joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55e2d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e0fae
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x676580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1b4], ecx
xor eax, eax
cmp dword [ebp + 8], 0
setne al
test eax, eax
jne 0x55e312
xor al, al
jmp 0x55e542
xor ecx, ecx
jne 0x55e2fe
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb eax, eax
neg eax
jne 0x55e32f
xor al, al
jmp 0x55e542
xor eax, eax
jne 0x55e316
mov dword [ebp - 0x1a0], 0
push 0x602e50
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1a0]
push edx
call fcn.00525b92
add esp, 0xc
mov dword [ebp - 0x1a4], eax
xor eax, eax
cmp dword [ebp - 0x1a0], 0
setne al
test eax, eax
jne 0x55e372
xor al, al
jmp 0x55e542
xor ecx, ecx
jne 0x55e35b
push 0
push 1
lea ecx, [ebp - 0x19c]
call fcn.005a5c50
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1a0]
push edx
lea ecx, [ebp - 0x19c]
call fcn.005a5a50
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1a0]
push eax
call fcn.00525a3d
add esp, 4
xor ecx, ecx
cmp dword [ebp - 0x14], 0
sete cl
test ecx, ecx
jne 0x55e3e1
mov byte [ebp - 0x1a9], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19c]
call fcn.005a5ba0
mov al, byte [ebp - 0x1a9]
jmp 0x55e542
xor edx, edx
jne 0x55e3b0
lea ecx, [ebp - 0x19c]
call fcn.00497600
mov dword [ebp - 0x1a8], eax
xor eax, eax
cmp dword [ebp - 0x1a8], 0
setne al
test eax, eax
jne 0x55e42a
mov byte [ebp - 0x1aa], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19c]
call fcn.005a5ba0
mov al, byte [ebp - 0x1aa]
jmp 0x55e542
xor ecx, ecx
jne 0x55e3f6
push str.shortcuts
mov ecx, dword [ebp - 0x1a8]
call fcn.00497570
mov dword [ebp - 0x1c], eax
xor edx, edx
cmp dword [ebp - 0x1c], 0
setne dl
test edx, edx
jne 0x55e472
mov byte [ebp - 0x1ab], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19c]
call fcn.005a5ba0
mov al, byte [ebp - 0x1ab]
jmp 0x55e542
xor eax, eax
jne 0x55e441
push 0x602e64
mov ecx, dword [ebp - 0x1c]
call fcn.00497570
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x1b4]
call fcn.0055dca0
mov byte [ebp - 0x1d], al
movzx edx, byte [ebp - 0x1d]
neg edx
sbb edx, edx
neg edx
jne 0x55e4c5
mov byte [ebp - 0x1ac], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19c]
call fcn.005a5ba0
mov al, byte [ebp - 0x1ac]
jmp 0x55e542
xor eax, eax
jne 0x55e498
push 0x602e68
mov ecx, dword [ebp - 0x1a8]
call fcn.00497570
mov dword [ebp - 0x18], eax
xor ecx, ecx
cmp dword [ebp - 0x18], 0
setne cl
test ecx, ecx
jne 0x55e50a
mov byte [ebp - 0x1ad], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19c]
call fcn.005a5ba0
mov al, byte [ebp - 0x1ad]
jmp 0x55e542
xor edx, edx
jne 0x55e4dc
push 0x602e70
mov ecx, dword [ebp - 0x18]
call fcn.00497590
mov ecx, dword [ebp - 0x1b4]
mov dword [ecx], eax
mov byte [ebp - 0x1ae], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19c]
call fcn.005a5ba0
mov al, byte [ebp - 0x1ae]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5667d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x5667f6
push 0
push 0
push 0
push 2
mov ecx, dword [ebp - 0x1c]
call fcn.00562f90
xor al, al
jmp 0x5668ee
mov ecx, dword [ebp - 0x1c]
call fcn.005655d0
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00512fc0
mov dword [ebp - 4], 0
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.005292cc
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.00529a83
add esp, 4
mov dword [ebp - 4], eax
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.005292cc
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x56685c
push 0
push 0
push 0
push 0xd
mov ecx, dword [ebp - 0x1c]
call fcn.00562f90
xor al, al
jmp 0x5668ee
mov eax, dword [ebp - 4]
add eax, 1
push eax
call fcn.00521888
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
push 1
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.005298d0
add esp, 0x10
cmp eax, 1
je 0x5668bb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00523d11
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, dword [ebp - 0x1c]
call fcn.00562f90
xor al, al
jmp 0x5668ee
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00566610
mov byte [ebp - 5], al
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00523d11
add esp, 4
mov dword [ebp - 0xc], 0
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret 8
Function at 0x567bc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x567bdc
mov eax, dword [ebp - 4]
jmp 0x567cb7
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x567c92
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov edi, edi
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x608960]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x608960]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x608960]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x608960]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x608960]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x608960]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x608960]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x608960]
dec ebp
jne 0x567bfc
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x567cae
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x608960]
dec ecx
jne 0x567c9c
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x567dc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x14]
movzx edx, byte [ecx]
test edx, edx
je 0x567e0f
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x567e05
mov edx, dword [ebp + 0x14]
mov byte [edx + 8], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp + 0xc]
jmp 0x567e69
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
cmp ecx, dword [edx + 0x18]
jbe 0x567e2f
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x18]
sub edx, dword [ecx + 0x1c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp + 0x14]
add edx, dword [eax + 0x1c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00523d20
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x568280
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
and eax, 0xff
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
shr ecx, 8
xor ecx, dword [eax*4 + 0x60a398]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0xff
mov edx, dword [ebp + 8]
add ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
imul edx, edx, 0x8088405
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shr edx, 0x18
mov eax, dword [ebp + 8]
xor edx, dword [eax + 8]
and edx, 0xff
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x60a398]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0x568300
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x568310
xor eax, eax
jmp 0x5684ad
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x56846e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x60a398]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x60a398]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x60a398]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x60a398]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x60a398]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x60a398]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x60a398]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x60a398]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x568319
cmp dword [ebp + 0x10], 0
je 0x5684a7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x60a398]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x568474
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret

Function at 0x5696c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop ebp
ret
Function at 0x569830
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x5698de
push 0x104
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x428]
push ecx
call fcn.005285da
add esp, 0xc
lea edx, [ebp - 0x428]
push edx
call fcn.00524b18
add esp, 4
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jbe 0x5698b9
mov eax, dword [ebp - 0x220]
movzx ecx, word [ebp + eax*2 - 0x42a]
cmp ecx, 0x2f
je 0x5698a9
mov edx, dword [ebp - 0x220]
movzx eax, word [ebp + edx*2 - 0x42a]
cmp eax, 0x5c
jne 0x5698b9
mov ecx, dword [ebp - 0x220]
mov word [ebp + ecx*2 - 0x42a], 0
lea edx, [ebp - 0x428]
push edx
call fcn.005696c0
add esp, 4
movzx eax, al
test eax, eax
jne 0x5698de
push 0
lea ecx, [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
test eax, eax
jne 0x5698ed
jmp 0x569a35
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
movzx ecx, word [eax]
test ecx, ecx
je 0x56993f
mov edx, dword [ebp - 0x21c]
movzx eax, word [edx]
cmp eax, 0x2f
je 0x569925
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ecx]
cmp edx, 0x5c
jne 0x56992e
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x21c]
add ecx, 2
mov dword [ebp - 0x21c], ecx
jmp 0x5698fc
mov edx, dword [ebp - 4]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x5699a2
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
sar ecx, 1
shl ecx, 1
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x630]
push eax
call fcn.00523d20
add esp, 0xc
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
sar ecx, 1
mov word [ebp + ecx*2 - 0x630], 0
lea edx, [ebp - 0x630]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00569830
add esp, 8
mov ecx, dword [ebp - 0x218]
add ecx, 2
mov dword [ebp - 0x218], ecx
mov word [ebp - 0x210], 0
cmp dword [ebp + 8], 0
je 0x5699c9
push 0x104
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.005285da
add esp, 0xc
mov word [ebp - 0xa], 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.00524b18
add esp, 4
mov dword [ebp - 0x214], eax
mov edx, 0x104
sub edx, dword [ebp - 0x214]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x214]
lea edx, [ebp + ecx*2 - 0x210]
push edx
call fcn.005285da
add esp, 0xc
mov word [ebp - 0xa], 0
lea eax, [ebp - 0x210]
push eax
call fcn.005696c0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x569a35
push 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret
Function at 0x56e6b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x56e6ca
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 4], 0xffffffff
je 0x56e6d4
mov eax, 0x1000000
jmp 0x56e7a7
mov edx, dword [ebp - 0x18]
add edx, 0x244
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, dword [ebp - 0x18]
add eax, 0x244
push eax
call fcn.00524b18
add esp, 4
mov ecx, dword [ebp - 0x18]
lea edx, [ecx + eax*2 + 0x242]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movzx ecx, word [eax]
cmp ecx, 0x5c
je 0x56e72f
mov edx, dword [ebp - 8]
movzx eax, word [edx]
cmp eax, 0x2f
je 0x56e72f
mov ecx, dword [ebp - 8]
mov word [ecx + 2], 0x2f
mov edx, dword [ebp - 8]
mov word [edx + 4], 0
cmp dword [ebp + 0x10], 1
jne 0x56e75f
mov eax, dword [ebp + 8]
push eax
call fcn.005697b0
add esp, 4
mov dword [ebp - 0x10], eax
xor ecx, ecx
cmp dword [ebp - 0x10], 0xffffffff
setne cl
mov byte [ebp - 0x11], cl
movzx edx, byte [ebp - 0x11]
test edx, edx
jne 0x56e75f
mov eax, 0x2000000
jmp 0x56e7a7
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00569af0
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x56e785
mov eax, dword [ebp - 0xc]
jmp 0x56e7a7
mov ecx, dword [ebp - 4]
push ecx
call fcn.0056d8e0
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x56e7a5
mov eax, 0x200
jmp 0x56e7a7
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x56f870
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00510840
cmp dword [ebp + 0xc], 0
je 0x56f8be
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x56f8be
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0xffffffff
mov esp, ebp
pop ebp
ret 8

Function at 0x56f930
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 4]
call fcn.00510840
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x56f96e
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
cmp dword [ebp + 0x10], 0
je 0x56f988
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
jmp 0x56f991
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0xc
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x56f830
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call fcn.0048aa40
add esp, 8
mov edx, dword [ebp - 4]
xor eax, eax
cmp dword [edx], 0
setne al
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5714b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5714fd
jmp 0x571588
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00521888
add esp, 4
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x571534
jmp 0x571588
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x6103e8
mov eax, dword [ebp - 4]
push eax
call sub.VERSION.dll_VerQueryValueW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x571567
cmp dword [ebp - 8], 0
jne 0x57156b
jmp 0x571588
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
mov dword [ebp - 0x18], 1
cmp dword [ebp - 4], 0
je 0x5715a0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.00523d11
add esp, 4
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret

Function at 0x571680
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dfb34
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x220]
call fcn.00403290
mov dword [ebp - 4], 0
mov word [ebp - 0x21c], 0
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00524800
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x220]
call fcn.0040b1c0
lea eax, [ebp - 0x220]
push eax
call fcn.005715b0
add esp, 4
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402050
mov edx, dword [ebp - 0x224]
or edx, 1
mov dword [ebp - 0x224], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00403270
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret
Function at 0x5718e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x676580]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x12c], 0
mov dword [ebp - 4], 0
push 0x11c
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.00524800
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x57195d
mov dword [ebp - 0x128], 0x114
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x571970
jmp 0x571aad
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
je 0x571a7d
cmp dword [ebp - 0x130], 2
je 0x571997
jmp 0x571aa6
cmp dword [ebp - 0x124], 6
jne 0x5719c1
cmp dword [ebp - 0x120], 1
jne 0x5719c1
movzx ecx, byte [ebp - 0xe]
sub ecx, 1
neg ecx
sbb ecx, ecx
neg ecx
add ecx, 8
mov dword [ebp - 4], ecx
jmp 0x571a7b
cmp dword [ebp - 0x124], 6
jne 0x5719ec
cmp dword [ebp - 0x120], 0
jne 0x5719ec
movzx edx, byte [ebp - 0xe]
sub edx, 1
neg edx
sbb edx, edx
and edx, 2
add edx, 7
mov dword [ebp - 4], edx
jmp 0x571a7b
cmp dword [ebp - 0x124], 5
jne 0x571a07
cmp dword [ebp - 0x120], 2
jne 0x571a07
mov dword [ebp - 4], 5
jmp 0x571a7b
cmp dword [ebp - 0x124], 5
jne 0x571a22
cmp dword [ebp - 0x120], 1
jne 0x571a22
mov dword [ebp - 4], 6
jmp 0x571a7b
cmp dword [ebp - 0x124], 5
jne 0x571a3d
cmp dword [ebp - 0x120], 0
jne 0x571a3d
mov dword [ebp - 4], 3
jmp 0x571a7b
cmp dword [ebp - 0x124], 4
ja 0x571a4f
mov dword [ebp - 4], 4
jmp 0x571a7b
cmp dword [ebp - 0x124], 6
jb 0x571a61
cmp dword [ebp - 0x120], 2
jae 0x571a6a
cmp dword [ebp - 0x124], 6
jbe 0x571a7b
movzx eax, byte [ebp - 0xe]
cmp eax, 1
jne 0x571a7b
call fcn.00571770
mov dword [ebp - 4], eax
jmp 0x571aad
mov ecx, dword [ebp - 0x11c]
shr ecx, 0x10
and ecx, 0xffff
cmp ecx, 0x45a
jae 0x571a9d
mov dword [ebp - 4], 1
jmp 0x571aa4
mov dword [ebp - 4], 2
jmp 0x571aad
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005236f2
mov esp, ebp
pop ebp
ret