joyce8/EMBER2024-capa huggingface dataset:
Function at 0x512280
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x222], 0
je 0x5122a7
mov ecx, edi
mov dl, 1
mov eax, dword [0x5110c4]
call fcn.00511128
mov dword [edi + 0x294], eax
jmp 0x5123b0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
cmp byte [edi + 0x22b], 0
je 0x5122e8
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp dx, word [edi + 0x226]
jbe 0x5122dd
mov edx, eax
sub dl, byte [edi + 0x226]
mov eax, edi
call fcn.00511830
jmp 0x51231e
xor edx, edx
mov eax, edi
call fcn.00511830
jmp 0x51231e
movzx edx, word [edi + 0x226]
mov ecx, 0x64
sub ecx, edx
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp ecx, edx
jle 0x512315
mov edx, eax
add dl, byte [edi + 0x226]
mov eax, edi
call fcn.00511830
jmp 0x51231e
mov dl, 0x64
mov eax, edi
call fcn.00511830
cmp byte [edi + 0x22b], 0
je 0x512330
cmp byte [edi + 0x22a], 0
je 0x512342
cmp byte [edi + 0x22b], 0
jne 0x51234d
cmp byte [edi + 0x22a], 0x64
jne 0x51234d
mov bl, byte [edi + 0x224]
xor bl, 1
jmp 0x51237d
mov eax, dword [0x5b29d8]
mov eax, dword [eax]
call fcn.004a133c
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
movzx edx, word [edi + 0x228]
cmp eax, edx
ja 0x51237d
cmp byte [edi + 0x224], 0
jne 0x51237d
cmp byte [edi + 0x2a0], 0
je 0x51234d
test bl, bl
jne 0x512397
cmp byte [edi + 0x224], 0
jne 0x512397
cmp byte [edi + 0x2a0], 0
je 0x5122a9
cmp byte [edi + 0x2a0], 0
jne 0x5123a9
cmp byte [edi + 0x224], 0
jne 0x5123b0
mov eax, edi
call fcn.005126a4
pop edi
pop esi
pop ebx
ret

Function at 0x51677c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5167ed
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x5b01d4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x5167d7
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0051676c
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x51457c]
call fcn.0051763c
mov dword [0x5b023c], eax
mov eax, dword [ebp - 4]
call fcn.005165f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5167f4
lea eax, [ebp - 8]
call fcn.00405ef8
ret

Function at 0x51688c
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x51689f
or esi, 2
test dl, dl
je 0x5168a8
or esi, 0
jmp 0x5168ab
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret
Function at 0x5174c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004048e4
xor eax, eax
push ebp
push 0x517620
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x514364]
call fcn.004187f0
test eax, eax
jl 0x51752f
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.00516870
and eax, 0x7f
mov eax, dword [eax*4 + 0x5b01d4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x517592
mov eax, dword [ebx]
call fcn.004046f4
test eax, eax
jle 0x517592
mov eax, dword [ebx]
call fcn.004046f4
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x517556
mov eax, ebx
mov edx, 0x517638
call fcn.004046fc
mov eax, dword [ebx]
call fcn.004046f4
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.004052bc
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.0051676c
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x5175dd
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x5b25cc]
call fcn.004063d8
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040a1dc
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404488
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x407cc0]
call fcn.0040cdc8
call fcn.00403dcc
mov eax, dword [ebp - 8]
call fcn.00517440
mov ebx, eax
test edi, edi
je 0x5175f2
mov eax, edi
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x517627
lea eax, [ebp - 0x1c]
call fcn.00404434
lea eax, [ebp - 0x18]
call fcn.00405ef8
lea eax, [ebp - 0x14]
call fcn.00404434
lea eax, [ebp - 4]
call fcn.00404434
ret

Function at 0x518204
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x3c
call fcn.00402f70
mov dword [esp], 0x3c
mov eax, dword [0x5b29d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc
mov eax, dword [ebx + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 5
push esp
call sub.shell32.dll_ShellExecuteExA
add esp, 0x3c
pop ebx
ret
Function at 0x5186ac
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
test dl, dl
je 0x5186c3
add esp, 0xfffffff0
call fcn.00403964
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00456a68
xor eax, eax
mov dword [ebx + 0x340], eax
xor edx, edx
mov eax, ebx
call fcn.00457564
mov al, byte [0x51879c]
mov byte [ebx + 0x344], al
mov byte [ebx + 0x244], 1
mov byte [ebx + 0x34d], 1
mov byte [ebx + 0x34e], 0
xor eax, eax
mov dword [ebx + 0x350], eax
xor eax, eax
mov dword [ebx + 0x354], eax
mov byte [ebx + 0x359], 0
mov byte [ebx + 0x35a], 1
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x5187a0
call sub.shell32.dll_SHGetFileInfoA
mov dword [ebx + 0x348], eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x51483c]
call fcn.005182e0
mov esi, eax
mov dword [ebx + 0x35c], esi
mov al, byte [esi + 0x24]
or al, byte [0x5187a4]
mov byte [esi + 0x24], al
lea eax, [ebx + 0x338]
mov edx, 0x5187b0
call fcn.00404488
mov byte [ebx + 0x34c], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x518793
call fcn.004039bc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x518d20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x518e8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5b2c40]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x5b2c40]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0049f3b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.00456674
xor edx, edx
push ebp
push 0x518e6d
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x518ddd
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00405ef8
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.00516e88
push eax
mov eax, dword [0x5b29d8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x518dd3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00403e78
jmp 0x518e74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x518e19
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00456254
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00518bb0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x518df5
push 0
mov edx, 0x518b48
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00455e0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518e74
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.004566c0
mov eax, dword [0x5b2c40]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.0049f3b0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518e91
lea eax, [ebp - 0x10]
call fcn.00405ef8
ret
Function at 0x51ac74
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
test dl, dl
je 0x51ac8b
add esp, 0xfffffff0
call fcn.00403964
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0045f214
xor eax, eax
mov dword [esi + 0x380], eax
mov dl, 1
mov eax, esi
call fcn.00460080
mov byte [esi + 0x387], 1
mov al, byte [0x51ad74]
mov byte [esi + 0x389], al
mov byte [esi + 0x384], 1
mov byte [esi + 0x386], 1
mov byte [esi + 0x385], 0
mov dl, 1
mov eax, dword [0x41a1f4]
call fcn.004035d0
mov dword [esi + 0x3a0], eax
xor eax, eax
mov dword [esi + 0x3a4], eax
mov byte [esi + 0x388], 0
mov byte [esi + 0x3b8], 0
push 0x4001
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x51ad78
call sub.shell32.dll_SHGetFileInfoA
mov dword [esi + 0x390], eax
push 0x4000
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x51ad78
call sub.shell32.dll_SHGetFileInfoA
mov dword [esi + 0x38c], eax
lea eax, [esi + 0x37c]
mov edx, 0x51ad84
call fcn.00404488
xor edx, edx
mov eax, esi
call fcn.004604dc
mov eax, esi
test bl, bl
je 0x51ad6c
call fcn.004039bc
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51d55c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x1c]
call fcn.004048e4
xor eax, eax
push ebp
push 0x51d672
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x1c], 0
jne 0x51d595
lea edx, [ebp + 0x1c]
mov eax, ebx
call fcn.00409848
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402f70
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
mov dword [ebp - 0x34], edi
mov eax, ebx
call fcn.004048f4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.004048f4
mov dword [ebp - 0x2c], eax
cmp dword [ebp + 0x1c], 0
je 0x51d5db
mov eax, dword [ebp + 0x1c]
call fcn.004048f4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x51d5fd
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
jmp 0x51d65c
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x51d656
cmp byte [ebp + 0x14], 0
je 0x51d618
push 0xffffffffffffffff
push eax
call sub.user32.dll_WaitForInputIdle
cmp byte [ebp + 0x18], 0
je 0x51d643
mov eax, dword [0x5b29d8]
mov eax, dword [eax]
call fcn.004a133c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 8]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x51d61e
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
mov dword [esi], 0x21
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51d679
lea eax, [ebp + 0x1c]
call fcn.00404434
ret
Function at 0x52b858
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x52b860
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x52baa4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404434
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
call fcn.00404434
xor eax, eax
push ebp
push 0x52ba59
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x52babc
call fcn.004044cc
xor ebx, ebx
lea eax, [ebp - 0x14]
call fcn.0052b7c4
jmp 0x52b8b7
inc ebx
push dword [ebp - 0x14]
push 0x52bad0
push dword [ebp - 0xc]
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00408e44
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004047b4
mov eax, dword [ebp - 0x18]
call fcn.00409440
test al, al
jne 0x52b8b6
push dword [ebp - 0x14]
push 0x52bad0
push dword [ebp - 0xc]
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00408e44
push dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004047b4
mov eax, dword [ebp - 0x14]
call fcn.00409acc
test al, al
jne 0x52b930
mov eax, 0x1583
call fcn.004fb6c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52ba89
push 0
lea eax, [ebp - 0x24]
mov ecx, 0x52badc
mov edx, dword [ebp - 0x14]
call fcn.00404740
mov eax, dword [ebp - 0x24]
call fcn.004048f4
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x5b29d8]
mov eax, dword [eax]
call fcn.004a1af8
mov eax, dword [ebp - 0x28]
call fcn.004048f4
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x52b983
mov eax, 0x1584
call fcn.004fb6c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52ba89
lea eax, [ebp - 0x2c]
mov ecx, 0x52badc
mov edx, dword [ebp - 0x14]
call fcn.00404740
mov eax, dword [ebp - 0x2c]
call fcn.0040954c
mov ebx, eax
and bx, 0xfffe
lea eax, [ebp - 0x30]
mov ecx, 0x52badc
mov edx, dword [ebp - 0x14]
call fcn.00404740
mov eax, dword [ebp - 0x30]
movzx edx, bx
call fcn.00409560
lea eax, [ebp - 0x10]
mov ecx, 0x52badc
mov edx, dword [ebp - 0x14]
call fcn.00404740
push 0
lea eax, [ebp - 0x34]
mov ecx, 0x52badc
mov edx, dword [ebp - 0x14]
call fcn.00404740
mov ecx, dword [ebp - 0x34]
mov dl, 1
mov eax, dword [0x41aa58]
call fcn.0041fa6c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
sub eax, 4
sbb edx, 0
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.0041f574
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 8]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.0041f574
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004f86bc
test al, al
jne 0x52ba47
mov eax, dword [ebp - 4]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52ba89
mov eax, dword [ebp - 4]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52ba7f
mov eax, esi
mov edx, dword [ebp - 0x14]
call fcn.00404488
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52baab
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404458
ret
Function at 0x52cda4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52ceb8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x52ce83
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402c84
mov eax, 0x32
call fcn.00402f90
inc eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov ebx, dword [ebp - 0xc]
dec ebx
test ebx, ebx
jl 0x52ce23
inc ebx
mov eax, 0x7fffffff
call fcn.00402f90
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0x10]
dec ebx
jne 0x52ce03
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x15], al
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004044cc
mov eax, dword [ebp - 0x14]
call fcn.004046f4
mov ebx, eax
test ebx, ebx
jle 0x52ce60
mov esi, 1
lea eax, [ebp - 0x14]
call fcn.0040494c
mov edx, dword [ebp - 0x14]
mov dl, byte [edx + esi - 1]
xor dl, byte [ebp - 0x15]
mov byte [eax + esi - 1], dl
inc esi
dec ebx
jne 0x52ce46
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004fba94
test al, al
jne 0x52ce79
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52cea2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52ce9e
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52cebf
lea eax, [ebp - 0x14]
call fcn.00404434
ret

Function at 0x52cecc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x52cfbe
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x52cf89
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, dword [ebp - 0xc]
dec ebx
test ebx, ebx
jl 0x52cf29
inc ebx
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
dec ebx
jne 0x52cf17
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x15], al
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.004fbb50
test al, al
jne 0x52cf47
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52cfa8
mov eax, dword [ebp - 0x14]
call fcn.004046f4
mov ebx, eax
test ebx, ebx
jle 0x52cf74
mov esi, 1
lea eax, [ebp - 0x14]
call fcn.0040494c
mov edx, dword [ebp - 0x14]
mov dl, byte [edx + esi - 1]
xor dl, byte [ebp - 0x15]
mov byte [eax + esi - 1], dl
inc esi
dec ebx
jne 0x52cf5a
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.00404488
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52cfa4
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52cfc5
lea eax, [ebp - 0x14]
call fcn.00404434
ret
Function at 0x5568d8
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x556ad9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x376], 1
cmp dword [ebp - 4], 0
jne 0x556956
xor edx, edx
mov eax, dword [ebx + 0x310]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x33c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebx + 0x308]
call fcn.0048361c
mov esi, eax
dec esi
test esi, esi
jl 0x556abc
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x308]
call fcn.004835e0
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
inc edi
dec esi
jne 0x556939
jmp 0x556abc
mov dl, 1
mov eax, dword [ebx + 0x310]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov dl, 1
mov eax, dword [ebx + 0x33c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebx + 0x308]
call fcn.0048361c
mov esi, eax
dec esi
test esi, esi
jl 0x55699d
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x308]
call fcn.004835e0
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
inc edi
dec esi
jne 0x556985
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0xc]
mov edx, dword [esi + 0x14]
mov eax, dword [ebx + 0x31c]
call fcn.00480004
lea edx, [ebp - 8]
mov ax, word [esi + 4]
call fcn.0049021c
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x320]
call fcn.00480004
mov eax, dword [ebx + 0x340]
mov eax, dword [eax + 0x168]
xor edx, edx
call fcn.0042c72c
mov edx, dword [esi + 0x18]
mov eax, dword [ebx + 0x348]
call fcn.00480004
mov dl, byte [esi + 6]
mov eax, dword [ebx + 0x350]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 0xa]
mov eax, dword [ebx + 0x354]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 9]
mov eax, dword [ebx + 0x360]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 8]
mov eax, dword [ebx + 0x358]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 0xc]
mov eax, dword [ebx + 0x35c]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dl, byte [esi + 0xb]
mov eax, dword [ebx + 0x364]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
xor edx, edx
mov dl, byte [esi + 7]
mov eax, dword [ebx + 0x370]
call fcn.0054bce8
mov eax, dword [esi + 0x1c]
call fcn.0040553c
test eax, eax
jne 0x556a80
mov edx, 0x556af0
mov eax, dword [ebx + 0x368]
call fcn.00480004
jmp 0x556a90
mov edx, 0x556b00
mov eax, dword [ebx + 0x368]
call fcn.00480004
cmp dword [esi + 0x10], 0
je 0x556abc
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x340]
mov ecx, dword [eax]
call dword [ecx + 0x44]
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx + 0x340]
call fcn.0043b588
mov ecx, dword [esi + 0x10]
pop edx
call fcn.0042a134
mov byte [ebx + 0x376], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x556ae0
lea eax, [ebp - 8]
call fcn.00404434
ret
Function at 0x5599ac
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
mov esi, eax
test dl, dl
je 0x5599c4
mov ebx, 0x101
jmp 0x5599c9
mov ebx, pe_nt_image_headers32
push ebx
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, esi
call fcn.004048f4
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp - 0x160]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55e98c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x55e994
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x55ebac
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
mov edx, 0x400
call fcn.00404a80
push 0x400
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.0040462c
lea eax, [ebp - 0x20]
mov edx, 0x55ebc8
call fcn.004044cc
mov eax, dword [ebp - 0xc]
call fcn.004046f4
mov edx, dword [ebp - 0xc]
cmp byte [edx + eax - 1], 0x5c
jne 0x55ea1a
mov eax, dword [ebp - 0xc]
call fcn.004046f4
mov edx, eax
lea eax, [ebp - 0xc]
mov ecx, 1
call fcn.00404994
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00404740
mov eax, dword [ebp - 0x24]
call fcn.00409430
test al, al
jne 0x55eadc
xor eax, eax
push ebp
push 0x55eab4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41a858]
call fcn.004035d0
mov dword [ebp - 8], eax
call fcn.0040af5c
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x2c]
call fcn.0040a908
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x55ebdc
call fcn.00404740
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00404740
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp - 8]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55ead0
mov dword [ebp - 4], 0x1e
jmp 0x55eb84
xor eax, eax
push ebp
push 0x55eb40
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41a858]
call fcn.004035d0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00404740
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea ecx, [ebp - 0x10]
mov edx, 0x55ebe8
mov eax, dword [ebp - 8]
call fcn.0041e6a8
mov eax, dword [ebp - 0x10]
call fcn.0040a968
fstp qword [ebp - 0x18]
wait
mov eax, dword [ebp - 8]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55eb60
call fcn.0040af5c
fsubr qword [ebp - 0x18]
call fcn.00402d38
add eax, 0x1e
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x55eb7f
cmp dword [ebp - 4], 0x1e
jle 0x55eb84
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55ebb3
lea eax, [ebp - 0x34]
mov edx, 7
call fcn.00404458
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404458
ret