joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b0f6c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5b10e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.005b10f0
mov esi, eax
cmp esi, 0xffffffff
je 0x5b10cc
mov eax, dword [ebp - 4]
call fcn.005b0470
xor eax, eax
push ebp
push 0x5b10b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, edi
call fcn.005b264c
mov eax, dword [0x64a274]
mov eax, dword [eax]
call fcn.00588f50
mov edi, esi
shl edi, 3
sub edi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
lea edx, [eax + edi*8]
mov eax, dword [ebp - 4]
call fcn.005b1240
test bl, bl
je 0x5b102b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
lea eax, [eax + edi*8]
lea ecx, [ebp - 8]
xor edx, edx
call fcn.005b00ac
mov eax, dword [ebp - 8]
call fcn.0050af0c
test al, al
je 0x5b102b
cmp bl, 2
jne 0x5b1023
mov eax, dword [ebp - 8]
call fcn.00504fec
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x5b102b
mov eax, dword [ebp - 8]
call fcn.00593d4c
mov eax, dword [ebp - 4]
call fcn.005b04d0
dec eax
cmp esi, eax
jge 0x5b1075
mov ebx, esi
mov eax, dword [ebp - 4]
call fcn.005b04d0
mov esi, eax
sub esi, 2
sub esi, ebx
jl 0x5b1075
inc esi
mov edi, ebx
shl edi, 3
sub edi, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
lea eax, [eax + edi*8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
lea edx, [edx + edi*8 + 0x38]
mov ecx, dword [0x58ff38]
call fcn.005059c4
inc ebx
dec esi
jne 0x5b104c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00505fd4
dec eax
push eax
mov eax, dword [ebp - 4]
add eax, 4
mov ecx, 1
mov edx, dword [0x58ff6c]
call fcn.005061b0
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b10b8
mov eax, dword [ebp - 4]
call fcn.005b0488
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b10e9
lea eax, [ebp - 8]
call fcn.00504b1c
ret
Function at 0x5b8954
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5b8982
mov eax, ebx
call fcn.005b9408
cmp dword [ebx + 0x40], 0
je 0x5b897b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5b89f3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5b89e5
cmp dword [ebx + 8], 0
je 0x5b89a4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5b89b6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5b89e5
cmp dword [ebx + 8], 0
je 0x5b8997
cmp eax, 3
je 0x5b89c9
dec eax
jne 0x5b8997
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5b8997
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5b8997
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5b8a11
cmp dword [ebx + 0x14], 0xcc
je 0x5b8a11
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005b8a1c
pop ebx
ret
Function at 0x5e8344
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [edx + 0x18]
test al, 0x40
je 0x5e835f
push 5
mov eax, ebx
call fcn.0056ef90
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
test al, 0x80
je 0x5e8372
push 0
mov eax, ebx
call fcn.0056ef90
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x5f33c4
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, edx
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edi, eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x48]
test esi, esi
je 0x5f34f0
test edi, edi
je 0x5f34f0
test eax, eax
je 0x5f34f0
test edx, edx
je 0x5f34f0
mov eax, dword [ebp - 0x4c]
cdq
idiv esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x44]
dec eax
cdq
idiv esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
cdq
idiv edi
mov ebx, eax
mov eax, dword [ebp - 0x40]
dec eax
cdq
idiv edi
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x25]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.005f32a4
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_IntersectClipRect
mov eax, dword [ebp - 0x18]
sub eax, ebx
jl 0x5f34e2
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
sub ebx, eax
jl 0x5f34da
inc ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
imul edi
mov edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x38]
sub eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
imul esi
mov edx, dword [ebp - 0x4c]
sub edx, dword [ebp - 0x3c]
sub eax, edx
mov dword [ebp - 0x1c], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp + 8]
call fcn.005316e0
call fcn.0052cba8
push eax
push edi
push esi
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_BitBlt
inc dword [ebp - 8]
dec ebx
jne 0x5f348a
inc dword [ebp - 0xc]
dec dword [ebp - 0x2c]
jne 0x5f347c
lea ecx, [ebp - 0x25]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.005f327c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5f367c
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x17
call sub.user32.dll_GetSystemMetrics
test eax, eax
jne 0x5f3695
push 1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret
push 2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret
Function at 0x5f36a4
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x17
call sub.user32.dll_GetSystemMetrics
test eax, eax
jne 0x5f36bd
push 2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret
push 1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret

Function at 0x5f8270
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x100]
test byte [eax], 0x80
setne cl
test cl, cl
jne 0x5f829e
inc eax
dec edx
jne 0x5f8290
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x5f83f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
movzx eax, byte [eax + 0xc]
mov word [ebp - 4], ax
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5f8417
add word [ebp - 4], 0x2000
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5f8429
add word [ebp - 4], 0x4000
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5f843b
add word [ebp - 4], 0x8000
lea eax, [ebp - 8]
call fcn.005f823c
mov ebx, eax
test ebx, ebx
je 0x5f8461
mov cx, word [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.005f7ef8
test al, al
je 0x5f8461
mov byte [ebp - 1], 1
jmp 0x5f849b
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
call fcn.005f8300
pop ecx
cmp byte [ebp - 1], 0
jne 0x5f849b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
cmp eax, dword [edx - 4]
je 0x5f849b
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 8]
call fcn.005f8300
pop ecx
mov al, byte [ebp - 1]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x5f8558
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push ebp
call fcn.005f83f0
pop ecx
test al, al
je 0x5f8578
mov eax, dword [ebp + 8]
mov dword [eax - 0xc], 1
jmp 0x5f8657
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5f8657
call fcn.005f82a4
mov dl, byte [0x5f865c]
not edx
and dl, al
mov byte [ebp - 1], dl
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.005f84a4
pop ecx
mov esi, eax
test esi, esi
jne 0x5f85ca
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
je 0x5f85ca
push ebp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005f84a4
pop ecx
mov esi, eax
test esi, esi
je 0x5f8657
mov eax, dword [esi + 0x18]
call fcn.006176bc
test al, al
je 0x5f8657
push esi
mov eax, esi
call fcn.00605864
mov edx, dword [ebp + 8]
mov dx, word [edx + 0xc]
mov cl, byte [ebp - 1]
call fcn.00606d10
cmp esi, eax
sete bl
mov eax, dword [esi + 0x10]
mov edx, dword [eax]
call dword [edx + 0xa0]
test al, al
je 0x5f860d
test bl, bl
jne 0x5f861f
mov eax, esi
call fcn.00605734
mov edx, dword [esi + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x190]
test bl, bl
je 0x5f864d
mov eax, dword [esi + 0x10]
mov edx, dword [0x5f01e4]
call fcn.00503d64
test al, al
je 0x5f8643
mov eax, esi
call fcn.00605734
mov byte [eax + 0x2a0], 1
xor edx, edx
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp + 8]
mov dword [eax - 0xc], 1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5f9534
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x64ef44]
mov eax, dword [eax + 4]
mov edx, ebx
call fcn.0051d490
test eax, eax
jge 0x5f9559
mov eax, dword [0x64ef44]
mov eax, dword [eax + 4]
mov edx, ebx
call fcn.0051d288
cmp byte [ebx + 0x4d], 0
jne 0x5f9579
cmp dword [0x64efc4], 0
jne 0x5f9579
xor ecx, ecx
mov dl, 1
mov eax, dword [0x649838]
call dword [eax + 0x2c]
mov dword [0x64efc4], eax
cmp dword [0x64efa0], 0
jne 0x5f959b
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push fcn.005f8660
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [0x64efa0], eax
cmp dword [0x64efa4], 0
jne 0x5f95bd
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x5f8d04
push 7
call sub.user32.dll_SetWindowsHookExA
mov dword [0x64efa4], eax
cmp dword [0x64efa8], 0
jne 0x5f95df
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x5f9388
push 4
call sub.user32.dll_SetWindowsHookExA
mov dword [0x64efa8], eax
pop ebx
ret
Function at 0x5fd24c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.005f9d90
test al, al
jne 0x5fd36e
cmp byte [esi + 0x123], 0
je 0x5fd36e
test bl, bl
jne 0x5fd283
cmp byte [0x64efe8], 0
je 0x5fd36e
mov byte [0x64efe8], bl
mov eax, 0x64efd4
mov edx, edi
call fcn.00504b70
mov byte [0x64efc8], 0
mov byte [esp], bl
test bl, bl
je 0x5fd2c2
mov edi, dword [esi + 0x11c]
test edi, edi
je 0x5fd2b9
mov eax, dword [edi + 0x20]
cmp byte [eax + 0x234], 0
je 0x5fd2c6
cmp dword [0x64efd4], 0
jne 0x5fd2c6
xor eax, eax
jmp 0x5fd2c8
mov al, 1
mov ebx, eax
test bl, bl
je 0x5fd319
call fcn.005f81f4
mov eax, dword [0x64efc4]
call fcn.0056ef90
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x5fd310
cmp byte [0x64efd8], 0
jne 0x5fd310
mov dword [0x64efe4], esi
push 0x5fcfc4
push 0x3e8
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [0x64efcc], eax
jmp 0x5fd36e
mov eax, esi
call fcn.005fd034
jmp 0x5fd36e
call fcn.005f81f4
mov eax, dword [0x64efc4]
call fcn.0056ef90
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5fd36e
push 0
mov eax, dword [0x64efc4]
call fcn.0056ef90
push eax
call sub.user32.dll_ShowWindow
cmp byte [esp], 0
je 0x5fd36e
call fcn.005f8214
mov byte [0x64efd8], 1
push 0x5fd028
push 0x190
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [0x64efd0], eax
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x604f5c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 0x15], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x35], 0
je 0x604f95
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x605016
push ebp
mov al, 1
call fcn.00604e70
pop ecx
test al, al
jne 0x605016
push ebp
mov al, 3
call fcn.00604e70
pop ecx
test al, al
jne 0x605016
push ebp
mov al, 2
call fcn.00604e70
pop ecx
test al, al
jne 0x605016
push ebp
mov al, 4
call fcn.00604e70
pop ecx
test al, al
jne 0x605016
mov eax, dword [ebp - 4]
cmp byte [eax + 0x35], 0
je 0x604fe4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x41]
sub dword [ebp - 0x10], eax
push ebp
mov al, 1
call fcn.00604e70
pop ecx
test al, al
jne 0x605016
push ebp
mov al, 3
call fcn.00604e70
pop ecx
test al, al
jne 0x605016
push ebp
mov al, 2
call fcn.00604e70
pop ecx
test al, al
jne 0x605016
push ebp
mov al, 4
call fcn.00604e70
pop ecx
test al, al
mov al, byte [ebp - 0x15]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x605f64
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x606032
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0060581c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00504db4
mov eax, dword [ebp - 8]
call fcn.00605eb4
pop ecx
mov ebx, eax
test bl, bl
jne 0x605fae
xor ebx, ebx
jmp 0x606014
mov eax, ebx
add al, 0xd0
sub al, 0xa
jae 0x605fcd
xor eax, eax
mov al, bl
cmp di, ax
jne 0x605fcd
mov al, byte [0x606044]
cmp al, byte [ebp - 1]
jne 0x605fcd
mov bl, 1
jmp 0x606014
push ebx
call sub.user32.dll_VkKeyScanA
mov esi, eax
mov eax, esi
and ax, 0xff
cmp di, ax
jne 0x606012
shr si, 8
mov bl, byte [0x606044]
mov eax, esi
and ax, 1
cmp ax, 1
jne 0x605ff9
or bl, 1
and si, 2
cmp si, 2
jne 0x606006
or bl, 4
mov al, byte [ebp - 1]
cmp al, bl
sete al
mov ebx, eax
jmp 0x606014
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x606039
lea eax, [ebp - 0xc]
call fcn.00505238
lea eax, [ebp - 8]
call fcn.00504b1c
ret

Function at 0x61b644
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
lea ecx, [esp + 8]
mov edx, ebx
mov eax, dword [ebx + 0x20]
call fcn.0060caec
push esp
call sub.user32.dll_GetCursorPos
push esp
mov eax, dword [ebx + 0x20]
call fcn.0056ef90
push eax
call sub.user32.dll_ScreenToClient
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x61b68e
push dword [esp + 4]
push dword [esp + 4]
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PtInRect
test eax, eax
jne 0x61b692
xor eax, eax
jmp 0x61b694
mov al, 1
test al, al
je 0x61b6b5
cmp byte [0x64efb4], 0
je 0x61b6a8
call fcn.005f367c
jmp 0x61b6b5
push 1
call sub.user32.dll_GetKeyState
test ax, ax
setl al
add esp, 0x18
pop ebx
ret
Function at 0x62cb18
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 1
sete byte [0x64ef55]
cmp byte [0x64ef55], 0
je 0x62cb47
cmp dword [esp + 8], 0
je 0x62cb4b
xor eax, eax
jmp 0x62cb4d
mov al, 1
mov byte [0x64ef54], al
cmp dword [esp + 0x10], 1
jne 0x62cb60
cmp dword [esp + 8], 0
jne 0x62cb72
cmp dword [esp + 0x10], 2
jne 0x62cb6e
cmp dword [esp + 4], 5
je 0x62cb72
xor eax, eax
jmp 0x62cb74
mov al, 1
mov byte [0x64ef56], al
add esp, 0x94
ret

Function at 0x630174
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x630183
add esp, 0xfffffff0
call fcn.00503f44
mov esi, ecx
mov ebx, edx
mov edi, eax
mov dword [edi + 4], esi
push esi
call sub.user32.dll_GetKeyState
and ax, 0xff
movzx eax, ax
mov dword [edi + 8], eax
mov eax, edi
test bl, bl
je 0x6301b1
call fcn.00503f9c
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x6337e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x6337e8
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6339ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, ebx
call fcn.00504fec
push eax
push 0
push 0
call fcn.005074b0
mov dword [0x649a08], eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x633983
push 0
mov eax, dword [ebp - 4]
call fcn.00504fec
push eax
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x633888
call sub.kernel32.dll_GetTickCount
mov edi, eax
lea eax, [edi + 0x1388]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x633880
call sub.kernel32.dll_GetTickCount
mov esi, eax
cmp esi, dword [ebp - 0xc]
ja 0x633880
cmp edi, esi
ja 0x633880
push 0
mov eax, dword [ebp - 4]
call fcn.00504fec
push eax
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x63385a
test ebx, ebx
je 0x633983
mov edx, 0x1388
mov eax, 1
lea ecx, [ebp - 0x18]
push ecx
push edx
push eax
push 0
push 0
push 0x479
push ebx
call sub.user32.dll_SendMessageTimeoutA
test eax, eax
jne 0x63390e
call sub.kernel32.dll_GetLastError
cmp eax, 0x5b4
jne 0x63390e
lea eax, [ebp - 0x14]
mov edx, 0x6339c4
call fcn.00504bb4
push 0x24
lea edx, [ebp - 0x1c]
mov eax, dword [0x64a274]
mov eax, dword [eax]
call fcn.00588c10
mov eax, dword [ebp - 0x1c]
call fcn.00504fec
push eax
mov eax, dword [ebp - 0x14]
call fcn.00504fec
push eax
push 0
call sub.user32.dll_MessageBoxA_1
cmp eax, 6
jne 0x633908
mov eax, ebx
call fcn.00592a38
mov eax, dword [0x64a274]
mov eax, dword [eax]
call fcn.00588f50
jmp 0x633983
mov byte [ebp - 5], 1
jmp 0x633983
push 0
mov eax, dword [0x64a274]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
call fcn.0050323c
test eax, eax
jle 0x633975
call fcn.0050323c
mov esi, eax
test esi, esi
jle 0x63395f
mov edi, 1
push dword [ebp - 0x10]
push 0x633a44
lea edx, [ebp - 0x20]
mov eax, edi
call fcn.005032a4
push dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00504eac
inc edi
dec esi
jne 0x633939
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.0050a858
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x10]
call fcn.00504bb4
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00633754
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6339b2
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00504b40
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00504b40
ret

Function at 0x635fc4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00504fec
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x635fdd
test al, 0x10
jne 0x635fe1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x635fe8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.00504fdc
xor eax, eax
push ebp
push 0x6361d5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.005035d0
mov edi, eax
lea eax, [ebp - 0x178]
xor ecx, ecx
mov edx, 0x160
call fcn.00503594
cmp dword [ebp + 0x20], 0
je 0x6360a3
cmp dword [ebp - 0x10], 0
je 0x6360a3
mov eax, dword [ebp + 0x20]
call fcn.0050af0c
test al, al
jne 0x636059
mov eax, dword [ebp + 0x20]
call fcn.00635fc4
test al, al
je 0x63607c
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00504fec
push eax
call sub.shell32.dll_SHGetFileInfoA
jmp 0x63609d
push 0x4010
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00504fec
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, dword [ebp - 0x174]
cmp byte [ebp + 0x1c], 0
je 0x6360ca
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x6361e8
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
jmp 0x6360e9
push 0x4001
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x6361e8
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.0051bc50
test bl, bl
je 0x636129
cmp byte [ebp + 0x14], 0
jne 0x636129
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0052cba8
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
test byte [ebp + 0x14], bl
je 0x6361bf
mov dl, 1
mov eax, dword [0x52aaf4]
call fcn.00531110
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0
push 0
push 0
mov eax, ebx
call fcn.005316e0
call fcn.0052cba8
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x184], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.00503350
add eax, dword [ebp - 8]
mov dword [ebp - 0x180], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.00503350
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x17c], eax
mov ecx, ebx
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 4]
call fcn.00635ee8
mov eax, ebx
call fcn.00503bcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6361dc
lea eax, [ebp + 0x20]
call fcn.00504b1c
ret
Function at 0x6419f8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x641a00
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x641b4d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov al, 1
call fcn.00594840
test bl, bl
je 0x641ad0
cmp dword [ebp - 4], 0
je 0x641a43
mov eax, dword [ebp - 4]
call fcn.00591880
test al, al
jne 0x641ad0
push 0
push 0
lea edx, [ebp - 0x10]
mov eax, 0x641b64
call fcn.00590ac0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.005053f4
mov eax, dword [ebp - 0xc]
mov cx, word [0x641b80]
mov dl, 2
call fcn.00593a3c
xor edx, edx
mov eax, esi
call fcn.00642e74
lea edx, [ebp - 4]
xor eax, eax
call fcn.00594840
cmp dword [ebp - 4], 0
je 0x641a95
mov eax, dword [ebp - 4]
call fcn.00591880
test al, al
jne 0x641ad0
push 0
push 0
lea edx, [ebp - 0x18]
mov eax, 0x641b8c
call fcn.00590ac0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.005053f4
mov eax, dword [ebp - 0x14]
mov cx, word [0x641b80]
mov dl, 1
call fcn.00593a3c
mov eax, dword [0x64a274]
mov eax, dword [eax]
call fcn.005891f8
jmp 0x641b0a
lea edx, [ebp - 0x28]
mov eax, 0x28
call fcn.0059ef38
lea edx, [ebp - 0x28]
lea eax, [ebp - 8]
call fcn.0051565c
cmp dword [ebp - 8], 0
je 0x641b0a
mov eax, dword [ebp - 8]
call fcn.00591880
test al, al
jne 0x641b0a
push 0
mov eax, dword [ebp - 8]
call fcn.00504fec
push eax
call sub.kernel32.dll_CreateDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x641b54
lea eax, [ebp - 0x28]
call fcn.00511ff0
lea eax, [ebp - 0x18]
call fcn.00504b1c
lea eax, [ebp - 0x14]
call fcn.00505238
lea eax, [ebp - 0x10]
call fcn.00504b1c
lea eax, [ebp - 0xc]
call fcn.00505238
lea eax, [ebp - 8]
mov edx, 2
call fcn.00504b40
ret