joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4897c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
mov eax, dword [ecx + 0x40]
mov dword [esp + 0xc], ecx
push ebx
push ebp
mov ecx, dword [eax]
push esi
cmp ecx, eax
push edi
mov dword [esp + 0x20], ecx
je 0x4899bd
jmp 0x4897e2
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 8]
mov ebx, 2
mov dword [esp + 0x24], edi
lea esi, [edi + 4]
mov ebp, 2
mov ecx, dword [esp + 0x78]
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x20]
push eax
mov dword [esp + 0x1c], eax
call fcn.00489f60
test al, al
je 0x489879
mov eax, dword [esp + 0x14]
test eax, eax
mov edi, eax
je 0x489838
mov ecx, dword [eax + 0x128]
push 0x6267d8
mov edx, dword [ecx]
call dword [edx + 0x1c]
test al, al
je 0x489838
mov ecx, edi
call fcn.0052d310
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x40]
push eax
push ecx
mov ecx, dword [esp + 0x7c]
call fcn.0043c890
mov edx, dword [eax]
lea ecx, [esp + 0x34]
mov dword [esp + 0x30], edx
mov al, byte [eax + 4]
lea edx, [esp + 0x30]
push ecx
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x3c], al
call fcn.004b8b30
push eax
lea ecx, [esp + 0x54]
call fcn.004b8b50
mov edi, dword [esp + 0x24]
add esi, 4
dec ebp
jne 0x4897f6
dec ebx
jne 0x4897f1
lea eax, [esp + 0x13]
mov ecx, edi
push eax
call fcn.0046f660
push eax
lea ecx, [esp + 0x1c]
call fcn.0053dc70
mov eax, dword [edi]
lea ecx, [esp + 0x28]
push eax
push ecx
mov ecx, edi
call fcn.00561700
mov edx, dword [eax]
lea eax, [esp + 0x30]
push edx
push eax
lea ecx, [esp + 0x24]
call fcn.00561700
push ecx
mov ecx, esp
push eax
call fcn.005d82d0
lea ecx, [esp + 0x24]
call fcn.004229d0
mov eax, dword [esp + 0x18]
mov esi, dword [eax]
cmp esi, eax
je 0x48993b
mov eax, dword [esi + 8]
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 0x128]
mov dl, byte [ecx + 0x6d]
test dl, dl
jne 0x489931
mov edx, dword [esp + 0x78]
mov ecx, dword [esp + 0x1c]
push edx
push eax
call fcn.00489f60
test al, al
je 0x489931
lea eax, [esp + 0x14]
lea ecx, [esp + 0x58]
push eax
push ecx
mov ecx, dword [esp + 0x7c]
call fcn.0043c890
mov ecx, dword [eax]
mov al, byte [eax + 4]
lea edx, [esp + 0x38]
mov dword [esp + 0x38], ecx
push edx
lea ecx, [esp + 0x64]
mov byte [esp + 0x40], al
call fcn.004b8b50
mov esi, dword [esi]
mov eax, dword [esp + 0x18]
cmp esi, eax
jne 0x4898dc
xor ebx, ebx
xor esi, esi
cmp esi, 0xffffffff
jne 0x48994a
mov dword [esp + 0x14], ebx
jmp 0x489983
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov eax, dword [edi + eax*4 + 0x14]
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x489983
mov ecx, dword [esp + 0x78]
push ecx
mov ecx, dword [esp + 0x20]
push eax
call fcn.00489f60
test al, al
je 0x489983
mov ecx, dword [esp + 0x74]
lea edx, [esp + 0x14]
lea eax, [esp + 0x68]
push edx
push eax
call fcn.0043c890
add esi, 2
cmp esi, 6
jle 0x48993f
lea ecx, [esp + 0x18]
call fcn.00561b10
mov ecx, dword [esp + 0x18]
push 1
push ecx
lea ecx, [esp + 0x20]
call fcn.00561ad0
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov eax, dword [edx]
mov edx, dword [ecx + 0x40]
cmp eax, edx
mov dword [esp + 0x20], eax
jne 0x4897de
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 8
Function at 0x494520
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
sub esp, 0x31c
push ebx
push esi
lea eax, [esp + 0x124]
push edi
push eax
push 0x139
xor bl, bl
call fcn.0045e0e0
mov ecx, eax
call fcn.00404ab0
mov dword [esp + 0x10], 0x104
call fcn.0045e0e0
xor edi, edi
lea ecx, [esp + 0xf]
push edi
mov esi, eax
push ecx
lea ecx, [esp + 0x28]
add esi, 0x4d4
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call fcn.0046fe80
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edx
push eax
push ecx
lea ecx, [esp + 0x24]
call fcn.00406710
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push 0x20019
push edi
push eax
push reloc.ijl15.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4946a5
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
push edx
push edi
push edi
push str.AppPath
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x14]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x4946a5
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
mov ebp, dword [esp + 0x330]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
dec ecx
je 0x494623
mov esi, ecx
push edx
call fcn.005f1c8f
add esp, 4
dec esi
mov edx, eax
jne 0x494615
mov al, byte [edx]
mov cl, byte [0x609640]
cmp al, cl
je 0x494659
mov edi, 0x609640
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
pop ebp
je 0x4946a3
cmp eax, 0xb7
je 0x4946a3
xor bl, bl
jmp 0x4946a5
mov bl, 1
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
sub ecx, eax
test eax, eax
je 0x4946e6
cmp ecx, 0x80
jbe 0x4946d0
push eax
call fcn.005f0905
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
add esp, 0x31c
ret
dec ecx
shr ecx, 3
mov edx, dword [ecx*4 + 0x61f1a0]
lea ecx, [ecx*4 + 0x61f1a0]
mov dword [eax], edx
mov dword [ecx], eax
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0x31c
ret
Function at 0x4de3f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xb8
push esi
lea esi, [ecx + 0x44]
lea eax, [esp + 0xc0]
lea ecx, [esp + 0x50]
push eax
push ecx
mov ecx, esi
call fcn.004843e0
mov edx, dword [eax]
lea eax, [esp + 0x48]
push eax
mov ecx, esi
mov dword [esp + 8], edx
call fcn.005d8060
mov ecx, dword [esp + 4]
mov edx, dword [eax]
cmp ecx, edx
je 0x4de438
mov edx, dword [esp + 0xc0]
mov eax, dword [ecx + 0x10]
cmp edx, eax
jae 0x4de496
lea ecx, [esp + 0x8c]
call fcn.004dc980
mov ecx, dword [esp + 0xc0]
push eax
mov dword [esp + 0x58], ecx
lea ecx, [esp + 0x60]
call fcn.00470420
lea edx, [esp + 0x54]
lea eax, [esp + 4]
push edx
push ecx
mov ecx, esp
push eax
call fcn.005d82d0
lea ecx, [esp + 0x4c]
push ecx
mov ecx, esi
call fcn.004e0750
mov edx, dword [eax]
lea ecx, [esp + 0x5c]
mov dword [esp + 4], edx
call fcn.004709d0
lea ecx, [esp + 0x8c]
call fcn.004709d0
mov ecx, dword [esp + 4]
lea eax, [esp + 0xb]
lea esi, [ecx + 0x18]
push eax
lea ecx, [esp + 0x10]
call fcn.0053dc70
lea ecx, [esp + 0x3c]
push ecx
mov ecx, esi
call fcn.005d8060
mov edx, dword [eax]
lea eax, [esp + 0x4c]
push edx
push eax
mov ecx, esi
call fcn.00561700
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.00561700
push ecx
mov ecx, esp
push eax
call fcn.005d82d0
lea ecx, [esp + 0x18]
call fcn.004704c0
mov ax, word [esi + 4]
mov word [esp + 0x10], ax
mov cx, word [esi + 6]
mov word [esp + 0x12], cx
mov dl, byte [esi + 8]
mov byte [esp + 0x14], dl
fld dword [esi + 0xc]
fst dword [esp + 0x18]
mov eax, dword [esi + 0x10]
mov dword [esp + 0x1c], eax
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x20], ecx
mov edx, dword [esi + 0x18]
mov dword [esp + 0x24], edx
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x28], eax
mov ecx, dword [esi + 0x20]
mov dword [esp + 0x2c], ecx
mov edx, dword [esi + 0x24]
mov dword [esp + 0x30], edx
mov eax, dword [esi + 0x28]
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x2c]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x38], ecx
fstp dword [esp + 4]
mov esi, dword [eax]
cmp esi, eax
je 0x4de563
mov eax, esi
mov esi, dword [esi]
push 1
push eax
lea ecx, [esp + 0x14]
call fcn.00561ad0
mov eax, dword [esp + 0xc]
cmp esi, eax
jne 0x4de54b
mov dword [eax], eax
mov eax, dword [esp + 0xc]
push 1
lea ecx, [esp + 0x10]
mov dword [eax + 4], eax
mov edx, dword [esp + 0x10]
push edx
call fcn.00561ad0
fld dword [esp + 4]
pop esi
add esp, 0xb8
ret 4
Function at 0x4de590
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xa8
push esi
lea esi, [ecx + 0x44]
lea eax, [esp + 0xb4]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.004843e0
mov edx, dword [eax]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 8], edx
call fcn.005d8060
mov ecx, dword [esp + 4]
mov edx, dword [eax]
cmp ecx, edx
je 0x4de5d8
mov edx, dword [esp + 0xb4]
mov eax, dword [ecx + 0x10]
cmp edx, eax
jae 0x4de630
lea ecx, [esp + 0x7c]
call fcn.004dc980
mov ecx, dword [esp + 0xb4]
push eax
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x50]
call fcn.00470420
lea edx, [esp + 0x44]
lea eax, [esp + 4]
push edx
push ecx
mov ecx, esp
push eax
call fcn.005d82d0
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.004e0750
mov edx, dword [eax]
lea ecx, [esp + 0x4c]
mov dword [esp + 4], edx
call fcn.004709d0
lea ecx, [esp + 0x7c]
call fcn.004709d0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xb0]
lea edx, [esp + 8]
mov dword [ecx + 0x24], eax
lea ecx, [esp + 0xb4]
push ecx
push edx
mov ecx, esi
call fcn.004843e0
mov eax, dword [eax]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov dword [esp + 8], eax
call fcn.005d8060
mov ecx, dword [esp + 4]
mov edx, dword [eax]
cmp ecx, edx
je 0x4de678
mov edx, dword [esp + 0xb4]
mov eax, dword [ecx + 0x10]
cmp edx, eax
jae 0x4de6d0
lea ecx, [esp + 0x7c]
call fcn.004dc980
mov ecx, dword [esp + 0xb4]
push eax
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x50]
call fcn.00470420
lea edx, [esp + 0x44]
lea eax, [esp + 4]
push edx
push ecx
mov ecx, esp
push eax
call fcn.005d82d0
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004e0750
mov edx, dword [eax]
lea ecx, [esp + 0x4c]
mov dword [esp + 4], edx
call fcn.004709d0
lea ecx, [esp + 0x7c]
call fcn.004709d0
mov ecx, dword [esp + 4]
lea esi, [ecx + 0x18]
lea ecx, [esp + 0x14]
push esi
call fcn.004e05d0
mov ax, word [esi + 4]
mov word [esp + 0x18], ax
mov cx, word [esi + 6]
mov word [esp + 0x1a], cx
mov dl, byte [esi + 8]
mov byte [esp + 0x1c], dl
mov eax, dword [esi + 0xc]
mov dword [esp + 0x20], eax
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x24], ecx
mov edx, dword [esi + 0x14]
mov dword [esp + 0x28], edx
mov eax, dword [esi + 0x18]
mov dword [esp + 0x2c], eax
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x30], ecx
mov edx, dword [esi + 0x20]
mov dword [esp + 0x34], edx
mov eax, dword [esi + 0x24]
mov dword [esp + 0x38], eax
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x3c], ecx
mov edx, dword [esi + 0x2c]
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], edx
call fcn.00561b10
mov eax, dword [esp + 0x14]
push 1
push eax
lea ecx, [esp + 0x1c]
call fcn.00561ad0
pop esi
add esp, 0xa8
ret 8
Function at 0x4df9b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xa8
lea eax, [esp + 0xac]
push ebx
push esi
lea esi, [ecx + 0x44]
push edi
lea ecx, [esp + 0xc]
push eax
mov edi, dword [esi]
push ecx
mov ecx, esi
xor bl, bl
call fcn.004f4df0
cmp dword [eax], edi
je 0x4dfb50
lea edx, [esp + 0xb8]
lea eax, [esp + 0x48]
push edx
push eax
mov ecx, esi
call fcn.004843e0
mov ecx, dword [eax]
lea edx, [esp + 0x44]
mov dword [esp + 0xc], ecx
push edx
mov ecx, esi
call fcn.005d8060
mov ecx, eax
mov eax, dword [esp + 0xc]
cmp eax, dword [ecx]
je 0x4dfa1a
mov edx, dword [esp + 0xb8]
mov ecx, dword [eax + 0x10]
cmp edx, ecx
jae 0x4dfa71
lea ecx, [esp + 0x4c]
call fcn.004dc980
push eax
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x84]
call fcn.004e0820
push eax
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
push edx
call fcn.005d82d0
lea eax, [esp + 0x48]
mov ecx, esi
push eax
call fcn.004e0750
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x84]
call fcn.004709d0
lea ecx, [esp + 0x4c]
call fcn.004709d0
mov eax, dword [esp + 0xc]
lea esi, [eax + 0x18]
lea ecx, [esp + 0x10]
push esi
call fcn.004e05d0
mov dx, word [esi + 4]
mov word [esp + 0x14], dx
mov ax, word [esi + 6]
mov word [esp + 0x16], ax
mov cl, byte [esi + 8]
mov byte [esp + 0x18], cl
mov edx, dword [esi + 0xc]
mov dword [esp + 0x1c], edx
mov eax, dword [esi + 0x10]
mov dword [esp + 0x20], eax
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x24], ecx
mov edx, dword [esi + 0x18]
mov dword [esp + 0x28], edx
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x2c], eax
mov ecx, dword [esi + 0x20]
mov dword [esp + 0x30], ecx
mov edx, dword [esi + 0x24]
mov dword [esp + 0x34], edx
mov eax, dword [esi + 0x28]
mov dword [esp + 0x38], eax
mov ecx, dword [esi + 0x2c]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x3c], ecx
mov esi, dword [eax]
cmp esi, eax
je 0x4dfb19
mov ecx, dword [0x621804]
mov eax, esi
mov esi, dword [esi]
push 1
mov eax, dword [eax + 8]
mov edx, dword [ecx]
push eax
call dword [edx + 0x24]
test eax, eax
je 0x4dfb11
mov eax, dword [eax + 0x128]
push 0x621c78
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x4dfb11
mov bl, 1
mov eax, dword [esp + 0x10]
cmp esi, eax
jne 0x4dfae0
mov esi, dword [eax]
cmp esi, eax
je 0x4dfb37
mov eax, esi
mov esi, dword [esi]
push 1
push eax
lea ecx, [esp + 0x18]
call fcn.00561ad0
mov eax, dword [esp + 0x10]
cmp esi, eax
jne 0x4dfb1f
mov dword [eax], eax
mov eax, dword [esp + 0x10]
push 1
lea ecx, [esp + 0x14]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x14]
push eax
call fcn.00561ad0
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0xa8
ret 4
Function at 0x527af0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
add ecx, 0x1ac
push ebx
push ebp
push esi
cmp eax, ecx
push edi
je 0x527c28
mov eax, dword [eax]
mov ebp, dword [ecx]
mov edi, dword [eax]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov ebx, dword [ebp]
cmp edi, eax
je 0x527be2
cmp ebx, ebp
je 0x527be6
mov eax, dword [edi]
mov esi, ebx
mov ebx, dword [ebx]
mov dword [esp + 0x10], eax
mov cl, byte [esi + 0xc]
mov byte [edi + 0xc], cl
mov dl, byte [esi + 0xd]
mov byte [edi + 0xd], dl
mov ax, word [esi + 0xe]
mov word [edi + 0xe], ax
mov ecx, dword [esi + 0x10]
mov dword [edi + 0x10], ecx
mov edx, dword [esi + 0x14]
lea eax, [esi + 0x18]
lea ecx, [edi + 0x18]
push eax
mov dword [edi + 0x14], edx
call fcn.00407c80
lea ecx, [esi + 0x24]
push ecx
lea ecx, [edi + 0x24]
call fcn.00407c80
lea edx, [esi + 0x30]
lea ecx, [edi + 0x30]
push edx
call fcn.00407c80
lea eax, [esi + 0x3c]
lea ecx, [edi + 0x3c]
push eax
call fcn.00407c80
mov ecx, dword [esi + 0x48]
mov dword [edi + 0x48], ecx
mov edx, dword [esi + 0x4c]
mov dword [edi + 0x4c], edx
mov al, byte [esi + 0x50]
mov byte [edi + 0x50], al
mov ecx, dword [esi + 0x54]
mov dword [edi + 0x54], ecx
mov edx, dword [esi + 0x58]
mov dword [edi + 0x58], edx
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
mov ecx, dword [esi + 0x60]
mov dword [edi + 0x60], ecx
mov edx, dword [esi + 0x64]
lea ecx, [esi + 0x6c]
mov dword [edi + 0x64], edx
mov eax, dword [esi + 0x68]
push ecx
lea ecx, [edi + 0x6c]
mov dword [edi + 0x68], eax
call fcn.00407c80
add esi, 0x78
lea ecx, [edi + 0x78]
push esi
call fcn.00407c80
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp edi, eax
jne 0x527b22
cmp ebx, ebp
jne 0x527c10
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
push ecx
mov dword [ecx], eax
mov ecx, esp
push edx
call fcn.005d82d0
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x20]
push eax
call fcn.00527d50
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
push ebp
push ebx
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
push edx
call fcn.005d82d0
mov ecx, dword [esp + 0x2c]
call fcn.00527da0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x5d3a20
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
mov ecx, 8
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0xc]
pop edi
add esp, 0x20
ret

Function at 0x5d3aa0
Capabilities:
Get file attributes

Disassembly:
mov ecx, dword [esp + 0x10]
sub esp, 0x200
lea eax, [esp]
push ebx
push eax
push ecx
xor bl, bl
call fcn.0045e0e0
mov ecx, eax
call fcn.00404ab0
test eax, eax
jne 0x5d3acd
xor al, al
pop ebx
add esp, 0x200
ret
lea edx, [esp + 4]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
test ebp, ebp
je 0x5d3b2b
push esi
push str.EBUEula
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x5d3b23
push edi
mov edi, dword [esp + 0x21c]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc eax
mov ecx, dword [esp + 0x214]
neg eax
sbb eax, eax
push 1
and eax, edi
push eax
mov eax, dword [esp + 0x220]
push eax
push ecx
call esi
add esp, 0x10
mov bl, al
pop edi
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x200
ret
Function at 0x5e9a10
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
xor edi, edi
push edi
push edi
push 1
push edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call esi
push edi
push edi
push 1
push edi
mov dword [esp + 0x20], eax
call esi
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push 4
push ecx
push 0x5e99a0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call ebx
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0xff
push 0x3e8
lea edx, [esp + 0x1c]
push edi
push edx
push 1
call esi
cmp eax, 0x102
jne 0x5e9aac
push 0xff
push 0x3e8
lea eax, [esp + 0x1c]
push edi
push eax
push 1
call esi
cmp eax, 0x102
je 0x5e9a91
call fcn.005e9830
test eax, eax
jne 0x5e9ac8
push 0x1f4
call ebx
call fcn.005e9880
call fcn.005e98a0
mov edi, eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x5ea780
Capabilities:
Create directory

Disassembly:
mov eax, dword [str.updates_tmp_]
sub esp, 0x25c
lea ecx, [esp + 4]
push esi
push eax
push 0x61f094
push 0x60b0bc
push ecx
call fcn.005f106c
add esp, 0x10
lea edx, [esp + 8]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esp + 0x264]
sub esp, 0xc
add eax, 4
mov ecx, esp
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
lea edx, [esp + 0x140]
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov ecx, dword [str.updates_tmp_]
push ecx
push str._s_s.dld
push edx
call fcn.005f106c
lea eax, [esp + 0x14c]
push 0x60ac24
push eax
call fcn.005f190a
mov esi, eax
add esp, 0x20
test esi, esi
je 0x5ea824
push esi
push 1
lea ecx, [esp + 0xc]
push 4
push ecx
mov dword [esp + 0x14], 1
call fcn.005f1564
push esi
call fcn.005f1894
add esp, 0x14
pop esi
add esp, 0x25c
ret 4
Function at 0x5eab20
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword [str.updates_tmp_]
sub esp, 0x26c
push esi
push edi
mov edi, ecx
push eax
lea ecx, [esp + 0x14c]
push str._s.
push ecx
call fcn.005f106c
add esp, 0xc
lea edx, [esp + 8]
lea eax, [esp + 0x148]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x5eab9e
lea ecx, [esp + 0x34]
push ebx
push ecx
mov ecx, edi
call fcn.005eacc0
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0xc]
push edx
push esi
call ebx
test eax, eax
je 0x5eab96
lea eax, [esp + 0x38]
mov ecx, edi
push eax
call fcn.005eacc0
lea ecx, [esp + 0xc]
push ecx
push esi
call ebx
test eax, eax
jne 0x5eab7e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
pop esi
add esp, 0x26c
ret

Function at 0x5eabb0
Capabilities:
Copy file
Delete file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
mov esi, dword [esp + 0x24]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x5eac9e
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x30]
push ebx
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.0046fe80
mov edi, str.movefiles
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push edx
add ecx, str.movefiles
push ecx
push str.movefiles
lea ecx, [esp + 0x24]
call fcn.004067a0
lea eax, [esp + 0x2c]
push ebx
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.0046fe80
mov ecx, dword [esp + 0x30]
mov edi, str.user
push ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, str.user
push ecx
push str.user
lea ecx, [esp + 0x18]
call fcn.004067a0
lea edx, [esp + 0x18]
push 1
lea eax, [esp + 0x10]
push edx
push eax
call fcn.0040a0e0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
add esp, 0xc
sub ecx, eax
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0041d810
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
sub edx, eax
lea ecx, [esp + 0x20]
push edx
push eax
call fcn.0041d810
pop edi
pop esi
pop ebx
add esp, 0x18
ret 0xc
cmp byte [esp + 0x2c], bl
je 0x5eacb5
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x5eacb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
add esp, 0x18
ret 0xc
Function at 0x5eae80
Capabilities:
Create directory

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x384
xor eax, eax
push ebx
push esi
mov ebx, ecx
push edi
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov esi, dword [esp + 0x398]
not ecx
dec ecx
push esi
push edx
lea eax, [ecx + edx - 1]
cmp eax, 0x5c
jne 0x5eaeb9
lea ecx, [esp + 0x14]
push 0x60b0a0
push ecx
jmp 0x5eaec3
lea edx, [esp + 0x14]
push 0x60b0bc
push edx
call fcn.005f106c
mov eax, dword [str.updates_]
add esp, 0x10
lea ecx, [esp + 0x264]
push esi
push eax
push 0x61f094
push str._s__s_s
push ecx
call fcn.005f106c
mov edx, dword [str.updates_]
lea eax, [esp + 0x14c]
push edx
push 0x61f094
push 0x60b0bc
push eax
call fcn.005f106c
add esp, 0x24
lea ecx, [esp + 0x138]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edx, [esp + 0x264]
push 0
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, ebx
call fcn.005eabb0
pop edi
pop esi
pop ebx
add esp, 0x384
ret 8

Function at 0x5eb4c0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
mov ebx, ecx
push ebp
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jne 0x5eb4ed
push 0x18
call fcn.005f0c55
add esp, 4
test eax, eax
je 0x5eb4e6
mov ecx, eax
call fcn.005ec720
mov dword [ebx + 0x10], eax
jmp 0x5eb4f2
xor eax, eax
mov dword [ebx + 0x10], eax
jmp 0x5eb4f2
call fcn.005ec7e0
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x5eb517
push 8
call fcn.005f0c55
add esp, 4
test eax, eax
je 0x5eb510
mov ecx, eax
call fcn.005ec910
jmp 0x5eb512
xor eax, eax
mov dword [ebx + 0x14], eax
mov dword [eax], ebx
push esi
push edi
mov edi, dword [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
lea ebp, [ebx + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x14]
pop edi
test eax, eax
mov dword [ebx + 0x228], ebx
mov dword [ebx + 0x22c], ecx
pop esi
jne 0x5eb55e
mov byte [ebx + 0x230], al
jmp 0x5eb57a
push eax
lea edx, [ebx + 0x231]
push 0x60b218
push edx
mov byte [ebx + 0x230], 1
call fcn.005f106c
add esp, 0xc
mov eax, dword [esp + 0x18]
lea ecx, [esp + 8]
push ecx
push 0
push ebp
push 0x5eb9a0
push 0
push 0
mov dword [ebx + 0x434], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x24], eax
pop ebp
pop ebx
pop ecx
ret 0xc