joyce8/EMBER2024-capa huggingface dataset:
Function at 0x547080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x613556
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x6af320]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x54712c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x54712c
call fcn.00545550
mov esi, eax
jmp 0x54721c
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x54714f
call fcn.00545550
jmp 0x54720f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
jne 0x54716d
call fcn.00545550
jmp 0x54720f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x54718e
mov esi, 0x8007000e
jmp 0x547211
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00545500
jmp 0x5471b8
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x5471cf
mov esi, 0x8007000e
jmp 0x547211
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x5471ef
call fcn.00545550
jmp 0x54720f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00546f20
mov esi, eax
test edi, edi
je 0x54721c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x547240
lea ecx, [ebp - 0x418]
call fcn.005454b0
jmp 0x547240
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x549a20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fa2ab
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6af320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push ecx
call fcn.004458f0
push dword [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [edi + 0x30]
mov dword [edi], vtable.std::_Packaged_state_void____cdecl___void__.0
call fcn.00549c50
mov dword [ebp - 4], 1
lea ebx, [edi + 0x48]
mov dword [edi], vtable.std::_Task_async_state_void__0_.0
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov byte [ebp - 4], 2
lea eax, [edi + 4]
mov ecx, 1
lock xadd dword [eax], ecx
sub esp, 0x2c
mov esi, esp
sub esp, 8
mov ecx, esp
call fcn.00445af0
mov ecx, esi
call fcn.00445a70
lea ecx, [esi + 0xc]
call fcn.00445b00
mov dword [esi + 0x1c], 0
lea ecx, [ebp - 0x1c]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x18], 0
mov byte [esi + 0x14], 0
push edi
mov word [esi + 0x28], 0
call fcn.00549ba0
add esp, 0x30
cmp ebx, eax
je 0x549af4
push eax
mov ecx, ebx
call fcn.00445b50
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x549b20
or ebx, 0xffffffff
lea ecx, [esi + 4]
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x549b20
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x549b20
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, edi
mov byte [edi + 0x26], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x54fe30
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov bl, byte [0x6d5bb8]
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov eax, dword [eax + 0xf4]
call eax
mov edx, dword [ebp + 8]
test al, al
jne 0x54fe82
mov eax, dword [edx]
cmp eax, 8
jle 0x54fe82
cmp eax, 0x13
jge 0x54fe82
test bl, bl
jne 0x54fe82
mov ecx, dword [edi + 0x60]
push edx
test ecx, ecx
je 0x550071
mov eax, dword [ecx]
call dword [eax + 0x124]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edx]
cmp eax, 0xd
jne 0x54fef1
test bl, bl
jne 0x54fef1
push dword [edx + 0x10]
lea eax, [edi + 0x174]
push dword [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x550078
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x550078
or dword [edi + 0x7e8], 0x50
lea esi, [edi + 0x1830]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi]
mov ecx, edi
mov dword [edi + 0x1838], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x183c], eax
call fcn.005b3380
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 9
jne 0x54ff9f
test bl, bl
jne 0x54ff9f
test byte [edi + 0x7e8], 0x40
je 0x550078
push dword [edx + 0x10]
lea eax, [edi + 0x174]
push dword [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x54ff2f
or dword [edi + 0x7e8], 0x10
jmp 0x54ff36
and dword [edi + 0x7e8], 0xffffffef
cmp dword [edi + 0x1830], 0
je 0x54ff8f
cmp dword [edi + 0x1834], 0
je 0x54ff8f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x14]
lea ecx, [edi + 0x1818]
sub eax, dword [edi + 0x1834]
push eax
mov eax, dword [esp + 0x14]
sub eax, dword [edi + 0x1830]
push eax
call fcn.0048fb70
mov eax, dword [esp + 0x10]
mov dword [edi + 0x1830], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 0x1834], eax
mov byte [edi + 0x1840], 1
mov ecx, edi
call fcn.005b3380
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0xe
jne 0x550070
test bl, bl
jne 0x550070
test byte [edi + 0x7e8], 0x40
je 0x550078
push dword [edx + 0x10]
lea eax, [edi + 0x174]
push dword [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x550026
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0xec]
call eax
test al, al
je 0x550026
cmp byte [edi + 0x1840], bl
je 0x55001f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
sub eax, dword [edi + 0x1838]
cdq
xor eax, edx
sub eax, edx
cmp eax, 5
jg 0x550026
mov eax, dword [esp + 0x14]
sub eax, dword [edi + 0x183c]
cdq
xor eax, edx
sub eax, edx
cmp eax, 5
jg 0x550026
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x20]
and dword [edi + 0x7e8], 0xffffffaf
mov ecx, edi
mov dword [edi + 0x1830], 0
mov eax, dword [edi + 0x1830]
mov dword [edi + 0x1834], 0
mov dword [edi + 0x1838], eax
mov eax, dword [edi + 0x1834]
mov dword [edi + 0x183c], eax
mov byte [edi + 0x1840], 0
call fcn.005b3380
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edx
mov ecx, edi
call fcn.005b7270
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x552b60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f7789
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6af320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.00413280
lea ecx, [edi + 0x18]
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.00413280
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x30]
push eax
call fcn.00413280
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x48]
push eax
call fcn.00413280
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x64]
push eax
call fcn.00413280
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x7c], eax
mov al, byte [esi + 0x80]
mov byte [edi + 0x80], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x567210
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x6f8560], ecx
inc eax
cmp eax, 0x100
jb 0x567213
cmp eax, 0x800
jae 0x5672e3
nop
mov edx, dword [eax*4 + 0x6f8160]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x6f8560]
mov dword [eax*4 + 0x6f8560], edx
inc eax
cmp eax, 0x800
jb 0x5672c0
mov dword [0x6fa560], 0x568d40
mov dword [0x6f8540], 0x568d40
mov dword [0x6fa564], 0x568de0
call fcn.00568ff0
mov ecx, dword [0x6f8540]
test eax, eax
mov edx, 0x568de0
cmove ecx, edx
mov dword [0x6f8540], ecx
pop ecx
ret
Function at 0x56c0b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
xor edi, edi
mov dword [ebp - 4], ebx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x56c0d6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 8], 5
sub edx, 4
add edx, ebx
mov dword [ebp - 0xc], edx
lea eax, [edi + ebx]
cmp eax, edx
jae 0x56c0ff
lea esp, [esp]
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x56c0ff
inc eax
cmp eax, edx
jb 0x56c0f0
mov ecx, eax
sub ecx, edi
mov edi, eax
sub ecx, ebx
sub edi, ebx
cmp eax, edx
jae 0x56c1e2
cmp ecx, 2
jbe 0x56c1a2
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x56c1d4
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp + 8]
add ecx, edi
add edi, 5
sub ebx, ecx
mov dword [ebp - 8], ecx
test esi, esi
je 0x56c17c
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x56c177
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
sub ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov ebx, dword [ebp - 4]
jmp 0x56c0e2
shr esi, cl
test esi, esi
je 0x56c11c
cmp esi, 4
ja 0x56c1c9
cmp esi, 3
je 0x56c1c9
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x56c11c
or esi, 8
shr esi, 1
inc edi
jmp 0x56c0e2
mov ebx, dword [ebp - 4]
or esi, 8
shr esi, 1
inc edi
jmp 0x56c0e2
cmp ecx, 2
jbe 0x56c1f7
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
shr esi, cl
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x572390
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.004181d0
mov ecx, dword [ebp - 4]
push ecx
push 0x5722f0
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5723c4
xor eax, eax
jmp 0x5723d2
mov ecx, dword [ebp - 4]
call fcn.0056dfb0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x572510
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x57254d
mov eax, dword [ebp - 4]
add eax, 4
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x572740
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x57255f
mov dword [ebp - 8], 1
jmp 0x572566
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x573610
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x6af320]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0
push 0x118
push 0
lea eax, [ebp - 0x11c]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x573675
mov dword [ebp - 0x120], 0x114
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x573682
mov al, 1
jmp 0x573684
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret

Function at 0x5736a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x6af320]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6af470], 0xffffffff
je 0x5736e0
cmp dword [0x6af470], 0
je 0x5736ce
mov byte [ebp - 0x121], 1
jmp 0x5736d5
mov byte [ebp - 0x121], 0
mov al, byte [ebp - 0x121]
jmp 0x57377d
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x573712
mov dword [ebp - 0x120], 0x114
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x11c]
push eax
push str.isWin7major___d__minor___d
push 0x48
push str.utility::usystem::isWin7
call fcn.0056c830
add esp, 0x14
cmp dword [ebp - 0x11c], 6
jne 0x573771
cmp dword [ebp - 0x118], 1
jne 0x573771
movzx ecx, byte [ebp - 6]
cmp ecx, 1
jne 0x573771
mov dword [0x6af470], 1
push str.is_win7
push 0x4c
push 0x6309b0
call fcn.0056c830
add esp, 0xc
mov al, 1
jmp 0x57377d
mov dword [0x6af470], 0
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret
Function at 0x573b20
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x573b4f
lea eax, [ebp - 0x28]
push eax
call dword [ebp - 4]
jmp 0x573b59
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edx, word [ebp - 0x28]
cmp edx, 9
je 0x573b6b
movzx eax, word [ebp - 0x28]
cmp eax, 6
jne 0x573b6f
mov al, 1
jmp 0x573b71
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x573ec0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x573ed7
mov dword [ebp - 8], 1
jmp 0x573ede
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 8]
call fcn.00413810
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x573f1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x573f1f
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x573f1f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x573f22
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x574010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], 0
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x440
mov dword [ebp - 0x30], 0x63113c
mov ecx, dword [ebp + 8]
call fcn.00413810
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 5
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x574081
push 5
push 0
mov ecx, dword [ebp + 8]
call fcn.00413810
push eax
push str.iexplore.exe
push 0x631284
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x5742d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x616ae6
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x6af320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
jbe 0x57440e
mov dword [ebp - 0x24c], 0
jmp 0x574339
mov ecx, dword [ebp - 0x24c]
add ecx, 1
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x24c]
cmp edx, dword [ebp - 0x254]
jae 0x57440e
push 0x104
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x24c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0xffffffff
je 0x574409
mov ecx, dword [ebp - 0x250]
and ecx, 0x10
je 0x5743cf
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x248]
call fcn.00413780
mov dword [ebp - 4], 0
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0048af10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.00413150
jmp 0x574409
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x230]
call fcn.00413780
mov dword [ebp - 4], 1
lea edx, [ebp - 0x230]
push edx
mov ecx, dword [ebp + 8]
call fcn.0048af10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00413150
jmp 0x57432a
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_DragFinish]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret
Function at 0x5747b0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x616b80
mov eax, dword fs:[0]
push eax
sub esp, 0x2dc
mov eax, dword [0x6af320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x631330
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x58]
call fcn.00425c20
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x58]
call fcn.00413810
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0xffffffff
je 0x574970
lea ecx, [ebp - 0x28]
call fcn.004181b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2ac]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00415f50
push 0x631320
lea edx, [ebp - 0x28]
push edx
call fcn.00417070
add esp, 8
movzx eax, al
test eax, eax
jne 0x574869
push 0x631324
lea ecx, [ebp - 0x28]
push ecx
call fcn.00417070
add esp, 8
movzx edx, al
test edx, edx
je 0x57486e
jmp 0x57493b
push 0x631350
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x70]
call fcn.00425c20
add esp, 4
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x2e8], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x2e8]
lea ecx, [ebp - 0x88]
call fcn.004774a0
add esp, 4
mov dword [ebp - 0x2e4], eax
mov edx, dword [ebp - 0x2e4]
push edx
lea ecx, [ebp - 0x28]
call fcn.00430160
lea ecx, [ebp - 0x88]
call fcn.00413150
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00413150
mov eax, dword [ebp - 0x2d8]
and eax, 0x10
je 0x5748fc
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.005747b0
add esp, 0xc
jmp 0x57493b
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00579ac0
add esp, 8
movzx eax, al
test eax, eax
je 0x57493b
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x40]
call fcn.0045dc60
mov byte [ebp - 4], 3
lea edx, [ebp - 0x40]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.0053c160
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00413150
lea eax, [ebp - 0x2d8]
push eax
mov ecx, dword [ebp - 0x2dc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x57482a
mov edx, dword [ebp - 0x2dc]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00413150
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00413150
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f24e0
mov esp, ebp
pop ebp
ret