joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5af1c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x40], ecx
mov eax, dword [ebx + 4]
test eax, eax
je 0x5af290
cmp dword [eax + 0xc], 0x20
mov edi, dword [eax + 4]
jb 0x5af290
push 0x2f
push dword [ebx]
call fcn.006f50a0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x5af20c
mov esi, dword [ebx]
xor ebx, ebx
mov ecx, ebx
mov dl, byte [esi]
test dl, dl
je 0x5af23c
cmp dl, 0x41
jl 0x5af220
cmp dl, 0x46
jle 0x5af231
cmp dl, 0x61
jl 0x5af22a
cmp dl, 0x66
jle 0x5af231
lea eax, [edx - 0x30]
cmp al, 9
ja 0x5af236
mov byte [ebp + ecx - 0x3c], dl
inc ecx
inc esi
cmp ecx, 0x20
jl 0x5af210
cmp ecx, 0x21
jae 0x5af2ac
mov byte [ebp + ecx - 0x3c], bl
cmp ecx, 0x20
je 0x5af254
push str.cannot_extract_GUID_from_obfuscated_font_part_name
push dword [ebp - 0x40]
jmp 0x5af296
mov esi, ebx
movzx ecx, byte [ebp + esi*2 - 0x3c]
call fcn.00532aa0
movzx ecx, byte [ebp + esi*2 - 0x3b]
mov edx, eax
shl dl, 4
call fcn.00532aa0
add dl, al
mov byte [ebp + esi - 0x18], dl
inc esi
cmp esi, 0x10
jl 0x5af256
lea ecx, [ebp - 9]
mov al, byte [ecx]
xor byte [ebx + edi], al
xor byte [ebx + edi + 0x10], al
inc ebx
dec ecx
cmp ebx, 0x10
jl 0x5af27e
jmp 0x5af29d
push str.insufficient_data_for_font_deobfuscation
push ecx
call fcn.004f6fc4
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
call fcn.006f420f
int3
Function at 0x5b2737
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push 4
push eax
push 0xf
push 0x400
movlpd qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x5b2783
push 0xe77898
push 4
pop edx
lea ecx, [ebp - 0x10]
call fcn.005b26f2
pop ecx
push esi
push 0xeaa1d0
call fcn.005b24d2
mov ebx, eax
xor edi, edi
mov dword [ebp - 0x24], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x5b27b1
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x5b27a0
sub esi, ecx
sar esi, 1
jmp 0x5b27b3
mov esi, edi
lea ecx, [ebp - 0x10]
call fcn.005b0bf2
lea ecx, [esi + 3]
xor edx, edx
imul eax, ecx
push 3
pop ecx
div ecx
mov ecx, ebx
lea esi, [eax + 1]
call fcn.005b0bf2
add eax, esi
push 2
push eax
mov dword [ebp - 0x20], eax
call fcn.00705f80
mov dword [ebp - 0x18], eax
pop ecx
pop ecx
test eax, eax
je 0x5b285e
mov ecx, ebx
mov esi, eax
call fcn.005b0bf2
xor edx, edx
push 3
pop ecx
div ecx
movzx eax, word [ebx]
sub ecx, edx
mov edx, eax
mov dword [ebp - 0x14], ecx
test ax, ax
je 0x5b2856
mov dword [ebp - 0x1c], ebx
mov word [esi], dx
lea ebx, [ebx + 2]
add esi, 2
cmp word [ebx], di
je 0x5b283b
cmp ecx, 2
jne 0x5b283b
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x10]
push eax
mov eax, esi
mov ecx, esi
sub eax, dword [ebp - 0x18]
sar eax, 1
sub edx, eax
call fcn.005b26f2
pop ecx
mov ecx, dword [ebp - 0x14]
lea esi, [esi + eax*2]
lea eax, [ecx + 1]
push 3
cdq
pop ecx
idiv ecx
movzx eax, word [ebx]
mov dword [ebp - 0x14], edx
mov ecx, edx
mov edx, eax
test ax, ax
jne 0x5b280a
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x18]
xor eax, eax
mov word [esi], ax
push ebx
call fcn.00702f96
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x5b2876
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmm1
mulsd xmm0, qword [0xed0738]
push ebx
push esi
push edi
addsd xmm0, qword [0xed0570]
call fcn.00724610
mov esi, eax
mov ebx, edx
xor eax, eax
push eax
push 0x64
push ebx
push esi
call fcn.00722a90
push edx
push eax
call fcn.005b2737
pop ecx
pop ecx
push 4
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x5b28e4
push 0xe77c04
push 4
pop edx
lea ecx, [ebp - 0xc]
call fcn.005b26f2
pop ecx
xor eax, eax
push eax
push 0x64
push ebx
push esi
call fcn.00722c20
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0xeaa1d8
call fcn.005b24d2
add esp, 0x10
mov esi, eax
mov edx, 0xe80dc8
mov ecx, esi
call fcn.005b234d
test al, al
je 0x5b293c
test esi, esi
je 0x5b2931
mov ecx, esi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x5b2920
sub ecx, edx
sar ecx, 1
jmp 0x5b2935
xor eax, eax
mov ecx, eax
xor eax, eax
mov word [esi + ecx*2 - 2], ax
xor eax, eax
push eax
call fcn.00702f96
pop ecx
push edi
call fcn.00702f96
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret

Function at 0x5b36d2
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 0
je 0x5b37b5
mov eax, dword [0xee68ac]
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
mov bl, cl
test eax, eax
je 0x5b36f7
cmp eax, 0xffffffff
jne 0x5b3727
push ecx
push ecx
push 3
push ecx
push ecx
push 0x40000000
push str..pipeSumatraPDFLogger
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0xee68ac], eax
test eax, eax
je 0x5b37b4
cmp eax, 0xffffffff
je 0x5b37b4
mov bl, 1
xor ecx, ecx
push ecx
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 8], 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x5b374a
push str.logPipe:_SetNamedPipeHandleState___failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test bl, bl
je 0x5b3785
push esi
push 0xe81d40
push str.app:__s_n
call fcn.005b11d0
pop ecx
pop ecx
mov esi, eax
mov ecx, esi
call fcn.005b0bdb
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push dword [0xee68ac]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.00702f96
pop ecx
pop esi
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0xee68ac]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5b37b4
push dword [0xee68ac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0xee68ac], 0xffffffff
pop ebx
leave
ret
Function at 0x5b37b7
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp byte [0xefc733], 0
push ebx
push esi
jne 0x5b37d8
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x5b37d8
mov al, byte [0xefcb75]
test al, al
je 0x5b37e6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [0xefcb75]
cmp byte [0xefcb74], 0
jne 0x5b392b
test al, al
je 0x5b381f
mov eax, dword [0xee68ac]
test eax, eax
je 0x5b392b
cmp eax, 0xffffffff
je 0x5b392b
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005b36d2
pop ecx
pop ecx
jmp 0x5b392b
mov ebx, 0xefd338
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lock inc dword [0xefcb80]
mov eax, dword [0xefcb7c]
test eax, eax
jne 0x5b3887
push 8
call fcn.006f40bd
mov esi, eax
xor eax, eax
pop ecx
push eax
push 0x20000
push eax
mov dword [esi], 0xe7669c
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0x34
mov dword [esi + 4], eax
mov dword [0xefcb78], esi
call fcn.006f40bd
pop ecx
push dword [0xefcb78]
mov ecx, eax
push 0x8000
call fcn.005b1bb2
mov dword [0xefcb7c], eax
jmp 0x5b389c
cmp dword [eax + 8], 0xfff80
jle 0x5b389c
mov ecx, eax
call fcn.005b1b98
mov eax, dword [0xefcb7c]
push dword [ebp + 0xc]
mov ecx, eax
push dword [ebp + 8]
call fcn.005b1c86
cmp byte [0xefcb76], 0
je 0x5b38d7
push 1
call fcn.006f7fc7
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.007063c8
push 1
call fcn.006f7fc7
push eax
call fcn.007058ed
add esp, 0x1c
mov eax, dword [0xefcb70]
test eax, eax
je 0x5b3910
push 0xe73488
push eax
call fcn.006f7ee8
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x5b3910
push esi
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.007063c8
push esi
call fcn.007058ed
push esi
call fcn.006fc765
add esp, 0x18
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005b36d2
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lock dec dword [0xefcb80]
pop esi
pop ebx
pop ebp
ret

Function at 0x5b3cee
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x200
lea eax, [ebp - 0x204]
push ebx
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.006f59b0
push esi
push edi
push str._s_d_n
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.005b10d3
add esp, 0x20
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x5b3f50
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push esi
mov esi, edx
xor esi, 0x1505
push edi
mov edi, ecx
cmp edx, 4
jb 0x5b3f8e
push ebx
mov ebx, edx
shr ebx, 2
imul ecx, dword [edi], 0x5bd1e995
sub edx, 4
imul esi, esi, 0x5bd1e995
add edi, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
xor esi, ecx
sub ebx, 1
jne 0x5b3f67
pop ebx
sub edx, 1
je 0x5b3faf
sub edx, 1
je 0x5b3fa6
sub edx, 1
jne 0x5b3fba
movzx eax, byte [edi + 2]
shl eax, 0x10
xor esi, eax
movzx eax, byte [edi + 1]
shl eax, 8
xor esi, eax
movzx eax, byte [edi]
xor eax, esi
imul esi, eax, 0x5bd1e995
mov eax, esi
shr eax, 0xd
xor eax, esi
imul ecx, eax, 0x5bd1e995
pop edi
pop esi
mov eax, ecx
shr eax, 0xf
xor eax, ecx
ret

Function at 0x5b48f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5b4905
xor al, al
pop ebp
ret
shr eax, 4
and al, 1
pop ebp
ret

Function at 0x5b4e91
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ecx]
push eax
mov dword [ebp - 0xc], 0x3a003f
mov dword [ebp - 8], 0x5c
call fcn.0070a3dd
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 0xc]
add eax, 0xffffffbf
pop ecx
cmp ax, 0x19
ja 0x5b4ee6
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub eax, 1
je 0x5b4ee2
sub eax, 1
je 0x5b4ee2
sub eax, 3
jne 0x5b4ee6
mov al, 1
jmp 0x5b4ee8
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f3e28
leave
ret

Function at 0x5b4feb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x1ec
lea eax, [ebp - 0x1f0]
mov esi, ecx
push 0
push eax
call fcn.006f59b0
add esp, 0xc
lea eax, [ebp - 0x1f0]
mov ebx, 0xf6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x5b5082
cmp eax, ebx
jae 0x5b5082
test esi, esi
jne 0x5b5049
lea edx, [ebp - 0x1f0]
push 0xffffffffffffffff
xor ecx, ecx
call fcn.005b0c60
pop ecx
jmp 0x5b5084
push 0x208
lea eax, [ebp - 0x3f8]
push 0
push eax
call fcn.006f59b0
add esp, 0xc
lea eax, [ebp - 0x3f8]
push eax
push 0
push esi
lea eax, [ebp - 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x5b5082
lea edx, [ebp - 0x3f8]
jmp 0x5b503d
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x5b5135
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, edx
push esi
push edi
test ebx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ecx
sete cl
call fcn.00420997
test ebx, ebx
je 0x5b5256
push 0xffffffffffffffff
mov edx, ebx
lea ecx, [ebp - 0x18]
call fcn.005b47cf
cmp dword [ebp - 0x18], 0
pop ecx
jne 0x5b516e
xor ebx, ebx
jmp 0x5b517f
push 0xe7f1e8
push dword [ebp - 0x18]
call fcn.006f7e8a
pop ecx
pop ecx
mov ebx, eax
test ebx, ebx
je 0x5b5256
push 2
push 0
push ebx
call fcn.00709174
add esp, 0xc
test eax, eax
jne 0x5b523c
push ebx
call fcn.0070877e
pop ecx
mov esi, eax
xor cl, cl
mov dword [ebp - 0x14], esi
call fcn.00420997
lea edx, [esi + 3]
cmp esi, edx
ja 0x5b523c
xor ecx, ecx
call fcn.005b3af2
mov dword [ebp - 8], eax
test eax, eax
je 0x5b523c
push 0
push 0
push ebx
call fcn.00709174
add esp, 0xc
test eax, eax
jne 0x5b523c
push ebx
push esi
push 1
push dword [ebp - 8]
call fcn.00709839
add esp, 0x10
mov dword [ebp - 0x10], eax
push ebx
cmp eax, esi
je 0x5b5246
call fcn.007087da
pop ecx
push ebx
mov dword [ebp - 0xc], eax
call fcn.007087ae
pop ecx
mov esi, eax
push esi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push str.ReadFileWithAllocator:_fread___failed__path:__s__size:__d__nRead:__d__err:__d__isEof:__d_n
call fcn.005b3949
add esp, 0x18
test esi, esi
jne 0x5b522a
cmp dword [ebp - 0xc], esi
jne 0x5b522a
xor eax, eax
inc eax
jmp 0x5b522c
xor al, al
mov cl, al
call fcn.00420997
push dword [ebp - 8]
call fcn.00702f96
pop ecx
and dword [edi], 0
and dword [edi + 4], 0
push ebx
jmp 0x5b524e
mov eax, dword [ebp - 8]
mov dword [edi], eax
mov dword [edi + 4], esi
call fcn.006fc765
pop ecx
jmp 0x5b525d
and dword [edi], 0
and dword [edi + 4], 0
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5b5344
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp dword [ebp + 0xc], 0
sete cl
push ebx
push esi
push edi
call fcn.00420997
cmp dword [ebp + 0xc], 0
jne 0x5b5369
or edi, 0xffffffff
mov edx, edi
jmp 0x5b53b9
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005b52d3
mov esi, eax
or edi, 0xffffffff
pop ecx
pop ecx
test esi, esi
je 0x5b53a6
cmp esi, edi
je 0x5b53a6
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [esp + 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x5b53a6
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
jmp 0x5b53b0
mov ebx, edi
test esi, esi
je 0x5b53b7
cmp esi, edi
je 0x5b53b7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b53c2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, edx
call fcn.005b52b9
mov esi, eax
cmp esi, 0xffffffff
jne 0x5b53da
xor edi, edi
jmp 0x5b5409
push dword [ebp + 8]
push 0
push edi
call fcn.006f59b0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
add esp, 0xc
push 0
push eax
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5b5406
or edi, 0xffffffff
jmp 0x5b5409
mov edi, dword [ebp - 4]
test esi, esi
je 0x5b5419
cmp esi, 0xffffffff
je 0x5b5419
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x5b541f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0
push 0x80
push 2
push 0
inc ebx
mov dword [ebp - 8], eax
push ebx
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5b5456
xor al, al
jmp 0x5b549c
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
test eax, eax
je 0x5b547b
cmp edi, dword [ebp - 4]
je 0x5b547b
mov cl, bl
jmp 0x5b547d
xor cl, cl
call fcn.00420997
cmp dword [ebp - 8], 0
je 0x5b548d
cmp edi, dword [ebp - 4]
je 0x5b548f
xor bl, bl
test esi, esi
je 0x5b549a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5b54a1
Capabilities:
Delete file

Disassembly:
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
neg eax
sbb eax, eax
inc eax
or eax, esi
jne 0x5b54c8
xor ecx, ecx
call fcn.005b66cf
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x5b54cc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
test ecx, ecx
jne 0x5b54db
xor al, al
jmp 0x5b550f
mov edx, ecx
lea ecx, [ebp - 8]
push 0xffffffffffffffff
call fcn.005b47cf
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
neg eax
sbb eax, eax
inc eax
or eax, esi
jne 0x5b550d
xor ecx, ecx
call fcn.005b66cf
jmp 0x5b54d7
mov al, 1
pop esi
leave
ret

Function at 0x5b5772
Capabilities:
Create directory

Disassembly:
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x5b5782
mov al, 1
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
ret

Function at 0x5b5bbf
Capabilities:
Create thread

Disassembly:
cmp dword [0xf088b8], 0
jne 0x5b5c10
push esi
push 0xf088bc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor esi, esi
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0xf088dc
push esi
push esi
push 0x5b5b18
push esi
push esi
mov dword [0xf088d8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0xf088dc]
mov edx, str.FileWatcherThread
mov dword [0xf088b8], eax
pop esi
jmp fcn.005c088a
ret
Function at 0x5b6721
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, ecx
mov dword [ebp - 0x14], edx
test edi, edi
jne 0x5b6738
xor eax, eax
jmp 0x5b67df
push ebx
push esi
xor ebx, ebx
mov eax, 0x20019
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x5b67b8
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x5b67af
mov eax, dword [ebp - 8]
shr eax, 1
inc eax
push 2
push eax
call fcn.00705f80
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 8]
push eax
push ebx
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x5b67af
xor edx, edx
lea ecx, [ebp - 0xc]
call fcn.005b0f57
mov ebx, dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x5b67db
cmp edi, reloc.OLEAUT32.dll_SysReAllocString
jne 0x5b67db
cmp dword [ebp - 0x10], 0x20019
jne 0x5b67db
mov edx, dword [ebp - 0x14]
mov eax, 0x20119
jmp 0x5b6741
pop esi
mov eax, ebx
pop ebx
pop edi
leave
ret

Function at 0x5b6876
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [ebp + 0xc]
call fcn.005b0bf2
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
movzx ecx, bl
push ecx
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
push esi
call fcn.005b6956
push eax
push str.WriteRegStr__s___s___s___s_____d_n
call fcn.005b3a54
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x5b68d1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, ecx
push edi
push 4
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], eax
push ecx
push 4
push dword [ebp + 8]
mov edi, edx
mov dword [ebp + 0xc], esi
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
movzx ecx, bl
push ecx
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 8]
push edi
call fcn.005b6956
push eax
push str.WriteRegDWORD__s___s___s___d_____d_n
call fcn.005b3a54
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5b69c4
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x5b69d9
call fcn.005b6971
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
movzx ecx, byte [ebp + 8]
mov esi, eax
push esi
push ecx
push edi
mov ecx, ebx
call fcn.005b6956
push eax
push str.LoggedDeleteRegKey__s___s___d_____d_n
call fcn.005b3a54
add esp, 0x14
test esi, esi
je 0x5b6a13
cmp esi, 2
je 0x5b6a13
mov ecx, esi
xor bl, bl
call fcn.005b66cf
jmp 0x5b6a15
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x5b6a1c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, edx
mov eax, ecx
push edi
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov esi, eax
test esi, esi
je 0x5b6a45
cmp esi, 2
je 0x5b6a45
xor bl, bl
jmp 0x5b6a47
mov bl, 1
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 8]
push edi
call fcn.005b6956
push eax
push str.LoggedDeleteRegValue__s___s___s_____d_n
call fcn.005b3a54
add esp, 0x14
test bl, bl
jne 0x5b6a6d
mov ecx, esi
call fcn.005b66cf
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x5b6a74
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
mov esi, edx
mov edi, ecx
call fcn.006f59b0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, esi
or ecx, 0x8000
cmp byte [ebp + 8], bl
push eax
push ebx
push ebx
cmove ecx, esi
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x5b6acf
mov dword [edi], ebx
mov dword [edi + 4], ebx
jmp 0x5b6adf
push 0xffffffffffffffff
lea edx, [ebp - 0x20c]
mov ecx, edi
call fcn.005b4673
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret

Function at 0x5b7031
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
call fcn.005b22d2
test al, al
je 0x5b704b
xor al, al
jmp 0x5b70ad
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.006f59b0
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0x400
push eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x5b70ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 8]
mov esi, eax
push ebx
push edi
push str.LaunchFile:_ShellExecuteExW_path:__s_params:__s_verb:__s_n
call fcn.005b3a54
add esp, 0x10
mov ecx, esi
call fcn.005b66cf
jmp 0x5b7047
mov al, 1
pop edi
pop esi
pop ebx
leave
ret