joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1014d4c8], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov dword [0x1014d4cc], 0
mov dword [0x1014d4d8], 0
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov dword [ebp - 0x20], eax
jne 0x10016487
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x1014d4c4], 0x341
mov edx, eax
add edx, 1
mov esi, dword [0x1014d4c8]
add esi, 1
mov dword [ebp - 0x24], eax
mov eax, esi
mov dword [ebp - 0x28], edx
cdq
idiv ecx
mov dword [0x1014d4c8], edx
mov dword [0x1014d4c0], 0x2e9
mov esi, dword [0x1014d4cc]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x1014d4cc], edx
mov ecx, dword [0x1014d4c8]
mov bl, byte [edi + ecx]
mov byte [0x1014d4d0], bl
mov dword [0x1014d4c4], 0x15f7
mov bl, byte [edi + edx]
mov ecx, dword [0x1014d4c8]
mov byte [edi + ecx], bl
mov dword [0x1014d4c0], 0xeac
mov bl, byte [0x1014d4d0]
mov ecx, dword [0x1014d4cc]
mov byte [edi + ecx], bl
mov ecx, dword [0x1014d4c8]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x1014d4cc]
movzx edx, byte [edi + edx]
add edx, ecx
mov dword [0x1014d4c0], 0x2123
and edx, 0xff
mov dword [0x1014d4d8], edx
mov ecx, dword [0x1014d4c4]
add ecx, 0xffffdc8e
mov dword [0x1014d4c4], ecx
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x24]
mov bl, byte [ecx + esi]
xor bl, byte [edi + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], bl
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x10]
cmp ecx, edx
mov dword [ebp - 0x20], ecx
je 0x1001647f
jmp 0x10016487
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x40cdc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40cde2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40cde9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40cdd8
mov eax, 1
add ebx, ebx
jne 0x40cdfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40cdf0
jne 0x40ce0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40cdf0
xor ecx, ecx
sub eax, 3
jb 0x40ce20
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40ce92
mov ebp, eax
add ebx, ebx
jne 0x40ce2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40ce38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40ce5c
inc ecx
add ebx, ebx
jne 0x40ce48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40ce3d
jne 0x40ce59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40ce3d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40ce7c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40ce6d
jmp 0x40cdde
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40ce7c
add edi, ecx
jmp 0x40cdde
pop esi
mov edi, esi
mov ecx, 0x13
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40ce9a
cmp byte [edi], 2
jne 0x40ce9a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40ce9f
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40cf0e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc060]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc0c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40cecc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc0c8]
or eax, eax
je 0x40cf08
mov dword [ebx], eax
add ebx, 4
jmp 0x40cee9
call dword [esi + 0xc0d0]
mov ebp, dword [esi + 0xc0cc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40cf42
sub esp, 0xffffff80
jmp 0x401816

Function at 0x43b650
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
or ebx, ecx
and ecx, ecx
call fcn.0043b672
dec ebx
xor dword [edx], edi
sub ecx, ebx
inc edx
mov ecx, 0x91bd9fb0
cmp edx, eax
jne fcn.0043b650
or ecx, ebx
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x23910b82
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x410968b4
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4251e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e15f
and dword [ebp - 4], 0
cmp dword [0x44f6a8], 0
mov ebx, eax
jne 0x425296
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x425347
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x425347
push eax
call fcn.0041e0ed
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44f6a8], eax
call esi
push eax
call fcn.0041e0ed
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44f6ac], eax
call esi
push eax
call fcn.0041e0ed
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44f6b0], eax
call esi
push eax
call fcn.0041e0ed
pop ecx
mov dword [0x44f6b8], eax
test eax, eax
je 0x425296
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e0ed
pop ecx
mov dword [0x44f6b4], eax
mov eax, dword [0x44f6b4]
cmp eax, ebx
je 0x4252ee
cmp dword [0x44f6b8], ebx
je 0x4252ee
push eax
call fcn.0041e168
push dword [0x44f6b8]
mov esi, eax
call fcn.0041e168
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4252ee
test edi, edi
je 0x4252ee
call esi
test eax, eax
je 0x4252e5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4252e5
test byte [ebp - 0xc], 1
jne 0x4252ee
or dword [ebp + 0x10], 0x200000
jmp 0x425327
mov eax, dword [0x44f6ac]
cmp eax, ebx
je 0x425327
push eax
call fcn.0041e168
pop ecx
test eax, eax
je 0x425327
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x425327
mov eax, dword [0x44f6b0]
cmp eax, ebx
je 0x425327
push eax
call fcn.0041e168
pop ecx
test eax, eax
je 0x425327
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44f6a8]
call fcn.0041e168
pop ecx
test eax, eax
je 0x425347
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x425349
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x59203c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x592083
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x592066
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x592077
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x592083
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x59e28c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
xor eax, eax
mov si, ax
test bl, 4
je 0x59e29e
or si, 1
test bl, 8
je 0x59e2a7
or si, 4
test bl, 1
je 0x59e2b0
or si, 8
test bl, 2
je 0x59e2b9
or si, 0x10
test bl, 0x10
je 0x59e2c2
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x59e2d2
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x59e2d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
xor eax, eax
mov bx, ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x59e2f1
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x59e301
or bx, 4
test esi, 0x20000000
je 0x59e30d
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x5eee44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00425a14
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f2094
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00425a14
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f6f9c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
xor edx, edx
mov dword [ebp - 0x25c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5f7072
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x258]
push eax
lea edx, [ebp - 0x25c]
mov eax, ebx
call fcn.005b9cdc
lea eax, [ebp - 0x25c]
mov edx, 0x5f7090
call fcn.0040ba80
mov eax, dword [ebp - 0x25c]
call fcn.0040b88c
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x5f7057
xor eax, eax
push ebp
push 0x5f7050
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
call fcn.005f6f4c
test al, al
je 0x5f7023
mov byte [ebp - 1], 1
jmp 0x5f7037
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5f700e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f7057
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f7079
lea eax, [ebp - 0x25c]
call fcn.0040a86c
pop eax
jmp eax

Function at 0x5f7094
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
push 0x200
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.0040b88c
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5f70d4
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.0040b928
jmp 0x5f70db
mov eax, ebx
call fcn.0040a86c
add esp, 0x2b4
pop esi
pop ebx
ret

Function at 0x5f70e4
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd4c
mov ebx, edx
mov esi, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6b6a9c]
or eax, 0x4001
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.0040b88c
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5f7123
mov eax, dword [esp + 4]
jmp 0x5f7125
xor eax, eax
add esp, 0x2b4
pop esi
pop ebx
ret

Function at 0x5f7130
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6b6aa4]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x5f7174
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5f7169
mov eax, dword [esp + 4]
jmp 0x5f716b
xor eax, eax
add esp, 0x2b4
pop ebx
ret
Function at 0x5f7153
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd4c
mov ebx, eax
movzx eax, bl
mov eax, dword [eax*4 + 0x6b6aa4]
or eax, 0x4011
push eax
push 0x2b4
lea eax, [esp + 8]
push eax
push 0x10
push 0x5f7174
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5f7169
mov eax, dword [esp + 4]
jmp 0x5f716b
xor eax, eax
add esp, 0x2b4
pop ebx
ret

Function at 0x5f8528
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5f86fa
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5f86cb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
test eax, eax
je 0x5f8585
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jne 0x5f85c3
mov eax, ebx
call fcn.005f73d0
test al, al
jne 0x5f85a3
mov byte [ebp - 5], 0
call fcn.0040a058
jmp 0x5f86d2
lea edx, [ebp - 0x264]
mov eax, ebx
call fcn.005f7094
mov ecx, dword [ebp - 0x264]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.005f8958
mov byte [ebp - 5], 1
lea eax, [ebp - 0x260]
push eax
lea edx, [ebp - 0x268]
mov eax, ebx
call fcn.005b9cdc
lea eax, [ebp - 0x268]
mov edx, 0x5f8718
call fcn.0040ba80
mov eax, dword [ebp - 0x268]
call fcn.0040b88c
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5f86b2
xor eax, eax
push ebp
push 0x5f86ab
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
call fcn.005f6f4c
test al, al
je 0x5f867e
lea eax, [ebp - 4]
lea edx, [ebp - 0x234]
mov ecx, 0x104
call fcn.0040b928
lea edx, [ebp - 0x270]
mov eax, ebx
call fcn.005b9cdc
lea eax, [ebp - 0x270]
mov edx, dword [ebp - 4]
call fcn.0040ba80
mov eax, dword [ebp - 0x270]
lea edx, [ebp - 0x26c]
call fcn.005f7094
mov eax, dword [ebp - 0x26c]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 4]
mov edx, esi
call fcn.005f7f3c
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5f8617
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f86b2
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f86d2
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f8701
lea eax, [ebp - 0x270]
mov edx, 4
call fcn.0040a8cc
lea eax, [ebp - 4]
call fcn.0040a86c
pop eax
jmp eax
Function at 0x5f89f0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5f8bec
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x5f8a75
lea edx, [ebp - 0x264]
mov eax, edi
call fcn.005ba25c
mov eax, dword [ebp - 0x264]
push eax
lea edx, [ebp - 0x268]
mov eax, ebx
call fcn.005b9cdc
mov eax, dword [ebp - 0x268]
pop edx
call fcn.005b9eec
test eax, eax
jne 0x5f8a75
lea edx, [ebp - 4]
mov eax, edi
call fcn.005ba234
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5f8bb8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
push eax
lea edx, [ebp - 0x26c]
mov eax, ebx
call fcn.005b9cdc
lea eax, [ebp - 0x26c]
mov edx, 0x5f8c08
call fcn.0040ba80
mov eax, dword [ebp - 0x26c]
call fcn.0040b88c
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5f8b9f
xor eax, eax
push ebp
push 0x5f8b98
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x260]
call fcn.005f6f4c
test al, al
je 0x5f8b67
lea eax, [ebp - 8]
lea edx, [ebp - 0x234]
mov ecx, 0x104
call fcn.0040b928
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.005b9eec
test eax, eax
je 0x5f8b67
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.005f8038
test eax, eax
jne 0x5f8b67
lea edx, [ebp - 0x274]
mov eax, ebx
call fcn.005b9cdc
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 8]
call fcn.0040ba80
mov eax, dword [ebp - 0x274]
lea edx, [ebp - 0x270]
call fcn.005f7094
mov eax, dword [ebp - 0x270]
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.005f7f3c
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5f8add
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f8b9f
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f8bbf
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
pop eax
jmp eax

Function at 0x5f8ec4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00425a14
add esp, 0x208
pop ebx
ret

Function at 0x5fc9a0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x5fd4a8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040b88c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jle 0x5fd548
mov eax, ebx
call fcn.0040704c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5fd541
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x5fd529
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5fd554
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x5fd529
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 4]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fd548
mov eax, dword [ebp - 0x10]
call fcn.00407068
pop eax
jmp eax
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5fdbc4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005fdb78
test al, al
jne 0x5fdbe5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5fdc35
xor eax, eax
push ebp
push 0x5fdc25
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.0040b88c
push eax
call sub.kernel32.dll_CreateDirectoryW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fdc2c
lea eax, [ebp - 0xc]
call fcn.005fdbb4
pop eax
jmp eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5fdc40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005fdb78
test al, al
jne 0x5fdc64
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5fdccc
xor eax, eax
push ebp
push 0x5fdcbc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x24]
push eax
push edi
push esi
call sub.kernel32.dll_CreateProcessW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fdcc3
lea eax, [ebp - 0xc]
call fcn.005fdbb4
pop eax
jmp eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20