joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ee298
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005ee13c
test al, al
jne 0x5ee2bc
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5ee314
xor eax, eax
push ebp
push 0x5ee304
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.004097c0
push eax
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_CopyFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ee30b
lea eax, [ebp - 0xc]
call fcn.005ee178
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5ee320
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005ee13c
test al, al
jne 0x5ee341
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5ee38d
xor eax, eax
push ebp
push 0x5ee37d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ee384
lea eax, [ebp - 0xc]
call fcn.005ee178
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ee4f8
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005ee13c
test al, al
jne 0x5ee51b
mov dword [ebp - 4], 0xffffffff
jmp 0x5ee567
xor eax, eax
push ebp
push 0x5ee557
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ee55e
lea eax, [ebp - 0xc]
call fcn.005ee178
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ee69c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005ee13c
test al, al
jne 0x5ee6c0
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5ee714
xor eax, eax
push ebp
push 0x5ee704
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004097c0
push eax
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_MoveFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ee70b
lea eax, [ebp - 0xc]
call fcn.005ee178
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ee720
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
test edi, edi
jne 0x5ee743
test esi, 4
je 0x5ee743
xor edi, edi
jmp 0x5ee74c
mov eax, edi
call fcn.004097c0
mov edi, eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.005ee13c
test al, al
jne 0x5ee761
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x5ee7b0
xor eax, eax
push ebp
push 0x5ee7a0
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_MoveFileExW
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ee7a7
lea eax, [ebp - 0x10]
call fcn.005ee178
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5ee82c
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005ee13c
test al, al
jne 0x5ee84d
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5ee899
xor eax, eax
push ebp
push 0x5ee889
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004097c0
push eax
call sub.kernel32.dll_RemoveDirectoryW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ee890
lea eax, [ebp - 0xc]
call fcn.005ee178
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ee8a4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.005ee13c
test al, al
jne 0x5ee8c8
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5ee915
xor eax, eax
push ebp
push 0x5ee905
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5eee20
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004087f0
xor eax, eax
push ebp
push 0x5eef08
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x5eeef2
lea eax, [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_GetFileSize
mov edi, eax
mov eax, edi
call fcn.00405490
mov ebx, eax
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push esi
call sub.kernel32.dll_ReadFile
push esi
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x5eeef2
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x5eeef2
mov eax, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5eeef2
movzx eax, word [eax + 4]
sub ax, 0x14c
je 0x5eeecf
sub ax, 0xb4
je 0x5eeed5
sub ax, 0x8464
je 0x5eeedb
sub ax, 0x2400
je 0x5eeee1
jmp 0x5eeee7
mov byte [ebp - 5], 1
jmp 0x5eeeeb
mov byte [ebp - 5], 3
jmp 0x5eeeeb
mov byte [ebp - 5], 2
jmp 0x5eeeeb
mov byte [ebp - 5], 4
jmp 0x5eeeeb
mov byte [ebp - 5], 0
mov eax, ebx
call fcn.004054ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5eef0f
lea eax, [ebp - 4]
call fcn.0040870c
ret

Function at 0x5ef7ec
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x65fc40
mov eax, esi
mov edx, 8
test al, 1
je 0x5ef808
shr eax, 1
xor eax, 0xedb88320
jmp 0x5ef80a
shr eax, 1
dec edx
jne 0x5ef7fb
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x5ef7f4
pop esi
ret

Function at 0x5ef820
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x65fc3c], 0
jne 0x5ef84a
call fcn.005ef7ec
mov dword [esp], 0x65fc3c
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x5ef874
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x65fc40]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x5ef850
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5ef8cc
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret
Function at 0x5f0e90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x5f0e98
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x5f0f85
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.005a3ed8
mov edx, dword [ebp - 8]
mov ecx, 0x5f0fa0
xor eax, eax
call fcn.005f0bf8
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x5f0f53
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x5f0eb2
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x3b
call fcn.005ab338
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.004207e0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.005a4e4c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x70
call fcn.005ab308
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x41994c]
call fcn.0042660c
call fcn.00407e08
jmp 0x5f0eb2
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00408aec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f0f8c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040876c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040876c
ret
Function at 0x5f2920
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.004087f0
xor eax, eax
push ebp
push 0x5f2a04
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x5f2967
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.005a2d4c
cmp dword [ebp + 0x18], 0
jne 0x5f2967
lea eax, [ebp + 0x18]
call fcn.005a3d50
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00405ce4
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x5f2992
mov eax, ebx
call fcn.004097c0
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.004097c0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.004097c0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
call fcn.004097c0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x5f29d4
call sub.kernel32.dll_GetLastError
mov dword [esi], eax
jmp 0x5f29ee
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x5f29ee
push esi
movzx edx, byte [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
call fcn.005f25c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f2a0b
lea eax, [ebp + 0x18]
call fcn.0040870c
ret

Function at 0x5f2c3c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x5f2c6a
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.00409864
jmp 0x5f2c71
mov eax, ebx
call fcn.0040870c
add esp, 0x24
pop ebx
ret

Function at 0x5f2c78
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x5f2ca9
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.00409864
jmp 0x5f2cb0
mov eax, ebx
call fcn.0040870c
add esp, 0x208
pop ebx
ret

Function at 0x5f2cc0
Capabilities:
Shutdown system

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov esi, edx
mov ebx, eax
call fcn.0042731c
cmp eax, 2
jne 0x5f2d2e
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x5f2ce9
xor eax, eax
jmp 0x5f2d3b
lea eax, [esp + 8]
push eax
push 0x5f2d44
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x5f2d2e
xor eax, eax
jmp 0x5f2d3b
push esi
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
pop esi
pop ebx
ret
Function at 0x5f2d7c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x5f2dd6
inc esi
xor edi, edi
cmp edi, 1
jne 0x5f2da2
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x5f2db0
cmp edi, 1
jle 0x5f2db0
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005ee320
test eax, eax
jne 0x5f2dd6
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x5f2dd6
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x5f2dd6
inc edi
dec esi
jne 0x5f2d92
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x5f3640
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
push 0
push 2
lea eax, [esp + 8]
push eax
call fcn.005a40dc
and eax, 0x7f
mov ecx, dword [eax*4 + 0x657b98]
mov edx, 0x80000002
xor eax, eax
call fcn.005a4308
test eax, eax
jne 0x5f368a
mov eax, esi
call fcn.004097c0
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueW
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
call fcn.004097c0
push eax
call sub.gdi32.dll_RemoveFontResourceW
test eax, eax
je 0x5f36ab
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageW
pop edx
pop esi
pop ebx
ret
Function at 0x5f36b0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x5f37f9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x5f3810
push 0x5f3838
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.0041218c
mov ebx, eax
lea edx, [ebp - 0xc]
movzx eax, byte [ebp - 1]
call fcn.005ee13c
test al, al
jne 0x5f370f
mov byte [ebp - 2], 0
jmp 0x5f37de
xor eax, eax
push ebp
push 0x5f37d7
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x5f3753
push 0
mov eax, dword [ebp + 8]
push eax
push edi
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.005a2c9c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.005a2878
mov eax, dword [ebp - 0x20]
call fcn.004097c0
push eax
call ebx
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
jmp 0x5f37c1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x30]
mov eax, esi
call fcn.005a2c9c
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.005a2d74
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.005a2878
mov eax, dword [ebp - 0x28]
call fcn.004097c0
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x5f37c1
mov ecx, edi
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.005a7654
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.005a7654
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f37de
lea eax, [ebp - 0xc]
call fcn.005ee178
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f3800
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.0040876c
ret

Function at 0x5f39e8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x5f3a0c
mov eax, dword [ebp - 4]
jmp 0x5f3a0f
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret
Function at 0x5f3a14
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x5f3a61
xor ebx, ebx
jmp 0x5f3a56
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.0041fb1c
test eax, eax
jne 0x5f3a55
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x5f3b0c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x5f3a37
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x5f3a6d
je 0x5f3a76
jmp 0x5f3a7f
call fcn.005a48e8
mov esi, eax
jmp 0x5f3a81
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x5f3a81
xor esi, esi
test si, si
je 0x5f3b0c
xor ebx, ebx
jmp 0x5f3aa7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x5f3aa6
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x5f3b0c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x5f3a8e
xor ebx, ebx
jmp 0x5f3b01
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov dx, 0x3ff
and dx, si
movzx edx, dx
cmp eax, edx
jne 0x5f3b00
mov ax, 0x3ff
and ax, si
cmp ax, 4
jne 0x5f3af5
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.005f39e8
push eax
mov eax, esi
call fcn.005f39e8
pop edx
cmp edx, eax
jne 0x5f3b00
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x5f3b0c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x5f3ab6
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x5fb974
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
lea eax, [ebp - 0x208]
call fcn.00421a04
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5fb9a4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x5fbac0
push dword fs:[eax]
mov dword fs:[eax], esp
inc dword [0x6600cc]
cmp dword [0x6600c8], 0
jne 0x5fba9b
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 6
jb 0x5fba9b
lea eax, [ebp - 8]
call fcn.005fb974
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.005a2878
lea eax, [ebp - 4]
mov edx, 0x5fbadc
call fcn.004099bc
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_LoadLibraryW
mov dword [0x6600c8], eax
cmp dword [0x6600c8], 0
je 0x5fba9b
push 0x5fbaf8
mov eax, dword [0x6600c8]
push eax
call fcn.0041218c
mov dword [0x6600ac], eax
push 0x5fbb18
mov eax, dword [0x6600c8]
push eax
call fcn.0041218c
mov dword [0x6600b0], eax
push 0x5fbb40
mov eax, dword [0x6600c8]
push eax
call fcn.0041218c
mov dword [0x6600b4], eax
push 0x5fbb54
mov eax, dword [0x6600c8]
push eax
call fcn.0041218c
mov dword [0x6600b8], eax
push 0x5fbb6c
mov eax, dword [0x6600c8]
push eax
call fcn.0041218c
mov dword [0x6600bc], eax
push 0x5fbb80
mov eax, dword [0x6600c8]
push eax
call fcn.0041218c
mov dword [0x6600c0], eax
cmp dword [0x6600c8], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fbac7
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040876c
ret
Function at 0x6003cc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor eax, eax
push ebp
push 0x6005cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
mov eax, dword [eax + 0x508]
mov edx, 0x20
call fcn.004ef854
mov eax, dword [ebx]
mov eax, dword [eax + 0x508]
mov edx, 0x20
call fcn.004ef888
mov eax, dword [ebx]
mov eax, dword [eax + 0x50c]
mov edx, 0x20
call fcn.004ef854
mov eax, dword [ebx]
mov eax, dword [eax + 0x50c]
mov edx, 0x20
call fcn.004ef888
xor eax, eax
push ebp
push 0x6005a2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1010
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0x10
push 0x6005dc
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x6004a9
cmp word [ebp - 0x2ac], 0
je 0x6004a9
mov eax, dword [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2ac]
push eax
mov eax, dword [0x65c634]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebx]
mov edx, dword [edx + 0x410]
mov ecx, dword [edx + 0x7c]
mov edx, dword [ebx]
mov edx, dword [edx + 0x508]
call fcn.00600308
xor edx, edx
mov al, 6
call fcn.006365c0
test al, al
je 0x60050e
push 0x27
lea edx, [ebp - 0x2bc]
mov eax, dword [0x658b40]
mov eax, dword [eax]
call fcn.005a2878
lea eax, [ebp - 0x2bc]
mov edx, 0x600604
call fcn.004099bc
mov eax, dword [ebp - 0x2bc]
call fcn.004097c0
push eax
mov eax, dword [0x65c634]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebx]
mov edx, dword [edx + 0x418]
mov ecx, dword [edx + 0x7c]
mov edx, dword [ebx]
mov edx, dword [edx + 0x50c]
call fcn.00600308
jmp 0x600598
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
xor eax, eax
call fcn.0063b7d4
cmp dword [ebp - 4], 0
jne 0x600532
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
mov al, 1
call fcn.0063b7d4
cmp dword [ebp - 4], 0
je 0x600598
push 0x1000
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x600598
cmp word [ebp - 0x2ac], 0
je 0x600598
mov eax, dword [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2ac]
push eax
mov eax, dword [0x65c634]
push eax
call sub.shell32.dll_ExtractIconW
mov edx, dword [ebx]
mov edx, dword [edx + 0x418]
mov ecx, dword [edx + 0x7c]
mov edx, dword [ebx]
mov edx, dword [edx + 0x50c]
call fcn.00600308
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6005ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6005d4
lea eax, [ebp - 0x2bc]
call fcn.0040870c
lea eax, [ebp - 4]
call fcn.0040870c
ret
Function at 0x6130c8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x6131a2
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x6131b4
call fcn.005f9810
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x613120
mov eax, 0x6131f0
call fcn.005f958c
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x61310b
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x613173
cmp dword [esp], 0
jne 0x613155
mov eax, 0x613218
call fcn.005f958c
jmp 0x61317d
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x613238
call fcn.005f9810
jmp 0x61317d
mov eax, 0x61326c
call fcn.005f958c
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x6131a2
push 0xfa
call sub.kernel32.dll_Sleep
add esp, 0xc
pop esi
pop ebx
ret