joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56d280
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, 0xa
mov eax, dword [esi + 0x96]
mov dword [esp + 0xc], edi
cmp eax, 0xffffffff
je 0x56d457
mov ecx, dword [esp + 0x20]
xor ebp, ebp
cmp ecx, ebp
je 0x56d457
cmp dword [ecx], 0xffffffff
je 0x56d457
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
je 0x56d457
mov eax, dword [esi + 0x96]
push ebx
push 2
push ebp
push ebp
push eax
call fcn.00560c50
mov ebx, edx
add esp, 0x10
cmp ebx, ebp
mov dword [esp + 0x18], eax
jg 0x56d2f2
jl 0x56d2ec
cmp eax, ebp
jae 0x56d2f2
mov dword [esp + 0x18], ebp
xor ebx, ebx
mov ecx, dword [esi + 0x96]
push ebp
push ebp
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x56d417
push 0x7800
mov dword [esp + 0x14], ebp
call fcn.0057ca98
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x56d329
mov dword [esp + 0x10], 4
mov edx, dword [esi + 0xdb0]
push esi
push edx
call fcn.0056bc70
cdq
add esp, 8
cmp edx, ebx
jl 0x56d3f4
jg 0x56d34e
cmp eax, dword [esp + 0x18]
jb 0x56d3f4
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x56d3f8
test ebx, ebx
jl 0x56d3f8
jg 0x56d370
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x56d3f8
push esi
call fcn.00565840
add esp, 4
test eax, eax
jne 0x56d3ea
mov ecx, dword [esi + 0x96]
push eax
lea eax, [esp + 0x2c]
push eax
push 0x7800
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x56d3e0
mov eax, dword [esp + 0x28]
test eax, eax
mov edi, eax
jne 0x56d3ac
mov dword [esp + 0x18], eax
xor ebx, ebx
jmp 0x56d35a
lea edx, [esp + 0x14]
push 0
push edx
push eax
mov eax, dword [esp + 0x30]
push ebp
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x56d3e0
cmp dword [esp + 0x14], edi
jne 0x56d3e0
mov ecx, dword [esp + 0x18]
mov eax, edi
cdq
sub ecx, eax
mov dword [esp + 0x18], ecx
sbb ebx, edx
jmp 0x56d35a
mov dword [esp + 0x10], 0xa
jmp 0x56d3f8
mov dword [esp + 0x10], 9
jmp 0x56d3f8
mov dword [esp + 0x10], edi
mov edx, dword [esp + 0x24]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test ebp, ebp
je 0x56d412
push ebp
call fcn.0057c9af
add esp, 4
mov edi, 0xa
mov ecx, dword [esi + 0x96]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
pop ebx
je 0x56d453
push 0
push 0x8000080
push 2
push 0
push 0
lea edx, [esi + 0x9a]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x96], eax
jne 0x56d457
mov dword [esp + 0xc], edi
mov eax, dword [esi + 0xdb0]
push esi
push eax
call fcn.0056bc70
add esp, 8
test eax, eax
jg 0x56d486
mov ecx, dword [esp + 0x20]
push esi
push 0xffffffffffffffff
push ecx
push 0
call fcn.0056cab0
add esp, 0x10
test eax, eax
mov eax, 9
jne 0x56d48a
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x56d4a0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x685140]
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x56d4db
mov eax, dword [esp + 0x18]
push 0x638420
mov ecx, eax
shl ecx, 6
add ecx, eax
lea esi, [ecx*4 + 0x37f2]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, dword [esp + 0x18]
test edi, edi
jge 0x56d4e7
xor edi, edi
jmp 0x56d4f1
cmp edi, 2
jle 0x56d4f1
mov edi, 2
xor ebp, ebp
xor eax, eax
test ebp, ebp
jl 0x56d5a9
mov ecx, dword [ebp*8 + 0x632320]
mov edx, dword [esp + 0x14]
cmp ecx, edx
mov dword [esp + 0x18], ecx
jne 0x56d544
mov edx, edi
mov eax, dword [ebp*8 + 0x632324]
shl edx, 6
add edx, edi
push 0x103
push eax
lea esi, [ebx + edx*4]
lea ecx, [esi + 0x37f2]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [esp + 0x18]
mov byte [esi + 0x38f5], 0
mov eax, 1
test ecx, ecx
jne 0x56d54d
or ebp, 0xffffffff
jmp 0x56d54e
inc ebp
test eax, eax
je 0x56d4f5
mov eax, dword [ebx + 0xb28]
test eax, eax
je 0x56d596
lea esi, [ebx + 0x3afe]
push 0x60dc40
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebx + 0xb2c]
mov ecx, edi
shl ecx, 6
add ecx, edi
push eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [ebx + ecx*4 + 0x37f2]
push edx
push 0
push eax
push 0
push 0xd
call dword [ebx + 0xb28]
mov ecx, edi
shl ecx, 6
add ecx, edi
pop edi
pop esi
pop ebp
lea eax, [ebx + ecx*4 + 0x37f2]
pop ebx
ret
test eax, eax
jne 0x56d552
mov edx, edi
push 0x638420
shl edx, 6
add edx, edi
lea esi, [ebx + edx*4 + 0x37f2]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x56d850
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x114
test eax, eax
push esi
push edi
je 0x56d8e5
add al, 0x40
push 0x610f08
mov byte [esp + 0xc], al
lea eax, [esp + 0xd]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [esp + 0x12c]
lea ecx, [esp + 0x18]
push 0x104
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
push eax
lea esi, [edi + 0x3d32]
push ecx
push 0x104
lea edx, [esp + 0x20]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x56d8e5
push edi
push 0
push 0
push 0
call fcn.0056e120
mov ecx, dword [esp + 0x134]
mov edx, dword [esp + 0x138]
add esp, 0x10
mov dword [ecx], eax
mov eax, esi
pop edi
mov dword [edx], 8
pop esi
add esp, 0x114
ret
pop edi
xor eax, eax
pop esi
add esp, 0x114
ret
Function at 0x56e350
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x24
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push eax
push esi
call fcn.0055fc40
mov ebp, dword [esp + 0x44]
add esp, 8
test eax, eax
jne 0x56e391
cmp word [esp + 0x18], 1
jg 0x56e3a1
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x56e391
pop edi
pop esi
pop ebp
mov eax, 0xf
pop ebx
add esp, 0x24
ret
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x56e42e
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 3
push closesocket
push ebp
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x56e3d0
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0x24
ret
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebp
call esi
mov esi, eax
cmp esi, 0xffffffff
jne 0x56e400
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 0xf
pop ebx
add esp, 0x24
ret
mov ecx, dword [esp + 0x40]
push ecx
push 0xffffffffffffffff
push esi
push edi
call fcn.0056e550
add esp, 0x10
mov ebx, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
test eax, eax
jne 0x56e438
test ebx, ebx
jne 0x56e438
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test ebx, ebx
je 0x56e44e
cmp ebx, 0xa
mov eax, ebx
jne 0x56e430
pop edi
pop esi
pop ebp
mov eax, 0xe
pop ebx
add esp, 0x24
ret

Function at 0x56e550
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x2000
call fcn.0057ca98
mov esi, eax
add esp, 4
test esi, esi
jne 0x56e577
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 8
ret
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
xor ebx, ebx
cmp edi, 0xffffffff
je 0x56e599
cmp ebx, edi
jae 0x56e615
mov eax, edi
sub eax, ebx
cmp eax, 0x2000
jb 0x56e59e
mov eax, 0x2000
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
push 0
push ecx
push eax
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x56e5ff
mov eax, dword [esp + 0x10]
test eax, eax
je 0x56e615
lea ecx, [esp + 0x14]
push 0
push ecx
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x56e63e
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp edx, eax
jne 0x56e63e
mov eax, dword [esp + 0x28]
push eax
call fcn.00565840
mov ecx, dword [esp + 0x2c]
add esp, 4
mov eax, dword [ecx + 0x8e]
test eax, eax
jne 0x56e628
add ebx, dword [esp + 0x14]
jmp 0x56e581
push esi
call fcn.0057c9af
add esp, 4
mov eax, 0xb
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push esi
call fcn.0057c9af
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push esi
call fcn.0057c9af
add esp, 4
mov eax, 9
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push esi
call fcn.0057c9af
add esp, 4
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x56e660
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x514
lea ecx, [esp + 0x30c]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
push ecx
call edi
lea edx, [esp + 0x31c]
push edx
call fcn.00568060
push 0
lea eax, [esp + 0x220]
push 0
lea ecx, [esp + 0x42c]
push eax
lea edx, [esp + 0x32c]
push ecx
push edx
call fcn.0056d6a0
push 0
lea eax, [esp + 0x234]
push 0
lea ecx, [esp + 0x440]
push eax
lea edx, [esp + 0x138]
push ecx
push edx
call fcn.00560080
add esp, 0x2c
lea eax, [esp + 0x114]
lea ecx, [esp + 0x218]
push eax
push ecx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea edx, [esp + 0x114]
push 0x5c
push edx
call fcn.00560040
test eax, eax
je 0x56e71d
mov byte [eax], 0
lea eax, [esp + 0x114]
push eax
call esi
cmp eax, 0xffffffff
je 0x56e6e9
lea ecx, [esp + 0x114]
lea edx, [esp + 0x10]
push ecx
push edx
jmp 0x56e72a
lea eax, [esp + 0x114]
lea ecx, [esp + 0x10]
push eax
push ecx
call edi
lea edx, [esp + 0x10]
push 0x60b360
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x218]
lea ecx, [esp + 0x114]
push eax
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x10]
push edx
call ebx
mov esi, eax
lea eax, [esp + 0x114]
push eax
call ebx
cmp esi, eax
jge 0x56e7fd
mov ebp, dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
lea ecx, [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x10]
lea edi, [esp + eax + 0x10]
push edx
call ebx
lea esi, [esp + eax + 0x114]
mov al, byte [esp + eax + 0x114]
test al, al
je 0x56e7be
cmp al, 0x5c
je 0x56e7be
mov byte [edi], al
mov al, byte [esi]
push eax
inc edi
call ebp
test eax, eax
je 0x56e7af
mov cl, byte [esi + 1]
mov byte [edi], cl
inc edi
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x56e799
lea edx, [esp + 0x10]
push 0
push edx
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x56e80a
lea eax, [esp + 0x10]
push 0x60b360
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x114]
mov esi, eax
push edx
call ebx
cmp esi, eax
jl 0x56e775
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x514
ret
pop edi
pop esi
pop ebp
mov eax, 0xf
pop ebx
add esp, 0x514
ret

Function at 0x56e820
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ecx
or edi, 0xffffffff
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x56e84a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x56e864
mov edx, dword [esp + 0x10]
push 1
push 0
push 0
push edx
call fcn.0057d500
xor ecx, ecx
add eax, esi
pop edi
pop esi
adc edx, ecx
pop ebx
ret
mov eax, edi
pop edi
mov edx, ebx
pop esi
pop ebx
ret
Function at 0x5704c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x20]
push edi
push esi
cmp dword [esi + 0x96], 0xffffffff
jne 0x57054b
mov edi, dword [esp + 0x24]
push 0x10
push edi
push 0
call fcn.0056cab0
add esp, 0x10
test eax, eax
je 0x5704fd
mov eax, dword [esi + 0x8e]
pop edi
neg eax
sbb eax, eax
pop esi
and al, 0xf6
add eax, 0x13
add esp, 0x10
ret
mov eax, dword [esp + 0x1c]
push 0
mov dword [esp + 0xc], 0x8074b50
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov eax, dword [edi]
push ecx
lea edx, [esp + 0x10]
push 0x10
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x570540
cmp dword [esp + 0x24], 0x10
je 0x5705b1
mov eax, 0xa
pop edi
pop esi
add esp, 0x10
ret
call fcn.0056d240
add esp, 4
cmp eax, 0x10
jge 0x57056a
mov ecx, dword [esp + 0x20]
push esi
push ecx
call fcn.0056d280
add esp, 8
test eax, eax
jne 0x570545
mov eax, dword [esp + 0x1c]
push 0
mov dword [esp + 0xc], 0x8074b50
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0x14]
lea eax, [esp + 0x28]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov edx, dword [esi + 0x96]
push eax
lea ecx, [esp + 0x10]
push 0x10
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x570540
cmp dword [esp + 0x24], 0x10
jne 0x570540
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x5705c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esp + 8], 0x8074b50
mov eax, dword [esi + 0x96]
push esi
cmp eax, 0xffffffff
jne 0x57062e
mov edi, dword [esp + 0x14]
push 4
push edi
push 0
call fcn.0056cab0
add esp, 0x10
test eax, eax
je 0x570603
mov eax, dword [esi + 0x8e]
pop edi
neg eax
sbb eax, eax
pop esi
and al, 0xf6
add eax, 0x13
pop ecx
ret
mov edx, dword [edi]
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x10]
push 4
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x570625
cmp dword [esp + 0x14], 4
je 0x570673
mov eax, 0xa
pop edi
pop esi
pop ecx
ret
call fcn.0056d240
add esp, 4
cmp eax, 4
jge 0x57064d
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.0056d280
add esp, 8
test eax, eax
jne 0x57062a
mov eax, dword [esi + 0x96]
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x10]
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x570625
cmp dword [esp + 0x14], 4
jne 0x570625
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x570a80
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [ebp + 0x96]
push ebp
lea esi, [edi + 0x16]
cmp eax, 0xffffffff
mov dword [esp + 0x14], esi
jne 0x570b93
mov eax, dword [esp + 0x30]
push esi
push eax
push 0
call fcn.0056cab0
add esp, 0x10
test eax, eax
je 0x570acd
mov eax, dword [ebp + 0x8e]
pop edi
neg eax
sbb eax, eax
pop esi
and al, 0xf6
pop ebp
add eax, 0x13
pop ebx
pop ecx
ret
lea ecx, [esi + 1]
push ecx
call fcn.0057ca98
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x570c7c
mov eax, dword [esp + 0x18]
mov dword [ebx], 0x6054b50
test byte [ebp + 0xdf1], 0x80
je 0x570b19
mov dx, word [ebp + 0xdf2]
mov word [ebx + 4], dx
mov cx, word [ebp + 0xdf4]
mov word [ebx + 6], cx
mov dx, word [ebp + 0xdfa]
mov word [ebx + 8], dx
jmp 0x570b26
lea ecx, [ebx + 4]
mov dword [ecx], 0
mov word [ebx + 8], ax
mov edx, dword [esp + 0x1c]
mov word [ebx + 0xa], ax
mov eax, dword [esp + 0x20]
mov dword [ebx + 0xc], edx
test edi, edi
mov dword [ebx + 0x10], eax
mov word [ebx + 0x14], di
je 0x570b5b
mov esi, dword [esp + 0x28]
mov ecx, edi
mov edx, ecx
lea edi, [ebx + 0x16]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x24]
push 0
push eax
mov edx, dword [ecx]
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x570b7f
cmp dword [esp + 0x24], esi
je 0x570c6b
push ebx
call fcn.0057c9af
add esp, 4
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call fcn.0056d240
add esp, 4
cmp eax, esi
jge 0x570bb5
mov eax, dword [esp + 0x2c]
push ebp
push eax
call fcn.0056d280
add esp, 8
test eax, eax
jne 0x570c81
lea ecx, [esi + 1]
push ecx
call fcn.0057ca98
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x570c7c
mov eax, dword [esp + 0x18]
mov dword [ebx], 0x6054b50
test byte [ebp + 0xdf1], 0x80
je 0x570c01
mov dx, word [ebp + 0xdf2]
mov word [ebx + 4], dx
mov cx, word [ebp + 0xdf4]
mov word [ebx + 6], cx
mov dx, word [ebp + 0xdfa]
mov word [ebx + 8], dx
jmp 0x570c0e
lea ecx, [ebx + 4]
mov dword [ecx], 0
mov word [ebx + 8], ax
mov edx, dword [esp + 0x1c]
mov word [ebx + 0xa], ax
mov eax, dword [esp + 0x20]
mov dword [ebx + 0xc], edx
test edi, edi
mov dword [ebx + 0x10], eax
mov word [ebx + 0x14], di
je 0x570c43
mov esi, dword [esp + 0x28]
mov ecx, edi
mov edx, ecx
lea edi, [ebx + 0x16]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov ecx, dword [ebp + 0x96]
lea eax, [esp + 0x24]
push 0
push eax
push esi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x570b7f
cmp dword [esp + 0x24], esi
jne 0x570b7f
push ebx
call fcn.0057c9af
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x570cb0
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x11c]
mov dword [esp + 0x10], 0
mov esi, dword [edi + 0xdbc]
test esi, esi
je 0x570e6c
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp word [esi + 0x4a], 0
jne 0x570cf1
cmp word [esi + 0x4c], 0
je 0x570d6b
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x46]
mov word [esi + 0x4a], 1
cmp byte [eax + ecx - 1], 0x2f
je 0x570d67
mov edx, dword [esi + 0x36]
lea eax, [esp + 0x14]
push edx
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
call fcn.00568060
add esp, 4
lea edx, [esp + 0x14]
push edx
call ebp
mov eax, dword [edi + 0xd9c]
test eax, eax
jne 0x570d6b
mov eax, dword [esi + 0x36]
push eax
call fcn.00570c90
mov ecx, dword [esi + 0x46]
push ecx
call fcn.00570c90
mov eax, dword [esi + 0x46]
add esp, 8
cmp byte [eax], 0
je 0x570d56
push 0x60cce0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [esi + 0x46]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
mov dword [esi + 0x18], eax
jbe 0x570d6b
inc dword [esp + 0x10]
mov esi, dword [esi + 0x4e]
test esi, esi
jne 0x570ce3
mov eax, dword [esp + 0x10]
test eax, eax
je 0x570e6c
shl eax, 2
push eax
call fcn.0057ca98
mov ebp, eax
add esp, 4
test ebp, ebp
mov dword [esp + 0x10], ebp
jne 0x570da8
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0x108
ret
mov esi, dword [edi + 0xdbc]
xor ebx, ebx
test esi, esi
je 0x570df1
mov edi, ebp
cmp word [esi + 0x4a], 0
je 0x570dea
mov ecx, dword [esi + 0x18]
test ecx, ecx
jbe 0x570dea
mov eax, dword [esi + 0x46]
cmp byte [ecx + eax - 1], 0x2f
jne 0x570dea
test ebx, ebx
je 0x570de4
mov ecx, dword [edi - 4]
mov edx, dword [ecx + 0x46]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x570dea
mov dword [edi], esi
inc ebx
add edi, 4
mov esi, dword [esi + 0x4e]
test esi, esi
jne 0x570db6
push 0x56e930
push 4
push ebx
push ebp
call fcn.0057f7af
add esp, 0x10
xor ebp, ebp
test ebx, ebx
jbe 0x570e5f
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
mov esi, dword [eax + 0x36]
cmp byte [esi], 0
je 0x570e57
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi - 1], 0x2f
jne 0x570e30
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [eax + esi - 1], 0
test ebp, ebp
je 0x570e4b
mov ecx, dword [edi - 4]
mov eax, dword [edi]
mov edx, dword [ecx + 0x46]
mov ecx, dword [eax + 0x46]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x570e57
mov edx, dword [edi]
mov eax, dword [edx + 0x36]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
inc ebp
add edi, 4
cmp ebp, ebx
jb 0x570e0c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0057c9af
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret
Function at 0x570ea0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov edx, dword [ecx + 0x3e]
mov eax, edx
xor eax, esi
and eax, 0xff
shr edx, 8
mov eax, dword [eax*4 + 0x631de8]
xor eax, edx
mov edx, dword [ecx + 0x42]
mov dword [ecx + 0x3e], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 0x46]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 0x42], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x631de8]
xor eax, edx
mov dword [ecx + 0x46], eax
ret
Function at 0x571a10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
cmp eax, 1
push edi
mov ebx, eax
jge 0x571a24
mov ebx, 1
cmp eax, 9
jle 0x571a2e
mov ebx, 9
mov esi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, dword [esi + 0x56]
mov dword [esi + 0x5e], ebp
cmp eax, ebp
jne 0x571a4c
mov dword [esi + 0x5e], 1
mov dword [esi + 0x56], 0x10000
cmp dword [esi + 0x4a], ebp
jne 0x571a81
push 2
push 0x8000
call fcn.00581155
add esp, 8
cmp eax, ebp
mov dword [esi + 0x4a], eax
jne 0x571a81
push esi
push ebp
push 0x17c
call fcn.0056d4a0
add esp, 8
push eax
push 4
call fcn.00568b50
add esp, 0xc
cmp dword [esi + 0x4e], ebp
jne 0x571acc
push 2
push 0x8000
call fcn.00581155
push 2
push 0x4000
mov dword [esi + 0x4e], eax
call fcn.00581155
mov ecx, dword [esi + 0x4e]
add esp, 0x10
cmp ecx, ebp
mov dword [esi + 0x52], eax
je 0x571ab2
cmp eax, ebp
jne 0x571acc
push esi
push ebp
push 0x186
call fcn.0056d4a0
add esp, 8
push eax
push 4
call fcn.00568b50
add esp, 0xc
mov eax, dword [esi + 0x52]
mov ecx, 0x1fff
xor edx, edx
mov word [eax + 0x7ffe], bp
mov edi, dword [esi + 0x52]
xor eax, eax
rep stosd dword es:[edi], eax
xor ecx, ecx
stosw word es:[edi], ax
mov cx, word [ebx*8 + 0x631b42]
xor eax, eax
mov dword [esi + 0x7e], ecx
mov dx, word [ebx*8 + 0x631b40]
mov dword [esi + 0x82], edx
mov ax, word [ebx*8 + 0x631b44]
xor ecx, ecx
mov dword [esi + 0x86], eax
mov cx, word [ebx*8 + 0x631b46]
cmp ebx, 1
mov dword [esi + 0x7a], ecx
jne 0x571b2c
mov eax, dword [esp + 0x18]
or byte [eax], 4
jmp 0x571b38
cmp ebx, 9
jne 0x571b38
mov eax, dword [esp + 0x18]
or byte [eax], 2
mov edx, dword [esi + 0x4a]
push esi
push 0x8000
push edx
mov dword [esi + 0x6a], ebp
mov dword [esi + 0x5a], ebp
call dword [esi + 0x3f3a]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x76], eax
jne 0x571b67
mov dword [esi + 0x72], 1
mov dword [esi + 0x76], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, 0x106
mov dword [esi + 0x72], ebp
cmp eax, edi
jae 0x571b88
cmp dword [esi + 0x72], ebp
jne 0x571b88
push esi
call fcn.00571d60
mov eax, dword [esi + 0x76]
add esp, 4
cmp eax, edi
jb 0x571b73
mov ecx, dword [esi + 0x4a]
mov dword [esi + 0x62], ebp
xor eax, eax
mov edi, dword [esi + 0x62]
xor edx, edx
mov dl, byte [ecx + eax]
and edi, 0x1ff
and edx, 0x3fff
shl edi, 5
xor edx, edi
inc eax
cmp eax, 2
mov dword [esi + 0x62], edx
jb 0x571b90
pop edi
pop esi
pop ebp
pop ebx
ret