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jle 0x60b41a
mov eax, ebx
call fcn.00406f0c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x60b413
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x60b3fd
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x60b43c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x60b3fd
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 4]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60b42f
mov eax, dword [ebp - 0x10]
call fcn.00406f28
ret
call fcn.00429d10
dec eax
je 0x60b42f
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0060b1a0
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x60b920
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0060b8d4
test al, al
jne 0x60b941
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x60b98f
xor eax, eax
push ebp
push 0x60b97f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_CreateDirectoryW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60b986
lea eax, [ebp - 0xc]
call fcn.0060b910
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x60b998
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0060b8d4
test al, al
jne 0x60b9bc
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x60ba22
xor eax, eax
push ebp
push 0x60ba12
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x24]
push eax
push edi
push esi
call sub.kernel32.dll_CreateProcessW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60ba19
lea eax, [ebp - 0xc]
call fcn.0060b910
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x60ba30
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0060b8d4
test al, al
jne 0x60ba54
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x60baac
xor eax, eax
push ebp
push 0x60ba9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.0040b278
push eax
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_CopyFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60baa3
lea eax, [ebp - 0xc]
call fcn.0060b910
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x60bab8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0060b8d4
test al, al
jne 0x60bad9
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x60bb25
xor eax, eax
push ebp
push 0x60bb15
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60bb1c
lea eax, [ebp - 0xc]
call fcn.0060b910
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x60bc90
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0060b8d4
test al, al
jne 0x60bcb3
mov dword [ebp - 4], 0xffffffff
jmp 0x60bcff
xor eax, eax
push ebp
push 0x60bcef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60bcf6
lea eax, [ebp - 0xc]
call fcn.0060b910
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x60be34
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0060b8d4
test al, al
jne 0x60be58
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x60beac
xor eax, eax
push ebp
push 0x60be9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.0040b278
push eax
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_MoveFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60bea3
lea eax, [ebp - 0xc]
call fcn.0060b910
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x60beb8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
test edi, edi
jne 0x60bedb
test esi, 4
je 0x60bedb
xor edi, edi
jmp 0x60bee4
mov eax, edi
call fcn.0040b278
mov edi, eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0060b8d4
test al, al
jne 0x60bef9
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x60bf48
xor eax, eax
push ebp
push 0x60bf38
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
call sub.kernel32.dll_MoveFileExW
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60bf3f
lea eax, [ebp - 0x10]
call fcn.0060b910
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x60bfc4
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0060b8d4
test al, al
jne 0x60bfe5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x60c031
xor eax, eax
push ebp
push 0x60c021
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_RemoveDirectoryW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60c028
lea eax, [ebp - 0xc]
call fcn.0060b910
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x60c03c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0060b8d4
test al, al
jne 0x60c060
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x60c0ad
xor eax, eax
push ebp
push 0x60c09d
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_SetFileAttributesW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60c0a4
lea eax, [ebp - 0xc]
call fcn.0060b910
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x60ec98
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.0040a2ac
xor eax, eax
push ebp
push 0x60ed7c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x60ecdf
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.005c51d4
cmp dword [ebp + 0x18], 0
jne 0x60ecdf
lea eax, [ebp + 0x18]
call fcn.005c61d8
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407760
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x60ed0a
mov eax, ebx
call fcn.0040b278
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.0040b278
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.0040b278
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
call fcn.0040b278
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x60ed4c
call sub.kernel32.dll_GetLastError
mov dword [esi], eax
jmp 0x60ed66
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x60ed66
push esi
movzx edx, byte [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
call fcn.0060e938
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60ed83
lea eax, [ebp + 0x18]
call fcn.0040a1c8
ret

Function at 0x60efb4
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x60efe2
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.0040b318
jmp 0x60efe9
mov eax, ebx
call fcn.0040a1c8
add esp, 0x24
pop ebx
ret

Function at 0x60eff0
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x60f021
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.0040b318
jmp 0x60f028
mov eax, ebx
call fcn.0040a1c8
add esp, 0x208
pop ebx
ret

Function at 0x60f0dc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x60f136
inc esi
xor edi, edi
cmp edi, 1
jne 0x60f102
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x60f110
cmp edi, 1
jle 0x60f110
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0060bab8
test eax, eax
jne 0x60f136
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x60f136
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x60f136
inc edi
dec esi
jne 0x60f0f2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x60fd58
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x60fd7c
mov eax, dword [ebp - 4]
jmp 0x60fd7f
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret

Function at 0x60fd84
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x60fdd1
xor ebx, ebx
jmp 0x60fdc6
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.00422360
test eax, eax
jne 0x60fdc5
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x60fe7c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x60fda7
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x60fddd
je 0x60fde6
jmp 0x60fdef
call fcn.005c6d70
mov esi, eax
jmp 0x60fdf1
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x60fdf1
xor esi, esi
test si, si
je 0x60fe7c
xor ebx, ebx
jmp 0x60fe17
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x60fe16
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x60fe7c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x60fdfe
xor ebx, ebx
jmp 0x60fe71
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov dx, 0x3ff
and dx, si
movzx edx, dx
cmp eax, edx
jne 0x60fe70
mov ax, 0x3ff
and ax, si
cmp ax, 4
jne 0x60fe65
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.0060fd58
push eax
mov eax, esi
call fcn.0060fd58
pop edx
cmp edx, eax
jne 0x60fe70
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x60fe7c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x60fe26
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x618030
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00424308
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x618060
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x61817c
push dword fs:[eax]
mov dword fs:[eax], esp
inc dword [0x6d533c]
cmp dword [0x6d5338], 0
jne 0x618157
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 6
jb 0x618157
lea eax, [ebp - 8]
call fcn.00618030
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.005c4d00
lea eax, [ebp - 4]
mov edx, 0x618198
call fcn.0040b470
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
call sub.kernel32.dll_LoadLibraryW
mov dword [0x6d5338], eax
cmp dword [0x6d5338], 0
je 0x618157
push 0x6181b4
mov eax, dword [0x6d5338]
push eax
call fcn.00414020
mov dword [0x6d531c], eax
push 0x6181d4
mov eax, dword [0x6d5338]
push eax
call fcn.00414020
mov dword [0x6d5320], eax
push 0x6181fc
mov eax, dword [0x6d5338]
push eax
call fcn.00414020
mov dword [0x6d5324], eax
push 0x618210
mov eax, dword [0x6d5338]
push eax
call fcn.00414020
mov dword [0x6d5328], eax
push 0x618228
mov eax, dword [0x6d5338]
push eax
call fcn.00414020
mov dword [0x6d532c], eax
push 0x61823c
mov eax, dword [0x6d5338]
push eax
call fcn.00414020
mov dword [0x6d5330], eax
cmp dword [0x6d5338], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x618183
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a228
ret
Function at 0x61ca94
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor eax, eax
push ebp
push 0x61cc95
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
mov eax, dword [eax + 0x508]
mov edx, 0x20
call fcn.005118b8
mov eax, dword [ebx]
mov eax, dword [eax + 0x508]
mov edx, 0x20
call fcn.005118ec
mov eax, dword [ebx]
mov eax, dword [eax + 0x50c]
mov edx, 0x20
call fcn.005118b8
mov eax, dword [ebx]
mov eax, dword [eax + 0x50c]
mov edx, 0x20
call fcn.005118ec
xor eax, eax
push ebp
push 0x61cc6a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1010
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0x10
push 0x61cca4
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x61cb71
cmp word [ebp - 0x2ac], 0
je 0x61cb71
mov eax, dword [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2ac]
push eax
mov eax, dword [0x6d1634]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebx]
mov edx, dword [edx + 0x410]
mov ecx, dword [edx + 0x7c]
mov edx, dword [ebx]
mov edx, dword [edx + 0x508]
call fcn.0061c9d0
xor edx, edx
mov al, 6
call fcn.006a61e8
test al, al
je 0x61cbd6
push 0x27
lea edx, [ebp - 0x2bc]
mov eax, dword [0x6cd188]
mov eax, dword [eax]
call fcn.005c4d00
lea eax, [ebp - 0x2bc]
mov edx, 0x61cccc
call fcn.0040b470
mov eax, dword [ebp - 0x2bc]
call fcn.0040b278
push eax
mov eax, dword [0x6d1634]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebx]
mov edx, dword [edx + 0x418]
mov ecx, dword [edx + 0x7c]
mov edx, dword [ebx]
mov edx, dword [edx + 0x50c]
call fcn.0061c9d0
jmp 0x61cc60
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
xor eax, eax
call fcn.006aba04
cmp dword [ebp - 4], 0
jne 0x61cbfa
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
mov al, 1
call fcn.006aba04
cmp dword [ebp - 4], 0
je 0x61cc60
push 0x1000
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x61cc60
cmp word [ebp - 0x2ac], 0
je 0x61cc60
mov eax, dword [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2ac]
push eax
mov eax, dword [0x6d1634]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebx]
mov edx, dword [edx + 0x418]
mov ecx, dword [edx + 0x7c]
mov edx, dword [ebx]
mov edx, dword [edx + 0x50c]
call fcn.0061c9d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61cc74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61cc9c
lea eax, [ebp - 0x2bc]
call fcn.0040a1c8
lea eax, [ebp - 4]
call fcn.0040a1c8
ret