joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ed9a0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005ed844
test al, al
jne 0x5ed9c4
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5eda1c
xor eax, eax
push ebp
push 0x5eda0c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.004097c0
push eax
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_CopyFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eda13
lea eax, [ebp - 0xc]
call fcn.005ed880
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5eda28
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005ed844
test al, al
jne 0x5eda49
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5eda95
xor eax, eax
push ebp
push 0x5eda85
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eda8c
lea eax, [ebp - 0xc]
call fcn.005ed880
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5edc00
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005ed844
test al, al
jne 0x5edc23
mov dword [ebp - 4], 0xffffffff
jmp 0x5edc6f
xor eax, eax
push ebp
push 0x5edc5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5edc66
lea eax, [ebp - 0xc]
call fcn.005ed880
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5edda4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005ed844
test al, al
jne 0x5eddc8
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5ede1c
xor eax, eax
push ebp
push 0x5ede0c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004097c0
push eax
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_MoveFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ede13
lea eax, [ebp - 0xc]
call fcn.005ed880
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ede28
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
test edi, edi
jne 0x5ede4b
test esi, 4
je 0x5ede4b
xor edi, edi
jmp 0x5ede54
mov eax, edi
call fcn.004097c0
mov edi, eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.005ed844
test al, al
jne 0x5ede69
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x5edeb8
xor eax, eax
push ebp
push 0x5edea8
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_MoveFileExW
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5edeaf
lea eax, [ebp - 0x10]
call fcn.005ed880
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5edf34
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005ed844
test al, al
jne 0x5edf55
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5edfa1
xor eax, eax
push ebp
push 0x5edf91
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_RemoveDirectoryW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5edf98
lea eax, [ebp - 0xc]
call fcn.005ed880
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5edfac
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005ed844
test al, al
jne 0x5edfd0
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5ee01d
xor eax, eax
push ebp
push 0x5ee00d
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ee014
lea eax, [ebp - 0xc]
call fcn.005ed880
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ee528
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004087f0
xor eax, eax
push ebp
push 0x5ee610
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x5ee5fa
lea eax, [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_GetFileSize
mov edi, eax
mov eax, edi
call fcn.00405490
mov ebx, eax
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push esi
call sub.kernel32.dll_ReadFile
push esi
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x5ee5fa
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x5ee5fa
mov eax, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5ee5fa
movzx eax, word [eax + 4]
sub ax, 0x14c
je 0x5ee5d7
sub ax, 0xb4
je 0x5ee5dd
sub ax, 0x8464
je 0x5ee5e3
sub ax, 0x2400
je 0x5ee5e9
jmp 0x5ee5ef
mov byte [ebp - 5], 1
jmp 0x5ee5f3
mov byte [ebp - 5], 3
jmp 0x5ee5f3
mov byte [ebp - 5], 2
jmp 0x5ee5f3
mov byte [ebp - 5], 4
jmp 0x5ee5f3
mov byte [ebp - 5], 0
mov eax, ebx
call fcn.004054ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ee617
lea eax, [ebp - 4]
call fcn.0040870c
ret

Function at 0x5eeef4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x65dc48
mov eax, esi
mov edx, 8
test al, 1
je 0x5eef10
shr eax, 1
xor eax, 0xedb88320
jmp 0x5eef12
shr eax, 1
dec edx
jne 0x5eef03
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5eeefc
pop esi
ret

Function at 0x5eef28
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x65dc44], 0
jne 0x5eef52
call fcn.005eeef4
mov dword [esp], 0x65dc44
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x5eef7c
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x65dc48]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x5eef58
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5eefd4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x5f0598
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5f05a0
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x5f068d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.005a3d1c
mov edx, dword [ebp - 8]
mov ecx, 0x5f06a8
xor eax, eax
call fcn.005f0300
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x5f065b
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x5f05ba
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x3b
call fcn.005ab17c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.004207d8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.005a4c90
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x70
call fcn.005ab14c
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x419944]
call fcn.00426604
call fcn.00407e08
jmp 0x5f05ba
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00408aec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f0694
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040876c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040876c
ret
Function at 0x5f2028
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.004087f0
xor eax, eax
push ebp
push 0x5f210c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x5f206f
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.005a2b90
cmp dword [ebp + 0x18], 0
jne 0x5f206f
lea eax, [ebp + 0x18]
call fcn.005a3b94
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00405ce4
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x5f209a
mov eax, ebx
call fcn.004097c0
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.004097c0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.004097c0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
call fcn.004097c0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x5f20dc
call sub.kernel32.dll_GetLastError
mov dword [esi], eax
jmp 0x5f20f6
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x5f20f6
push esi
movzx edx, byte [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
call fcn.005f1cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f2113
lea eax, [ebp + 0x18]
call fcn.0040870c
ret

Function at 0x5f2344
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x5f2372
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.00409864
jmp 0x5f2379
mov eax, ebx
call fcn.0040870c
add esp, 0x24
pop ebx
ret

Function at 0x5f2380
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x5f23b1
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.00409864
jmp 0x5f23b8
mov eax, ebx
call fcn.0040870c
add esp, 0x208
pop ebx
ret

Function at 0x5f23c8
Capabilities:
Shutdown system

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov esi, edx
mov ebx, eax
call fcn.00427314
cmp eax, 2
jne 0x5f2436
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x5f23f1
xor eax, eax
jmp 0x5f2443
lea eax, [esp + 8]
push eax
push 0x5f244c
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x5f2436
xor eax, eax
jmp 0x5f2443
push esi
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
pop esi
pop ebx
ret
Function at 0x5f2484
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x5f24de
inc esi
xor edi, edi
cmp edi, 1
jne 0x5f24aa
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x5f24b8
cmp edi, 1
jle 0x5f24b8
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005eda28
test eax, eax
jne 0x5f24de
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x5f24de
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x5f24de
inc edi
dec esi
jne 0x5f249a
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x5f2d48
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
push 0
push 2
lea eax, [esp + 8]
push eax
call fcn.005a3f20
and eax, 0x7f
mov ecx, dword [eax*4 + 0x655b98]
mov edx, 0x80000002
xor eax, eax
call fcn.005a414c
test eax, eax
jne 0x5f2d92
mov eax, esi
call fcn.004097c0
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueW
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
call fcn.004097c0
push eax
call sub.gdi32.dll_RemoveFontResourceW
test eax, eax
je 0x5f2db3
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageW
pop edx
pop esi
pop ebx
ret
Function at 0x5f2db8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x5f2f01
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x5f2f18
push 0x5f2f40
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.0041218c
mov ebx, eax
lea edx, [ebp - 0xc]
movzx eax, byte [ebp - 1]
call fcn.005ed844
test al, al
jne 0x5f2e17
mov byte [ebp - 2], 0
jmp 0x5f2ee6
xor eax, eax
push ebp
push 0x5f2edf
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x5f2e5b
push 0
mov eax, dword [ebp + 8]
push eax
push edi
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.005a2ae0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.005a26bc
mov eax, dword [ebp - 0x20]
call fcn.004097c0
push eax
call ebx
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
jmp 0x5f2ec9
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x30]
mov eax, esi
call fcn.005a2ae0
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.005a2bb8
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.005a26bc
mov eax, dword [ebp - 0x28]
call fcn.004097c0
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x5f2ec9
mov ecx, edi
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.005a7498
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.005a7498
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f2ee6
lea eax, [ebp - 0xc]
call fcn.005ed880
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f2f08
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.0040876c
ret

Function at 0x5f30f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x5f3114
mov eax, dword [ebp - 4]
jmp 0x5f3117
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret
Function at 0x5f311c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x5f3169
xor ebx, ebx
jmp 0x5f315e
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.0041fb14
test eax, eax
jne 0x5f315d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x5f3214
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x5f313f
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x5f3175
je 0x5f317e
jmp 0x5f3187
call fcn.005a472c
mov esi, eax
jmp 0x5f3189
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x5f3189
xor esi, esi
test si, si
je 0x5f3214
xor ebx, ebx
jmp 0x5f31af
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x5f31ae
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x5f3214
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x5f3196
xor ebx, ebx
jmp 0x5f3209
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov dx, 0x3ff
and dx, si
movzx edx, dx
cmp eax, edx
jne 0x5f3208
mov ax, 0x3ff
and ax, si
cmp ax, 4
jne 0x5f31fd
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.005f30f0
push eax
mov eax, esi
call fcn.005f30f0
pop edx
cmp edx, eax
jne 0x5f3208
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x5f3214
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x5f31be
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x5fb07c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.004219fc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5fb0ac
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x5fb1c8
push dword fs:[eax]
mov dword fs:[eax], esp
inc dword [0x65e0d4]
cmp dword [0x65e0d0], 0
jne 0x5fb1a3
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 6
jb 0x5fb1a3
lea eax, [ebp - 8]
call fcn.005fb07c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.005a26bc
lea eax, [ebp - 4]
mov edx, 0x5fb1e4
call fcn.004099bc
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_LoadLibraryW
mov dword [0x65e0d0], eax
cmp dword [0x65e0d0], 0
je 0x5fb1a3
push 0x5fb200
mov eax, dword [0x65e0d0]
push eax
call fcn.0041218c
mov dword [0x65e0b4], eax
push 0x5fb220
mov eax, dword [0x65e0d0]
push eax
call fcn.0041218c
mov dword [0x65e0b8], eax
push 0x5fb248
mov eax, dword [0x65e0d0]
push eax
call fcn.0041218c
mov dword [0x65e0bc], eax
push 0x5fb25c
mov eax, dword [0x65e0d0]
push eax
call fcn.0041218c
mov dword [0x65e0c0], eax
push 0x5fb274
mov eax, dword [0x65e0d0]
push eax
call fcn.0041218c
mov dword [0x65e0c4], eax
push 0x5fb288
mov eax, dword [0x65e0d0]
push eax
call fcn.0041218c
mov dword [0x65e0c8], eax
cmp dword [0x65e0d0], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fb1cf
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040876c
ret
Function at 0x5ffad4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor eax, eax
push ebp
push 0x5ffcd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
mov eax, dword [eax + 0x508]
mov edx, 0x20
call fcn.004ef6dc
mov eax, dword [ebx]
mov eax, dword [eax + 0x508]
mov edx, 0x20
call fcn.004ef710
mov eax, dword [ebx]
mov eax, dword [eax + 0x50c]
mov edx, 0x20
call fcn.004ef6dc
mov eax, dword [ebx]
mov eax, dword [eax + 0x50c]
mov edx, 0x20
call fcn.004ef710
xor eax, eax
push ebp
push 0x5ffcaa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1010
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0x10
push 0x5ffce4
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5ffbb1
cmp word [ebp - 0x2ac], 0
je 0x5ffbb1
mov eax, dword [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2ac]
push eax
mov eax, dword [0x65a634]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebx]
mov edx, dword [edx + 0x410]
mov ecx, dword [edx + 0x7c]
mov edx, dword [ebx]
mov edx, dword [edx + 0x508]
call fcn.005ffa10
xor edx, edx
mov al, 6
call fcn.006351d8
test al, al
je 0x5ffc16
push 0x27
lea edx, [ebp - 0x2bc]
mov eax, dword [0x656b28]
mov eax, dword [eax]
call fcn.005a26bc
lea eax, [ebp - 0x2bc]
mov edx, 0x5ffd0c
call fcn.004099bc
mov eax, dword [ebp - 0x2bc]
call fcn.004097c0
push eax
mov eax, dword [0x65a634]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebx]
mov edx, dword [edx + 0x418]
mov ecx, dword [edx + 0x7c]
mov edx, dword [ebx]
mov edx, dword [edx + 0x50c]
call fcn.005ffa10
jmp 0x5ffca0
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
xor eax, eax
call fcn.0063a3cc
cmp dword [ebp - 4], 0
jne 0x5ffc3a
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
mov al, 1
call fcn.0063a3cc
cmp dword [ebp - 4], 0
je 0x5ffca0
push 0x1000
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5ffca0
cmp word [ebp - 0x2ac], 0
je 0x5ffca0
mov eax, dword [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2ac]
push eax
mov eax, dword [0x65a634]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebx]
mov edx, dword [edx + 0x418]
mov ecx, dword [edx + 0x7c]
mov edx, dword [ebx]
mov edx, dword [edx + 0x50c]
call fcn.005ffa10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5ffcb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ffcdc
lea eax, [ebp - 0x2bc]
call fcn.0040870c
lea eax, [ebp - 4]
call fcn.0040870c
ret
Function at 0x6126ec
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x6127c6
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x6127d8
call fcn.005f8f18
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x612744
mov eax, 0x612814
call fcn.005f8c94
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x61272f
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x612797
cmp dword [esp], 0
jne 0x612779
mov eax, 0x61283c
call fcn.005f8c94
jmp 0x6127a1
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x61285c
call fcn.005f8f18
jmp 0x6127a1
mov eax, 0x612890
call fcn.005f8c94
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x6127c6
push 0xfa
call sub.kernel32.dll_Sleep
add esp, 0xc
pop esi
pop ebx
ret