joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529b70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x529ba1
dec al
je 0x529bdc
dec al
je 0x529c21
dec al
je 0x529c8a
jmp 0x529d14
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x529d14
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x529bb1
jmp 0x529d14
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x529d14
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x529bec
jmp 0x529d14
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x529d14
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x529c50
xor ebp, ebp
jmp 0x529c60
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x529c69
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x529c31
jmp 0x529d14
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x529d14
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x529ce3
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00526c00
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x529c9e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x534b18
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x534b69
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x534b50
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x534b40
jmp 0x534b69
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x534b51
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x549478
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5494a6
mov eax, ebx
call fcn.00549f2c
cmp dword [ebx + 0x40], 0
je 0x54949f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x549517
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x549509
cmp dword [ebx + 8], 0
je 0x5494c8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5494da
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x549509
cmp dword [ebx + 8], 0
je 0x5494bb
cmp eax, 3
je 0x5494ed
dec eax
jne 0x5494bb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5494bb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5494bb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x549535
cmp dword [ebx + 0x14], 0xcc
je 0x549535
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00549540
pop ebx
ret

Function at 0x55b93c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x55b9a0
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.00407af4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0041ee2c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55b9a7
lea eax, [ebp - 0x14]
call fcn.00406c58
ret
Function at 0x55c3d4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00406d3c
xor eax, eax
push ebp
push 0x55c580
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x55c50b
xor ebx, ebx
lea eax, [ebp - 0x268]
push eax
xor ecx, ecx
xor edx, edx
mov al, 1
call fcn.0051eed8
mov eax, dword [ebp - 0x268]
lea edx, [ebp - 8]
call fcn.00520978
lea eax, [ebp - 0xc]
mov edx, 0x55c59c
call fcn.00407080
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x26c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00407ca4
mov eax, dword [ebp - 0x26c]
call fcn.00407a50
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x55c4fa
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00407af4
mov ecx, dword [ebp - 0x270]
lea eax, [edi + 0xd0]
mov edx, dword [ebp - 8]
call fcn.00407ca4
call fcn.004296b8
push eax
mov ecx, dword [edi + 0xd0]
mov dl, 1
mov eax, dword [0x463d6c]
call fcn.00465524
mov esi, eax
mov edx, esi
mov eax, edi
call fcn.0055c720
mov ebx, eax
mov eax, esi
call fcn.00405180
test bl, bl
jne 0x55c4f1
lea eax, [ebp - 0x264]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x55c483
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindClose
test bl, bl
je 0x55c555
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00407038
jmp 0x55c555
lea eax, [edi + 0xd0]
mov edx, dword [ebp - 4]
call fcn.00407038
call fcn.004296b8
push eax
mov ecx, dword [edi + 0xd0]
mov dl, 1
mov eax, dword [0x463d6c]
call fcn.00465524
mov esi, eax
mov edx, esi
mov eax, edi
call fcn.0055c720
mov eax, esi
call fcn.00405180
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00407038
mov eax, edi
call fcn.0055ceb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c587
lea eax, [ebp - 0x270]
mov edx, 3
call fcn.00406cb8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406cb8
ret
Function at 0x55c5bc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x55c6e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 0x25c]
push eax
xor ecx, ecx
xor edx, edx
mov al, 1
call fcn.0051eed8
mov eax, dword [ebp - 0x25c]
lea edx, [ebp - 4]
call fcn.00520978
lea eax, [ebp - 8]
mov edx, 0x55c700
call fcn.00407080
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x260]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00407ca4
mov eax, dword [ebp - 0x260]
call fcn.00407a50
push eax
call sub.kernel32.dll_FindFirstFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x55c6a3
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00407af4
mov edx, dword [ebp - 0x264]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x55c6a3
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00407af4
mov edx, dword [ebp - 0x268]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x258]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x55c680
push ebx
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c6ec
lea eax, [ebp - 0x268]
mov edx, 4
call fcn.00406cb8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406cb8
ret
Function at 0x55d464
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406d3c
xor eax, eax
push ebp
push 0x55d5ec
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x55d4bf
lea eax, [ebp - 4]
push eax
mov edx, dword [esi + 0x68]
lea eax, [ebp - 0xc]
mov ecx, 0x55d608
call fcn.00407ca4
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi + 0x4c]
movzx eax, byte [esi + 0x48]
call fcn.0051eed8
xor edx, edx
push ebp
push 0x55d5b7
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0041f9d0
mov eax, dword [ebp - 0x10]
call fcn.0041f6a0
mov eax, dword [ebp - 4]
call fcn.00407a50
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00407aa0
mov eax, dword [ebp - 0x14]
call fcn.00407a50
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x55d56d
call sub.kernel32.dll_GetLastError
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00407a50
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00407aa0
mov eax, dword [ebp - 0x18]
call fcn.00407a50
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x55d567
test ah, 4
je 0x55d567
test al, 0x10
je 0x55d567
mov eax, dword [ebp - 4]
call fcn.00407a50
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.00407aa0
mov eax, dword [ebp - 0x1c]
call fcn.00407a50
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x55d56d
push edi
call sub.kernel32.dll_SetLastError
lea eax, [esi + 0xd0]
mov edx, dword [ebp - 4]
call fcn.00407038
call fcn.004296b8
push eax
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x463d6c]
call fcn.00465524
mov ebx, eax
mov edx, ebx
mov eax, esi
call fcn.0055d020
mov eax, ebx
call fcn.00405180
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00407038
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55d5c9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d5f3
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00406cb8
lea eax, [ebp - 4]
call fcn.00406c58
ret
Function at 0x55dfb4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x26c], edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x55e13d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
cmp byte [ebx + 0xb0], 0
je 0x55e025
lea eax, [ebp - 0x260]
push eax
xor ecx, ecx
xor edx, edx
mov al, 1
call fcn.0051eed8
mov eax, dword [ebp - 0x260]
lea edx, [ebp - 4]
call fcn.00520978
jmp 0x55e048
lea eax, [ebp - 0x264]
push eax
xor ecx, ecx
mov edx, dword [ebx + 0x4c]
movzx eax, byte [ebx + 0x48]
call fcn.0051eed8
mov eax, dword [ebp - 0x264]
lea edx, [ebp - 4]
call fcn.00520978
lea eax, [ebp - 8]
mov ecx, 0x55e15c
mov edx, dword [ebx + 0x68]
call fcn.00407ca4
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x268]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00407ca4
mov eax, dword [ebp - 0x268]
call fcn.00407a50
push eax
call sub.kernel32.dll_FindFirstFileW
mov edi, eax
cmp edi, 0xffffffff
je 0x55e112
mov ecx, ebx
mov dl, 1
mov eax, dword [0x559e68]
call fcn.0055e31c
mov esi, eax
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x230]
mov ecx, 0x104
call fcn.00407af4
mov ecx, dword [ebp - 0x270]
lea eax, [ebp - 0x26c]
mov edx, dword [ebp - 4]
call fcn.00407ca4
mov edx, dword [ebp - 0x26c]
mov eax, esi
call fcn.0055e66c
test al, al
je 0x55e0f4
mov edx, esi
mov eax, ebx
call fcn.0055be24
test al, al
je 0x55e0f4
mov byte [ebp - 9], 1
mov edx, esi
mov eax, dword [ebx + 0x64]
call fcn.0044538c
jmp 0x55e0fb
mov eax, esi
call fcn.00405180
lea eax, [ebp - 0x25c]
push eax
push edi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x55e08c
push edi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55e144
lea eax, [ebp - 0x270]
mov edx, 5
call fcn.00406cb8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406cb8
ret
Function at 0x55f558
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x55f6c2
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x55f584
call sub.kernel32.dll_GetUserDefaultLCID
mov esi, eax
mov eax, esi
call fcn.0055b93c
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], esi
xor eax, eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x18]
mov edx, 0x55f6dc
call fcn.00407038
lea ecx, [ebp - 4]
mov edx, 0x1002
mov eax, esi
call fcn.00522cf8
lea ecx, [ebp - 0x14]
mov edx, 0x1001
mov eax, esi
call fcn.00522cf8
push dword [ebp - 0x14]
push 0x55f714
push dword [ebp - 4]
push 0x55f728
lea eax, [ebx + 0x1c]
mov edx, 4
call fcn.00407d2c
lea ecx, [ebp - 0x18]
mov edx, 4
mov eax, esi
call fcn.00522cf8
push dword [ebp - 0x18]
push 0x55f714
lea ecx, [ebp - 0x1c]
mov edx, 8
mov eax, esi
call fcn.00522cf8
push dword [ebp - 0x1c]
push 0x55f728
lea eax, [ebx + 0x3c]
mov edx, 4
call fcn.00407d2c
call fcn.00421700
fstp qword [ebp - 0x10]
wait
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea ecx, [ebp - 8]
mov edx, dword [0x67d4a8]
mov eax, 0x55f738
call fcn.004224e8
lea eax, [ebx + 0x20]
mov ecx, dword [ebp - 8]
mov edx, 0x55f758
call fcn.00407ca4
lea eax, [ebx + 0x24]
mov edx, 0x55f7b0
call fcn.00407038
push 0x55f7e0
push dword [ebp - 4]
push 0x55f7f8
lea eax, [ebx + 0x34]
mov edx, 3
call fcn.00407d2c
mov eax, dword [ebx + 4]
push dword [eax + 0x68]
push dword [ebp - 4]
push 0x55f810
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00407d2c
mov edx, dword [ebp - 0x20]
mov eax, ebx
call fcn.0055f448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55f6c9
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00406cb8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406cb8
ret

Function at 0x586e40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
movzx ebx, word [0x586e80]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x586e5b
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x586e6b
or bx, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x586e7b
or bx, 2
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x5bd950
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x110], 6
jae 0x5bd97c
xor eax, eax
jmp 0x5bd97e
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x5bfe30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x5bfec4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [esi + 0x54], 1
jle 0x5bfeae
cmp byte [esi + 0x2c], 0
jne 0x5bfeae
cmp dword [esi + 0x70], 0xffffffff
jne 0x5bfe68
mov edx, dword [esi + 0x50]
mov eax, esi
call fcn.005bfc7c
mov dword [esi + 0x70], eax
lea edx, [ebp - 4]
mov eax, dword [esi + 0x50]
call fcn.0041ebe4
mov eax, dword [ebp - 4]
call fcn.00407a50
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [esi + 0x74]
add eax, eax
lea eax, [eax + eax*4]
cmp eax, dword [esi + 0x70]
jl 0x5bfeab
mov eax, esi
call fcn.005bfe1c
mov eax, esi
call fcn.005bf14c
mov edx, dword [esi + 0x50]
mov eax, esi
call fcn.005bfc7c
add dword [esi + 0x70], eax
mov bl, 1
inc dword [esi + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bfecb
lea eax, [ebp - 4]
call fcn.00406c58
ret

Function at 0x5c0e70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00407a50
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x5c0e89
test al, 0x10
jne 0x5c0e8d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x5caa94
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00407a50
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x5caab0
test al, 0x10
jne 0x5caab5
xor eax, eax
pop ebx
pop ebp
ret
mov al, 1
pop ebx
pop ebp
ret
Function at 0x5dcb28
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x67d828]
movzx eax, byte [eax]
xor al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x5dccb3
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x15], 0
xor eax, eax
push ebp
push 0x5dccac
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
jne 0x5dcbb2
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x5dcbb2
lea eax, [ebp - 0xc]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x5dcc72
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
mov eax, dword [0x67d10c]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
call fcn.00425f1c
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x5dcc02
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x5dcc07
call fcn.00425e78
mov eax, dword [ebp - 0x10]
call fcn.00404484
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
call fcn.00425f1c
mov eax, dword [ebp - 0x14]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x5dcc72
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x5dcc6e
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x10
cmp eax, 0x10
setne byte [ebp - 1]
jmp 0x5dcc72
inc ebx
dec esi
jne 0x5dcc3b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dccb3
cmp dword [ebp - 0x14], 0
je 0x5dcc8d
mov eax, dword [ebp - 0x14]
call fcn.004044d4
cmp byte [ebp - 0x15], 0
je 0x5dcc9c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
cmp dword [ebp - 8], 0
je 0x5dccab
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5ddc1c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x5ddc3a
push ebx
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x5ddc32
test al, 0x10
je 0x5ddc36
xor eax, eax
jmp 0x5ddc3c
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x5de264
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5de31a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00407a50
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x5de304
lea eax, [ebp - 4]
mov edx, edi
call fcn.00407bcc
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.00407a50
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x5de304
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5de32c
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x5de304
cmp dword [ebp - 0xc], 0x34
jne 0x5de304
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5de321
lea eax, [ebp - 4]
call fcn.00406c58
ret

Function at 0x5de394
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
test dl, dl
je 0x5de3a9
add esp, 0xfffffff0
call fcn.004056e4
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, edi
call fcn.005ddc1c
test al, al
jne 0x5de3df
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0x11
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [0x67cf24]
mov dl, 1
mov eax, dword [0x5dcf4c]
call fcn.00424214
call fcn.00406340
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.00407a50
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x5de412
mov ecx, dword [0x67d0d8]
mov dl, 1
mov eax, dword [0x5dcf4c]
call fcn.00424144
call fcn.00406340
lea eax, [ebx + 4]
xor ecx, ecx
mov edx, esi
call fcn.004076bc
mov eax, dword [ebx + 4]
call fcn.00407664
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, edi
call fcn.00407a50
push eax
call sub.version.dll_GetFileVersionInfoW
call fcn.00425f1c
mov eax, ebx
call fcn.005dec0c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5de45c
call fcn.0040573c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret