joyce8/EMBER2024-capa huggingface dataset:
Function at 0x505580
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x753eb6
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x248], eax
push esi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x254]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x50565a
lea eax, [esp + 0x148]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp byte [esp + 0x148], 0
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
jne 0x5055fa
xor ecx, ecx
jmp 0x50560d
lea ecx, [esp + 0x148]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x505604
sub ecx, edx
push ecx
lea eax, [esp + 0x14c]
push eax
lea ecx, [esp + 0x30]
call fcn.00409620
mov dword [esp + 0x24], vtable.wbs::FileString.0
lea eax, [esp + 0x24]
mov dword [esp + 0x25c], 0
push eax
mov ecx, esi
call fcn.004f59b0
cmp dword [esp + 0x3c], 0x10
mov dword [esp + 0x24], vtable.wbs::StringBase_char_.0
jb 0x505702
push dword [esp + 0x28]
jmp 0x5056fa
cmp dword [esi + 0x18], 0x10
lea eax, [esi + 4]
mov dword [esp + 0x40], 0
jb 0x50566d
mov eax, dword [eax]
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x48]
push ecx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp byte [esp + 0x44], 0
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
jne 0x5056a3
xor ecx, ecx
jmp 0x5056b9
lea ecx, [esp + 0x44]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5056b0
sub ecx, edx
push ecx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x14]
call fcn.00409620
mov dword [esp + 8], vtable.wbs::FileString.0
lea eax, [esp + 8]
mov dword [esp + 0x25c], 1
push eax
mov ecx, esi
call fcn.004f59b0
cmp dword [esp + 0x20], 0x10
mov dword [esp + 8], vtable.wbs::StringBase_char_.0
jb 0x505702
push dword [esp + 0xc]
call fcn.006f75a9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x254]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x258
ret
Function at 0x505730
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x753efb
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x124], eax
push esi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x24]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp byte [esp + 0x24], 0
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
jne 0x50579a
xor ecx, ecx
jmp 0x5057aa
lea ecx, [esp + 0x24]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5057a1
sub ecx, edx
push ecx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.00409620
mov dword [esp + 8], vtable.wbs::FileString.0
lea eax, [esp + 8]
mov dword [esp + 0x138], 0
push eax
mov ecx, esi
call fcn.004f59b0
cmp dword [esp + 0x20], 0x10
mov dword [esp + 8], vtable.wbs::StringBase_char_.0
jb 0x5057f3
push dword [esp + 0xc]
call fcn.006f75a9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x134
ret
Function at 0x5059e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x753f81
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x184]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 0x104
jae 0x505aee
test eax, eax
je 0x505aee
cmp byte [esp + 0x184], 0
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
jne 0x505a65
xor ecx, ecx
jmp 0x505a79
lea ecx, [esp + 0x184]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x505a70
sub ecx, edx
push ecx
lea eax, [esp + 0x188]
push eax
lea ecx, [esp + 0x1c]
call fcn.00409620
mov dword [esp + 0x10], vtable.wbs::FileString.0
lea eax, [esp + 0x10]
mov dword [esp + 0x294], 2
push eax
mov ecx, esi
call fcn.004f59b0
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x10], vtable.wbs::StringBase_char_.0
jb 0x505ac5
push dword [esp + 0x14]
call fcn.006f75a9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x288
ret
push 0xac
lea eax, [esp + 0xdc]
push 0
push eax
call fcn.006f87a0
add esp, 0xc
call fcn.004f68c0
mov ebx, eax
call fcn.004f68c0
mov edi, eax
call fcn.004f68c0
mov esi, eax
call fcn.004f68c0
push ebx
push edi
push esi
push eax
push 0x3ea
lea ecx, [esp + 0xec]
call fcn.004f91a0
mov dword [esp + 0xd8], vtable.wbs::FileException.0
mov dword [esp + 0x17c], 0xf
mov dword [esp + 0x178], 0
mov byte [esp + 0x168], 0
mov dword [esp + method.wbs::StringBase_char_.virtual_0], vtable.wbs::FileString.0
mov dword [esp + 0x180], 0
push 5
push str._TEMP
lea ecx, [esp + 0x1c]
mov dword [esp + 0x29c], 0
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.00409620
mov dword [esp + 0x10], vtable.wbs::FileString.0
lea eax, [esp + 0x10]
mov byte [esp + 0x294], 1
push eax
lea ecx, [esp + 0x168]
call fcn.004f59b0
cmp dword [esp + 0x28], 0x10
mov byte [esp + 0x294], 0
mov dword [esp + 0x10], vtable.wbs::StringBase_char_.0
jb 0x505be7
push dword [esp + 0x14]
call fcn.006f75a9
add esp, 4
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0x30]
call fcn.00503d70
push 0x7d9928
lea eax, [esp + 0x30]
push eax
call fcn.006f7cb3
int3

Function at 0x507a20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x754d68
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
push dword [esp + 0x34]
lea ecx, [esp + 0xc]
call fcn.00503eb0
mov ecx, dword [esi + 0x70]
lea edx, [esp + 8]
push dword [esp + 0x3c]
mov dword [esp + 0x30], 0
push dword [esp + 0x3c]
mov eax, dword [ecx]
push edx
call dword [eax + 0x20]
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0061b700
mov ecx, esi
call fcn.00507aa0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 0xc
Function at 0x507f00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x754d68
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
push dword [esp + 0x34]
lea ecx, [esp + 0xc]
call fcn.00503eb0
mov ecx, dword [esi + 0x70]
lea edx, [esp + 8]
push dword [esp + 0x38]
mov dword [esp + 0x30], 0
push edx
mov eax, dword [ecx]
call dword [eax + 0x24]
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0061b700
mov ecx, esi
call fcn.00507f80
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 0xc

Function at 0x508580
Capabilities:
Query service status

Disassembly:
mov ecx, 0x852d00
jmp fcn.00514e20

Function at 0x5092e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7544f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004f74d0
mov ecx, esi
mov dword [esp + 0x14], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
call fcn.00509610
test al, al
jne 0x509382
mov ecx, esi
call fcn.00509450
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x5097e0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x1c], 0xffffffff
jne 0x5097f8
call fcn.00509af0
test al, al
jne 0x5097f8
pop esi
pop ebx
ret
push dword [esi + 0x1c]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x509820
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
push esi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
ret
Function at 0x509af0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x75466c
mov eax, dword fs:[0]
push eax
sub esp, 0x1a4
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x1b8]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x14], 0
mov byte [esp + 0x17], 0
jne 0x509b3f
xor al, al
jmp 0x509d01
mov eax, dword [edi + 0x20]
cmp dword [eax + 4], 0
je 0x509b38
mov eax, dword [eax + 0x18]
push 0
push 2
call eax
mov ebp, eax
cmp ebp, 0xffffffff
je 0x509b38
mov dword [esp + 0x8c], 0x128
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
lea ecx, [esp + 0x8c]
mov eax, dword [edi + 0x20]
push ecx
push ebp
mov dword [esp + 0x20], ebx
mov eax, dword [eax + 0x1c]
call eax
test eax, eax
je 0x509cf6
push 1
lea eax, [esp + 0x74]
mov ecx, edi
push eax
call fcn.00504a30
mov ecx, dword [esp + 0x84]
mov esi, dword [sym.imp.USER32.dll_CharUpperBuffA]
mov dword [esp + 0x1c0], 0
test ecx, ecx
je 0x509bd0
cmp dword [esp + 0x88], 0x10
lea eax, [esp + 0x74]
push ecx
cmovae eax, dword [esp + 0x78]
push eax
call esi
jmp 0x509bd0
cmp ebx, dword [esp + 0x94]
je 0x509cb3
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x58]
call fcn.00503eb0
mov ecx, dword [esp + 0x68]
mov byte [esp + 0x1c0], 1
test ecx, ecx
je 0x509c10
cmp dword [esp + 0x6c], 0x10
lea eax, [esp + 0x58]
push ecx
cmovae eax, dword [esp + 0x5c]
push eax
call esi
push 1
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x78]
call fcn.00504a30
mov byte [esp + 0x1c0], 2
test eax, eax
je 0x509c31
lea esi, [eax + 4]
jmp 0x509c33
xor esi, esi
push 1
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x5c]
call fcn.00504a30
mov byte [esp + 0x1c0], 3
test eax, eax
je 0x509c54
lea ecx, [eax + 4]
jmp 0x509c56
xor ecx, ecx
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x509c61
mov esi, dword [esi]
push eax
push esi
push dword [ecx + 0x10]
push 0
call fcn.00404d40
test eax, eax
mov byte [esp + 0x1c0], 2
lea ecx, [esp + 0x38]
sete bl
call fcn.0061b700
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c0], 1
call fcn.0061b700
mov byte [esp + 0x1c0], 0
lea ecx, [esp + 0x54]
test bl, bl
jne 0x509cce
call fcn.0061b700
mov ebx, dword [esp + 0x18]
mov esi, dword [sym.imp.USER32.dll_CharUpperBuffA]
mov eax, dword [edi + 0x20]
lea ecx, [esp + 0x8c]
push ecx
push ebp
mov eax, dword [eax + 0x20]
call eax
test eax, eax
jne 0x509bd0
jmp 0x509ce2
mov eax, dword [esp + 0x94]
mov dword [edi + 0x1c], eax
mov byte [esp + 0x17], 1
call fcn.0061b700
lea ecx, [esp + 0x70]
mov dword [esp + 0x1c0], 0xffffffff
call fcn.0061b700
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x1b0
ret
Function at 0x509da0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x10
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x1c], 0xffffffff
jne 0x509dc3
call fcn.00509af0
test al, al
je case.default.0x509de4
mov eax, dword [esi + 0x1c]
xorps xmm0, xmm0
movq qword [esp + 8], xmm0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
cmp eax, 3
ja case.default.0x509de4
jmp dword [eax*4 + 0x509e58]
mov dword [esp + 0xc], 0x10
jmp 0x509e0f
mov dword [esp + 0xc], 0x112
mov dword [esp + 0x10], 0xf060
jmp 0x509e0f
mov dword [esp + 0xc], 0x12
lea eax, [esp + 8]
push eax
push 0x509e70
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pop esi
mov al, cl
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x10
ret 4
mov ecx, dword [esp + 0x14]
xor al, al
pop esi
pop ebx
xor ecx, esp
call fcn.006f7ca4
add esp, 0x10
ret 4

Function at 0x50a0f0
Capabilities:
Copy file

Disassembly:
mov edx, dword [esp + 4]
add edx, 4
cmp dword [edx + 0x14], 0x10
jb 0x50a0ff
mov edx, dword [edx]
cmp dword [ecx + 0x1c], 0x10
lea eax, [ecx + 8]
jb 0x50a10a
mov eax, dword [eax]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
setne al
ret 4
Function at 0x50a680
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x7547ed
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x298], eax
push ebx
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x2ac]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x2bc]
lea ecx, [esp + 0xdc]
call fcn.00503f10
cmp dword [esi + 0x14], 0
mov dword [esp + 0x2b4], 0
jne 0x50a6ee
lea ecx, [esp + 0xdc]
call fcn.005059e0
jmp 0x50a722
push esi
lea ecx, [esp + 0x18]
call fcn.00503e70
lea eax, [esp + 0x14]
mov byte [esp + 0x2b4], 1
push eax
lea ecx, [esp + 0xe0]
call fcn.00503f80
lea ecx, [esp + 0x14]
mov byte [esp + 0x2b4], 0
call fcn.0061b700
cmp dword [esp + 0xf4], 0x10
lea ecx, [esp + 0x1a4]
push ecx
push 0
lea eax, [esp + 0xe8]
cmovae eax, dword [esp + 0xe8]
push 0x78b528
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x50a85b
push 0xac
push eax
lea eax, [esp + 0x100]
push eax
call fcn.006f87a0
add esp, 0xc
call fcn.004f68c0
mov ebx, eax
call fcn.004f68c0
mov edi, eax
call fcn.004f68c0
mov esi, eax
call fcn.004f68c0
push ebx
push edi
push esi
push eax
push 0x3ee
lea ecx, [esp + 0x10c]
call fcn.004f91a0
lea ecx, [esp + 0x184]
mov byte [esp + 0x2b4], 2
mov dword [esp + 0xf8], vtable.wbs::FileException.0
call fcn.00503f10
mov dword [esp + 0x1a0], 0
lea eax, [esp + 0xdc]
mov byte [esp + 0x2b4], 3
push eax
lea ecx, [esp + 0x188]
call fcn.00503f80
lea eax, [esp + 0xf8]
push eax
lea ecx, [esp + 0x34]
call fcn.004f8f10
lea ecx, [esp + 0xbc]
mov byte [esp + 0x2b4], 4
mov dword [esp + 0x30], vtable.wbs::FileException.0
call fcn.00503f10
lea eax, [esp + 0x184]
mov byte [esp + 0x2b4], 5
push eax
lea ecx, [esp + 0xc0]
mov dword [esp + 0xdc], 0
call fcn.00503f80
mov eax, dword [esp + 0x1a0]
mov dword [esp + 0xd8], eax
lea eax, [esp + 0x30]
push 0x7d9928
push eax
mov byte [esp + 0x2bc], 3
call fcn.006f7cb3
lea eax, [esp + 0x1a4]
push eax
lea ecx, [esp + 0x18]
call fcn.00503eb0
lea eax, [esp + 0x14]
mov byte [esp + 0x2b4], 6
push eax
lea ecx, [edi + 4]
call fcn.00503f80
lea ecx, [esp + 0x14]
mov byte [esp + 0x2b4], 0
call fcn.0061b700
push ecx
mov eax, esp
mov ecx, edi
mov dword [eax], 3
call fcn.0050af90
lea ecx, [esp + 0xdc]
mov dword [esp + 0x2b4], 0xffffffff
call fcn.0061b700
mov al, 1
mov ecx, dword [esp + 0x2ac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x298]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x2a8
ret 4

Function at 0x50a8f0
Capabilities:
Delete file

Disassembly:
add ecx, 8
cmp dword [ecx + 0x14], 0x10
jb 0x50a8fb
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
ret
Function at 0x50ad10
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x754937
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x194], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x1ac]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x1bc]
call fcn.0050ab60
mov esi, eax
mov ecx, ebp
lea eax, [esp + 0xe0]
push eax
call fcn.005043e0
cmp dword [esp + 0xf8], 0x10
lea eax, [esp + 0xe4]
mov dword [esp + 0x1b4], 0
cmovae eax, dword [esp + 0xe4]
add esi, 4
cmp dword [esi + 0x14], 0x10
jb 0x50ad97
mov esi, dword [esi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x50af24
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x50aeb1
push 0xac
lea eax, [esp + 0x100]
push 0
push eax
call fcn.006f87a0
add esp, 0xc
call fcn.004f68c0
mov ebx, eax
call fcn.004f68c0
mov edi, eax
call fcn.004f68c0
mov esi, eax
call fcn.004f68c0
push ebx
push edi
push esi
push eax
push 0x405
lea ecx, [esp + 0x110]
call fcn.004f91a0
lea ecx, [esp + 0x188]
mov byte [esp + 0x1b4], 1
mov dword [esp + 0xfc], vtable.wbs::FileException.0
call fcn.00503f10
push ecx
mov eax, esp
mov dword [esp + 0x1a8], 0xb7
push 0
lea ecx, [esp + 0xe8]
mov byte [esp + 0x1bc], 2
mov dword [eax], 1
lea eax, [esp + 0x20]
push eax
call fcn.005050b0
push eax
lea ecx, [esp + 0x114]
mov byte [esp + 0x1b8], 3
call fcn.004f59b0
cmp dword [esp + 0x30], 0x10
mov byte [esp + 0x1b4], 2
mov dword [esp + 0x18], vtable.wbs::StringBase_char_.0
jb 0x50ae84
push dword [esp + 0x1c]
call fcn.006f75a9
add esp, 4
push ebp
lea ecx, [esp + 0x18c]
call fcn.00503f80
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x38]
call fcn.00503d70
push 0x7d9928
lea eax, [esp + 0x38]
push eax
call fcn.006f7cb3
call fcn.004f68c0
mov edi, eax
call fcn.004f68c0
mov esi, eax
call fcn.004f68c0
push edi
push esi
push eax
lea eax, [esp + 0xec]
push eax
push 0x3f5
lea ecx, [esp + 0x110]
call fcn.004f91a0
lea ecx, [esp + 0x188]
mov byte [esp + 0x1b4], 4
mov dword [esp + 0xfc], vtable.wbs::FileException.0
call fcn.00503f10
push 0x7d9928
lea eax, [esp + 0x100]
mov dword [esp + 0x1a8], 0
push eax
mov byte [esp + 0x1bc], 0
call fcn.006f7cb3
cmp dword [esp + 0xf8], 0x10
lea edx, [esp + 0xe4]
mov eax, dword [edi]
mov ecx, edi
cmovae edx, dword [esp + 0xe4]
push edx
call dword [eax + 0x14]
lea ecx, [esp + 0xe0]
mov dword [esp + 0x1b4], 0xffffffff
call fcn.0061b700
mov ecx, dword [esp + 0x1ac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x1a4
ret 4
Function at 0x50b620
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x754a66
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
push ebx
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0xd8]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
add ecx, 4
push eax
call fcn.005043e0
add eax, 4
mov dword [esp + 0xe0], 0
cmp dword [eax + 0x14], 0x10
jb 0x50b66f
mov eax, dword [eax]
push dword [esp + 0xe8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x10]
mov dword [esp + 0xe0], 0xffffffff
mov esi, eax
call fcn.0061b700
test esi, esi
jne 0x50b707
call fcn.004f68c0
mov ebx, eax
call fcn.004f68c0
mov edi, eax
call fcn.004f68c0
mov esi, eax
call fcn.004f68c0
push ebx
push edi
push esi
push eax
push 0x3f2
lea ecx, [esp + 0x40]
call fcn.004f91a0
lea ecx, [esp + 0xb8]
mov dword [esp + 0xe0], 1
mov dword [esp + 0x2c], vtable.wbs::FileException.0
call fcn.00503f10
push 0x7d9928
lea eax, [esp + 0x30]
mov dword [esp + 0xd8], 0
push eax
mov dword [esp + 0xe8], 0xffffffff
call fcn.006f7cb3
mov ecx, dword [esp + 0xd8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xd4
ret 4

Function at 0x50c010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x754b91
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
lea ecx, [edi + 8]
mov word [edi], 0
mov dword [edi + 4], 0
call fcn.00503f10
mov dword [esp + 0x1c], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea eax, [esp + 0xc]
mov byte [esp + 0x1c], 1
push eax
push 0
lea ecx, [edi + 0x30]
mov dword [esp + 0x14], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
call fcn.0050d3f0
mov dword [edi + 0x3c], 0
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.0050d0d0
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x50ce50
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x754d30
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0x38]
mov edi, dword [esp + 0x6c]
push eax
call fcn.00503e70
push 0x78b578
lea ecx, [esp + 0x20]
mov dword [esp + 0x64], 0
call fcn.00503eb0
lea eax, [esp + 0x1c]
mov byte [esp + 0x60], 1
push eax
lea ecx, [esp + 0x3c]
call fcn.00504050
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60], 0
call fcn.0061b700
push 0x140
call fcn.006f7558
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
cmp dword [esp + 0x50], 0x10
lea eax, [esp + 0x3c]
push esi
cmovae eax, dword [esp + 0x40]
push eax
mov byte [esp + 0x68], 2
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
setne cl
test cl, cl
je 0x50cf8f
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [esi]
test al, 0x10
je 0x50cf82
cmp byte [esi + 0x2c], 0x2e
lea edx, [esi + 0x2c]
jne 0x50cf34
mov cl, byte [esi + 0x2d]
test cl, cl
je 0x50cf82
cmp cl, 0x2e
jne 0x50cf34
cmp byte [esi + 0x2e], 0
je 0x50cf82
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx]
test cl, 0x40
jne 0x50cf47
test al, 2
je 0x50cf47
xor al, al
jmp 0x50cf55
test cl, cl
js 0x50cf53
test al, 4
je 0x50cf53
xor al, al
jmp 0x50cf55
mov al, 1
test al, al
je 0x50cf82
push edx
lea ecx, [esp + 0x20]
call fcn.00503eb0
lea eax, [esp + 0x1c]
mov byte [esp + 0x60], 3
push eax
mov ecx, edi
call fcn.0050d960
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60], 2
call fcn.0061b700
push esi
push ebp
call ebx
test eax, eax
setne al
test al, al
jne 0x50cf13
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [edi + 4]
mov eax, 0x92492493
sub ecx, dword [edi]
imul ecx
push esi
add edx, ecx
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
call fcn.006f75a9
add esp, 4
mov dword [esp + 0x60], 0xffffffff
lea ecx, [esp + 0x38]
call fcn.0061b700
mov eax, edi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x50
ret 8

Function at 0x50d180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x771138
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x54]
push eax
lea ecx, [esp + 0xc]
call fcn.00503e70
lea eax, [esp + 8]
mov dword [esp + 0x30], 0
push eax
mov ecx, esi
call fcn.0050c5d0
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.0061b700
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x2c
ret