joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5032d2
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push fcn.00503221
push 0x10
push 0x2c
call fcn.0052e80c
push 0
push 0
push 8
mov dword [0x6b0640], eax
call fcn.0052e164
cmp word [0x6b0638], 0
mov dword [0x6b2c0c], eax
jne 0x5033b7
push edi
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x50332a
mov word [0x6b0638], di
jmp 0x503332
xor eax, eax
mov word [0x6b0638], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x6b0654], eax
test eax, eax
je 0x5033b6
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5cc038
push eax
call esi
push 0x5cc044
push dword [0x6b0654]
mov dword [0x6b0644], eax
call esi
push str.getnameinfo
push dword [0x6b0654]
mov dword [0x6b0648], eax
call esi
push str.WSAStringToAddressA
push dword [0x6b0654]
mov dword [0x6b064c], eax
call esi
cmp dword [0x6b0644], 0
mov dword [0x6b0650], eax
pop esi
je 0x5033b6
cmp dword [0x6b0648], 0
je 0x5033b6
cmp dword [0x6b064c], 0
je 0x5033b6
test eax, eax
je 0x5033b6
mov dword [0x6b063c], edi
pop edi
add esp, 0x190
ret
Function at 0x5034e8
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x840
push ebx
push ebp
push esi
push edi
push dword [0x6b2c0c]
xor esi, esi
mov dword [esp + 0x14], esi
call fcn.0052e0f9
mov ebp, dword [esp + 0x854]
xor edi, edi
inc edi
mov ebx, eax
mov dword [esp + 0x20], ebx
cmp word [ebp + 0x20], di
jne 0x503557
push esi
push esi
push dword [ebp]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
cmp esi, 0xffffffff
je 0x5036b9
lea eax, [ebp + 0x28]
push 0x18
push eax
call fcn.0052eaa2
pop ecx
pop ecx
mov ecx, eax
mov dword [esp + 0x10], edi
mov dword [ecx], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], ebp
mov eax, dword [ebp + 0x24]
mov dword [ebx + 4], eax
mov dword [ebx], ecx
jmp 0x5036b9
cmp word [ebp + 0x22], si
je 0x50358b
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x1c
push eax
lea eax, [esp + 0x38]
push eax
push esi
push 0x800
lea eax, [esp + 0x60]
push eax
push dword [ebp]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x5035b7
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x10
push eax
lea eax, [esp + 0x28]
push eax
push esi
push 0x800
lea eax, [esp + 0x60]
push eax
push dword [ebp]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
mov dword [esp + 0x14], eax
test edi, edi
jle 0x5036b9
lea ebx, [ebp + 0x28]
mov dword [esp + 0x10], 2
mov esi, dword [ebx]
jmp 0x5035fb
xor eax, eax
cmp word [ebp + 0x22], ax
je 0x5035e0
push dword [esp + 0x1c]
lea eax, [esp + 0x38]
jmp 0x5035e8
push dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
lea eax, [esi + 0xc]
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x503601
mov esi, dword [esi]
test esi, esi
jne 0x5035ce
jmp 0x50360b
lea ebx, [esi + 8]
test esi, esi
jne 0x50364a
lea ebx, [ebp + 0x28]
push 0x40
push ebx
call fcn.0052eaa2
mov ebx, eax
mov eax, dword [esp + 0x18]
pop ecx
pop ecx
mov dword [ebx], eax
lea edi, [ebx + 4]
mov dword [ebx + 0x24], ebp
mov al, byte [ebp + 0x22]
mov byte [ebx + 0x20], al
xor eax, eax
cmp word [ebp + 0x22], ax
je 0x503640
push 7
pop ecx
lea esi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
jmp 0x50364c
lea esi, [esp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x50363a
xor eax, eax
cmp dword [ebx + 0x2c], 0
jne 0x50367a
push edi
push eax
push dword [0x6aef98]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
lea ecx, [esp + 0x54]
mov dword [ebx + 0x2c], eax
push ecx
push eax
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x5036ad
mov eax, dword [ebx + 0x30]
add eax, edi
push eax
push dword [ebx + 0x2c]
push 8
push dword [0x6aef98]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
lea eax, [esp + 0x50]
push edi
push eax
mov eax, dword [ebx + 0x30]
add eax, ecx
mov dword [ebx + 0x2c], ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [ebx + 0x30], edi
mov eax, dword [esp + 0x20]
mov dword [eax], ebx
mov ecx, dword [ebp + 0x24]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x840
ret
Function at 0x503813
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [esi], 1
jne 0x503839
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
jmp 0x503876
cmp dword [esi + 0x2c], ebx
je 0x503876
mov edi, dword [ebp + 0x10]
cmp edi, dword [esi + 0x30]
jle 0x503849
mov edi, dword [esi + 0x30]
push edi
push dword [esi + 0x34]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0x30], edi
add esp, 0xc
add dword [esi + 0x34], edi
cmp dword [esi + 0x30], ebx
jne 0x503876
push dword [esi + 0x2c]
push ebx
push dword [0x6aef98]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 0x2c], ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x5038e3
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ecx
push ebx
push edi
push dword [esp + 0x14]
xor edi, edi
push dword [0x6b0640]
call fcn.0052e778
mov ebx, eax
test ebx, ebx
je 0x503a76
cmp dword [esp + 0x18], 0xffff
push ebp
push esi
ja 0x503a5d
mov ebp, dword [esp + 0x24]
push 2
pop ecx
push 0x17
pop eax
test ebp, 0x10000000
je 0x503930
mov dword [esp + 0x24], eax
and ebp, 0xefffffff
jmp 0x503936
mov eax, ecx
mov dword [esp + 0x24], ecx
test ebp, ebp
jne 0x50393b
inc ebp
push edi
push ebp
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
je 0x503a5d
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jle 0x503a52
push 0x17
pop eax
cmp dword [esp + 0x24], eax
je 0x503981
push 2
pop eax
push dword [esp + 0x20]
mov word [ebx + 4], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebx + 6], ax
mov eax, dword [esp + 0x28]
test eax, eax
je 0x5039dd
cmp word [eax], di
je 0x5039dd
push eax
call fcn.005c3170
cmp dword [esp + 0x24], 0x17
mov ecx, eax
mov dword [esp + 0x20], ecx
jne 0x5039c4
lea eax, [ebx + 0xc]
push eax
push ecx
push 0x17
call fcn.0050346a
add esp, 0xc
jmp 0x5039ce
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebx + 8], eax
push dword [esp + 0x20]
call fcn.005c3160
mov eax, dword [esp + 0x24]
jmp 0x5039fd
mov eax, dword [esp + 0x24]
cmp eax, 0x17
jne 0x5039fa
mov esi, 0x5cc010
lea edi, [ebx + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x14]
xor edi, edi
jmp 0x503a02
mov dword [ebx + 8], edi
cmp eax, 0x17
jne 0x503a06
push 0x1c
jmp 0x503a08
push 0x10
lea eax, [ebx + 4]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x503a52
cmp ebp, 1
jne 0x503a29
push 0x64
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x503a52
xor eax, eax
mov dword [ebx], esi
cmp dword [esp + 0x24], 0x17
mov word [ebx + 0x20], bp
sete al
mov word [ebx + 0x22], ax
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
jne 0x503a4b
mov dword [ebx + 0x24], ebx
jmp 0x503a4e
mov dword [ebx + 0x24], eax
mov edi, ebx
jmp 0x503a59
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
test edi, edi
jne 0x503a74
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x503a68
mov ebx, eax
push ebx
push dword [0x6b0640]
call fcn.0052e6ea
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
pop ecx
ret 0x10
Function at 0x503fce
Capabilities:
Get socket status
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x920
xor eax, eax
inc eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ebx
cmp dword [edi], eax
jne 0x504051
mov esi, dword [edi + 8]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
lea eax, [ebp - 0x120]
mov dword [ebp - 0x11c], esi
push eax
lea eax, [esi + 1]
mov dword [ebp - 0xc], ebx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x504048
je 0x50404d
lea eax, [ebp - 0x120]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x50404d
lea eax, [ebp + 8]
push eax
push 0x4004667f
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x504048
cmp dword [ebp + 8], ebx
je 0x504048
push 2
jmp 0x50404a
push 4
pop esi
jmp 0x5040ab
mov esi, ebx
jmp 0x5040ab
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x800
lea eax, [ebp - 0x920]
push eax
push dword [edi + 0x28]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp + 8], eax
test eax, eax
jle 0x5040ab
push 2
pop esi
push eax
push ebx
push dword [0x6aef98]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
push ecx
mov dword [edi + 0x30], ecx
lea ecx, [ebp - 0x920]
push ecx
push eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x34], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5040b6
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
lea eax, [ebp - 0x100]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0xff
push eax
mov dword [0x6b2c10], esi
mov dword [0x6b2c20], esi
mov dword [0x6b2c24], edi
mov dword [0x6b2c28], esi
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x504162
cmp edi, 0x10000000
jne 0x50413e
cmp dword [0x6b063c], esi
je 0x504162
mov eax, dword [0x6b0658]
test eax, eax
je 0x50411a
push eax
call dword [0x6b0648]
mov dword [0x6b0658], esi
push 0x6b0658
push esi
push esi
lea eax, [ebp - 0x100]
push eax
call dword [0x6b0644]
test eax, eax
jne 0x504162
mov eax, dword [0x6b0658]
mov dword [0x6b2c28], eax
jmp 0x50415f
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x504162
push 0x10
push eax
push 0x6b2c14
call sub.MSVCRT.dll_memcpy
add esp, 0xc
xor esi, esi
inc esi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5042e4
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
cmp eax, 0xffffffff
jne 0x504307
lea eax, [ebp + 0xc]
push eax
push 0x4004667f
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x50434e
push 2
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x504347
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2745
je 0x50434b
cmp eax, 0x2746
je 0x50434b
cmp eax, 0x2749
je 0x50434b
cmp eax, 0x274a
je 0x50434b
xor esi, esi
jmp 0x50434e
test esi, esi
jne 0x50434e
push 0xfffffffffffffffe
pop esi
mov eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x50452b
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x6b2c50]
call fcn.0052e739
mov ebx, eax
test ebx, ebx
je 0x50458f
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x504554
push dword [esp + 0xc]
push ebx
call eax
jmp 0x50458f
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.0052ef50
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.0052f030
pop edi
pop esi
pop ebx
ret 8

Function at 0x504647
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 1
call edi
mov ebx, 0x8000
test bx, ax
je 0x504661
inc esi
push 2
call edi
test bx, ax
je 0x50466d
or esi, 2
push 4
call edi
test bx, ax
je 0x504679
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x504c0f
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x14]
push eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x2c]
test esi, esi
jne 0x504c47
push dword [edi]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov dword [esp + 0x10], 1
test byte [edi + 0x14], 8
je 0x504d2c
call dword [sym.imp.USER32.dll_GetFocus]
cmp dword [edi], eax
jne 0x504d2c
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
sub ebp, dword [esp + 0x18]
mov dword [esp + 0x28], eax
test eax, eax
jle 0x504d5a
test ebp, ebp
jle 0x504d5a
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
test ebx, ebx
je 0x504d5a
push ebp
push dword [esp + 0x2c]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x2c], eax
test eax, eax
je 0x504d23
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [edi + 0x10], 0
je 0x504ccd
push 4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi + 0x10]
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x504ce2
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push 2
pop eax
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
sub dword [esp + 0x1c], eax
sub dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0xcc0020
xor eax, eax
push eax
push eax
push ebx
push ebp
push dword [esp + 0x3c]
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [esp + 0x2c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x504d5a
cmp dword [edi + 0x10], ebx
je 0x504d46
push 4
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi + 0x10]
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x504d5a
push ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
cmp dword [esp + 0x10], 0
je 0x504d6a
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x504d72
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetMessagePos]
mov edi, dword [esp + 0x20]
mov esi, eax
push 0xfffffffffffffff4
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [edi]
mov dword [esp + 0x14], eax
call fcn.00511aca
push eax
call fcn.005133ab
push dword [0x6b0674]
mov dword [esp + 0x24], eax
call fcn.0052e249
mov ebp, eax
movsx ecx, si
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
push dword [edi]
shr esi, 0x10
movsx ecx, si
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
mov edi, 0x8000
test di, ax
je 0x504de6
inc ebx
push 0x12
call esi
test di, ax
je 0x504df2
or ebx, 2
push 0x11
call esi
test di, ax
je 0x504dfe
or ebx, 4
mov eax, dword [esp + 0x14]
mov dword [ebp], eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 4], eax
call fcn.00504647
push 0x504e53
push ebp
push dword [esp + 0x2c]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x34]
push dword [esp + 0x2c]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x3c]
push dword [esp + 0x20]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0x44]
movzx eax, ax
push 0x332c
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x18], eax
call fcn.00517b86
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x50c4cd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push 0
push 0
push 0x1304
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x50c53f
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
cmp ebx, 0xffffffff
jne 0x50c4f6
mov ebx, eax
push dword [ebp]
call fcn.0050bc62
push ebx
push dword [ebp]
mov edi, eax
call fcn.0050bc39
add esp, 0xc
mov esi, eax
push 0
push ebx
push 0x130c
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [ebp]
call fcn.0050c55f
pop ecx
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x50e72a
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x6b2c34]
call fcn.0052e0f9
xor ebp, ebp
mov esi, eax
cmp dword [0x6b18a8], ebp
jne 0x50e806
xor ebx, ebx
inc ebx
mov dword [0x6b18a8], ebx
call fcn.005122ca
mov edi, 0xa4
push edi
push ebp
push 0x6b18b0
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x6b18b0], 0x13
lea eax, [esp + 0x10]
mov dword [0x6b18b4], edi
mov dword [0x6b18c0], 0x50e675
mov dword [0x6b18c4], 0x50e9c0
push eax
mov dword [0x6b1918], 0x50e650
mov dword [0x6b191c], 0x50e90b
mov dword [0x6b18bc], 0x50e62b
mov dword [0x6b1940], 0x50e690
mov dword [0x6b1954], ebx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x50e806
cmp dword [esp + 0x20], ebx
je 0x50e7ee
cmp dword [esp + 0x20], 2
jne 0x50e806
cmp dword [esp + 0x14], 5
jae 0x50e7f6
mov dword [0x6b1954], ebp
jmp 0x50e806
jne 0x50e806
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
and dword [0x6b1954], eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.00518b9b
mov eax, dword [esp + 0x140]
push ebp
push dword [0x6aef9c]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebp
push str.BUTTON
push ebp
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x50e8dc
push dword [esp + 0x128]
push dword [0x6b2c50]
call fcn.0052e778
mov edi, dword [esp + 0x13c]
mov esi, eax
mov dword [esi + 0x10], edi
test edi, edi
je 0x50e8ab
push edi
call fcn.0052881d
test eax, eax
je 0x50e8ab
push ebp
push ebp
push edi
call fcn.00528392
mov dword [esi + 0x18], eax
jmp 0x50e8ae
mov dword [esi + 0x18], ebp
push 0x50e37a
push 0xfffffffffffffffc
push ebx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x6b18b0
push ebx
push esi
push dword [esp + 0x134]
mov dword [0x6b18ac], eax
call fcn.00511af9
mov ebx, eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x114
ret 0x1c
Function at 0x510f06
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
push ebx
push ebp
push esi
push edi
push dword [0x6b2c34]
call fcn.0052e0f9
cmp dword [0x6b1c28], 0
mov edi, eax
mov esi, 0x50010000
jne 0x51106e
mov ebx, 0xa4
push ebx
push 0
push 0x6b1c30
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x6b1c30], 0x1b
mov dword [0x6b1c34], ebx
mov dword [0x6b1c38], 0x510876
mov dword [0x6b1c3c], 0x510bbb
mov dword [0x6b1c54], 0x5105f3
mov dword [0x6b1c64], 0x510bb1
mov dword [0x6b1c5c], 0x510b5c
mov dword [0x6b1c58], 0x5111ed
mov dword [0x6b1c44], 0x5116d4
mov dword [0x6b1c40], 0x510e02
mov dword [0x6b1c48], 0x510e4c
mov dword [0x6b1c4c], 0x511705
mov dword [0x6b1c70], 0x510d79
mov dword [0x6b1c74], 0x51168d
mov dword [0x6b1c68], 0x510ce8
mov dword [0x6b1c6c], 0x51153a
mov dword [0x6b1ca8], 0x511387
mov dword [0x6b1cac], 0x510c00
mov dword [0x6b1cb0], 0x5113da
mov dword [0x6b1cb4], 0x510c8c
mov dword [0x6b1cb8], 0x51144c
mov dword [0x6b1cbc], 0x510cc6
mov dword [0x6b1ca0], 0x510c5b
mov dword [0x6b1cd0], 0x51146e
call fcn.005122ca
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x511064
cmp dword [esp + 0x24], 2
jne 0x511064
cmp dword [esp + 0x18], 6
jb 0x511064
mov eax, dword [0x6b0660]
mov dword [0x6b1c2c], eax
mov dword [0x6b1c28], 1
test byte [esp + 0x140], 2
jne 0x51107d
mov esi, 0x50010002
test byte [esp + 0x140], 1
jne 0x51108a
or esi, 5
test byte [esp + 0x140], 0x20
je 0x511097
or esi, 0x20
push 0x1f4
push 0
push dword [0x6aef98]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x13c]
push eax
call fcn.00518b9b
test ebp, ebp
je 0x5111da
push 0
push dword [0x6aef9c]
push 0xffffffffffffffff
push dword [edi]
push dword [esp + 0x14c]
push dword [esp + 0x14c]
push dword [esp + 0x14c]
push dword [esp + 0x14c]
push esi
push 0
push str.SysTreeView32
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x5111de
push dword [esp + 0x12c]
push dword [0x6b2c50]
call fcn.0052e778
push 0x51174e
push 0xfffffffffffffffc
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 4
push 4
push 0x112c
push ebx
mov dword [0x6b1cd4], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x6b1c30
push ebx
push edi
push dword [esp + 0x138]
mov dword [edi + 0x14], ebp
mov dword [edi + 0x18], 0x19
call fcn.00511af9
mov ebx, eax
mov eax, 0x100
test dword [esp + 0x140], eax
je 0x5111de
or esi, eax
push esi
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowLongW]
test dword [esp + 0x140], 0x10000
je 0x5111de
call fcn.00513133
cmp eax, 0x3c
jg 0x5111ad
push edi
call fcn.00510a98
pop ecx
push 0
push 2
push 0x1108
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x5111ca
push eax
push dword [edi]
call fcn.00512da1
push edi
push str.PB_3State
push dword [edi]
call dword [sym.imp.USER32.dll_SetPropW]
jmp 0x5111de
mov ebx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x118
ret 0x18
Function at 0x5125d2
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
lea eax, [ebp - 0x208]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [ebp + 8]
or eax, 0x4000
push eax
push 0x2b4
lea eax, [ebp - 0x4bc]
push eax
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret 4