joyce8/EMBER2024-capa huggingface dataset:
Function at 0x522b80
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x58]
mov esi, dword [edi + 0xc]
mov dword [esp + 0x10], esi
test eax, eax
jne 0x522c5f
or edx, 0xffffffff
cmp dword [edi + 0x70], edx
jne 0x522c5b
cmp dword [edi + 0x5c], edx
jne 0x522bb4
pop edi
mov eax, edx
pop esi
add esp, 0xc
ret 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x24]
xor esi, esi
mov dword [esp + 0x10], ebp
xor ebx, ebx
lea eax, [esp + 0x10]
cmp ebp, 0x2000000
jb 0x522bd3
mov eax, 0x6461e0
mov eax, dword [eax]
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [edi + 0x5c]
push eax
lea eax, [esi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x522c22
mov eax, dword [esp + 0x14]
test eax, eax
je 0x522c14
add esi, eax
adc ebx, 0
sub ebp, eax
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x10], ebp
jg 0x522c14
jl 0x522bc2
cmp esi, dword [esp + 0x24]
jb 0x522bc2
pop ebp
mov edx, ebx
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret 0xc
mov edx, esi
or edx, ebx
jne 0x522c14
lea eax, [esp + 0x20]
push 0xffffffffffffffff
push eax
call fcn.004b1250
mov ecx, dword [esp + 0x20]
add esp, 8
push eax
push 1
call fcn.005247d0
lea ecx, [esp + 0x20]
call fcn.004010b0
pop ebp
pop ebx
or eax, 0xffffffff
pop edi
or edx, eax
pop esi
add esp, 0xc
ret 0xc
test eax, eax
je 0x522cbe
call fcn.005227d0
test al, al
je 0x522cbe
mov ecx, dword [edi + 0x58]
push ecx
call fcn.0057765b
add esp, 4
test eax, eax
je 0x522cbe
call fcn.00578d71
mov edx, dword [eax]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.004b1250
add esp, 8
push eax
push 1
mov ecx, esi
call fcn.005247d0
mov ecx, dword [esp + 0x18]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x522cb1
mov eax, dword [esp + 0x18]
push eax
call fcn.004b7f30
add esp, 4
or eax, 0xffffffff
pop edi
or edx, eax
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
mov ecx, edi
call fcn.00521730
pop edi
pop esi
add esp, 0xc
ret 0xc
Function at 0x522ce0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [esp + 0x10], eax
cmp dword [ebp + 0x58], edi
jne 0x522dbe
or eax, 0xffffffff
cmp dword [ebp + 0x70], eax
jne 0x522dbe
cmp dword [ebp + 0x5c], eax
jne 0x522d14
pop edi
mov edx, eax
pop ebp
add esp, 0x14
ret 0xc
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov dword [esp + 0x20], edi
xor esi, esi
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
cmp ebx, 0x2000000
jb 0x522d35
mov eax, 0x6461e0
mov eax, dword [eax]
mov edx, dword [esp + 0x28]
push 0
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [ebp + 0x5c]
push eax
lea eax, [esi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x522d85
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x522d77
xor eax, eax
add esi, ecx
adc edi, eax
sub ebx, ecx
sbb dword [esp + 0x20], eax
cmp edi, dword [esp + 0x30]
jg 0x522d77
jl 0x522d20
cmp esi, dword [esp + 0x2c]
jb 0x522d20
mov eax, esi
pop esi
pop ebx
mov edx, edi
pop edi
pop ebp
add esp, 0x14
ret 0xc
mov edx, esi
or edx, edi
jne 0x522d77
lea eax, [esp + 0x28]
push 0xffffffffffffffff
push eax
call fcn.004b1250
mov ecx, dword [esp + 0x20]
add esp, 8
push eax
push 2
call fcn.005247d0
lea ecx, [esp + 0x28]
call fcn.004010b0
pop esi
pop ebx
or eax, 0xffffffff
pop edi
or edx, eax
pop ebp
add esp, 0x14
ret 0xc
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.00521a60
pop edi
pop ebp
add esp, 0x14
ret 0xc
Function at 0x5234f0
Capabilities:
Clear file content

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x5c]
push edi
cmp ecx, 0xffffffff
jne 0x5235d7
cmp dword [eax + 0x70], ecx
jne 0x5235d7
cmp dword [eax + 0x58], 0
jne 0x5235d7
lea edi, [eax + 0x10]
mov ecx, edi
call fcn.00525640
test al, al
jne 0x52367f
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.00525120
push eax
lea ecx, [esp + 0x18]
call fcn.00504ff0
mov ecx, dword [esp + 0x10]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x52355d
mov eax, dword [esp + 0x10]
push eax
call fcn.004b7f30
add esp, 4
push ecx
mov eax, esp
lea ecx, [esp + 0x18]
mov dword [eax], 3
call fcn.005046c0
test al, al
je 0x5235c2
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.005053c0
mov bl, al
test bl, bl
jne 0x5235ad
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.004fdcb0
push eax
push 0xc
mov ecx, esi
call fcn.005247d0
lea ecx, [esp + 0x20]
call fcn.004010b0
lea ecx, [esp + 0x14]
call fcn.005053a0
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
lea ecx, [esp + 0x14]
call fcn.005053a0
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov edi, ecx
cmp edi, 0xffffffff
jne 0x523609
mov ecx, dword [eax + 0x58]
test ecx, ecx
je 0x5235f6
push ecx
call fcn.0057d0aa
push eax
call fcn.0057ccbc
add esp, 8
jmp 0x523602
mov ecx, dword [eax + 0x70]
push ecx
call fcn.0057ccbc
add esp, 4
mov edi, eax
cmp edi, 0xffffffff
je 0x52367f
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x20]
mov ebp, eax
mov eax, dword [esp + 0x24]
mov ebx, edx
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebx
call edx
test al, al
je 0x523674
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x523674
cmp ebx, dword [esp + 0x24]
jg 0x523654
jl 0x52364e
cmp ebp, dword [esp + 0x20]
jae 0x523654
lea eax, [esp + 0x14]
jmp 0x523658
lea eax, [esp + 0x20]
mov ecx, dword [eax + 4]
mov edx, dword [esi]
mov eax, dword [eax]
mov edx, dword [edx + 0x18]
push ecx
push eax
mov ecx, esi
call edx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
push ebx
push ebp
mov ecx, esi
call edx
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
Function at 0x525b70
Capabilities:
Create directory

Disassembly:
push ecx
push ebx
push 0
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00522a40
add esp, 8
mov ecx, eax
call fcn.004b9cd0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [esp + 4]
test eax, eax
setne bl
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x525baf
mov ecx, dword [esp + 4]
push ecx
call fcn.004b7f30
add esp, 4
mov al, bl
pop ebx
pop ecx
ret

Function at 0x525bc0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x25c
mov eax, dword [0x6b06f8]
xor eax, esp
mov dword [esp + 0x258], eax
mov eax, dword [esp + 0x260]
mov eax, dword [eax]
push ebx
mov dword [esp + 4], eax
mov ecx, 1
lock xadd dword [eax], ecx
mov eax, dword [esp + 4]
cmp dword [eax + 8], 2
jne 0x525c13
mov edx, dword [eax + 0xc]
cmp word [edx + 2], 0x3a
jne 0x525c13
push ecx
mov eax, esp
mov ecx, 0x5c
mov word [eax], cx
lea ecx, [esp + 8]
call fcn.004b9340
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
call fcn.00522a40
add esp, 8
mov ecx, eax
call fcn.004b9cd0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 8]
mov ebx, eax
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x525c4f
mov eax, dword [esp + 8]
push eax
call fcn.004b7f30
add esp, 4
cmp ebx, 0xffffffff
jne 0x525c8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x525c64
cmp eax, 0x20
jne 0x525c8a
lea ecx, [esp + 0xc]
push ecx
push ecx
mov edx, esp
lea eax, [esp + 0xc]
push eax
push edx
call fcn.00522a40
add esp, 8
call fcn.00525aa0
add esp, 8
test al, al
je 0x525c8a
mov ebx, dword [esp + 0xc]
test esi, esi
je 0x525c96
cmp ebx, 0xffffffff
setne cl
mov byte [esi], cl
mov edx, dword [esp + 4]
or eax, 0xffffffff
cmp ebx, eax
jne 0x525ccc
lock xadd dword [edx], eax
jne 0x525cb4
mov ecx, dword [esp + 4]
push ecx
call fcn.004b7f30
add esp, 4
xor al, al
pop ebx
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.0057372c
add esp, 0x25c
ret
shr ebx, 4
and bl, 1
lock xadd dword [edx], eax
jne 0x525ce5
mov ecx, dword [esp + 4]
push ecx
call fcn.004b7f30
add esp, 4
mov ecx, dword [esp + 0x25c]
mov al, bl
pop ebx
xor ecx, esp
call fcn.0057372c
add esp, 0x25c
ret
Function at 0x526250
Capabilities:
Copy file

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push ebx
push 1
lea eax, [esp + 0xc]
push eax
call fcn.00525660
mov ecx, eax
call fcn.004b9cd0
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00525660
mov ecx, eax
call fcn.004b9cd0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, dword [esp + 4]
test eax, eax
setne bl
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x5262a7
mov ecx, dword [esp + 4]
push ecx
call fcn.004b7f30
add esp, 4
mov edx, dword [esp + 8]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x5262c1
mov ecx, dword [esp + 8]
push ecx
call fcn.004b7f30
add esp, 4
test bl, bl
jne 0x5262d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x18]
mov ecx, 2
mov dword [edx], eax
mov dword [edx + 4], ecx
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x5262e0
Capabilities:
Move file

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push ebx
lea eax, [esp + 8]
push eax
call fcn.00525660
mov ecx, eax
call fcn.004b9cd0
push eax
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x18]
call fcn.00525660
mov ecx, eax
call fcn.004b9cd0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edx, dword [esp + 4]
test eax, eax
setne bl
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x526335
mov ecx, dword [esp + 4]
push ecx
call fcn.004b7f30
add esp, 4
mov edx, dword [esp + 8]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x52634f
mov ecx, dword [esp + 8]
push ecx
call fcn.004b7f30
add esp, 4
test bl, bl
jne 0x526367
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x18]
mov ecx, 2
mov dword [edx], eax
mov dword [edx + 4], ecx
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x526370
Capabilities:
Delete file

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
lea eax, [esp + 4]
push eax
call fcn.00525660
mov ecx, eax
call fcn.004b9cd0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 4]
test eax, eax
setne bl
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x5263ad
mov eax, dword [esp + 4]
push eax
call fcn.004b7f30
add esp, 4
test bl, bl
jne 0x5263c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x10]
mov ecx, 2
mov dword [edx], eax
mov dword [edx + 4], ecx
mov al, bl
pop ebx
pop ecx
ret
Function at 0x526810
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x6b06f8]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
mov ebx, dword [esp + 0x420]
push ebp
push esi
mov dword [esp + 0x10], 0x6ae0d4
mov eax, 0x6ae0d4
mov ecx, 1
lock xadd dword [eax], ecx
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edx, [esp + 0x20]
push edx
push 0x200
call ebp
mov esi, eax
test esi, esi
je 0x526906
cmp esi, 0x200
jbe 0x5268cf
xor ecx, ecx
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.005726e9
add esp, 4
mov edi, eax
push edi
push 0x200
call ebp
test eax, eax
je 0x5268c3
push esi
lea eax, [esp + 0x14]
push edi
push eax
call fcn.004bae70
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
call fcn.004b7f40
mov ecx, dword [esp + 0x10]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x5268c3
mov eax, dword [esp + 0x10]
push eax
call fcn.004b7f30
add esp, 4
push edi
call fcn.0057458b
add esp, 4
pop edi
jmp 0x526906
push esi
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.004bae70
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
call fcn.004b7f40
mov eax, dword [esp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x526906
mov edx, dword [esp + 0xc]
push edx
call fcn.004b7f30
add esp, 4
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
cmp eax, 2
jl 0x52695b
cmp eax, 1
jle 0x526920
mov eax, dword [ecx + 0xc]
movzx eax, word [eax + 2]
jmp 0x526922
xor eax, eax
cmp ax, 0x3a
jne 0x52695b
mov ecx, dword [ecx + 0xc]
mov dx, word [ecx]
lea ecx, [esp + 0xc]
lea eax, [esp + 0x10]
push ecx
lea ecx, [esp + 0x1a]
mov word [esp + 0x1a], dx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
call fcn.004b7650
push eax
lea ecx, [esp + 0x1c]
call fcn.004bc770
mov byte [esp + 0xc], 0
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.00524f20
mov ecx, dword [esp + 0x10]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x52698b
mov eax, dword [esp + 0x10]
push eax
call fcn.004b7f30
add esp, 4
mov ecx, dword [esp + 0x420]
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0057372c
add esp, 0x418
ret
Function at 0x528430
Capabilities:
Get disk information

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, eax
mov ecx, esi
mov byte [esp + 9], 0
xor ebx, ebx
call fcn.00525010
test al, al
je 0x5284b3
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00525120
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov ax, word [edx]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xe]
mov word [esp + 0xe], ax
call fcn.004b7650
movzx ecx, word [eax]
mov edx, dword [esp + 0x10]
sub ecx, 0x41
mov esi, 1
shl esi, cl
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x52849f
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004b7f30
add esp, 4
test ebx, esi
je 0x5285a9
mov ebx, 0x14
mov al, 1
jmp 0x52856e
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.00525660
push 1
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], str._UNC
call fcn.004b97b0
test al, al
je 0x52854c
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0xc]
mov ax, word [edx]
push 1
mov word [esp + 0x14], ax
mov ecx, dword [esp + 0x14]
push 7
push ecx
lea ecx, [esp + 0x18]
call fcn.004b95d0
test eax, eax
jle 0x528531
mov edx, dword [esp + 0xc]
mov ecx, dword [edx + 0xc]
mov dx, word [ecx]
push 1
inc eax
push eax
mov word [esp + 0x18], dx
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
call fcn.004b95d0
test eax, eax
jle 0x528531
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 8]
dec edx
cmp eax, edx
jne 0x52854c
lea eax, [esp + 0xc]
push eax
call fcn.00528250
add esp, 4
test al, al
je 0x52854c
mov ebx, 0x10
mov byte [esp + 9], 1
mov ecx, dword [esp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x528566
mov eax, dword [esp + 0xc]
push eax
call fcn.004b7f30
add esp, 4
mov al, byte [esp + 9]
test al, al
je 0x5285ad
mov dword [edi + 0x10], ebx
test bl, 2
je 0x52857d
or dword [edi + 4], 0x100000
and bl, 0x10
movzx ecx, bl
neg ecx
sbb ecx, ecx
and ecx, 0x20000
add ecx, 0x20000
or dword [edi + 4], ecx
or dword [edi + 4], 0x400000
or dword [edi], 0x560000
pop esi
pop ebx
add esp, 0xc
ret
mov al, byte [esp + 9]
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x53482d
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 8], eax
jle 0x534858
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x655490]
mov esi, eax
shl esi, 3
xor edx, esi
xor eax, edx
inc ecx
dec dword [ebp + 8]
cmp dword [ebp + 8], 0
jg 0x53483a
pop esi
pop ebp
ret

Function at 0x534cf1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x20]
push edi
test eax, eax
je 0x534d34
cdq
push esi
mov esi, eax
add eax, dword [ebp + 0xc]
mov edi, edx
mov ecx, edx
adc ecx, dword [ebp + 0x10]
push edi
sub eax, 1
push esi
sbb ecx, 0
push ecx
push eax
call fcn.00578ed0
push edi
push esi
push edx
push eax
call fcn.00578e90
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
pop esi
push dword [ebp + 0x10]
mov edi, ebx
push dword [ebp + 0xc]
call fcn.00534b87
pop ecx
pop ecx
test eax, eax
jne 0x534d5d
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x534d64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x10], eax
mov dword [ebp - 4], 0x60a
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x534d94
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x534dc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x534dc6
mov dword [esi + 0x10], eax
mov eax, 0x70a
jmp 0x534de6
push 1
push 0
push 0
push dword [ebp + 8]
call fcn.00578e90
mov ecx, eax
xor eax, eax
add ecx, edi
adc edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x5350fb
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.005350c0
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x53511f
push 7
pop eax
jmp 0x5351ae
push esi
call fcn.0053498a
test eax, eax
je 0x53515e
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x53514b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x535193
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jge 0x535193
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x535129
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x535180
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x535193
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jge 0x535193
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x53515e
push edi
call fcn.00573db2
pop ecx
cmp esi, 0xffffffff
pop esi
jne 0x5351a9
cmp ebx, 2
jne 0x5351a9
xor eax, eax
jmp 0x5351ae
mov eax, 0xa0a
pop edi
pop ebx
leave
ret
Function at 0x53bd17
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x6b06f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x6c5fa4]
push ebx
push esi
test eax, eax
je 0x53bd53
push eax
push 0x6727b4
lea eax, [ebp - 0x10c]
push eax
push 0xe6
call fcn.0053b557
add esp, 0x10
jmp 0x53bdcb
call fcn.0053498a
mov esi, 0xe6
test eax, eax
je 0x53bd93
lea eax, [ebp - 0x314]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x314]
push eax
call fcn.00534a42
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x53bdaf
push 7
pop eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0057372c
leave
ret
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x210]
push eax
call fcn.00534b0a
jmp 0x53bd7b
push ebx
push 0x6727b4
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.0053b557
push ebx
call fcn.00573db2
add esp, 0x14
mov ecx, str.etilqs_
call fcn.00533e29
lea ecx, [ebp - 0x10c]
mov edx, eax
call fcn.00533e29
lea eax, [edx + eax + 0x11]
mov edx, dword [ebp + 8]
cmp eax, edx
jl 0x53bdf2
xor eax, eax
inc eax
jmp 0x53bd85
lea ecx, [ebp - 0x10c]
call fcn.00533e29
test eax, eax
jbe 0x53be0b
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x53be0b
dec eax
jne 0x53be02
mov byte [ebp + eax - 0x10c], 0
lea eax, [ebp - 0x10c]
push eax
push str._setilqs_
add edx, 0xffffffef
push edi
push edx
call fcn.0053b557
mov ecx, edi
call fcn.00533e29
mov esi, eax
lea eax, [edi + esi]
push eax
push 0xf
call fcn.0053b713
add esp, 0x18
push 0xf
pop ecx
movzx eax, byte [edi + esi]
xor edx, edx
push 0x3e
pop ebx
div ebx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi], al
inc esi
dec ecx
jne 0x53be43
mov byte [edi + esi], cl
xor eax, eax
jmp 0x53bd85
Function at 0x53bff6
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x6b06f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x10c]
push ecx
push 0x104
push eax
push dword [ebp + 8]
mov dword [ebp - 0x114], 0x200
call fcn.0053bf1e
add esp, 0x10
test eax, eax
jne 0x53c0e0
push ebx
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.005350c0
mov esi, eax
xor ebx, ebx
pop ecx
cmp esi, ebx
je 0x53c0d4
push edi
call fcn.0053498a
test eax, eax
mov eax, esi
je 0x53c097
cmp word [esi], bx
je 0x53c078
cmp word [eax], 0x5c
je 0x53c073
inc eax
inc eax
cmp word [eax], bx
jne 0x53c064
jmp 0x53c078
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x110]
push eax
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x53c0c6
cmp byte [esi], bl
je 0x53c0a9
cmp byte [eax], 0x5c
je 0x53c0a7
inc eax
cmp byte [eax], bl
jne 0x53c09b
jmp 0x53c0a9
mov byte [eax], bl
lea eax, [ebp - 0x110]
push eax
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.00573db2
pop ecx
cmp edi, ebx
pop edi
jne 0x53c0de
mov dword [ebp - 0x114], 0x200
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x114]
xor ecx, ebp
call fcn.0057372c
leave
ret
Function at 0x53e686
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x53e7a0
test esi, esi
je 0x53e7a0
movzx edx, word [edi + 2]
mov eax, 0x800
mov ecx, edx
and ecx, eax
mov ebx, eax
cmp cx, bx
je 0x53e744
movzx ecx, word [esi + 2]
mov ebx, ecx
and ebx, eax
cmp bx, ax
je 0x53e744
xor cl, dl
test cl, 0x10
jne 0x53e744
mov al, byte [edi]
cmp al, byte [esi]
jne 0x53e744
push dword [esi + 8]
push dword [edi + 8]
call fcn.0053e686
pop ecx
pop ecx
test eax, eax
jne 0x53e744
push dword [esi + 0xc]
push dword [edi + 0xc]
call fcn.0053e686
pop ecx
pop ecx
test eax, eax
jne 0x53e744
mov ebx, dword [esi + 0x10]
mov edi, dword [edi + 0x10]
call fcn.00538880
test eax, eax
jne 0x53e744
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x18]
cmp eax, dword [esi + 0x18]
jne 0x53e744
mov ax, word [edi + 0x1c]
cmp ax, word [esi + 0x1c]
jne 0x53e744
movzx eax, word [edi + 2]
mov ecx, eax
mov eax, 0x400
and ecx, eax
mov edx, eax
cmp cx, dx
jne 0x53e749
mov cx, word [esi + 2]
and cx, dx
cmp cx, ax
jne 0x53e744
mov eax, dword [edi + 4]
cmp eax, dword [esi + 4]
je 0x53e773
push 2
pop eax
jmp 0x53e7ab
cmp byte [edi], 0x98
je 0x53e773
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x53e773
mov dx, word [esi + 2]
mov ebx, eax
and dx, bx
cmp dx, ax
je 0x53e744
mov edx, dword [esi + 4]
test edx, edx
je 0x53e744
call fcn.00533e9e
test eax, eax
jne 0x53e744
movzx ecx, word [edi + 2]
mov dx, word [esi + 2]
mov eax, 0x100
and ecx, eax
and dx, ax
cmp cx, dx
je 0x53e78f
xor eax, eax
inc eax
jmp 0x53e7ab
test cx, cx
je 0x53e79c
mov eax, dword [edi + 0x14]
cmp eax, dword [esi + 0x14]
jne 0x53e744
xor eax, eax
jmp 0x53e7ab
mov eax, esi
sub eax, edi
neg eax
sbb eax, eax
and eax, 2
pop edi
pop esi
pop ebx
pop ebp
ret