joyce8/EMBER2024-capa huggingface dataset:
Function at 0xecd0d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
lea ebx, [ebp + 8]
mov eax, 0x1075c68
call fcn.00f4f878
mov word [ebp - 0x14], 8
push 0
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebx]
push edx
call fcn.00e645dc
add dword [ebp - 8], 6
mov eax, dword [ebx]
mov ecx, 0x1075f4c
mov edx, 0x1076154
add esp, 0x14
mov dword [eax + 8], ecx
mov ecx, dword [ebx]
mov dword [ecx + 0x30], edx
xor edx, edx
mov eax, dword [ebx]
or ecx, 0xffffffff
add eax, 0xc8
mov dword [eax + 4], edx
mov dword [eax], edx
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0xa4], edx
mov eax, dword [ebx]
mov dword [eax + 0xa0], edx
xor eax, eax
mov ecx, dword [ebx]
mov dword [ecx + 0xb4], eax
mov edx, dword [ebx]
mov dword [edx + 0xb0], eax
xor eax, eax
mov ecx, dword [ebx]
mov word [ecx + 0xba], ax
mov edx, dword [ebx]
mov word [edx + 0xb8], ax
xor eax, eax
mov ecx, dword [ebx]
mov dword [ecx + 0xac], eax
mov edx, dword [ebx]
mov dword [edx + 0xa8], eax
xor eax, eax
mov ecx, dword [ebx]
mov word [ecx + 0xbe], ax
mov edx, dword [ebx]
mov word [edx + 0xbc], ax
xor eax, eax
mov ecx, dword [ebx]
mov dword [ecx + 0xc4], eax
xor ecx, ecx
mov edx, dword [ebx]
mov dword [edx + 0xdc], ecx
mov eax, dword [ebx]
mov dword [eax + 0xd8], ecx
xor eax, eax
mov edx, dword [ebx]
mov dword [edx + 0xe0], eax
mov edx, dword [ebx]
and word [edx + 0xc0], 0xc03f
mov ecx, dword [ebx]
and byte [ecx + 0xc0], 0xfe
mov eax, dword [ebx]
and byte [eax + 0xc0], 0xfd
mov edx, dword [ebx]
and byte [edx + 0xc0], 0xfb
mov ecx, dword [ebx]
and byte [ecx + 0xc0], 0xf7
mov eax, dword [ebx]
and byte [eax + 0xc0], 0xef
mov edx, dword [ebx]
and byte [edx + 0xc0], 0xdf
mov ecx, dword [ebx]
and byte [ecx + 0xc1], 0xbf
push 2
mov eax, dword [ebx]
push eax
mov edx, dword [eax + 8]
call dword [edx + 0x5c]
add esp, 8
push 2
mov ecx, dword [ebx]
push ecx
mov eax, dword [ecx + 8]
call dword [eax + 0x60]
add esp, 8
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xedf834
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x107ab24
call fcn.00f4f878
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 0x18]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00edf768
add esp, 0xc
add dword [ebp - 8], 2
mov edx, 0x107ad50
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x30], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0x34], eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0xedfaac
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x107abc4
call fcn.00f4f878
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 0x24]
push edx
mov ecx, dword [ebp + 0x20]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00edf768
add esp, 0xc
add dword [ebp - 8], 2
mov edx, 0x107ad00
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x30], edx
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x34], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ecx + 0x3c], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov dword [edx + 0x40], ecx
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0xee827c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x107d3fc
call fcn.00f4f878
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 0x10]
push edx
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00e5138c
add dword [ebp - 8], 5
mov edx, dword [ebp + 8]
mov eax, 0x107d808
mov ecx, 0x107d998
add esp, 0x10
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], ecx
mov edx, dword [ebp + 8]
add edx, 0x88
push edx
call fcn.00e1bf70
pop ecx
add dword [ebp - 8], 2
mov ecx, dword [ebp + 8]
add ecx, 0xa8
push ecx
call fcn.00de08c4
pop ecx
inc dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0xac
push eax
call fcn.00de08c4
pop ecx
inc dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, 0xb0
push edx
call fcn.00de08c4
pop ecx
inc dword [ebp - 8]
push 0
push 0
mov ecx, dword [ebp + 8]
add ecx, 0xc8
push ecx
call fcn.00e42418
add dword [ebp - 8], 2
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, 0x100
xor edx, edx
mov dword [eax], edx
push 3
mov ecx, dword [ebp + 8]
add ecx, 0x88
push ecx
call fcn.00d7b760
add esp, 8
push 2
mov eax, dword [ebp + 8]
push eax
mov edx, dword [eax + 8]
call dword [edx + 0x48]
add esp, 8
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0xb4], eax
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 0xa0], ecx
mov dword [edx + 0xa4], ecx
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0xeeafd4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x107e444
call fcn.00f4f878
mov word [ebp - 0x14], 8
push 0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00e5138c
add dword [ebp - 8], 5
mov ecx, dword [ebp + 8]
mov edx, 0x10804a0
mov eax, 0x1080630
add esp, 0x10
mov dword [ecx + 8], edx
mov edx, dword [ebp + 8]
mov dword [edx + 0x30], eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x84], 0x64
mov eax, dword [ebp + 8]
mov dword [eax + 0x80], 0x64
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [edx + 0x88], 0x64
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x8c], eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0xef5364
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, 0x108426c
call fcn.00f4f878
mov word [ebp - 0x2c], 8
push ebx
call fcn.00e52210
mov edi, eax
pop ecx
lea ecx, [ebp - 0x18]
mov edx, dword [edi + 0x30]
push edx
push esi
push ecx
call fcn.00ef53dc
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
add dword [ebp - 0x20], 2
push ebx
call fcn.00ef5754
add esp, 8
sub dword [ebp - 0x20], 2
push 2
lea edx, [ebp - 0x18]
push edx
call fcn.00e1c360
add esp, 8
mov ecx, dword [ebx + 0x94]
mov dword [ecx + 4], esi
mov eax, dword [ebp - 0x3c]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xefdde0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 8], 3
je 0xefdf76
mov ecx, dword [edx]
xor ebx, ebx
mov dword [ebp - 4], ecx
xor esi, esi
test byte [edx + 8], 2
je 0xefde39
movzx edi, byte [eax]
xor ecx, ecx
mov cl, byte [edx + 9]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
movzx edi, byte [eax + 1]
xor ecx, ecx
mov cl, byte [edx + 9]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
xor ecx, ecx
movzx edi, byte [eax + 2]
inc ebx
mov cl, byte [edx + 9]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
jmp 0xefde49
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax + 3]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
test byte [edx + 8], 4
je 0xefde5f
xor ecx, ecx
mov cl, byte [edx + 9]
movzx eax, byte [eax + 4]
sub ecx, eax
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
xor ecx, ecx
lea eax, [ebp - 0x20]
cmp ebx, ecx
jle 0xefde7f
cmp dword [eax], 0
jg 0xefde73
xor edi, edi
mov dword [eax], edi
jmp 0xefde77
mov si, 1
inc ecx
add eax, 4
cmp ebx, ecx
jg 0xefde68
test si, si
je 0xefdf76
mov al, byte [edx + 9]
sub al, 2
je 0xefdea4
sub al, 2
je 0xefdec4
sub al, 4
je 0xefdeff
sub al, 8
je 0xefdf26
jmp 0xefdf76
mov ecx, dword [edx + 4]
mov eax, dword [ebp + 0xc]
xor edx, edx
cmp ecx, edx
jbe 0xefdf76
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0xefdeb4
jmp 0xefdf76
mov esi, dword [ebp - 0x20]
mov ebx, 0xf0
mov ecx, esi
mov edx, dword [edx + 4]
sar ebx, cl
mov ecx, esi
mov esi, 0xf
sar esi, cl
mov ecx, esi
and bl, 0xf0
or bl, cl
xor esi, esi
cmp edx, esi
mov eax, dword [ebp + 0xc]
jbe 0xefdf76
mov ecx, dword [ebp - 0x20]
inc esi
shr byte [eax], cl
and byte [eax], bl
inc eax
cmp edx, esi
ja 0xefdef0
jmp 0xefdf76
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
imul ebx
mov dword [ebp - 8], eax
xor esi, esi
cmp esi, dword [ebp - 8]
jae 0xefdf76
mov eax, esi
xor edx, edx
div ebx
mov ecx, dword [ebp + edx*4 - 0x20]
shr byte [edi], cl
inc edi
inc esi
cmp esi, dword [ebp - 8]
jb 0xefdf11
jmp 0xefdf76
mov edi, dword [ebp + 0xc]
mov eax, ebx
imul dword [ebp - 4]
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jae 0xefdf76
movzx esi, byte [edi]
shl esi, 8
xor eax, eax
mov al, byte [edi + 1]
xor edx, edx
add si, ax
mov eax, dword [ebp - 0xc]
div ebx
mov ecx, dword [ebp + edx*4 - 0x20]
shr si, cl
movzx eax, si
sar eax, 8
mov edx, esi
mov byte [edi], al
inc edi
and dl, 0xff
mov byte [edi], dl
inc edi
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jb 0xefdf3e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf0a9f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x10874cc
test edx, edx
jne 0xf0aa0e
xor eax, eax
jmp 0xf0aaf6
xor eax, 0xffffffff
cmp ebx, 8
jb 0xf0aad6
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
sub ebx, 8
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
mov eax, esi
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
cmp ebx, 8
mov eax, esi
jae 0xf0aa1a
test ebx, ebx
je 0xf0aaf3
movzx esi, byte [edx]
xor esi, eax
inc edx
and esi, 0xff
shr eax, 8
mov esi, dword [ecx + esi*4]
xor esi, eax
dec ebx
mov eax, esi
jne 0xf0aada
xor eax, 0xffffffff
pop esi
pop ebx
pop ebp
ret
Function at 0xf0b760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x24]
mov eax, dword [ebx + 0x34]
sub eax, dword [ebx + 0x6c]
sub eax, dword [ebx + 0x64]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xf0b795
cmp dword [ebx + 0x64], 0
jne 0xf0b795
cmp dword [ebx + 0x6c], 0
jne 0xf0b795
mov dword [ebp - 8], esi
jmp 0xf0b824
cmp dword [ebp - 8], 0xffffffff
jne 0xf0b7a3
dec dword [ebp - 8]
jmp 0xf0b824
mov edx, dword [ebx + 0x24]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x64]
ja 0xf0b824
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.00f4f2c0
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], edi
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0xf0b7f1
mov cx, word [ebp - 4]
sub cx, si
jmp 0xf0b7f3
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0xf0b7da
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0xf0b819
mov cx, word [ebp - 4]
sub cx, si
jmp 0xf0b81b
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0xf0b802
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0xf0b886
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x30]
add edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
push edx
push edi
call fcn.00f0b4f8
add esp, 0xc
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0xf0b871
mov ecx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x64]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0xf0b886
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0xf0b76f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0xf4eeec
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0xf506e8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0xf50707
mov eax, dword [0x109bff4]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0xf50714
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0xf50741
je 0xf50753
sub ecx, 0x100
je 0xf50761
sub ecx, 0x100
je 0xf50768
sub ecx, 0x100
je 0xf5075a
jmp 0xf5076f
sub ecx, 0x600
je 0xf50768
sub ecx, 0x100
je 0xf50753
jmp 0xf5076f
mov edi, 1
jmp 0xf50774
mov edi, 2
jmp 0xf50774
mov edi, 4
jmp 0xf50774
mov edi, 5
jmp 0xf50774
mov edi, 3
test byte [ebp + 0xd], 1
je 0xf5079b
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x109ba6c]
test al, 0x80
je 0xf50794
mov ebx, 0x80
jmp 0xf507ad
mov ebx, 1
jmp 0xf507ad
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0xf507ad
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0xf507bf
je 0xf507c8
dec eax
je 0xf507d1
jmp 0xf507da
mov dword [ebp - 4], 0x80000000
jmp 0xf507e9
mov dword [ebp - 4], 0x40000000
jmp 0xf507e9
mov dword [ebp - 4], 0xc0000000
jmp 0xf507e9
push 1
call fcn.00f51f54
pop ecx
mov ebx, eax
jmp 0xf508d5
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0xf50805
sub eax, 0x10
je 0xf5080c
sub eax, 0x10
je 0xf50815
sub eax, 0x10
je 0xf5081e
jmp 0xf5081e
xor edx, edx
mov dword [ebp - 8], edx
jmp 0xf50825
mov dword [ebp - 8], 1
jmp 0xf50825
mov dword [ebp - 8], 2
jmp 0xf50825
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0xf5088e
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0xf50883
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0xf50883
add ebx, 0xffffffb2
push ebx
call fcn.00f51f54
pop ecx
mov ebx, eax
jmp 0xf508d5
mov edi, esi
push edi
call fcn.00f50658
pop ecx
test eax, eax
je 0xf508a2
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0xf508ae
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00f51c98
add esp, 8
mov ebx, eax
inc eax
jne 0xf508d5
push 4
call fcn.00f51f54
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf50a7c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0xf50a9b
mov eax, dword [0x109bff4]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0xf50aa8
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0xf50ad5
je 0xf50ae7
sub ecx, 0x100
je 0xf50af5
sub ecx, 0x100
je 0xf50afc
sub ecx, 0x100
je 0xf50aee
jmp 0xf50b03
sub ecx, 0x600
je 0xf50afc
sub ecx, 0x100
je 0xf50ae7
jmp 0xf50b03
mov edi, 1
jmp 0xf50b08
mov edi, 2
jmp 0xf50b08
mov edi, 4
jmp 0xf50b08
mov edi, 5
jmp 0xf50b08
mov edi, 3
test byte [ebp + 0xd], 1
je 0xf50b2f
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x109ba6c]
test al, 0x80
je 0xf50b28
mov ebx, 0x80
jmp 0xf50b41
mov ebx, 1
jmp 0xf50b41
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
cmp eax, 0xffffffff
jne 0xf50b41
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0xf50b53
je 0xf50b5c
dec eax
je 0xf50b65
jmp 0xf50b6e
mov dword [ebp - 4], 0x80000000
jmp 0xf50b7d
mov dword [ebp - 4], 0x40000000
jmp 0xf50b7d
mov dword [ebp - 4], 0xc0000000
jmp 0xf50b7d
push 1
call fcn.00f51f54
pop ecx
mov ebx, eax
jmp 0xf50c69
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0xf50b99
sub eax, 0x10
je 0xf50ba0
sub eax, 0x10
je 0xf50ba9
sub eax, 0x10
je 0xf50bb2
jmp 0xf50bb2
xor edx, edx
mov dword [ebp - 8], edx
jmp 0xf50bb9
mov dword [ebp - 8], 1
jmp 0xf50bb9
mov dword [ebp - 8], 2
jmp 0xf50bb9
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp eax, 0xffffffff
jne 0xf50c22
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0xf50c17
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0xf50c17
add ebx, 0xffffffb2
push ebx
call fcn.00f51f54
pop ecx
mov ebx, eax
jmp 0xf50c69
mov edi, esi
push edi
call fcn.00f50658
pop ecx
test eax, eax
je 0xf50c36
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0xf50c42
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00f51c98
add esp, 8
mov ebx, eax
inc eax
jne 0xf50c69
push 4
call fcn.00f51f54
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xf50ec4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
cmp eax, 0xffffffff
jne 0xf50ee0
call fcn.00f51fb8
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0xf50efb
test bl, 1
je 0xf50efb
mov dword [0x109d36c], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0xf51024
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0xf51040
call fcn.00f51fb8
jmp 0xf510af
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0xf5105c
call fcn.00f51fb8
jmp 0xf510af
cmp dword [0x10a2708], 1
je 0xf510ad
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.00f59ec8
pop ecx
cmp al, 0x41
jl 0xf510ad
cmp al, 0x5a
jg 0xf510ad
cmp byte [ebp - 0x107], 0x3a
jne 0xf510ad
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0xf510ad
call fcn.00f51fb8
jmp 0xf510af
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0xf510e4
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push 0x104
call fcn.00f4e4a4
pop ecx
mov esi, eax
test eax, eax
jne 0xf51107
mov dword [0x109d36c], 8
or eax, 0xffffffff
jmp 0xf5114b
push esi
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
je 0xf510f8
cmp eax, 0x104
jg 0xf510f8
movsx ebx, byte [esi]
cmp byte [esi + 1], 0x3a
jne 0xf51142
mov edi, ebx
push edi
call fcn.00f56aa8
pop ecx
mov ebx, eax
cmp ebx, 0x41
jl 0xf51140
cmp ebx, 0x5a
jg 0xf51140
add ebx, 0xffffffc0
jmp 0xf51142
xor ebx, ebx
push esi
call fcn.00f4e4b4
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0xf51990
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp esi, dword [0x109bf24]
jb 0xf519b1
push 6
call fcn.00f51f54
pop ecx
jmp 0xf51a30
mov ebx, dword [esi*4 + 0x10a2404]
push 0x22
push 0
push edi
call fcn.00f4f330
add esp, 0xc
push ebx
call sub.KERNEL32.DLL_GetFileType
dec eax
je 0xf519de
dec eax
je 0xf519d6
dec eax
je 0xf51a28
jmp 0xf51a2e
mov word [edi + 4], 0x2000
jmp 0xf51a2e
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x10]
push ecx
push ebx
call sub.KERNEL32.DLL_GetFileTime
dec eax
je 0xf519fa
call fcn.00f51fb8
jmp 0xf51a30
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
push eax
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x10]
push ecx
xor eax, eax
test byte [esi*4 + 0x109bf29], 1
jne 0xf51a1c
inc eax
push eax
push edi
call fcn.00f5b9ec
add esp, 0x18
jmp 0xf51a2e
mov word [edi + 4], 0x1000
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf51a38
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.00f4e4a4
pop ecx
mov ebx, eax
test eax, eax
jne 0xf51a5c
xor eax, eax
jmp 0xf51b05
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
mov esi, eax
test esi, esi
je 0xf51a7d
cmp esi, 0x104
jb 0xf51a88
push ebx
call fcn.00f4e4b4
pop ecx
xor eax, eax
jmp 0xf51b05
cmp byte [ebx + 1], 0x3a
jne 0xf51ab8
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jae 0xf51ab8
push ebx
call fcn.00f4e4b4
pop ecx
xor eax, eax
jmp 0xf51b05
inc esi
test edi, edi
je 0xf51afb
cmp esi, dword [ebp + 0x10]
jbe 0xf51acd
push ebx
call fcn.00f4e4b4
pop ecx
xor eax, eax
jmp 0xf51b05
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.00f4e4b4
pop ecx
mov eax, edi
jmp 0xf51b05
push esi
push ebx
call fcn.00f4e4c4
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret