joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5159d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0xa0
mov dword [ebp - 4], ecx
call ebx
test eax, 0x8000
je 0x5159f5
mov esi, 2
jmp 0x515a0c
push 0xa1
call ebx
mov si, ax
and esi, 0x8000
neg esi
sbb esi, esi
and esi, 3
push 0xa4
call ebx
test eax, 0x8000
je 0x515a21
mov edi, 8
jmp 0x515a38
push 0xa5
call ebx
mov di, ax
and edi, 0x8000
neg edi
sbb edi, edi
and edi, 9
push 0xa2
call ebx
test eax, 0x8000
je 0x515a4d
mov eax, 5
jmp 0x515a60
push 0xa3
call ebx
and eax, 0x8000
neg eax
sbb eax, eax
and eax, 6
cmp esi, 2
je 0x515a98
cmp esi, 3
je 0x515a98
test edi, edi
je 0x515a7c
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [ecx], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x515a8e
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
pop ebx
mov dword [ecx], 0
mov esp, ebp
pop ebp
ret

Function at 0x515ab0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0xa0
mov dword [ebp - 4], ecx
call ebx
test eax, 0x8000
je 0x515ad5
mov esi, 2
jmp 0x515aec
push 0xa1
call ebx
mov si, ax
and esi, 0x8000
neg esi
sbb esi, esi
and esi, 3
push 0xa4
call ebx
test eax, 0x8000
je 0x515b01
mov edi, 8
jmp 0x515b18
push 0xa5
call ebx
mov di, ax
and edi, 0x8000
neg edi
sbb edi, edi
and edi, 9
push 0xa2
call ebx
test eax, 0x8000
je 0x515b2d
mov eax, 5
jmp 0x515b40
push 0xa3
call ebx
and eax, 0x8000
neg eax
sbb eax, eax
and eax, 6
cmp edi, 9
jne 0x515b58
mov ecx, dword [ebp - 4]
lea eax, [edi - 8]
pop edi
pop esi
pop ebx
mov dword [ecx], 0
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x515b6a
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [ecx], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x515b7c
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x515b8e
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x515ba0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0xa0
mov dword [ebp - 4], ecx
call ebx
test eax, 0x8000
je 0x515bc5
mov esi, 2
jmp 0x515bdc
push 0xa1
call ebx
mov si, ax
and esi, 0x8000
neg esi
sbb esi, esi
and esi, 3
push 0xa4
call ebx
test eax, 0x8000
je 0x515bf1
mov edi, 8
jmp 0x515c08
push 0xa5
call ebx
mov di, ax
and edi, 0x8000
neg edi
sbb edi, edi
and edi, 9
push 0xa2
call ebx
test eax, 0x8000
je 0x515c1d
mov eax, 5
jmp 0x515c30
push 0xa3
call ebx
and eax, 0x8000
neg eax
sbb eax, eax
and eax, 6
cmp edi, 8
je 0x515c67
cmp esi, 5
je 0x515c67
mov ecx, dword [ebp - 4]
test esi, esi
je 0x515c4c
pop edi
mov dword [ecx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 5
je 0x515c5c
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ecx], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
pop ebx
mov dword [ecx], 0
mov esp, ebp
pop ebp
ret

Function at 0x515c80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0xa0
mov dword [ebp - 4], ecx
call ebx
test eax, 0x8000
je 0x515ca5
mov esi, 2
jmp 0x515cbc
push 0xa1
call ebx
mov si, ax
and esi, 0x8000
neg esi
sbb esi, esi
and esi, 3
push 0xa4
call ebx
test eax, 0x8000
je 0x515cd1
mov edi, 8
jmp 0x515ce8
push 0xa5
call ebx
mov di, ax
and edi, 0x8000
neg edi
sbb edi, edi
and edi, 9
push 0xa2
call ebx
test eax, 0x8000
je 0x515cfd
mov eax, 5
jmp 0x515d10
push 0xa3
call ebx
and eax, 0x8000
neg eax
sbb eax, eax
and eax, 6
cmp edi, 9
je 0x515d46
cmp esi, 3
je 0x515d46
mov ecx, dword [ebp - 4]
test esi, esi
je 0x515d2c
pop edi
mov dword [ecx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x515d3b
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ecx], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
pop ebx
mov dword [ecx], 0
mov esp, ebp
pop ebp
ret
Function at 0x515d60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0xa0
mov dword [ebp - 4], ecx
call ebx
test eax, 0x8000
je 0x515d85
mov esi, 2
jmp 0x515d9c
push 0xa1
call ebx
mov si, ax
and esi, 0x8000
neg esi
sbb esi, esi
and esi, 3
push 0xa4
call ebx
test eax, 0x8000
je 0x515db1
mov edi, 8
jmp 0x515dc8
push 0xa5
call ebx
mov di, ax
and edi, 0x8000
neg edi
sbb edi, edi
and edi, 9
push 0xa2
call ebx
test eax, 0x8000
jne 0x515ddd
push 0xa3
call ebx
cmp edi, 5
je 0x515e0a
cmp edi, 8
je 0x515e0a
cmp esi, 2
je 0x515e0a
mov eax, dword [ebp - 4]
cmp esi, 5
je 0x515dff
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x517930
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e408
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x517a77
cmp byte [edi + 0x3e], 0
je 0x517a77
push 0xffff
call fcn.00517010
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
sete al
test al, al
je 0x517994
xor al, al
jmp 0x517a79
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmp ecx, 0x10
lea edx, [ebp - 0x28]
mov ecx, dword [edi + 0x38]
cmovae esi, ebx
cmovae edx, ebx
add eax, esi
push eax
push edx
lea eax, [edi + 0x40]
push eax
mov eax, dword [ecx]
call dword [eax + 0x20]
sub eax, 0
je 0x517a06
sub eax, 1
je 0x517a0a
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x517a5d
xor bl, bl
jmp 0x517a5f
mov byte [edi + 0x3e], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, ebx
sub esi, eax
je 0x517a3f
push dword [edi + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, ebx
push 1
push eax
call fcn.00555a0a
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x517a02
cmp byte [edi + 0x3e], 0
je 0x517a5d
test esi, esi
jne 0x5179c7
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.004f8390
jmp 0x5179c4
mov bl, 1
cmp ecx, 0x10
jb 0x517a73
push 1
inc ecx
push ecx
push dword [ebp - 0x28]
call fcn.00403190
add esp, 0xc
mov al, bl
jmp 0x517a79
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret
Function at 0x517e90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570be6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5d3070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0053f79c
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00528f83
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x519240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e6ba
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.00529202
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x519300
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.0054774e
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x5cf958
push eax
call fcn.005477d0
push edi
push esi
call fcn.00529086
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 4

Function at 0x51a570
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
test eax, eax
jne 0x51a57e
pop ebp
ret 8
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.005534f0
add esp, 0x10
pop ebp
ret 8
Function at 0x51aa50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e7d4
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5d3070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.irr::io::CXMLReaderImpl_wchar_t__class_irr::io::IXMLBase_.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 2
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 1
call fcn.0053f7f7
xor ecx, ecx
mov dword [esi + 0x20], eax
mov word [eax], cx
mov byte [ebp - 4], 1
push 2
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 1
call fcn.0053f7f7
xor ecx, ecx
mov dword [esi + 0x2c], eax
add esp, 8
mov word [eax], cx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], ecx
mov word [esi + 0x48], 0x101
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], ecx
mov word [esi + 0x58], 0x101
mov edi, dword [ebp + 8]
mov byte [ebp - 4], 4
test edi, edi
je 0x51ab50
push edi
mov ecx, esi
mov dword [esi + 0x1c], 3
call fcn.0051ae60
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov ecx, esi
call fcn.0051acc0
mov eax, dword [esi + 0xc]
mov dword [esi + 8], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x51ae60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
mov ebx, dword [esi + 8]
add ebx, 4
push ebx
call fcn.0053f7f7
mov edi, eax
add esp, 4
mov eax, dword [esi + 4]
test eax, eax
je 0x51afa8
push eax
lea eax, [ebx - 4]
push eax
push 1
push edi
call fcn.005534f0
add esp, 0x10
test eax, eax
je 0x51afa8
mov dword [edi + ebx - 4], 0
cmp ebx, 4
jl 0x51aef5
mov eax, dword [edi]
cmp eax, 0xfffe0000
jne 0x51aec3
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 4
jmp 0x51aed4
cmp eax, 0xfeff
jne 0x51aef5
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 5
mov eax, ebx
cdq
and edx, 3
add eax, edx
sar eax, 2
push eax
push edi
lea eax, [edi + 4]
push eax
call fcn.0051c5b0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ebx, 2
jl 0x51af44
movzx eax, word [edi]
mov ecx, 0xfffe
cmp ax, cx
jne 0x51af13
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 2
jmp 0x51af27
mov ecx, 0xfeff
cmp ax, cx
jne 0x51af44
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 3
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
push eax
push edi
lea eax, [edi + 2]
push eax
call fcn.0051c660
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ebx, 3
jl 0x51af89
movsx eax, byte [edi]
cmp eax, 0xef
jne 0x51af89
movsx eax, byte [edi + 1]
cmp eax, 0xbb
jne 0x51af89
movsx eax, byte [edi + 2]
cmp eax, 0xbf
jne 0x51af89
mov ecx, dword [ebp - 4]
lea eax, [edi + 3]
push ebx
push edi
push eax
mov dword [ecx + 0x18], 1
call fcn.0051c6e0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
mov ecx, eax
push ebx
push edi
push edi
mov dword [eax + 0x18], 0
call fcn.0051c6e0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
call fcn.0053f7f2
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x526260
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f18c
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d3070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 0
lea eax, [esi + 0x30]
mov dword [esi], vtable.RT::CGraphItemList.0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x5262c4
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x48]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x5262de
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea ecx, [esi + 0x60]
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x5262fe
mov eax, dword [ecx]
jmp 0x526300
mov eax, ecx
xor edx, edx
mov word [eax], dx
mov byte [ebp - 4], 3
push 4
push 0x5a61f0
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], edx
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], edx
call fcn.00402b20
mov dword [esi + 0x78], 0xbf800000
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x527b30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f2cb
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
sete al
test al, al
je 0x527b75
xor al, al
jmp 0x527d06
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.005481a0
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], 0
mov word [ebp - 0x238], ax
cmp word [ebp - 0x21c], ax
jne 0x527bc7
xor ecx, ecx
jmp 0x527bdf
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x527bd0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x238]
call fcn.00402b20
push 1
push 0x5a71f4
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], 0
call fcn.00404380
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x238]
call fcn.00404460
cmp dword [ebp - 0x224], 8
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.KbdLayerDescriptor
push eax
mov dword [ebp - 0x248], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x240], eax
test eax, eax
je 0x527ce5
mov ebx, dword [edi + 8]
mov esi, dword [edi + 4]
cmp esi, ebx
je 0x527c6f
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
add esi, 0xc
cmp esi, ebx
jne 0x527c60
mov eax, dword [edi + 4]
mov dword [edi + 8], eax
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x527cbb
cmp dword [ebp - 0x220], 0
je 0x527cbb
call dword [ebp - 0x240]
cdq
mov edx, dword [eax + 0x10]
or edx, dword [eax + 0x14]
je 0x527cd0
push dword [eax + 0x10]
mov ecx, edi
call fcn.00527de0
jmp 0x527cd0
call dword [ebp - 0x240]
mov eax, dword [eax + 8]
test eax, eax
je 0x527cd0
push eax
mov ecx, edi
call fcn.00527d30
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x527ce5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov bl, 1
jmp 0x527ce7
xor bl, bl
mov ecx, dword [ebp - 0x224]
cmp ecx, 8
jb 0x527d04
push 2
inc ecx
push ecx
push dword [ebp - 0x238]
call fcn.00403190
add esp, 0xc
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 4
Function at 0x543410
Capabilities:
Copy file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 8
jb 0x543420
mov ecx, dword [esi]
jmp 0x543422
mov ecx, esi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x543430
mov edx, dword [edi]
jmp 0x543432
mov edx, edi
xor eax, eax
cmp dword [esp + 0x14], eax
sete al
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x543450
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x543452
xor eax, eax
push str.boost::filesystem::copy_file
push dword [esp + 0x1c]
push esi
push edi
push eax
call fcn.00544100
add esp, 0x14
pop edi
pop esi
ret

Function at 0x543670
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x580e68
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x5436ab
mov eax, dword [edi]
jmp 0x5436ad
mov eax, edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x5436d3
test esi, esi
je 0x5436cc
mov dword [esi], 0
call fcn.00546070
mov dword [esi + 4], eax
mov al, 1
jmp 0x543761
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x64], 0
call fcn.00546070
mov dword [ebp - 0x60], eax
cmp ebx, 0xb7
jne 0x54371f
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.00544eb0
add esp, 0xc
cmp dword [ebp - 0x6c], 3
sete al
test al, al
je 0x54371f
test esi, esi
je 0x54375f
mov dword [esi], 0
call fcn.00546070
jmp 0x54375c
test esi, esi
jne 0x543755
push str.boost::filesystem::create_directory
lea ecx, [ebp - 0x28]
call fcn.004f8520
mov dword [ebp - 4], esi
call fcn.00546070
push eax
push ebx
push edi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00542e20
push 0x5cf010
lea eax, [ebp - 0x5c]
push eax
call fcn.005477d0
call fcn.00546070
mov dword [esi], ebx
mov dword [esi + 4], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret
Function at 0x544980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x14], 8
jb 0x544993
mov eax, dword [esi]
jmp 0x544995
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5449bd
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00544870
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x5449d4
mov dword [edi], 0
call fcn.00546070
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x544a0b
push esi
call fcn.005443d0
add esp, 4
test al, al
je 0x544a00
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret

Function at 0x544c90
Capabilities:
Check if file exists
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x544c9c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x544cda
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x544cda
cmp eax, 3
je 0x544cda
cmp eax, 0x7b
je 0x544cda
cmp eax, 0xf
je 0x544cda
cmp eax, 0x15
je 0x544cda
cmp eax, 0x57
je 0x544cda
cmp eax, 0xa1
je 0x544cda
cmp eax, 0x35
je 0x544cda
xor al, al
ret
mov al, 1
ret

Function at 0x544ce0
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x544cec
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x544d2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x544d2a
cmp eax, 3
je 0x544d2a
cmp eax, 0x7b
je 0x544d2a
cmp eax, 0xf
je 0x544d2a
cmp eax, 0x15
je 0x544d2a
cmp eax, 0x57
je 0x544d2a
cmp eax, 0xa1
je 0x544d2a
cmp eax, 0x35
je 0x544d2a
xor al, al
ret
mov al, 1
ret

Function at 0x544dd0
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 8
jb 0x544de0
mov eax, dword [esi]
jmp 0x544de2
mov eax, esi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x544df0
mov ecx, dword [edi]
jmp 0x544df2
mov ecx, edi
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x544e08
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x544e0a
xor eax, eax
push str.boost::filesystem::rename
push dword [esp + 0x18]
push esi
push edi
push eax
call fcn.00544100
add esp, 0x14
pop edi
pop esi
ret