joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e77a5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004e7721
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4e791d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4e791d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4e78cc
jg 0x4e77fe
test eax, eax
je 0x4e78c2
push 1
push 0x1000
call fcn.004d7c02
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4e7824
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x4e78b9
push 0x8000
push ebx
call fcn.004d65f6
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4e7850
jg 0x4e784b
cmp ecx, 0x1000
jb 0x4e7850
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004ddc0c
add esp, 0x10
cmp eax, 0xffffffff
je 0x4e7895
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4e784b
jl 0x4e787c
test ecx, ecx
jne 0x4e783d
push dword [ebp - 0xc]
push ebx
call fcn.004d65f6
push esi
call fcn.004d6a3e
add esp, 0xc
xor edi, edi
jmp 0x4e792e
cmp byte [edi + 0x24], 0
je 0x4e78ac
cmp dword [edi + 0x20], 5
jne 0x4e78ac
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4e78b7
mov edi, dword [edi + 0x18]
jmp 0x4e78b9
xor edi, edi
push esi
call fcn.004d6a3e
pop ecx
jmp 0x4e792e
test ecx, ecx
jg 0x4e788e
jl 0x4e78cc
test eax, eax
jae 0x4e788e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004e00a3
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4e78ef
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4e788e
jmp 0x4e7926
push ebx
call fcn.004e34b1
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4e788e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4e792e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4e792b
mov edi, dword [edi + 0x18]
jmp 0x4e792e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004e00a3
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4edb10
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60a043
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x7f206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebp - 0xa0]
call fcn.00403450
mov dword [ebp - 4], 0
mov ecx, dword [0x800f60]
mov eax, dword [ecx]
mov dword [ebp - 0x38], eax
lea esi, [eax - 8]
cmp esi, 0x7a1354
je 0x4edb77
mov eax, 1
lock xadd dword [esi], eax
mov ecx, dword [0x800f60]
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00402940
or edi, 0xffffffff
mov byte [ebp - 4], 0
cmp esi, 0x7a1354
je 0x4edbad
mov eax, edi
lock xadd dword [esi], eax
test eax, eax
jne 0x4edbad
push esi
call fcn.004a8172
add esp, 4
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x38]
call fcn.00524830
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x60]
call fcn.005288d0
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3c]
call fcn.00418480
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
lea ecx, [ebp - 0x34]
push ecx
push 0
push dword [eax]
call esi
mov eax, dword [ebp - 0x38]
cmp byte [eax], 0
je 0x4edc8d
lea edx, [ebp - 0x38]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3c]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov byte [ebp - 4], 3
test al, 0x10
jne 0x4edc8d
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x3c]
call fcn.00418480
lea ecx, [ebp - 0x34]
push ecx
push 0
push dword [eax]
call esi
test eax, eax
je 0x4edc35
mov eax, dword [ebp - 0x18]
xor ecx, ecx
or ecx, dword [ebp - 0x14]
jmp 0x4edc43
xorps xmm0, xmm0
movlpd qword [ebp - 0x40], xmm0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 0x78]
jne 0x4edc8d
cmp eax, dword [ebp - 0x74]
jne 0x4edc8d
lea ecx, [ebx + 0x1f8]
mov eax, 2
xchg dword [ecx], eax
mov eax, dword [ebx + 0xa08]
lea ecx, [ebx + 0xa08]
push 1
call dword [eax + 0x2c]
mov eax, dword [ebx + 0x8b0]
lea ecx, [ebx + 0x8b0]
push 0
call dword [eax + 0x2c]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebx + 0x1d4]
call fcn.00528440
jmp 0x4edcb9
lea ecx, [ebx + 0x1f8]
xor eax, eax
xchg dword [ecx], eax
mov eax, dword [ebx + 0xa08]
lea ecx, [ebx + 0xa08]
push 0
call dword [eax + 0x2c]
mov eax, dword [ebx + 0x8b0]
lea ecx, [ebx + 0x8b0]
push 1
call dword [eax + 0x2c]
lea ecx, [ebp - 0x60]
call fcn.00528870
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x4edcdf
lock xadd dword [eax], edi
test edi, edi
jne 0x4edcdf
push eax
call fcn.004a8172
add esp, 4
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0xffffffff
call fcn.00403500
push dword [ebp + 8]
mov ecx, ebx
call fcn.005fb770
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret 4
Function at 0x4f2020
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60a83b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x7f2bbc]
cmp byte [eax], 0
je 0x4f20b9
push 0x62988f
lea ecx, [ebp - 0x10]
call fcn.0041d340
add esp, 4
lea edx, [ebp - 0x10]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00418480
mov edx, 0x7f2bbc
lea ecx, [ebp - 0x18]
mov esi, dword [eax]
call fcn.00418480
push 0xa
push 0
push esi
push dword [eax]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x4f214c
or eax, 0xffffffff
lock xadd dword [ecx], eax
test eax, eax
jne 0x4f214c
push ecx
jmp 0x4f2144
push 0x629895
lea ecx, [ebp - 0x14]
call fcn.0041d340
push str.https:__www14.53kf.com_webCompany.php_cid72627691arg10627691kf_signDUyMzMTY2OA4OTE0ODc1NTI5MDM4MDAzNzI2Mjc2OTE_253Dstyle1uidcc1b59b34c076d209ebca7330e7e1bf9
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.0041d340
add esp, 8
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00418480
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x1c]
mov esi, dword [eax]
call fcn.00418480
push 0xa
push 0
push esi
push dword [eax]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x10]
or esi, 0xffffffff
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x4f212e
mov eax, esi
lock xadd dword [ecx], eax
test eax, eax
jne 0x4f212e
push ecx
call fcn.004a8172
add esp, 4
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x4f214c
lock xadd dword [eax], esi
test esi, esi
jne 0x4f214c
push eax
call fcn.004a8172
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4fc5a0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ecx + 4]
mov eax, dword [edi + 0x40]
test eax, eax
jne 0x4fc5c1
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp ebx, dword [edi + 0x50]
jne 0x4fc5d5
cmp esi, dword [edi + 0x54]
je 0x4fc6bf
push 0
push 0
push 0
push ebx
push eax
mov byte [edi + 0x58], 0
call dword [sym.imp.WININET.dll_InternetSetFilePointer]
xor ecx, ecx
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], ecx
cmp eax, ebx
jne 0x4fc602
cmp esi, ecx
jne 0x4fc604
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp esi, ecx
jg 0x4fc60c
jl 0x4fc5b6
cmp ebx, eax
jb 0x4fc5b6
sub ebx, eax
sbb esi, ecx
mov dword [esp + 0xc], esi
js 0x4fc62b
jg 0x4fc620
cmp ebx, 0x4000
jbe 0x4fc62b
mov eax, 0x4000
mov dword [esp + 0x10], eax
jmp 0x4fc631
mov eax, ebx
mov dword [esp + 0x10], ebx
push eax
call fcn.004c2f64
mov ecx, dword [esp + 0x10]
add esp, 4
mov esi, eax
test ecx, ecx
jl 0x4fc6b6
jg 0x4fc650
test ebx, ebx
je 0x4fc6b6
nop word [eax + eax]
cmp byte [edi + 0x58], 0
jne 0x4fc6b6
mov eax, dword [esp + 0x10]
cdq
cmp edx, ecx
jg 0x4fc66b
jl 0x4fc665
cmp eax, ebx
jae 0x4fc66b
mov edx, dword [esp + 0x10]
jmp 0x4fc66d
mov edx, ebx
xor eax, eax
test esi, esi
je 0x4fc6a3
mov dword [esp + 0x14], eax
cmp dword [edi + 0x40], eax
je 0x4fc6a3
lea eax, [esp + 0x14]
push eax
push edx
push esi
push dword [edi + 0x40]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esp + 0x14]
add dword [edi + 0x50], eax
mov ecx, dword [esp + 0xc]
adc dword [edi + 0x54], 0
test eax, eax
jne 0x4fc6a3
mov byte [edi + 0x58], 1
cdq
sub ebx, eax
sbb ecx, edx
mov dword [esp + 0xc], ecx
test ecx, ecx
jg 0x4fc650
jl 0x4fc6b6
test ebx, ebx
jne 0x4fc650
push esi
call fcn.004c2bdc
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4fc6d0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x4fc6ea
mov byte [esi + 8], 1
mov ecx, dword [esi + 4]
push 0
call fcn.00415890
mov ecx, dword [ebp + 8]
xor eax, eax
mov esi, dword [esi + 4]
test ecx, ecx
je 0x4fc726
mov dword [ebp + 8], eax
cmp byte [esi + 0x58], al
jne 0x4fc726
mov edx, dword [esi + 0x40]
test edx, edx
je 0x4fc726
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp + 8]
add dword [esi + 0x50], eax
adc dword [esi + 0x54], 0
test eax, eax
jne 0x4fc726
mov byte [esi + 0x58], 1
pop esi
pop ebp
ret 8
Function at 0x4fc730
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x4fc74d
mov byte [esi + 8], 1
mov ecx, dword [esi + 4]
push 0
call fcn.00415890
mov eax, dword [esi + 4]
pop esi
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4fc792
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], 4
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x4fc792
mov eax, dword [ebp - 4]
xor edx, edx
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
or edx, eax
mov esp, ebp
pop ebp
ret
Function at 0x4ffbb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c093
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
mov esi, 1
mov dword [ebp - 0x10], eax
lea ecx, [eax - 8]
cmp ecx, 0x7a1354
je 0x4ffbf1
mov eax, esi
lock xadd dword [ecx], eax
push 0x79d134
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.00518bc0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
lea ecx, [eax - 8]
cmp ecx, 0x7a1354
je 0x4ffc1a
lock xadd dword [ecx], esi
or esi, 0xffffffff
cmp ecx, 0x7a1354
je 0x4ffc38
mov eax, esi
lock xadd dword [ecx], eax
test eax, eax
jne 0x4ffc38
push ecx
call fcn.004a8172
add esp, 4
lea edx, [ebp - 0x10]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x4ffc70
lock xadd dword [eax], esi
test esi, esi
jne 0x4ffc70
push eax
call fcn.004a8172
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x500240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c0e3
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.004104b0
mov dword [ebp - 4], 0
mov esi, dword [esi]
test esi, esi
je 0x50034f
push dword [ebp + 0x10]
mov ecx, esi
call fcn.00415660
test al, al
je 0x50034f
mov edi, dword [ebp + 0xc]
test edi, edi
jg 0x5002a6
xor edi, edi
jmp 0x500352
push 0
push 0
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push 0
movups xmmword [ebp - 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5002ec
push dword [ebp - 0x14]
mov edi, dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x500352
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x3e5
jne 0x500346
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.00415830
test al, al
je 0x500346
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x500332
push dword [ebp - 0x14]
mov edi, dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x500352
call edi
cmp eax, 0x6d
jne 0x500346
cmp byte [esi + 0xd], 0
je 0x500346
mov ecx, esi
call fcn.00415810
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or edi, 0xffffffff
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [ebp - 0x10]
mov ecx, esi
mov dword [ebp + 0x10], eax
call fcn.005127d0
mov ecx, dword [esi + 0xd8]
xor edx, edx
test ecx, ecx
jle 0x500392
mov eax, dword [esi + 0xd0]
nop
mov esi, dword [ebp + 0x10]
cmp dword [eax], esi
mov esi, dword [ebp - 0x10]
je 0x5003ab
inc edx
add eax, 8
cmp edx, ecx
jl 0x500380
xor eax, eax
xchg dword [esi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
add dword [eax + 4], 0xffffffff
jne 0x50043e
cmp edx, dword [esi + 0xd8]
jae 0x50042e
mov eax, dword [esi + 0xd0]
lea ecx, [eax + edx*8]
mov eax, dword [esi + 0xd8]
sub eax, edx
lea eax, [eax*8 - 8]
push eax
lea eax, [ecx + 8]
push eax
push ecx
call fcn.004bfcc0
mov eax, dword [esi + 0xd8]
add esp, 0xc
mov dword [ebp + 0x10], eax
lea ecx, [eax - 1]
xor eax, eax
mov dword [esi + 0xd8], ecx
add ecx, ecx
test ecx, ecx
cmovg eax, ecx
cmp dword [esi + 0xd4], eax
jle 0x50042e
mov ecx, dword [ebp + 0x10]
cmp ecx, 8
mov dword [ebp + 8], 8
lea eax, [ecx - 1]
cmovle eax, dword [ebp + 8]
cmp eax, dword [esi + 0xd4]
jge 0x50042e
push eax
lea ecx, [esi + 0xd0]
call fcn.0041bad0
lea ecx, [esi + 4]
call fcn.004fef70
lea ecx, [esi + 0x64]
call fcn.004fef70
xor ecx, ecx
xchg dword [esi], ecx
jmp 0x500396
Function at 0x501060
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c205
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5010b9
test eax, 0x400
je 0x5010b9
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x5010d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c22b
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x7f206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x41c], esi
xor eax, eax
mov dword [ebp - 0x41c], esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x418]
push eax
push 0x204
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x41c]
call fcn.0041d400
add esp, 4
lea edx, [ebp - 0x41c]
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00524830
mov eax, dword [ebp - 0x41c]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x501172
or ecx, 0xffffffff
lock xadd dword [eax], ecx
test ecx, ecx
jne 0x501172
push eax
call fcn.004a8172
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret
Function at 0x5012d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c291
mov eax, dword fs:[0]
push eax
mov eax, 0x1018
call fcn.004a9210
mov eax, dword [0x7f206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1018], ecx
push 0x1000
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.004c0240
add esp, 0xc
lea eax, [ebp - 0x1010]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ebx, ebx
lea esi, [ebp - 0x1010]
xor edi, edi
mov dword [ebp - 0x1024], ebx
mov dword [ebp - 0x1020], ebx
mov dword [ebp - 0x101c], edi
mov dword [ebp - 4], edi
cmp word [ebp - 0x1010], di
je 0x5013d3
nop dword [eax + eax]
push esi
lea ecx, [ebp - 0x1014]
call fcn.0041d400
lea ecx, [edi + 1]
add esp, 4
cmp ecx, dword [ebp - 0x1020]
jle 0x5013a5
mov eax, ecx
test eax, eax
jns 0x501383
add eax, 1
sar eax, 1
add ecx, 8
add eax, ecx
lea ecx, [ebp - 0x1024]
and eax, 0xfffffff8
push eax
call fcn.0041acc0
mov edi, dword [ebp - 0x101c]
mov ebx, dword [ebp - 0x1024]
mov eax, dword [ebp - 0x1014]
lea ecx, [edi]
lea edi, [ecx + 1]
mov dword [ebx + ecx*4], eax
mov dword [ebp - 0x101c], edi
mov dword [ebp - 0x1014], 0x7a135c
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x5013c3
cmp word [esi], ax
jne 0x501360
push dword [ebp - 0x1014]
lea edx, [ebx + edi*4]
mov ecx, ebx
mov eax, edx
sub eax, ebx
sar eax, 2
push eax
call fcn.0041f900
add esp, 8
xor esi, esi
test edi, edi
jle 0x50148d
cmp esi, edi
jae 0x501400
mov edx, ebx
jmp 0x50141e
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x8013dc]
cmp eax, dword [ecx + 4]
jg 0x5014c2
mov edx, 0x7f2d68
lea ecx, [ebp - 0x1014]
call fcn.00524830
mov eax, dword [ebp - 0x1018]
mov edx, dword [eax + 8]
lea ecx, [edx + 1]
cmp ecx, dword [eax + 4]
jle 0x501464
mov eax, ecx
test eax, eax
jns 0x501443
add eax, 1
sar eax, 1
add ecx, 8
add eax, ecx
mov ecx, dword [ebp - 0x1018]
and eax, 0xfffffff8
push eax
call fcn.0041acc0
mov ecx, dword [ebp - 0x1018]
mov edx, dword [ecx + 8]
jmp 0x501466
mov ecx, eax
lea eax, [edx + 1]
inc esi
mov dword [ecx + 8], eax
add ebx, 4
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x1014]
mov dword [ebp - 0x1014], 0x7a135c
mov dword [ecx + edx*4], eax
cmp esi, edi
jl 0x5013fa
lea ecx, [ebp - 0x1024]
call fcn.00403a20
push dword [ebp - 0x1024]
call fcn.004c2bdc
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret
push 0x8013dc
call fcn.004a8317
add esp, 4
cmp dword [0x8013dc], 0xffffffff
jne 0x501419
push 0x61a3c0
mov dword [0x7f2d68], 0x7a135c
call fcn.004a815d
push 0x8013dc
call fcn.004a82cd
add esp, 8
jmp 0x501419
Function at 0x501720
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c2d2
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], 0
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x501789
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov dword [edx], eax
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x501773
mov ecx, 1
lock xadd dword [eax], ecx
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x5017a5
push ecx
push dword [esi + 0x28]
mov ecx, esi
call fcn.005018f0
mov eax, dword [esi + 0xc]
mov dword [esi + 0x24], 0
or edi, 0xffffffff
test eax, eax
je 0x5017ea
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x5017ea
lea ecx, [ebp - 0x10]
call fcn.00502140
mov edx, dword [esi + 0x10]
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov dword [eax], edx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x5017ea
mov eax, edi
lock xadd dword [ecx], eax
test eax, eax
jne 0x5017ea
push ecx
call fcn.004a8172
add esp, 4
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x50180d
mov dword [ebp - 0x10], 0x7a135c
lea eax, [ebp - 0x10]
mov ebx, 2
mov ecx, 0x7a135c
jmp 0x50181c
lea ecx, [ebp - 0x14]
call fcn.00502140
mov ebx, 4
mov ecx, dword [eax]
mov esi, dword [ebp + 8]
or ebx, 1
mov dword [esi], ecx
mov dword [eax], 0x7a135c
test bl, 4
je 0x501853
mov ecx, dword [ebp - 0x14]
and ebx, 0xfffffffb
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x501853
mov eax, edi
lock xadd dword [ecx], eax
test eax, eax
jne 0x501853
push ecx
call fcn.004a8172
add esp, 4
test bl, 2
je 0x501876
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x501876
lock xadd dword [eax], edi
test edi, edi
jne 0x501876
push eax
call fcn.004a8172
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5018f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x50195c
push 0
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x501952
lea ecx, [ebp + 0xc]
call fcn.00502140
mov edx, eax
mov eax, dword [esi + 0x10]
mov ecx, dword [edx]
mov dword [esi + 0x10], ecx
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x501952
or eax, 0xffffffff
lock xadd dword [ecx], eax
test eax, eax
jne 0x501952
push ecx
call fcn.004a8172
add esp, 4
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8