joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c6b90
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov word [esp], 0
test ebx, ebx
je 0x5c6bce
mov eax, ebx
call fcn.0040b278
push eax
push pe_nt_image_headers32
lea eax, [esp + 8]
push eax
push 0x5c6c00
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
jmp 0x5c6bec
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push 0x5c6c00
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_GetProfileStringW
cmp word [esp], 0
sete al
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5c6fc8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5c705d
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x5c7013
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.0040a350
jmp 0x5c7047
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
cmp word [ebx], 0
jne 0x5c702a
lea eax, [ebp - 4]
call fcn.0040a1c8
jmp 0x5c703d
lea edx, [ebp - 4]
mov eax, ebx
call fcn.005c6e18
mov ebx, eax
test esi, esi
je 0x5c703d
dec esi
jmp 0x5c701a
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040a5a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c7064
lea eax, [ebp - 4]
call fcn.0040a1c8
ret

Function at 0x5c7448
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00424328
add esp, 0x208
pop ebx
ret

Function at 0x5c74a8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00424328
add esp, 0x208
pop ebx
ret

Function at 0x5c757c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5c75f9
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x5c75d7
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 6
jb 0x5c75d7
lea eax, [ebp - 8]
call fcn.005c74a8
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.005c4ebc
lea eax, [ebp - 4]
mov edx, 0x5c7614
call fcn.0040b470
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.005c52e0
jmp 0x5c75de
mov eax, esi
call fcn.0040a1c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c7600
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a228
ret
Function at 0x5c7840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x5c7976
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5c7960
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x5c789d
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x5c7960
cmp dword [ebp - 0x14], 0
jne 0x5c78b2
mov eax, dword [ebp - 0xc]
call fcn.0040a1c8
mov bl, 1
jmp 0x5c7960
cmp dword [ebp - 0x14], 0x70000000
jb 0x5c78c0
call fcn.00429014
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.0040a350
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.0040a774
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
je 0x5c7866
test eax, eax
jne 0x5c7960
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x5c790e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x5c7960
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x5c7916
dec esi
test esi, esi
je 0x5c7925
mov eax, dword [ebp - 4]
cmp word [eax + esi*2 - 2], 0
je 0x5c7915
cmp dword [ebp - 0x10], 7
jne 0x5c7930
test esi, esi
je 0x5c7930
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040b3f0
cmp dword [ebp - 0x10], 7
jne 0x5c7953
test esi, esi
je 0x5c7953
lea eax, [ebp - 4]
call fcn.0040a774
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040a5a8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c797d
lea eax, [ebp - 4]
call fcn.0040a1c8
ret

Function at 0x5c79a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov ebp, eax
push 0
push 0
push 0
push 0
push esi
push ebp
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
test bl, bl
je 0x5c7a1c
test esi, esi
je 0x5c79cd
cmp word [esi], 0
jne 0x5c7a1c
call fcn.00429d30
cmp eax, 2
je 0x5c7a1c
xor ebx, ebx
xor esi, esi
mov dword [esp + 4], 2
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push esi
push ebp
call sub.advapi32.dll_RegEnumValueW
mov edi, eax
test edi, edi
je 0x5c7a0a
cmp edi, 0xea
jne 0x5c7a1c
test edi, edi
jne 0x5c7a19
cmp word [esp], 0
jne 0x5c7a19
mov bl, 1
jmp 0x5c7a1c
inc esi
jmp 0x5c79db
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5c7a88
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x5c7a9c
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyW
pop esi
pop ebx
ret
cmp dword [0x6d77e4], 0
jne 0x5c7abf
push 0x5c7ae4
push 0x5c7b04
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00414030
mov dword [0x6d77e4], eax
cmp dword [0x6d77e4], 0
je 0x5c7ad9
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x6d77e4]
jmp 0x5c7ade
mov eax, 0x7f
pop esi
pop ebx
ret

Function at 0x5c7b20
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x5c7c93
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
je 0x5c7b54
mov eax, dword [ebp - 0x10]
cmp word [eax], 0
jne 0x5c7b5e
mov ebx, 0x57
jmp 0x5c7c7d
call fcn.00429d30
cmp eax, 2
jne 0x5c7c6c
push 0
push 8
lea eax, [ebp - 0x14]
push eax
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.005c7a60
test eax, eax
jne 0x5c7c6c
xor eax, eax
push ebp
push 0x5c7c65
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.0040a350
xor eax, eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5c7bb9
sub ebx, 4
mov ebx, dword [ebx]
mov dword [ebp - 0x1c], ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.0040a774
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov esi, eax
cmp esi, 0xea
jne 0x5c7c24
mov edi, dword [ebp - 4]
test edi, edi
je 0x5c7bf4
sub edi, 4
mov edi, dword [edi]
cmp edi, 0x10000
jge 0x5c7c4e
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x5c7c13
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a350
jmp 0x5c7bad
test esi, esi
jne 0x5c7c4e
mov eax, dword [ebp - 4]
call fcn.0040b278
mov ecx, eax
movzx eax, byte [ebp - 5]
mov edx, dword [ebp - 0x14]
call fcn.005c7b20
test eax, eax
je 0x5c7bad
inc dword [ebp - 0x18]
jmp 0x5c7bad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c7c6c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.005c7a88
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c7c9a
lea eax, [ebp - 4]
call fcn.0040a1c8
ret
Function at 0x5c7e14
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov ebx, eax
call fcn.00429d30
cmp eax, 2
je 0x5c7e31
mov byte [ebp - 1], 1
jmp 0x5c8006
mov byte [ebp - 1], 0
mov eax, 0x6cece0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x5c8006
xor eax, eax
push ebp
push 0x5c7fff
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x5c7e9a
push 0x5c8010
push 0x5c803c
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00414030
mov ebx, eax
test ebx, ebx
je 0x5c7ec1
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x5c7fe8
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x5c7fe8
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x5c7f12
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
je 0x5c7ef3
call fcn.004099b8
jmp 0x5c8006
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x5c7f12
call fcn.004099b8
jmp 0x5c8006
xor eax, eax
push ebp
push 0x5c7fe1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x5c7f55
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x5c7f55
call fcn.004099b8
call fcn.004099b8
jmp 0x5c8006
mov eax, dword [ebp - 0x14]
call fcn.00406f0c
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x5c7f87
call fcn.004099b8
call fcn.004099b8
jmp 0x5c8006
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x5c7fc2
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x5c7fbe
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x5c7fbe
mov byte [ebp - 1], 1
jmp 0x5c7fc2
inc ebx
dec esi
jne 0x5c7f94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c7fe8
mov eax, dword [ebp - 0x18]
call fcn.00406f28
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c8006
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c8700
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
xor edx, edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5c88cb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x5c8891
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x5c88e8
call fcn.0040b8a8
test eax, eax
jne 0x5c8891
mov eax, dword [ebp - 8]
call fcn.005c68bc
test al, al
je 0x5c8891
lea eax, [ebp - 0x25c]
push eax
lea edx, [ebp - 0x260]
mov eax, dword [ebp - 8]
call fcn.005c4ebc
lea eax, [ebp - 0x260]
mov edx, 0x5c88f8
call fcn.0040b470
mov eax, dword [ebp - 0x260]
call fcn.0040b278
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x5c8891
xor eax, eax
push ebp
push 0x5c888a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x5c88fc
lea eax, [ebp - 0x230]
call fcn.00424154
test eax, eax
je 0x5c885b
mov edx, 0x5c8900
lea eax, [ebp - 0x230]
call fcn.00424154
test eax, eax
je 0x5c885b
lea edx, [ebp - 0x264]
mov eax, dword [ebp - 8]
call fcn.005c4ebc
mov eax, dword [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x230]
mov ecx, 0x104
call fcn.0040b318
mov ecx, dword [ebp - 0x268]
lea eax, [ebp - 4]
pop edx
call fcn.0040b4c8
mov ebx, dword [ebp - 0x25c]
test bl, 1
je 0x5c883a
and ebx, 0xfffffffe
push ebx
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
call sub.kernel32.dll_SetFileAttributesW
test byte [ebp - 0x25c], 0x10
jne 0x5c8853
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
call sub.kernel32.dll_DeleteFileW
jmp 0x5c885b
mov eax, dword [ebp - 4]
call fcn.005c8700
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5c87b7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c8891
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose
ret
mov eax, dword [ebp - 8]
call fcn.0040b278
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c88d2
lea eax, [ebp - 0x268]
mov edx, 3
call fcn.0040a228
lea eax, [ebp - 4]
call fcn.0040a1c8
ret
Function at 0x5c8ce0
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5c8d7d
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00429d30
cmp eax, 2
jne 0x5c8d23
push 1
mov eax, esi
call fcn.0040b278
push eax
mov eax, edi
call fcn.0040b278
push eax
call sub.kernel32.dll_MoveFileExW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x5c8d67
mov eax, esi
call fcn.0040b278
mov edx, eax
lea eax, [ebp - 4]
call fcn.0040b2dc
mov eax, dword [ebp - 4]
call fcn.00423a38
mov ebx, eax
test bl, bl
jne 0x5c8d4c
call sub.kernel32.dll_GetLastError
cmp eax, 2
jne 0x5c8d67
mov eax, esi
call fcn.0040b278
push eax
mov eax, edi
call fcn.0040b278
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c8d84
lea eax, [ebp - 4]
call fcn.0040a1c8
ret

Function at 0x5c9cec
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret
Function at 0x5cd14c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x6d7828
mov eax, esi
mov edx, 8
test al, 1
je 0x5cd168
shr eax, 1
xor eax, 0xedb88320
jmp 0x5cd16a
shr eax, 1
dec edx
jne 0x5cd15b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5cd154
pop esi
ret

Function at 0x5cd180
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x6d7824], 0
jne 0x5cd1aa
call fcn.005cd14c
mov dword [esp], 0x6d7824
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x5cd1d4
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x6d7828]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x5cd1b0
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5e0028
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
lea edi, [ebp - 0xd]
mov bl, 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0x18]
dec esi
test esi, esi
jl 0x5e01d8
inc esi
mov eax, dword [ebp + 8]
push eax
mov eax, edi
mov edx, 5
call fcn.005dec64
pop ecx
test al, al
jne 0x5e006f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.005e030c
xor ebx, ebx
jmp 0x5e01d8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
cmp eax, dword [edi]
ja 0x5e008d
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.005e030c
xor ebx, ebx
jmp 0x5e01d8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 4]
mov edx, dword [edi]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.005f75dc
test eax, eax
jne 0x5e00c4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.005e030c
xor ebx, ebx
jmp 0x5e01d8
test byte [edi + 4], 1
je 0x5e01d1
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov edx, 4
call fcn.005dec64
pop ecx
test al, al
jne 0x5e00f8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.005e030c
xor ebx, ebx
jmp 0x5e01d8
mov edx, dword [0x5dbfd0]
mov eax, 0xc
call fcn.0040c870
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5e01a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.0040ada0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.0040a77c
mov edx, dword [ebp - 4]
call fcn.005dec64
pop ecx
test al, al
jne 0x5e0166
mov edx, dword [0x5dbfd0]
mov eax, dword [ebp - 8]
call fcn.0040c884
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.005e030c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5e01d8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.005d754c
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
call fcn.005d7964
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5e01d1
dec esi
jne 0x5e0046
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5eb0a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5eb125
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.005d7bdc
mov eax, dword [ebp - 4]
call fcn.005d754c
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x30]
mov ebx, dword [eax + 0xc]
dec ebx
cmp ebx, 0
jl 0x5eb10c
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 4]
mov esi, dword [eax + ebx*4]
mov eax, dword [esi + 4]
cmp eax, dword [ebp - 8]
jne 0x5eb106
mov eax, dword [esi]
mov edx, dword [ebp - 4]
call fcn.0040abf0
je 0x5eb10f
dec ebx
cmp ebx, 0xffffffff
jne 0x5eb0e9
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eb12c
lea eax, [ebp - 4]
call fcn.0040a1ec
ret
Function at 0x5fd524
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ebx, ebx
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x5fd570
cmp dword [ebp - 0x104], 2
jne 0x5fd570
cmp dword [ebp - 0x110], 5
ja 0x5fd56e
cmp dword [ebp - 0x110], 5
jne 0x5fd570
cmp dword [ebp - 0x10c], 1
jb 0x5fd570
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5fd578
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00424328
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6006e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00424328
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x605694
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
xor edx, edx
mov dword [ebp - 0x25c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x605766
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x258]
push eax
lea edx, [ebp - 0x25c]
mov eax, ebx
call fcn.005c4ebc
lea eax, [ebp - 0x25c]
mov edx, 0x605784
call fcn.0040b470
mov eax, dword [ebp - 0x25c]
call fcn.0040b278
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x60574d
xor eax, eax
push ebp
push 0x605746
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
call fcn.00605644
test al, al
je 0x60571b
mov byte [ebp - 1], 1
jmp 0x60572f
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x605706
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60574d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60576d
lea eax, [ebp - 0x25c]
call fcn.0040a1c8
ret

Function at 0x605788
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
push 0x200
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x6057c8
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.0040b318
jmp 0x6057cf
mov eax, ebx
call fcn.0040a1c8
add esp, 0x2b4
pop esi
pop ebx
ret

Function at 0x6057d8
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6cef50]
or eax, 0x4001
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x605817
mov eax, dword [esp + 4]
jmp 0x605819
xor eax, eax
add esp, 0x2b4
pop esi
pop ebx
ret
Function at 0x605824
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6cef58]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x605868
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x60585d
mov eax, dword [esp + 4]
jmp 0x60585f
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x605847
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6cef58]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x605868
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x60585d
mov eax, dword [esp + 4]
jmp 0x60585f
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x605d04
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
test dl, dl
je 0x605d18
add esp, 0xfffffff0
call fcn.00408a40
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0051556c
mov eax, dword [0x605db8]
not eax
and dword [esi + 0x60], eax
mov edx, 0x79
mov eax, esi
call fcn.005118d0
mov edx, 0x61
mov eax, esi
call fcn.00511904
xor edx, edx
mov eax, esi
call fcn.00512604
mov dl, 1
mov eax, esi
call fcn.0051b730
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 6
jae 0x605d74
mov dx, 0xfffe
mov eax, esi
call fcn.0051264c
push 0
lea eax, [ebp - 0x5c]
push eax
push 0x5c
push 0x1f
call sub.user32.dll_SystemParametersInfoW
test eax, eax
je 0x605d9a
lea eax, [ebp - 0x5c]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov edx, eax
mov eax, dword [esi + 0x74]
call fcn.004ee4ec
mov eax, esi
test bl, bl
je 0x605daf
call fcn.00408a98
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret