joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59b190
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x59b20d
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x59b1eb
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 6
jb 0x59b1eb
lea eax, [ebp - 8]
call fcn.0059b0bc
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00599bf0
lea eax, [ebp - 4]
mov edx, 0x59b228
call fcn.00408f18
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.0059a01c
jmp 0x59b1f2
mov eax, esi
call fcn.00407c58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59b214
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407cb8
ret

Function at 0x59b46c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x59b5a2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x59b58c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x59b4c9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x59b58c
cmp dword [ebp - 0x14], 0
jne 0x59b4de
mov eax, dword [ebp - 0xc]
call fcn.00407c58
mov bl, 1
jmp 0x59b58c
cmp dword [ebp - 0x14], 0x70000000
jb 0x59b4ec
call fcn.00427bd4
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00407de0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00408210
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
cmp eax, 0xea
je 0x59b492
test eax, eax
jne 0x59b58c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x59b53a
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x59b58c
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x59b542
dec esi
test esi, esi
je 0x59b551
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x59b541
cmp dword [ebp - 0x10], 7
jne 0x59b55c
test esi, esi
je 0x59b55c
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00408e98
cmp dword [ebp - 0x10], 7
jne 0x59b57f
test esi, esi
je 0x59b57f
lea eax, [ebp - 4]
call fcn.00408210
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00408038
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59b5a9
lea eax, [ebp - 4]
call fcn.00407c58
ret
Function at 0x59b5cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov ebp, eax
push 0
push 0
push 0
push 0
push esi
push ebp
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
test bl, bl
je 0x59b648
test esi, esi
je 0x59b5f9
cmp word [esi], 0
jne 0x59b648
mov eax, dword [0x65b6fc]
cmp dword [eax], 2
je 0x59b648
xor ebx, ebx
xor esi, esi
mov dword [esp + 4], 2
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push esi
push ebp
call sub.advapi32.dll_RegEnumValueW
mov edi, eax
test edi, edi
je 0x59b636
cmp edi, 0xea
jne 0x59b648
test edi, edi
jne 0x59b645
cmp word [esp], 0
jne 0x59b645
mov bl, 1
jmp 0x59b648
inc esi
jmp 0x59b607
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x59b6b4
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x59b6c8
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyW
pop esi
pop ebx
ret
cmp dword [0x6635a4], 0
jne 0x59b6eb
push 0x59b710
push 0x59b730
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040f4e8
mov dword [0x6635a4], eax
cmp dword [0x6635a4], 0
je 0x59b705
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x6635a4]
jmp 0x59b70a
mov eax, 0x7f
pop esi
pop ebx
ret
Function at 0x59b74c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x59b8bf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
je 0x59b780
mov eax, dword [ebp - 0x10]
cmp word [eax], 0
jne 0x59b78a
mov ebx, 0x57
jmp 0x59b8a9
mov eax, dword [0x65b6fc]
cmp dword [eax], 2
jne 0x59b898
push 0
push 8
lea eax, [ebp - 0x14]
push eax
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0059b68c
test eax, eax
jne 0x59b898
xor eax, eax
push ebp
push 0x59b891
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.00407de0
xor eax, eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x59b7e5
sub ebx, 4
mov ebx, dword [ebx]
mov dword [ebp - 0x1c], ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.00408210
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov esi, eax
cmp esi, 0xea
jne 0x59b850
mov edi, dword [ebp - 4]
test edi, edi
je 0x59b820
sub edi, 4
mov edi, dword [edi]
cmp edi, 0x10000
jge 0x59b87a
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x59b83f
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407de0
jmp 0x59b7d9
test esi, esi
jne 0x59b87a
mov eax, dword [ebp - 4]
call fcn.00408d1c
mov ecx, eax
movzx eax, byte [ebp - 5]
mov edx, dword [ebp - 0x14]
call fcn.0059b74c
test eax, eax
je 0x59b7d9
inc dword [ebp - 0x18]
jmp 0x59b7d9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59b898
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0059b6b4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59b8c6
lea eax, [ebp - 4]
call fcn.00407c58
ret
Function at 0x59c628
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x59c6c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x65b6fc]
cmp dword [eax], 2
jne 0x59c66b
push 1
mov eax, esi
call fcn.00408d1c
push eax
mov eax, edi
call fcn.00408d1c
push eax
call sub.kernel32.dll_MoveFileExW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x59c6af
mov eax, esi
call fcn.00408d1c
mov edx, eax
lea eax, [ebp - 4]
call fcn.00408d84
mov eax, dword [ebp - 4]
call fcn.004229ac
mov ebx, eax
test bl, bl
jne 0x59c694
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
jne 0x59c6af
mov eax, esi
call fcn.00408d1c
push eax
mov eax, edi
call fcn.00408d1c
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59c6cc
lea eax, [ebp - 4]
call fcn.00407c58
ret

Function at 0x59d5f8
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret
Function at 0x5a0a68
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x6635e8
mov eax, esi
mov edx, 8
test al, 1
je 0x5a0a84
shr eax, 1
xor eax, 0xedb88320
jmp 0x5a0a86
shr eax, 1
dec edx
jne 0x5a0a77
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5a0a70
pop esi
ret

Function at 0x5a0a9c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x6635e4], 0
jne 0x5a0abf
call fcn.005a0a68
push 1
push 0x6635e4
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x5a0ae9
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x6635e8]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x5a0ac5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5b4408
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
lea edi, [ebp - 0xd]
mov bl, 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0x18]
dec esi
test esi, esi
jl 0x5b45b8
inc esi
mov eax, dword [ebp + 8]
push eax
mov eax, edi
mov edx, 5
call fcn.005b3038
pop ecx
test al, al
jne 0x5b444f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.005b46ec
xor ebx, ebx
jmp 0x5b45b8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
cmp eax, dword [edi]
ja 0x5b446d
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.005b46ec
xor ebx, ebx
jmp 0x5b45b8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 4]
mov edx, dword [edi]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.005cb4f8
test eax, eax
jne 0x5b44a4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.005b46ec
xor ebx, ebx
jmp 0x5b45b8
test byte [edi + 4], 1
je 0x5b45b1
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov edx, 4
call fcn.005b3038
pop ecx
test al, al
jne 0x5b44d8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.005b46ec
xor ebx, ebx
jmp 0x5b45b8
mov edx, dword [0x5b0480]
mov eax, 0xc
call fcn.00409d30
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5b4583
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00408840
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00408218
mov edx, dword [ebp - 4]
call fcn.005b3038
pop ecx
test al, al
jne 0x5b4546
mov edx, dword [0x5b0480]
mov eax, dword [ebp - 8]
call fcn.00409d44
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.005b46ec
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b45b8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.005abad0
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
call fcn.005abee0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b45b1
dec esi
jne 0x5b4426
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5bf2f4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5bf371
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.005ac158
mov eax, dword [ebp - 4]
call fcn.005abad0
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x30]
mov ebx, dword [eax + 0xc]
dec ebx
cmp ebx, 0
jl 0x5bf358
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 4]
mov esi, dword [eax + ebx*4]
mov eax, dword [esi + 4]
cmp eax, dword [ebp - 8]
jne 0x5bf352
mov eax, dword [esi]
mov edx, dword [ebp - 4]
call fcn.0040868c
je 0x5bf35b
dec ebx
cmp ebx, 0xffffffff
jne 0x5bf335
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bf378
lea eax, [ebp - 4]
call fcn.00407c7c
ret
Function at 0x5e4c2c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.004233b4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5e8dd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.004233b4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5eaa28
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
xor edx, edx
mov dword [ebp - 0x25c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5eaafa
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x258]
push eax
lea edx, [ebp - 0x25c]
mov eax, ebx
call fcn.00599bf0
lea eax, [ebp - 0x25c]
mov edx, 0x5eab18
call fcn.00408f18
mov eax, dword [ebp - 0x25c]
call fcn.00408d1c
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x5eaae1
xor eax, eax
push ebp
push 0x5eaada
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
call fcn.005ea9d8
test al, al
je 0x5eaaaf
mov byte [ebp - 1], 1
jmp 0x5eaac3
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5eaa9a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eaae1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eab01
lea eax, [ebp - 0x25c]
call fcn.00407c58
ret

Function at 0x5eab1c
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
push 0x200
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00408d1c
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5eab5c
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.00408dc0
jmp 0x5eab63
mov eax, ebx
call fcn.00407c58
add esp, 0x2b4
pop esi
pop ebx
ret

Function at 0x5eab6c
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x65a6b8]
or eax, 0x4001
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00408d1c
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5eabab
mov eax, dword [esp + 4]
jmp 0x5eabad
xor eax, eax
add esp, 0x2b4
pop esi
pop ebx
ret

Function at 0x5eabb8
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x65a6c0]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x5eabfc
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5eabf1
mov eax, dword [esp + 4]
jmp 0x5eabf3
xor eax, eax
add esp, 0x2b4
pop ebx
ret
Function at 0x5eabdb
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x65a6c0]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x5eabfc
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5eabf1
mov eax, dword [esp + 4]
jmp 0x5eabf3
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x5eb098
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
test dl, dl
je 0x5eb0ac
add esp, 0xfffffff0
call fcn.00406610
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.004f3e60
mov eax, dword [0x5eb14c]
not eax
and dword [esi + 0x58], eax
mov edx, 0x79
mov eax, esi
call fcn.004f02a0
mov edx, 0x61
mov eax, esi
call fcn.004f02d4
xor edx, edx
mov eax, esi
call fcn.004f0e98
mov dl, 1
mov eax, esi
call fcn.004f9ef4
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 6
jae 0x5eb108
mov dx, 0xfffe
mov eax, esi
call fcn.004f0ee0
push 0
lea eax, [ebp - 0x5c]
push eax
push 0x5c
push 0x1f
call sub.user32.dll_SystemParametersInfoW
test eax, eax
je 0x5eb12e
lea eax, [ebp - 0x5c]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov edx, eax
mov eax, dword [esi + 0x6c]
call fcn.004d3570
mov eax, esi
test bl, bl
je 0x5eb143
call fcn.00406668
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ec210
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5ec3dc
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5ec3af
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
test eax, eax
je 0x5ec26d
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jne 0x5ec2ab
mov eax, ebx
call fcn.005eae58
test al, al
jne 0x5ec28b
mov byte [ebp - 5], 0
call fcn.00407448
jmp 0x5ec3b6
lea edx, [ebp - 0x264]
mov eax, ebx
call fcn.005eab1c
mov ecx, dword [ebp - 0x264]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.005ec63c
mov byte [ebp - 5], 1
lea eax, [ebp - 0x260]
push eax
lea edx, [ebp - 0x268]
mov eax, ebx
call fcn.00599bf0
lea eax, [ebp - 0x268]
mov edx, 0x5ec3fc
call fcn.00408f18
mov eax, dword [ebp - 0x268]
call fcn.00408d1c
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5ec398
xor eax, eax
push ebp
push 0x5ec391
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
call fcn.005ea9d8
test al, al
je 0x5ec366
lea eax, [ebp - 4]
lea edx, [ebp - 0x234]
mov ecx, 0x104
call fcn.00408dc0
lea edx, [ebp - 0x270]
mov eax, ebx
call fcn.00599bf0
lea eax, [ebp - 0x270]
mov edx, dword [ebp - 4]
call fcn.00408f18
mov eax, dword [ebp - 0x270]
lea edx, [ebp - 0x26c]
call fcn.005eab1c
mov eax, dword [ebp - 0x26c]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 4]
mov edx, esi
call fcn.005ebc18
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5ec2ff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ec398
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ec3b6
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ec3e3
lea eax, [ebp - 0x270]
mov edx, 4
call fcn.00407cb8
lea eax, [ebp - 4]
call fcn.00407c58
ret
Function at 0x5ec6cc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5ec8c2
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x5ec751
lea edx, [ebp - 0x264]
mov eax, edi
call fcn.0059a17c
mov eax, dword [ebp - 0x264]
push eax
lea edx, [ebp - 0x268]
mov eax, ebx
call fcn.00599bf0
mov eax, dword [ebp - 0x268]
pop edx
call fcn.00599e08
test eax, eax
jne 0x5ec751
lea edx, [ebp - 4]
mov eax, edi
call fcn.0059a154
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5ec890
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
push eax
lea edx, [ebp - 0x26c]
mov eax, ebx
call fcn.00599bf0
lea eax, [ebp - 0x26c]
mov edx, 0x5ec8dc
call fcn.00408f18
mov eax, dword [ebp - 0x26c]
call fcn.00408d1c
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5ec879
xor eax, eax
push ebp
push 0x5ec872
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
call fcn.005ea9d8
test al, al
je 0x5ec843
lea eax, [ebp - 8]
lea edx, [ebp - 0x234]
mov ecx, 0x104
call fcn.00408dc0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00599e08
test eax, eax
je 0x5ec843
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.005ebd0c
test eax, eax
jne 0x5ec843
lea edx, [ebp - 0x274]
mov eax, ebx
call fcn.00599bf0
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 8]
call fcn.00408f18
mov eax, dword [ebp - 0x274]
lea edx, [ebp - 0x270]
call fcn.005eab1c
mov eax, dword [ebp - 0x270]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.005ebc18
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5ec7b9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ec879
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ec897
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x5ecb98
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.004233b4
add esp, 0x208
pop ebx
ret

Function at 0x5efef0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret