joyce8/EMBER2024-capa huggingface dataset:
Function at 0x517a23
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x6029bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x20]
mov edx, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x517a8b
and dword [ebp - 0x390], 0
lea ecx, [ebp - 0x390]
push 0
push ecx
push dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x517a7b
push str.write_to_file_failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.00503c26
jmp 0x517a9d
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cd104
mov esp, ebp
pop ebp
ret 8
push str.trying_to_write_to_a_file_thats_not_opened
push 0x15
lea ecx, [ebp - 0x38c]
call fcn.005152b2
push 0x5d6094
lea eax, [ebp - 0x38c]
push eax
call fcn.004cea74
int3

Function at 0x51bdba
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x98
mov eax, 0x564096
call fcn.004cd176
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x94], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
mov ebx, eax
call fcn.0051e61b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x94]
cmp dword [eax + 0x14], 8
jb 0x51be00
mov eax, dword [eax]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x94]
push eax
push str._s.Approximate_duration_:__d_milliseconds.
lea eax, [ebp - 0x28]
push eax
call fcn.0051c014
mov esi, eax
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
jb 0x51be30
mov esi, dword [esi]
lea ecx, [ebp - 0x90]
call fcn.0050748a
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xa4], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
push ecx
push eax
push str.MonitoredScope::ExecuteUnderStopWatch
push 0x32
push 0x3b0
push 0x51054a
mov dword [ebp - 0xa0], str.ContextData
mov dword [ebp - 0x9c], esi
call fcn.0049deb4
lea ecx, [ebp - 0x90]
call fcn.00408767
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040779d
mov eax, dword [ebp - 0x98]
call fcn.004cd128
ret 8

Function at 0x51ebf0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi + 4], 0
je 0x51ec10
lea eax, [edi + 0x10]
push eax
push str.Mutex__s_already_created
push 3
call fcn.0051d350
mov al, 1
jmp 0x51ec71
push esi
lea esi, [edi + 0x10]
cmp dword [esi + 0x14], 8
jb 0x51ec1e
mov eax, dword [esi]
jmp 0x51ec20
mov eax, esi
push eax
movzx eax, byte [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0xc], eax
cmp eax, 0xb7
jne 0x51ec53
push esi
push str.Got_handle_to_existing_mutex__s
push 3
call fcn.0051d39e
cmp dword [edi + 4], 0
jne 0x51ec6e
lea eax, [ebp + 0xc]
push eax
push esi
push str.Failed_to_create_the_mutex__s:_LastError:_0x_x
push 3
call fcn.0051d3ec
xor al, al
jmp 0x51ec70
mov al, 1
pop esi
pop edi
pop ebp
ret 8
Function at 0x520061
Capabilities:
Get user security identifier

Disassembly:
push 0x3d0
mov eax, 0x564891
call fcn.004cd176
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push 8
mov dword [ebp - 0x3d8], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x3dc], ebx
mov dword [ebp - 0x3b8], ebx
mov dword [ebp - 0x3b4], ebx
mov dword [ebp - 0x3c4], ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ebx
cmp dword [edi + 0x14], ecx
jb 0x5200b8
mov eax, dword [edi]
jmp 0x5200ba
mov eax, edi
cmp dword [esi + 0x14], ecx
jb 0x5200c3
mov ecx, dword [esi]
jmp 0x5200c5
mov ecx, esi
lea edx, [ebp - 0x3c4]
push edx
lea edx, [ebp - 0x3b4]
push edx
push ebx
lea edx, [ebp - 0x3b8]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x520119
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x520119
push edi
push esi
push str.::LookupAccountNameW_failed_to_retrieve_size_of_account_security_identifier__systemname_s__accountname_s_.
push eax
push 0xf
lea ecx, [ebp - 0x3b0]
call fcn.0051bcaa
push 0x5d6094
lea eax, [ebp - 0x3b0]
push eax
call fcn.004cea74
mov eax, dword [ebp - 0x3b4]
lea ecx, [ebp - 0x28]
dec eax
push ebx
push eax
call fcn.00409232
mov dword [ebp - 0x3d0], ebx
mov dword [ebp - 0x3cc], ebx
mov dword [ebp - 0x3c8], ebx
push dword [ebp - 0x3b8]
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 1
call fcn.0043ccf1
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x3cc]
cmovae edx, dword [ebp - 0x28]
sub eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x3d0]
push 0
pop ecx
cmove eax, ecx
mov byte [ebp - 4], 2
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x3d4], eax
jb 0x52018e
mov ecx, dword [edi]
jmp 0x520190
mov ecx, edi
cmp dword [esi + 0x14], 8
jb 0x52019a
mov eax, dword [esi]
jmp 0x52019c
mov eax, esi
lea ebx, [ebp - 0x3c4]
push ebx
lea ebx, [ebp - 0x3b4]
push ebx
push edx
lea edx, [ebp - 0x3b8]
push edx
push dword [ebp - 0x3d4]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, dword [ebp - 0x3d0]
test eax, eax
jne 0x5201ea
push edi
push esi
push str.::LookupAccountNameW_failed_to_retrieve_account_security_identifier__systemname_s__accountname_s_.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x3b0]
call fcn.0051bb9a
jmp 0x520108
xor eax, eax
lea ecx, [ebp - 0x3bc]
cmp dword [ebp - 0x3c0], eax
cmove ebx, eax
lea eax, [ebp - 0x3c0]
push eax
mov dword [ebp - 0x3c0], ebx
call fcn.0051e13a
mov esi, dword [ebp - 0x3d8]
lea ecx, [ebp - 0x3bc]
push esi
mov byte [ebp - 4], 3
call fcn.0052cc51
cmp dword [ebp - 0x3bc], 0
je 0x520237
push dword [ebp - 0x3bc]
call fcn.004b46b4
lea ecx, [ebp - 0x3d0]
call fcn.0041193a
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040779d
mov eax, esi
call fcn.004cd128
ret 0xc
Function at 0x520f70
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x6029bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.00409232
cmp dword [esi + 0x14], 8
jb 0x520fa6
mov eax, dword [esi]
jmp 0x520fa8
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x520fdb
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.00409232
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004cd104
mov esp, ebp
pop ebp
ret 4
push str.Failed_to_get_current_username.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.00407fef
push 0x5d6094
lea eax, [ebp - 0x38c]
push eax
call fcn.004cea74
int3
Function at 0x52f669
Capabilities:
Accept command line arguments

Disassembly:
push 0x28
mov eax, 0x56280a
call fcn.004cd176
mov edi, ecx
mov dword [ebp - 0x34], edi
lea esi, [edi + 0x110]
cmp dword [esi + 0x10], 0
sete al
test al, al
jne 0x52f71e
lea ecx, [edi + 0x4c]
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
push 0x18
mov dword [ebp - 0x30], ecx
cdq
pop ecx
idiv ecx
test eax, eax
jne 0x52f71e
push str.Args::ParseArgument:_Parsing_commandline.
push 0x32
push 0xe
push 0x4502e2
call fcn.0048405b
and dword [ebp - 0x2c], 0
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x52f6c6
mov esi, dword [esi]
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor esi, esi
mov ebx, eax
cmp dword [ebp - 0x2c], esi
jle 0x52f710
mov edi, dword [ebp - 0x30]
push dword [ebx + esi*4]
lea ecx, [ebp - 0x28]
call fcn.00406337
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
mov ecx, edi
call fcn.0051b459
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.0040779d
inc esi
cmp esi, dword [ebp - 0x2c]
jl 0x52f6dd
mov edi, dword [ebp - 0x34]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [edi + 0x12c], 0
call fcn.004cd128
ret
Function at 0x5314eb
Capabilities:
Get geographical location

Disassembly:
push 0x60
mov eax, 0x566986
call fcn.004cd176
push 1
push 0x3e8
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
mov dword [ebp - 0x68], ebx
call fcn.00531688
cmp dword [ebp - 0x30], ebx
mov dword [ebp - 4], ebx
sete al
test al, al
je 0x531633
push 1
push 0xbb9
lea eax, [ebp - 0x58]
push eax
call fcn.00531688
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
push 0x59aa04
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00406337
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004624c8
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040779d
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
sub eax, ecx
push 0x18
pop edi
cdq
idiv edi
mov dword [ebp - 0x6c], edi
cmp eax, 3
jb 0x531620
xor esi, esi
inc esi
dec eax
cmp eax, esi
jbe 0x531620
lea eax, [ecx + edi]
push eax
lea ecx, [ebp - 0x28]
call fcn.004062e4
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
call fcn.00466678
cmp dword [0x61dd04], 8
lea ecx, [ebp - 0x28]
push dword [0x61dd00]
mov eax, 0x61dcf0
cmovae eax, dword [0x61dcf0]
push eax
push dword [ebp - 0x18]
push ebx
call fcn.00407b1e
test eax, eax
je 0x5315fc
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040779d
mov eax, dword [ebp - 0x60]
add esi, 2
mov ecx, dword [ebp - 0x64]
add edi, 0x30
sub eax, ecx
cdq
idiv dword [ebp - 0x6c]
dec eax
cmp esi, eax
jb 0x531591
jmp 0x531620
lea eax, [esi + 1]
imul eax, eax, 0x18
lea ecx, [ebp - 0x40]
add eax, dword [ebp - 0x64]
cmp ecx, eax
je 0x531615
push 0xffffffffffffffff
push ebx
push eax
call fcn.0040799b
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.0040779d
lea ecx, [ebp - 0x64]
call fcn.0041235d
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.0040779d
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x68]
push 2
push ecx
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push 0x20000070
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov eax, dword [ebp - 0x68]
sub eax, ebx
je 0x531674
sub eax, 1
je 0x531672
sub eax, 1
je 0x531674
sub eax, 1
je 0x531672
push 0x3413a3
call fcn.00503c15
jmp 0x531674
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.0040779d
mov al, bl
call fcn.004cd128
ret
Function at 0x531f4a
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x566a66
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x6029bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.C2RCustomWindow.0
mov ecx, dword [esi + 0xf0]
xor ebx, ebx
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x531f8e
add ecx, 8
call fcn.00513b59
mov ecx, dword [esi + 0xe8]
xor edi, edi
inc edi
mov dword [ebp - 4], edi
test ecx, ecx
je 0x531fa6
add ecx, 8
call fcn.00513b59
mov ecx, dword [esi + 0xe0]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x531fbf
add ecx, 8
call fcn.00513b59
mov ecx, dword [esi + 0xcc]
test ecx, ecx
je 0x531fce
mov eax, dword [ecx]
push edi
call dword [eax]
mov ecx, dword [esi + 0xc8]
test ecx, ecx
je 0x531fdd
mov eax, dword [ecx]
push edi
call dword [eax]
mov ecx, dword [esi + 0xc4]
test ecx, ecx
je 0x531fec
mov eax, dword [ecx]
push edi
call dword [eax]
mov ecx, dword [esi + 0xc0]
test ecx, ecx
je 0x531ffb
mov eax, dword [ecx]
push edi
call dword [eax]
mov ecx, dword [esi + 0xac]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x532011
call fcn.00513b59
push ebx
push edi
lea ecx, [esi + 0x94]
call fcn.0040779d
mov ecx, dword [esi + 0x84]
mov dword [ebp - 4], 4
test ecx, ecx
je 0x532034
call fcn.00513b59
push ebx
push edi
lea ecx, [esi + 0x6c]
call fcn.0040779d
push ebx
push edi
lea ecx, [esi + 0x48]
call fcn.0040779d
push ebx
push edi
lea ecx, [esi + 0x30]
call fcn.0040779d
lea ecx, [esi + 0x24]
call fcn.0041235d
lea ecx, [esi + 0x18]
call fcn.00534743
lea ecx, [esi + 0xc]
call fcn.0053471c
lea ecx, [esi + 4]
call fcn.00456398
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53235c
Capabilities:
Create thread

Disassembly:
push 0x390
mov eax, 0x566a8e
call fcn.004cd176
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x8c], edi
je 0x532442
push 0x2c
call fcn.00409735
pop ecx
mov dword [ebp - 0x39c], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x53239c
push edi
push 1
mov ecx, eax
call fcn.005126d1
jmp 0x53239e
mov eax, edi
or dword [ebp - 4], 0xffffffff
lea ebx, [esi + 0xf0]
push eax
mov ecx, ebx
call fcn.0051291f
push edi
push edi
push esi
push 0x532e7e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x5323f0
push str.CreateThread_call_failed.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x398]
call fcn.005103d0
push 0x5d6094
lea eax, [ebp - 0x398]
push eax
call fcn.004cea74
push 0x14
call fcn.00409735
mov dword [ebp - 0x39c], eax
pop ecx
test eax, eax
je 0x532425
mov dword [eax], vtable.RefCounted.0
mov dword [eax + 4], 0
mov dword [eax], vtable.OHandle.0
mov dword [eax + 8], edi
mov byte [eax + 0xc], 1
mov dword [eax + 0x10], 0x55
jmp 0x532427
xor eax, eax
push eax
lea ecx, [esi + 0xac]
call fcn.00532084
mov ecx, ebx
call fcn.00530183
push 0xffffffffffffffff
push eax
call fcn.00513ecc
call fcn.004cd128
ret
Function at 0x5363e8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x6029bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.00409232
cmp dword [esi + 0x14], 8
jb 0x53641e
mov eax, dword [esi]
jmp 0x536420
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x536452
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.00409232
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004cd104
mov esp, ebp
pop ebp
ret 4
push str.Failed_to_get_current_computername.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.004945b0
push 0x5d6094
lea eax, [ebp - 0x38c]
push eax
call fcn.004cea74
int3

Function at 0x536e8b
Capabilities:
Copy file

Disassembly:
push 0x39c
mov eax, 0x566d08
call fcn.004cd1e4
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x3a4], edi
mov dword [ebp - 0x3a8], esi
cmp dword [esi + 0x14], 8
jb 0x536eb6
mov eax, dword [esi]
jmp 0x536eb8
mov eax, esi
cmp dword [edi + 0x14], 8
jb 0x536ec2
mov ecx, dword [edi]
jmp 0x536ec4
mov ecx, edi
xor edx, edx
cmp byte [ebp + 0x10], dl
sete dl
push edx
push eax
push ecx
mov dword [ebp - 0x3a0], edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x536f27
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 5
jne 0x536f53
and dword [ebp - 4], 0
push 1
push 0x80
push esi
call fcn.00505802
cmp dword [esi + 0x14], 8
jb 0x536f07
mov ecx, dword [esi]
jmp 0x536f09
mov ecx, esi
cmp dword [edi + 0x14], 8
jb 0x536f13
mov eax, dword [edi]
jmp 0x536f15
mov eax, edi
push dword [ebp - 0x3a0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x536f4f
call fcn.004cd135
ret 0xc
or dword [ebp - 4], 0xffffffff
push esi
push edi
push str.Failed_to_copy_file_src:__s__dest:__s
call ebx
push eax
push 0xf
lea ecx, [ebp - 0x39c]
call fcn.00536a73
push 0x5d6094
lea eax, [ebp - 0x39c]
push eax
call fcn.004cea74
int3
Function at 0x5371e7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5ac
mov eax, dword [0x6029bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x537210
mov edx, dword [esi]
jmp 0x537212
mov edx, esi
cmp dword [edi + 0x14], 8
jb 0x53721c
mov ecx, dword [edi]
jmp 0x53721e
mov ecx, edi
lea eax, [ebp - 0x20c]
push eax
xor eax, eax
cmp byte [ebp + 0x10], al
sete al
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x537276
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00406337
push eax
mov ecx, ebx
call fcn.004190f4
push 0
push 1
lea ecx, [ebp - 0x224]
call fcn.0040779d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cd104
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
push str.Cannot_get_temp_file_name_in_path__s_with_prefix__s
push eax
push 0xf
lea ecx, [ebp - 0x5ac]
call fcn.00536b0c
push 0x5d6094
lea eax, [ebp - 0x5ac]
push eax
call fcn.004cea74
int3

Function at 0x537327
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.005053c4
test al, al
je 0x53738e
cmp dword [edi + 0x14], 8
jb 0x537347
mov eax, dword [edi]
jmp 0x537349
mov eax, edi
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x53735e
xor al, al
jmp 0x53738d
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
push ebx
call fcn.0043ccf1
mov eax, dword [esi + 4]
sub eax, dword [esi]
neg eax
sbb eax, eax
and eax, dword [esi]
cmp dword [edi + 0x14], 8
pop esi
jb 0x53737e
mov edi, dword [edi]
push eax
push ebx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
setne al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x53741e
Capabilities:
Read file on windows

Disassembly:
push 0x738
mov eax, 0x566dfa
call fcn.004cd176
mov edi, ecx
mov esi, dword [ebp + 8]
xor ecx, ecx
cmp dword [edi + 0x20], 0xffffffff
mov dword [ebp - 0x744], ecx
jne 0x537463
push str.trying_to_read_from_a_file_thats_not_open
push 0x15
lea ecx, [ebp - 0x738]
call fcn.004080df
push 0x5d6094
lea eax, [ebp - 0x738]
push eax
call fcn.004cea74
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x28], ax
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x73c]
push ecx
push eax
push 2
lea eax, [ebp - 0x740]
mov dword [ebp - 4], ecx
push eax
push dword [edi + 0x20]
mov dword [ebp - 0x73c], ecx
call ebx
test eax, eax
je 0x5374f3
push 0xa
pop ecx
cmp dword [ebp - 0x73c], 2
jne 0x537500
mov eax, dword [ebp - 0x740]
cmp ax, cx
je 0x537500
cmp ax, 0xd
je 0x537521
mov ecx, 0xfeff
cmp ax, cx
je 0x5374ce
push eax
push 1
lea ecx, [ebp - 0x28]
call fcn.00407895
and dword [ebp - 0x73c], 0
lea eax, [ebp - 0x73c]
push 0
push eax
push 2
lea eax, [ebp - 0x740]
push eax
push dword [edi + 0x20]
call ebx
push 0xa
pop ecx
test eax, eax
jne 0x53749f
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x26
jne 0x537557
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004062bf
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040779d
mov eax, esi
call fcn.004cd128
ret 4
push 0
lea eax, [ebp - 0x73c]
push eax
push 2
lea eax, [ebp - 0x740]
push eax
push dword [edi + 0x20]
call ebx
test eax, eax
je 0x5374f3
push 0xa
pop eax
cmp word [ebp - 0x740], ax
je 0x537500
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
mov ecx, edi
call fcn.00505879
jmp 0x537500
push str.read_from_file_failed
call edi
push eax
push 0xf
lea ecx, [ebp - 0x3b0]
call fcn.005369fa
push 0x5d6094
lea eax, [ebp - 0x3b0]
jmp 0x53745d

Function at 0x537618
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x537629
mov eax, dword [esi]
jmp 0x53762b
mov eax, esi
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x537658
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push esi
push str.Failed_to_schedule_delete_file__s.__Error_Code:_0x_x.
push 2
call fcn.00536e39
xor al, al
jmp 0x53765a
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x537c8c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
mov eax, dword [0x6029bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x394], ecx
mov dword [ebp - 0x390], ecx
cmp dword [esi + 0x14], 8
jb 0x537cbb
mov eax, dword [esi]
jmp 0x537cbd
mov eax, esi
push ecx
push ecx
lea ecx, [ebp - 0x394]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x537cee
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x394]
xor ecx, ebp
mov edx, dword [ebp - 0x390]
pop esi
call fcn.004cd104
mov esp, ebp
pop ebp
ret 4
push esi
push str.Failed_to_check_free_space_in_drive___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.00503e40
push 0x5d6094
lea eax, [ebp - 0x38c]
push eax
call fcn.004cea74
int3

Function at 0x53886f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
mov eax, dword [0x6029bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x20], 0
je 0x5388f9
cmp dword [eax + 0x10], 0
mov bl, byte [ebp + 0xc]
jne 0x5388b4
test bl, bl
je 0x5388b4
lea eax, [esi + 8]
push eax
push str.ORegistryKey.DeleteValue_failure:_Cannot_delete_registry_value_from_Registry_Key__s._The_Registry_value_is_null
push 0x1d
lea ecx, [ebp - 0x38c]
call fcn.00538571
jmp 0x53890b
cmp dword [eax + 0x14], 8
jb 0x5388bc
mov eax, dword [eax]
push eax
push dword [esi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x5388e7
test bl, bl
je 0x5388e7
lea ecx, [esi + 8]
push ecx
push str.ORegistryKey.DeleteValue_failure:_Cannot_delete_registry_value_from_Registry_Key__s.
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.005382ec
jmp 0x53890b
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004cd104
mov esp, ebp
pop ebp
ret 8
push str.ORegistryKey.DeleteValue_failure:_The_registry_key_is_closed_or_not_set
push 0x3a
lea ecx, [ebp - 0x38c]
call fcn.00537f9a
push 0x5d6094
lea eax, [ebp - 0x38c]
push eax
call fcn.004cea74
int3
Function at 0x538b41
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
mov eax, dword [0x6029bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x20], 0
je 0x538bde
cmp dword [esi + 0x10], 0x3fff
jbe 0x538b85
lea eax, [edi + 8]
push eax
push str.ORegistryKey.SetValue_failure:_Cannot_set_binary_into_registry_key__s._The_value_name_is_too_long
push 0x1d
lea ecx, [ebp - 0x38c]
call fcn.0053846b
jmp 0x538bf0
mov ecx, dword [edx]
mov edx, dword [edx + 4]
sub edx, ecx
push 0
pop eax
cmove ecx, eax
cmp dword [esi + 0x14], 8
jb 0x538b9c
mov eax, dword [esi]
jmp 0x538b9e
mov eax, esi
push edx
push ecx
push 3
push 0
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x538bcc
lea ecx, [edi + 8]
push ecx
push esi
push str.ORegistryKey.SetValue_failure:_Cannot_set_binary___s__reg_value__s.
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.00537f01
jmp 0x538bf0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004cd104
mov esp, ebp
pop ebp
ret 8
push str.ORegistryKey.SetValue_failure:_Registry_key_is_not_initialized
push 0x3a
lea ecx, [ebp - 0x38c]
call fcn.00537e8a
push 0x5d6094
lea eax, [ebp - 0x38c]
push eax
call fcn.004cea74
int3