joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb994
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4bb9c5
dec al
je 0x4bba01
dec al
je 0x4bba45
dec al
je 0x4bbab0
jmp 0x4bbb3a
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4bbb3a
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4bb9d5
jmp 0x4bbb3a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4bbb3a
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4bba11
jmp 0x4bbb3a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4bbb3a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4bba73
xor ebp, ebp
jmp 0x4bba84
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4bba8d
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4bba55
jmp 0x4bbb3a
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4bbb3a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4bbb08
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004b9400
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4bbac4
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c477c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a0], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c48cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4c47c8
cmp dword [ebp - 0x8c], 1
je 0x4c47cc
xor ebx, ebx
jmp 0x4c47ce
mov bl, 1
mov dl, 1
mov eax, dword [0x443cf0]
call fcn.00443dc0
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c48a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.00443e60
test bl, bl
je 0x4c480b
mov edx, 0x4c48e4
mov eax, dword [ebp - 4]
call fcn.00443fe8
jmp 0x4c4818
mov edx, 0x4c4918
mov eax, dword [ebp - 4]
call fcn.00443fe8
lea ecx, [ebp - 0x1a0]
mov edx, 0x4c4950
mov eax, dword [ebp - 4]
call fcn.00444218
mov edx, dword [ebp - 0x1a0]
lea eax, [esi + 0x1c]
call fcn.00404488
lea ecx, [ebp - 0x1a4]
mov edx, 0x4c4968
mov eax, dword [ebp - 4]
call fcn.00444218
mov edx, dword [ebp - 0x1a4]
lea eax, [esi + 0x20]
call fcn.00404488
mov eax, dword [ebp - 4]
call fcn.00443e30
cmp dword [esi + 0x1c], 0
jne 0x4c4892
mov dword [ebp - 8], 0xff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x19c]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [esi + 0x1c]
lea edx, [ebp - 0x19c]
mov ecx, pe_nt_image_headers32
call fcn.004046a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c48af
mov eax, dword [ebp - 4]
call fcn.00403600
ret
Function at 0x4d29e8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x419658]
call fcn.00404dcc
xor eax, eax
push ebp
push 0x4d2b2c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5a1954], 0
jne 0x4d2a3b
mov ecx, dword [0x5a2cc4]
mov dl, 1
mov eax, dword [0x407c34]
call fcn.0040cd98
call fcn.00403dcc
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f70
mov eax, ebx
call fcn.00404c9c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4d2b3c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405e98
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404cac
test eax, eax
jle 0x4d2ad3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4d2acc
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004046bc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004046a4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408ae0
test eax, eax
jne 0x4d2acc
mov ebx, 0x15
jmp 0x4d2ad8
mov ebx, 0x10
jmp 0x4d2ad8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x5a1954]
call fcn.004d2940
mov eax, dword [ebp - 8]
call fcn.004d2940
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405eb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2b33
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404458
lea eax, [ebp - 0x10]
mov edx, dword [0x419658]
call fcn.00404e9c
ret

Function at 0x4d7b2c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4d7b5a
mov eax, ebx
call fcn.004d85e0
cmp dword [ebx + 0x40], 0
je 0x4d7b53
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4d7bcb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4d7bbd
cmp dword [ebx + 8], 0
je 0x4d7b7c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4d7b8e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4d7bbd
cmp dword [ebx + 8], 0
je 0x4d7b6f
cmp eax, 3
je 0x4d7ba1
dec eax
jne 0x4d7b6f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4d7b6f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4d7b6f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4d7be9
cmp dword [ebx + 0x14], 0xcc
je 0x4d7be9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004d7bf4
pop ebx
ret
Function at 0x4f2dc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x222], 0
je 0x4f2de7
mov ecx, edi
mov dl, 1
mov eax, dword [0x4f1c04]
call fcn.004f1c68
mov dword [edi + 0x294], eax
jmp 0x4f2ef0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
cmp byte [edi + 0x22b], 0
je 0x4f2e28
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp dx, word [edi + 0x226]
jbe 0x4f2e1d
mov edx, eax
sub dl, byte [edi + 0x226]
mov eax, edi
call fcn.004f2370
jmp 0x4f2e5e
xor edx, edx
mov eax, edi
call fcn.004f2370
jmp 0x4f2e5e
movzx edx, word [edi + 0x226]
mov ecx, 0x64
sub ecx, edx
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp ecx, edx
jle 0x4f2e55
mov edx, eax
add dl, byte [edi + 0x226]
mov eax, edi
call fcn.004f2370
jmp 0x4f2e5e
mov dl, 0x64
mov eax, edi
call fcn.004f2370
cmp byte [edi + 0x22b], 0
je 0x4f2e70
cmp byte [edi + 0x22a], 0
je 0x4f2e82
cmp byte [edi + 0x22b], 0
jne 0x4f2e8d
cmp byte [edi + 0x22a], 0x64
jne 0x4f2e8d
mov bl, byte [edi + 0x224]
xor bl, 1
jmp 0x4f2ebd
mov eax, dword [0x5a311c]
mov eax, dword [eax]
call fcn.004a2ac0
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
movzx edx, word [edi + 0x228]
cmp eax, edx
ja 0x4f2ebd
cmp byte [edi + 0x224], 0
jne 0x4f2ebd
cmp byte [edi + 0x2a0], 0
je 0x4f2e8d
test bl, bl
jne 0x4f2ed7
cmp byte [edi + 0x224], 0
jne 0x4f2ed7
cmp byte [edi + 0x2a0], 0
je 0x4f2de9
cmp byte [edi + 0x2a0], 0
jne 0x4f2ee9
cmp byte [edi + 0x224], 0
jne 0x4f2ef0
mov eax, edi
call fcn.004f31e4
pop edi
pop esi
pop ebx
ret

Function at 0x4f4b54
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4f4ba5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4f4b8c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4f4b7c
jmp 0x4f4ba5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4f4b8d
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50eb38
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x50eba9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x5a2ad0]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x50eb93
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0050eb28
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x50c0e4]
call fcn.0050f9f8
mov dword [0x5a2b38], eax
mov eax, dword [ebp - 4]
call fcn.0050e9b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ebb0
lea eax, [ebp - 8]
call fcn.00405e98
ret
Function at 0x50ec48
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x50ec5b
or esi, 2
test dl, dl
je 0x50ec64
or esi, 0
jmp 0x50ec67
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret

Function at 0x50f884
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004048e4
xor eax, eax
push ebp
push 0x50f9dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x50becc]
call fcn.00418704
test eax, eax
jl 0x50f8eb
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0050ec2c
and eax, 0x7f
mov eax, dword [eax*4 + 0x5a2ad0]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x50f94e
mov eax, dword [ebx]
call fcn.004046f4
test eax, eax
jle 0x50f94e
mov eax, dword [ebx]
call fcn.004046f4
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x50f912
mov eax, ebx
mov edx, 0x50f9f4
call fcn.004046fc
mov eax, dword [ebx]
call fcn.004046f4
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.0040525c
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.0050eb28
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x50f999
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x5a2d08]
call fcn.00406378
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040a0bc
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404488
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x407c34]
call fcn.0040ccdc
call fcn.00403dcc
mov eax, dword [ebp - 8]
call fcn.0050f7fc
mov ebx, eax
test edi, edi
je 0x50f9ae
mov eax, edi
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50f9e3
lea eax, [ebp - 0x1c]
call fcn.00404434
lea eax, [ebp - 0x18]
call fcn.00405e98
lea eax, [ebp - 0x14]
call fcn.00404434
lea eax, [ebp - 4]
call fcn.00404434
ret
Function at 0x510a68
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
test dl, dl
je 0x510a7f
add esp, 0xfffffff0
call fcn.00403964
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004571c0
xor eax, eax
mov dword [ebx + 0x340], eax
xor edx, edx
mov eax, ebx
call fcn.00457cbc
mov al, byte [0x510b58]
mov byte [ebx + 0x344], al
mov byte [ebx + 0x244], 1
mov byte [ebx + 0x34d], 1
mov byte [ebx + 0x34e], 0
xor eax, eax
mov dword [ebx + 0x350], eax
xor eax, eax
mov dword [ebx + 0x354], eax
mov byte [ebx + 0x359], 0
mov byte [ebx + 0x35a], 1
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x510b5c
call sub.shell32.dll_SHGetFileInfoA
mov dword [ebx + 0x348], eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x50c3a4]
call fcn.0051069c
mov esi, eax
mov dword [ebx + 0x35c], esi
mov al, byte [esi + 0x24]
or al, byte [0x510b60]
mov byte [esi + 0x24], al
lea eax, [ebx + 0x338]
mov edx, 0x510b6c
call fcn.00404488
mov byte [ebx + 0x34c], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x510b4f
call fcn.004039bc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5110dc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x511246
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5a3398]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x5a3398]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.004a0b94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00456dcc
xor edx, edx
push ebp
push 0x511229
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x511199
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00405e98
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.0050f244
push eax
mov eax, dword [0x5a311c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x51118f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00403e78
jmp 0x511230
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5111d5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.004569ac
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00510f6c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x5111b1
push 0
mov edx, 0x510f04
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00456564
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511230
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00456e18
mov eax, dword [0x5a3398]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.004a0b94
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51124d
lea eax, [ebp - 0x10]
call fcn.00405e98
ret

Function at 0x5121a0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
test dl, dl
je 0x5121b7
add esp, 0xfffffff0
call fcn.00403964
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0046ba38
xor eax, eax
mov dword [ebx + 0x2b8], eax
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x512258
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
mov dword [ebx + 0x2a0], esi
lea eax, [ebx + 0x2a4]
push eax
lea eax, [ebx + 0x2a8]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIconSize
mov byte [ebx + 0x2c6], 0
xor edx, edx
mov eax, ebx
call fcn.0046bdd8
mov al, byte [0x51225c]
mov byte [ebx + 0x2c4], al
lea eax, [ebx + 0x2b4]
mov edx, 0x512268
call fcn.00404488
mov byte [ebx + 0x2c5], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x51224f
call fcn.004039bc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5130d0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
test dl, dl
je 0x5130e7
add esp, 0xfffffff0
call fcn.00403964
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0045f9a8
xor eax, eax
mov dword [esi + 0x380], eax
mov dl, 1
mov eax, esi
call fcn.00460814
mov byte [esi + 0x387], 1
mov al, byte [0x5131d0]
mov byte [esi + 0x389], al
mov byte [esi + 0x384], 1
mov byte [esi + 0x386], 1
mov byte [esi + 0x385], 0
mov dl, 1
mov eax, dword [0x41a0e8]
call fcn.004035d0
mov dword [esi + 0x3a0], eax
xor eax, eax
mov dword [esi + 0x3a4], eax
mov byte [esi + 0x388], 0
mov byte [esi + 0x3b8], 0
push 0x4001
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x5131d4
call sub.shell32.dll_SHGetFileInfoA
mov dword [esi + 0x390], eax
push 0x4000
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x5131d4
call sub.shell32.dll_SHGetFileInfoA
mov dword [esi + 0x38c], eax
lea eax, [esi + 0x37c]
mov edx, 0x5131e0
call fcn.00404488
xor edx, edx
mov eax, esi
call fcn.00460c70
mov eax, esi
test bl, bl
je 0x5131c8
call fcn.004039bc
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x517b44
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, edx
push esp
and eax, 0x7f
mov eax, dword [eax*4 + 0x5a2b44]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [esp + 4]
call fcn.00409bcc
add esp, 0x10c
pop ebx
ret

Function at 0x518398
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x1c]
call fcn.004048e4
xor eax, eax
push ebp
push 0x5184ae
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x1c], 0
jne 0x5183d1
lea edx, [ebp + 0x1c]
mov eax, ebx
call fcn.00409728
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402f70
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
mov dword [ebp - 0x34], edi
mov eax, ebx
call fcn.004048f4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.004048f4
mov dword [ebp - 0x2c], eax
cmp dword [ebp + 0x1c], 0
je 0x518417
mov eax, dword [ebp + 0x1c]
call fcn.004048f4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x518439
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
jmp 0x518498
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x518492
cmp byte [ebp + 0x14], 0
je 0x518454
push 0xffffffffffffffff
push eax
call sub.user32.dll_WaitForInputIdle
cmp byte [ebp + 0x18], 0
je 0x51847f
mov eax, dword [0x5a311c]
mov eax, dword [eax]
call fcn.004a2ac0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 8]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x51845a
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
mov dword [esi], 0x21
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5184b5
lea eax, [ebp + 0x1c]
call fcn.00404434
ret
Function at 0x5184c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x5186de
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi], 0
je 0x5186bb
mov edx, dword [0x5a3304]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
call fcn.00404740
mov eax, dword [ebp - 0x10]
call fcn.004093a4
test al, al
je 0x5186bb
xor ebx, ebx
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x5185c7
lea eax, [ebp - 0xc]
mov edx, dword [esi + 0x14]
call fcn.004044cc
cmp dword [ebp - 0xc], 0
je 0x5186bb
mov edx, dword [ebp - 0xc]
mov eax, 0x5186f4
call fcn.00404a38
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5186bb
mov ecx, dword [ebp - 8]
dec ecx
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.00404994
mov edx, dword [ebp - 0xc]
mov eax, 0x518700
call fcn.00404a38
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x518581
mov eax, dword [ebp - 0xc]
call fcn.004046f4
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404994
mov edx, dword [ebp - 0xc]
mov eax, 0x51870c
call fcn.00404a38
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5185ac
mov eax, dword [ebp - 0xc]
call fcn.004046f4
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404994
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00518264
cmp dword [ebp - 4], 0
jne 0x5185c1
mov bl, 1
jmp 0x5185cc
cmp dword [esi + 0x1c], 0
jmp 0x5185cc
dec eax
jne 0x5185cc
mov bl, 1
test bl, bl
je 0x5186bb
cmp byte [esi + 0x20], 0
je 0x518633
cmp byte [esi + 0x2c], 0
je 0x518611
push 0x44
mov eax, dword [esi + 0x24]
call fcn.004048f4
push eax
mov eax, dword [esi + 0x28]
call fcn.004048f4
mov edx, eax
mov eax, dword [0x5a311c]
mov eax, dword [eax]
pop ecx
call fcn.004a2dfc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jne 0x5186bb
jmp 0x518633
push 0x40
mov eax, dword [esi + 0x24]
call fcn.004048f4
push eax
mov eax, dword [esi + 0x28]
call fcn.004048f4
mov edx, eax
mov eax, dword [0x5a311c]
mov eax, dword [eax]
pop ecx
call fcn.004a2dfc
cmp byte [esi + 0xc], 0
jne 0x518676
push 1
mov eax, dword [esi + 8]
call fcn.004048f4
push eax
mov eax, dword [esi + 4]
call fcn.004048f4
push eax
mov edx, dword [0x5a3304]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, dword [esi]
call fcn.00404740
mov eax, dword [ebp - 0x14]
call fcn.004048f4
push eax
push 0x518710
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x5186bb
mov edx, dword [0x5a3304]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
mov ecx, dword [esi + 8]
call fcn.00404740
mov eax, dword [ebp - 0x18]
push eax
push 1
push 1
push 1
push 0
lea eax, [ebp - 8]
push eax
mov edx, dword [0x5a3304]
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
mov ecx, dword [esi]
call fcn.00404740
mov edx, dword [ebp - 0x1c]
mov ecx, dword [esi + 4]
mov eax, 0x518720
call fcn.00518398
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5186e5
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00404458
lea eax, [ebp - 4]
call fcn.00404434
ret