joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51d780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004069f0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00406b00
test eax, eax
jle 0x51d803
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ax, word [eax + edx*2 - 2]
mov word [ebp - 0x16], ax
mov eax, dword [ebp - 0x10]
dec eax
shl eax, 3
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
and ecx, 0x3f
call fcn.0040809c
and ax, word [ebp - 6]
xor word [ebp - 0x16], ax
mov eax, dword [ebp - 0xc]
call fcn.00406bc8
mov edx, dword [ebp - 0x10]
mov cx, word [ebp - 0x16]
mov word [eax + edx*2 - 2], cx
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x51d7b3
mov esp, ebp
pop ebp
ret 8

Function at 0x52ca50
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0042a370
xor eax, eax
push ebp
push 0x52cadc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.0042b390
push 0
mov eax, dword [ebp - 4]
add eax, 0x64
mov ecx, 1
mov edx, dword [0x52b650]
call fcn.004084e0
add esp, 4
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 1
push 0
mov eax, dword [ebp - 4]
add eax, 0x34
mov ecx, 1
mov edx, dword [0x427754]
call fcn.004084e0
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52cae3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.0042a380
ret
Function at 0x55bf20
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
mov edx, dword [0x55be4c]
call fcn.004078ec
xor eax, eax
push ebp
push 0x55bfee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x55be00]
call fcn.004084e0
add esp, 4
lea eax, [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push 0x55be80
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0x14]
call fcn.0040832c
test eax, eax
jne 0x55bf8a
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x55bfd2
mov eax, dword [ebp - 0x14]
call fcn.00408334
test eax, eax
jl 0x55bfca
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x55bfc2
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0xc], eax
jmp 0x55bfd2
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x55bfa1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55bff5
lea eax, [ebp - 0x18]
mov edx, dword [0x55be4c]
call fcn.004079c4
ret

Function at 0x562540
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
mov edx, 0x44
call fcn.0042ad80
mov dword [ebp - 0x50], 0x44
lea eax, [ebp - 0x60]
mov edx, 0x10
call fcn.0042ad80
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407230
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x5625b7
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x580d00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x580d08
push ecx
xor eax, eax
push ebp
push 0x580ef2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [eax]
call dword [edx + 0xa8]
cmp edx, 0
jne 0x580d3d
cmp eax, 0x80000000
ja 0x580d43
jmp 0x580eca
jle 0x580eca
lea edx, [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov ecx, dword [eax]
call dword [ecx + 0x84]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041d8a0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0x580f0c
call fcn.00407420
lea eax, [ebp - 8]
mov edx, 0x105
call fcn.00407348
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
call fcn.00406b00
push eax
mov eax, dword [ebp - 8]
call fcn.00407230
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407230
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
jne 0x580e0d
push 0x580f1c
lea edx, [ebp - 0x28]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
add eax, 4
call fcn.0047a360
push dword [ebp - 0x28]
push 0x580f7c
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov ecx, dword [eax]
call dword [ecx + 0x84]
push dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.004074a8
mov edx, dword [ebp - 0x24]
mov eax, dword [0x5eba70]
mov eax, dword [eax]
xor ecx, ecx
call fcn.0043f530
jmp 0x580eca
mov eax, dword [ebp - 8]
call fcn.00407230
mov edx, eax
lea eax, [ebp - 8]
call fcn.00407288
mov edx, 0x580fac
mov eax, dword [ebp - 8]
call fcn.00427f20
test eax, eax
jne 0x580e40
mov dword [ebp - 0x10], 0x80000000
mov dword [ebp - 0xc], 0
jmp 0x580e90
mov edx, 0x580fc4
mov eax, dword [ebp - 8]
call fcn.00427f20
test eax, eax
jne 0x580e61
mov dword [ebp - 0x10], 0x80000000
mov dword [ebp - 0xc], 0
jmp 0x580e90
mov edx, 0x580fd8
mov eax, dword [ebp - 8]
call fcn.00427f20
test eax, eax
jne 0x580e82
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 1
jmp 0x580e90
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
jne 0x580e9e
cmp dword [ebp - 0x10], 0
jbe 0x580eca
jmp 0x580ea0
jle 0x580eca
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [eax]
call dword [edx + 0xa8]
cmp edx, dword [ebp - 0xc]
jne 0x580eba
cmp eax, dword [ebp - 0x10]
jbe 0x580eca
jmp 0x580ebc
jle 0x580eca
mov eax, dword [ebp + 8]
add eax, 0xffffffdc
mov edx, dword [ebp - 4]
call fcn.00406a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x580ef9
lea eax, [ebp - 0x2c]
mov edx, 5
call fcn.0040668c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040668c
ret
Function at 0x5910d0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov word [ebp - 2], ax
mov eax, dword [ebp - 0xc]
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x59118d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x59117c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.00404860
mov eax, dword [ebp - 0x14]
push eax
movzx eax, word [ebp - 2]
push eax
call sub.user32.dll_SetClipboardData
test eax, eax
jne 0x591165
push 0x5911b8
call sub.kernel32.dll_GetLastError_2
mov ecx, eax
mov eax, dword [0x5eba70]
mov eax, dword [eax]
mov dl, 2
call fcn.0043f8b0
call fcn.00405e18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5911a5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x591183
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x592fb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [ebp - 9], 0
test byte [ebp - 4], 1
je 0x592ff9
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x59302f
push 0xa4
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x59302f
push 0xa5
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x593133
jmp 0x59302f
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x593133
push 0xa4
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x593133
push 0xa5
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x593133
test byte [ebp - 4], 2
je 0x593065
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x59309b
push 0xa2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x59309b
push 0xa3
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x593133
jmp 0x59309b
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x593133
push 0xa2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x593133
push 0xa3
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x593133
test byte [ebp - 4], 4
je 0x5930cd
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x5930f7
push 0xa0
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x5930f7
push 0xa1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x593133
jmp 0x5930f7
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x593133
push 0xa0
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x593133
push 0xa1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x593133
test byte [ebp - 4], 8
je 0x593117
push 0x5b
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x59312f
push 0x5c
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x593133
jmp 0x59312f
push 0x5b
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x593133
push 0x5c
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x593133
mov byte [ebp - 9], 1
mov al, byte [ebp - 9]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x593330
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
call sub.user32.dll_GetShellWindow
cmp eax, dword [ebp - 4]
je 0x593358
push 0
push 0x593364
call sub.user32.dll_FindWindowW
cmp eax, dword [ebp - 4]
je 0x593358
xor eax, eax
jmp 0x59335a
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x59cce0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov byte [ebp - 5], 0
push 0x59cf48
push 0x59cf58
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040b494
mov dword [ebp - 4], eax
push 6
push 1
push 2
call sub.ws2_32.dll_socket
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x59cd27
push ebp
mov eax, 0x59cf7c
call fcn.0059cbe0
pop ecx
jmp 0x59cf40
xor eax, eax
push ebp
push 0x59cf39
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x1c], 1
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push 0xffff
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_setsockopt
inc eax
jne 0x59cd61
push ebp
mov eax, 0x59cfd0
call fcn.0059cbe0
pop ecx
mov dword [ebp - 0xc], 0x10
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0xc]
call fcn.0042ad80
mov word [ebp - 0x2c], 2
push 0x59d010
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_bind
inc eax
jne 0x59cdb0
push ebp
mov eax, 0x59d028
call fcn.0059cbe0
pop ecx
call fcn.00405e18
jmp 0x59cf40
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_getsockname
inc eax
jne 0x59cdda
push ebp
mov eax, 0x59d064
call fcn.0059cbe0
pop ecx
call fcn.00405e18
jmp 0x59cf40
push 0x59d010
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0x28], eax
push 0x7fffffff
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_listen
inc eax
jne 0x59ce0e
push ebp
mov eax, 0x59d0b0
call fcn.0059cbe0
pop ecx
call fcn.00405e18
jmp 0x59cf40
push 6
push 1
push 2
call sub.ws2_32.dll_socket
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x59ce38
push ebp
mov eax, 0x59d100
call fcn.0059cbe0
pop ecx
call fcn.00405e18
jmp 0x59cf40
xor eax, eax
push ebp
push 0x59cf0c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.ws2_32.dll_connect
inc eax
jne 0x59ce75
push ebp
mov eax, 0x59d150
call fcn.0059cbe0
pop ecx
call fcn.00405e18
call fcn.00405e18
jmp 0x59cf40
push ebp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.0059cba0
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x59cea7
push ebp
mov eax, 0x59d190
call fcn.0059cbe0
pop ecx
call fcn.00405e18
call fcn.00405e18
jmp 0x59cf40
xor eax, eax
push ebp
push 0x59cedf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59cee6
mov eax, dword [ebp - 0x18]
push eax
call sub.ws2_32.dll_closesocket
inc eax
jne 0x59cede
push ebp
mov eax, 0x59d1cc
call fcn.0059cbe0
pop ecx
ret
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x59d2e0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x59d45e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xa], 1
mov eax, dword [ebp - 8]
call fcn.0042c010
mov dl, 1
mov eax, dword [0x426f08]
call fcn.00405008
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x59d434
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x59d47c
mov cl, byte [0x59d480]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0042ab50
mov eax, dword [ebp - 0x14]
call fcn.0042ca30
dec eax
test eax, eax
jl 0x59d41e
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.0042c7e0
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
call fcn.00406b00
mov edx, eax
inc edx
mov ecx, 0x7fffffff
pop eax
call fcn.004075f0
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00407420
push 1
mov eax, dword [ebp - 0x18]
call fcn.00407230
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.0042c7e0
mov eax, dword [ebp - 0x28]
call fcn.00407230
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
jne 0x59d412
mov byte [ebp - 0xa], 0
lea ecx, [ebp - 0x30]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.0042c7e0
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x59d490
call fcn.00407420
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x5eba70]
mov eax, dword [eax]
xor ecx, ecx
call fcn.0043f530
cmp byte [ebp - 9], 0
je 0x59d412
call fcn.00405e18
jmp 0x59d43b
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x59d36d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59d43b
mov eax, dword [ebp - 0x14]
call fcn.00405038
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59d465
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.0040668c
lea eax, [ebp - 0x18]
call fcn.0040662c
ret
Function at 0x5a1650
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x5a1709
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
inc dword [eax - 4]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0042c7e0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 4]
call fcn.0042bd20
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0041d1ac
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x10]
lea eax, [ebp - 8]
call fcn.00407420
push 1
mov eax, dword [ebp - 8]
call fcn.00407230
push eax
mov eax, dword [ebp - 4]
call fcn.00407230
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x5a16dc
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00407230
push eax
call sub.kernel32.dll_MoveFileExW
jmp 0x5a16ee
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.00407230
push eax
call sub.kernel32.dll_MoveFileExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a1710
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040668c
ret
Function at 0x5a9170
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x5a9188
add esp, 0xfffffff0
call fcn.00405318
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a9239
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x28
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x18]
call fcn.00406a8c
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x38], ecx
mov ecx, dword [edx + 0x14]
mov dword [eax + 0x3c], ecx
mov eax, dword [ebp - 4]
add eax, 0x84
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0xc]
call fcn.00406a8c
mov eax, dword [ebp - 4]
add eax, 0x80
mov edx, dword [ebp + 8]
call fcn.00406a8c
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0xc]
call fcn.0047af40
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.005a60a0
mov eax, dword [ebp - 4]
add eax, 0x40
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
call fcn.004072f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a9240
lea eax, [ebp - 0x10]
call fcn.00406650
ret

Function at 0x5a9820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x5a9838
add esp, 0xfffffff0
call fcn.00405318
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a98f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x28
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x18]
call fcn.00406a8c
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x38], ecx
mov ecx, dword [edx + 0x14]
mov dword [eax + 0x3c], ecx
mov eax, dword [ebp - 4]
add eax, 0x88
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0xc]
call fcn.00406a8c
mov eax, dword [ebp - 4]
lea edx, [eax + 0x84]
mov eax, dword [ebp + 8]
call fcn.00409d94
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
call fcn.005a9cd0
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0xc]
call fcn.0047af40
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.005a60a0
mov eax, dword [ebp - 4]
add eax, 0x40
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
call fcn.004072f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a98ff
lea eax, [ebp - 0x10]
call fcn.00406650
ret
Function at 0x5a9d40
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a9ea5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00407230
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5a9e8a
test byte [ebp - 0x10], 1
je 0x5a9e8a
push 0x5a9ec0
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0041d1ac
push dword [ebp - 0x18]
push 0x5a9f1c
push dword [ebp - 4]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004074a8
mov eax, dword [ebp - 0x14]
push eax
call fcn.005c7aa0
xor ecx, ecx
pop edx
call fcn.0043f530
mov eax, dword [ebp - 0x10]
and eax, 0xfffffffe
push eax
mov eax, dword [ebp - 4]
call fcn.00407230
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.00407230
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 0x10], eax
test byte [ebp - 0x10], 1
jne 0x5a9e41
cmp byte [0x5eb2f9], 0
jne 0x5a9e1e
mov byte [0x5eb2f9], 1
push 0
push 0
mov ecx, dword [ebp - 8]
mov eax, dword [0x5ec0b4]
mov eax, dword [eax]
mov edx, 0x7d
call fcn.00560320
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x5a9f38
call fcn.00407420
mov eax, dword [ebp - 0x1c]
push eax
call fcn.005c7aa0
xor ecx, ecx
pop edx
call fcn.0043fa80
jmp 0x5a9e8a
cmp byte [0x5eb2f8], 0
jne 0x5a9e69
mov byte [0x5eb2f8], 1
push 0
push 0
mov ecx, dword [ebp - 8]
mov eax, dword [0x5ec0b4]
mov eax, dword [eax]
mov edx, 0x7e
call fcn.00560320
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov edx, 0x5a9f94
call fcn.00407420
mov eax, dword [ebp - 0x20]
push eax
call fcn.005c7aa0
xor ecx, ecx
pop edx
call fcn.0043f530
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a9eac
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.0040668c
ret
Function at 0x5b0750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5b085d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00428620
mov eax, dword [0x5eb3c0]
call fcn.0042ca30
dec eax
cmp eax, 0
jl 0x5b0842
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [0x5eb3c0]
call fcn.0042c7e0
mov byte [ebp - 0x19], 0
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, dword [ebp - 0x14]
call fcn.0040775c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jl 0x5b0835
cmp byte [ebp - 0x19], 0
jne 0x5b080d
mov byte [ebp - 0x19], 1
lea eax, [ebp - 0x18]
mov edx, 0x105
call fcn.00407348
mov eax, dword [ebp - 0x18]
call fcn.00407230
push eax
push 0
push 0
mov edx, dword [ebp - 0xc]
mov eax, dword [0x5eb3c0]
call fcn.0042c890
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, eax
jne 0x5b0805
lea eax, [ebp - 0x18]
call fcn.0042b200
jmp 0x5b080d
lea eax, [ebp - 0x18]
call fcn.0040662c
mov eax, dword [ebp - 0x14]
call fcn.00406b00
mov ecx, eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00407638
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.0040769c
jmp 0x5b07a8
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x5b0794
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b0864
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0040668c
ret