joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5559c0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
xor esi, 0x28cd
and esi, 0x8eae
add esi, 0xc8b8
pop esi
push edi
push ebx
add esp, 4
sub edi, 0x78ac
or edi, 0xc817
add edi, 0x9bf1
xor edi, 0xa27f
pop edi
push ecx
push edi
add esp, 4
xor ecx, 0xb762
call 0x5559a9
add byte [esi + 0x4e], cl
dec esi
cmp bh, byte [0xc4833a3a]
add al, 0x81
loope 0x5559a4
add byte [eax], 0
pop ecx
push edi
call 0x5559c0
add byte [0x483e3a42], bh
dec esi
add esp, 4
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x43c], eax
push esi
or esi, 0x175be
or esi, 0x124a6
pop esi
push ecx
push eax
add esp, 4
and ecx, 0x15bad
pop ecx
push ebx
push esi
add esp, 4
and ebx, 0x4913
xor ebx, 0xd42e
sub ebx, 0x7bc9
pop ebx
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x440], edx
push ecx
xor ecx, 0x5aa3
and ecx, 0x14f4e
pop ecx
push ecx
and ecx, 0x7015
jmp 0x555a2f
xor ecx, 0x15829
jmp 0x555a3a
pop ecx
push eax
or eax, 0xcf99
pop eax
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
jne 0x555a96
push esi
push esi
add esp, 4
xor esi, 0x8869
sub esi, 0xe3a3
and esi, 0xf3a4
pop esi
push ebx
push edx
add esp, 4
jmp 0x555a7c
and ebx, 0xe7f4
jmp 0x555a89
pop ebx
mov dword [ebp - 0x74], 0
jmp fcn.00555e22
push esi
call 0x555aa3
add byte [esi], bh
dec ebx
aas
dec edx
aaa
inc ebx
add esp, 4
xor esi, 0x1129b
pop esi
push ebx
jmp 0x555ab3
and ebx, 0x42e8
pop ebx
push ebx
xor ebx, 0xf4ad
and ebx, 0x5b4
pop ebx
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jne 0x555b21
push ebx
xor ebx, 0xe3dc
add ebx, 0x1558d
pop ebx
push edx
push ebx
add esp, 4
or edx, 0x47c0
pop edx
push edx
push esi
add esp, 4
add edx, 0x106ba
add edx, 0x11705
xor edx, 0x16100
pop edx
mov dword [ebp - 0x74], 0
jmp fcn.00555e22
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0xb0], ecx
push ebx
or ebx, 0x17ee7
add ebx, 0x13d2f
sub ebx, 0x5ac2
pop ebx
push ebx
call 0x555b4f
add byte [esi + 0x48], cl
cmp eax, 0x3241453c
add esp, 4
jmp 0x555b58
or ebx, 0xfa88
pop ebx
lea edx, [ebp - 0x2b0]
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x25c], ecx
push eax
push edx
add esp, 4
or eax, 0x1bfc
add eax, 0x5285
add eax, 0x126e
call 0x555ba0
add byte [ecx + 0x46], cl
xor al, 0x48
cmp al, 0x3a
cmp dh, byte [0xc4834e4d]
add al, 0x58
push esi
jmp 0x555bab
pop esi
xor edx, edx
mov word [ebp - 0x48], dx
xor eax, eax
mov word [ebp - 0x20], ax
push ebx
jmp 0x555bbe
sub ebx, 0x133ad
xor ebx, 0x3c4b
pop ebx
push esi
push esi
add esp, 4
Function at 0x555aa3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
xor esi, 0x28cd
and esi, 0x8eae
add esi, 0xc8b8
pop esi
push edi
push ebx
add esp, 4
sub edi, 0x78ac
or edi, 0xc817
add edi, 0x9bf1
xor edi, 0xa27f
pop edi
push ecx
push edi
add esp, 4
xor ecx, 0xb762
call 0x5559a9
add byte [esi + 0x4e], cl
dec esi
cmp bh, byte [0xc4833a3a]
add al, 0x81
loope 0x5559a4
add byte [eax], 0
pop ecx
push edi
call 0x5559c0
add byte [0x483e3a42], bh
dec esi
add esp, 4
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x43c], eax
push esi
or esi, 0x175be
or esi, 0x124a6
pop esi
push ecx
push eax
add esp, 4
and ecx, 0x15bad
pop ecx
push ebx
push esi
add esp, 4
and ebx, 0x4913
xor ebx, 0xd42e
sub ebx, 0x7bc9
pop ebx
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x440], edx
push ecx
xor ecx, 0x5aa3
and ecx, 0x14f4e
pop ecx
push ecx
and ecx, 0x7015
jmp 0x555a2f
xor ecx, 0x15829
jmp 0x555a3a
pop ecx
push eax
or eax, 0xcf99
pop eax
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
jne 0x555a96
push esi
push esi
add esp, 4
xor esi, 0x8869
sub esi, 0xe3a3
and esi, 0xf3a4
pop esi
push ebx
push edx
add esp, 4
jmp 0x555a7c
and ebx, 0xe7f4
jmp 0x555a89
pop ebx
mov dword [ebp - 0x74], 0
jmp fcn.00555e22
push esi
call 0x555aa3
add byte [esi], bh
dec ebx
aas
dec edx
aaa
inc ebx
add esp, 4
xor esi, 0x1129b
pop esi
push ebx
jmp 0x555ab3
and ebx, 0x42e8
pop ebx
push ebx
xor ebx, 0xf4ad
and ebx, 0x5b4
pop ebx
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jne 0x555b21
push ebx
xor ebx, 0xe3dc
add ebx, 0x1558d
pop ebx
push edx
push ebx
add esp, 4
or edx, 0x47c0
pop edx
push edx
push esi
add esp, 4
add edx, 0x106ba
add edx, 0x11705
xor edx, 0x16100
pop edx
mov dword [ebp - 0x74], 0
jmp fcn.00555e22
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0xb0], ecx
push ebx
or ebx, 0x17ee7
add ebx, 0x13d2f
sub ebx, 0x5ac2
pop ebx
push ebx
call 0x555b4f
add byte [esi + 0x48], cl
cmp eax, 0x3241453c
add esp, 4
jmp 0x555b58
or ebx, 0xfa88
pop ebx
lea edx, [ebp - 0x2b0]
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x25c], ecx
push eax
push edx
add esp, 4
or eax, 0x1bfc
add eax, 0x5285
add eax, 0x126e
call 0x555ba0
add byte [ecx + 0x46], cl
xor al, 0x48
cmp al, 0x3a
cmp dh, byte [0xc4834e4d]
add al, 0x58
push esi
jmp 0x555bab
pop esi
xor edx, edx
mov word [ebp - 0x48], dx
xor eax, eax
mov word [ebp - 0x20], ax
push ebx
jmp 0x555bbe
sub ebx, 0x133ad
xor ebx, 0x3c4b
pop ebx
push esi
push esi
add esp, 4
Function at 0x555b4f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
xor esi, 0x28cd
and esi, 0x8eae
add esi, 0xc8b8
pop esi
push edi
push ebx
add esp, 4
sub edi, 0x78ac
or edi, 0xc817
add edi, 0x9bf1
xor edi, 0xa27f
pop edi
push ecx
push edi
add esp, 4
xor ecx, 0xb762
call 0x5559a9
add byte [esi + 0x4e], cl
dec esi
cmp bh, byte [0xc4833a3a]
add al, 0x81
loope 0x5559a4
add byte [eax], 0
pop ecx
push edi
call 0x5559c0
add byte [0x483e3a42], bh
dec esi
add esp, 4
pop edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x43c], eax
push esi
or esi, 0x175be
or esi, 0x124a6
pop esi
push ecx
push eax
add esp, 4
and ecx, 0x15bad
pop ecx
push ebx
push esi
add esp, 4
and ebx, 0x4913
xor ebx, 0xd42e
sub ebx, 0x7bc9
pop ebx
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x440], edx
push ecx
xor ecx, 0x5aa3
and ecx, 0x14f4e
pop ecx
push ecx
and ecx, 0x7015
jmp 0x555a2f
xor ecx, 0x15829
jmp 0x555a3a
pop ecx
push eax
or eax, 0xcf99
pop eax
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
jne 0x555a96
push esi
push esi
add esp, 4
xor esi, 0x8869
sub esi, 0xe3a3
and esi, 0xf3a4
pop esi
push ebx
push edx
add esp, 4
jmp 0x555a7c
and ebx, 0xe7f4
jmp 0x555a89
pop ebx
mov dword [ebp - 0x74], 0
jmp fcn.00555e22
push esi
call 0x555aa3
add byte [esi], bh
dec ebx
aas
dec edx
aaa
inc ebx
add esp, 4
xor esi, 0x1129b
pop esi
push ebx
jmp 0x555ab3
and ebx, 0x42e8
pop ebx
push ebx
xor ebx, 0xf4ad
and ebx, 0x5b4
pop ebx
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jne 0x555b21
push ebx
xor ebx, 0xe3dc
add ebx, 0x1558d
pop ebx
push edx
push ebx
add esp, 4
or edx, 0x47c0
pop edx
push edx
push esi
add esp, 4
add edx, 0x106ba
add edx, 0x11705
xor edx, 0x16100
pop edx
mov dword [ebp - 0x74], 0
jmp fcn.00555e22
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0xb0], ecx
push ebx
or ebx, 0x17ee7
add ebx, 0x13d2f
sub ebx, 0x5ac2
pop ebx
push ebx
call 0x555b4f
add byte [esi + 0x48], cl
cmp eax, 0x3241453c
add esp, 4
jmp 0x555b58
or ebx, 0xfa88
pop ebx
lea edx, [ebp - 0x2b0]
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x25c], ecx
push eax
push edx
add esp, 4
or eax, 0x1bfc
add eax, 0x5285
add eax, 0x126e
call 0x555ba0
add byte [ecx + 0x46], cl
xor al, 0x48
cmp al, 0x3a
cmp dh, byte [0xc4834e4d]
add al, 0x58
push esi
jmp 0x555bab
pop esi
xor edx, edx
mov word [ebp - 0x48], dx
xor eax, eax
mov word [ebp - 0x20], ax
push ebx
jmp 0x555bbe
sub ebx, 0x133ad
xor ebx, 0x3c4b
pop ebx
push esi
push esi
add esp, 4

Function at 0x555bd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x555bde
add byte [eax], bh
cmp dword [edx + esi], edi
inc edi
dec edi
inc ebx
add esp, 4
pop esi
push ebx
or ebx, 0x1043f
pop ebx
mov ecx, dword [ebp - 0x25c]
mov dx, word [ecx]
mov word [ebp - 0x1d6], dx
mov dword [ebp - 0x1d6], edx
mov eax, dword [ebp - 0x25c]
add eax, 2
mov dword [ebp - 0x25c], eax
mov cx, word [ebp - 0x1d6]
mov word [ebp - 0x48], cx
push ecx
or ecx, 0xdaf7
jmp 0x555c24
add ecx, 0x12c32
pop ecx
push ecx
jmp fcn.00555c34
Function at 0x555bde
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x555bde
add byte [eax], bh
cmp dword [edx + esi], edi
inc edi
dec edi
inc ebx
add esp, 4
pop esi
push ebx
or ebx, 0x1043f
pop ebx
mov ecx, dword [ebp - 0x25c]
mov dx, word [ecx]
mov word [ebp - 0x1d6], dx
mov dword [ebp - 0x1d6], edx
mov eax, dword [ebp - 0x25c]
add eax, 2
mov dword [ebp - 0x25c], eax
mov cx, word [ebp - 0x1d6]
mov word [ebp - 0x48], cx
push ecx
or ecx, 0xdaf7
jmp 0x555c24
add ecx, 0x12c32
pop ecx
push ecx
jmp fcn.00555c34

Function at 0x555c34
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x555c42
add byte [ecx + edi + 0x32], al
inc ebx
xor bh, byte [ebx]
dec ecx
dec ebx
add esp, 4
pop ecx
mov edx, dword [ebp - 0x260]
mov ax, word [edx]
mov word [ebp - 0x1e0], ax
mov ecx, dword [ebp - 0x260]
add ecx, 2
invalid
invalid
invalid
std
invalid

Function at 0x555c42
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x555c42
add byte [ecx + edi + 0x32], al
inc ebx
xor bh, byte [ebx]
dec ecx
dec ebx
add esp, 4
pop ecx
mov edx, dword [ebp - 0x260]
mov ax, word [edx]
mov word [ebp - 0x1e0], ax
mov ecx, dword [ebp - 0x260]
add ecx, 2
invalid
invalid
invalid
std
invalid

Function at 0x555c93
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x555c93
add byte [edx], dh
push eax
inc eax
xor bh, byte [ebx]
add esp, 4
jmp 0x555c9b
xor ebx, 0x180b1
pop ebx
movzx eax, word [ebp - 0x20]
test eax, eax
jne 0x555cbf
movzx ecx, word [ebp - 0x48]
movzx edx, word [ebp - 0x20]
sub ecx, edx
mov dword [ebp - 0x334], ecx
jmp 0x555d42
movzx eax, word [ebp - 0x48]
movzx ecx, word [ebp - 0x20]
cmp eax, ecx
je 0x555bb8
movzx edx, word [ebp - 0x48]
xor edx, 0x20
movzx eax, word [ebp - 0x20]
cmp edx, eax
je 0x555bb8
push ecx
invalid

Function at 0x555cac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x555c93
add byte [edx], dh
push eax
inc eax
xor bh, byte [ebx]
add esp, 4
jmp 0x555c9b
xor ebx, 0x180b1
pop ebx
movzx eax, word [ebp - 0x20]
test eax, eax
jne 0x555cbf
movzx ecx, word [ebp - 0x48]
movzx edx, word [ebp - 0x20]
sub ecx, edx
mov dword [ebp - 0x334], ecx
jmp 0x555d42
movzx eax, word [ebp - 0x48]
movzx ecx, word [ebp - 0x20]
cmp eax, ecx
je 0x555bb8
movzx edx, word [ebp - 0x48]
xor edx, 0x20
movzx eax, word [ebp - 0x20]
cmp edx, eax
je 0x555bb8
push ecx
invalid

Function at 0x555d10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
movzx ecx, word [ebp - 0x48]
movzx edx, word [ebp - 0x20]
cmp ecx, edx
jge 0x555d2c
mov dword [ebp - 0x330], 0xffffffff
jmp 0x555d36
mov dword [ebp - 0x330], 1
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x334], eax
Function at 0x555e2c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0xd89e
pop eax
push eax
push eax
add esp, 4
call 0x555e47
add byte [eax + 0x4c], dl
xor eax, 0x3f44323b
dec eax
add esp, 4
pop eax
push esi
call 0x555e5a
add byte [ecx + 0x4b], cl
inc esp
xor eax, 0x343a3d38
add esp, 4
pop esi
mov eax, 0x6b
mov word [ebp - 0x3a0], ax
mov ecx, 0x65
mov word [ebp - 0x39e], cx
mov edx, 0x72
mov word [ebp - 0x39c], dx
mov eax, 0x6e
mov word [ebp - 0x39a], ax
mov ecx, 0x65
mov word [ebp - 0x398], cx
mov edx, 0x6c
mov word [ebp - 0x396], dx
mov eax, 0x33
mov word [ebp - 0x394], ax
mov ecx, 0x32
mov word [ebp - 0x392], cx
mov edx, 0x2e
mov word [ebp - 0x390], dx
mov eax, 0x64
mov word [ebp - 0x38e], ax
mov ecx, 0x6c
mov word [ebp - 0x38c], cx
mov edx, 0x6c
mov word [ebp - 0x38a], dx
xor eax, eax
mov word [ebp - 0x388], ax
push ecx
sub ecx, 0xdc88
pop ecx
push ecx
push eax
add esp, 4
and ecx, 0x185cf
or ecx, 0xc1da
fcmovb st(0), st(1)
add byte [eax], al
pop ecx
push ecx
push edi
add esp, 4
and ecx, 0x153e0
add ecx, 0x6ba7
add ecx, 0x2142
pop ecx
mov byte [ebp - 0x174], 0x4c
mov byte [ebp - 0x173], 0x6f
mov byte [ebp - 0x172], 0x61
mov byte [ebp - 0x171], 0x64
mov byte [ebp - 0x170], 0x4c
invalid
invalid
xchg ecx, eax
invalid

Function at 0x555e47
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0xd89e
pop eax
push eax
push eax
add esp, 4
call 0x555e47
add byte [eax + 0x4c], dl
xor eax, 0x3f44323b
dec eax
add esp, 4
pop eax
push esi
call 0x555e5a
add byte [ecx + 0x4b], cl
inc esp
xor eax, 0x343a3d38
add esp, 4
pop esi
mov eax, 0x6b
mov word [ebp - 0x3a0], ax
mov ecx, 0x65
mov word [ebp - 0x39e], cx
mov edx, 0x72
mov word [ebp - 0x39c], dx
mov eax, 0x6e
mov word [ebp - 0x39a], ax
mov ecx, 0x65
mov word [ebp - 0x398], cx
mov edx, 0x6c
mov word [ebp - 0x396], dx
mov eax, 0x33
mov word [ebp - 0x394], ax
mov ecx, 0x32
mov word [ebp - 0x392], cx
mov edx, 0x2e
mov word [ebp - 0x390], dx
mov eax, 0x64
mov word [ebp - 0x38e], ax
mov ecx, 0x6c
mov word [ebp - 0x38c], cx
mov edx, 0x6c
mov word [ebp - 0x38a], dx
xor eax, eax
mov word [ebp - 0x388], ax
push ecx
sub ecx, 0xdc88
pop ecx
push ecx
push eax
add esp, 4
and ecx, 0x185cf
or ecx, 0xc1da
fcmovb st(0), st(1)
add byte [eax], al
pop ecx
push ecx
push edi
add esp, 4
and ecx, 0x153e0
add ecx, 0x6ba7
add ecx, 0x2142
pop ecx
mov byte [ebp - 0x174], 0x4c
mov byte [ebp - 0x173], 0x6f
mov byte [ebp - 0x172], 0x61
mov byte [ebp - 0x171], 0x64
mov byte [ebp - 0x170], 0x4c
invalid
invalid
xchg ecx, eax
invalid
Function at 0x555e5a
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0xd89e
pop eax
push eax
push eax
add esp, 4
call 0x555e47
add byte [eax + 0x4c], dl
xor eax, 0x3f44323b
dec eax
add esp, 4
pop eax
push esi
call 0x555e5a
add byte [ecx + 0x4b], cl
inc esp
xor eax, 0x343a3d38
add esp, 4
pop esi
mov eax, 0x6b
mov word [ebp - 0x3a0], ax
mov ecx, 0x65
mov word [ebp - 0x39e], cx
mov edx, 0x72
mov word [ebp - 0x39c], dx
mov eax, 0x6e
mov word [ebp - 0x39a], ax
mov ecx, 0x65
mov word [ebp - 0x398], cx
mov edx, 0x6c
mov word [ebp - 0x396], dx
mov eax, 0x33
mov word [ebp - 0x394], ax
mov ecx, 0x32
mov word [ebp - 0x392], cx
mov edx, 0x2e
mov word [ebp - 0x390], dx
mov eax, 0x64
mov word [ebp - 0x38e], ax
mov ecx, 0x6c
mov word [ebp - 0x38c], cx
mov edx, 0x6c
mov word [ebp - 0x38a], dx
xor eax, eax
mov word [ebp - 0x388], ax
push ecx
sub ecx, 0xdc88
pop ecx
push ecx
push eax
add esp, 4
and ecx, 0x185cf
or ecx, 0xc1da
fcmovb st(0), st(1)
add byte [eax], al
pop ecx
push ecx
push edi
add esp, 4
and ecx, 0x153e0
add ecx, 0x6ba7
add ecx, 0x2142
pop ecx
mov byte [ebp - 0x174], 0x4c
mov byte [ebp - 0x173], 0x6f
mov byte [ebp - 0x172], 0x61
mov byte [ebp - 0x171], 0x64
mov byte [ebp - 0x170], 0x4c
invalid
invalid
xchg ecx, eax
invalid
Function at 0x5683b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x56841e
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
lea eax, [ebp - 0xf]
push eax
push 0x1004
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xf]
mov ecx, 7
call fcn.00405378
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.0040a480
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x568425
lea eax, [ebp - 0x14]
call fcn.00405108
ret

Function at 0x57d324
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x57d395
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x615ee8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x57d37f
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0057d314
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x57baf8]
call fcn.0057e1e4
mov dword [0x615f50], eax
mov eax, dword [ebp - 4]
call fcn.0057d1a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57d39c
lea eax, [ebp - 8]
call fcn.00406ff4
ret

Function at 0x57d434
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x57d447
or esi, 2
test dl, dl
je 0x57d450
or esi, 0
jmp 0x57d453
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret
Function at 0x57e070
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004055b8
xor eax, eax
push ebp
push 0x57e1c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x57b8e0]
call fcn.00419168
test eax, eax
jl 0x57e0d7
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0057d418
and eax, 0x7f
mov eax, dword [eax*4 + 0x615ee8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x57e13a
mov eax, dword [ebx]
call fcn.004053c8
test eax, eax
jle 0x57e13a
mov eax, dword [ebx]
call fcn.004053c8
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x57e0fe
mov eax, ebx
mov edx, 0x57e1e0
call fcn.004053d0
mov eax, dword [ebx]
call fcn.004053c8
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
call fcn.004061c8
mov esi, eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x18]
call fcn.0057d314
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x57e185
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x61a8e8]
call fcn.004074d4
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
pop eax
call fcn.0040b8b4
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040515c
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x408df0]
call fcn.0040e7b4
call fcn.00404a84
mov eax, dword [ebp - 8]
call fcn.0057dfe8
mov ebx, eax
test edi, edi
je 0x57e19a
mov eax, edi
call fcn.004042b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57e1cf
lea eax, [ebp - 0x1c]
call fcn.00405108
lea eax, [ebp - 0x18]
call fcn.00406ff4
lea eax, [ebp - 0x14]
call fcn.00405108
lea eax, [ebp - 4]
call fcn.00405108
ret
Function at 0x57f8c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x57fa32
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x61b468]
mov eax, dword [eax]
mov ax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x61b468]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.00488c78
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.0044b724
xor edx, edx
push ebp
push 0x57fa15
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x57f985
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
call fcn.00406ff4
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x344]
call fcn.0057da30
push eax
mov eax, dword [0x61b070]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x57f97b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00404b30
jmp 0x57fa1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57f9c1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.0044b304
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0057f758
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x57f99d
push 0
mov edx, 0x57f6f0
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.0044aebc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57fa1c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x26c]
call fcn.0044b770
mov eax, dword [0x61b468]
mov eax, dword [eax]
mov dx, word [ebp - 0x16]
call fcn.00488c78
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57fa39
lea eax, [ebp - 0x10]
call fcn.00406ff4
ret
Function at 0x5835b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004055b8
xor eax, eax
push ebp
push 0x583737
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x24], 1
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov eax, dword [0x57b8e0]
call fcn.00419168
test eax, eax
jl 0x583624
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.0058341c
and eax, 0x7f
mov eax, dword [eax*4 + 0x615f5c]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov dword [ebp - 0x24], eax
jmp 0x58369f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.004053c8
test eax, eax
jle 0x58369f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.004053c8
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x3a
jne 0x583658
mov eax, dword [ebp - 0xc]
mov edx, 0x583750
call fcn.004053d0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.004053c8
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.004061c8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
lea eax, [ebp - 0x2c]
call fcn.00583404
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x5836f0
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [0x61a8e8]
call fcn.004074d4
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
lea edx, [ebp - 0x38]
xor ecx, ecx
pop eax
call fcn.0040b8b4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040515c
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x408df0]
call fcn.0040e7b4
call fcn.00404a84
mov eax, dword [ebp - 0x18]
call fcn.00583520
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 0
je 0x583709
mov eax, dword [ebp - 4]
call fcn.004042b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58373e
lea eax, [ebp - 0x30]
call fcn.00405108
lea eax, [ebp - 0x2c]
call fcn.00406ff4
lea eax, [ebp - 0x28]
call fcn.00405108
lea eax, [ebp - 8]
call fcn.00405108
ret