joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e4f00
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e380
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x634384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4e503d
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], 1
call fcn.0044c250
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
push 0x28
push ecx
mov ecx, eax
call fcn.0044c580
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x10
lea eax, [ebp - 0x30]
push eax
push 0
call fcn.0044b6a0
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 0
push dword [ebp - 0x44]
mov dword [ebp - 0x4c], vtable.Utils::Primitives::CDwHandleX_class_Utils::Primitives::SimpleHandleCloser_.0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4e4fef
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x4e4fe2
cmp eax, 0xffffffff
je 0x4e4fe2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x48], 0
push 4
push dword [ebp - 0x44]
call fcn.00539070
add esp, 8
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x54]
mov dword [ebp - 0x5c], vtable.Utils::Primitives::CDwHandleX_class_Utils::Primitives::SimpleHandleCloser_.0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4e5031
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x4e5024
cmp eax, 0xffffffff
je 0x4e5024
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x58], 0
push 4
push dword [ebp - 0x54]
call fcn.00539070
add esp, 8
cmp dword [ebp - 0x34], 0
je 0x4e503d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp + 8]
dec eax
cmp eax, 3
ja case.default.0x4e5046
jmp dword [eax*4 + 0x4e50c4]
push 0x80000000
push 0
push 1
push 0
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
mov esi, eax
jmp 0x4e50a3
push 0x80000000
push 1
push 1
push 0
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
mov esi, eax
jmp 0x4e50a3
push 1
push 1
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
mov esi, eax
jmp 0x4e50a3
push 1
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
mov esi, eax
jmp 0x4e50a3
push 0x57
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 1
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005395e6
mov esp, ebp
pop ebp
ret
Function at 0x4e5220
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e3eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x634384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x30]
mov byte [edi], 0
push 0
mov dword [edi + 4], 0
mov ecx, esi
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004e6160
mov dword [esi], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e5420
Capabilities:
Get number of processors
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e4bb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x634384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4e547e
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4e5479
push 0xfffffffffffffffd
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x14]
call edi
mov eax, dword [esi + 8]
test eax, eax
je 0x4e5488
push eax
call edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4e5492
push eax
call edi
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4e549c
push eax
call edi
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x30]
call fcn.004e5360
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4f0470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fld dword [ebx + edx*8 + 0xf]
mov bh, 0x47
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.004f025e
insd dword es:[edi], dx
out dx, al
rcl ah, 0x66
mov eax, dword [edi + 6]
cmp ax, bx
jbe 0x4f04b8
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x4f04b2
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x4f04a3
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004f025e
sbb dword [esi], edx
or edx, edx
lea eax, [ebp - 0x58]
push eax
call fcn.004f026e
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004f0223
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4f054c
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec

Function at 0x4f0560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
invalid
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004f025e
xchg ebx, eax
mov bl, 0xea
jae 0x4f052e
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x4f0f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x4f0f52
cmp dword [ebp - 0x398], 0
je 0x4f111c
cmp dword [ebp + 0xc], 1
je 0x4f111c
cmp dword [ebp + 0xc], 8
jne 0x4f10e4
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
invalid
invalid

Function at 0x4f1100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add al, 1
add byte [eax], al
lea eax, [ebp - 0x334]
push eax
push 0
invalid
xchg ebp, eax
invalid
Function at 0x4f1690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x4f16b4
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
or eax, 0xfffffc6c
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
invalid
invalid
jmp 0x4f165e
call fcn.004f025e
and byte [esi - 0x47], al
pop ebp
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.004f025e
mov dword [0x8d141079], eax
test esp, edx
clc
invalid
Function at 0x4f2fb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1128
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x634384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebx + 0x590]
lock bts dword [eax], 0
jb 0x4f310c
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 4
call fcn.004ed240
mov ecx, eax
call fcn.00432a50
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4f310c
cmp dword [ebx + 0x574], 0x10
lea edi, [ebx + 0x560]
mov ecx, edi
jb 0x4f3023
mov ecx, dword [edi]
lea edx, [ebp - 0x14]
push edx
push 0
lea edx, [ebp - 0x18]
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4f310c
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x4f3050
cmp eax, 2
jne 0x4f310c
mov eax, dword [ebp - 0x14]
cmp eax, 2
jb 0x4f310c
lea ecx, [ebp - 0xd]
inc eax
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004a9360
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
jb 0x4f3079
mov edi, dword [edi]
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 0
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4f30c3
lea edi, [ebx + 0x578]
push edi
push esi
call fcn.00432e40
add esp, 8
cmp dword [ebx + 0x588], 0
je 0x4f30c3
push edi
call fcn.0043c000
add esp, 4
mov ecx, edi
push 9
push str.dwengine
call fcn.00437860
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4f310c
mov ecx, dword [ebp - 0x20]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x4f30ed
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f3124
push ecx
push esi
call fcn.00539070
add esp, 8
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebx + 0x578]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00555b08
int3
Function at 0x4f5310
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, ecx
movzx edx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi]
shl edx, 8
or edx, eax
mov eax, dword [edi]
add eax, edx
mov dword [esp + 8], edx
cmp eax, edx
mov dword [edi], eax
movzx edx, byte [esi + 7]
sbb ecx, ecx
movzx eax, byte [esi + 6]
shl edx, 8
neg ecx
or edx, eax
movzx eax, byte [esi + 5]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 4]
shl edx, 8
or edx, eax
mov dword [esp + 0xc], edx
lea eax, [edx + ecx]
add dword [edi + 4], eax
cmp dword [edi + 4], edx
movzx edx, byte [esi + 0xb]
movzx eax, byte [esi + 0xa]
sbb ecx, ecx
shl edx, 8
neg ecx
or edx, eax
movzx eax, byte [esi + 9]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 8]
shl edx, 8
or edx, eax
mov dword [esp + 0x10], edx
lea eax, [edx + ecx]
add dword [edi + 8], eax
cmp dword [edi + 8], edx
movzx edx, byte [esi + 0xf]
movzx eax, byte [esi + 0xe]
sbb ecx, ecx
shl edx, 8
neg ecx
or edx, eax
movzx eax, byte [esi + 0xd]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 0xc]
shl edx, 8
or edx, eax
mov dword [esp + 0x14], edx
lea eax, [edx + ecx]
add dword [edi + 0xc], eax
cmp dword [edi + 0xc], edx
movzx edx, byte [esi + 0x13]
movzx eax, byte [esi + 0x12]
sbb ecx, ecx
shl edx, 8
neg ecx
or edx, eax
movzx eax, byte [esi + 0x11]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 0x10]
shl edx, 8
or edx, eax
mov dword [esp + 0x18], edx
lea eax, [edx + ecx]
add dword [edi + 0x10], eax
cmp dword [edi + 0x10], edx
movzx edx, byte [esi + 0x17]
movzx eax, byte [esi + 0x16]
sbb ecx, ecx
shl edx, 8
neg ecx
or edx, eax
movzx eax, byte [esi + 0x15]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 0x14]
shl edx, 8
or edx, eax
mov dword [esp + 0x1c], edx
lea eax, [edx + ecx]
add dword [edi + 0x14], eax
cmp dword [edi + 0x14], edx
movzx edx, byte [esi + 0x1b]
movzx eax, byte [esi + 0x1a]
sbb ecx, ecx
shl edx, 8
neg ecx
or edx, eax
movzx eax, byte [esi + 0x19]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 0x18]
shl edx, 8
or edx, eax
mov dword [esp + 0x20], edx
lea eax, [edx + ecx]
add dword [edi + 0x18], eax
cmp dword [edi + 0x18], edx
movzx ecx, byte [esi + 0x1f]
movzx eax, byte [esi + 0x1e]
sbb edx, edx
shl ecx, 8
neg edx
or ecx, eax
movzx eax, byte [esi + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x24], ecx
lea eax, [ecx + edx]
add dword [edi + 0x1c], eax
lea eax, [esp + 8]
push eax
lea eax, [edi + 0x20]
push eax
call fcn.004f54c0
mov eax, dword [esp + 0x38]
add esp, 8
add dword [edi + 0x40], eax
cmp dword [edi + 0x40], eax
jae 0x4f54b2
inc dword [edi + 0x44]
pop edi
pop esi
add esp, 0x20
ret 8
Function at 0x4fcde0
Capabilities:
Read file via mapping

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea esi, [edi + 8]
mov dword [edi + 0x10], 0
lea ebx, [edi + 0x10]
mov dword [esi], 0
lea ebp, [edi + 0x18]
mov dword [esi + 4], 0
mov dword [edi], 0
mov dword [edi + 0x14], 0
mov dword [ebp], 5
mov byte [edi + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x14]
push eax
push ebx
push esi
push dword [esp + 0x24]
call fcn.00484b90
mov ecx, eax
call fcn.004fa2f0
test al, al
je 0x4fceb2
cmp dword [ebx], 0
je 0x4fceb2
cmp byte [edi + 0x1c], 0
jne 0x4fce9b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea eax, [esp + 0x18]
push eax
push 4
push ebp
push 0x18
mov dword [esp + 0x28], 0
call esi
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
cmp dword [ebp], 1
je 0x4fce9b
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 1
push eax
push 0x18
call esi
push eax
call fcn.00445f80
add esp, 0x10
test eax, eax
setns al
mov byte [edi + 0x1c], al
push dword [edi + 0x14]
push 0
push 0
push 4
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi], eax
test eax, eax
jne 0x4fceb9
mov ecx, edi
call fcn.004fcf50
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x4fd020
Capabilities:
Read file via mapping

Disassembly:
push ecx
push ebx
push edi
mov edi, ecx
lea eax, [edi + 0x14]
push eax
lea ebx, [edi + 0x10]
push ebx
lea eax, [edi + 8]
push eax
push dword [esp + 0x1c]
call fcn.00484b90
mov ecx, eax
call fcn.004fa2f0
test al, al
je 0x4fd0be
cmp dword [ebx], 0
je 0x4fd0be
cmp byte [edi + 0x1c], 0
jne 0x4fd0a7
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 4
lea esi, [edi + 0x18]
push esi
push 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationThread]
cmp dword [esi], 1
pop esi
je 0x4fd0a7
push 4
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
push eax
push 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.00445f80
add esp, 0x10
test eax, eax
setns al
mov byte [edi + 0x1c], al
push dword [edi + 0x14]
push 0
push 0
push 4
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi], eax
test eax, eax
jne 0x4fd0c5
mov ecx, edi
call fcn.004fcf50
pop edi
pop ebx
pop ecx
ret 4
Function at 0x507ec0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a5bd8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x634384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00507c70
mov eax, dword [esi + 0x1a4]
test eax, eax
je 0x508023
mov ecx, ebx
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x507f26
test dl, dl
je 0x507f22
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x507f26
add ecx, 2
add eax, 2
test dl, dl
jne 0x507f06
xor eax, eax
jmp 0x507f2b
sbb eax, eax
or eax, 1
test eax, eax
je 0x508023
push ebx
mov ecx, esi
call fcn.00508740
mov edi, eax
test edi, edi
je 0x507f88
push edi
mov ecx, esi
call fcn.00508060
push edi
mov ecx, esi
mov ebx, eax
call fcn.00508060
test ebx, ebx
jne 0x507f60
test eax, eax
je 0x507f71
jmp 0x50803a
cmp ebx, 1
jne 0x50803a
cmp eax, ebx
jne 0x50803a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x50803a
or eax, 0xffffffff
jmp 0x50803c
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
push ebx
call fcn.00432e80
add esp, 8
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov ecx, esi
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00508060
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov edi, eax
cmovae ecx, dword [ebp - 0x28]
push ecx
mov ecx, esi
call fcn.00508060
test edi, edi
jne 0x507ffb
test eax, eax
je 0x508004
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0041ba60
jmp 0x50803a
cmp edi, 1
jne 0x507fea
cmp eax, edi
jne 0x507fea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x507fea
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0041ba60
or eax, 0xffffffff
jmp 0x50803c
cmp dword [esi + 0x1c4], 0
jne 0x507f80
mov dword [esi + 0x1c4], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005395e6
mov esp, ebp
pop ebp
ret 4

Function at 0x508060
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.0043c4c0
add esp, 4
push 0x80
push esi
test al, al
je 0x50808f
call fcn.00445690
push esi
call fcn.00445b50
add esp, 0xc
neg eax
sbb eax, eax
inc eax
pop esi
ret 4
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret 4
Function at 0x508850
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a5d08
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x634384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, edi
mov ecx, dword [esi + 0x1a4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5088a7
test dl, dl
je 0x5088a3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5088a7
add eax, 2
add ecx, 2
test dl, dl
jne 0x508887
xor eax, eax
jmp 0x5088ac
sbb eax, eax
or eax, 1
test eax, eax
jne 0x5088d4
cmp dword [esi + 0x1c4], eax
je 0x5088c0
or eax, 0xffffffff
jmp 0x508991
cmp dword [esi + 0x1ac], 0
je 0x5088d4
mov eax, dword [esi + 0x1c8]
jmp 0x508991
push edi
mov ecx, esi
call fcn.00508740
mov esi, eax
test esi, esi
je 0x508909
push esi
call fcn.0043c4c0
add esp, 4
push esi
test al, al
je 0x5088ff
call fcn.004455f0
add esp, 4
mov esi, eax
jmp 0x508986
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
jmp 0x508986
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.00432e80
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0043c4c0
add esp, 0xc
test al, al
lea eax, [ebp - 0x28]
je 0x508966
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004455f0
add esp, 4
jmp 0x508975
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0041ba60
or eax, 0xffffffff
cmp esi, 0xffffffff
cmove esi, eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005395e6
mov esp, ebp
pop ebp
ret 4
Function at 0x50c980
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6488
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x634384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, edi
mov ecx, dword [esi + 0x1a4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x50c9d7
test dl, dl
je 0x50c9d3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x50c9d7
add eax, 2
add ecx, 2
test dl, dl
jne 0x50c9b7
xor eax, eax
jmp 0x50c9dc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x50ca09
cmp dword [esi + 0x1c4], eax
je 0x50c9f0
or eax, 0xffffffff
jmp 0x50cada
cmp dword [esi + 0x1ac], 0
je 0x50ca09
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1c8], eax
xor eax, eax
jmp 0x50cada
push edi
mov ecx, esi
call fcn.00508740
mov esi, eax
test esi, esi
je 0x50ca4b
push esi
call fcn.0043c4c0
add esp, 4
push dword [ebp + 0xc]
push esi
test al, al
je 0x50ca39
call fcn.00445690
add esp, 8
neg eax
sbb eax, eax
jmp 0x50cada
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
sbb eax, eax
neg eax
dec eax
jmp 0x50cada
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.00432e80
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0043c4c0
add esp, 0xc
test al, al
lea eax, [ebp - 0x28]
push dword [ebp + 0xc]
je 0x50cab1
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00445690
add esp, 8
mov esi, eax
neg esi
sbb esi, esi
jmp 0x50cac9
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0041ba60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005395e6
mov esp, ebp
pop ebp
ret 8