joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440f98
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
push 0x140
call fcn.0048a490
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x13c], edx
push 0x258
call fcn.0048a490
mov ebx, eax
mov eax, dword [ebp - 4]
pop ecx
mov dword [eax + 0x13c], ebx
cmp dword [ebp + 0xc], 8
jne 0x44105e
mov edx, dword [0x641ee4]
mov dword [ebp - 0xc], edx
push 3
mov ecx, dword [ebp + 8]
push ecx
lea eax, [ebp - 0xc]
push eax
call fcn.004c329c
add esp, 0xc
mov dword [ebx], 0xffffffff
cmp byte [ebp - 0xa], 0
jne 0x441005
mov byte [ebp - 0xa], 0x5c
push 0
lea edx, [ebp - 8]
push 0
push edx
push 0
push 0
lea ecx, [ebx + 0x14c]
push 0x104
push ecx
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x441057
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebx + 0x250]
push ecx
call fcn.00440a30
add esp, 8
mov esi, 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.00440b88
pop ecx
mov dword [ebx + 0x144], eax
jmp 0x44114b
xor esi, esi
jmp 0x44114b
mov eax, dword [ebp + 8]
push eax
call fcn.0050a120
pop ecx
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
call fcn.0048a490
pop ecx
mov edi, eax
mov dword [ebx], 0xffffffff
xor esi, esi
test edi, edi
je 0x44114b
push 0
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.004c28dc
add esp, 0xc
mov edx, dword [ebp - 0x10]
cmp byte [edi + edx - 1], 0x5c
jne 0x4410b3
push 0
push 0x641ee8
push edi
call fcn.004c2898
add esp, 0xc
lea ecx, [ebx + 4]
push ecx
push edi
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00440b88
pop ecx
mov dword [ebx + 0x144], eax
cmp dword [ebx], 0xffffffff
je 0x441144
mov eax, dword [ebx + 0x144]
test eax, eax
je 0x4410ef
cmp dword [ebx + 4], 0
je 0x4410ef
test byte [ebx + 4], 0x80
jne 0x4410ef
and eax, dword [ebx + 4]
je 0x4410f6
mov esi, 1
jmp 0x441144
mov eax, dword [ebx + 4]
test al, 0x10
jne 0x441107
mov edx, dword [ebx + 0x144]
and edx, eax
je 0x44110e
mov esi, 1
jmp 0x441144
xor esi, esi
jmp 0x441134
mov eax, dword [ebx + 0x144]
test eax, eax
je 0x44112d
cmp dword [ebx + 4], 0
je 0x44112d
test byte [ebx + 4], 0x80
jne 0x44112d
and eax, dword [ebx + 4]
je 0x441134
mov esi, 1
jmp 0x441144
lea eax, [ebx + 4]
push eax
mov edx, dword [ebx]
push edx
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x441112
push edi
call fcn.0048a558
pop ecx
push 0
push esi
call fcn.0043db18
add esp, 8
test esi, esi
je 0x441166
mov ecx, dword [ebp - 4]
push ecx
call fcn.00440dcc
pop ecx
jmp 0x441175
mov eax, dword [ebp - 4]
push eax
call fcn.004411f0
pop ecx
xor edx, edx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450dfc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x90], 2
jne 0x450e63
cmp dword [ebp - 0x9c], 5
jb 0x450e63
push str.winspool.drv
call sub.KERNEL32.DLL_LoadLibraryA
mov edi, eax
test edi, edi
je 0x450e63
push str.GetDefaultPrinterA
push edi
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x450e5d
push esi
mov edx, dword [ebp + 8]
push edx
call eax
mov ebx, eax
push edi
call sub.KERNEL32.DLL_FreeLibrary
test ebx, ebx
jne 0x450eb4
mov eax, dword [esi]
push eax
mov edx, dword [ebp + 8]
push edx
push 0x642948
push str.device
push str.windows
call sub.KERNEL32.DLL_GetProfileStringA
mov edx, eax
test edx, edx
je 0x450eb1
cmp edx, dword [esi]
jae 0x450eb1
xor edx, edx
mov eax, dword [ebp + 8]
jmp 0x450e95
inc edx
inc eax
mov cl, byte [eax]
test cl, cl
je 0x450ea0
cmp cl, 0x2c
jne 0x450e93
mov eax, dword [ebp + 8]
mov ebx, 1
mov byte [eax + edx], 0
inc edx
mov dword [esi], edx
jmp 0x450eb4
inc edx
mov dword [esi], edx
test ebx, ebx
jne 0x450f54
cmp dword [ebp - 0x90], 1
jne 0x450f54
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
push ecx
push 0
push 0
push 2
push 0
push 1
call sub.WINSPOOL.DRV_EnumPrintersA
test eax, eax
je 0x450f54
cmp dword [ebp - 4], 0
jbe 0x450f54
mov eax, dword [ebp - 4]
push eax
call fcn.0048a490
pop ecx
mov edi, eax
test edi, edi
je 0x450f54
lea eax, [ebp - 8]
lea edx, [ebp - 4]
push eax
push edx
mov ecx, dword [ebp - 4]
push ecx
push edi
push 2
push 0
push 1
call sub.WINSPOOL.DRV_EnumPrintersA
test eax, eax
je 0x450f4d
cmp dword [ebp - 8], 0
jbe 0x450f4d
mov eax, dword [edi + 4]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x450f4d
mov edx, dword [esi]
cmp edx, dword [ebp - 0xc]
jbe 0x450f4d
mov ecx, dword [edi + 4]
push ecx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_lstrcpyA
mov edx, dword [ebp - 0xc]
mov ebx, 1
inc edx
mov dword [esi], edx
push edi
call fcn.0048a558
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451504
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x45150d
mov eax, dword [ebp - 4]
add esp, 0xffffffec
push ebx
push esi
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.WINSPOOL.DRV_OpenPrinterA
test eax, eax
je 0x451627
mov ecx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0x8018], ecx
mov dword [ebp - 0x8014], eax
mov dword [ebp - 0x8010], 0x6429ba
lea edx, [ebp - 0x8018]
push edx
push 1
mov ecx, dword [ebp - 4]
push ecx
call sub.WINSPOOL.DRV_StartDocPrinterA
test eax, eax
je 0x451617
mov eax, dword [ebp - 4]
push eax
call sub.WINSPOOL.DRV_StartPagePrinter
test eax, eax
je 0x451607
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
mov edx, dword [ebp + 0xc]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x4515f7
jmp 0x4515c8
mov eax, dword [ebp - 8]
cmp byte [ebp + eax - 0x800d], 0x1a
jne 0x4515b0
dec dword [ebp - 8]
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x800c]
push edx
mov ecx, dword [ebp - 8]
push ecx
push eax
mov edx, dword [ebp - 4]
push edx
call sub.WINSPOOL.DRV_WritePrinter
lea ecx, [ebp - 8]
push 0
push ecx
lea eax, [ebp - 0x800c]
push 0x8000
push eax
push esi
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x4515ea
cmp dword [ebp - 8], 0
ja 0x4515a0
mov ebx, 1
push esi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4515fc
mov ebx, 0xfffffffa
mov eax, dword [ebp - 4]
push eax
call sub.WINSPOOL.DRV_EndPagePrinter
jmp 0x45160c
mov ebx, 0xfffffffc
mov eax, dword [ebp - 4]
push eax
call sub.WINSPOOL.DRV_EndDocPrinter
jmp 0x45161c
mov ebx, 0xfffffffd
mov eax, dword [ebp - 4]
push eax
call sub.WINSPOOL.DRV_ClosePrinter
jmp 0x45162c
mov ebx, 0xfffffffe
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x486754
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
cmp dword [0x66ff3c], 0
jne 0x4867c7
push esp
call sub.KERNEL32.DLL_GetSystemInfo
mov ebx, dword [esp + 4]
mov esi, dword [esp + 0x1c]
mov eax, esi
dec eax
test eax, esi
jne 0x48677e
mov edx, ebx
dec edx
test edx, ebx
je 0x486783
call fcn.00513270
mov dword [0x66ff44], esi
mov dword [0x66ff40], ebx
mov dword [0x66ff48], 0x40000
mov eax, 5
mov dword [0x66ff4c], 0x200000
mov dword [0x66ff50], eax
mov dword [0x670110], eax
call sub.KERNEL32.DLL_GetTickCount
xor eax, 0x55555555
or eax, 8
and eax, 0xfffffff8
mov dword [0x66ff3c], eax
mov eax, 1
add esp, 0x24
pop esi
pop ebx
ret

Function at 0x48a670
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
movzx eax, word [ebp + 8]
cmp eax, 0x68
jg 0x48a6d1
je 0x48a7c0
cmp eax, 4
jg 0x48a6b5
je 0x48a77e
sub eax, 1
jb 0x48a723
je 0x48a737
dec eax
je 0x48a756
dec eax
je 0x48a76a
jmp 0x48a82a
sub eax, 0x65
je 0x48a785
dec eax
je 0x48a79f
dec eax
je 0x48a7a9
jmp 0x48a82a
cmp eax, 0x3ec
jg 0x48a705
je 0x48a7e8
sub eax, 0x69
je 0x48a7c4
sub eax, 0x380
je 0x48a7c8
dec eax
je 0x48a7d0
dec eax
je 0x48a7d4
jmp 0x48a82a
sub eax, 0x3ed
je 0x48a802
dec eax
je 0x48a826
dec eax
je 0x48a7cc
jmp 0x48a82a
lea edx, [ebp - 0x20]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
shr eax, 0xa
jmp 0x48a82c
lea edx, [ebp - 0x40]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
cmp dword [ebp - 0x34], 0xffffffff
jae 0x48a74b
mov eax, dword [ebp - 0x34]
jmp 0x48a74e
or eax, 0xffffffff
shr eax, 0xa
jmp 0x48a82c
lea edx, [ebp - 0x60]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x54]
shr eax, 0xa
jmp 0x48a82c
lea edx, [ebp - 0x80]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x64]
shr eax, 0xa
jmp 0x48a82c
xor eax, eax
jmp 0x48a82c
lea edx, [ebp - 0xa0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x98]
shr eax, 0xa
jmp 0x48a82c
mov eax, 1
jmp 0x48a82c
lea edx, [ebp - 0xc0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0xac]
shr eax, 0xa
jmp 0x48a82c
xor eax, eax
jmp 0x48a82c
xor eax, eax
jmp 0x48a82c
xor eax, eax
jmp 0x48a82c
xor eax, eax
jmp 0x48a82c
xor eax, eax
jmp 0x48a82c
cmp dword [0x654684], 0
je 0x48a7e4
mov eax, dword [0x66e624]
jmp 0x48a82c
xor eax, eax
jmp 0x48a82c
cmp dword [0x654684], 0
je 0x48a7fe
mov eax, dword [0x66e624]
shl eax, 3
lea eax, [eax + eax*2]
jmp 0x48a82c
xor eax, eax
jmp 0x48a82c
cmp dword [0x654684], 0
je 0x48a822
mov eax, dword [0x66e61c]
sub eax, dword [0x66e618]
test eax, eax
jns 0x48a81d
add eax, 3
sar eax, 2
jmp 0x48a82c
xor eax, eax
jmp 0x48a82c
xor eax, eax
jmp 0x48a82c
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x491944
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push 0
call fcn.004912f4
add esp, 8
mov esi, eax
push 0
push esi
call fcn.0043c2f8
add esp, 8
mov ebx, eax
push esi
call fcn.0048a558
pop ecx
cmp ebx, 0xffffffff
jne 0x491a81
push str.I18N
push edi
push 0
call sub.KERNEL32.DLL_FindResourceA
test eax, eax
jne 0x491995
xor eax, eax
jmp 0x491b5c
push eax
push 0
call sub.KERNEL32.DLL_LoadResource
test eax, eax
jne 0x4919a8
xor eax, eax
jmp 0x491b5c
push eax
call sub.KERNEL32.DLL_LockResource
mov ebx, eax
push 0xac
push ebx
lea eax, [ebp - 0xac]
push eax
call fcn.004c1fd0
add esp, 0xc
lea eax, [ebp - 0xac]
mov edx, 0x6562ea
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4919ec
test cl, cl
je 0x491a1e
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4919ec
add eax, 2
add edx, 2
test cl, cl
jne 0x4919d0
je 0x491a1e
lea eax, [ebp - 0xac]
mov edx, 0x6562ef
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x491a15
test cl, cl
je 0x491a1e
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x491a15
add eax, 2
add edx, 2
test cl, cl
jne 0x4919f9
je 0x491a1e
xor eax, eax
jmp 0x491b5c
mov edx, dword [ebp - 4]
push edx
add ebx, 0xac
push ebx
call fcn.004916f8
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x491a7a
push 0xf
push edi
push 0x670244
call fcn.004c329c
add esp, 0xc
lea eax, [ebp - 0x75]
push 0x32
push eax
push 0x670254
call fcn.004c329c
add esp, 0xc
mov eax, dword [0x6562b0]
test eax, eax
je 0x491a6a
push eax
call fcn.0046b514
pop ecx
mov dword [0x6562b0], ebx
mov eax, 1
jmp 0x491b5c
xor eax, eax
jmp 0x491b5c
push 0xac
lea edx, [ebp - 0xac]
push edx
push ebx
call fcn.0043c80c
add esp, 0xc
cmp ax, 0xac
je 0x491aaa
push ebx
call fcn.0043c4a0
pop ecx
xor eax, eax
jmp 0x491b5c
lea eax, [ebp - 0xac]
mov edx, 0x6562ea
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x491ad1
test cl, cl
je 0x491b07
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x491ad1
add eax, 2
add edx, 2
test cl, cl
jne 0x491ab5
je 0x491b07
lea eax, [ebp - 0xac]
mov edx, 0x6562ef
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x491afa
test cl, cl
je 0x491b07
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x491afa
add eax, 2
add edx, 2
test cl, cl
jne 0x491ade
je 0x491b07
push ebx
call fcn.0043c4a0
pop ecx
xor eax, eax
jmp 0x491b5c
mov edx, dword [ebp - 4]
push edx
push ebx
call fcn.00491578
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x491b5a
push 0xf
push edi
push 0x670244
call fcn.004c329c
add esp, 0xc
lea ecx, [ebp - 0x75]
push 0x32
push ecx
push 0x670254
call fcn.004c329c
add esp, 0xc
mov eax, dword [0x6562b0]
test eax, eax
je 0x491b4d
push eax
call fcn.0046b514
pop ecx
mov dword [0x6562b0], ebx
mov eax, 1
jmp 0x491b5c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c1e28
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], edx
test eax, eax
jne 0x4c1e3d
xor eax, eax
jmp 0x4c1e74
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.0043d79c
add esp, 8
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4c1e59
test al, 0x50
je 0x4c1e5d
xor ebx, ebx
jmp 0x4c1e62
mov ebx, 1
cmp dword [ebp - 4], 0
je 0x4c1e72
mov eax, dword [ebp - 4]
push eax
call fcn.0048a558
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x4c1f0c
Capabilities:
Delete registry value
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push ebx
push edi
call sub.KERNEL32.DLL_SetEnvironmentVariableA
mov esi, eax
test esi, esi
je 0x4c1fc7
cmp dword [ebp + 0x10], 0
je 0x4c1fc7
xor esi, esi
test ebx, ebx
je 0x4c1f41
cmp byte [ebx], 0
jne 0x4c1f41
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push str.SystemCurrentControlSetControlSession_ManagerEnvironment
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4c1fc7
push 0
push 0
push 0
push 0
push edi
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4c1f7e
cmp eax, 2
jne 0x4c1fbe
test ebx, ebx
je 0x4c1fbe
test ebx, ebx
je 0x4c1f9c
push ebx
call fcn.0050a120
pop ecx
inc eax
push eax
push ebx
push 1
push 0
push edi
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegSetValueExA
jmp 0x4c1fa6
push edi
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegDeleteValueA
push 0x65b75d
push 0
push 0x1a
push 0xffff
call sub.USER32.DLL_SendMessageA
mov esi, 1
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4e12ec
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x65fe50
test edx, edx
jne 0x4e130b
xor eax, eax
jmp 0x4e1429
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4e1328
push esi
push edx
push eax
call fcn.004e1430
add esp, 0xc
jmp 0x4e1429
push esi
push edx
push eax
call fcn.004e16f0
add esp, 0xc
jmp 0x4e1429
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x500afc
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
lea ebx, [ebp + 8]
mov eax, 0x666ca4
call fcn.0050a4e0
mov word [ebp - 0x18], 0xc
mov edx, 0x667164
mov ecx, dword [ebx]
mov dword [ecx], edx
push 0x10
call fcn.0050550c
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x500b49
mov word [ebp - 0x18], 0x30
mov edx, dword [ebp - 4]
push edx
call fcn.00503d1c
pop ecx
mov word [ebp - 0x18], 0x24
mov ecx, dword [ebp - 4]
jmp 0x500b4c
mov ecx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [eax + 0x3c], ecx
mov word [ebp - 0x18], 0x18
mov eax, dword [ebx]
mov edx, dword [ebx]
add edx, 0xc
mov dword [eax + 0x14], edx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x10
mov dword [ecx + 0x18], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x1c
mov dword [edx + 0x24], eax
mov eax, dword [ebx]
mov ecx, dword [ebx]
add ecx, 0x20
mov dword [eax + 0x28], ecx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x2c
mov dword [ecx + 0x34], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x30
mov dword [edx + 0x38], eax
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x18]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x38]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x14]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x24]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x34]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x506304
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
lea ebx, [ebp + 8]
mov eax, 0x66807c
call fcn.0050a4e0
mov word [ebp - 0x18], 0xc
mov edx, 0x6683ec
mov ecx, dword [ebx]
mov dword [ecx], edx
push 0x10
call fcn.0050550c
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x506351
mov word [ebp - 0x18], 0x30
mov edx, dword [ebp - 4]
push edx
call fcn.00503d1c
pop ecx
mov word [ebp - 0x18], 0x24
mov ecx, dword [ebp - 4]
jmp 0x506354
mov ecx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [eax + 0x3c], ecx
mov word [ebp - 0x18], 0x18
mov eax, dword [ebx]
mov edx, dword [ebx]
add edx, 0xc
mov dword [eax + 0x14], edx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x10
mov dword [ecx + 0x18], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x1c
mov dword [edx + 0x24], eax
mov eax, dword [ebx]
mov ecx, dword [ebx]
add ecx, 0x20
mov dword [eax + 0x28], ecx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x2c
mov dword [ecx + 0x34], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x30
mov dword [edx + 0x38], eax
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x18]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x38]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x14]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x24]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x34]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x509b98
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x50b0fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x50b118
call fcn.0050c740
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x50b136
test bl, 1
je 0x50b136
mov dword [0x66a7ec], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x50b3ec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x50b40b
mov eax, dword [0x6694e0]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x50b418
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x50b445
je 0x50b457
sub ecx, 0x100
je 0x50b465
sub ecx, 0x100
je 0x50b46c
sub ecx, 0x100
je 0x50b45e
jmp 0x50b473
sub ecx, 0x600
je 0x50b46c
sub ecx, 0x100
je 0x50b457
jmp 0x50b473
mov edi, 1
jmp 0x50b478
mov edi, 2
jmp 0x50b478
mov edi, 4
jmp 0x50b478
mov edi, 5
jmp 0x50b478
mov edi, 3
test byte [ebp + 0xd], 1
je 0x50b49f
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x668f58]
test al, 0x80
je 0x50b498
mov ebx, 0x80
jmp 0x50b4b1
mov ebx, 1
jmp 0x50b4b1
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x50b4b1
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x50b4c3
je 0x50b4cc
dec eax
je 0x50b4d5
jmp 0x50b4de
mov dword [ebp - 4], SysStringLen
jmp 0x50b4ed
mov dword [ebp - 4], 0x40000000
jmp 0x50b4ed
mov dword [ebp - 4], 0xc0000000
jmp 0x50b4ed
push 1
call fcn.0050c6dc
pop ecx
mov ebx, eax
jmp 0x50b5dd
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x50b509
sub eax, 0x10
je 0x50b510
sub eax, 0x10
je 0x50b519
sub eax, 0x10
je 0x50b522
jmp 0x50b522
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x50b529
mov dword [ebp - 8], 1
jmp 0x50b529
mov dword [ebp - 8], 2
jmp 0x50b529
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x50b596
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x50b58b
test byte [ebp + 0xd], 1
je 0x50b586
mov ebx, 0x50
jmp 0x50b58b
mov ebx, 2
push ebx
call fcn.0050c6dc
pop ecx
mov ebx, eax
jmp 0x50b5dd
mov edi, esi
push edi
call fcn.0050b35c
pop ecx
test eax, eax
je 0x50b5aa
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x50b5b6
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0050c420
add esp, 8
mov ebx, eax
inc eax
jne 0x50b5dd
push 4
call fcn.0050c6dc
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x50bbec
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [ebp + 8]
lea edx, [ebp - 3]
add al, 0x40
mov byte [ebp - 3], al
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push edx
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x50bc14
call fcn.0050c740
pop ecx
pop ebp
ret
xor eax, eax
pop ecx
pop ebp
ret