joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50245e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
shr edx, 4
push edi
and esi, 0xf
mov edi, ecx
inc edx
push 6
movzx eax, dx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x502493
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x5024d7
movzx eax, ax
or eax, 0x80070000
jmp 0x5024d7
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x50247f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
test ecx, ecx
je 0x50247f
test esi, esi
je 0x5024be
movzx eax, word [ecx]
lea ecx, [ecx + eax*2]
add ecx, 2
sub esi, 1
jne 0x5024b0
movzx eax, word [ecx]
test ax, ax
je 0x5024d2
lea ecx, [eax + 1]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
xor eax, eax
jmp 0x5024d7
mov eax, 0x80070716
pop edi
pop esi
pop ebp
ret 4
Function at 0x50698b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x8d8
mov eax, 0x6d1dbd
call fcn.00432a44
mov edi, ecx
mov esi, dword [ebp + 8]
mov ecx, dword [edi + 0x14]
mov dword [ebp - 0x8d8], esi
call fcn.004dc10a
push dword [edi + 0x14]
lea ecx, [ebp - 0x8b4]
mov ebx, eax
push dword [edi + 0xc]
call fcn.00505dd2
and dword [ebp - 4], 0
mov dword [ebp - 0x8b4], 0x506bf4
mov dword [ebp - 0x818], esi
mov dword [ebp - 4], 1
jmp 0x506b20
cmp byte [0x72251c], 0
je 0x5069f1
push 0x2d
pop ecx
call fcn.005046af
mov eax, dword [ebp - 0x824]
lea edx, [ebp - 0x8c0]
mov ecx, dword [ebx]
mov esi, dword [edi + 0x14]
push edx
lea edx, [ebp - 0x8c4]
push edx
lea edx, [ebp - 0x8c8]
push edx
push 0
push dword [ebp + eax*4 - 0x8a8]
push ebx
call dword [ecx + 0xd8]
mov ecx, dword [edi + 0xc]
push esi
push eax
call fcn.004bead6
cmp byte [0x72251c], 0
je 0x506a8d
rdtsc
mov esi, dword [0x722518]
mov dword [ebp - 0x8b8], edx
mov edx, eax
jmp 0x506a51
cmp dword [esi*4 + 0x722520], 0x2d
je 0x506a55
dec esi
test esi, esi
jg 0x506a46
mov eax, dword [ebp - 0x8b8]
dec esi
mov ecx, edx
mov dword [0x722518], esi
sub ecx, dword [0x7234c0]
mov dword [0x7234c0], edx
sbb eax, dword [0x7234c4]
add dword [0x721dc0], ecx
adc dword [0x721dc4], eax
mov eax, dword [ebp - 0x8b8]
mov dword [0x7234c4], eax
push dword [edi + 0x14]
mov eax, dword [ebp - 0x8c0]
mov esi, dword [ebp - 0x8c8]
and dword [ebp - 0x8b8], 0
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp - 0x8c4]
push ecx
mov dword [ebp - 0x8d0], eax
mov ecx, edi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x8dc]
push eax
lea eax, [ebp - 0x8b8]
push eax
lea eax, [ebp - 0x8d4]
push eax
push esi
call fcn.00507490
test al, al
je 0x506b15
mov ecx, dword [edi + 8]
lea eax, [ebp - 0x814]
push eax
add ecx, 4
call fcn.004a8492
test eax, eax
je 0x506b15
push dword [ebp - 0x8cc]
mov edx, dword [edi]
mov ecx, edi
push dword [ebp - 0x8d0]
push dword [ebp - 0x8b8]
push dword [ebp - 0x8d4]
push eax
push esi
call dword [edx + 8]
lea ecx, [ebp - 0x8b4]
call fcn.00505d58
lea ecx, [ebp - 0x8b4]
call fcn.00505d2d
test al, al
je 0x5069e0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b4]
call fcn.00505e1b
and dword [ebp - 0x8bc], 0
cmp byte [0x72251c], 0
je 0x506b5a
push 0x2c
pop ecx
call fcn.005046af
mov eax, dword [ebx]
lea ecx, [ebp - 0x8e0]
mov esi, dword [edi + 0x14]
push ecx
push 1
lea ecx, [ebp - 0x8e4]
push ecx
push 6
push dword [ebp - 0x8d8]
lea ecx, [ebp - 0x8bc]
push ecx
push ebx
call dword [eax + 0x64]
mov ecx, dword [edi + 0xc]
push esi
push eax
call fcn.004bead6
cmp byte [0x72251c], 0
je 0x506be0
rdtsc
mov esi, dword [0x722518]
mov edi, eax
jmp 0x506bac
cmp dword [esi*4 + 0x722520], 0x2c
je 0x506bb0
dec esi
test esi, esi
jg 0x506ba1
mov ecx, edi
mov eax, edx
sub ecx, dword [0x7234c0]
mov dword [0x7234c0], edi
sbb eax, dword [0x7234c4]
add dword [0x721db0], ecx
mov dword [0x7234c4], edx
adc dword [0x721db4], eax
lea eax, [esi - 1]
mov dword [0x722518], eax
push dword [ebp - 0x8bc]
mov eax, dword [ebx]
push ebx
call dword [eax + 0xc]
call fcn.00402698
ret 4
Function at 0x582e68
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0
push 0
push 3
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x582ef3
call edi
cmp eax, 0x7a
jne 0x582ef3
push dword [ebp - 4]
call fcn.00439c0c
mov esi, eax
pop ecx
test esi, esi
jne 0x582eac
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x8007000e
jmp 0x582f09
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 3
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x582ed4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00582aba
jmp 0x582eea
call edi
mov ecx, eax
test ecx, ecx
jle 0x582ee5
movzx ecx, cx
or ecx, 0x80070000
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
push esi
call fcn.004030a8
pop ecx
jmp 0x582f09
call edi
mov ecx, eax
test ecx, ecx
jle 0x582f04
movzx ecx, cx
or ecx, 0x80070000
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
pop edi
pop esi
leave
ret 0x10

Function at 0x583192
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
and dword [esi], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x5831b4
mov dword [esi], eax
xor eax, eax
jmp 0x5831f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x5831cd
test eax, eax
jle 0x5831f8
movzx eax, ax
or eax, 0x80070000
jmp 0x5831f8
push edi
push 1
push 0x437f98
call fcn.00583a3e
push dword [ebp + 8]
mov edi, 0x80070005
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x5831f5
mov dword [esi], eax
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x58375a
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
push 0x5837e4
push 0x405b40
and dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x583789
mov eax, 0x8000ffff
jmp 0x5837dd
push dword [ebp + 8]
push 0
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x58379d
mov dword [esi], eax
xor eax, eax
jmp 0x5837dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x5837b6
test eax, eax
jle 0x5837dd
movzx eax, ax
or eax, 0x80070000
jmp 0x5837dd
push ebx
push 1
push 0x437f98
call fcn.00583a3e
push dword [ebp + 8]
mov ebx, 0x80070005
push 0
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x5837da
mov dword [esi], eax
xor ebx, ebx
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x584c53
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x584c6c
test al, 0x10
jne 0x584c6c
mov al, 1
jmp 0x584c6e
xor al, al
pop ebp
ret 4

Function at 0x585515
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x204]
push esi
mov esi, dword [ebp + 0xc]
push 0x100
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x585565
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
jmp 0x58556a
mov eax, 0x80004005
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040548e
leave
ret 8
Function at 0x5933b9
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x214]
push ebx
push edi
push ecx
push eax
mov dword [ebp - 0x208], eax
xor ebx, ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x5934c4
push esi
push edi
call fcn.00439c0c
mov esi, eax
pop ecx
test esi, esi
je 0x5934c3
push esi
push edi
push ebx
push dword [ebp - 0x208]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x5934bc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x47e024
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x5934bc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x441d58
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x5934bc
mov ecx, dword [ebp - 0x20c]
mov dword [ebp - 0x208], ebx
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push 0x5934d8
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.0048cb0b
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x5934bc
push 9
push dword [ebp - 0x208]
push 0x593524
call fcn.00433f17
neg eax
sbb al, al
lea ebx, [eax + 1]
push esi
call fcn.004030a8
pop ecx
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.0040548e
leave
ret 4

Function at 0x594830
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x594873
cmp dword [ebp + 0xc], 0
je 0x594873
cmp dword [ebp + 0x10], 0x80070002
jne 0x594873
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x594885
test al, 0x10
jne 0x594885
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x59486c
test al, 0x10
jne 0x594885
mov eax, 0x80040136
jmp 0x59489a
cmp dword [ebp + 0x10], 0x800702e4
je 0x59488a
cmp dword [ebp + 0x10], 0x2e4
je 0x59488a
mov eax, dword [ebp + 0x10]
jmp 0x59489a
call fcn.0061043c
neg eax
sbb eax, eax
neg eax
add eax, 0x80040137
pop ebp
ret 0xc

Function at 0x597b45
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x180]
lea ebx, [edi + 0x188]
push ebx
push eax
mov dword [edi + 0x190], eax
call fcn.005d27b7
mov esi, eax
test esi, esi
jne 0x597bd6
cmp dword [ebp + 0xc], eax
je 0x597b89
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x597ba4
mov esi, 0x80004005
jmp 0x597bd6
push 1
mov ecx, edi
call fcn.005898d4
mov esi, eax
test esi, esi
jns 0x597ba2
push esi
mov ecx, edi
call fcn.00595ec9
jmp 0x597bd6
jne 0x597bd6
cmp dword [edi + 0xe0], 0
jne 0x597bd6
push 0
push 0xffffffffffffffff
push edi
push 0x589b90
push dword [ebx]
lea eax, [edi + 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
neg eax
sbb esi, esi
and esi, 0x7fffbffc
add esi, 0x80004004
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x599e24
Capabilities:
Get file version info

Disassembly:
push 0xc
mov eax, 0x6d8ae0
call fcn.00401167
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 8]
push eax
mov dword [edi], 0xffffffff
mov dword [edi + 4], 0xffffffff
call fcn.0059a15f
test eax, eax
jne 0x599ec4
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x599ec4
push ebx
call fcn.00439c0c
mov esi, eax
pop ecx
test esi, esi
je 0x599ec4
push esi
push ebx
push 0
push dword [ebp - 0x10]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x599ebd
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
push 0x47e024
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x599ebd
mov ecx, dword [ebp + 8]
mov ax, word [ecx + 0xa]
mov word [edi], ax
mov ax, word [ecx + 8]
mov word [edi + 2], ax
mov ax, word [ecx + 0xe]
mov word [edi + 4], ax
mov ax, word [ecx + 0xc]
mov word [edi + 6], ax
push esi
call fcn.004030a8
pop ecx
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call fcn.004026a3
ret 4
Function at 0x599ed9
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x80004005
je 0x59a06c
test edi, edi
je 0x59a06c
and dword [edi], 0
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x238], eax
test eax, eax
je 0x59a04d
push eax
call fcn.00439c0c
mov ebx, eax
pop ecx
test ebx, ebx
je 0x59a046
push ebx
push dword [ebp - 0x238]
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x59a03d
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x244]
push eax
push 0x47e024
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x59a03d
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x23c]
push eax
push 0x441d58
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x599fef
mov ecx, dword [ebp - 0x23c]
and dword [ebp - 0x238], 0
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push 0x59a088
lea eax, [ebp - 0x234]
push 0x100
push eax
call fcn.0048cb0b
add esp, 0x14
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x234]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x599fef
push dword [ebp - 0x238]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
xor esi, esi
cmp dword [edi], 0
jne 0x59a03d
mov ecx, dword [ebp - 0x244]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0x34]
push 0x59a0d4
push eax
call fcn.00598cce
add esp, 0x18
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [edi], esi
neg esi
sbb esi, esi
and esi, 0x7ff8fff2
add esi, 0x8007000e
push ebx
call fcn.004030a8
pop ecx
jmp 0x59a071
mov esi, 0x8007000e
jmp 0x59a071
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x59a065
cmp eax, 0x715
je 0x59a065
cmp eax, 0x714
jne 0x59a071
and dword [edi], 0
xor esi, esi
jmp 0x59a071
mov esi, 0x80070057
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040548e
leave
ret 8
Function at 0x59abb7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x144], ecx
mov ecx, dword [ebp + 0x10]
mov edi, 0x80004005
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push eax
mov dword [ebp - 0x148], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x59ac93
cmp esi, 0xffffffff
je 0x59ac93
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x140]
push eax
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call ebx
test eax, eax
je 0x59ac8c
cmp dword [ebp - 0x140], 0x40
jne 0x59ac8c
push 0
push 0
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x59ac8c
push 0
lea eax, [ebp - 0x140]
push eax
push 0xf8
lea eax, [ebp - 0x13c]
push eax
push esi
call ebx
test eax, eax
je 0x59ac8c
cmp dword [ebp - 0x140], 0xf8
jne 0x59ac8c
mov ecx, dword [ebp - 0x144]
xor edi, edi
mov eax, dword [ebp - 0x134]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x148]
mov eax, dword [ebp - 0xec]
mov dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040548e
leave
ret 0xc

Function at 0x59bc85
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, ecx
mov dword [ebp - 4], eax
test edi, edi
je 0x59bd4b
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x59bd4b
mov ebx, dword [ebp + 0x18]
test ebx, ebx
je 0x59bd4b
mov ecx, dword [eax + 0x80]
test ecx, ecx
je 0x59bd44
mov eax, dword [ecx]
lea esi, [ebp + 0x10]
push esi
push edx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
call dword [eax + 0x54]
mov esi, eax
cmp esi, 0x8007012b
jne 0x59bd3d
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp + 0x10]
mov dword [ebx], eax
cmp eax, edi
jbe 0x59bd37
jmp 0x59bd50
mov eax, dword [ebp - 0x24]
mov dword [ebp + 0x18], eax
cmp eax, edi
jb 0x59bd00
mov dword [ebp + 0x18], edi
mov eax, dword [ebp - 4]
mov ecx, dword [ebx]
mov esi, dword [eax + 0x80]
lea eax, [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
add eax, ecx
mov edx, dword [esi]
push eax
push dword [ebp + 0x18]
xor eax, eax
add ecx, dword [ebp + 8]
adc eax, dword [ebp + 0xc]
push eax
push ecx
push esi
call dword [edx + 0x54]
mov esi, eax
test esi, esi
jne 0x59bd50
mov eax, dword [ebp + 0x10]
cmp eax, edi
ja 0x59bd50
add dword [ebx], eax
sub edi, eax
je 0x59bd50
jmp 0x59bcf3
mov eax, dword [ebp + 0x10]
mov dword [ebx], eax
jmp 0x59bd50
mov esi, 0x80004005
jmp 0x59bd50
mov esi, 0x80070057
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
Function at 0x59c4b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x20
mov eax, 0x6d9318
call fcn.00432a44
mov ebx, ecx
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
call fcn.0059ae48
cmp dword [ebp - 0x24], 0
jne 0x59c59c
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x59c4f4
mov eax, dword [eax + 0x34]
cmp dword [eax + 0xf8], 0
jne 0x59c59c
and dword [ebp - 0x2c], 0
and dword [ebp - 4], 0
mov esi, 0x433200
mov ecx, dword [ebx + 0x34]
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
test ecx, ecx
je 0x59c58d
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x2c]
push edx
push ecx
call dword [eax + 0x40]
test eax, eax
jne 0x59c58d
lea ecx, [ebp - 0x20]
mov esi, 0x59c5a4
xor edx, edx
mov eax, dword [ecx + edx*4]
cmp eax, dword [esi + edx*4]
jne 0x59c58d
inc edx
cmp edx, 4
jne 0x59c531
and dword [ebp - 0x28], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
mov ecx, ebx
call fcn.0059a15f
mov esi, dword [ebp - 0x28]
test eax, eax
jne 0x59c586
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x59c586
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x59c574
test al, 0x10
je 0x59c586
mov byte [ebp - 4], 0
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call edi
xor ebx, ebx
inc ebx
jmp 0x59c58f
mov byte [ebp - 4], 0
push esi
call edi
xor bl, bl
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x2c]
call edi
mov al, bl
jmp 0x59c59e
mov al, 1
call fcn.00402698
ret
Function at 0x5d27be
Capabilities:
Link many functions at runtime

Disassembly:
push 0x18
mov eax, 0x6e3b98
call fcn.00401167
mov ebx, ecx
cmp byte [ebx + 4], 0
mov edi, 0x80004004
jne 0x5d2976
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x24]
push 0x20019
push 0x441a80
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00437bb7
test eax, eax
jne 0x5d2959
and dword [ebp - 0x10], eax
lea ecx, [ebp - 0x24]
lea eax, [ebp - 0x10]
push eax
push 0
push 0x5d2980
call fcn.005d2a26
test eax, eax
jne 0x5d2947
mov eax, dword [ebp - 0x10]
cmp eax, 1
jbe 0x5d2947
xor esi, esi
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 1
dec eax
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov edi, eax
test edi, edi
je 0x5d2935
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x10]
mov esi, edi
push eax
push edi
push 0x5d2980
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], esi
call fcn.005d2a26
test eax, eax
jne 0x5d291c
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 8], eax
test eax, eax
je 0x5d2907
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5d29a0
push eax
call edi
push 0x5d29bc
push dword [ebx + 8]
mov dword [ebx + 0x10], eax
call edi
push 0x5d29cc
push dword [ebx + 8]
mov dword [ebx + 0x14], eax
call edi
push 0x5d29e0
push dword [ebx + 8]
mov dword [ebx + 0x18], eax
call edi
push 0x441cec
push dword [ebx + 8]
mov dword [ebx + 0x1c], eax
call edi
push 0x5d2a00
push dword [ebx + 8]
mov dword [ebx + 0x20], eax
call edi
cmp dword [ebx + 0x10], 0
mov dword [ebx + 0x24], eax
je 0x5d28fe
cmp dword [ebx + 0x14], 0
je 0x5d28fe
cmp dword [ebx + 0x18], 0
je 0x5d28fe
cmp dword [ebx + 0x1c], 0
je 0x5d28fe
cmp dword [ebx + 0x20], 0
je 0x5d28fe
mov byte [ebx + 4], 1
xor edi, edi
jmp 0x5d293a
push 1
push 0
push 2
push esi
jmp 0x5d290e
push 1
push 0
push 2
push edi
push 0x466
mov ecx, ebx
call fcn.005d2b54
jmp 0x5d292e
push 1
push 0
push 2
push 0x465
mov ecx, ebx
call fcn.005d2a95
mov edi, 0x80004004
jmp 0x5d293a
mov edi, 0x8007000e
mov byte [ebp - 4], 0
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x5d2959
push 1
push 0
push 2
push 0x465
mov ecx, ebx
call fcn.005d2a95
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0
je 0x5d2970
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x24], 0
and dword [ebp - 0x20], 0
jmp 0x5d2978
xor edi, edi
mov eax, edi
call fcn.004026a3
ret
Function at 0x5dd19f
Capabilities:
Get common file path

Disassembly:
push 0x21c
mov eax, 0x6e5e4e
call fcn.00432a44
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x228], ecx
and dword [ecx], 0
mov ecx, eax
mov dword [ebp - 0x224], eax
call fcn.00437b82
lea ecx, [ebp - 0x220]
call fcn.004366f5
and dword [ebp - 4], 0
mov edi, 0x105
push edi
lea ecx, [ebp - 0x220]
call fcn.004395c1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
test esi, esi
je 0x5dd345
cmp esi, edi
jae 0x5dd345
push esi
lea ecx, [ebp - 0x220]
call fcn.00439c41
lea eax, [esi - 1]
push eax
lea ecx, [ebp - 0x220]
call fcn.00492ba9
push 0x5c
pop ecx
cmp ax, cx
je 0x5dd237
push ecx
lea ecx, [ebp - 0x220]
call fcn.00497099
inc esi
push 0x20a
lea eax, [ebp - 0x21c]
mov ecx, ebx
push eax
mov eax, dword [ebx]
call dword [eax + 0x80]
push eax
call fcn.0060eb19
test eax, eax
je 0x5dd320
push edi
lea ecx, [ebp - 0x220]
call fcn.004395c1
push 0
push 0
sub edi, esi
push edi
lea eax, [eax + esi*2]
xor esi, esi
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.00574aa2
add esp, 0x24
lea ecx, [ebp - 0x220]
test eax, eax
je 0x5dd29c
push esi
call fcn.00439c41
jmp 0x5dd320
push 0xffffffffffffffff
call fcn.00439c15
mov eax, dword [ebp - 0x220]
mov edi, esi
mov ebx, dword [eax - 0xc]
inc edi
lea eax, [ebp - 0x220]
push edi
push 0x5dd37c
push eax
call fcn.0049abf7
add esp, 0xc
push esi
push 0x80
push 1
push esi
push 4
push 0x40000000
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5dd327
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435aec
mov esi, eax
cmp esi, 0x80070050
jne 0x5dd360
push ebx
lea ecx, [ebp - 0x220]
call fcn.004395c1
push ebx
lea ecx, [ebp - 0x220]
call fcn.00439c41
push 0
pop esi
cmp edi, 0x100
jb 0x5dd2ae
mov esi, 0x80004005
jmp 0x5dd360
mov ecx, dword [ebp - 0x224]
lea eax, [ebp - 0x220]
push eax
call fcn.004954ae
mov eax, dword [ebp - 0x228]
mov dword [eax], esi
xor esi, esi
jmp 0x5dd360
push 0
lea ecx, [ebp - 0x220]
call fcn.00439c41
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435aec
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0040119b
mov eax, esi
call fcn.00402698
ret 0xc