joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4be3ce
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
mov eax, dword [ebp + 0xc]
imul dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov edx, dword [0x7ceb60]
test edx, edx
je 0x4be534
mov eax, dword [ebp - 4]
xor edx, edx
add eax, dword [0x7ceb64]
adc edx, dword [0x7ceb68]
cmp edx, dword [0x7ceb70]
jne 0x4be411
cmp eax, dword [0x7ceb6c]
ja 0x4be440
jmp 0x4be413
jg 0x4be440
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 4]
push dword [ebp + 8]
push dword [0xa769c4]
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 4]
xor edx, edx
add dword [0x7ceb64], eax
adc dword [0x7ceb68], edx
jmp 0x4be54b
mov eax, dword [0x7ceb6c]
mov ecx, eax
mov eax, dword [0x7ceb64]
sub ecx, eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
test edx, edx
jbe 0x4be485
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 0x18]
push dword [ebp + 8]
push dword [0xa769c4]
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x4be555
mov ecx, dword [ebp - 0x18]
sub dword [ebp - 4], ecx
mov eax, dword [0xa769c4]
mov dword [ebp - 0x1c], eax
inc dword [0x7ceb74]
push dword [0x7ceb74]
push dword [0x8f2834]
push str._s._03i
lea edx, [ebp - 0x124]
push edx
call fcn.00670e94
add esp, 0x10
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x124]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov dword [0xa769c4], eax
mov eax, dword [0xa769c4]
cmp eax, 0xffffffff
jne 0x4be4e8
mov edx, dword [ebp - 0x1c]
mov dword [0xa769c4], edx
jmp 0x4be555
push dword [ebp - 0x1c]
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp - 4]
test ecx, ecx
jbe 0x4be51c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
add ecx, eax
push ecx
push dword [0xa769c4]
call sub.KERNEL32.DLL_WriteFile
jmp 0x4be521
xor edx, edx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [0x7ceb64], eax
mov dword [0x7ceb68], edx
jmp 0x4be54b
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 4]
push dword [ebp + 8]
push dword [0xa769c4]
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp eax, edx
je 0x4be572
mov ecx, dword [0x6f6920]
test ecx, ecx
jne 0x4be56e
call fcn.00462858
mov dword [0x6f6920], 1
xor eax, eax
jmp 0x4be575
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4c5910
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, dword [ebp + 0xc]
cdq
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [0x76ed24]
cdq
push edx
push eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
call fcn.006744e4
push edx
push eax
mov eax, dword [0x76ed2c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
jne 0x4c5977
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x4c5977
xor eax, eax
jmp 0x4c5a76
mov edx, dword [ebp + 0x14]
imul edx, dword [0x76ed24]
mov dword [ebp - 0x14], edx
mov ecx, dword [0x76ed24]
cmp ecx, 0x930
jne 0x4c59bb
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.KERNEL32.DLL_ReadFile
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
je 0x4c5a6f
xor eax, eax
jmp 0x4c5a76
push dword [ebp - 0x14]
call fcn.0066c210
pop ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
test edx, edx
jne 0x4c59ef
push 0x59fa
call fcn.00402a64
pop ecx
push eax
push dword [0x75f650]
call fcn.0046279c
add esp, 8
xor eax, eax
jmp 0x4c5a76
push 0
lea edx, [ebp - 0x18]
push edx
push dword [ebp - 0x14]
push dword [ebp - 0x24]
push dword [ebp + 8]
call sub.KERNEL32.DLL_ReadFile
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
je 0x4c5a1a
push dword [ebp - 0x24]
call fcn.0066c220
pop ecx
xor eax, eax
jmp 0x4c5a76
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
cmp eax, edx
jge 0x4c5a66
push 0x930
mov ecx, dword [ebp - 4]
imul ecx, dword [0x76ed24]
mov eax, dword [ebp - 0x24]
add ecx, eax
push ecx
imul edx, dword [ebp - 4], 0x930
mov ecx, dword [ebp - 0x28]
add edx, ecx
push edx
call fcn.0066c7fc
add esp, 0xc
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
cmp eax, edx
jl 0x4c5a2f
push dword [ebp - 0x24]
call fcn.0066c220
pop ecx
imul eax, dword [ebp + 0x14], 0x930
mov esp, ebp
pop ebp
ret
Function at 0x4c6088
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov eax, dword [ebp + 0xc]
cdq
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [0x76ed24]
cdq
push edx
push eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
call fcn.006744e4
push edx
push eax
mov eax, dword [0x76ed2c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [0x76ed28]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
jne 0x4c60fe
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x4c60fe
xor eax, eax
jmp 0x4c612c
mov dword [ebp - 0x14], 0x800
push 0
lea edx, [ebp - 0x18]
push edx
push dword [ebp - 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
je 0x4c6127
xor eax, eax
jmp 0x4c612c
mov eax, 0x800
mov esp, ebp
pop ebp
ret
Function at 0x4e8138
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4e814c
xor eax, eax
jmp 0x4e81b8
xor edx, edx
mov dword [ebp - 0x10], edx
lea ecx, [ebp - 4]
push ecx
push 0x7d226c
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x4e81b5
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 8]
push ecx
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4e81ad
push dword [ebp + 0xc]
push 0x7d2293
lea eax, [ebp - 0x110]
push eax
call fcn.00670f10
add esp, 0xc
mov dword [ebp - 0x10], 1
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x4e81bc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
mov eax, dword [0x6e713c]
test eax, eax
je 0x4e8230
mov edx, dword [ebp + 8]
test edx, edx
je 0x4e8230
lea ecx, [ebp - 4]
push ecx
push 0x7d2296
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x4e8230
push dword [ebp + 0xc]
push 0x7d22bd
lea eax, [ebp - 0x104]
push eax
call fcn.00670e94
add esp, 0xc
lea edx, [ebp - 0x104]
push edx
call fcn.0066ca1c
pop ecx
inc eax
push eax
lea ecx, [ebp - 0x104]
push ecx
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov esp, ebp
pop ebp
ret

Function at 0x4e8280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
push edx
push 0x7d22c0
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x4e82ee
mov dword [ebp - 0xc], 0x100
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 8]
push edx
push 0
push str.XPBurn
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4e82e6
lea ecx, [ebp - 0x10]
push ecx
push 0x7d22ee
lea eax, [ebp - 0x110]
push eax
call fcn.00670f10
add esp, 0xc
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x4e82f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
push edx
push 0x7d22f1
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x4e8366
mov dword [ebp - 0xc], 0x100
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 8]
push edx
push 0
push str.XPErase
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4e835e
lea ecx, [ebp - 0x10]
push ecx
push 0x7d2320
lea eax, [ebp - 0x110]
push eax
call fcn.00670f10
add esp, 0xc
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4e9170
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
xor eax, eax
mov dword [ebp - 0x14], eax
mov edx, dword [0x7d20a4]
test edx, edx
je 0x4e91b9
mov dword [ebp - 0x74], 0x40
lea ecx, [ebp - 0x74]
push ecx
call dword [0x7d20a4]
test eax, eax
je 0x4e91b9
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4e91df
lea eax, [ebp - 0x34]
push eax
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0
push 0x100000
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00674507
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
sar edx, 3
sub dword [ebp - 0x14], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x4eb17c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 4]
push edx
push str.SoftwareAheadShared
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x4eb202
mov dword [ebp - 0xc], 0x400
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x410]
push eax
lea edx, [ebp - 8]
push edx
push 0
push 0x7d2541
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4eb1fa
push 0
lea ecx, [ebp - 0x410]
push ecx
call fcn.0066e7cc
add esp, 8
test eax, eax
jne 0x4eb1fa
lea eax, [ebp - 0x410]
push eax
push 0xb2dbec
call fcn.0066c9ec
add esp, 8
mov dword [ebp - 0x10], 1
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x4eb2b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
call fcn.004eb20c
test eax, eax
je 0x4eb2c9
mov eax, 1
jmp 0x4eb327
call sub.KERNEL32.DLL_GetVersion
mov dword [ebp - 4], eax
mov dl, byte [ebp - 4]
and dl, 0xff
xor ecx, ecx
mov cl, dl
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp eax, 5
jb 0x4eb325
push 0x823144
push 0x7d2567
lea edx, [ebp - 0x110]
push edx
call fcn.00670e94
add esp, 0xc
push 0
lea ecx, [ebp - 0x110]
push ecx
call fcn.0066e7cc
add esp, 8
test eax, eax
jne 0x4eb325
mov dword [0x7d208c], 2
mov eax, 1
jmp 0x4eb327
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4ecc14
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x4ecc48
xor eax, eax
jmp 0x4ecd0d
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x100
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x114]
push ecx
lea eax, [ebp - 0xc]
push eax
push 0
push str.CurrentVersion
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x4ecc8d
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
jmp 0x4ecd0d
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x100
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x214]
push ecx
lea eax, [ebp - 0xc]
push eax
push 0
push str.CurrentBuild
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x4ecccf
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
jmp 0x4ecd0d
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._d._d
lea edx, [ebp - 0x114]
push edx
call fcn.00670f10
add esp, 0x10
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x14], ecx
push dword [ebp - 0x14]
call fcn.006749dc
pop ecx
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4f7a68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff638
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4f7a7f
xor eax, eax
jmp 0x4f7ca2
push 0x7d48f3
push dword [ebp + 8]
call fcn.0066ef18
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
test edx, edx
jne 0x4f7aa0
xor eax, eax
jmp 0x4f7ca2
push 0
push 0
push dword [ebp - 4]
call fcn.0066f298
add esp, 0xc
push dword [ebp - 4]
push 1
push 0x8c0
lea edx, [ebp - 0x8c4]
push edx
call fcn.0066f1f8
add esp, 0x10
cmp eax, 1
je 0x4f7add
push dword [ebp - 4]
call fcn.0066ea1c
pop ecx
xor eax, eax
jmp 0x4f7ca2
lea edx, [ebp - 0x8c4]
push edx
call fcn.0044b3f0
pop ecx
test eax, eax
jne 0x4f7afe
push dword [ebp - 4]
call fcn.0066ea1c
pop ecx
xor eax, eax
jmp 0x4f7ca2
xor edx, edx
mov dword [0x7d4888], edx
push 0x8243fb
push str._sprj_log.txt
lea ecx, [ebp - 0x9c8]
push ecx
call fcn.00670e94
add esp, 0xc
push 0x7d4905
lea eax, [ebp - 0x9c8]
push eax
call fcn.0066ef18
add esp, 8
mov dword [0x7d488c], eax
mov edx, dword [0x7d488c]
test edx, edx
je 0x4f7b7e
push dword [ebp + 8]
push str.Project:__s_n
push dword [0x7d488c]
call fcn.0066ef4c
add esp, 0xc
push 0x7d4916
push dword [0x7d488c]
call fcn.0066ef4c
add esp, 8
push 0x7d4940
push dword [0x7d488c]
call fcn.0066ef4c
add esp, 8
mov ecx, dword [0x6f6b68]
mov dword [ecx + 0x4c], 0x8c0
push dword [ebp - 4]
push dword [0x6f6b68]
call fcn.004f7956
add esp, 8
mov eax, dword [0x7d488c]
test eax, eax
je 0x4f7be7
push 0x7d4961
push dword [0x7d488c]
call fcn.0066ef4c
add esp, 8
mov edx, dword [0x7d4888]
test edx, edx
je 0x4f7bdb
push dword [0x7d4888]
push 0x7d4982
push dword [0x7d488c]
call fcn.0066ef4c
add esp, 0xc
push dword [0x7d488c]
call fcn.0066ea1c
pop ecx
mov ecx, dword [0x7d4888]
test ecx, ecx
je 0x4f7c78
mov eax, dword [0x7d488c]
test eax, eax
je 0x4f7c4c
push 0x61b3
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 8
push 0x9f2fb4
push 0
call fcn.00462810
add esp, 8
test eax, eax
je 0x4f7c78
push 5
push 0x8243fb
push 0
lea edx, [ebp - 0x9c8]
push edx
push 0x7d4997
push dword [0x6e716c]
call sub.SHELL32.DLL_ShellExecuteA
jmp 0x4f7c78
push 0x61b2
call fcn.00402a64
pop ecx
push eax
push 0x9f2fb4
call fcn.00670e94
add esp, 8
push 0x9f2fb4
push dword [0x6e716c]
call fcn.004627e0
add esp, 8
xor ecx, ecx
mov dword [0x7d488c], ecx
push 0x104
lea eax, [ebp - 0x313]
push eax
call fcn.004195c0
add esp, 8
push dword [ebp - 4]
call fcn.0066ea1c
pop ecx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4fb5ea
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcac
push dword [ebp + 8]
lea eax, [ebp - 0x354]
push eax
call fcn.0066c9ec
add esp, 8
push 0x7d5dc8
lea edx, [ebp - 0x354]
push edx
call fcn.0066c910
add esp, 8
lea ecx, [ebp - 0x14c]
push ecx
lea eax, [ebp - 0x354]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x4fb721
push 0x7d5dcd
lea edx, [ebp - 0x120]
push edx
call fcn.0066c9a0
add esp, 8
test eax, eax
je 0x4fb702
push 0x7d5dcf
lea ecx, [ebp - 0x120]
push ecx
call fcn.0066c9a0
add esp, 8
test eax, eax
je 0x4fb702
test byte [ebp - 0x14c], 0x10
je 0x4fb6c4
push dword [ebp + 8]
lea eax, [ebp - 0x250]
push eax
call fcn.0066c9ec
add esp, 8
push 0x7d5dd2
lea edx, [ebp - 0x250]
push edx
call fcn.0066c910
add esp, 8
lea ecx, [ebp - 0x120]
push ecx
lea eax, [ebp - 0x250]
push eax
call fcn.0066c910
add esp, 8
lea edx, [ebp - 0x250]
push edx
call fcn.004fb5ea
pop ecx
jmp 0x4fb702
inc dword [0x7d5cc8]
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x130]
mov dword [ebp - 8], eax
push 0
push 0x800
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
add eax, 0x800
adc edx, 0
sub eax, 1
sbb edx, 0
call fcn.00674507
add dword [0x7d5ccc], eax
lea edx, [ebp - 0x14c]
push edx
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x4fb638
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindClose
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x5098b8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov eax, dword [ebp + 8]
mov edx, dword [eax]
cmp edx, 4
jne 0x5098f0
push dword [0x6e7384]
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x238]
mov edx, dword [ebp + 0x10]
add eax, edx
push eax
push dword [ebp + 0xc]
call fcn.00476024
add esp, 0x10
jmp 0x5099da
mov ecx, dword [0x7d8064]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
imul dword [edx + 0xc]
cdq
mov ecx, dword [ebp + 8]
add eax, dword [ecx + 0x228]
adc edx, dword [ecx + 0x22c]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
cmp edx, 0xffffffff
jne 0x509944
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x509944
xor eax, eax
jmp 0x5099da
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
imul edx, dword [ecx + 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xc]
cmp edx, 0x930
jne 0x509975
push 0
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x20]
push dword [ebp + 0xc]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_ReadFile
jmp 0x5099d5
mov dword [ebp - 0x28], 0x85ac24
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x30]
call sub.KERNEL32.DLL_ReadFile
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x14]
cmp eax, edx
jge 0x5099d5
push 0x930
push dword [ebp - 0x28]
push dword [ebp - 0x24]
call fcn.0066c7fc
add esp, 0xc
add dword [ebp - 0x24], 0x930
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0xc]
add dword [ebp - 0x28], eax
inc dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x14]
cmp edx, ecx
jl 0x5099a5
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x50a134
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov eax, dword [ebp + 8]
add eax, 0x128
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 1
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x3b0], eax
mov edx, dword [ebp - 4]
mov ecx, dword [edx]
cmp ecx, 4
je 0x50a17d
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x280]
test edx, edx
je 0x50a18b
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x230]
mov dword [ebp - 0xc], eax
jmp 0x50a1ab
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
cdq
push edx
push eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x230]
mov edx, dword [ecx + 0x234]
call fcn.0067457f
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
sub eax, edx
imul ecx, eax, 0x930
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], ecx
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp + 8]
push dword [eax + 4]
push 0
push dword [ebp + 8]
push 0x5099e0
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov esp, ebp
pop ebp
ret
Function at 0x52dbe0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
mov eax, dword [ebp + 8]
test eax, eax
jne 0x52dbf7
xor eax, eax
jmp 0x52de66
push 0x204
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.0066c86c
add esp, 0xc
xor ecx, ecx
mov dword [0x7fe6cc], ecx
mov dword [0xbbf0a4], 1
mov dword [0xbbf0a0], 0x300
push dword [ebp + 8]
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x7fe6d0], eax
mov eax, dword [0x7fe6d0]
test eax, eax
jne 0x52dc46
xor eax, eax
jmp 0x52de66
push 1
push dword [0x7fe6d0]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbbf074], eax
mov edx, dword [0xbbf074]
test edx, edx
jne 0x52dc6e
call fcn.0052de6c
xor eax, eax
jmp 0x52de66
call dword [0xbbf074]
mov dword [0xbbf09c], eax
mov edx, dword [0xbbf09c]
cmp edx, 0xffffffff
je 0x52dc8f
mov ecx, dword [0xbbf09c]
cmp ecx, 0xfffffffe
jne 0x52dc9b
call fcn.0052de6c
xor eax, eax
jmp 0x52de66
push 3
push dword [0x7fe6d0]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbbf094], eax
mov edx, dword [0xbbf094]
test edx, edx
jne 0x52dcc3
call fcn.0052de6c
xor eax, eax
jmp 0x52de66
push 4
push dword [0x7fe6d0]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbbf078], eax
mov edx, dword [0xbbf078]
test edx, edx
jne 0x52dceb
call fcn.0052de6c
xor eax, eax
jmp 0x52de66
push 5
push dword [0x7fe6d0]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbbf07c], eax
mov edx, dword [0xbbf07c]
test edx, edx
jne 0x52dd13
call fcn.0052de6c
xor eax, eax
jmp 0x52de66
push 6
push dword [0x7fe6d0]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbbf098], eax
mov edx, dword [0xbbf098]
test edx, edx
jne 0x52dd3b
call fcn.0052de6c
xor eax, eax
jmp 0x52de66
push 7
push dword [0x7fe6d0]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbbf080], eax
mov edx, dword [0xbbf080]
test edx, edx
jne 0x52dd63
call fcn.0052de6c
xor eax, eax
jmp 0x52de66
push 8
push dword [0x7fe6d0]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbbf084], eax
mov edx, dword [0xbbf084]
test edx, edx
jne 0x52dd8b
call fcn.0052de6c
xor eax, eax
jmp 0x52de66
push 9
push dword [0x7fe6d0]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbbf08c], eax
mov edx, dword [0xbbf08c]
test edx, edx
jne 0x52ddb3
call fcn.0052de6c
xor eax, eax
jmp 0x52de66
push 0xa
push dword [0x7fe6d0]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbbf090], eax
mov edx, dword [0xbbf090]
test edx, edx
jne 0x52dddb
call fcn.0052de6c
xor eax, eax
jmp 0x52de66
push 0xd
push dword [0x7fe6d0]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0xbbf088], eax
mov edx, dword [0xbbf088]
test edx, edx
jne 0x52de00
call fcn.0052de6c
xor eax, eax
jmp 0x52de66
push 0xbbf0a0
call fcn.0052de8c
pop ecx
push 0xbbf0a4
call fcn.0052dee0
pop ecx
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x52de39
imul ecx, dword [ebp - 4], 0x118
add ecx, 0xbbcd74
push ecx
push dword [ebp - 4]
call fcn.0052e1d4
add esp, 8
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
mov edx, dword [0xbbf0a4]
cmp eax, edx
jl 0x52de1d
push 0xbbf0ac
call dword [0xbbf08c]
pop ecx
call fcn.0052e284
mov dword [0x7fe6cc], 1
mov eax, 1
mov esp, ebp
pop ebp
ret