joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ef0ab
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1468
call fcn.0059fbd0
push ebx
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebx]
push esi
push edi
lea eax, [ebp - 0x125c]
call fcn.004016d4
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
push 0
push str.DSS
mov ecx, esi
call dword [eax + 0x20]
mov eax, dword [esi]
push 1
lea ecx, [ebp - 0x125c]
push ecx
mov ecx, esi
call dword [eax + 0x20]
mov eax, dword [ebp + 8]
mov dword [eax], 2
lea eax, [ebp - 0x20c]
push eax
call fcn.00401b1f
lea eax, [ebp - 0x20c]
push eax
push dword [ebx]
call fcn.00401a8b
mov edi, dword [ebx + 4]
push 0x5be650
lea edx, [ebp - 0x20c]
call fcn.004a2d01
lea eax, [ebp - 0x1464]
push eax
mov eax, dword [ebx]
call fcn.00401016
push 6
pop edi
lea esi, [ebp - 0x1030]
mov dword [ebp - 0x1040], 0x6080d4
mov dword [ebp - 0x103c], edi
mov byte [ebp - 0x1032], 0xff
mov byte [ebp - 0x1031], 0
mov byte [ebp - 0x1038], 0
call fcn.004ee176
mov eax, 0x1fa
xor esi, esi
push eax
mov dword [ebp - 0x1054], esi
mov dword [ebp - 0x1050], 0x200
mov dword [ebp - 0x104c], edi
mov dword [ebp - 0x1044], esi
mov dword [ebp - 0x1048], eax
call fcn.0058f8c4
pop ecx
push dword [ebx + 4]
mov dword [ebp - 0x211], eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x1054]
push eax
call fcn.004eefbf
test eax, eax
je 0x4ef1bb
mov eax, dword [ebp + 8]
mov dword [eax], esi
cmp dword [ebp - 0x625], esi
mov eax, 0x3e80
jne 0x4ef1cd
mov eax, 0x2ee0
mov dword [ebx + 8], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x211]
call fcn.0058f8c9
push dword [ebp - 0x615]
call fcn.0058f8c9
mov eax, dword [ebp + 8]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4f10e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push edi
mov edi, eax
mov dword [ebp - 4], 0
mov edi, edi
mov edx, dword [edi + 0x1a]
push 0
lea eax, [ebp - 8]
push eax
push 4
lea ecx, [ebp - 4]
push ecx
push edx
call ebx
mov eax, dword [ebp - 4]
bswap eax
mov ecx, eax
shr ecx, 0x18
and cl, 0x7f
mov dword [ebp - 4], eax
je 0x4f1182
cmp cl, 1
je 0x4f115e
cmp cl, 2
je 0x4f115e
cmp cl, 5
je 0x4f115e
cmp cl, 4
je 0x4f115e
cmp cl, 6
je 0x4f115e
cmp cl, 3
jne 0x4f114c
lea eax, [ebp - 4]
call fcn.004f1190
jmp 0x4f1170
push 1
and eax, 0xffffff
cdq
push 0
push edx
push eax
mov eax, dword [edi + 0x1a]
push eax
jmp 0x4f116e
mov ecx, dword [edi + 0x1a]
push 1
and eax, 0xffffff
cdq
push 0
push edx
push eax
push ecx
call esi
mov edx, dword [ebp - 4]
shr edx, 0x1f
cmp dl, 1
jne 0x4f1100
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi + 0xd], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f1190
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, dword [eax]
and ecx, 0xffffff
mov eax, 0x38e38e39
mul ecx
push esi
mov esi, edx
lea eax, [edi + 0x176]
shr esi, 2
push eax
call fcn.0055cae4
xor eax, eax
cmp esi, eax
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
jbe 0x4f127b
push ebx
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
xor ebx, ebx
jmp 0x4f11e5
xor eax, eax
mov ecx, dword [edi + 0x1a]
push eax
lea edx, [ebp - 8]
push edx
push 8
lea eax, [ebp - 0x24]
push eax
push ecx
call esi
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
push 0
bswap edx
lea ecx, [ebp - 0xc]
push ecx
bswap eax
mov dword [ebp - 0x20], edx
push 8
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0x1a]
push edx
push eax
call esi
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push 0
bswap ecx
lea eax, [ebp - 0x10]
push eax
bswap edx
mov dword [ebp - 0x18], ecx
push 2
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x1c], edx
mov edx, dword [edi + 0x1a]
push ecx
push edx
call esi
mov ax, word [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov ch, al
mov cl, ah
mov eax, dword [edi + 0x176]
add eax, ebx
add ebx, 0x12
sub dword [ebp - 4], 1
mov word [ebp - 0x14], cx
mov dword [eax], edx
mov ecx, dword [ebp - 0x20]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0xc], ecx
mov dx, word [ebp - 0x14]
mov word [eax + 0x10], dx
jne 0x4f11e3
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4f1830
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [edi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push 0
lea ecx, [ebp - 4]
push ecx
mov esi, eax
push 2
lea eax, [esi + 4]
push eax
push edx
call ebx
mov ax, word [esi + 4]
mov ch, al
push 0
lea edx, [ebp - 4]
push edx
push 2
mov cl, ah
lea eax, [esi + 6]
push eax
mov word [esi + 4], cx
mov eax, dword [edi]
push eax
call ebx
mov cx, word [esi + 6]
mov dh, cl
push 0
lea eax, [esi + 8]
mov dl, ch
lea ecx, [ebp - 4]
push ecx
push 3
push eax
mov word [esi + 6], dx
mov edx, dword [edi]
push edx
call ebx
mov eax, dword [esi + 8]
push 0
bswap eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi + 8], eax
shr dword [esi + 8], 8
mov edx, dword [edi]
push 3
lea eax, [esi + 0xc]
push eax
push edx
call ebx
mov eax, dword [esi + 0xc]
bswap eax
mov dword [esi + 0xc], eax
shr dword [esi + 0xc], 8
xor eax, eax
push eax
lea ecx, [ebp - 4]
push ecx
push 8
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, dword [edi]
push edx
push eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
bswap eax
mov edx, eax
shr edx, 0xc
mov dword [esi + 0x10], edx
mov edx, eax
shr edx, 9
bswap ecx
and dl, 7
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
add dl, 1
mov byte [esi + 0x14], dl
mov edx, eax
shr edx, 4
and eax, 0xf
mov dword [esi + 0x1a], eax
push 0
and dl, 0x1f
lea eax, [ebp - 4]
push eax
add dl, 1
mov byte [esi + 0x15], dl
mov dword [esi + 0x16], ecx
mov ecx, dword [edi]
push 0x10
add esi, 0x1e
push esi
push ecx
call ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f1940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, eax
mov eax, dword [esi]
push 0
lea ecx, [ebp - 0xc]
push ecx
bswap eax
push 4
lea edx, [ebp - 8]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push edx
push eax
call ebx
movzx ecx, word [esi + 4]
mov dh, cl
push 0
mov dl, ch
lea ecx, [ebp - 0xc]
push ecx
push 2
movzx eax, dx
lea edx, [ebp - 8]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push edx
push eax
call ebx
movzx ecx, word [esi + 6]
mov dh, cl
push 0
mov dl, ch
lea ecx, [ebp - 0xc]
push ecx
push 2
movzx eax, dx
lea edx, [ebp - 8]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push edx
push eax
call ebx
mov ecx, dword [esi + 8]
push 0
shl ecx, 8
lea edx, [ebp - 0xc]
push edx
bswap ecx
push 3
lea eax, [ebp - 4]
mov dword [ebp - 4], ecx
mov ecx, dword [edi]
push eax
push ecx
call ebx
mov edx, dword [esi + 0xc]
push 0
shl edx, 8
lea eax, [ebp - 0xc]
push eax
bswap edx
push 3
lea ecx, [ebp - 4]
mov dword [ebp - 4], edx
mov edx, dword [edi]
push ecx
push edx
call ebx
movzx eax, byte [esi + 0x14]
sub eax, 1
cdq
mov ecx, eax
mov eax, dword [esi + 0x10]
mov ebx, edx
cdq
shld edx, eax, 3
add eax, eax
add eax, eax
add eax, eax
or ecx, eax
movzx eax, byte [esi + 0x15]
or ebx, edx
shld ebx, ecx, 5
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
shl ecx, 5
sub eax, 1
cdq
or ecx, eax
shl ecx, 4
or ecx, dword [esi + 0x1a]
xor edx, edx
or edx, dword [esi + 0x16]
push 0
bswap ecx
lea eax, [ebp - 0xc]
push eax
bswap edx
mov dword [ebp - 0x18], ecx
push 8
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [edi]
push ecx
push edx
call ebx
mov ecx, dword [edi]
push 0
lea eax, [ebp - 0xc]
push eax
push 0x10
add esi, 0x1e
push esi
push ecx
call ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f1a50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ecx, ecx
push ecx
push ecx
mov esi, eax
push ecx
mov eax, 0xc
push eax
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ecx, dword [esi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
shl ecx, 8
lea edx, [ebp - 8]
push edx
bswap ecx
push 3
lea eax, [ebp - 4]
mov dword [ebp - 4], ecx
mov ecx, dword [edi]
push eax
push ecx
call ebx
mov edx, dword [esi + 0xc]
push 0
shl edx, 8
lea eax, [ebp - 8]
push eax
bswap edx
push 3
lea ecx, [ebp - 4]
mov dword [ebp - 4], edx
mov edx, dword [edi]
push ecx
push edx
call ebx
movzx eax, byte [esi + 0x14]
sub eax, 1
cdq
mov ecx, eax
mov eax, dword [esi + 0x10]
mov ebx, edx
cdq
shld edx, eax, 3
add eax, eax
add eax, eax
add eax, eax
or ecx, eax
movzx eax, byte [esi + 0x15]
or ebx, edx
shld ebx, ecx, 5
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
shl ecx, 5
sub eax, 1
cdq
or ecx, eax
shl ecx, 4
or ecx, dword [esi + 0x1a]
xor edx, edx
or edx, dword [esi + 0x16]
push 0
bswap ecx
lea eax, [ebp - 8]
push eax
bswap edx
mov dword [ebp - 0x10], ecx
push 8
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov edx, dword [edi]
push ecx
push edx
call ebx
push 0
lea eax, [ebp - 8]
push eax
push 0x10
add esi, 0x1e
mov ecx, dword [edi]
push esi
push ecx
call ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f1d70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 8], edi
jle 0x4f1e50
cmp dword [esi + 4], edi
je 0x4f1e50
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
bswap eax
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push 4
lea edx, [ebp - 8]
push edx
push ecx
call ebx
cmp dword [esi + 8], edi
mov dword [ebp - 8], edi
jle 0x4f1e50
mov dword [ebp - 4], edi
jmp 0x4f1dc3
mov esi, edx
mov eax, dword [esi + 4]
add eax, dword [ebp - 4]
push 0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov esi, dword [eax + 8]
mov edi, dword [eax + 0xc]
mov ax, word [eax + 0x10]
bswap ecx
mov dword [ebp - 0x1c], ecx
bswap edx
lea ecx, [ebp - 0x10]
push ecx
mov word [ebp - 0x2c], ax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x20], edx
push 8
lea edx, [ebp - 0x20]
push edx
push ecx
call ebx
push 0
lea edx, [ebp - 0x14]
push edx
bswap esi
mov dword [ebp - 0x24], esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi]
push 8
lea eax, [ebp - 0x28]
push eax
bswap edi
push ecx
mov dword [ebp - 0x28], edi
call ebx
mov dx, word [ebp - 0x2c]
mov ah, dl
push 0
mov al, dh
lea edx, [ebp - 0x18]
push edx
push 2
movzx ecx, ax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov ecx, dword [esi]
push eax
push ecx
call ebx
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 8]
add dword [ebp - 4], 0x12
add eax, 1
cmp eax, dword [edx + 8]
mov dword [ebp - 8], eax
jl 0x4f1dc1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f4e90
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
lea esi, [edi + 4]
jns 0x4f4ea7
add eax, dword [esi]
cmp eax, 0x7fff
jae 0x4f4f2c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push ebx
lea eax, [ebp - 8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4f4eca
xor ebx, ebx
mov dword [ebp - 0xc], ebx
jmp 0x4f4ed3
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 1
lea edx, [ebp - 0x10]
push edx
xor ecx, ecx
push ecx
xor eax, eax
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4f4ef4
mov dword [ebp - 0x14], eax
jmp 0x4f4efd
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
sub ebx, eax
cmp ebx, 0x7fff
jbe 0x4f4f0c
mov ebx, 0x7fff
mov ecx, dword [edi]
mov edx, dword [ebp + 8]
push 0
lea eax, [ebp + 8]
push eax
mov eax, dword [edx]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [edi]
push ebx
push ecx
call fcn.0055ca1c
pop ebx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
call fcn.0049c687
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x50b39a
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea esi, [ebp - 1]
call fcn.00447312
xor ebx, ebx
mov word [edi], bx
call fcn.0050b382
movzx eax, ax
movzx eax, ax
push eax
lea esi, [ebp - 0x20]
call fcn.0050b15a
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
call fcn.0050b0ae
test eax, eax
mov eax, dword [ebp - 0xc]
jl 0x50b44b
cmp eax, ebx
je 0x50b455
xor esi, esi
jmp 0x50b3f3
cmp dword [ebp + 0xc], esi
mov eax, dword [ebp - 8]
je 0x50b406
mov ecx, dword [eax]
push eax
inc esi
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 8]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x50b3e1
jmp 0x50b448
lea edx, [ebp + 8]
push edx
lea edx, [ebp - 0x20]
push edx
mov dword [ebp + 8], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
cmp eax, 0x8004503a
jne 0x50b42c
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push ebx
push eax
call dword [ecx + 0x18]
cmp eax, ebx
jl 0x50b43f
mov edx, dword [ebp + 8]
push 0x104
mov esi, edi
call fcn.004a8ff7
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x50b455
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 1], bl
je 0x50b460
call dword [sym.imp.ole32.dll_CoUninitialize]
pop esi
pop ebx
leave
ret 8

Function at 0x50b466
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftSpeechRecognizers
push edi
call fcn.0050b275
cmp ebx, eax
jge 0x50b4a2
push esi
call fcn.0050b382
movzx eax, ax
movzx eax, ax
push eax
lea esi, [ebp - 0x14]
call fcn.0050b15a
push ebx
push edi
mov edi, dword [ebp + 0xc]
call fcn.0050b39a
pop esi
jmp 0x50b4ad
mov edi, dword [ebp + 0xc]
sub ebx, eax
push ebx
call fcn.0050b2fc
pop edi
pop ebx
leave
ret 8
Function at 0x50f39e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi]
sub esp, 0x38
cmp eax, 0xffffffff
je 0x50f432
xor edx, edx
push edx
push edx
push edx
mov ecx, 0x438
push ecx
push eax
mov dword [ebp - 0x34], 0x2e4b2e4d
mov dword [ebp - 0x30], 0x214b214d
mov dword [ebp - 0x2c], 0x4e484334
mov dword [ebp - 0x28], 0x4e484336
mov dword [ebp - 0x24], 0x4e484338
mov dword [ebp - 0x20], 0x544c4634
mov dword [ebp - 0x1c], 0x544c4638
mov dword [ebp - 0x18], 0x31384443
mov dword [ebp - 0x14], 0x41544b4f
mov dword [ebp - 0x10], 0x4e433631
mov dword [ebp - 0xc], 0x4e433233
mov dword [ebp - 8], 0x20202020
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 4
lea eax, [ebp - 4]
push eax
push esi
call fcn.00401f65
xor eax, eax
mov ecx, dword [ebp + eax*4 - 0x34]
cmp ecx, dword [ebp - 4]
je 0x50f436
inc eax
cmp eax, 0xc
jb 0x50f423
xor al, al
leave
ret
mov al, 1
leave
ret

Function at 0x517c71
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 0xc]
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, eax
mov eax, edi
call fcn.0050a240
push dword [ebp + 8]
lea esi, [edi + 0x20]
mov dword [edi], 0x60848c
call fcn.00402129
cmp dword [esi], 0xffffffff
jne 0x517ca2
or byte [edi + 0x11], 1
movzx eax, byte [ebp + 0xc]
imul eax, ebx
mov dword [edi + 0x18], ebx
xor ebx, ebx
mov dword [edi + 0x1c], eax
push ebx
mov eax, edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.00517dab
cmp dword [edi + 8], ebx
jl 0x517d11
jg 0x517ccb
cmp dword [edi + 4], ebx
jbe 0x517d11
push esi
call fcn.004019a4
push dword [edi + 8]
mov dword [ebp - 8], eax
push dword [edi + 4]
mov ebx, edx
push 0
push dword [edi + 0x1c]
call fcn.0059d970
mov ecx, dword [ebp - 8]
add ecx, eax
push esi
mov dword [ebp - 8], ecx
adc ebx, edx
call fcn.004019d3
cmp ebx, edx
jb 0x517d06
ja 0x517d01
cmp dword [ebp - 8], eax
jbe 0x517d06
mov dword [ebp - 8], eax
mov ebx, edx
push ebx
push dword [ebp - 8]
mov eax, esi
call fcn.00401976
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [esi], 0xffffffff
jne 0x517d22
or byte [edi + 0x11], 1
pop esi
mov eax, edi
pop ebx
leave
ret 0xc
Function at 0x525cf8
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
add ebx, 0xc
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor edi, edi
inc edi
lea esi, [ebp - 0x10]
call fcn.0043547d
mov eax, dword [ebp - 0x10]
push ebx
mov dword [eax], 0x4b4e554a
call fcn.004019d3
xor ecx, ecx
push ecx
push ecx
mov dword [ebp - 8], eax
push ecx
xor eax, eax
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov esi, dword [ebp + 8]
add esi, 0x10
jmp 0x525da3
push esi
call fcn.0044b960
test al, al
je 0x525da3
jmp 0x525d9a
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x10]
call fcn.0044b9b9
test al, al
je 0x525d9a
push dword [esi + 0x18]
mov eax, esi
push dword [esi + 0x14]
call fcn.00401976
mov eax, dword [ebp - 0x14]
test al, 1
je 0x525d7e
inc eax
push ebx
lea edi, [eax + 8]
call fcn.004019a4
mov ecx, dword [ebp - 8]
sub ecx, eax
cmp edi, ecx
jae 0x525dae
push 0
push edi
mov eax, ebx
call fcn.0040198d
call fcn.00525530
test al, al
je 0x525d58
call fcn.0044b99d
test al, al
je 0x525d4c
jmp 0x525dbe
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edi, dword [ebp + 8]
call fcn.00526011
push dword [ebp - 0x10]
call fcn.0058f8c9
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x525fa8
Capabilities:
Clear file content

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, eax
lea esi, [edi + 0xc]
push esi
call fcn.004019d3
push edx
push eax
mov eax, esi
call fcn.00401976
mov esi, edi
xor ebx, ebx
call fcn.00525ecb
test al, al
je 0x525fd0
push 0x10
pop ebx
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x2c]
test al, al
je 0x525feb
call fcn.00525e1f
test al, al
je 0x525feb
mov eax, dword [edi + 0x3c]
lea ebx, [ebx + eax + 8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x20]
add ebx, eax
cmp ebx, dword [esp + 0x14]
je 0x52600a
jae 0x526005
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call fcn.00526011
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x52c478
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
mov ebx, dword [ebp + 0xc]
push esi
jmp 0x52c5e5
mov eax, dword [edi + 0x10f0]
mov esi, 0x3ffff800
cmp eax, esi
jae 0x52c4d5
sub esi, eax
cmp esi, ebx
jbe 0x52c4a2
mov esi, ebx
cmp word [edi + 0xdb8], 0
je 0x52c4c5
lea eax, [edi + 0x1317]
cmp dword [eax], 0xffffffff
je 0x52c5ed
push esi
push dword [ebp + 8]
push eax
call fcn.00402005
add dword [ebp + 8], esi
sub ebx, esi
add dword [edi + 0x10f0], esi
jmp 0x52c5e5
mov eax, dword [edi + 0x1317]
cmp eax, 0xffffffff
je 0x52c4ee
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi + 0x1317], 0xffffffff
cmp word [edi + 0xdb8], 0
je 0x52c5d1
and word [ebp - 0x208], 0
cmp byte [edi + 0x154c], 0
je 0x52c52b
movzx eax, byte [edi + 0x1343]
push eax
lea eax, [edi + 0x1344]
push eax
lea eax, [ebp - 0x208]
call fcn.0055a394
pop ecx
pop ecx
jmp 0x52c579
lea esi, [edi + 0x1344]
push 0x5c5698
push esi
call fcn.0058fe77
test eax, eax
pop ecx
pop ecx
je 0x52c567
lea eax, [edi + 0x1316]
inc byte [eax]
movzx eax, byte [eax]
push eax
movzx eax, byte [edi + 0x1343]
push eax
push esi
lea eax, [ebp - 0x208]
call fcn.0055a394
add esp, 0xc
jmp 0x52c579
mov edx, esi
push 0x104
lea esi, [ebp - 0x208]
call fcn.004a8ff7
and word [ebp - 0x410], 0
lea eax, [ebp - 0x208]
push eax
lea eax, [edi + 0x110e]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.00401f2d
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x1317]
cmp eax, 0xffffffff
je 0x52c5ba
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
lea eax, [ebp - 0x410]
push eax
call fcn.0040194a
mov dword [edi + 0x1317], eax
and dword [edi + 0x10f0], 0
and dword [edi + 0x10ec], 0
mov dword [edi + 0x10e8], ebx
test ebx, ebx
ja 0x52c48b
pop esi
pop ebx
leave
ret 8

Function at 0x52e112
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x208]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x52e138
sub eax, ecx
sar eax, 1
cmp word [ebp + eax*2 - 0x20a], 0x5c
mov esi, 0x5b07d8
je 0x52e15b
mov esi, 0x5c56a4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
push str._s_sshmf_I64d__I64d___d.bin.tmp
lea edi, [ebp - 0x410]
call fcn.004a9039
add esp, 0x1c
mov eax, dword [0x6a4e48]
mov edi, dword [ebp + 8]
inc dword [0x6a4e48]
push eax
lea eax, [ebp - 0x410]
push eax
mov esi, 0x104
call fcn.004a9039
pop ecx
pop ecx
push edi
call fcn.00401b98
test al, al
jne 0x52e18b
mov eax, edi
pop edi
pop esi
leave
ret 8