joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a4788
Capabilities:
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4a479e
add esp, 0xfffffff0
call fcn.00404a10
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4a48de
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [edi + 4]
mov edx, esi
call fcn.00405664
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040b098
mov edx, dword [ebp - 4]
lea eax, [edi + 8]
mov ecx, 0x4a490c
call fcn.00405928
mov dl, 1
mov eax, dword [0x41ab48]
call fcn.0040467c
mov dword [edi + 0x10], eax
mov dl, 1
mov eax, dword [0x41ab48]
call fcn.0040467c
mov dword [edi + 0x14], eax
mov dl, 1
mov eax, dword [0x41ab48]
call fcn.0040467c
mov dword [edi + 0x18], eax
mov dl, 1
mov eax, dword [0x41ab48]
call fcn.0040467c
mov dword [edi + 0x1c], eax
mov dl, 1
mov eax, dword [0x41ab48]
call fcn.0040467c
mov dword [edi + 0x20], eax
mov byte [edi + 0x34], 0
mov eax, dword [0x639780]
mov eax, dword [eax]
call fcn.00405aa0
push eax
push 0
push 0x4a4918
push 0x4a4920
call sub.kernel32.dll_GetPrivateProfileIntA
mov esi, eax
mov eax, esi
cdq
push edx
push eax
call fcn.0040d1a4
call fcn.004035e4
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
test edx, edx
jge 0x4a4868
neg eax
adc edx, 0
neg edx
cmp edx, 0
jne 0x4a4874
cmp eax, 0xf
jb 0x4a48bd
jmp 0x4a4876
jl 0x4a48bd
mov eax, dword [edi + 8]
call fcn.00405aa0
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x639780]
mov eax, dword [eax]
call fcn.00405aa0
push eax
call fcn.0040d1a4
call fcn.004035e4
push edx
push eax
lea eax, [ebp - 8]
call fcn.0040a7a8
mov eax, dword [ebp - 8]
call fcn.00405aa0
push eax
push 0x4a4918
push 0x4a4920
call sub.kernel32.dll_WritePrivateProfileStringA
mov eax, edi
mov edx, dword [eax]
call dword [edx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a48e5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405634
ret

Function at 0x4a61a8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403b9c
ret

Function at 0x4ae8b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4ae90e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004ae8a4
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004ac194
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004abcac
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae915
lea eax, [ebp - 4]
call fcn.00405610
ret
Function at 0x4d1cac
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4d1cda
mov eax, ebx
call fcn.004d2760
cmp dword [ebx + 0x40], 0
je 0x4d1cd3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4d1d4b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4d1d3d
cmp dword [ebx + 8], 0
je 0x4d1cfc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4d1d0e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4d1d3d
cmp dword [ebx + 8], 0
je 0x4d1cef
cmp eax, 3
je 0x4d1d21
dec eax
jne 0x4d1cef
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4d1cef
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4d1cef
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4d1d69
cmp dword [ebx + 0x14], 0xcc
je 0x4d1d69
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004d1d74
pop ebx
ret
Function at 0x4eb9ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4eba5d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x637d54]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4eba47
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004eb9dc
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4eb7d8]
call fcn.004eba84
mov dword [0x637db8], eax
mov eax, dword [ebp - 4]
call fcn.004eb98c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eba64
lea eax, [ebp - 8]
call fcn.00407514
ret

Function at 0x4ed660
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4ed71a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405e18
mov eax, dword [0x63a034]
cmp dword [eax], 2
jne 0x4ed6cf
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00406254
mov eax, dword [ebx]
call fcn.00405fd0
push eax
mov eax, dword [ebx]
call fcn.00405fc0
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405fd0
mov edx, eax
dec edx
mov eax, ebx
call fcn.00406254
jmp 0x4ed701
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040b8b4
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405fb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed721
lea eax, [ebp - 0x3f0]
call fcn.00405610
ret
Function at 0x509e24
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x509e3c
mov eax, ebx
call fcn.005096e8
cmp dword [ebx + 0x68], 0
jne 0x509e49
mov eax, ebx
call fcn.00509670
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x10]
mov eax, ebx
call fcn.005094f0
lea eax, [esp + 0x10]
xor edx, edx
call fcn.00553734
cmp eax, dword [esp]
je 0x509eb7
lea eax, [esp + 0x10]
xor edx, edx
call fcn.00553748
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x509e93
adc edx, 0
push edx
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00553734
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x509eac
adc edx, 0
push edx
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_InflateRect
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x509ed2
push 3
mov eax, dword [esi + 0x10]
call fcn.0045e79c
push eax
call sub.user32.dll_GetWindow
mov esi, eax
jmp 0x509edf
push 3
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x68]
call fcn.004728e0
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.0047291c
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.00455d9c
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00455dd0
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.0041b7b4
mov eax, ebp
mov edx, dword [0x6397d4]
mov byte [edx + 2], al
mov eax, dword [0x6397d4]
mov byte [eax], 0
mov eax, dword [0x6397d4]
mov byte [eax + 1], 0
mov eax, dword [0x6397d4]
mov byte [eax + 3], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0045e79c
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0045e79c
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0045e79c
push eax
call sub.user32.dll_SetWindowLongA
push 2
mov eax, dword [0x6397d4]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.00434af4
call fcn.0042fee8
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0045e79c
push eax
mov eax, dword [0x639788]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.0045e79c
push eax
call sub.user32.dll_ShowWindow
push 0
push esi
call sub.user32.dll_ReleaseDC
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5111f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x641f6c
test esi, esi
jne 0x51120a
xor eax, eax
jmp 0x5112fb
cmp dword [ebp], 0
jne 0x511215
call fcn.00511180
xor ebx, 0xffffffff
cmp edi, 8
jb 0x5112d5
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x511221
test edi, edi
jbe 0x5112f6
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x5112d9
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5320dc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.005320c8
test eax, eax
jne 0x5320fd
mov eax, esi
call fcn.00405610
jmp 0x53218e
mov eax, ebx
call fcn.00532224
test al, al
je 0x532143
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.00405700
test edi, edi
je 0x53213a
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
jmp 0x53218e
mov eax, esi
call fcn.00405610
jmp 0x53218e
mov ebp, dword [ebx + 0x70]
test ebp, ebp
je 0x532187
mov eax, dword [ebp + 0x250]
call fcn.0041e028
test eax, eax
jle 0x532175
mov eax, dword [ebx + 0x70]
mov eax, dword [eax + 0x250]
mov edx, edi
call fcn.004bf734
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.00405664
jmp 0x53218e
mov eax, esi
mov edx, dword [ebx + 0x70]
mov edx, dword [edx + 0x258]
call fcn.00405664
jmp 0x53218e
mov eax, esi
call fcn.00405610
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x552474
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, eax
mov ebx, dword [ebp + 8]
add ebx, 0xffffffc4
mov esi, dword [ebp + 8]
add esi, 0xffffffbc
xor eax, eax
push ebp
push 0x552627
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.00434af4
mov eax, dword [eax + 0xc]
mov edx, dword [esi]
mov edx, dword [edx + 0x30]
mov edx, dword [edx + 0x70]
mov edx, dword [edx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x48]
call fcn.0044d538
call fcn.004eb2b8
mov edx, dword [ebp + 8]
mov dword [edx - 0x4c], eax
mov eax, dword [ebp + 8]
cmp dword [eax - 0x4c], 0
je 0x5524f8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x4c]
mov eax, dword [eax + 0x68]
call fcn.0042ecdc
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.00434af4
mov eax, dword [eax + 0xc]
pop edx
call fcn.0042ece4
mov eax, dword [ebp + 8]
mov dword [eax - 0x50], ebx
lea edx, [ebp - 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042ebb0
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.0040b734
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x50]
push eax
push 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.00434af4
call fcn.0042fee8
push eax
call sub.gdi32.dll_GetObjectA
mov dword [ebx + 8], edi
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042ec24
mov dword [ebx], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042ec60
test al, 8
setne al
mov byte [ebx + 0x16], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042ec60
test al, 2
setne al
mov byte [ebx + 0x14], al
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042ec60
test al, 4
setne al
mov byte [ebx + 0x15], al
mov dword [ebx + 0x10], 0x190
mov eax, dword [esi]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 0x10]
call fcn.0042ecdc
mov byte [ebx + 0x17], al
xor eax, eax
mov dword [ebx + 4], eax
mov byte [ebx + 0x18], 0
mov byte [ebx + 0x19], 0
mov eax, dword [ebx + 8]
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x1b], 0
mov byte [ebx + 0x1a], 0
push ebx
call sub.gdi32.dll_CreateFontIndirectA
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.00434af4
mov eax, dword [eax + 0xc]
pop edx
call fcn.0042eb54
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.00434af4
mov eax, dword [eax + 0xc]
mov edx, dword [ebp + 8]
imul edx, dword [edx - 0x54], 0x23
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x94]
mov edx, dword [ecx + edx*4 + 0xc]
call fcn.0042e8d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55262e
lea eax, [ebp - 4]
call fcn.00405610
ret
Function at 0x553b64
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x639cd4]
mov eax, dword [eax]
call fcn.00475bd8
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, esi
jb 0x553b6f
pop esi
pop ebx
ret

Function at 0x5540d8
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.0040ace0
test al, al
je 0x55415f
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00403b9c
or esi, 0x100
test esi, esi
jns 0x554113
call fcn.00404574
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00405aa0
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x55415f
mov dl, 1
mov eax, dword [0x42d99c]
call fcn.00436234
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00436608
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x55415f
mov eax, esp
call fcn.00410e78
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret

Function at 0x55527c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x555333
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405aa0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x5552be
call fcn.0040500c
jmp 0x55533a
mov eax, ebx
call fcn.00402fa8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00405aa0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x5552e7
call fcn.0040500c
jmp 0x55533a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x555348
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x555308
call fcn.0040500c
jmp 0x55533a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55533a
mov eax, dword [ebp - 8]
call fcn.00402fc4
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x555594
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5555fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00403b9c
test ebx, ebx
jne 0x5555d1
mov word [ebp - 2], 0
lea ebx, [ebp - 2]
or esi, 0x4008
push esi
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push ebx
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x160]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x555608
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55588c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
push 0x5559f0
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5559e6
xor eax, eax
push ebp
push 0x5559df
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x5559fc
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
push 0x4000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x5559fc
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
push 0x8000
push 0x10
push 0x10
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
push ebx
push 0xffffffffffffffff
push esi
call sub.comctl32.dll_ImageList_ReplaceIcon
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
push ebx
push 0xffffffffffffffff
push edi
call sub.comctl32.dll_ImageList_ReplaceIcon
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x10
push 0x10
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
push ebx
push 0xffffffffffffffff
push esi
call sub.comctl32.dll_ImageList_ReplaceIcon
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
push ebx
push 0xffffffffffffffff
push edi
call sub.comctl32.dll_ImageList_ReplaceIcon
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
mov byte [0x637fa4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5559e6
cmp dword [ebp - 4], 0
je 0x5559de
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55b9c4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x55b9cc
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x55bb2f
push dword fs:[eax]
mov dword fs:[eax], esp
test dl, dl
je 0x55ba2d
lea edx, [ebp - 8]
mov eax, dword [0x639758]
call fcn.00407a10
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00559090
cmp ebx, 1
jbe 0x55ba64
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x55bb48
call fcn.0040c140
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004058dc
jmp 0x55ba64
lea eax, [ebp - 4]
mov edx, 0x55bb58
call fcn.004056a8
cmp ebx, 1
jbe 0x55ba64
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x55bb68
call fcn.0040c140
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.004058dc
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
call fcn.00405928
mov eax, dword [ebp - 0x1c]
call fcn.00405aa0
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x55baf7
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
jne 0x55ba9c
mov bl, 1
jmp 0x55bb07
push 0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040e83c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [0x639dd0]
call fcn.00407a10
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00559090
mov eax, dword [ebp - 0x28]
mov ecx, 1
pop edx
call fcn.005567dc
mov eax, dword [ebp - 0x20]
movzx ecx, word [0x55bb6c]
xor edx, edx
call fcn.00446fac
mov bl, 2
jmp 0x55bb07
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp - 4]
call fcn.00405664
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55bb36
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.00405634
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405634
ret

Function at 0x55c1d4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x164], ebx
mov ebx, ecx
mov esi, eax
xor eax, eax
push ebp
push 0x55c26e
push dword fs:[eax]
mov dword fs:[eax], esp
test edx, 0x40000000
jne 0x55c220
lea edx, [ebp - 0x164]
mov eax, dword [0x639dcc]
call fcn.00407a10
mov eax, dword [ebp - 0x164]
mov edx, ebx
call fcn.00559090
jmp 0x55c255
push 0x408
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push esi
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x55c24e
mov eax, ebx
lea edx, [ebp - 0x50]
mov ecx, 0x50
call fcn.00405880
jmp 0x55c255
mov eax, ebx
call fcn.00405610
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c275
lea eax, [ebp - 0x164]
call fcn.00405610
ret