joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57d4a5
Capabilities:
Enumerate process modules

Disassembly:
push 0x24c
mov eax, 0x6b6b5d
call fcn.0066d88e
mov ecx, dword [ebp + 8]
call fcn.00695772
mov esi, 0x400
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x10], 0x1000
call fcn.0057c520
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x40]
call fcn.0056f7af
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x34]
shl eax, 2
push eax
push 0
lea ecx, [ebp - 0x40]
call fcn.005814ee
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x57d50a
mov esi, dword [ebp - 0x10]
shr esi, 2
cmp dword [ebp - 0x34], esi
jb 0x57d4d5
jmp 0x57d55b
push 0x41e6d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.005287fb
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x14c]
lea edi, [ebp - 0x14c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
dec esi
push esi
call fcn.005814ee
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.0057d3f0
test esi, esi
lea ecx, [ebp - 0x40]
ja 0x57d543
or dword [ebp - 4], 0xffffffff
call fcn.0057c58f
call fcn.0066d966
ret 4

Function at 0x57d573
Capabilities:
Enumerate process modules

Disassembly:
push 0x2a0
mov eax, 0x6b6b96
call fcn.0066d8c1
mov ecx, dword [ebp + 0x10]
call fcn.00695772
mov ecx, dword [ebp + 0x14]
call fcn.0055f853
lea ecx, [ebp - 0x6c]
call fcn.0058bbc8
xor ebx, ebx
push 0x40322c
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], ebx
call fcn.0057706c
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 2
push ebx
push 0x410
call fcn.0057ca5d
mov esi, 0x400
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], 0x1000
call fcn.0057c5cb
mov byte [ebp - 4], 4
push esi
lea ecx, [ebp - 0x44]
call fcn.0056f7af
mov esi, dword [ebp - 0x64]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x38]
shl eax, 2
push eax
push ebx
lea ecx, [ebp - 0x44]
call fcn.005814ee
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x57d620
mov esi, dword [ebp - 0x14]
shr esi, 2
cmp dword [ebp - 0x38], esi
jb 0x57d5e5
jmp 0x57d6ad
cmp byte [ebp + 0xc], bl
je 0x57d639
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.0057c63a
mov byte [ebp - 4], bl
jmp 0x57d6d4
push dword [ebp + 8]
push 0x41e728
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x2ac]
push eax
call fcn.005287fb
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
lea edi, [ebp - 0x1a0]
push 0x6c2560
lea eax, [ebp - 0x1a0]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0066dd58
dec esi
push esi
call fcn.005814ee
mov edi, dword [eax]
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], edi
call fcn.0057d419
lea eax, [ebp - 0x94]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
call fcn.0057ccb5
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x94]
push eax
call fcn.0053de7e
cmp esi, ebx
lea ecx, [ebp - 0x44]
ja 0x57d675
jmp 0x57d628
lea ecx, [ebp - 0x94]
call fcn.00576231
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.0058bcd2
call fcn.0066d966
ret 0x10
Function at 0x57d789
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x57d74f
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x57d7f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x57d7f0
push esi
push 0x41e780
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.005287fb
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x114]
lea edi, [ebp - 0x114]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
pop esi
leave
ret 8

Function at 0x57d8db
Capabilities:
Shutdown system

Disassembly:
push esi
push 2
push 2
xor esi, esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x57d8f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret

Function at 0x57da17
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push edi
xor ecx, ecx
xor eax, eax
push ecx
mov dword [ebp - 8], ecx
lea edi, [ebp - 4]
stosd dword es:[edi], eax
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x57da87
mov ecx, dword [ebp + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x41e86c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.005287fb
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x114]
lea edi, [ebp - 0x114]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
leave
ret 4

Function at 0x57da92
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x72acfc]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x57daf9
push 0x41e898
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x330]
push eax
call fcn.005287fb
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x224]
lea edi, [ebp - 0x224]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb al, al
xor ecx, ebp
inc al
call fcn.0066d880
leave
ret
Function at 0x57db10
Capabilities:
Get common file path
Get file version info

Disassembly:
push 0x27c
mov eax, 0x6b6bef
call fcn.0066d88e
xor ebx, ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.005761e7
push 0x104
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], ebx
call fcn.005765be
lea ecx, [ebp - 0x48]
call fcn.0057605c
push eax
lea ecx, [ebp - 0x48]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x57db94
push 0x41e920
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.005287fb
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x17c]
lea edi, [ebp - 0x17c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
mov esi, 0x402e78
push esi
lea ecx, [ebp - 0x70]
call fcn.0057706c
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00576c0d
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], bl
call fcn.00576231
push 0x41e90c
lea ecx, [ebp - 0x70]
call fcn.0057706c
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00576c0d
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], bl
call fcn.00576231
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x48]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
jbe 0x57dc5b
push 1
push 0xde
push 0x41e8e4
push edi
call fcn.0058b7f6
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x57dc5b
push eax
push edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x48]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x57dc53
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x57dc53
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
cmp eax, dword [ebp + 8]
sbb eax, eax
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
call fcn.0058b7ce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00576231
mov eax, dword [ebp - 0x1c]
call fcn.0066d966
ret 4

Function at 0x57e19a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x72acfc]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
mov edi, dword [ebp + 0xc]
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.0066e181
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, 0x80070057
jne 0x57e1f0
xor al, al
jmp 0x57e200
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.00576f94
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0066d880
leave
ret 8
Function at 0x57e9f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x218
push 0x104
call fcn.005765be
mov ecx, dword [ebp + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov ecx, dword [ebp + 8]
push eax
call fcn.0057605c
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x57ea5f
push 0x41ea88
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.005287fb
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
leave
ret 4

Function at 0x57ea63
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x72acfc]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.0066e181
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
xor eax, eax
cmp byte [ebp + 0x10], al
mov ecx, edi
sete al
push eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
mov ecx, esi
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x57eb13
mov ecx, edi
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
mov ecx, esi
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x41eaa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.005287fb
add esp, 0x14
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x318]
lea edi, [ebp - 0x318]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
lea eax, [ebp - 0x20c]
push eax
mov ecx, ebx
call fcn.00576f94
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0066d880
leave
ret 0x10

Function at 0x57eb32
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x72acfc]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push esi
mov esi, dword [ebp + 8]
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.0066e181
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x57ebb6
push 0x41eadc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.005287fb
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x318]
lea edi, [ebp - 0x318]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00576f94
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0066d880
leave
ret 4
Function at 0x580acd
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
sub esp, 0x218
cmp eax, 0xffffffff
jne 0x580b11
push 0x41f4f8
lea eax, [ebp - 0x218]
push 0x3d
push eax
call fcn.00520b6e
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
leave
ret 4

Function at 0x580b1f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
sub esp, 0x218
cmp eax, 0xffffffff
jne 0x580b63
push 0x41f4f8
lea eax, [ebp - 0x218]
push 0x3d
push eax
call fcn.00520b6e
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
leave
ret
Function at 0x58452b
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov ecx, dword [ebp + 8]
mov eax, 0x101
push eax
mov dword [ebp - 4], eax
call fcn.005765be
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x584596
push 0x421d8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.005287fb
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x110]
lea edi, [ebp - 0x110]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
leave
ret 4

Function at 0x58459a
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov ecx, dword [ebp + 8]
mov eax, 0x101
push eax
mov dword [ebp - 4], eax
call fcn.005765be
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x584604
push 0x421dac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.005287fb
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x110]
lea edi, [ebp - 0x110]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
leave
ret 4
Function at 0x584a9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
push 0
push 0
call esi
mov ecx, dword [ebp + 8]
mov edi, eax
push edi
call fcn.005765be
mov ecx, dword [ebp + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push edi
call esi
test eax, eax
jne 0x584b07
push 0x4220f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.005287fb
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
pop edi
pop esi
leave
ret 4

Function at 0x584b0d
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x218
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov ecx, dword [ebp + 8]
push eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x584b7d
mov ecx, dword [ebp + 0xc]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov ecx, dword [ebp + 8]
push eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x422114
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.005287fb
add esp, 0x14
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
leave
ret 8

Function at 0x585881
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
push edi
je 0x5858d1
call fcn.0058586c
test al, al
jne 0x5858d1
push 0x422410
lea eax, [ebp - 0x218]
push 0x53
push eax
call fcn.00520b6e
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
xor edi, edi
push edi
push edi
push dword [ebp + 8]
push dword [esi + 8]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 4], eax
jne 0x585904
push 0x4223f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.005287fb
jmp 0x5858b0
pop edi
mov dword [esi + 0xc], 0x103
pop esi
leave
ret 4

Function at 0x586e5f
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push 0x423628
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, eax
test esi, esi
jne 0x586e88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x586e88
xor bl, bl
jmp 0x586e95
test esi, esi
mov bl, 1
je 0x586e95
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
ret
Function at 0x589ee2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x589efd
xor al, al
jmp 0x589f02
shr al, 4
and al, 1
pop ebp
ret 4

Function at 0x589f06
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x218
push esi
push 0
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov esi, eax
test esi, esi
je 0x589f72
cmp esi, 0x50
je 0x589f72
cmp esi, 0xb7
je 0x589f72
mov ecx, dword [ebp + 8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x424548
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.005287fb
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
pop esi
leave
ret 4

Function at 0x589f77
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x218
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x589fcc
push 0x424578
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.005287fb
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
leave
ret 4
Function at 0x58a272
Capabilities:
Enumerate files on windows

Disassembly:
push 0x4ec
mov eax, 0x6b8a67
call fcn.0066d8f7
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x264], eax
call fcn.00589ee2
test al, al
jne 0x58a2d4
push 0x4245b4
lea eax, [ebp - 0x4f8]
push 0x22
push eax
call fcn.00520b6e
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x3ec]
lea edi, [ebp - 0x3ec]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
mov ecx, esi
call fcn.00536636
lea ecx, [ebp - 0x2b8]
call fcn.005761e7
and dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0x2b8]
call fcn.00576fc1
mov esi, 0x402e78
push esi
lea ecx, [ebp - 0x290]
call fcn.0057706c
push 1
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00577a78
mov bl, al
neg bl
sbb bl, bl
lea ecx, [ebp - 0x290]
inc bl
mov byte [ebp - 4], 0
call fcn.00576231
test bl, bl
je 0x58a35b
push esi
lea ecx, [ebp - 0x290]
call fcn.0057706c
push eax
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 2
call fcn.00576c0d
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0
call fcn.00576231
push dword [ebp - 0x264]
lea ecx, [ebp - 0x2b8]
call fcn.00576c0d
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x2b8]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x264], eax
jne 0x58a3bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x58a4c9
cmp eax, 2
je 0x58a4c9
push 0x4245c8
push eax
lea eax, [ebp - 0x4f8]
push eax
call fcn.005287fb
jmp 0x58a2b3
mov ecx, edi
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
lea ecx, [ebp - 0x2e0]
call fcn.0057706c
push esi
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.0057706c
push 1
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 4
call fcn.00577a78
mov bl, al
neg bl
sbb bl, bl
lea ecx, [ebp - 0x290]
inc bl
mov byte [ebp - 4], 3
call fcn.00576231
test bl, bl
je 0x58a43a
push esi
lea ecx, [ebp - 0x290]
call fcn.0057706c
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 5
call fcn.00576c0d
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.00576231
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x290]
call fcn.0057706c
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 6
call fcn.00576c0d
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 3
call fcn.00576231
lea eax, [ebp - 0x2e0]
push eax
call fcn.0057bcba
test al, al
je 0x58a493
mov ecx, dword [ebp - 0x268]
lea eax, [ebp - 0x2e0]
push eax
call fcn.00524d25
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0
call fcn.00576231
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x58a3bf
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b8]
call fcn.00576231
call fcn.0066d97a
ret 0xc