joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b0ebc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov ebp, eax
push 0
push 0
push 0
push 0
push esi
push ebp
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
test bl, bl
je 0x5b0f38
test esi, esi
je 0x5b0ee9
cmp word [esi], 0
jne 0x5b0f38
call fcn.0042719c
cmp eax, 2
je 0x5b0f38
xor ebx, ebx
xor esi, esi
mov dword [esp + 4], 2
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push esi
push ebp
call sub.advapi32.dll_RegEnumValueW
mov edi, eax
test edi, edi
je 0x5b0f26
cmp edi, 0xea
jne 0x5b0f38
test edi, edi
jne 0x5b0f35
cmp word [esp], 0
jne 0x5b0f35
mov bl, 1
jmp 0x5b0f38
inc esi
jmp 0x5b0ef7
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5b0fa4
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x5b0fb8
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyW
pop esi
pop ebx
ret
cmp dword [0x6697c0], 0
jne 0x5b0fdb
push 0x5b1000
push 0x5b1020
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00411e58
mov dword [0x6697c0], eax
cmp dword [0x6697c0], 0
je 0x5b0ff5
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x6697c0]
jmp 0x5b0ffa
mov eax, 0x7f
pop esi
pop ebx
ret

Function at 0x5b0fa5
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x5b0fb8
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyW
pop esi
pop ebx
ret
cmp dword [0x6697c0], 0
jne 0x5b0fdb
push 0x5b1000
push 0x5b1020
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00411e58
mov dword [0x6697c0], eax
cmp dword [0x6697c0], 0
je 0x5b0ff5
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x6697c0]
jmp 0x5b0ffa
mov eax, 0x7f
pop esi
pop ebx
ret
Function at 0x5b103c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x5b11af
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
je 0x5b1070
mov eax, dword [ebp - 0x10]
cmp word [eax], 0
jne 0x5b107a
mov ebx, 0x57
jmp 0x5b1199
call fcn.0042719c
cmp eax, 2
jne 0x5b1188
push 0
push 8
lea eax, [ebp - 0x14]
push eax
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.005b0f7c
test eax, eax
jne 0x5b1188
xor eax, eax
push ebp
push 0x5b1181
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.004088a0
xor eax, eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5b10d5
sub ebx, 4
mov ebx, dword [ebx]
mov dword [ebp - 0x1c], ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.00408cc4
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov esi, eax
cmp esi, 0xea
jne 0x5b1140
mov edi, dword [ebp - 4]
test edi, edi
je 0x5b1110
sub edi, 4
mov edi, dword [edi]
cmp edi, 0x10000
jge 0x5b116a
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x5b112f
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.004088a0
jmp 0x5b10c9
test esi, esi
jne 0x5b116a
mov eax, dword [ebp - 4]
call fcn.004097c8
mov ecx, eax
movzx eax, byte [ebp - 5]
mov edx, dword [ebp - 0x14]
call fcn.005b103c
test eax, eax
je 0x5b10c9
inc dword [ebp - 0x18]
jmp 0x5b10c9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b1188
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.005b0fa4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b11b6
lea eax, [ebp - 4]
call fcn.00408718
ret
Function at 0x5b1248
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, eax
call fcn.0042719c
cmp eax, 2
je 0x5b1265
mov byte [ebp - 1], 1
jmp 0x5b143a
mov byte [ebp - 1], 0
mov eax, 0x661808
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x5b143a
xor eax, eax
push ebp
push 0x5b1433
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x5b12ce
push 0x5b1444
push 0x5b1470
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00411e58
mov ebx, eax
test ebx, ebx
je 0x5b12f5
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x5b141c
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x5b141c
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x5b1346
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x5b1327
call fcn.00407f08
jmp 0x5b143a
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x5b1346
call fcn.00407f08
jmp 0x5b143a
xor eax, eax
push ebp
push 0x5b1415
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x5b1389
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x5b1389
call fcn.00407f08
call fcn.00407f08
jmp 0x5b143a
mov eax, dword [ebp - 0x14]
call fcn.00405490
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x5b13bb
call fcn.00407f08
call fcn.00407f08
jmp 0x5b143a
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x5b13f6
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x5b13f2
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x5b13f2
mov byte [ebp - 1], 1
jmp 0x5b13f6
inc ebx
dec esi
jne 0x5b13c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b141c
mov eax, dword [ebp - 0x18]
call fcn.004054ac
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b143a
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b1f0c
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5b1fa9
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0042719c
cmp eax, 2
jne 0x5b1f4f
push 1
mov eax, esi
call fcn.004097c8
push eax
mov eax, edi
call fcn.004097c8
push eax
call sub.kernel32.dll_MoveFileExW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x5b1f93
mov eax, esi
call fcn.004097c8
mov edx, eax
lea eax, [ebp - 4]
call fcn.0040982c
mov eax, dword [ebp - 4]
call fcn.00420f94
mov ebx, eax
test bl, bl
jne 0x5b1f78
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x5b1f93
mov eax, esi
call fcn.004097c8
push eax
mov eax, edi
call fcn.004097c8
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b1fb0
lea eax, [ebp - 4]
call fcn.00408718
ret

Function at 0x5b44c0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret
Function at 0x5b7920
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x669804
mov eax, esi
mov edx, 8
test al, 1
je 0x5b793c
shr eax, 1
xor eax, 0xedb88320
jmp 0x5b793e
shr eax, 1
dec edx
jne 0x5b792f
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5b7928
pop esi
ret

Function at 0x5b7954
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x669800], 0
jne 0x5b797e
call fcn.005b7920
mov dword [esp], 0x669800
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x5b79a8
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x669804]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x5b7984
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5ca944
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
lea edi, [ebp - 0xd]
mov bl, 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0x18]
dec esi
test esi, esi
jl 0x5caaf4
inc esi
mov eax, dword [ebp + 8]
push eax
mov eax, edi
mov edx, 5
call fcn.005c9580
pop ecx
test al, al
jne 0x5ca98b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.005cac28
xor ebx, ebx
jmp 0x5caaf4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
cmp eax, dword [edi]
ja 0x5ca9a9
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.005cac28
xor ebx, ebx
jmp 0x5caaf4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 4]
mov edx, dword [edi]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.005e1eb0
test eax, eax
jne 0x5ca9e0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.005cac28
xor ebx, ebx
jmp 0x5caaf4
test byte [edi + 4], 1
je 0x5caaed
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov edx, 4
call fcn.005c9580
pop ecx
test al, al
jne 0x5caa14
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.005cac28
xor ebx, ebx
jmp 0x5caaf4
mov edx, dword [0x5c68ec]
mov eax, 0xc
call fcn.0040abbc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5caabf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.004092f0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00408ccc
mov edx, dword [ebp - 4]
call fcn.005c9580
pop ecx
test al, al
jne 0x5caa82
mov edx, dword [0x5c68ec]
mov eax, dword [ebp - 8]
call fcn.0040abd0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.005cac28
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5caaf4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.005c1e68
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
call fcn.005c2280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5caaed
dec esi
jne 0x5ca962
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d59b8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5d5a35
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.005c24f8
mov eax, dword [ebp - 4]
call fcn.005c1e68
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x30]
mov ebx, dword [eax + 0xc]
dec ebx
cmp ebx, 0
jl 0x5d5a1c
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 4]
mov esi, dword [eax + ebx*4]
mov eax, dword [esi + 4]
cmp eax, dword [ebp - 8]
jne 0x5d5a16
mov eax, dword [esi]
mov edx, dword [ebp - 4]
call fcn.00409140
je 0x5d5a1f
dec ebx
cmp ebx, 0xffffffff
jne 0x5d59f9
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d5a3c
lea eax, [ebp - 4]
call fcn.0040873c
ret
Function at 0x5e7df8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ebx, ebx
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x5e7e44
cmp dword [ebp - 0x104], 2
jne 0x5e7e44
cmp dword [ebp - 0x110], 5
ja 0x5e7e42
cmp dword [ebp - 0x110], 5
jne 0x5e7e44
cmp dword [ebp - 0x10c], 1
jb 0x5e7e44
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5e7e4c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00421884
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5eae04
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00421884
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ef018
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00421884
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f0d30
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
xor edx, edx
mov dword [ebp - 0x25c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5f0e02
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x258]
push eax
lea edx, [ebp - 0x25c]
mov eax, ebx
call fcn.005af4ec
lea eax, [ebp - 0x25c]
mov edx, 0x5f0e20
call fcn.004099c0
mov eax, dword [ebp - 0x25c]
call fcn.004097c8
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x5f0de9
xor eax, eax
push ebp
push 0x5f0de2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
call fcn.005f0ce0
test al, al
je 0x5f0db7
mov byte [ebp - 1], 1
jmp 0x5f0dcb
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5f0da2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f0de9
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f0e09
lea eax, [ebp - 0x25c]
call fcn.00408718
ret

Function at 0x5f0e24
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
push 0x200
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.004097c8
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5f0e64
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.00409868
jmp 0x5f0e6b
mov eax, ebx
call fcn.00408718
add esp, 0x2b4
pop esi
pop ebx
ret
Function at 0x5f0e74
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x661a7c]
or eax, 0x4001
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.004097c8
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5f0eb3
mov eax, dword [esp + 4]
jmp 0x5f0eb5
xor eax, eax
add esp, 0x2b4
pop esi
pop ebx
ret

Function at 0x5f0ec0
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x661a84]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x5f0f04
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5f0ef9
mov eax, dword [esp + 4]
jmp 0x5f0efb
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x5f0ee3
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x661a84]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x5f0f04
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5f0ef9
mov eax, dword [esp + 4]
jmp 0x5f0efb
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x5f13a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
test dl, dl
je 0x5f13b4
add esp, 0xfffffff0
call fcn.00406f90
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.004ffd40
mov eax, dword [0x5f1454]
not eax
and dword [esi + 0x60], eax
mov edx, 0x79
mov eax, esi
call fcn.004fc0a4
mov edx, 0x61
mov eax, esi
call fcn.004fc0d8
xor edx, edx
mov eax, esi
call fcn.004fcdd8
mov dl, 1
mov eax, esi
call fcn.00505f04
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 6
jae 0x5f1410
mov dx, 0xfffe
mov eax, esi
call fcn.004fce20
push 0
lea eax, [ebp - 0x5c]
push eax
push 0x5c
push 0x1f
call sub.user32.dll_SystemParametersInfoW
test eax, eax
je 0x5f1436
lea eax, [ebp - 0x5c]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov edx, eax
mov eax, dword [esi + 0x74]
call fcn.004dd35c
mov eax, esi
test bl, bl
je 0x5f144b
call fcn.00406fe8
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5f24f0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5f26bc
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5f268f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
test eax, eax
je 0x5f254d
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jne 0x5f258b
mov eax, ebx
call fcn.005f1160
test al, al
jne 0x5f256b
mov byte [ebp - 5], 0
call fcn.00407f08
jmp 0x5f2696
lea edx, [ebp - 0x264]
mov eax, ebx
call fcn.005f0e24
mov ecx, dword [ebp - 0x264]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.005f2914
mov byte [ebp - 5], 1
lea eax, [ebp - 0x260]
push eax
lea edx, [ebp - 0x268]
mov eax, ebx
call fcn.005af4ec
lea eax, [ebp - 0x268]
mov edx, 0x5f26dc
call fcn.004099c0
mov eax, dword [ebp - 0x268]
call fcn.004097c8
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5f2678
xor eax, eax
push ebp
push 0x5f2671
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
call fcn.005f0ce0
test al, al
je 0x5f2646
lea eax, [ebp - 4]
lea edx, [ebp - 0x234]
mov ecx, 0x104
call fcn.00409868
lea edx, [ebp - 0x270]
mov eax, ebx
call fcn.005af4ec
lea eax, [ebp - 0x270]
mov edx, dword [ebp - 4]
call fcn.004099c0
mov eax, dword [ebp - 0x270]
lea edx, [ebp - 0x26c]
call fcn.005f0e24
mov eax, dword [ebp - 0x26c]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 4]
mov edx, esi
call fcn.005f1f08
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5f25df
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f2678
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f2696
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f26c3
lea eax, [ebp - 0x270]
mov edx, 4
call fcn.00408778
lea eax, [ebp - 4]
call fcn.00408718
ret
Function at 0x5f29ac
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5f2ba2
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x5f2a31
lea edx, [ebp - 0x264]
mov eax, edi
call fcn.005afa70
mov eax, dword [ebp - 0x264]
push eax
lea edx, [ebp - 0x268]
mov eax, ebx
call fcn.005af4ec
mov eax, dword [ebp - 0x268]
pop edx
call fcn.005af6fc
test eax, eax
jne 0x5f2a31
lea edx, [ebp - 4]
mov eax, edi
call fcn.005afa48
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5f2b70
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
push eax
lea edx, [ebp - 0x26c]
mov eax, ebx
call fcn.005af4ec
lea eax, [ebp - 0x26c]
mov edx, 0x5f2bbc
call fcn.004099c0
mov eax, dword [ebp - 0x26c]
call fcn.004097c8
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5f2b59
xor eax, eax
push ebp
push 0x5f2b52
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
call fcn.005f0ce0
test al, al
je 0x5f2b23
lea eax, [ebp - 8]
lea edx, [ebp - 0x234]
mov ecx, 0x104
call fcn.00409868
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.005af6fc
test eax, eax
je 0x5f2b23
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.005f2004
test eax, eax
jne 0x5f2b23
lea edx, [ebp - 0x274]
mov eax, ebx
call fcn.005af4ec
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 8]
call fcn.004099c0
mov eax, dword [ebp - 0x274]
lea edx, [ebp - 0x270]
call fcn.005f0e24
mov eax, dword [ebp - 0x270]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.005f1f08
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5f2a99
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f2b59
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f2b77
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x5f2e74
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00421884
add esp, 0x208
pop ebx
ret

Function at 0x5f638c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret