joyce8/EMBER2024-capa huggingface dataset:
Function at 0x536c84
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0x28000000
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x536ccc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x536cdc
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x536ce3
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
push esi
push edi
mov dword [ebp - 0x250], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x536d0b
mov dword [ebp - 4], 0x6783a4
mov edi, 0x685904
mov edx, dword [ebp - 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00529440
add esp, 4
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x24c]
push eax
push str.ForceFlash.set
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x536d74
xor eax, eax
jmp 0x536e8c
mov dword [ebp - 8], 0
mov dword [ebp - 0x250], 0
cmp dword [ebp - 8], 0
jne 0x536e6e
lea edi, [ebp - 0x220]
lea edx, [ebp - 0x358]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x358]
push ecx
call dword [sym.imp.USER32.dll_CharUpperA]
push str.FORCEFLASH
lea edx, [ebp - 0x358]
push edx
call fcn.0054cb20
add esp, 8
test eax, eax
je 0x536e3f
push 0x5cc8bc
lea eax, [ebp - 0x358]
push eax
call fcn.0054cb20
add esp, 8
test eax, eax
je 0x536e3f
lea edi, [ebp - 0x10c]
mov edx, dword [ebp - 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x5cc8c4
mov ecx, dword [ebp - 4]
push ecx
call fcn.0054bea0
add esp, 8
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0054bea0
add esp, 8
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x536e69
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x536e69
mov dword [ebp - 8], 1
jmp 0x536d85
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp - 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x53922f
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575d1a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1dc
mov dword [ebp - 0x1e8], 0
lea ecx, [ebp - 0x1e0]
call fcn.00401420
mov dword [ebp - 4], 1
push 0x68592c
lea ecx, [ebp - 0x10]
call fcn.005620da
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9c]
call fcn.00401420
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x98]
call fcn.00401420
mov byte [ebp - 4], 4
lea eax, [ebp - 0x94]
push eax
call fcn.00529440
add esp, 4
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x9c]
call fcn.005621f5
mov edx, dword [ebp + 0xc]
push edx
push 0x5ccad0
lea eax, [ebp - 0x94]
push eax
call fcn.0054c6e3
add esp, 0xc
lea ecx, [ebp - 0x94]
push ecx
push 0x5ccad4
lea edx, [ebp - 0x98]
push edx
call fcn.0055f827
add esp, 0xc
lea ecx, [ebp - 0x9c]
call fcn.005287a0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x1dc]
push eax
push 0x5ccad8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0xffffffff
jne 0x53937c
push 0x685930
mov ecx, dword [ebp + 8]
call fcn.005620da
mov ecx, dword [ebp - 0x1e8]
or ecx, 1
mov dword [ebp - 0x1e8], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x98]
call fcn.0056206c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9c]
call fcn.0056206c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.0056206c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1e0]
call fcn.0056206c
mov eax, dword [ebp + 8]
jmp 0x5394a2
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
jne 0x53943e
lea edx, [ebp - 0x1b0]
push edx
lea ecx, [ebp - 0x1e0]
call fcn.005621f5
lea ecx, [ebp - 0x1e0]
call fcn.0056256e
lea ecx, [ebp - 0x98]
call fcn.005287a0
push eax
lea ecx, [ebp - 0x1e0]
call fcn.0055f4a1
cmp eax, 0xffffffff
je 0x53940f
push str..SET
lea ecx, [ebp - 0x1e0]
call fcn.0055f4a1
cmp eax, 0xffffffff
je 0x53940f
push str..BAK
lea ecx, [ebp - 0x1e0]
call fcn.0055f4a1
cmp eax, 0xffffffff
jne 0x53940f
mov eax, dword [ebp - 0x1e0]
push eax
mov ecx, dword [ebp - 0x9c]
push ecx
push str._s_s
lea edx, [ebp - 0x10]
push edx
call fcn.0055f827
add esp, 0x10
lea eax, [ebp - 0x1dc]
push eax
mov ecx, dword [ebp - 0x1e4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x539439
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x539439
mov dword [ebp - 0x14], 1
jmp 0x539383
mov edx, dword [ebp - 0x1e4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00561de1
mov ecx, dword [ebp - 0x1e8]
or ecx, 1
mov dword [ebp - 0x1e8], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x98]
call fcn.0056206c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9c]
call fcn.0056206c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.0056206c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1e0]
call fcn.0056206c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x539ce3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push esi
push edi
mov dword [ebp - 0x318], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x210], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x314]
rep stosd dword es:[edi], eax
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x108]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x108]
push eax
call fcn.00529440
add esp, 4
lea edi, [ebp - 0x108]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
movsx ecx, byte [ebp + ecx - 0x109]
cmp ecx, 0x5c
je 0x539d7a
push 0x5ccbb4
lea edx, [ebp - 0x108]
push edx
call fcn.0054bea0
add esp, 8
jmp 0x539d8e
push str.ISO_List.idx
lea eax, [ebp - 0x108]
push eax
call fcn.0054bea0
add esp, 8
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x539da7
xor eax, eax
jmp 0x539f44
push 0x5ccbd4
lea edx, [ebp - 0x108]
push edx
call fcn.0054cc9f
add esp, 8
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0
jne 0x539dd1
xor eax, eax
jmp 0x539f44
push 2
push 0
mov eax, dword [ebp - 0x318]
push eax
call fcn.0054f7ae
add esp, 0xc
mov ecx, dword [ebp - 0x318]
push ecx
call fcn.0054f6de
add esp, 4
mov dword [ebp - 0x210], eax
push 0
push 0
mov edx, dword [ebp - 0x318]
push edx
call fcn.0054f7ae
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x539e1e
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x210]
xor edx, edx
mov ecx, 0x104
div ecx
cmp dword [ebp - 4], eax
jae 0x539ec3
push 0
mov edx, dword [ebp - 4]
imul edx, edx, 0x104
push edx
mov eax, dword [ebp - 0x318]
push eax
call fcn.0054f7ae
add esp, 0xc
mov ecx, dword [ebp - 0x318]
push ecx
push 0x104
push 1
lea edx, [ebp - 0x20c]
push edx
call fcn.0054ce1b
add esp, 0x10
lea edi, [ebp - 0x20c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
test ecx, ecx
je 0x539ebe
push 0
mov eax, dword [ebp - 4]
imul eax, eax, 0x104
push eax
mov ecx, dword [ebp - 0x318]
push ecx
call fcn.0054f7ae
add esp, 0xc
mov edx, dword [ebp - 0x318]
push edx
push 0x104
push 1
lea eax, [ebp - 0x314]
push eax
call fcn.0054e00a
add esp, 0x10
jmp 0x539ec3
jmp 0x539e15
mov eax, dword [ebp - 0x210]
xor edx, edx
mov ecx, 0x104
div ecx
cmp dword [ebp - 4], eax
jne 0x539f00
mov ecx, 0x41
xor eax, eax
mov edi, dword [ebp + 8]
rep stosd dword es:[edi], eax
mov edx, dword [ebp - 0x318]
push edx
call fcn.0054cbf2
add esp, 4
mov dword [ebp - 0x318], 0
xor eax, eax
jmp 0x539f44
lea edi, [ebp - 0x20c]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x318]
push ecx
call fcn.0054cbf2
add esp, 4
mov dword [ebp - 0x318], 0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x53a388
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push edi
mov ecx, 0x41
xor eax, eax
mov edi, 0x67ad18
rep stosd dword es:[edi], eax
push 0x6784a8
push 0x104
push 0x67ad18
push 0x685940
push str.PortTransfer_ReferenceFile
push str.ReferenceFile
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x67ad18
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x53a3ed
push 0x67ad18
call fcn.00529440
add esp, 4
push str.UFD_MPOSEHub.ini
push 0x67ad18
call fcn.0054bea0
add esp, 8
push 0x67ad18
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x53a3ff
jmp 0x53a40c
push 0x67ad18
call fcn.0053a02b
add esp, 4
pop edi
pop ebp
ret

Function at 0x53c9e3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
cmp dword [ebp - 0x90], 4
jne 0x53ca45
cmp dword [ebp - 0x8c], 0x5a
je 0x53ca43
mov dword [ebp - 0xa4], 1
jmp 0x53ca74
cmp dword [ebp - 0x90], 5
jne 0x53ca74
cmp dword [ebp - 0x8c], 0
jne 0x53ca61
mov dword [ebp - 0x9c], 1
cmp dword [ebp - 0x8c], 1
jne 0x53ca74
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0xa4]
mov esp, ebp
pop ebp
ret

Function at 0x53ca7e
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
cmp dword [ebp - 0x90], 4
jne 0x53cae0
cmp dword [ebp - 0x8c], 0x5a
je 0x53cade
mov dword [ebp - 0xa4], 1
jmp 0x53cb0f
cmp dword [ebp - 0x90], 5
jne 0x53cb0f
cmp dword [ebp - 0x8c], 0
jne 0x53cafc
mov dword [ebp - 0x9c], 1
cmp dword [ebp - 0x8c], 1
jne 0x53cb0f
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x9c]
mov esp, ebp
pop ebp
ret

Function at 0x53cb19
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0xa0], 0
cmp dword [ebp - 0x90], 4
jne 0x53cb85
cmp dword [ebp - 0x8c], 0x5a
je 0x53cb83
mov dword [ebp - 0xa8], 1
jmp 0x53cbc9
cmp dword [ebp - 0x90], 5
jne 0x53cbb6
cmp dword [ebp - 0x8c], 0
jne 0x53cba1
mov dword [ebp - 0x9c], 1
cmp dword [ebp - 0x8c], 1
jne 0x53cbb4
mov dword [ebp - 0x98], 1
jmp 0x53cbc9
cmp dword [ebp - 0x90], 6
jne 0x53cbc9
mov dword [ebp - 0xa0], 1
mov eax, dword [ebp - 0xa0]
mov esp, ebp
pop ebp
ret
Function at 0x53cbd3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
cmp dword [0x685d30], 0
je 0x53cc11
mov edi, 0x5ccd80
lea edx, [ebp - 0x100]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x53cc39
mov edi, 0x5ccdac
lea edx, [ebp - 0x100]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.0054bea0
add esp, 8
lea eax, [ebp - 0x108]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x100]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x108], 0xffffffff
je 0x53ccb9
mov dword [ebp - 0x104], 0xff
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
push str.CreateFileName
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x53ccbf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [0x685d30], 0
je 0x53cd04
mov edi, str.SystemCurrentControlSetServicesClass_
lea edx, [ebp - 0x104]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x53cd2c
mov edi, str.SYSTEMCurrentControlSetControlClass_
lea edx, [ebp - 0x104]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.0054bea0
add esp, 8
lea eax, [ebp - 0x14c]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x104]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x14c], 0xffffffff
je 0x53cdda
mov dword [ebp - 0x148], 0xff
lea edx, [ebp - 0x148]
push edx
lea eax, [ebp - 0x144]
push eax
push 0
push 0
push str.ProviderName
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x150], eax
mov edx, dword [ebp - 0x14c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsx eax, byte [ebp - 0x144]
cmp eax, 0x53
jne 0x53cdda
movsx ecx, byte [ebp - 0x143]
cmp ecx, 0x4d
jne 0x53cdda
movsx edx, byte [ebp - 0x142]
cmp edx, 0x49
jne 0x53cdda
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x54d6f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x54d8c4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x689900]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x54d8c4
test cl, 0x48
je 0x54d75b
cmp byte [eax + 5], 0xa
je 0x54d75b
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x54d7ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x54d795
call fcn.00550eab
mov dword [eax], 9
call fcn.00550ebe
mov dword [eax], esi
jmp 0x54d7a5
cmp eax, 0x6d
je 0x54d8c4
push eax
call fcn.00550ed1
pop ecx
or eax, 0xffffffff
jmp 0x54d8c6
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x54d8bf
test eax, eax
je 0x54d7d4
cmp byte [ebx], 0xa
jne 0x54d7d4
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x54d7dd
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x54d8b9
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x54d8a9
cmp al, 0xd
je 0x54d80f
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x54d89b
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x54d829
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x54d824
add dword [ebp + 0x10], 2
jmp 0x54d87d
mov dword [ebp + 0x10], eax
jmp 0x54d897
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x54d851
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x54d897
cmp dword [ebp - 0xc], 0
je 0x54d897
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x54d872
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x54d87d
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x54d89a
cmp ebx, dword [ebp + 0xc]
jne 0x54d882
cmp byte [ebp - 1], 0xa
jne 0x54d882
mov byte [ebx], 0xa
jmp 0x54d89a
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.005554ab
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x54d89b
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x54d7f3
jmp 0x54d8b9
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x54d8b9
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x54d8c6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x54f4e8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x54f505
call fcn.00550eab
mov dword [eax], 0x16
xor eax, eax
jmp 0x54f56e
xor ecx, ecx
push esi
mov edx, 0x8c
inc ecx
call fcn.005544cb
mov esi, eax
test esi, esi
je 0x54f559
push esi
call fcn.00551e03
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x54f537
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x54f453
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x54f56d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0054ccb2
test ebx, ebx
pop ecx
je 0x54f56b
push ebx
call fcn.00550ed1
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x55564d
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
call fcn.005554ab
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x555792
push 2
push esi
push dword [ebp + 8]
call fcn.005554ab
add esp, 0xc
cmp eax, ebx
je 0x555792
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x555735
mov ebx, 0x1000
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x5556c6
call fcn.00550eab
mov dword [eax], 0xc
or esi, 0xffffffff
jmp 0x55577d
push 0x8000
push dword [ebp + 8]
call fcn.005597ad
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp edi, ebx
mov eax, ebx
jge 0x5556e0
mov eax, edi
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00555808
add esp, 0xc
cmp eax, 0xffffffff
je 0x5556fc
sub edi, eax
test edi, edi
jg 0x5556d8
jmp 0x555714
call fcn.00550ebe
cmp dword [eax], 5
jne 0x555711
call fcn.00550eab
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.005597ad
pop ecx
pop ecx
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x55577d
jge 0x55577d
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005554ab
push dword [ebp + 8]
call fcn.00555288
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x55577d
call fcn.00550eab
mov dword [eax], 0xd
call fcn.00550ebe
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.005554ab
add esp, 0xc
mov eax, esi
pop edi
jmp 0x555794
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x555808
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
jne 0x555826
xor eax, eax
jmp 0x555994
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x689900]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x555859
push 2
push edi
push edi
push dword [ebp + 8]
call fcn.005555ca
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x55592b
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edi
jbe 0x555963
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
mov dword [ebp - 8], edi
cmp ecx, dword [ebp + 0x10]
jae 0x5558b4
mov edx, dword [ebp - 0xc]
inc dword [ebp - 0xc]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x5558a5
inc dword [ebp - 0x14]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 8]
mov byte [eax], dl
inc eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x400
jl 0x555888
mov edi, eax
lea eax, [ebp - 0x41c]
sub edi, eax
push 0
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5558f4
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
cmp eax, edi
jl 0x5558fd
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x555879
jmp 0x5558ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ebp - 0x10]
cmp eax, edi
jne 0x55598f
cmp dword [ebp - 4], edi
je 0x555963
push 5
pop esi
cmp dword [ebp - 4], esi
jne 0x555958
call fcn.00550eab
mov dword [eax], 9
call fcn.00550ebe
mov dword [eax], esi
jmp 0x55598a
push edi
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x55594d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], eax
jmp 0x5558ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x5558ff
push dword [ebp - 4]
call fcn.00550ed1
pop ecx
jmp 0x55598a
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x555978
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x555978
xor eax, eax
jmp 0x555992
call fcn.00550eab
mov dword [eax], 0x1c
call fcn.00550ebe
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x555992
sub eax, dword [ebp - 0x14]
pop esi
pop ebx
pop edi
leave
ret

Function at 0x555fe3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x556003
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00550ed1
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x556026
test byte [esp + 8], 2
je 0x556026
call fcn.00550eab
mov dword [eax], 0xd
call fcn.00550ebe
mov dword [eax], 5
jmp 0x555fff
xor eax, eax
ret