joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f67f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x86a090
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x98b454]
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x38]
lea eax, [esp + 0x38]
push 0x92f11c
push eax
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], 0
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0
call fcn.005f19ce
mov ecx, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
add edi, 0x280
push ecx
push 0
push ebp
mov ecx, edi
mov byte [esp + 0x38], 1
call fcn.00828880
mov eax, dword [esi + 0x3c]
lea ecx, [esp + 0x38]
push eax
call fcn.00832082
mov eax, dword [esi + 0x10]
cmp eax, 4
je 0x4f6883
cmp eax, 3
jne 0x4f6890
mov eax, dword [esi + 0x14]
lea ecx, [esp + 0x38]
push eax
call fcn.00832082
mov edx, dword [esp + 0x38]
mov ecx, edi
push edx
push 1
push ebp
call fcn.00828880
mov eax, dword [esi + 0x48]
lea ecx, [esp + 0x38]
push eax
call fcn.00832082
mov eax, dword [esp + 0x38]
mov ecx, edi
push eax
push 2
push ebp
call fcn.00828880
mov eax, dword [esi + 0x58]
lea ecx, [esp + 0x38]
push eax
call fcn.00832082
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4f68e1
push 0x1fcb
lea ecx, [esp + 0x3c]
call fcn.008325e8
mov edx, dword [esp + 0x38]
mov ecx, edi
push edx
push 3
push ebp
call fcn.00828880
fld qword [esi + 0x20]
fst qword [esp + 0x10]
fcomp qword [0x894380]
fnstsw ax
test ah, 0x40
jne 0x4f6949
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.005f1526
lea edx, [esp + 0x34]
push 0x92f11c
push edx
lea ecx, [esp + 0x20]
call fcn.005f19ce
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 2
call fcn.00832032
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 1
call fcn.00831eeb
jmp 0x4f6957
push 0x9314d8
lea ecx, [esp + 0x3c]
call fcn.00832082
mov eax, dword [esp + 0x38]
mov ecx, edi
push eax
push 4
push ebp
call fcn.00828880
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x28]
push ecx
push edx
lea ecx, [esp + 0x20]
call fcn.005f1526
lea eax, [esp + 0x34]
push 0x92f11c
push eax
lea ecx, [esp + 0x20]
call fcn.005f19ce
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 3
call fcn.00832032
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 1
call fcn.00831eeb
mov ecx, dword [esp + 0x38]
push ecx
push 5
push ebp
mov ecx, edi
call fcn.00828880
mov esi, dword [esi + 0x34]
lea ecx, [esp + 0x38]
push esi
call fcn.00832082
mov edx, dword [esp + 0x38]
mov ecx, edi
push edx
push 6
push ebp
call fcn.00828880
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 0
call fcn.00831eeb
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00831eeb
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x4faca0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x86a964
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc0
push esi
mov esi, ecx
push 0x29
lea ecx, [esp + 8]
call fcn.004b5e30
lea ecx, [esp + 0x50]
mov dword [esp + 0xcc], 0
call fcn.004df100
lea eax, [esp + 0x50]
lea ecx, [esp + 4]
push eax
push ecx
mov ecx, 0x9cded8
mov byte [esp + 0xd4], 1
call fcn.004dd4b0
mov edx, dword [esp + 0x84]
mov dword [esi + 0x68], edx
lea ecx, [esp + 0xac]
mov byte [esp + 0xcc], 5
call fcn.00831eeb
lea ecx, [esp + 0x8c]
mov byte [esp + 0xcc], 4
call fcn.00636c90
lea ecx, [esp + 0x80]
mov byte [esp + 0xcc], 3
call fcn.00617ec0
lea ecx, [esp + 0x70]
mov byte [esp + 0xcc], 2
call fcn.0061ebe0
lea eax, [esp + 0x58]
mov dword [esp + 0x4c], eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0xcc], 7
call fcn.00831eeb
lea ecx, [esp + 0x68]
mov byte [esp + 0xcc], 6
call fcn.00831eeb
lea ecx, [esp + 0x50]
mov byte [esp + 0xcc], 0
call fcn.004b5e20
lea ecx, [esp + 4]
mov dword [esp + 0xcc], 0xffffffff
call fcn.004b5e20
push 0xffffffffffffffff
lea eax, [esi + 0xc]
push 0x7530
lea ecx, [esi + 4]
push 0
push eax
mov dword [eax], ecx
push 0
push 3
lea ecx, [esp + 0x24]
mov dword [esi + 8], esi
mov dword [esi + 0x10], 0x4139e0
call fcn.005794a0
lea edx, [esp + 0xc]
mov ecx, 0x9cf1a8
push edx
mov dword [esp + 0xd0], 8
call fcn.0057a890
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x2c], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x34], edx
mov edx, dword [esp + 0x28]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x48], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x40], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x54], ecx
mov ecx, dword [esp + 0x48]
mov dword [esi + 0x4c], edx
mov edx, dword [esp + 0x40]
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x44]
mov dword [esi + 0x60], ecx
lea ecx, [esp + 0xc]
mov dword [esi + 0x58], edx
mov dword [esi + 0x5c], eax
mov dword [esp + 0xcc], 0xffffffff
call fcn.00579500
mov ecx, dword [esp + 0xc4]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0xcc
ret
Function at 0x4faf50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x86a9d9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80
push esi
mov esi, dword [esp + 0x94]
mov dword [ecx + 0x68], esi
push 0x29
lea ecx, [esp + 0xc]
call fcn.004b5e30
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 0
call fcn.004df100
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, 0x9cded8
mov byte [esp + 0x94], 1
mov dword [esp + 0x4c], esi
call fcn.004dd8c0
lea ecx, [esp + 0x6c]
mov byte [esp + 0x8c], 5
call fcn.00831eeb
lea ecx, [esp + 0x4c]
mov byte [esp + 0x8c], 4
call fcn.00636c90
lea ecx, [esp + 0x40]
mov byte [esp + 0x8c], 3
call fcn.00617ec0
lea ecx, [esp + 0x30]
mov byte [esp + 0x8c], 2
call fcn.0061ebe0
lea edx, [esp + 0x18]
mov dword [esp + 4], edx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x8c], 7
call fcn.00831eeb
lea ecx, [esp + 0x28]
mov byte [esp + 0x8c], 6
call fcn.00831eeb
lea ecx, [esp + 0x10]
mov byte [esp + 0x8c], 0
call fcn.004b5e20
lea ecx, [esp + 8]
mov dword [esp + 0x8c], 0xffffffff
call fcn.004b5e20
mov ecx, dword [esp + 0x84]
pop esi
mov dword fs:[0], ecx
add esp, 0x8c
ret 4
Function at 0x4fb130
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x86aa44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc0
push esi
mov esi, ecx
push 0x4c
lea ecx, [esp + 8]
call fcn.004b5e30
lea ecx, [esp + 0x50]
mov dword [esp + 0xcc], 0
call fcn.004df100
lea eax, [esp + 0x50]
lea ecx, [esp + 4]
push eax
push ecx
mov ecx, 0x9cded8
mov byte [esp + 0xd4], 1
call fcn.004dd4b0
mov edx, dword [esp + 0x84]
mov dword [esi + 0x70], edx
lea ecx, [esp + 0xac]
mov byte [esp + 0xcc], 5
call fcn.00831eeb
lea ecx, [esp + 0x8c]
mov byte [esp + 0xcc], 4
call fcn.00636c90
lea ecx, [esp + 0x80]
mov byte [esp + 0xcc], 3
call fcn.00617ec0
lea ecx, [esp + 0x70]
mov byte [esp + 0xcc], 2
call fcn.0061ebe0
lea eax, [esp + 0x58]
mov dword [esp + 0x4c], eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0xcc], 7
call fcn.00831eeb
lea ecx, [esp + 0x68]
mov byte [esp + 0xcc], 6
call fcn.00831eeb
lea ecx, [esp + 0x50]
mov byte [esp + 0xcc], 0
call fcn.004b5e20
lea ecx, [esp + 4]
mov dword [esp + 0xcc], 0xffffffff
call fcn.004b5e20
push 0xffffffffffffffff
lea eax, [esi + 0xc]
push 0x2710
lea ecx, [esi + 4]
push 0
push eax
mov dword [eax], ecx
push 0
push 0
lea ecx, [esp + 0x24]
mov dword [esi + 8], esi
mov dword [esi + 0x10], 0x4139e0
call fcn.005794a0
lea edx, [esp + 0xc]
mov ecx, 0x9cf1a8
push edx
mov dword [esp + 0xd0], 8
call fcn.0057a890
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x2c], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x34], edx
mov edx, dword [esp + 0x28]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x48], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x40], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x54], ecx
mov ecx, dword [esp + 0x48]
mov dword [esi + 0x4c], edx
mov edx, dword [esp + 0x40]
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x44]
mov dword [esi + 0x60], ecx
lea ecx, [esp + 0xc]
mov dword [esi + 0x58], edx
mov dword [esi + 0x5c], eax
mov dword [esp + 0xcc], 0xffffffff
call fcn.00579500
mov ecx, dword [esp + 0xc4]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0xcc
ret
Function at 0x4fb420
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x86aab9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80
push esi
mov esi, dword [esp + 0x94]
mov dword [ecx + 0x70], esi
push 0x4c
lea ecx, [esp + 0xc]
call fcn.004b5e30
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 0
call fcn.004df100
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, 0x9cded8
mov byte [esp + 0x94], 1
mov dword [esp + 0x4c], esi
call fcn.004dd8c0
lea ecx, [esp + 0x6c]
mov byte [esp + 0x8c], 5
call fcn.00831eeb
lea ecx, [esp + 0x4c]
mov byte [esp + 0x8c], 4
call fcn.00636c90
lea ecx, [esp + 0x40]
mov byte [esp + 0x8c], 3
call fcn.00617ec0
lea ecx, [esp + 0x30]
mov byte [esp + 0x8c], 2
call fcn.0061ebe0
lea edx, [esp + 0x18]
mov dword [esp + 4], edx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x8c], 7
call fcn.00831eeb
lea ecx, [esp + 0x28]
mov byte [esp + 0x8c], 6
call fcn.00831eeb
lea ecx, [esp + 0x10]
mov byte [esp + 0x8c], 0
call fcn.004b5e20
lea ecx, [esp + 8]
mov dword [esp + 0x8c], 0xffffffff
call fcn.004b5e20
mov ecx, dword [esp + 0x84]
pop esi
mov dword fs:[0], ecx
add esp, 0x8c
ret 4

Function at 0x4fba10
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x86abe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
lea ecx, [esi + 8]
push eax
mov dword [esi + 0x1c], esi
mov dword [esi + 0x10], esi
call fcn.0063e7e0
call fcn.0064f790
push eax
lea ecx, [esi + 4]
call fcn.0064f650
push 0xffffffffffffffff
lea eax, [esi + 0x28]
push 0x2710
lea ecx, [esi + 0x18]
push 0
push eax
mov dword [eax], ecx
push 0
push 2
lea ecx, [esp + 0x1c]
mov dword [esi + 0x2c], 0x413a10
call fcn.005794a0
lea edx, [esp + 4]
mov ecx, 0x9cf1a8
push edx
mov dword [esp + 0x50], 0
call fcn.0057a890
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x48], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x50], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x58], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x54], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x64], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x5c], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x60], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x70], ecx
mov ecx, dword [esp + 0x40]
mov dword [esi + 0x68], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x6c], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x7c], ecx
lea ecx, [esp + 4]
mov dword [esi + 0x74], edx
mov dword [esi + 0x78], eax
mov dword [esp + 0x4c], 0xffffffff
call fcn.00579500
mov ecx, dword [esp + 0x44]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x4fd8e0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [ecx + 0x18]
sub esp, 0x208
push esi
lea esi, [ecx + 0x18]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4fd932
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
push 0x104
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 8]
mov ecx, esi
push edx
call fcn.006181a0
mov eax, esi
pop edi
pop esi
add esp, 0x208
ret
mov eax, esi
pop esi
add esp, 0x208
ret

Function at 0x4fdb10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
push ebx
mov ecx, edi
call fcn.00618070
mov eax, dword [edi]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
xor esi, esi
call ebp
cmp eax, 0xffffffff
je 0x4fdb6c
mov eax, dword [ebx]
push esi
push eax
push str._s__d
push edi
call fcn.0061aed0
add esp, 0x10
inc esi
cmp esi, 0x3e8
jae 0x4fdb61
mov eax, dword [edi]
push eax
call ebp
cmp eax, 0xffffffff
jne 0x4fdb36
cmp esi, 0x3e8
jne 0x4fdb6c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8

Function at 0x4fdb80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x86b068
push eax
mov dword fs:[0], esp
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
mov eax, dword [ebx]
xor edi, edi
cmp dword [eax - 8], edi
je 0x4fdc3e
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x4fdc3e
push eax
lea ecx, [esp + 0x24]
call fcn.00617650
mov esi, dword [esp + 0x24]
push ebx
mov ecx, esi
mov dword [esp + 0x1c], edi
call fcn.00618070
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test edi, edi
jne 0x4fdbf2
mov ecx, dword [esp + 0x20]
mov edx, dword [ebx]
push ecx
push edx
push 0x93a244
push esi
call fcn.0061aed0
add esp, 0x10
jmp 0x4fdc09
mov eax, dword [esp + 0x20]
mov ecx, dword [ebx]
push eax
push edi
push ecx
push 0x958bac
push esi
call fcn.0061aed0
add esp, 0x14
mov eax, dword [esi]
push eax
call ebp
cmp eax, 0xffffffff
je 0x4fdc1c
inc edi
cmp edi, 0x3e8
jb 0x4fdbd6
xor edx, edx
cmp edi, 0x3e8
setne dl
lea ecx, [esp + 0x20]
mov esi, edx
mov dword [esp + 0x18], 0xffffffff
call fcn.00617ec0
mov eax, esi
jmp 0x4fdc40
xor eax, eax
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x4fe660
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x86b128
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push esi
mov esi, ecx
call fcn.004fe770
mov edx, dword [esi + 0x6c]
push 0xffffffffffffffff
lea eax, [esi + 4]
push edx
lea ecx, [esi + 0x5c]
push 0
push eax
mov dword [eax], ecx
push 0
push 2
lea ecx, [esp + 0x1c]
mov dword [esi + 0x60], esi
mov dword [esi + 8], 0x4139e0
call fcn.005794a0
lea eax, [esp + 4]
mov ecx, 0x9cf1a8
push eax
mov dword [esp + 0x50], 0
call fcn.0057a890
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x30], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x34], edx
mov edx, dword [esp + 0x28]
mov dword [esi + 0x3c], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x40], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x48], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x4c], edx
mov edx, dword [esp + 0x40]
mov dword [esi + 0x54], ecx
lea ecx, [esp + 4]
mov dword [esi + 0x50], eax
mov dword [esi + 0x58], edx
mov dword [esp + 0x4c], 0xffffffff
call fcn.00579500
mov ecx, dword [esp + 0x44]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x50bf40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x86cde8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, ecx
mov dword [eax], 0
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
mov dword [ebp], 0
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ecx], 0
mov ecx, dword [esp + 0x34]
mov dword [edx], 0
push edi
mov dword [eax], 0
mov dword [ecx], 0
mov edx, dword [esi + 0x78]
push 2
push 0xffffffffffffffff
push 0x100c
push edx
mov dword [esp + 0x20], 0
call ebx
mov edi, eax
test edi, edi
jl 0x50c0eb
cmp edi, dword [esi + 0x4c4]
jge 0x50c0ba
mov eax, dword [esi + 0x4c0]
mov ebx, edi
shl ebx, 6
add eax, ebx
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x50c06d
mov eax, dword [ebp]
lea edx, [esp + 0x28]
inc eax
mov dword [ebp], eax
mov ecx, dword [esi + 0x4c0]
lea eax, [ecx + ebx]
mov ecx, dword [ecx + ebx + 0x14]
mov eax, dword [eax + 0x18]
push ecx
push eax
push edx
call fcn.00508340
add esp, 0xc
mov eax, dword [esp + 0x28]
mov ecx, 0x9ce3b8
push eax
mov dword [esp + 0x20], 0
call fcn.00523a60
test eax, eax
je 0x50c03e
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, 0x9ce3b8
call fcn.005239e0
test eax, eax
je 0x50c03e
mov eax, dword [esp + 0x38]
inc dword [eax]
mov ebx, dword [esp + 0x3c]
test ebx, ebx
je 0x50c05a
cmp dword [ebx], 0
jne 0x50c05a
mov edx, dword [esp + 0x28]
push edx
call fcn.0067b390
add esp, 4
mov dword [ebx], eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00831eeb
jmp 0x50c0ab
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x50c07a
mov eax, dword [esp + 0x2c]
jmp 0x50c0a9
mov ecx, 0x9ce3b8
call fcn.00528350
test eax, eax
je 0x50c0a5
mov eax, dword [esi + 0x4c0]
mov ecx, 0x9ce3b8
mov ebx, dword [eax + ebx + 0x18]
push ebx
call fcn.00528360
test eax, eax
mov eax, dword [esp + 0x34]
jne 0x50c0a9
mov eax, dword [esp + 0x24]
inc dword [eax]
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
inc eax
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 0x78]
push 1
push edi
push 0x102c
push ecx
call ebx
cmp eax, 1
jne 0x50c0d3
mov edx, dword [esp + 0x30]
mov dword [edx], eax
mov eax, dword [esi + 0x78]
push 2
push edi
push 0x100c
push eax
call ebx
mov edi, eax
test edi, edi
jge 0x50bfc0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x5111c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
mov edi, ecx
xor esi, esi
push esi
push esi
mov eax, dword [edi + 0x78]
push 0x1004
push eax
call ebx
test eax, eax
jle 0x511213
push ebp
lea ebp, [edi + 0x5c]
mov ecx, dword [edi + 0x78]
push 2
push esi
push 0x102c
push ecx
call ebx
xor eax, 2
push 2
push eax
push esi
mov ecx, ebp
call fcn.00828855
mov edx, dword [edi + 0x78]
push 0
push 0
push 0x1004
push edx
inc esi
call ebx
cmp esi, eax
jl 0x5111e2
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x511b00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x86d857
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
push edi
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], 0
call fcn.00831c58
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x20], 1
push ebp
call fcn.0048c580
add esp, 4
lea ecx, [esp + 0xc]
push eax
call fcn.00831f5f
mov eax, dword [esp + 0xc]
mov byte [esp + 0x20], 2
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x511b76
mov ecx, dword [edi]
lea edx, [esp + 0x2c]
push ecx
push eax
push 0x95c10c
push edx
call fcn.00826097
add esp, 0x10
mov eax, dword [0x9dce80]
test eax, eax
je 0x511be1
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
call fcn.00617650
mov esi, eax
mov eax, dword [edi]
lea ecx, [esp + 0x30]
push eax
mov byte [esp + 0x24], 3
call fcn.00617650
mov ecx, dword [esi]
mov edx, dword [eax]
push ecx
push edx
push ebp
push str.CSDDiskScanDlg::GetInterfaceFile_dwFlag_0x_x____s_______s_
push str.IPG_6010
push 0xffffffffffffffff
push 0x9dc5ec
mov byte [esp + 0x3c], 4
call fcn.006600d0
add esp, 0x1c
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 3
call fcn.00617ec0
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call fcn.00617ec0
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call fcn.00831c58
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call fcn.00831eeb
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call fcn.00831eeb
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x514370
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x86de62
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x8ab26c]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi + 0x14], eax
mov ecx, dword [0x8ab26c]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x20], ecx
mov edx, dword [0x8ab26c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x48], 0x893fcc
mov dword [esi + 0x4c], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
lea ecx, [esi + 0x5c]
mov byte [esp + 0x14], 3
call fcn.0061ebd0
mov dword [esi + 0x6c], 0x893f9c
mov dword [esi + 0x70], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x74], edi
lea ecx, [esi + 0x80]
mov byte [esp + 0x14], 5
call fcn.0082b045
lea ecx, [esi + 0x94]
mov byte [esp + 0x14], 6
call fcn.0061ebd0
lea ecx, [esi + 0xa4]
mov byte [esp + 0x14], 7
call fcn.0061ebd0
mov eax, dword [0x8ab26c]
mov dword [esi + 0xb8], eax
mov ecx, dword [0x8ab26c]
mov dword [esi + 0xc8], ecx
mov edx, dword [0x8ab26c]
mov dword [esi + 0xcc], edx
mov eax, dword [0x8ab26c]
mov dword [esi + 0xd0], eax
mov ecx, dword [0x8ab26c]
mov dword [esi + 0xd4], ecx
mov edx, dword [0x8ab26c]
mov dword [esi + 0xd8], edx
mov eax, dword [0x8ab26c]
mov dword [esi + 0xdc], eax
mov ecx, dword [0x8ab26c]
mov dword [esi + 0xe0], ecx
mov edx, dword [0x8ab26c]
mov dword [esi + 0xe4], edx
mov eax, dword [0x8ab26c]
mov dword [esi + 0xe8], eax
mov ecx, dword [0x8ab26c]
mov dword [esi + 0xec], ecx
mov edx, dword [0x8ab26c]
mov dword [esi + 0xf4], edx
mov eax, dword [0x8ab26c]
mov dword [esi + 0xf8], eax
lea ecx, [esi + 0xfc]
mov byte [esp + 0x14], 0x15
call fcn.0061ebd0
mov edx, esi
xor ecx, ecx
mov eax, 1
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x18], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0xc4], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x518490
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x86e438
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x14]
push eax
call fcn.00617650
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0
call fcn.00619280
push 0x945b4c
lea ecx, [esp + 0x18]
call fcn.00619100
cmp eax, 0xffffffff
je 0x51850a
push 0x945b78
lea ecx, [esp + 0x18]
call fcn.00619100
cmp eax, 0xffffffff
je 0x5184f7
push 0x93a338
push 0x945b78
jmp 0x518501
push 0x9b5220
push 0x945b4c
lea ecx, [esp + 0x1c]
call fcn.00619e90
mov eax, dword [esp + 0x14]
push esi
xor esi, esi
mov cx, word [eax]
cmp cx, 0x61
jb 0x51856f
cmp cx, 0x7a
ja 0x51856f
cmp word [eax + 2], 0x3a
jne 0x51856f
cmp word [eax + 4], 0x5c
jne 0x51856f
lea ecx, [esp + 4]
push 3
push ecx
lea ecx, [esp + 0x20]
call fcn.0061a690
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x51855d
cmp eax, 2
je 0x51855d
cmp eax, 5
je 0x51855d
cmp eax, 6
jne 0x518562
mov esi, 1
lea ecx, [esp + 4]
call fcn.00617ec0
mov eax, dword [esp + 0x18]
mov ecx, dword [0x9dce80]
test ecx, ecx
je 0x518594
push eax
push esi
push str.IsLocalFile_bRet__d__wstrFile__s_
push str.SDFileImp
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x18
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00617ec0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x518910
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x51892a
test al, 0x10
je 0x51892a
mov eax, 1
ret
xor eax, eax
ret