joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ac4f0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d54ff
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x638fe4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00418413
mov ecx, eax
test ecx, ecx
jne 0x5ac52c
push 0x80004005
call fcn.00402650
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5ac541
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x5ac543
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWARECanonIJNetworkScannerSelectorEX
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
mov edx, str.AppPath
call fcn.005b0e00
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov bl, 1
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5ac5bf
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x5ac5c1
xor bl, bl
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x5ac616
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5ac614
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5ac614
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edx
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5acb90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d556e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x638fe4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
push 0x60ab98
mov dword [ebp - 0x10], 0
call fcn.00403280
mov dword [ebp - 4], 0
mov ecx, 1
mov eax, dword [esi]
mov dword [ebp - 0x10], 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or ecx, eax
jge 0x5acc03
push 0x104
mov ecx, esi
call fcn.00402cf0
push 0x104
push dword [esi]
push 0x20
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov eax, dword [esi]
test eax, eax
jne 0x5acc21
xor ecx, ecx
jmp 0x5acc33
push dword [eax - 8]
push eax
call fcn.0054c667
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x5acc57
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x5acc57
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402650
int3

Function at 0x5acc70
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5591
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x638fe4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00418413
mov ecx, eax
test ecx, ecx
jne 0x5accac
push 0x80004005
call fcn.00402650
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5accc1
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x5accc3
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWARECanonIJNetworkScannerSelectorEX2
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
mov edx, str.AppPath
call fcn.005b0e00
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov bl, 1
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5acd3f
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x5acd41
xor bl, bl
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x5acd96
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5acd94
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5acd94
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edx
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ad830
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0
push 0
push 5
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esi, eax
lea ecx, [ebp - 0xc]
push esi
call fcn.0040a6c0
mov ebx, dword [ebp - 0xc]
push esi
push ebx
push 5
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
call fcn.0054ea10
add esp, 4
test eax, eax
je 0x5ad89e
cmp eax, 1
je 0x5ad89e
cmp eax, 2
je 0x5ad89e
cmp eax, 0x37
je 0x5ad88c
cmp eax, 0x32
jl 0x5ad88c
cmp eax, 0x3c
jl 0x5ad89e
cmp eax, 0x1f4
jl 0x5ad89a
cmp eax, 0x258
jl 0x5ad89e
xor esi, esi
jmp 0x5ad8a3
mov esi, 1
test ebx, ebx
je 0x5ad8b5
mov ecx, dword [ebp - 4]
sub ecx, ebx
sar ecx, 1
push ecx
push ebx
call fcn.00402320
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ad8c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5643
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x638fe4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x10], edi
mov ebx, ecx
call fcn.00418413
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x5ad90b
push 0x80004005
call fcn.00402650
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5ad920
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x5ad922
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWARECanonMy_Image_Garden
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x5ad972
test ebx, ebx
je 0x5ada61
push ecx
push 0x60ab98
mov ecx, ebx
call fcn.00403620
jmp 0x5ada61
lea eax, [ebp - 0x14]
mov edx, str.AppPath
push eax
call fcn.005b0e00
add esp, 4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
push esi
mov dword [ebp - 0x18], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5ad9b2
push eax
push 0x60ab98
lea ecx, [ebp - 0x14]
call fcn.00403620
mov esi, dword [ebp - 0x14]
test ebx, ebx
je 0x5ad9da
push ecx
lea eax, [esi - 0x10]
mov edi, esp
push eax
mov dword [ebp - 0x1c], edi
call fcn.004035b0
add esp, 4
add eax, 0x10
mov ecx, ebx
mov dword [edi], eax
call fcn.005acdb0
mov edi, dword [ebp - 0x10]
add esp, 4
test edi, edi
je 0x5ad9e9
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00403220
mov edi, dword [ebp + 8]
test edi, edi
je 0x5ada61
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push 0x20004
call fcn.005b5f80
add esp, 4
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x5ada48
mov eax, dword [ebp + 0x10]
cmp eax, 4
ja case.0x5ada18.0
jmp dword [eax*4 + 0x5adac8]
push str.SU_CalenderView
jmp 0x5ada40
push str.SU_WorkShop
jmp 0x5ada40
push str.SU_Scan
jmp 0x5ada40
push str.SU_OCR
jmp 0x5ada40
push str.SU_FolderView
lea ecx, [ebp - 0x10]
call fcn.004031d0
push dword [ebp - 0x10]
push str._f__s_
push edi
call fcn.00402e70
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.00402b90
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x5adab5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5adab3
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5adab3
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5adbe0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x638fe4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, edx
mov dword [ebp - 0x210], eax
mov bh, 1
mov dword [ebp - 0x214], ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x5adc75
push ecx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054cb78
add esp, 0xc
lea eax, [ebp - 0x20c]
push dword [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.00403280
push dword [ebp - 0x210]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea ecx, [ebp - 0x210]
sete bl
call fcn.00402b90
mov ecx, dword [ebp - 0x214]
test bl, bl
setne al
dec al
and bh, al
test esi, esi
je 0x5adcdb
test bh, bh
je 0x5adcdb
push ecx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054cb78
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.00403280
push dword [ebp - 0x210]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea ecx, [ebp - 0x210]
sete bl
call fcn.00402b90
test bl, bl
setne al
dec al
and bh, al
jmp 0x5adce1
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
test edi, edi
je 0x5add55
test bh, bh
je 0x5add55
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0054cb78
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00403280
push dword [ebp - 0x214]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea ecx, [ebp - 0x214]
sete bl
call fcn.00402b90
test bl, bl
pop edi
setne al
dec al
pop esi
and al, bh
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544774
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bh
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00544774
mov esp, ebp
pop ebp
ret
Function at 0x5add70
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d566e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x638fe4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
je 0x5ade59
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
mov eax, dword [ebp + 8]
jne 0x5ade59
add eax, 0xfffffff0
push eax
call fcn.004035b0
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x5addf7
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00402cf0
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [esi - 8]
push esi
call fcn.0054c667
add esp, 8
test eax, eax
js 0x5adeaa
cmp eax, dword [esi - 8]
jg 0x5adeaa
xor ecx, ecx
mov dword [esi - 0xc], eax
push ecx
mov word [esi + eax*2], cx
mov edi, esp
add esi, 0xfffffff0
mov dword [ebp - 0x14], edi
push esi
call fcn.004035b0
add esp, 4
add eax, 0x10
mov dword [edi], eax
call fcn.005add70
add esp, 4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.00402b90
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x10]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5adeb8
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5adeb4
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5adeb4
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402650
mov ecx, edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5b0700
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d592a
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x638fe4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
mov bh, 1
call fcn.005a9780
mov dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
or esi, 0xffffffff
test eax, eax
je 0x5b07da
push 0x60ab98
lea ecx, [ebp - 0x14]
call fcn.00403280
push 5
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x14]
cmp eax, 0x20
mov eax, esi
setl bl
add ecx, 0xfffffff0
dec bl
and bl, bh
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b07dc
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x18], edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b07d3
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x18], edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b07cc
push 0
push dword [edx + 4]
call edi
jmp 0x5b07dc
mov ecx, edx
call dword [ebp - 0x18]
jmp 0x5b07dc
mov ecx, edx
call dword [ebp - 0x18]
jmp 0x5b07dc
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x5b0831
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b082f
mov eax, dword [ecx + 4]
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
cmp ecx, vtable.ATL::CWin32Heap.0
jne 0x5b082d
push 0
push dword [eax + 4]
call edi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, eax
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b0850
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp esi, edx
je 0x5b0878
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esi]
call edi
mov edx, dword [ebp + 0xc]
add esi, 0x1c
cmp esi, edx
jne 0x5b0866
mov esi, dword [ebp + 8]
pop edi
test esi, esi
je 0x5b08e5
push ebx
push dword [ebp - 4]
push ecx
mov ecx, esi
call fcn.00405440
mov ecx, dword [ebp + 0x10]
mov eax, 0x92492493
mov ebx, dword [ebp + 8]
add esp, 8
sub ecx, ebx
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x9249249
ja 0x5b08ea
lea eax, [ecx*8]
sub eax, ecx
shl eax, 2
cmp eax, 0x1000
jb 0x5b08db
test bl, 0x1f
jne 0x5b08ef
mov eax, dword [ebx - 4]
cmp eax, ebx
jae 0x5b08f4
sub ebx, eax
cmp ebx, 4
jb 0x5b08f9
cmp ebx, 0x23
ja 0x5b08fe
mov ebx, eax
push ebx
call fcn.0040e5b0
add esp, 4
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0054a598
call fcn.0054a598
call fcn.0054a598
call fcn.0054a598
call fcn.0054a598
int3
Function at 0x5b0910
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5955
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x638fe4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
mov bh, 1
call fcn.005a9a20
mov dword [ebp - 4], 0
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
or esi, 0xffffffff
test eax, eax
je 0x5b0a00
push 0x60ab98
lea ecx, [ebp - 0x10]
call fcn.00403280
push 0xc
push str._f_SU_Exec_
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bh
call fcn.00403620
push 5
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov eax, esi
setl bl
add ecx, 0xfffffff0
dec bl
and bl, bh
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5b0a02
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x18], edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b09f9
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x18], edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b09f2
push 0
push dword [edx + 4]
call edi
jmp 0x5b0a02
mov ecx, edx
call dword [ebp - 0x18]
jmp 0x5b0a02
mov ecx, edx
call dword [ebp - 0x18]
jmp 0x5b0a02
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x5b0a57
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b0a55
mov eax, dword [ecx + 4]
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
cmp ecx, vtable.ATL::CWin32Heap.0
jne 0x5b0a53
push 0
push dword [eax + 4]
call edi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, eax
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b0a70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d5978
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x638fe4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
call fcn.00418413
mov ecx, eax
test ecx, ecx
jne 0x5b0ab4
push 0x80004005
call fcn.00402650
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b0ac9
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x5b0acb
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x5b0afc
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00402cf0
mov esi, dword [ebp - 0x10]
push 0x104
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [esi - 8]
push esi
call fcn.0054c667
add esp, 8
test eax, eax
js 0x5b0bd9
cmp eax, dword [esi - 8]
jg 0x5b0bd9
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test edi, edi
je 0x5b0b6d
cmp dword [esi - 4], 1
jle 0x5b0b48
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00402d90
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
push dword [esi - 8]
push esi
call fcn.0054c667
add esp, 8
test eax, eax
js 0x5b0bd9
cmp eax, dword [esi - 8]
jg 0x5b0bd9
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 4], 1
jle 0x5b0b81
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00402d90
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push dword [esi - 8]
push esi
call fcn.0054c667
add esp, 8
test eax, eax
js 0x5b0bd9
cmp eax, dword [esi - 8]
jg 0x5b0bd9
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea edi, [esi - 0x10]
mov ebx, dword [ebx]
sub ebx, 0x10
cmp edi, ebx
je 0x5b0bef
cmp dword [ebx + 0xc], ecx
jl 0x5b0be3
mov eax, dword [edi]
cmp eax, dword [ebx]
jne 0x5b0be3
push edi
call fcn.004035b0
add esp, 4
mov ecx, ebx
mov esi, eax
call fcn.00402670
mov ecx, dword [ebp - 0x14]
lea eax, [esi + 0x10]
mov dword [ecx], eax
jmp 0x5b0bef
push 0x80070057
call fcn.00402650
push dword [esi - 0xc]
mov ecx, dword [ebp - 0x14]
push esi
call fcn.00403620
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x5b0c40
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5b0c3e
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5b0c3e
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b0e00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x638fe4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
push eax
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
push eax
push 0
mov ebx, edx
mov dword [ebp - 0x18], 0
mov edi, ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5b0f03
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x5b0f16
cmp eax, 2
jbe 0x5b0eb3
cmp eax, 0xb
jne 0x5b0f16
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 8
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 0
push ebx
push edi
call eax
movzx ecx, byte [ebp - 9]
mov edi, eax
movzx eax, byte [ebp - 0xe]
push ecx
movzx ecx, byte [ebp - 0xa]
push ecx
movzx ecx, byte [ebp - 0xb]
push ecx
movzx ecx, byte [ebp - 0xc]
push ecx
movzx ecx, byte [ebp - 0xd]
push ecx
push eax
movzx eax, byte [ebp - 0xf]
push eax
movzx eax, byte [ebp - 0x10]
push eax
push str._02x_02x_02x_02x_02x_02x_02x_02x
push esi
call fcn.00402e70
add esp, 0x28
jmp 0x5b0eff
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
push dword [ebp - 0x14]
call fcn.00402c20
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 0
push ebx
push edi
call eax
mov edi, eax
mov eax, dword [esi]
test eax, eax
jne 0x5b0edb
xor ecx, ecx
jmp 0x5b0eed
push dword [eax - 8]
push eax
call fcn.0054c667
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x5b0f2c
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x5b0f2c
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
test edi, edi
je 0x5b0f16
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00544774
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00544774
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402650
int3