joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d1f5b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004bb510
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004ca0fc
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4d1f9d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4d20f9
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004dd850
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x58eea0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004cb5f8
mov ecx, dword [esi*4 + 0x58eea0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4d20f2
cmp eax, dword [edi + ecx + 0x24]
jne 0x4d20f2
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4d20f2
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004cb5f8
add esp, 0x14
test edx, edx
jl 0x4d20f2
jg 0x4d2068
test eax, eax
jb 0x4d20f2
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4d20f2
jl 0x4d2082
cmp dword [ebp - 0x1008], eax
ja 0x4d20f2
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4d20a0
test ebx, ebx
je 0x4d20d9
cmp ecx, edi
jae 0x4d20d9
mov al, byte [ecx]
cmp al, 0xd
jne 0x4d20ba
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4d20c6
cmp byte [ecx + 1], 0xa
jne 0x4d20c6
inc ecx
jmp 0x4d20c6
movzx eax, al
movsx eax, byte [eax + 0x58a280]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4d20a0
cmp edx, ebx
jne 0x4d20a0
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4d20f7
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004babe3
leave
ret

Function at 0x4d7396
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x561648
push 0x561640
push 0x561648
push 0x1e
call fcn.004d78f2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4d73ca
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x4d73d0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4d7414
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x56166c
push 0x561664
push 0x56166c
push 0x20
call fcn.004d78f2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4d744b
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4dd9b1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4dda4e
push ebx
push esi
call fcn.004dda9f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004dd8fa
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4dd9fb
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4dda4d
push edi
push eax
call fcn.00449a50
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4dda1b
call fcn.0049e7e0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4dda4c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004dd8fa
add esp, 0x20
test eax, eax
jne 0x4dda3a
push edi
call fcn.0049e7e0
jmp 0x4dda42
push ebx
call fcn.0049e7e0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4dda51
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4dda62
pop esi
ret
push ebx
push edi
push esi
call fcn.004dda9f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00449a50
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4dda8a
push ebx
push esi
push edi
call fcn.004bd2f0
add esp, 0xc
push 0
call fcn.0049e7e0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4ddae1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ddd4a

Function at 0x4e220e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e2219
Function at 0x4f1810
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x437e00
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
lea eax, [esi + 0x19]
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [edx + 4]
push 1
push ecx
push eax
call fcn.004fc1d0
add esp, 0x10
mov dword [esi + 8], esp
lea ebx, [esi + 0x20]
mov dword [ebx + 8], edi
mov dword [ebx + 4], edi
mov dword [ebx], edi
mov byte [ebx + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.004917b0
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0xd
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.0043a470
add esp, 0x1c
mov esp, dword [esi + 8]
lea edi, [esi + eax]
add edi, 0x20
push dword [ebp + 0x10]
push edi
push ebx
call fcn.004f1580
add esp, 0xc
mov dword [esi + 8], eax
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x30]
movdqu xmmword [ebx + 0x1e], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00491090
lea eax, [esi + 0x70]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
push edi
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.004f27d0
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x4f194b
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x78], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x78], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.004f2650
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x4f19f0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, esp
mov dword [esi + 0xa8], ebp
lea ecx, [esi + 0xb0]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x437e10
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
lea eax, [esi + 0x19]
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x20]
push dword [edx + 4]
push 1
push ecx
push eax
call fcn.004fc1d0
add esp, 0x10
mov dword [esi + 8], esp
lea ebx, [esi + 0x20]
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x10], edi
pcmpeqd xmm0, xmm0
movdqa xmmword [ebx], xmm0
sub esp, 0x20
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.004917b0
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0x18
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.0043a470
add esp, 0x20
mov esp, dword [esi + 8]
lea edi, [esi + eax]
add edi, 0x20
push dword [ebp + 0x10]
push edi
push ebx
call fcn.004f1580
add esp, 0xc
mov dword [esi + 8], eax
lea ebx, [esi + 0x40]
pcmpeqd xmm0, xmm0
movdqu xmmword [ebx + 0x4a], xmm0
movdqa xmmword [ebx + 0x40], xmm0
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00491090
lea eax, [esi + 0xb0]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
push edi
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.004f27d0
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x4f1b4e
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0xb8], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xb8], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x40]
push eax
push dword [ebp + 0xc]
push edi
call fcn.004f2650
add esp, 0x1c
mov eax, dword [esi + 0xb0]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x4f1c00
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x437e20
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor edx, edx
lea eax, [esi + 0x19]
mov dword [eax + 3], edx
mov dword [eax - 1], 0x25
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [ebx + 4]
push edx
push ecx
push eax
call fcn.004fc1d0
add esp, 0x10
mov dword [esi + 8], esp
lea ebx, [esi + 0x20]
mov dword [ebx + 8], edi
mov dword [ebx + 4], edi
mov dword [ebx], edi
mov byte [ebx + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.004917b0
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0xd
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.0043a470
add esp, 0x1c
mov esp, dword [esi + 8]
lea edi, [esi + eax]
add edi, 0x20
push dword [ebp + 0x10]
push edi
push ebx
call fcn.004f1580
add esp, 0xc
mov dword [esi + 8], eax
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x30]
movdqu xmmword [ebx + 0x1e], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00491090
lea eax, [esi + 0x70]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
push edi
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.004f27d0
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x4f1d3a
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x78], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x78], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.004f2650
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x4f1de0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, esp
mov dword [esi + 0xa8], ebp
lea ecx, [esi + 0xb0]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x437e30
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor edx, edx
lea eax, [esi + 0x19]
mov dword [eax + 3], edx
mov dword [eax - 1], 0x25
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x20]
push dword [ebx + 4]
push edx
push ecx
push eax
call fcn.004fc1d0
add esp, 0x10
mov dword [esi + 8], esp
lea eax, [esi + 0x20]
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], edi
pcmpeqd xmm0, xmm0
movdqa xmmword [eax], xmm0
mov ebx, eax
sub esp, 0x20
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.004917b0
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0x18
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.0043a470
add esp, 0x20
mov esp, dword [esi + 8]
lea ebx, [esi + eax]
add ebx, 0x20
push dword [ebp + 0x10]
push ebx
lea eax, [esi + 0x20]
push eax
call fcn.004f1580
add esp, 0xc
mov dword [esi + 8], eax
lea edi, [esi + 0x40]
pcmpeqd xmm0, xmm0
movdqu xmmword [edi + 0x4a], xmm0
movdqa xmmword [edi + 0x40], xmm0
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00491090
lea eax, [esi + 0xb0]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push edi
push ebx
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.004f27d0
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x4f1f42
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0xb8], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xb8], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x40]
push eax
push dword [ebp + 0xc]
push edi
call fcn.004f2650
add esp, 0x1c
mov eax, dword [esi + 0xb0]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x4ff470
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.004ba1be
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x4ff4c0
push ecx
push ecx
call fcn.004c6b9a
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4ff4af
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x502ad0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x58fde4], 0
je 0x502b08
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x58fdd0]
test esi, esi
je 0x502ba2
test byte [0x58bb30], 1
je 0x502af1
cmp byte [esi + 0xb], 0
jns 0x502b27
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x575410]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x58fde4], eax
inc eax
cmp eax, 1
ja 0x502af1
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.004bd870
add esp, 0xc
mov word [esi - 2], 0
lea edi, [ebp - 0x218]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x502c47
xor ebx, ebx
jmp 0x502af1
push 0xc
call fcn.004ba1be
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.004bd870
add esp, 0xc
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.004e8ff0
movzx eax, byte [esi + 0xb]
test al, al
jns 0x502bf7
mov eax, dword [esi + 4]
mov ecx, dword [esi]
jmp 0x502bfc
and eax, 0x7f
mov ecx, esi
test eax, eax
jne 0x502c19
mov ecx, esi
push 9
push 0x575478
call fcn.00439a00
mov dword [0x58fdd0], esi
jmp 0x502b16
lea edi, [eax + eax]
test edi, edi
je 0x502c00
lea edx, [edi - 2]
cmp word [ecx + edi - 2], 0x5c
mov edi, edx
jne 0x502c1c
cmp edx, 0xfffffffe
je 0x502c00
sar edx, 1
inc edx
cmp eax, edx
jb 0x502ce7
mov ecx, esi
push edx
call fcn.005028d0
jmp 0x502c00
mov esi, dword [0x58fdd0]
push edi
call fcn.004d43b4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00439700
mov ecx, dword [0x58fdd0]
call fcn.00437650
cmp word [eax], 0x5c
je 0x502c82
mov ecx, dword [0x58fdd0]
push 1
push 0x575474
call fcn.00439a00
mov ecx, dword [0x58fdd0]
push 9
push 0x575478
call fcn.00439a00
mov eax, dword [0x58fdd0]
cmp byte [eax + 0xb], 0
jns 0x502ca1
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x575410]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x58fde4], eax
inc eax
cmp eax, 1
ja 0x502af1
mov dword [0x58fde4], 0
jmp 0x502b9b
call fcn.004cc3d0
int3
Function at 0x5076b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x507722
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x507726
cmp byte [ebp + 0xc], 0
je 0x507702
cmp byte [esi + 4], 0
je 0x507777
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, esi
push edi
call fcn.00448cb0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [esi]
jmp 0x5076d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x50774c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x507750
xor ebx, ebx
jmp 0x50770c
mov eax, dword [esi]
jmp 0x507738
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x50777e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x507702
mov edi, dword [ebp - 0x14]
jmp 0x507702
mov eax, dword [esi]
jmp 0x5076f6
mov eax, dword [esi]
jmp 0x507763
Function at 0x521150
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp esi, ebx
je 0x5211a2
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.00532000
test al, al
jne 0x52118f
add esi, 0x58
cmp esi, ebx
jne 0x52117a
mov esi, ebx
mov eax, dword [ebp - 0x24]
cmp esi, dword [eax + 0x2c]
je 0x5211a2
cmp byte [esi + 0x1b], 0
jns 0x5211b9
mov eax, dword [esi + 0x10]
jmp 0x5211bc
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x5211a5
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x5211a5

Function at 0x521310
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp edi, ebx
je 0x52136d
mov dword [ebp - 0x24], ecx
lea esi, [ebp - 0x20]
mov ecx, edi
push esi
call fcn.00532000
test al, al
jne 0x52134f
add edi, 0x58
cmp edi, ebx
jne 0x52133a
mov edi, ebx
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x24]
cmp edi, dword [esi + 0x2c]
je 0x521370
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x521384
cmp byte [edi + 0x1b], 0
jns 0x521392
mov eax, dword [edi + 0x10]
jmp 0x521395
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
jmp 0x521370
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x521370
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x521370
mov byte [esi + 0x24], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor ebx, ebx
jmp 0x521370