joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3af4
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a0], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c3c45
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4c3b40
cmp dword [ebp - 0x8c], 1
je 0x4c3b44
xor ebx, ebx
jmp 0x4c3b46
mov bl, 1
mov dl, 1
mov eax, dword [0x443cf4]
call fcn.00443dc4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c3c20
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.00443e64
test bl, bl
je 0x4c3b83
mov edx, 0x4c3c5c
mov eax, dword [ebp - 4]
call fcn.00443fec
jmp 0x4c3b90
mov edx, 0x4c3c90
mov eax, dword [ebp - 4]
call fcn.00443fec
lea ecx, [ebp - 0x1a0]
mov edx, 0x4c3cc8
mov eax, dword [ebp - 4]
call fcn.0044421c
mov edx, dword [ebp - 0x1a0]
lea eax, [esi + 0x1c]
call fcn.00404488
lea ecx, [ebp - 0x1a4]
mov edx, 0x4c3ce0
mov eax, dword [ebp - 4]
call fcn.0044421c
mov edx, dword [ebp - 0x1a4]
lea eax, [esi + 0x20]
call fcn.00404488
mov eax, dword [ebp - 4]
call fcn.00443e34
cmp dword [esi + 0x1c], 0
jne 0x4c3c0a
mov dword [ebp - 8], 0xff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x19c]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [esi + 0x1c]
lea edx, [ebp - 0x19c]
mov ecx, pe_nt_image_headers32
call fcn.004046a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3c27
mov eax, dword [ebp - 4]
call fcn.00403600
ret
Function at 0x4d36c4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4195e0]
call fcn.00404dcc
xor eax, eax
push ebp
push 0x4d3808
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x585954], 0
jne 0x4d3717
mov ecx, dword [0x586c94]
mov dl, 1
mov eax, dword [0x407c04]
call fcn.0040cd20
call fcn.00403dcc
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f70
mov eax, ebx
call fcn.00404c9c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4d3818
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405e98
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404cac
test eax, eax
jle 0x4d37af
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4d37a8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004046bc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004046a4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408ab0
test eax, eax
jne 0x4d37a8
mov ebx, 0x15
jmp 0x4d37b4
mov ebx, 0x10
jmp 0x4d37b4
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x585954]
call fcn.004d361c
mov eax, dword [ebp - 8]
call fcn.004d361c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405eb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d380f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404458
lea eax, [ebp - 0x10]
mov edx, dword [0x4195e0]
call fcn.00404e9c
ret

Function at 0x4d8808
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4d8836
mov eax, ebx
call fcn.004d92bc
cmp dword [ebx + 0x40], 0
je 0x4d882f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4d88a7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4d8899
cmp dword [ebx + 8], 0
je 0x4d8858
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4d886a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4d8899
cmp dword [ebx + 8], 0
je 0x4d884b
cmp eax, 3
je 0x4d887d
dec eax
jne 0x4d884b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4d884b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4d884b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4d88c5
cmp dword [ebx + 0x14], 0xcc
je 0x4d88c5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004d88d0
pop ebx
ret
Function at 0x4f3a9c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x222], 0
je 0x4f3ac3
mov ecx, edi
mov dl, 1
mov eax, dword [0x4f28e0]
call fcn.004f2944
mov dword [edi + 0x294], eax
jmp 0x4f3bcc
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
cmp byte [edi + 0x22b], 0
je 0x4f3b04
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp dx, word [edi + 0x226]
jbe 0x4f3af9
mov edx, eax
sub dl, byte [edi + 0x226]
mov eax, edi
call fcn.004f304c
jmp 0x4f3b3a
xor edx, edx
mov eax, edi
call fcn.004f304c
jmp 0x4f3b3a
movzx edx, word [edi + 0x226]
mov ecx, 0x64
sub ecx, edx
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp ecx, edx
jle 0x4f3b31
mov edx, eax
add dl, byte [edi + 0x226]
mov eax, edi
call fcn.004f304c
jmp 0x4f3b3a
mov dl, 0x64
mov eax, edi
call fcn.004f304c
cmp byte [edi + 0x22b], 0
je 0x4f3b4c
cmp byte [edi + 0x22a], 0
je 0x4f3b5e
cmp byte [edi + 0x22b], 0
jne 0x4f3b69
cmp byte [edi + 0x22a], 0x64
jne 0x4f3b69
mov bl, byte [edi + 0x224]
xor bl, 1
jmp 0x4f3b99
mov eax, dword [0x5870e8]
mov eax, dword [eax]
call fcn.004a1e38
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
movzx edx, word [edi + 0x228]
cmp eax, edx
ja 0x4f3b99
cmp byte [edi + 0x224], 0
jne 0x4f3b99
cmp byte [edi + 0x2a0], 0
je 0x4f3b69
test bl, bl
jne 0x4f3bb3
cmp byte [edi + 0x224], 0
jne 0x4f3bb3
cmp byte [edi + 0x2a0], 0
je 0x4f3ac5
cmp byte [edi + 0x2a0], 0
jne 0x4f3bc5
cmp byte [edi + 0x224], 0
jne 0x4f3bcc
mov eax, edi
call fcn.004f3ec0
pop edi
pop esi
pop ebx
ret

Function at 0x4f5830
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4f5881
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4f5868
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4f5858
jmp 0x4f5881
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4f5869
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x522298
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, edx
push esp
and eax, 0x7f
mov eax, dword [eax*4 + 0x586acc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [esp + 4]
call fcn.00409b54
add esp, 0x10c
pop ebx
ret

Function at 0x522680
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x1c]
call fcn.004048e4
xor eax, eax
push ebp
push 0x522796
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x1c], 0
jne 0x5226b9
lea edx, [ebp + 0x1c]
mov eax, ebx
call fcn.004096b0
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402f70
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
mov dword [ebp - 0x34], edi
mov eax, ebx
call fcn.004048f4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.004048f4
mov dword [ebp - 0x2c], eax
cmp dword [ebp + 0x1c], 0
je 0x5226ff
mov eax, dword [ebp + 0x1c]
call fcn.004048f4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x522721
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
jmp 0x522780
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x52277a
cmp byte [ebp + 0x14], 0
je 0x52273c
push 0xffffffffffffffff
push eax
call sub.user32.dll_WaitForInputIdle
cmp byte [ebp + 0x18], 0
je 0x522767
mov eax, dword [0x5870e8]
mov eax, dword [eax]
call fcn.004a1e38
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 8]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x522742
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
mov dword [esi], 0x21
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52279d
lea eax, [ebp + 0x1c]
call fcn.00404434
ret
Function at 0x5227a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x5229c6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi], 0
je 0x5229a3
mov edx, dword [0x5872d0]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
call fcn.00404740
mov eax, dword [ebp - 0x10]
call fcn.00409374
test al, al
je 0x5229a3
xor ebx, ebx
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x5228af
lea eax, [ebp - 0xc]
mov edx, dword [esi + 0x14]
call fcn.004044cc
cmp dword [ebp - 0xc], 0
je 0x5229a3
mov edx, dword [ebp - 0xc]
mov eax, 0x5229dc
call fcn.00404a38
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5229a3
mov ecx, dword [ebp - 8]
dec ecx
lea eax, [ebp - 0xc]
mov edx, 1
call fcn.00404994
mov edx, dword [ebp - 0xc]
mov eax, 0x5229e8
call fcn.00404a38
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x522869
mov eax, dword [ebp - 0xc]
call fcn.004046f4
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404994
mov edx, dword [ebp - 0xc]
mov eax, 0x5229f4
call fcn.00404a38
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x522894
mov eax, dword [ebp - 0xc]
call fcn.004046f4
mov ecx, eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404994
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0052254c
cmp dword [ebp - 4], 0
jne 0x5228a9
mov bl, 1
jmp 0x5228b4
cmp dword [esi + 0x1c], 0
jmp 0x5228b4
dec eax
jne 0x5228b4
mov bl, 1
test bl, bl
je 0x5229a3
cmp byte [esi + 0x20], 0
je 0x52291b
cmp byte [esi + 0x2c], 0
je 0x5228f9
push 0x44
mov eax, dword [esi + 0x24]
call fcn.004048f4
push eax
mov eax, dword [esi + 0x28]
call fcn.004048f4
mov edx, eax
mov eax, dword [0x5870e8]
mov eax, dword [eax]
pop ecx
call fcn.004a2174
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jne 0x5229a3
jmp 0x52291b
push 0x40
mov eax, dword [esi + 0x24]
call fcn.004048f4
push eax
mov eax, dword [esi + 0x28]
call fcn.004048f4
mov edx, eax
mov eax, dword [0x5870e8]
mov eax, dword [eax]
pop ecx
call fcn.004a2174
cmp byte [esi + 0xc], 0
jne 0x52295e
push 1
mov eax, dword [esi + 8]
call fcn.004048f4
push eax
mov eax, dword [esi + 4]
call fcn.004048f4
push eax
mov edx, dword [0x5872d0]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, dword [esi]
call fcn.00404740
mov eax, dword [ebp - 0x14]
call fcn.004048f4
push eax
push 0x5229f8
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x5229a3
mov edx, dword [0x5872d0]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
mov ecx, dword [esi + 8]
call fcn.00404740
mov eax, dword [ebp - 0x18]
push eax
push 1
push 1
push 1
push 0
lea eax, [ebp - 8]
push eax
mov edx, dword [0x5872d0]
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
mov ecx, dword [esi]
call fcn.00404740
mov edx, dword [ebp - 0x1c]
mov ecx, dword [esi + 4]
mov eax, 0x522a08
call fcn.00522680
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5229cd
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00404458
lea eax, [ebp - 4]
call fcn.00404434
ret
Function at 0x5252f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004048e4
mov eax, dword [ebp - 8]
call fcn.004048e4
mov eax, dword [ebp + 0x14]
call fcn.004048e4
mov eax, dword [ebp + 0x10]
call fcn.004048e4
xor eax, eax
push ebp
push 0x52551e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 0xc], 0
je 0x525355
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0051f474
jmp 0x52538a
push esi
mov eax, dword [ebp + 0x10]
call fcn.004048f4
push eax
mov eax, dword [ebp + 0x14]
call fcn.004048f4
push eax
mov eax, dword [ebp - 8]
call fcn.004048f4
push eax
mov eax, dword [ebp - 4]
call fcn.004048f4
push eax
mov eax, ebx
call fcn.004875c8
push eax
call sub.shell32.dll_ShellExecuteA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x20
jg 0x5254ec
lea eax, [ebp - 0x10]
mov edx, 0x525538
call fcn.004044cc
mov eax, dword [ebp - 0xc]
cmp eax, 0x20
ja case.0x5253b3.0
mov al, byte [eax + 0x5253ba]
jmp dword [eax*4 + 0x5253db]
lea eax, [ebp - 0x10]
mov edx, 0x525550
call fcn.004044cc
jmp case.0x5253b3.0
lea eax, [ebp - 0x10]
mov edx, 0x52558c
call fcn.004044cc
jmp case.0x5253b3.0
lea eax, [ebp - 0x10]
mov edx, 0x5255b8
call fcn.004044cc
jmp case.0x5253b3.0
lea eax, [ebp - 0x10]
mov edx, 0x5255e4
call fcn.004044cc
jmp case.0x5253b3.0
lea eax, [ebp - 0x10]
mov edx, 0x525630
call fcn.004044cc
jmp case.0x5253b3.0
lea eax, [ebp - 0x10]
mov edx, 0x525674
call fcn.004044cc
jmp case.0x5253b3.0
lea eax, [ebp - 0x10]
mov edx, 0x5256b0
call fcn.004044cc
jmp case.0x5253b3.0
lea eax, [ebp - 0x10]
mov edx, 0x525718
call fcn.004044cc
jmp case.0x5253b3.0
lea eax, [ebp - 0x10]
mov edx, 0x52573c
call fcn.004044cc
jmp case.0x5253b3.0
lea eax, [ebp - 0x10]
mov edx, 0x525790
call fcn.004044cc
jmp case.0x5253b3.0
lea eax, [ebp - 0x10]
mov edx, 0x5257cc
call fcn.004044cc
jmp case.0x5253b3.0
lea eax, [ebp - 0x10]
mov edx, 0x52581c
call fcn.004044cc
jmp case.0x5253b3.0
lea eax, [ebp - 0x10]
mov edx, 0x52585c
call fcn.004044cc
mov eax, dword [ebp - 0x10]
call fcn.0051c7c0
xor ebx, ebx
jmp 0x5254ee
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x525525
lea eax, [ebp - 0x10]
call fcn.00404434
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404458
lea eax, [ebp + 0x10]
mov edx, 2
call fcn.00404458
ret
Function at 0x528914
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, edx
mov ebx, eax
mov eax, edi
call fcn.00404434
mov eax, ebx
call fcn.00409374
test al, al
je 0x528990
push esp
mov eax, ebx
call fcn.004048f4
mov ebp, eax
push ebp
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [esp], eax
cmp dword [esp], 0
jbe 0x528990
mov eax, dword [esp]
call fcn.0040884c
mov esi, eax
push esi
mov eax, dword [esp + 4]
push eax
push 0
push ebp
call sub.version.dll_GetFileVersionInfoA
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0x528998
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x528986
mov eax, edi
mov edx, dword [esp + 8]
call fcn.0040462c
mov edx, dword [esp]
mov eax, esi
call fcn.0040280c
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x533e40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x533eb1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x586bb0]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x533e9b
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00533e30
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x532614]
call fcn.00534d00
mov dword [0x586c18], eax
mov eax, dword [ebp - 4]
call fcn.00533cbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533eb8
lea eax, [ebp - 8]
call fcn.00405e98
ret

Function at 0x533f50
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x533f63
or esi, 2
test dl, dl
je 0x533f6c
or esi, 0
jmp 0x533f6f
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret
Function at 0x534b8c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004048e4
xor eax, eax
push ebp
push 0x534ce4
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x5323fc]
call fcn.0041868c
test eax, eax
jl 0x534bf3
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.00533f34
and eax, 0x7f
mov eax, dword [eax*4 + 0x586bb0]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x534c56
mov eax, dword [ebx]
call fcn.004046f4
test eax, eax
jle 0x534c56
mov eax, dword [ebx]
call fcn.004046f4
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x534c1a
mov eax, ebx
mov edx, 0x534cfc
call fcn.004046fc
mov eax, dword [ebx]
call fcn.004046f4
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.0040525c
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.00533e30
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x534ca1
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x586cd4]
call fcn.00406378
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040a044
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404488
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x407c04]
call fcn.0040cc64
call fcn.00403dcc
mov eax, dword [ebp - 8]
call fcn.00534b04
mov ebx, eax
test edi, edi
je 0x534cb6
mov eax, edi
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534ceb
lea eax, [ebp - 0x1c]
call fcn.00404434
lea eax, [ebp - 0x18]
call fcn.00405e98
lea eax, [ebp - 0x14]
call fcn.00404434
lea eax, [ebp - 4]
call fcn.00404434
ret

Function at 0x5358c8
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x3c
call fcn.00402f70
mov dword [esp], 0x3c
mov eax, dword [0x5870e8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc
mov eax, dword [ebx + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 5
push esp
call sub.shell32.dll_ShellExecuteExA
add esp, 0x3c
pop ebx
ret
Function at 0x5363e4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53654e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x587364]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x587364]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0049ff0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00456db8
xor edx, edx
push ebp
push 0x536531
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x5364a1
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00405e98
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.0053454c
push eax
mov eax, dword [0x5870e8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x536497
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00403e78
jmp 0x536538
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5364dd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00456998
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00536274
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x5364b9
push 0
mov edx, 0x53620c
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00456550
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x536538
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00456e04
mov eax, dword [0x587364]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.0049ff0c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x536555
lea eax, [ebp - 0x10]
call fcn.00405e98
ret
Function at 0x543710
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
lea eax, [ebp - 0x158]
mov edx, dword [0x407be4]
call fcn.00404dcc
xor eax, eax
push ebp
push 0x543965
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x15c]
mov ecx, 0x54397c
mov edx, ebx
call fcn.00404740
mov eax, dword [ebp - 0x15c]
lea ecx, [ebp - 0x158]
mov edx, 0x3f
call fcn.00409530
test eax, eax
jne 0x543936
mov eax, dword [ebp - 0x14c]
mov edx, 0x54398c
call fcn.00404840
je 0x543918
mov eax, dword [ebp - 0x14c]
mov edx, 0x543998
call fcn.00404840
je 0x543918
mov eax, dword [ebp - 0x14c]
mov edx, 0x5439a4
call fcn.00404840
je 0x543918
test byte [ebp - 0x150], 0x10
je 0x543896
push ebx
push 0x5439bc
push dword [ebp - 0x14c]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x160]
call fcn.00409384
test al, al
je 0x543896
push edi
push 0x5439bc
push dword [ebp - 0x14c]
lea eax, [ebp - 0x164]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x164]
call fcn.00409934
push edi
push 0x5439bc
push dword [ebp - 0x14c]
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x168]
push eax
push ebx
push 0x5439bc
push dword [ebp - 0x14c]
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.004047b4
mov edx, dword [ebp - 0x16c]
mov eax, esi
pop ecx
call fcn.00543710
jmp 0x543918
push ebx
push 0x5439bc
push dword [ebp - 0x14c]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x170]
call fcn.00409374
test al, al
je 0x543918
push 0
push edi
push 0x5439bc
push dword [ebp - 0x14c]
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x174]
call fcn.004048f4
push eax
push ebx
push 0x5439bc
push dword [ebp - 0x14c]
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x178]
call fcn.004048f4
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x158]
call fcn.00409580
test eax, eax
je 0x5437a3
lea eax, [ebp - 0x158]
call fcn.004095a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54396c
lea eax, [ebp - 0x178]
mov edx, 8
call fcn.00404458
lea eax, [ebp - 0x158]
mov edx, dword [0x407be4]
call fcn.00404e9c
ret