joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fc0c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
cmp byte [0x986fc0], 0
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
jne 0x4fc1b7
push 0x400
push 0
push 0x986b90
call fcn.0051c1b0
add esp, 0xc
xor edi, edi
push edi
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
mov eax, str.ExistingPageFiles
mov byte [0x986fc0], 1
mov ebx, 0x986b90
call fcn.00500730
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4fc13f
mov eax, dword [esi + 8]
lea ecx, [esi + 0xc]
shr eax, 1
push ecx
call fcn.004fef10
mov edx, dword fs:[0x18]
add esp, 4
mov edi, eax
mov eax, dword [edx + 0x30]
mov ecx, dword [eax + 0x18]
push esi
push 0
push ecx
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
mov eax, edi
test edi, edi
jne 0x4fc15e
push str.PagingFiles
xor al, al
mov ecx, str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
mov edx, 0x80000002
call fcn.00500a20
add esp, 4
mov edx, eax
test eax, eax
je 0x4fc1b7
movzx ecx, word [eax]
test cx, cx
je 0x4fc1ae
cmp cx, 0x5c
jne 0x4fc17c
cmp word [eax + 2], 0x3f
jne 0x4fc17c
lea edx, [eax + 8]
movzx ecx, word [edx]
test cx, cx
je 0x4fc19b
cmp cx, 0x20
je 0x4fc19b
add edx, 2
mov word [ebx], cx
movzx ecx, word [edx]
add ebx, 2
test cx, cx
jne 0x4fc184
xor ecx, ecx
mov word [ebx], cx
cmp word [edx], cx
je 0x4fc1ae
add edx, 2
cmp word [edx], 0
jne 0x4fc1a5
push eax
call fcn.00507bce
add esp, 4
cmp word [0x986b90], 0
mov esi, 0x986b90
je 0x4fc20a
xor eax, eax
cmp word [esi], 0x3f
jne 0x4fc1d6
mov eax, 1
add esi, 2
lea edx, [ebp + eax*2]
push esi
push edx
call fcn.00507f2e
add esp, 8
test eax, eax
je 0x4fc211
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4fc1f0
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 2], cx
lea esi, [esi + eax*2 + 2]
jne 0x4fc1c6
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret

Function at 0x4fc220
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x14
push ebx
push esi
xor esi, esi
push edi
push esi
lea eax, [esp + 0x18]
push 0x20080
push eax
mov eax, dword [esp + 0x30]
lea ebx, [esi + 1]
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
call fcn.004fbd20
add esp, 0xc
test eax, eax
jl 0x4fc2b6
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.Ntdll.dll_NtQuerySecurityObject]
lea ecx, [esp + 0x10]
push ecx
push esi
push esi
push 5
push edx
call edi
mov eax, dword fs:[0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + 0x30]
mov eax, dword [edx + 0x18]
add ecx, 0x28
push ecx
push 8
push eax
call dword [sym.imp.Ntdll.dll_RtlAllocateHeap]
mov ebx, dword [esp + 0x14]
mov esi, eax
test esi, esi
je 0x4fc2af
push 4
push 0x28
push esi
lea ecx, [esp + 0x24]
push ecx
push ebx
call dword [sym.imp.Ntdll.dll_NtQueryInformationFile]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push eax
lea ecx, [esi + 0x28]
push ecx
push 5
push ebx
call edi
push ebx
call dword [sym.imp.Ntdll.dll_NtClose]
mov edx, dword [esp + 0x24]
push 0x10000000
push edx
call fcn.004fc570
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x4fc2e0
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x1c
push ebx
push ebp
xor ebp, ebp
push esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
cmp edi, ebp
je 0x4fc39d
push 7
lea eax, [esp + 0x18]
push 0xc0100
push eax
mov eax, dword [esp + 0x38]
lea ebx, [ebp + 1]
call fcn.004fbd20
add esp, 0xc
test eax, eax
jl 0x4fc387
mov ecx, dword [edi]
or ecx, dword [edi + 4]
mov ebx, dword [esp + 0x14]
je 0x4fc337
push 4
push 0x28
push edi
lea edx, [esp + 0x2c]
push edx
push ebx
call dword [sym.imp.Ntdll.dll_NtSetInformationFile]
lea eax, [esp + 0x13]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea esi, [edi + 0x28]
push esi
call dword [sym.imp.Ntdll.dll_RtlGetOwnerSecurityDescriptor]
cmp dword [esp + 0x18], ebp
mov ebp, dword [sym.imp.Ntdll.dll_NtSetSecurityObject]
je 0x4fc35d
push esi
push 1
push ebx
call ebp
lea edx, [esp + 0x13]
push edx
lea eax, [esp + 0x20]
push eax
mov ecx, edx
push ecx
push esi
call dword [sym.imp.Ntdll.dll_RtlGetDaclSecurityDescriptor]
cmp dword [esp + 0x1c], 0
je 0x4fc37e
push esi
push 4
push ebx
call ebp
push ebx
call dword [sym.imp.Ntdll.dll_NtClose]
xor ebp, ebp
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov ecx, dword [eax + 0x18]
push edi
push ebp
push ecx
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x4fc3b0
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x34
push ebx
mov ebx, dword [sym.imp.Ntdll.dll_NtOpenFile]
push ebp
push esi
push 0
push 7
lea eax, [esp + 0x18]
push eax
push edi
push 0x40000
lea ecx, [esp + 0x20]
push ecx
call ebx
mov ebp, dword [sym.imp.Ntdll.dll_NtClose]
mov esi, eax
cmp esi, 0xc0000022
jne 0x4fc428
push 0
push 7
lea edx, [esp + 0x18]
push edx
push edi
push 0x80000
lea eax, [esp + 0x20]
push eax
call ebx
test eax, eax
jl 0x4fc410
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004fbe10
mov edx, dword [esp + 0x10]
add esp, 4
push edx
call ebp
push 0
push 7
lea eax, [esp + 0x18]
push eax
push edi
push 0x40000
lea ecx, [esp + 0x20]
push ecx
call ebx
mov esi, eax
test esi, esi
jl 0x4fc447
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0xc]
push edx
push eax
call fcn.004fbf30
mov ecx, dword [esp + 0x14]
add esp, 8
push ecx
mov esi, eax
call ebp
test dword [esp + 0x44], 0x50010002
je 0x4fc4c0
push 0
push 7
lea edx, [esp + 0x18]
push edx
push edi
push 0x100
lea eax, [esp + 0x20]
push eax
call ebx
mov esi, eax
test esi, esi
jl 0x4fc4c0
or eax, 0xffffffff
push 4
push 0x28
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x44], eax
lea edx, [esp + 0x1c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x18]
push edx
push eax
mov dword [esp + 0x4c], 0x80
call dword [sym.imp.Ntdll.dll_NtSetInformationFile]
mov ecx, dword [esp + 0xc]
push ecx
call ebp
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x4fc600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
push esi
lea ecx, [esp + 8]
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call fcn.004fba20
test eax, eax
jge 0x4fc651
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.Ntdll.dll_NtQueryAttributesFile]
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x30]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [edx + 0x18]
push 0
push eax
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
test esi, esi
je 0x4fc699
cmp esi, 0xc0000043
je 0x4fc699
cmp esi, 0xc0000022
je 0x4fc699
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4fc770
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x4c
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
push esi
lea ecx, [esp + 8]
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call fcn.004fba20
test eax, eax
jge 0x4fc7bf
mov eax, 1
pop esi
add esp, 0x4c
ret
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.Ntdll.dll_NtQueryAttributesFile]
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x30]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [edx + 0x18]
push 0
push eax
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
test esi, esi
jl 0x4fc7f9
mov eax, dword [esp + 0x48]
pop esi
add esp, 0x4c
ret
or eax, 0xffffffff
pop esi
add esp, 0x4c
ret

Function at 0x4fc8e0
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x30
lea eax, [esp + 8]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call fcn.004fba20
test eax, eax
jl 0x4fc978
push 0
push 0
push 0x18
push 1
push 3
push 0x80
push 0
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x38]
push edx
push 0x100001
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.Ntdll.dll_NtCreateFile]
test eax, eax
jl 0x4fc95e
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.Ntdll.dll_NtClose]
mov edx, dword [esp + 0xc]
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
push edx
mov edx, dword [ecx + 0x18]
push 0
push edx
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
xor eax, eax
add esp, 0x30
ret
Function at 0x4fca00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x20
push esi
push 0x202000
push 7
lea eax, [esp + 0x20]
push eax
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.Ntdll.dll_NtOpenFile]
test eax, eax
jl 0x4fcaa1
push 0
push 0
push 0
push 0x1f0003
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.Ntdll.dll_NtCreateEvent]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
push 2
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
push 0
push 0
push ecx
push edx
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call dword [sym.imp.Ntdll.dll_NtWriteFile]
mov esi, eax
cmp esi, 0x103
jne 0x4fca94
mov eax, dword [esp + 4]
push 0
push 1
push eax
call dword [sym.imp.Ntdll.dll_NtWaitForSingleObject]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.Ntdll.dll_NtClose]
mov eax, esi
pop esi
add esp, 0x20
ret
Function at 0x4fd010
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x58
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x6c]
xor ebp, ebp
push edi
mov dword [esp + 0x1c], ebp
xor bl, bl
call fcn.004fce40
add esp, 4
cmp eax, ebp
jne 0x4fd1d2
lea eax, [esp + 0x20]
mov dword [esp + 0x38], eax
mov eax, edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0x18
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], 0x40
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], ebp
call fcn.004fba20
mov esi, eax
cmp esi, ebp
jl 0x4fd1d0
push 0x978be8
push edi
xor eax, eax
call fcn.00418cd0
add esp, 8
mov dword [esp + 0x1c], eax
cmp eax, ebp
je 0x4fd1b6
lea esp, [esp]
mov edi, dword [esp + 0x1c]
mov ecx, edi
lea edx, [esp + 0x48]
call fcn.004fdba0
test al, al
je 0x4fd0eb
cmp byte [esp + 0x60], 0
je 0x4fd0bf
mov ecx, dword [esp + 0x48]
push ecx
call fcn.004fce40
add esp, 4
cmp eax, ebp
jne 0x4fd1d2
cmp byte [esp + 0x61], 0
je 0x4fd0d5
mov edx, dword [esp + 0x48]
push edx
call fcn.004fd010
add esp, 4
jmp 0x4fd0de
mov eax, dword [esp + 0x48]
call fcn.004fcab0
lea ecx, [esp + 0x48]
call fcn.004fdda0
test al, al
jne 0x4fd0a3
mov eax, dword [esp + 0x58]
cmp eax, ebp
je 0x4fd0fa
push eax
call dword [sym.imp.Ntdll.dll_NtClose]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x58], 0xffffffff
cmp eax, ebp
je 0x4fd113
push eax
call fcn.00507bce
add esp, 4
cmp byte [esp + 0x63], 0
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], ebp
je 0x4fd13e
test bl, bl
jne 0x4fd13e
push 0x10000000
lea edi, [esp + 0x34]
call fcn.004fc3b0
add esp, 4
mov bl, 1
jmp 0x4fd090
push 0x10
push 1
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x3c]
push ecx
push 0x110000
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.Ntdll.dll_NtOpenFile]
mov esi, eax
cmp esi, 0xc0000022
jne 0x4fd16c
test bl, bl
jne 0x4fd1ad
jmp 0x4fd126
cmp esi, ebp
jl 0x4fd19b
mov edx, dword [esp + 0x18]
push 0xd
push 1
lea eax, [esp + 0x1f]
push eax
lea ecx, [esp + 0x34]
push ecx
push edx
mov byte [esp + 0x2b], 1
call dword [sym.imp.Ntdll.dll_NtSetInformationFile]
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.Ntdll.dll_NtClose]
cmp esi, 0xc0000034
je 0x4fd1ab
cmp esi, 0xc000003a
jne 0x4fd1ad
xor esi, esi
push edi
call fcn.00507bce
add esp, 4
mov ecx, dword [esp + 0x24]
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
push ecx
mov ecx, dword [eax + 0x18]
push ebp
push ecx
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
Function at 0x4fd1e0
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
mov edi, eax
call fcn.004187c0
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x4fd207
mov eax, 0xe0010001
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
mov ebx, dword [sym.imp.Ntdll.dll_NtOpenFile]
lea ecx, [ecx]
lea eax, [esp + 0x18]
mov dword [esp + 0x30], eax
mov eax, edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0x18
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], 0x40
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
call fcn.004fba20
mov esi, eax
cmp esi, ebp
jl 0x4fd2ac
push ebp
push 1
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x34]
push edx
push 0x10000
lea eax, [esp + 0x28]
push eax
call ebx
mov esi, eax
cmp esi, ebp
jl 0x4fd28f
mov eax, dword [esp + 0x14]
push 0xd
push 1
lea ecx, [esp + 0x1b]
push ecx
lea edx, [esp + 0x2c]
push edx
push eax
mov byte [esp + 0x27], 1
call dword [sym.imp.Ntdll.dll_NtSetInformationFile]
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.Ntdll.dll_NtClose]
mov edx, dword [esp + 0x1c]
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
push edx
mov edx, dword [ecx + 0x18]
push ebp
push edx
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
cmp esi, ebp
je 0x4fd2bc
cmp esi, 0xc0000034
je 0x4fd2bc
cmp esi, 0xc000003a
jne 0x4fd316
movzx eax, word [edi]
mov ecx, 0x41
cmp cx, ax
ja 0x4fd2cf
cmp ax, 0x5a
jbe 0x4fd2df
mov edx, 0x61
cmp dx, ax
ja 0x4fd316
cmp ax, 0x7a
ja 0x4fd316
cmp word [edi + 2], 0x3a
jne 0x4fd316
cmp word [edi + 4], 0x5c
jne 0x4fd316
push 0x5c
push edi
call fcn.00508605
add esp, 8
cmp eax, ebp
je 0x4fd316
lea ecx, [eax + 2]
lea edx, [edi + 6]
cmp ecx, edx
je 0x4fd310
xor ecx, ecx
mov word [eax], cx
jmp 0x4fd210
xor edx, edx
mov word [eax + 2], dx
push edi
call fcn.00507bce
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x34
ret
Function at 0x4fd8f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
push 1
lea eax, [esp + 0x10]
push 0x100002
push eax
mov eax, dword [esp + 0x28]
mov ebx, 5
call fcn.004fbd20
add esp, 0xc
test eax, eax
jl 0x4fd946
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0xc]
push 0
push 0
push ecx
push edx
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.Ntdll.dll_NtWriteFile]
push esi
mov edi, eax
call dword [sym.imp.Ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x4fd9a0
Capabilities:
Get file attributes
Read file on windows

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
push 1
lea eax, [esp + 0x10]
push 0x80100000
xor esi, esi
push eax
mov eax, dword [esp + 0x40]
lea ebx, [esi + 1]
call fcn.004fbd20
add esp, 0xc
test eax, eax
jl 0x4fda3b
mov edi, dword [esp + 0xc]
push 5
push 0x18
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
call dword [sym.imp.Ntdll.dll_NtQueryInformationFile]
test eax, eax
jl 0x4fda34
mov eax, dword [esp + 0x20]
add eax, 0x18
push eax
call fcn.00507d92
mov esi, eax
add esp, 4
test esi, esi
je 0x4fda34
mov ecx, dword [esp + 0x20]
push 0
mov dword [esi], ecx
mov edx, dword [esp + 0x28]
push 0
mov dword [esi + 4], edx
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.Ntdll.dll_NtReadFile]
push edi
call dword [sym.imp.Ntdll.dll_NtClose]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x4fdba0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x4d4
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x4cc], eax
xor eax, eax
push ebx
push ebp
push esi
mov esi, edx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esp + 0x30], ecx
mov eax, ecx
push edi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x18], 1
mov byte [esp + 0x17], 0
xor ebx, ebx
call fcn.004fba20
test eax, eax
jge 0x4fdbf9
xor al, al
jmp 0x4fdd86
mov dx, word [esp + 0x1c]
mov ax, word [esp + 0x1e]
shr dx, 1
xor ecx, ecx
movzx edx, dx
mov word [esp + 0x26], ax
mov word [esp + 0x24], cx
mov ecx, dword [esp + 0x20]
xor edi, edi
xor eax, eax
mov dword [esp + 0x28], ecx
cmp di, dx
jae 0x4fdc60
lea edi, [eax + 2]
lea esp, [esp]
cmp word [ecx], 0x5c
jne 0x4fdc54
mov ebp, edx
sub ebp, eax
lea ebp, [ebp + ebp - 2]
mov word [esp + 0x2c], bp
mov word [esp + 0x2e], bp
lea ebp, [ecx + 2]
mov word [esp + 0x24], di
mov dword [esp + 0x30], ebp
inc eax
add edi, 2
add ecx, 2
cmp ax, dx
jb 0x4fdc30
push ebx
push ebx
push 0x11
push 1
push 1
push 0x80
push ebx
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0x58]
push edx
push 0x100001
lea eax, [esp + 0x4c]
lea ebp, [esi + 0x10]
push ebp
mov dword [esp + 0x64], 0x18
mov dword [esp + 0x68], ebx
mov dword [esp + 0x70], 0x40
mov dword [esp + 0x6c], eax
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
call dword [sym.imp.Ntdll.dll_NtCreateFile]
mov edi, eax
cmp edi, ebx
jl 0x4fdd57
mov ebx, dword [sym.imp.Ntdll.dll_NtQueryDirectoryFile]
jmp 0x4fdcc0
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [ebp]
push 1
push 1
push 0x480
lea edx, [esp + 0x6c]
push edx
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 0
push ecx
call ebx
mov edi, eax
mov eax, dword [esp + 0x94]
cmp eax, 4
jne 0x4fdd10
mov ecx, 0x2e
cmp word [esp + 0x98], cx
jne 0x4fdd2b
cmp word [esp + 0x9a], cx
jmp 0x4fdd1e
cmp eax, 2
jne 0x4fdd2b
cmp word [esp + 0x98], 0x2e
jne 0x4fdd2b
mov byte [esp + 0x18], 0
test edi, edi
jge 0x4fdcc0
jmp 0x4fdd57
test edi, edi
jl 0x4fdd57
mov ecx, dword [esp + 0x90]
mov ebx, dword [esp + 0x34]
lea edx, [esp + 0x80]
push edx
push ecx
lea edx, [esp + 0xa0]
push edx
call fcn.004fda80
add esp, 0xc
mov byte [esp + 0x17], al
cmp edi, 0xc0000022
sete al
mov byte [esi + 0x1b], al
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4fdd82
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x30]
push eax
mov eax, dword [edx + 0x18]
push 0
push eax
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x4dc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005078c8
add esp, 0x4d4
ret
Function at 0x4fdda0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x494
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x48c], eax
push ebx
push esi
push 0
push 0
push 1
push 1
push 0x480
mov esi, ecx
mov edx, dword [esi + 0x10]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.Ntdll.dll_NtQueryDirectoryFile]
test eax, eax
jl 0x4fde17
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x50]
push ecx
lea edx, [esp + 0x58]
push edx
xor ebx, ebx
call fcn.004fda80
add esp, 0xc
pop esi
pop ebx
mov ecx, dword [esp + 0x48c]
xor ecx, esp
call fcn.005078c8
add esp, 0x494
ret
mov ecx, dword [esp + 0x494]
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.005078c8
add esp, 0x494
ret

Function at 0x4fdf20
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ecx
mov eax, dword fs:[0x18]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.Ntdll.dll_RtlAllocateHeap]
mov dword [esp + 0x10], 0x1000
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0x18]
push 0x1000
push 8
push ecx
call edi
mov esi, eax
test esi, esi
je 0x4fdfac
mov ebp, dword [sym.imp.Ntdll.dll_NtQuerySystemInformation]
mov ebx, dword [sym.imp.Ntdll.dll_RtlFreeHeap]
jmp 0x4fdf60
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push eax
push esi
push 0xb
call ebp
cmp eax, 0xc0000004
je 0x4fdf7d
cmp eax, 0xc0000023
jne 0x4fdfb4
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x30]
mov eax, dword [edx + 0x18]
push esi
push 0
push eax
call ebx
mov eax, dword fs:[0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + 0x30]
mov eax, dword [edx + 0x18]
push ecx
push 8
push eax
call edi
mov esi, eax
test esi, esi
jne 0x4fdf60
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4fe8b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
xor eax, eax
push esi
push eax
push eax
push 3
push eax
push 3
push 3
push str..PhysicalDrive0
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4fe917
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x28]
push edi
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 4]
sub eax, edi
neg eax
sbb eax, eax
and eax, 0xe0010057
pop esi
add esp, 0x18
ret
Function at 0x4ff0e0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x218
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push esi
xor esi, esi
push 0x206
lea ecx, [esp + 0x1e]
xor eax, eax
push esi
push ecx
mov dword [esp + 0x18], esi
mov word [esp + 0x24], ax
call fcn.0051c1b0
add esp, 0xc
push 0x103
lea edx, [esp + 0x1c]
push edx
push esi
mov dword [esp + 0x1c], esi
xor bl, bl
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
cmp ebp, esi
je 0x4ff1b4
push ebp
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4ff1b4
mov edx, dword [esp + 0x10]
push esi
push ebp
push edx
lea eax, [esp + 0x24]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4ff1a4
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x978ed4
push esi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0xc]
movzx ecx, word [eax + 0xa]
mov dword [edi], ecx
movzx edx, word [eax + 8]
mov dword [edi + 4], edx
movzx ecx, word [eax + 0xe]
mov dword [edi + 8], ecx
movzx edx, word [eax + 0xc]
mov dword [edi + 0xc], edx
mov bl, 1
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [esp + 0x220]
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.005078c8
add esp, 0x218
ret