joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d5fa3
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
lea eax, [ebp - 0x10]
mov ebx, ecx
push eax
call fcn.0041be56
push eax
lea ecx, [ebp - 0x14]
call fcn.0040d36e
mov ecx, dword [ebp - 0x10]
mov edi, 0x668010
add ecx, 0xfffffff4
cmp ecx, edi
je 0x5d5fd3
call fcn.00407965
push esi
lea eax, [ebp - 0xc]
mov ecx, ebx
push eax
call fcn.005d65c3
push dword [ebp + 8]
mov esi, eax
mov ecx, ebx
lea eax, [ebp - 8]
push eax
call fcn.005d663d
mov edx, eax
lea ecx, [ebp - 4]
call fcn.0040ce1d
mov ecx, dword [0x668294]
mov dword [ebp + 8], ecx
mov ecx, dword [esi]
mov eax, dword [eax]
push ecx
push dword [ecx - 8]
lea ecx, [ebp + 8]
push eax
push dword [eax - 8]
call fcn.0040f4c7
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff4
cmp ecx, edi
je 0x5d6025
call fcn.00407965
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff4
cmp ecx, edi
je 0x5d6034
call fcn.00407965
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff4
cmp ecx, edi
je 0x5d6043
call fcn.00407965
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x14]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x5d6059
xor ebx, ebx
jmp 0x5d607e
push 0x6751f8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x2c]
call fcn.0040d242
xor ebx, ebx
push 0x6751f8
inc ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esi - 0xc]
mov esi, 0x668010
cmp ecx, esi
je 0x5d608f
call fcn.00407965
lea ecx, [edi - 0xc]
cmp ecx, esi
pop esi
je 0x5d609c
call fcn.00407965
pop edi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x5d6126
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov esi, ecx
push eax
call fcn.0041be56
push eax
lea ecx, [ebp - 4]
call fcn.0040d36e
mov ecx, dword [ebp - 0xc]
mov ebx, 0x668010
add ecx, 0xfffffff4
cmp ecx, ebx
je 0x5d6157
call fcn.00407965
mov ecx, esi
call fcn.00421f50
mov esi, dword [ebp - 4]
test eax, eax
jne 0x5d6184
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5d6184
test al, 1
je 0x5d6184
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, eax
jmp 0x5d6187
xor edi, edi
inc edi
lea ecx, [esi - 0xc]
cmp ecx, ebx
je 0x5d6193
call fcn.00407965
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5d619a
Capabilities:
Get file size

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00421f50
test eax, eax
jne 0x5d61f2
push eax
push 0x80
push 3
push eax
push 1
push SysReAllocString
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x5d61f2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x5d61f2
cmp esi, 0x400
jae 0x5d61eb
xor eax, eax
inc eax
jmp 0x5d61f4
shr esi, 0xa
mov eax, esi
jmp 0x5d61f4
xor eax, eax
pop edi
pop esi
ret
Function at 0x5d7bb1
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [ebp + 8]
mov dword [ebp - 8], ecx
lea ecx, [ebp - 4]
call fcn.0040d2ee
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 3
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x5d7c21
push ebx
push ebx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
push ebx
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 8]
mov dword [eax + 0xc8], ebx
xor ebx, ebx
inc ebx
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x5d7c31
call fcn.00407965
pop esi
mov eax, ebx
pop ebx
leave
ret 8

Function at 0x5d7c39
Capabilities:
Write file on windows

Disassembly:
push 0x824
mov eax, 0x610d84
call fcn.004db4be
mov ebx, ecx
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x818], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x814], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x81c], eax
mov eax, dword [0x673200]
test byte [eax + 4], 0x10
je 0x5d7cd1
push ecx
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x830]
call fcn.004a9820
and dword [ebp - 4], 0
lea ecx, [ebp - 0x830]
push 0
push dword [ebp - 0x814]
push esi
push 0x642c2c
push dword [ebx + 0x6c]
push str.CCacheStreamP2P::OnGetStreamDataSave__current_offset_is:
call fcn.004a9b63
mov ecx, eax
call fcn.004a9a44
mov ecx, eax
call fcn.004a9b63
mov ecx, eax
call fcn.004a988a
mov ecx, eax
call fcn.004a9bc0
push 0x10
mov edx, eax
pop ecx
call fcn.004a96a7
pop ecx
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x818]
push 0
push eax
push esi
push dword [ebp - 0x81c]
push dword [ebx + 0xc8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add dword [ebx + 0x6c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x144], eax
call fcn.004db46d
ret 0x10
Function at 0x5da26d
Capabilities:
Delete file

Disassembly:
push 0xc
mov eax, 0x61119a
call fcn.004db48b
mov ebx, ecx
mov eax, dword [ebx + 0x20]
shl eax, 0x14
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x645b70]
mulsd xmm0, qword [0x6457e8]
call fcn.005f9fd0
mov edx, dword [ebx + 0xa4]
mov esi, eax
mov eax, dword [ebx + 0xa0]
mov dword [ebp - 0x14], esi
test edx, edx
ja 0x5da2dc
jb 0x5da2bd
cmp eax, esi
jae 0x5da2dc
mov ecx, esi
sub ecx, eax
push 0
pop eax
sbb eax, edx
test eax, eax
ja 0x5da39a
jb 0x5da2dc
cmp ecx, 0x500000
ja 0x5da39a
mov edi, dword [ebx + 0x94]
lea eax, [ebx + 0x90]
mov ecx, dword [eax]
dec edi
mov eax, dword [eax + 4]
shl eax, 4
push 0x4b5617
lea edx, [eax + ecx]
sar eax, 4
push eax
call fcn.004b65cf
mov eax, dword [ebx + 0xa4]
pop ecx
pop ecx
mov ecx, dword [ebx + 0xa0]
add ecx, 0xa00000
adc eax, 0
test eax, eax
jb 0x5da39a
ja 0x5da323
cmp ecx, esi
jbe 0x5da39a
test edi, edi
js 0x5da39a
push edi
lea ecx, [ebx + 0x90]
call fcn.004b5e0c
push eax
lea ecx, [ebp - 0x10]
call fcn.0040d36e
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00414841
test eax, eax
je 0x5da359
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x5da365
push edi
lea ecx, [ebx + 0x90]
call fcn.004b55a5
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0xc]
dec edi
cmp ecx, 0x668010
je 0x5da37a
call fcn.00407965
mov ecx, dword [ebx + 0xa0]
mov eax, dword [ebx + 0xa4]
add ecx, 0xa00000
adc eax, 0
test eax, eax
ja 0x5da323
jb 0x5da39a
cmp ecx, dword [ebp - 0x14]
ja 0x5da323
call fcn.004db459
ret
Function at 0x5daf3e
Capabilities:
Delete file

Disassembly:
push 0x3c
mov eax, 0x611358
call fcn.004db48b
lea ecx, [ebp - 0x48]
call fcn.004b5538
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.005d647d
mov esi, dword [0x668294]
mov dword [ebp + 8], esi
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x14]
mov ebx, 0x675270
push eax
mov ecx, ebx
call fcn.004b5aa4
test al, al
je 0x5daff3
push 1
mov edi, 0x637cac
lea eax, [ebp + 8]
push edi
push eax
call fcn.0040cefd
mov esi, dword [ebp + 8]
add esp, 0xc
push dword [ebp - 0x38]
push esi
call fcn.005073b0
pop ecx
pop ecx
test eax, eax
jne 0x5daff3
mov ecx, dword [ebp - 0x48]
call fcn.00414841
test eax, eax
je 0x5dafc6
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x5daff3
push 0
lea eax, [ebp + 8]
push edi
push eax
call fcn.0040cefd
add esp, 0xc
lea eax, [ebp + 8]
lea ecx, [ebp - 0x38]
push eax
call fcn.0040d242
lea eax, [ebp - 0x48]
mov ecx, ebx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004b5ad8
mov esi, dword [ebp + 8]
mov eax, dword [0x668294]
lea edi, [ebp - 0x18]
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push 2
push eax
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
push eax
call fcn.0040d36e
push ecx
mov ecx, esp
push 0x675238
call fcn.0040d36e
mov edx, edi
lea ecx, [ebp - 0x1c]
call fcn.005d7894
add esp, 0x10
lea ecx, [ebp + 8]
push eax
call fcn.0040d242
mov ecx, dword [ebp - 0x1c]
mov ebx, 0x668010
add ecx, 0xfffffff4
cmp ecx, ebx
je 0x5db04a
call fcn.00407965
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.0040d242
mov eax, dword [edi]
mov ecx, 0x80004005
xor edi, edi
cmp dword [eax - 8], edi
cmove edi, ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff4
cmp ecx, ebx
je 0x5db076
call fcn.00407965
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff4
cmp ecx, ebx
je 0x5db085
call fcn.00407965
lea ecx, [esi - 0xc]
cmp ecx, ebx
je 0x5db091
call fcn.00407965
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff4
cmp ecx, ebx
je 0x5db0a0
call fcn.00407965
lea ecx, [ebp - 0x48]
call fcn.004b5737
mov eax, edi
call fcn.004db459
ret 0x10
Function at 0x5dba71
Capabilities:
Create directory
Get file attributes

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x5dbb1b
xor eax, eax
cmp word [esi], ax
je 0x5dbb1b
push ebx
push edi
push 0x5c
pop ebx
push ebx
push esi
call fcn.004e115a
pop ecx
pop ecx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x5dbadc
movzx eax, word [esi + 2]
cmp eax, 0x3a
jne 0x5dbab2
cmp word [esi + 4], bx
je 0x5dbace
cmp word [esi], bx
jne 0x5dbadc
cmp ax, bx
jne 0x5dbadc
lea eax, [edi + 4]
push ebx
push eax
call fcn.004e115a
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x5dbae5
lea eax, [edi + 2]
push ebx
push eax
call fcn.004e115a
pop ecx
pop ecx
mov edi, eax
test edi, edi
je 0x5dbae5
xor eax, eax
mov word [edi], ax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x5dbb02
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
test edi, edi
je 0x5dbb0d
mov word [edi], bx
test eax, eax
jne 0x5dbace
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
pop ebx
and eax, 0x10
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x5dbb1f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test ecx, ecx
je 0x5dbb3c
cmp word [ecx], 0
je 0x5dbb3c
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5dbb3c
shr eax, 4
and eax, 1
ret
xor eax, eax
ret

Function at 0x5dc8a4
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x611604
call fcn.004db48b
mov eax, dword [0x668294]
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push str.dwTaskID___d__dwPlayProgress___d
push eax
call fcn.0040cefd
mov esi, dword [ebp - 0x10]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [0x6752e0]
test ecx, ecx
je 0x5dc8f5
mov eax, dword [ecx]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
call dword [eax + 0x14]
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x5dc905
call fcn.00407965
call fcn.004db459
ret 8
Function at 0x5dd667
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x667710]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x1c]
push ebx
push esi
mov eax, dword [eax]
push edi
mov esi, dword [eax - 8]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0x6e657474
mov dword [ebp - 0x10], 0x65646f63
mov dword [ebp - 0xc], 0x24212529
mov byte [ebp - 8], 0
call fcn.0041ddcb
jmp 0x5dd6c5
lea eax, [ebp - 0x14]
push eax
call fcn.00505070
pop ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042aaaa
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 8], esi
jl 0x5dd6ae
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040cc99
mov edi, dword [0x668294]
push esi
mov dword [ebp - 0x20], edi
call fcn.00505e8b
mov ebx, eax
mov dword [ebp - 0x28], ebx
pop ecx
test ebx, ebx
jne 0x5dd719
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.0040cd8e
lea ecx, [edi - 0xc]
mov esi, 0x668010
cmp ecx, esi
je 0x5dd70e
call fcn.00407965
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff4
jmp 0x5dd7ba
mov eax, dword [ebp - 0x18]
lea ecx, [esi - 1]
mov edi, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
test ecx, ecx
js 0x5dd74d
sub ebx, ecx
lea edx, [ecx + edi]
dec ebx
add ebx, esi
sub dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x18]
mov al, byte [edi + edx]
xor al, byte [edx]
dec edx
mov byte [ebx], al
inc ebx
sub ecx, 1
jns 0x5dd739
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x28]
lea ecx, [ebp - 0x18]
lea eax, [esi*2 + 1]
push ecx
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
call fcn.0040cccd
push eax
mov edx, esi
mov ecx, ebx
call fcn.004a82ba
pop ecx
pop ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
call fcn.0040cc99
push ebx
call fcn.0050524d
pop ecx
lea ecx, [ebp - 0x20]
call fcn.0040f2d3
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x5dd798
push esi
call fcn.00516257
pop ecx
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.0040cd8e
lea ecx, [esi - 0xc]
mov esi, 0x668010
cmp ecx, esi
je 0x5dd7b7
call fcn.00407965
lea ecx, [edi - 0xc]
cmp ecx, esi
je 0x5dd7c3
call fcn.00407965
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004da623
leave
ret
Function at 0x5dd7d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x34
mov eax, 0x6118a5
call fcn.004db4be
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x24]
and dword [ebp - 0x38], 0
mov eax, dword [edi]
mov eax, dword [eax - 8]
cdq
sub eax, edx
mov dword [ebp - 0x20], 0x6e657474
mov esi, eax
mov dword [ebp - 0x1c], 0x65646f63
lea eax, [ebp - 0x20]
sar esi, 1
push eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], 0x24212529
mov byte [ebp - 0x14], 0
call fcn.0041ddcb
mov dword [ebp - 4], 1
jmp 0x5dd845
lea eax, [ebp - 0x20]
push eax
call fcn.00505070
pop ecx
lea ecx, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.0042aaaa
mov eax, dword [ebp - 0x24]
cmp dword [eax - 8], esi
jl 0x5dd82e
push esi
lea ecx, [ebp - 0x24]
call fcn.0040cc99
mov eax, dword [0x668294]
mov dword [ebx], eax
lea eax, [esi + 1]
mov dword [ebp - 0x38], 1
push eax
mov ecx, ebx
call fcn.0040cccd
mov edx, eax
mov eax, dword [edi]
lea edi, [esi - 1]
mov dword [ebp - 0x30], eax
mov esi, dword [ebp - 0x24]
test edi, edi
js 0x5dd8ce
mov eax, dword [ebp - 0x34]
mov ecx, edx
sub ecx, edi
dec eax
add eax, ecx
sub esi, edx
mov dword [ebp - 0x2c], esi
mov esi, eax
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + edi*2]
call fcn.004a8322
mov dl, al
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + edi*2 + 1]
call fcn.004a8322
test dl, dl
js 0x5dd8c8
test al, al
js 0x5dd8c8
shl dl, 4
add dl, al
xor dl, byte [ebx + esi]
mov byte [esi], dl
inc esi
sub edi, 1
jns 0x5dd897
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
push dword [ebp - 0x34]
mov ecx, ebx
call fcn.0040cc99
push 0xd
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.004395d7
push str.http_3A_2F_2F
push dword [eax]
call fcn.0051655c
neg eax
mov edi, 0x668010
pop ecx
pop ecx
mov ecx, dword [ebp - 0x28]
sbb al, al
inc al
add ecx, 0xfffffff4
mov dword [ebp - 0x2c], eax
cmp ecx, edi
je 0x5dd913
call fcn.00407965
mov eax, dword [ebp - 0x2c]
test al, al
je 0x5dd940
push ecx
mov ecx, esp
push ebx
call fcn.0040cd8e
lea ecx, [ebp - 0x28]
call fcn.005dd954
pop ecx
push eax
mov ecx, ebx
call fcn.0040cd2a
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff4
cmp ecx, edi
je 0x5dd940
call fcn.00407965
lea ecx, [esi - 0xc]
cmp ecx, edi
je 0x5dd94c
call fcn.00407965
mov eax, ebx
call fcn.004db46d
ret
Function at 0x5e1db6
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
mov eax, dword [0x667710]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x3a
mov word [ebp - 0x44], cx
xor esi, esi
pop ecx
push 0x5c
pop eax
push ecx
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push esi
push eax
mov word [ebp - 0x42], cx
call fcn.004e0bc0
add esp, 0xc
mov dword [ebp - 0x848], esi
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x84c], esi
push esi
push esi
push eax
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x848]
push eax
push 0x400
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x848]
xor ecx, ebp
pop esi
call fcn.004da623
leave
ret

Function at 0x5e2793
Capabilities:
Create directory

Disassembly:
push 0x320
mov eax, 0x611f6e
call fcn.004db4be
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi + 0x10], ebx
jne 0x5e27b5
xor eax, eax
jmp 0x5e2903
test esi, esi
je 0x5e27ce
cmp word [esi], bx
je 0x5e27ce
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
mov ecx, edi
call fcn.0040f513
lea ecx, [ebp - 0x2c8]
call fcn.005cb530
sub esp, 0xc
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x32c]
call fcn.005cb2ac
lea eax, [ebp - 0x32c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2c8]
call fcn.005cb02a
push 0x643b1c
lea ecx, [ebp - 0x300]
call fcn.005cb14e
push 0xa
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 2
push eax
push 3
call fcn.0051a25f
add esp, 0xc
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x300]
push eax
push str.version
call fcn.005cb083
lea eax, [ebp - 0x300]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.005cb02a
lea eax, [ebp - 0x2c8]
mov ecx, edi
push eax
call fcn.005e2022
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x29c], ebx
push eax
lea eax, [ebp - 0x298]
push eax
push 0x104
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [ebp - 0x29c]
test eax, eax
je 0x5e289c
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x298]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [edi]
lea ecx, [ebp - 0x2a0]
push ebx
call fcn.00407a7f
pop ecx
push ebx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c8]
push dword [eax]
call fcn.005cb3da
mov ecx, dword [ebp - 0x2a0]
add ecx, 0xfffffff4
movzx esi, al
cmp ecx, 0x668010
je 0x5e28d6
call fcn.00407965
lea ecx, [ebp - 0x300]
call fcn.005cb112
lea ecx, [ebp - 0x32c]
call fcn.00413933
lea ecx, [ebp - 0x2c8]
mov dword [ebp - 0x2c8], 0x636404
call fcn.005cb049
mov eax, esi
call fcn.004db46d
ret 4
Function at 0x5e29c5
Capabilities:
Read file via mapping

Disassembly:
push 0x18
mov eax, 0x611fad
call fcn.004db48b
mov eax, ecx
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp dword [eax + 0x18], ebx
jne 0x5e2b0a
mov ecx, dword [ebp + 8]
call fcn.0047a405
test eax, eax
je 0x5e2b0a
mov eax, dword [0x668294]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0047a46b
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
pop ecx
test eax, eax
je 0x5e2ae9
mov eax, dword [ebp - 0x10]
add eax, 0x20
push edi
mov ecx, eax
mov dword [ebp - 0x18], eax
call fcn.00472dd5
test eax, eax
je 0x5e2ae9
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
push eax
call fcn.0040d36e
mov ecx, dword [ebp - 0x18]
call fcn.0047a534
mov ecx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], ecx
test ecx, ecx
je 0x5e2ae9
push ebx
push ecx
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [ebp - 0x10]
push dword [ecx + 0xc]
mov dword [ecx + 0x14], eax
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x18], eax
test eax, eax
jne 0x5e2a91
mov ebx, 0x8007000e
jmp 0x5e2ae9
cmp dword [ebp + 8], 0
lea eax, [ecx + 0x1c]
mov dword [ebp - 0x20], eax
jne 0x5e2aa1
mov eax, ebx
jmp 0x5e2aaa
push dword [ebp + 8]
call fcn.00505bb3
pop ecx
push dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
push eax
call fcn.0040f513
mov eax, dword [ebp - 0x10]
push eax
push ecx
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ebx
call fcn.004b86d4
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
test ecx, ecx
je 0x5e2ae9
mov eax, dword [ecx]
push 1
push edx
push dword [ebp + 8]
push esi
call dword [eax + 0x14]
mov ebx, eax
lea ecx, [esi - 0xc]
mov esi, 0x668010
cmp ecx, esi
je 0x5e2afa
call fcn.00407965
lea ecx, [edi - 0xc]
cmp ecx, esi
je 0x5e2b06
call fcn.00407965
mov eax, ebx
jmp 0x5e2b0c
xor eax, eax
call fcn.004db459
ret 4
Function at 0x5e8b9a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp word [0x675788], 0
push esi
mov esi, 0x675788
jne 0x5e8bce
lea eax, [ebp - 4]
xor ecx, ecx
push eax
push esi
push 0x104
push ecx
push str.mp3PRO.dll
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x5e8be4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5e8be4
shr eax, 4
not eax
and eax, 1
jmp 0x5e8be6
xor eax, eax
pop esi
leave
ret
Function at 0x5eac86
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004db570
mov eax, dword [0x667710]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [eax]
mov eax, dword [0x677420]
cmp eax, dword [ecx + 4]
jg 0x5eaeba
mov ecx, dword [0x67741c]
xor ebx, ebx
cmp dword [ecx - 8], ebx
jne 0x5eae9f
mov esi, 0x20019
mov dword [ebp - 0x101c], ebx
push esi
push str.SOFTWAREMicrosoftMediaPlayerPlayerExtensionsTypes
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x101c]
mov dword [ebp - 0x1018], ebx
mov dword [ebp - 0x1014], ebx
call fcn.00413668
test eax, eax
je 0x5ead32
push esi
push str.SOFTWAREMicrosoftMediaPlayerPlayerExtensions
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x101c]
call fcn.00413668
test eax, eax
je 0x5ead32
cmp dword [ebp - 0x101c], ebx
je 0x5ead2b
push dword [ebp - 0x101c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x5eaea6
mov esi, 0x67741c
push 0x400
mov ecx, esi
call fcn.0040ceb7
mov ecx, esi
call fcn.0040f41c
mov eax, dword [0x67741c]
xor ecx, ecx
mov esi, ebx
mov dword [ebp - 0x100c], ebx
mov dword [eax - 8], ebx
mov eax, dword [0x67741c]
mov word [eax], cx
mov eax, 0x400
mov dword [ebp - 0x1010], eax
mov dword [ebp - 0x1008], eax
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x100c]
push eax
push ebx
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x5eae45
cmp dword [ebp - 0x100c], 1
jne 0x5eae06
mov eax, dword [ebp - 0x1008]
add eax, eax
cmp eax, 0x800
jae 0x5eaeb5
xor ecx, ecx
mov word [ebp + eax - 0x804], cx
lea eax, [ebp - 0x804]
push eax
call fcn.00505bb3
pop ecx
lea ecx, [ebp - 0x804]
push ecx
push eax
mov ecx, 0x67741c
call fcn.0040f454
push 0x638040
call fcn.00505bb3
mov dword [esp], 0x638040
mov ecx, 0x67741c
push eax
call fcn.0040f454
mov eax, 0x400
inc esi
and dword [ebp - 0x100c], 0
mov dword [ebp - 0x1010], eax
mov dword [ebp - 0x1008], eax
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x100c]
push eax
push 0
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1004]
push eax
push esi
push dword [ebp - 0x101c]
call ebx
test eax, eax
je 0x5eada5
push ecx
mov ebx, 0x67741c
mov ecx, ebx
call fcn.004b2232
mov ecx, ebx
call fcn.0040f41c
mov eax, dword [0x67741c]
test eax, eax
je 0x5eae79
push eax
call fcn.00516182
pop ecx
mov esi, str..mpeg_.mpg_.mpa_.mpga_.mpega_.mpe_.m1v_.ac3_.avi_.snd_.au_.aif_.aifc_.aiff_.dat_
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
mov ecx, ebx
call fcn.0040f454
lea ecx, [ebp - 0x101c]
call fcn.0041364e
mov ecx, dword [0x67741c]
mov edx, edi
call fcn.004ac506
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004da623
leave
ret
call fcn.004dafb4
mov esi, 0x677420
push esi
call fcn.004da785
cmp dword [0x677420], 0xffffffff
pop ecx
jne 0x5eacbb
mov eax, dword [0x668294]
push 0x613c32
mov dword [0x67741c], eax
call fcn.004dadb5
push esi
call fcn.004da73b
pop ecx
pop ecx
jmp 0x5eacbb