joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59a5dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x59a622
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0059a528
mov eax, dword [ebp - 4]
call fcn.00408d1c
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59a629
lea eax, [ebp - 4]
call fcn.00407c58
ret

Function at 0x59a630
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00408d1c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x59a64c
test al, 0x10
je 0x59a651
xor eax, eax
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret

Function at 0x59a688
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00408d1c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x59a6a9
test al, 0x10
je 0x59a6a9
test ah, 4
je 0x59a6ae
xor eax, eax
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret

Function at 0x59a6b4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00407d3c
xor eax, eax
push ebp
push 0x59a7b3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00408220
mov ebx, pe_nt_image_headers32
mov eax, edi
mov ecx, ebx
xor edx, edx
call fcn.00407de0
cmp dword [ebp + 0xc], 0
je 0x59a733
mov eax, dword [ebp + 0xc]
call fcn.00408d1c
push eax
push ebx
mov eax, edi
call fcn.00408210
push eax
mov eax, dword [ebp - 4]
call fcn.00408d1c
push eax
mov eax, dword [ebp - 0xc]
call fcn.00408d1c
push eax
mov eax, dword [ebp - 8]
call fcn.00408d1c
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
mov esi, eax
jmp 0x59a75e
push ebx
mov eax, edi
call fcn.00408210
push eax
mov eax, dword [ebp - 4]
call fcn.00408d1c
push eax
mov eax, dword [ebp - 0xc]
call fcn.00408d1c
push eax
mov eax, dword [ebp - 8]
call fcn.00408d1c
push eax
call sub.kernel32.dll_GetProfileStringW
mov esi, eax
test esi, esi
je 0x59a77a
mov eax, dword [edi]
call fcn.00408d1c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.00408174
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
mov eax, ebx
sub eax, 8
cmp esi, eax
jl 0x59a78b
cmp ebx, 0x10000
jl 0x59a796
mov eax, edi
mov edx, esi
call fcn.00408e98
jmp 0x59a79d
add ebx, ebx
jmp 0x59a6ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59a7ba
lea eax, [ebp - 4]
call fcn.00407c58
ret
Function at 0x59a884
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
mov word [ebp - 0x10], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x59a8ce
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00408d1c
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00408d1c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00408d1c
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
jmp 0x59a8f2
push 8
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00408d1c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00408d1c
push eax
call sub.kernel32.dll_GetProfileStringW
push ebx
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_lstrcmpW
test eax, eax
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x59a964
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov ebx, edx
mov esi, eax
mov word [ebp - 0x200], 0
test ebx, ebx
je 0x59a9aa
mov eax, ebx
call fcn.00408d1c
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x59a9dc
push 0
mov eax, esi
call fcn.00408d1c
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
jmp 0x59a9ca
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x59a9dc
push 0
mov eax, esi
call fcn.00408d1c
push eax
call sub.kernel32.dll_GetProfileStringW
cmp word [ebp - 0x200], 0
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x59adb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x59ae45
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x59adfb
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00407de0
jmp 0x59ae2f
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
cmp word [ebx], 0
jne 0x59ae12
lea eax, [ebp - 4]
call fcn.00407c58
jmp 0x59ae25
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0059ac00
mov ebx, eax
test esi, esi
je 0x59ae25
dec esi
jmp 0x59ae02
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00408038
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59ae4c
lea eax, [ebp - 4]
call fcn.00407c58
ret

Function at 0x59b220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00423454
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x59b250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00423454
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x59b32c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x59b3a9
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x59b387
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 6
jb 0x59b387
lea eax, [ebp - 8]
call fcn.0059b250
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00599cd0
lea eax, [ebp - 4]
mov edx, 0x59b3c4
call fcn.00408f18
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.0059a124
jmp 0x59b38e
mov eax, esi
call fcn.00407c58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59b3b0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407cb8
ret

Function at 0x59b610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x59b746
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x59b730
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x59b66d
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x59b730
cmp dword [ebp - 0x14], 0
jne 0x59b682
mov eax, dword [ebp - 0xc]
call fcn.00407c58
mov bl, 1
jmp 0x59b730
cmp dword [ebp - 0x14], 0x70000000
jb 0x59b690
call fcn.00427c74
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00407de0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.00408210
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
cmp eax, 0xea
je 0x59b636
test eax, eax
jne 0x59b730
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x59b6de
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x59b730
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x59b6e6
dec esi
test esi, esi
je 0x59b6f5
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x59b6e5
cmp dword [ebp - 0x10], 7
jne 0x59b700
test esi, esi
je 0x59b700
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00408e98
cmp dword [ebp - 0x10], 7
jne 0x59b723
test esi, esi
je 0x59b723
lea eax, [ebp - 4]
call fcn.00408210
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00408038
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59b74d
lea eax, [ebp - 4]
call fcn.00407c58
ret
Function at 0x59b778
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
test bl, bl
je 0x59b7fa
test esi, esi
je 0x59b7ab
cmp word [esi], 0
jne 0x59b7fa
mov eax, dword [0x65d704]
cmp dword [eax], 2
je 0x59b7fa
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0xc], 2
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumValueW
mov edi, eax
test edi, edi
je 0x59b7e8
cmp edi, 0xea
jne 0x59b7fa
test edi, edi
jne 0x59b7f7
cmp word [ebp - 8], 0
jne 0x59b7f7
mov bl, 1
jmp 0x59b7fa
inc esi
jmp 0x59b7b9
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x59b864
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x59b87a
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyW
jmp 0x59b8bc
cmp dword [0x6655a4], 0
jne 0x59b89d
push 0x59b8c0
push 0x59b8e0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040f4e8
mov dword [0x6655a4], eax
cmp dword [0x6655a4], 0
je 0x59b8b7
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x6655a4]
jmp 0x59b8bc
mov eax, 0x7f
pop esi
pop ebx
pop ebp
ret
Function at 0x59b8fc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x59ba6f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
je 0x59b930
mov eax, dword [ebp - 0x10]
cmp word [eax], 0
jne 0x59b93a
mov ebx, 0x57
jmp 0x59ba59
mov eax, dword [0x65d704]
cmp dword [eax], 2
jne 0x59ba48
push 0
push 8
lea eax, [ebp - 0x14]
push eax
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0059b83c
test eax, eax
jne 0x59ba48
xor eax, eax
push ebp
push 0x59ba41
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.00407de0
xor eax, eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x59b995
sub ebx, 4
mov ebx, dword [ebx]
mov dword [ebp - 0x1c], ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.00408210
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov esi, eax
cmp esi, 0xea
jne 0x59ba00
mov edi, dword [ebp - 4]
test edi, edi
je 0x59b9d0
sub edi, 4
mov edi, dword [edi]
cmp edi, 0x10000
jge 0x59ba2a
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x59b9ef
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407de0
jmp 0x59b989
test esi, esi
jne 0x59ba2a
mov eax, dword [ebp - 4]
call fcn.00408d1c
mov ecx, eax
movzx eax, byte [ebp - 5]
mov edx, dword [ebp - 0x14]
call fcn.0059b8fc
test eax, eax
je 0x59b989
inc dword [ebp - 0x18]
jmp 0x59b989
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59ba48
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.0059b864
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59ba76
lea eax, [ebp - 4]
call fcn.00407c58
ret
Function at 0x59c828
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x59c8c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x65d704]
cmp dword [eax], 2
jne 0x59c86b
push 1
mov eax, esi
call fcn.00408d1c
push eax
mov eax, edi
call fcn.00408d1c
push eax
call sub.kernel32.dll_MoveFileExW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x59c8af
mov eax, esi
call fcn.00408d1c
mov edx, eax
lea eax, [ebp - 4]
call fcn.00408d84
mov eax, dword [ebp - 4]
call fcn.00422a4c
mov ebx, eax
test bl, bl
jne 0x59c894
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
jne 0x59c8af
mov eax, esi
call fcn.00408d1c
push eax
mov eax, edi
call fcn.00408d1c
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59c8cc
lea eax, [ebp - 4]
call fcn.00407c58
ret

Function at 0x59d810
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret
Function at 0x5a0ce4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x6655e8
mov eax, esi
mov edx, 8
test al, 1
je 0x5a0d00
shr eax, 1
xor eax, 0xedb88320
jmp 0x5a0d02
shr eax, 1
dec edx
jne 0x5a0cf3
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5a0cec
pop esi
ret

Function at 0x5a0d18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x6655e4], 0
jne 0x5a0d3e
call fcn.005a0ce4
push 1
push 0x6655e4
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x5a0d68
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x6655e8]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x5a0d44
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5b4954
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
lea edi, [ebp - 0xd]
mov bl, 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0x18]
dec esi
test esi, esi
jl 0x5b4b04
inc esi
mov eax, dword [ebp + 8]
push eax
mov eax, edi
mov edx, 5
call fcn.005b3584
pop ecx
test al, al
jne 0x5b499b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.005b4c3c
xor ebx, ebx
jmp 0x5b4b04
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
cmp eax, dword [edi]
ja 0x5b49b9
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.005b4c3c
xor ebx, ebx
jmp 0x5b4b04
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 4]
mov edx, dword [edi]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.005cbbac
test eax, eax
jne 0x5b49f0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.005b4c3c
xor ebx, ebx
jmp 0x5b4b04
test byte [edi + 4], 1
je 0x5b4afd
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov edx, 4
call fcn.005b3584
pop ecx
test al, al
jne 0x5b4a24
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.005b4c3c
xor ebx, ebx
jmp 0x5b4b04
mov edx, dword [0x5b0960]
mov eax, 0xc
call fcn.00409d30
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5b4acf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00408840
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00408218
mov edx, dword [ebp - 4]
call fcn.005b3584
pop ecx
test al, al
jne 0x5b4a92
mov edx, dword [0x5b0960]
mov eax, dword [ebp - 8]
call fcn.00409d44
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.005b4c3c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b4b04
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.005abf58
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
call fcn.005ac388
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b4afd
dec esi
jne 0x5b4972
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5bf8ac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5bf929
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.005ac630
mov eax, dword [ebp - 4]
call fcn.005abf58
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x30]
mov ebx, dword [eax + 0xc]
dec ebx
cmp ebx, 0
jl 0x5bf910
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 4]
mov esi, dword [eax + ebx*4]
mov eax, dword [esi + 4]
cmp eax, dword [ebp - 8]
jne 0x5bf90a
mov eax, dword [esi]
mov edx, dword [ebp - 4]
call fcn.0040868c
je 0x5bf913
dec ebx
cmp ebx, 0xffffffff
jne 0x5bf8ed
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bf930
lea eax, [ebp - 4]
call fcn.00407c7c
ret
Function at 0x5e59f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00423454
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5e8cc4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
mov byte [0x665e58], 0
mov eax, dword [0x65d704]
cmp dword [eax], 2
jne 0x5e8d06
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x5e8d06
cmp dword [ebp - 0x110], 5
setae byte [0x665e58]
mov esp, ebp
pop ebp
ret

Function at 0x5e9ca8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00423454
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5eb938
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
xor edx, edx
mov dword [ebp - 0x25c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5eba0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x258]
push eax
lea edx, [ebp - 0x25c]
mov eax, ebx
call fcn.00599cd0
lea eax, [ebp - 0x25c]
mov edx, 0x5eba28
call fcn.00408f18
mov eax, dword [ebp - 0x25c]
call fcn.00408d1c
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x5eb9f1
xor eax, eax
push ebp
push 0x5eb9ea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
call fcn.005eb8e4
test al, al
je 0x5eb9bf
mov byte [ebp - 1], 1
jmp 0x5eb9d3
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5eb9aa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eb9f1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eba11
lea eax, [ebp - 0x25c]
call fcn.00407c58
ret

Function at 0x5eba2c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd4c
push ebx
push esi
mov ebx, edx
mov esi, eax
push 0x200
push 0x2b4
lea eax, [ebp - 0x2b4]
push eax
push 0
mov eax, esi
call fcn.00408d1c
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5eba73
mov eax, ebx
lea edx, [ebp - 0x2a8]
mov ecx, 0x104
call fcn.00408dc0
jmp 0x5eba7a
mov eax, ebx
call fcn.00407c58
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5eba80
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd4c
push ebx
push esi
mov ebx, edx
mov esi, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x65c6b8]
or eax, 0x4001
push eax
push 0x2b4
lea eax, [ebp - 0x2b4]
push eax
push 0
mov eax, esi
call fcn.00408d1c
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5ebac6
mov eax, dword [ebp - 0x2b0]
jmp 0x5ebac8
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ebad0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd4c
push ebx
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x65c6c0]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [ebp - 0x2b4]
push eax
push 0x10
push 0x5ebb18
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5ebb10
mov eax, dword [ebp - 0x2b0]
jmp 0x5ebb12
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ebe34
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
call sub.kernel32.dll_GetVersion_1
mov dx, 0xff
and dx, ax
cmp dx, 5
jne 0x5ebeb9
shr ax, 8
cmp ax, 1
jb 0x5ebeb9
mov bl, 1
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x5ebec4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5ebebb
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x5ebf3c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5ebeae
cmp dword [ebp - 8], 4
jne 0x5ebeae
cmp dword [ebp - 0x10], 4
jne 0x5ebeae
cmp dword [ebp - 0xc], 0
setne bl
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x5ebebb
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ebfbc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
test dl, dl
je 0x5ebfd0
add esp, 0xfffffff0
call fcn.00406610
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.004f3f40
mov eax, dword [0x5ec070]
not eax
and dword [esi + 0x58], eax
mov edx, 0x79
mov eax, esi
call fcn.004f0380
mov edx, 0x61
mov eax, esi
call fcn.004f03b4
xor edx, edx
mov eax, esi
call fcn.004f0f78
mov dl, 1
mov eax, esi
call fcn.004f9fd4
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 6
jae 0x5ec02c
mov dx, 0xfffe
mov eax, esi
call fcn.004f0fc0
push 0
lea eax, [ebp - 0x5c]
push eax
push 0x5c
push 0x1f
call sub.user32.dll_SystemParametersInfoW
test eax, eax
je 0x5ec052
lea eax, [ebp - 0x5c]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov edx, eax
mov eax, dword [esi + 0x6c]
call fcn.004d3650
mov eax, esi
test bl, bl
je 0x5ec067
call fcn.00406668
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ec074
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
call sub.comctl32.dll_InitCommonControls_1
mov edx, edi
mov eax, esi
call fcn.004f57fc
mov ecx, 0x5ec108
mov edx, edi
mov eax, esi
call fcn.004f5728
mov eax, dword [edi + 4]
or eax, 0x2000000
or eax, 0x4000000
or eax, 4
or eax, 1
or eax, 0x20
or eax, 8
mov dword [edi + 4], eax
call fcn.005ebe34
mov ebx, eax
mov byte [esi + 0x290], bl
test bl, bl
je 0x5ec0d9
mov eax, dword [edi + 4]
or eax, 0x200
or eax, 0x400
mov dword [edi + 4], eax
jmp 0x5ec0f6
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 6
jb 0x5ec0f2
or dword [edi + 4], 0x200
jmp 0x5ec0f6
or dword [edi + 4], 2
or dword [edi + 8], 0x200
and dword [edi + 0x24], 0xfffffffc
pop edi
pop esi
pop ebx
pop ebp
ret