joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fc4d4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
cmp eax, 0xca
jne 0x4fc504
mov eax, ebx
call fcn.004fcff8
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x4fc4fd
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
mov edx, dword [ebx + 0x14]
cmp edx, 0xcb
jne 0x4fc57c
mov ecx, dword [ebx + 0x1b4]
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x4fc56e
mov edx, dword [ebx + 8]
test edx, edx
je 0x4fc52a
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4fc53c
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4fc56e
mov edx, dword [ebx + 8]
test edx, edx
je 0x4fc51c
cmp eax, 3
je 0x4fc550
dec eax
jne 0x4fc51c
mov ecx, dword [ebx + 8]
inc dword [ecx + 4]
mov edx, dword [ecx + 4]
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 8]
cmp edx, ecx
jl 0x4fc51c
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4fc51c
mov eax, dword [ebx + 0x90]
mov dword [ebx + 0x98], eax
jmp 0x4fc59c
mov ecx, dword [ebx + 0x14]
cmp ecx, 0xcc
je 0x4fc59c
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004fc5a8
pop ebx
ret
Function at 0x523b70
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x523b9e
mov eax, ebx
call fcn.00524628
cmp dword [ebx + 0x3c], 0
je 0x523b97
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x523c0f
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x523c01
cmp dword [ebx + 8], 0
je 0x523bc0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x523bd2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x523c01
cmp dword [ebx + 8], 0
je 0x523bb3
cmp eax, 3
je 0x523be5
dec eax
jne 0x523bb3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x523bb3
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x523bb3
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x523c2d
cmp dword [ebx + 0x10], 0xcc
je 0x523c2d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00523c38
pop ebx
ret
Function at 0x54a530
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], edx
mov dl, byte [eax + 8]
cmp dl, 3
je 0x54a6bd
xor esi, esi
xor edi, edi
mov ebx, dword [eax]
test dl, 2
mov dword [esp + 4], ebx
je 0x54a581
movzx ebp, byte [ecx]
xor edx, edx
mov dl, byte [eax + 9]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
inc esi
movzx ebp, byte [ecx + 1]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
xor ebx, ebx
inc esi
mov bl, byte [ecx + 2]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
jmp 0x54a592
xor edx, edx
xor ebx, ebx
mov bl, byte [ecx + 3]
mov dl, byte [eax + 9]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
test byte [eax + 8], 4
je 0x54a5a8
xor edx, edx
mov dl, byte [eax + 9]
movzx ecx, byte [ecx + 4]
sub edx, ecx
mov dword [esp + esi*4 + 0xc], edx
inc esi
xor edx, edx
lea ecx, [esp + 0xc]
cmp esi, edx
jle 0x54a5ca
mov ebx, dword [ecx]
test ebx, ebx
jg 0x54a5be
xor ebx, ebx
mov dword [ecx], ebx
jmp 0x54a5c2
mov di, 1
inc edx
add ecx, 4
cmp esi, edx
jg 0x54a5b2
test di, di
je 0x54a6bd
mov dl, byte [eax + 9]
sub dl, 2
je 0x54a5f3
sub dl, 2
je 0x54a613
sub dl, 4
je 0x54a64d
sub dl, 8
je 0x54a671
jmp 0x54a6bd
mov ecx, dword [eax + 4]
mov eax, dword [esp]
xor edx, edx
cmp ecx, edx
jbe 0x54a6bd
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x54a603
jmp 0x54a6bd
mov edx, dword [esp]
mov esi, dword [eax + 4]
mov ecx, dword [esp + 0xc]
mov eax, 0xf0
sar eax, cl
and al, 0xf0
mov ecx, dword [esp + 0xc]
mov ebx, 0xf
sar ebx, cl
or al, bl
xor ebx, ebx
cmp esi, ebx
jbe 0x54a6bd
mov ecx, dword [esp + 0xc]
inc ebx
shr byte [edx], cl
and byte [edx], al
inc edx
cmp esi, ebx
ja 0x54a63d
jmp 0x54a6bd
mov edi, dword [esp]
mov ebp, dword [esp + 4]
imul ebp, esi
xor ebx, ebx
cmp ebp, ebx
jbe 0x54a6bd
mov eax, ebx
xor edx, edx
div esi
mov ecx, dword [esp + edx*4 + 0xc]
shr byte [edi], cl
inc edi
inc ebx
cmp ebp, ebx
ja 0x54a65d
jmp 0x54a6bd
mov ebx, dword [esp]
mov eax, esi
imul dword [esp + 4]
mov dword [esp + 8], eax
xor ebp, ebp
mov eax, dword [esp + 8]
cmp ebp, eax
jae 0x54a6bd
movzx edi, byte [ebx]
shl edi, 8
xor eax, eax
mov al, byte [ebx + 1]
xor edx, edx
add di, ax
mov eax, ebp
div esi
inc ebp
mov ecx, dword [esp + edx*4 + 0xc]
shr di, cl
movzx eax, di
sar eax, 8
mov edx, edi
mov byte [ebx], al
inc ebx
and dl, 0xff
mov byte [ebx], dl
inc ebx
mov ecx, dword [esp + 8]
cmp ebp, ecx
jb 0x54a688
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x561e14
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
mov ebx, eax
mov dx, word [0x561e80]
mov eax, ebx
call fcn.0055f688
test al, al
je 0x561e7b
push 0
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x561e7b
push 8
call sub.USER32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x561e76
push 8
call sub.USER32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x561e76
cmp byte [ebx + 0x30], 0
je 0x561e61
mov cl, 1
mov edx, 0x561e8c
mov eax, ebx
call fcn.0055fadc
push 0
xor ecx, ecx
mov edx, dword [ebx + 0x58]
mov eax, esi
call fcn.00567b08
mov eax, ebx
call fcn.0055f560
call sub.USER32.dll_CloseClipboard
pop esi
pop ebx
ret

Function at 0x5633fc
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov ebx, eax
mov dx, word [0x5634dc]
mov eax, ebx
call fcn.0055f688
test al, al
je 0x5634d4
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
mov eax, ebx
mov si, 0xffef
call fcn.00403c68
test al, al
je 0x5634cd
push 0
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x5634d4
call sub.USER32.dll_EmptyClipboard
cmp dword [esp + 0x18], 0
je 0x5634a4
mov eax, dword [esp + 0x18]
call fcn.00595468
test al, al
jne 0x5634a4
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, ebx
call fcn.005602a0
push eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x58]
call fcn.00563370
jmp 0x5634be
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [ebx + 0x58]
call fcn.005622f8
push eax
push 8
call sub.USER32.dll_SetClipboardData
call sub.USER32.dll_CloseClipboard
jmp 0x5634d4
mov eax, ebx
call fcn.00561dcc
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x5634e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
add esp, 0xffffffe0
mov ebx, eax
mov dx, word [0x563630]
mov eax, ebx
call fcn.0055f688
test al, al
je 0x563627
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
mov eax, ebx
mov si, 0xffef
call fcn.00403c68
test al, al
je 0x563627
cmp byte [ebx + 0x30], 0
je 0x563545
mov cl, 1
mov edx, 0x56363c
mov eax, ebx
call fcn.0055fadc
push 0
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x5635c3
call sub.USER32.dll_EmptyClipboard
cmp dword [esp + 0x18], 0
je 0x56359c
mov eax, dword [esp + 0x18]
call fcn.00595468
test al, al
jne 0x56359c
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, ebx
call fcn.005602a0
push eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x58]
call fcn.00563370
jmp 0x5635b6
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [ebx + 0x58]
call fcn.005622f8
push eax
push 8
call sub.USER32.dll_SetClipboardData
call sub.USER32.dll_CloseClipboard
cmp dword [esp + 0x18], 0
je 0x5635ee
mov eax, dword [esp + 0x18]
call fcn.00595468
test al, al
jne 0x5635ee
mov eax, ebx
call fcn.005602a0
mov ecx, eax
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x58]
call fcn.005636b0
jmp 0x563620
mov eax, dword [esp + 8]
dec eax
push eax
mov eax, dword [esp + 0x10]
dec eax
push eax
mov eax, ebx
call fcn.005602a0
mov dword [esp + 0x24], eax
fild dword [esp + 0x24]
add esp, 0xfffffff8
fstp qword [esp]
wait
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [ebx + 0x58]
call fcn.0059be70
mov eax, ebx
call fcn.0055f560
add esp, 0x20
pop esi
pop ebx
ret
Function at 0x5921fc
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov ebx, eax
push 0
push 0x80
push 3
push 0
push 1
push 0
mov eax, ebx
call fcn.00404d0c
push eax
call sub.KERNEL32.dll_CreateFileA_1
mov ebx, eax
push 0
push ebx
call sub.KERNEL32.dll_GetFileSize_1
mov esi, eax
push ebx
call sub.KERNEL32.dll_CloseHandle_1
mov eax, esi
pop esi
pop ebx
ret

Function at 0x596870
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.KERNEL32.dll_GetVersionExA
test eax, eax
je 0x5968b3
cmp dword [esp + 0x10], 2
jne 0x59689c
cmp dword [esp + 4], 5
jb 0x59689c
mov bl, 1
jmp 0x5968b3
cmp dword [esp + 0x10], 1
jne 0x5968b3
cmp dword [esp + 4], 4
jb 0x5968b3
cmp dword [esp + 8], 0x5a
jb 0x5968b3
mov bl, 1
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x5a0f24
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a1013
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x64edbc]
cmp dword [eax], 0
jne 0x5a0f78
lea eax, [ebp - 0x109]
push eax
push 0xfa
call sub.KERNEL32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.0040a024
jmp 0x5a0f88
lea eax, [ebp - 4]
mov edx, dword [0x64edbc]
mov edx, dword [edx]
call fcn.004048f4
lea ecx, [ebp - 0x110]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.005a4a90
mov edx, dword [ebp - 0x110]
lea eax, [ebx + 8]
call fcn.004048b0
xor eax, eax
push ebp
push 0x5a0fe6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebx + 8]
mov dl, 1
mov eax, dword [0x419c2c]
call fcn.0041eb78
mov esi, eax
mov dword [ebx + 4], esi
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, esi
call fcn.0041e6e0
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5a0ff2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a101a
lea eax, [ebp - 0x110]
call fcn.0040485c
lea eax, [ebp - 4]
call fcn.0040485c
ret
Function at 0x5a1028
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, ebx
call fcn.005a0f1c
test al, al
je 0x5a117a
mov eax, dword [ebp - 4]
call fcn.005a0f1c
test al, al
je 0x5a117a
mov eax, ebx
call fcn.005a12a8
mov eax, dword [ebp - 4]
call fcn.005a12a8
cmp dword [ebp + 0x14], 0
jne 0x5a10f3
cmp dword [ebp + 0x10], 0
jne 0x5a10f3
mov eax, dword [ebx + 4]
call fcn.0041e690
cmp edx, dword [ebp + 0xc]
jne 0x5a10f3
cmp eax, dword [ebp + 8]
jne 0x5a10f3
mov eax, dword [ebx + 4]
call fcn.00403a6c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00403a6c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00409a88
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404d0c
push eax
mov eax, dword [ebx + 8]
call fcn.00404d0c
push eax
call sub.KERNEL32.dll_CopyFileA
push 2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dl, 1
mov eax, dword [0x419c2c]
call fcn.0041eb78
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
push 2
mov ecx, dword [ebx + 8]
mov dl, 1
mov eax, dword [0x419c2c]
call fcn.0041eb78
mov dword [ebx + 4], eax
jmp 0x5a117a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [ebx + 4]
call fcn.0041e67c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0041e67c
mov eax, 0x100000
call fcn.004027ac
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
jne 0x5a1130
cmp dword [ebp + 8], 0x100000
jae 0x5a1137
jmp 0x5a1132
jge 0x5a1137
mov esi, dword [ebp + 8]
jmp 0x5a113c
mov esi, 0x100000
mov edx, dword [ebp - 8]
mov ecx, esi
mov eax, dword [ebx + 4]
mov edi, dword [eax]
call dword [edi + 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, esi
cdq
sub dword [ebp + 8], eax
sbb dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0
jne 0x5a1170
cmp dword [ebp + 8], 0
ja 0x5a111f
jmp 0x5a1172
jg 0x5a111f
mov eax, dword [ebp - 8]
call fcn.004027cc
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0x10

Function at 0x5a13e0
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x5a5294
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4189a4]
call fcn.004052e4
xor eax, eax
push ebp
push 0x5a53d8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x64d5b4], 0
jne 0x5a52e7
mov ecx, dword [0x64eb98]
mov dl, 1
mov eax, dword [0x40844c]
call fcn.0040ce98
call fcn.00404238
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403234
mov eax, ebx
call fcn.004050ec
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x5a53e8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004067c4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004050fc
test eax, eax
jle 0x5a537f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.KERNEL32.dll_GetComputerNameA
test eax, eax
je 0x5a5378
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404adc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404ac4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00409298
test eax, eax
jne 0x5a5378
mov ebx, 0x15
jmp 0x5a5384
mov ebx, 0x10
jmp 0x5a5384
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x64d5b4]
call fcn.005a5190
mov eax, dword [ebp - 8]
call fcn.005a5190
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004067dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a53df
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404880
lea eax, [ebp - 0x10]
mov edx, dword [0x4189a4]
call fcn.004053b4
ret

Function at 0x5a9bb8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404cfc
xor eax, eax
push ebp
push 0x5a9c43
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x68], 1
jne 0x5a9c06
push 0x4000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404d0c
push eax
call sub.SHELL32.dll_SHGetFileInfo
jmp 0x5a9c27
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404d0c
push eax
call sub.SHELL32.dll_SHGetFileInfo
mov ebx, dword [ebp - 0x160]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a9c4a
lea eax, [ebp - 4]
call fcn.0040485c
ret
Function at 0x5a9c98
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
mov ebx, eax
cmp byte [ebx + 0x68], 0
jne 0x5a9cd2
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x5a9d68
call sub.SHELL32.dll_SHGetFileInfo
mov edx, eax
mov eax, ebx
call fcn.00456884
jmp 0x5a9cf8
push 0x4000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x5a9d68
call sub.SHELL32.dll_SHGetFileInfo
mov edx, eax
mov eax, ebx
call fcn.00456884
mov eax, ebx
call fcn.005a9d6c
test al, al
jne 0x5a9d61
mov ecx, ebx
mov dl, 1
mov eax, dword [0x445b40]
call fcn.00456528
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a9d5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x42], 1
mov eax, ebx
call fcn.004568c0
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00456884
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a9d61
mov eax, dword [ebp - 4]
call fcn.00403a6c
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b66ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
xor edx, edx
push ebp
push 0x5b6838
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.KERNEL32.dll_GetTickCount
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [esi + 0x300]
push esi
lea esi, [eax + 8]
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x28]
sub eax, ebx
sub eax, 0x32
mov ecx, 0x64
cdq
idiv ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x5b6768
mov dword [ebp - 0xc], 1
mov eax, ebx
add eax, 0xa
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x28]
sub edx, 0xf
mov eax, 0x64
call fcn.0042f910
imul edi, eax, 0x32
dec edi
jmp 0x5b6775
mov eax, ebx
add eax, 0x14
mov dword [ebp - 4], eax
mov edi, 0x1387
mov eax, dword [ebp - 0x1c]
mov edx, eax
sub edx, dword [ebp - 0x24]
cmp edx, 0x96
jl 0x5b67aa
mov edx, dword [ebp - 0x24]
add edx, 0x78
mov ecx, dword [ebp - 0x24]
add ecx, eax
sar ecx, 1
jns 0x5b6797
adc ecx, 0
mov eax, ecx
call fcn.0042f994
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x32
jmp 0x5b67e2
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x24]
cmp edx, 0x64
jl 0x5b67cb
sub eax, 0xa
mov dword [ebp - 8], eax
sar edi, 1
jns 0x5b67c2
adc edi, 0
mov dword [ebp - 0x10], 0x19
jmp 0x5b67e2
sub eax, 0xa
mov dword [ebp - 8], eax
test edi, edi
jns 0x5b67d8
add edi, 3
sar edi, 2
mov dword [ebp - 0x10], 0xf
sub dword [ebp - 4], ebx
mov eax, dword [ebp - 0x24]
sub dword [ebp - 8], eax
test edi, edi
jl 0x5b6829
inc edi
xor ebx, ebx
mov eax, dword [esi + 0x2f8]
call fcn.0042d71c
push eax
mov eax, ebx
cdq
idiv dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
sub ecx, edx
mov eax, ebx
cdq
idiv dword [ebp - 0x10]
mov edx, eax
imul edx, dword [ebp - 0xc]
add edx, dword [ebp - 4]
pop eax
call fcn.00428bac
mov dword [esi + ebx*4 + 0x328], eax
inc ebx
dec edi
jne 0x5b67f2
call sub.KERNEL32.dll_GetTickCount
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b6842
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5bb87c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5bb933
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404d0c
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x5bb8be
call fcn.004042e4
jmp 0x5bb93a
mov eax, ebx
call fcn.004027ac
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00404d0c
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x5bb8e7
call fcn.004042e4
jmp 0x5bb93a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5bb944
mov eax, dword [ebp - 8]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x5bb908
call fcn.004042e4
jmp 0x5bb93a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bb93a
mov eax, dword [ebp - 8]
call fcn.004027cc
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5bbb90
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5bbbf8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00403234
test ebx, ebx
jne 0x5bbbcd
mov word [ebp - 2], 0
lea ebx, [ebp - 2]
or esi, 0x4008
push esi
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push ebx
call sub.SHELL32.dll_SHGetFileInfo
mov ebx, dword [ebp - 0x160]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5bbc04
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret