joyce8/EMBER2024-capa huggingface dataset:
Function at 0x509560
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d9f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5d6b80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
call fcn.0045adc0
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x5095a6
push 0x80004005
call fcn.0045a8f0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.005094d0
mov esi, dword [ebp - 0x10]
add esp, 4
test eax, eax
je 0x509659
lea eax, [ebp - 0x1c]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x509654
push ebx
call fcn.005243ff
push ebx
mov edi, eax
push 0
push edi
call fcn.00525ee0
add esp, 0x10
test edi, edi
je 0x50964b
push edi
push ebx
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x50964b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x57e140
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x50964b
cmp dword [ebp - 0x14], 0
je 0x50964b
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 8]
mov ecx, dword [eax + 0xc]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
push edx
push str._d._d._d._d
push dword [ebp + 8]
call fcn.0045acb0
add esp, 0x18
push edi
call fcn.00525873
add esp, 4
mov edi, 1
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x50967a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5096f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x573b80
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5d6b80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0045adc0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x509734
push 0x80004005
call fcn.0045a8f0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push 1
push eax
call fcn.004c3c90
add esp, 8
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp dword [eax - 0xc], 0
je 0x50977e
lea eax, [ebp - 0x18]
push eax
call fcn.004c6a20
add esp, 4
test eax, eax
jne 0x50977e
push dword [ebp - 0x10]
call fcn.004c3c50
add esp, 4
mov esi, dword [ebp + 8]
mov dword [0x5de6a0], esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
push esi
push 0
push 0
push 0x32
push 0x64
push 0
push SysReAllocStringLen
push 0x80000
push 0x5de6a8
push 0x5de770
push 0xa8
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
push 0
test esi, esi
jne 0x5097f6
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x40
push str.Error
push dword [ebp - 0x14]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x509822
push esi
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push esi
mov ecx, 0x5de970
call fcn.0051c560
push esi
mov ecx, 0x5de840
call fcn.00515a90
mov edx, dword [ebp - 0x10]
or edi, 0xffffffff
add edx, 0xfffffff0
mov byte [ebp - 4], 0
mov eax, edi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x509845
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x18]
add ebx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x509866
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50a2a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x573c03
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d6b80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0x11
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xa
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x10], 0x3f400000
mov dword [esi + 0x14], 0x3e800000
mov dword [esi + 0x18], 0x40100000
mov dword [esi + 0x1c], 0x26
mov dword [esi + 0x20], 0
mov dword [esi], vtable.APNU::CConfig.0
mov dword [ebp - 4], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0x11
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0xa
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x40], 0x3f400000
mov dword [esi + 0x44], 0x3e800000
mov dword [esi + 0x48], 0x40100000
mov dword [esi + 0x4c], 0x26
mov dword [esi + 0x50], 0
mov eax, dword [ebp + 8]
mov dword [esi + 0x64], 1
mov byte [ebp - 4], 1
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0045a950
add esp, 4
add eax, 0x10
mov dword [esi + 0x68], eax
call fcn.0045adc0
mov ecx, eax
test ecx, ecx
jne 0x50a3b5
push 0x80004005
call fcn.0045a8f0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x6c], eax
call fcn.0045adc0
mov ecx, eax
test ecx, ecx
jne 0x50a3d5
push 0x80004005
call fcn.0045a8f0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x70], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x50a690
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574e78
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5d6b80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x50a86d
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x50a86d
push 1
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0x5c
push eax
mov ecx, esi
call fcn.0046bd70
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
mov ecx, eax
call fcn.0045a9c0
mov edx, dword [ebp - 0x1c]
test eax, eax
mov dword [ebp - 4], 0xffffffff
setne byte [ebp - 0xd]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x50a728
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xd], 0
je 0x50a739
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.0047f960
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0045b960
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x50a83b
push ecx
push eax
mov ecx, esi
call fcn.00472540
lea eax, [ebp - 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50a777
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00472540
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0045b960
mov ecx, dword [eax]
mov esi, dword [ebp - 0x18]
add esi, 0xfffffff0
mov byte [ebp - 4], 2
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x50a80a
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x50a7fb
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x50a7fb
push edx
call fcn.0045a950
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x50a7f3
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov dword [ebp - 0x18], eax
jmp 0x50a807
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0045b6e0
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x50a82a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jne 0x50a768
lea edx, [eax - 0x10]
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x50a859
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50b980
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x573e08
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5d6b80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x1c], 0
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
jne 0x50b9e9
push esi
push edi
push ebx
push dword [ebp + 8]
call fcn.0050c260
add esp, 0x10
test eax, eax
je 0x50b9e9
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x18]
mov ecx, edi
push 7
push str.0.0.0.0
mov dword [eax], 1
mov dword [esi], 0
call fcn.0045b6e0
call fcn.0045adc0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x50ba22
push 0x80004005
call fcn.0045a8f0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x10]
push dword [0x5d64bc]
push dword [0x5d64b8]
push 0x57a90c
push eax
call fcn.0045acb0
add esp, 0x14
call fcn.0045adc0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x50ba74
push 0x80004005
call fcn.0045a8f0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x1c], eax
lea eax, [ebp + 0x1c]
mov byte [ebp - 4], 1
push eax
push 0x2a
call fcn.004e32f0
add esp, 8
or esi, 0xffffffff
test eax, eax
jns 0x50bac0
lea eax, [ebp + 0x1c]
push eax
push 0x26
call fcn.004e32f0
add esp, 8
test eax, eax
jns 0x50bac0
push edi
mov ecx, edi
call fcn.0045a580
mov eax, dword [ebx]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
setne bl
jmp 0x50bb19
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.0050a690
push dword [0x5d64e8]
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00480bb0
add esp, 0x14
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0045a580
mov edx, dword [ebp - 0x14]
mov ecx, esi
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x50bb0f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
mov edi, dword [ebp + 0x1c]
mov edx, esi
add edi, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [edi + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x50bb39
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x50bb5a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50c070
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x5d6b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x418], eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x50c0b5
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525878
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x50c0df
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525878
mov esp, ebp
pop ebp
ret
lea eax, [edi + 1]
push esi
push eax
call fcn.005243ff
add esp, 4
mov esi, eax
lea eax, [ebp - 0x414]
push esi
push edi
push dword [ebp - 0x420]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x50c159
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x57e140
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x50c159
mov ecx, dword [ebp - 0x41c]
test ecx, ecx
je 0x50c159
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._u._u._u._u
push dword [ebp - 0x418]
call fcn.0045acb0
add esp, 0x18
mov ebx, 1
push esi
call fcn.00525873
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, ebx
xor ecx, ebp
pop esi
pop edi
pop ebx
call fcn.00525878
mov esp, ebp
pop ebp
ret
Function at 0x510d90
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5748dc
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x5d6b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x27c]
xorps xmm0, xmm0
push eax
movdqu xmmword [ebp - 0x27c], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x27c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.004cbfa0
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x26c]
call fcn.0050ecc0
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.004cc100
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x268]
call fcn.0050ecc0
push dword [ebp - 0x26c]
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or edi, 0xffffffff
cmp eax, edi
je 0x510efa
test al, 0x10
je 0x510efa
lea eax, [ebp - 0x268]
push 0x59c550
push eax
lea esi, [edi + 2]
call fcn.004713a0
add esp, 8
test al, al
je 0x510efc
mov eax, dword [ebp - 0x268]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x280], esp
mov esi, esp
push eax
call fcn.0045a950
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp - 0x26c]
mov esi, esp
add eax, 0xfffffff0
mov byte [ebp - 4], 3
push eax
call fcn.0045a950
add eax, 0x10
add esp, 4
mov dword [esi], eax
lea eax, [ebp - 0x264]
mov byte [ebp - 4], 2
push eax
call fcn.00516220
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, edi
jne 0x510ecd
xor esi, esi
jmp 0x510ed9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 1
mov edx, dword [ebp - 0x264]
mov ecx, edi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x510efc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x510efc
xor esi, esi
mov edx, dword [ebp - 0x268]
mov ecx, edi
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x510f1f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
mov dword [ebp - 0x264], ecx
lea eax, [ecx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x510f4b
mov ecx, dword [ecx]
push dword [ebp - 0x264]
mov edx, dword [ecx]
call dword [edx + 4]
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00525878
mov esp, ebp
pop ebp
ret 4
Function at 0x511820
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
or edx, 0xffffffff
push ebx
push esi
push edi
mov eax, dword [eax + 8]
mov ebx, ecx
mov edi, dword [ebp + 8]
test eax, eax
mov ecx, 0x7d0
mov byte [ebp - 1], 0
cmove ecx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [edi + 4]
mov dword [ebp + 8], esi
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
jne 0x511a12
cmp dword [edi + 4], 0
jle 0x51199e
push ecx
push 0
push dword [edi]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, eax
cmp esi, 0x102
je 0x5119e4
cmp esi, 0xffffffff
je 0x5119c6
mov edx, dword [ebx]
mov ecx, ebx
push 0
call dword [edx + 0xc]
test eax, eax
jne 0x5119d5
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax + 0x10]
test eax, eax
jne 0x5119af
mov ecx, dword [ebp + 8]
lea eax, [ecx - 2]
cmp esi, eax
jae 0x51198d
xor esi, esi
test eax, eax
je 0x51198d
test esi, esi
js 0x51199e
cmp esi, dword [edi + 4]
jge 0x51199e
mov eax, dword [edi]
cmp dword [eax + esi*4], 0
je 0x511981
push 0
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x51197e
mov ecx, dword [ebp + 0xc]
push esi
call fcn.0050f460
mov ecx, dword [ebp + 0xc]
cmp dword [eax + 0x24], 0
je 0x511937
lea eax, [ebp - 8]
push eax
push esi
call fcn.0050f460
mov ecx, eax
call fcn.004d72f0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x511929
test al, 0x10
jne 0x51192d
mov byte [ebp - 1], 1
lea ecx, [ebp - 8]
call fcn.0048ceb0
jmp 0x51196e
push esi
call fcn.0050f460
push eax
mov ecx, ebx
call fcn.0050f770
test eax, eax
je 0x51196e
mov ecx, dword [ebp + 0xc]
push esi
call fcn.0050f460
push eax
push 0xa
push ecx
mov ecx, dword [ebp + 0xc]
push esp
push esi
call fcn.0050f460
mov ecx, eax
call fcn.00510820
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
push esi
mov ecx, edi
call fcn.00524020
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov ecx, dword [ebp + 8]
inc esi
lea eax, [ecx - 2]
cmp esi, eax
jb 0x5118c4
cmp byte [ebp - 1], 0
jne 0x511a12
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
jmp 0x511851
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x511a12
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.Wait_failure_in_DirectoryMonitor
push 8
call fcn.0051ac70
add esp, 8
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor esi, esi
cmp dword [ebp - 0xc], esi
jle 0x511a12
xor edi, edi
lea ecx, [ecx]
test esi, esi
js 0x51199e
mov eax, dword [ebp + 0x14]
cmp esi, dword [eax + 8]
jge 0x51199e
mov eax, dword [eax + 4]
mov ecx, ebx
mov edx, dword [ebx]
add eax, edi
push eax
call dword [edx + 0x38]
inc esi
add edi, 0x4c
cmp esi, dword [ebp - 0xc]
jl 0x5119f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x514b90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567298
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5d6b80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
jne 0x514bd1
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x58f090
lea ecx, [ebp + 8]
call fcn.0045a3a0
push 0x580604
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.004b84c0
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x514bf7
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp + 8]
call fcn.00472540
mov esi, dword [ebp + 0xc]
mov ecx, 1
mov eax, dword [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0xa28
or eax, ecx
jge 0x514c35
push 0xa28
mov ecx, esi
call fcn.0045b530
push dword [esi]
push dword [ebp + 8]
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
mov ecx, dword [esi]
mov edi, eax
test ecx, ecx
je 0x514c65
push dword [ecx - 8]
push ecx
call fcn.00526d13
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x514cae
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x514cae
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov dword [ebp - 4], 0xffffffff
mov word [eax + ecx*2], dx
or ecx, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x514c9b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.0045a8f0
int3
Function at 0x517630
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x5d6b80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x23c]
mov esi, ecx
push eax
call fcn.00517b90
test eax, eax
je 0x5176df
xor eax, eax
mov dword [ebp - 0x120], 0x11c
push 0xfe
push eax
mov word [ebp - 0x10c], ax
lea eax, [ebp - 0x10a]
push eax
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
call fcn.00525ee0
xor eax, eax
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x5176df
cmp dword [ebp - 0x11c], 0xa
jne 0x5176df
cmp dword [ebp - 0x238], 0xa
jae 0x5176df
mov dword [esi + 0x12c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00525878
mov esp, ebp
pop ebp
ret

Function at 0x5176f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565dd8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5d6b80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0045adc0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x517734
push 0x80004005
call fcn.0045a8f0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.0047fb40
mov eax, dword [0x5d6240]
lea ecx, [ebp - 0x20]
mov ebx, dword [ebp - 0x10]
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 2
push dword [0x5d67d4]
mov dword [ebp - 0x18], 0
push reloc.WS2_32.dll_accept
call fcn.0045b220
mov esi, dword [ebp - 0x20]
mov edi, eax
test edi, edi
jne 0x5177ad
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push ebx
push 1
push 0
push dword [ebp - 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x5177b8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
xor ebx, ebx
test edi, edi
mov dword [ebp - 4], 0xffffffff
sete bl
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5177e3
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret