joyce8/EMBER2024-capa huggingface dataset:
Function at 0x542c90
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
push ebx
push esi
mov esi, ecx
push edi
mov byte [esp + 0xf], 0
mov dword [esp + 0x14], eax
mov ecx, 1
lock xadd dword [eax], ecx
mov edi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea edx, [esp + 0x1c]
push edx
push 0x68624c
push 1
push 0
push 0x68625c
xor bl, bl
call edi
cmp eax, 0x800401f0
jne 0x542cf3
push 0
mov bl, 1
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x1c]
push eax
push 0x68624c
push 1
push 0
push 0x68625c
call edi
test eax, eax
jl 0x542e2a
push 1
push ecx
mov eax, esp
mov ecx, 0x5c
push ecx
mov word [eax], cx
mov eax, esp
mov edx, 0x2f
mov word [eax], dx
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
push 3
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call edx
mov ecx, eax
call fcn.004dba20
mov ecx, dword [esp + 0x1c]
mov edi, dword [ecx]
mov ecx, eax
call fcn.004d9f60
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [edi + 0x50]
push edx
call eax
mov ecx, dword [esp + 0x10]
mov edi, eax
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x542d5e
mov eax, dword [esp + 0x10]
push eax
call fcn.004d8200
add esp, 4
test edi, edi
jl 0x542e17
push 1
push ecx
mov eax, esp
mov ecx, 0x5c
push ecx
mov word [eax], cx
mov eax, esp
mov edx, 0x2f
mov word [eax], dx
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
push 4
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call edx
mov ecx, eax
call fcn.004dba20
mov ecx, dword [esp + 0x1c]
mov edi, dword [ecx]
mov ecx, eax
call fcn.004d9f60
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [edi + 0x24]
push edx
call eax
mov ecx, dword [esp + 0x10]
mov edi, eax
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x542dc9
mov eax, dword [esp + 0x10]
push eax
call fcn.004d8200
add esp, 4
test edi, edi
jl 0x542e17
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x68626c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x542e17
mov ecx, dword [esp + 0x10]
mov edi, dword [ecx]
push 1
lea ecx, [esp + 0x18]
call fcn.004d9f60
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [edi + 0x18]
push edx
call eax
test eax, eax
jl 0x542e0b
mov byte [esp + 0xf], 1
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp byte [esp + 0xf], 0
jne 0x542e5d
lea eax, [esp + 0x10]
push 0xffffffffffffffff
push eax
call fcn.004d1480
add esp, 8
push eax
push 0xa
mov ecx, esi
call fcn.00544c20
mov ecx, dword [esp + 0x10]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x542e5d
mov eax, dword [esp + 0x10]
push eax
call fcn.004d8200
add esp, 4
test bl, bl
je 0x542e67
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x14]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x542e81
mov eax, dword [esp + 0x14]
push eax
call fcn.004d8200
add esp, 4
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x542fd0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x58]
mov esi, dword [edi + 0xc]
mov dword [esp + 0x10], esi
test eax, eax
jne 0x5430af
or edx, 0xffffffff
cmp dword [edi + 0x70], edx
jne 0x5430ab
cmp dword [edi + 0x5c], edx
jne 0x543004
pop edi
mov eax, edx
pop esi
add esp, 0xc
ret 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x24]
xor esi, esi
mov dword [esp + 0x10], ebp
xor ebx, ebx
lea eax, [esp + 0x10]
cmp ebp, 0x2000000
jb 0x543023
mov eax, 0x6681e0
mov eax, dword [eax]
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [edi + 0x5c]
push eax
lea eax, [esi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x543072
mov eax, dword [esp + 0x14]
test eax, eax
je 0x543064
add esi, eax
adc ebx, 0
sub ebp, eax
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x10], ebp
jg 0x543064
jl 0x543012
cmp esi, dword [esp + 0x24]
jb 0x543012
pop ebp
mov edx, ebx
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret 0xc
mov edx, esi
or edx, ebx
jne 0x543064
lea eax, [esp + 0x20]
push 0xffffffffffffffff
push eax
call fcn.004d1480
mov ecx, dword [esp + 0x20]
add esp, 8
push eax
push 1
call fcn.00544c20
lea ecx, [esp + 0x20]
call fcn.00401110
pop ebp
pop ebx
or eax, 0xffffffff
pop edi
or edx, eax
pop esi
add esp, 0xc
ret 0xc
test eax, eax
je 0x54310e
call fcn.00542c40
test al, al
je 0x54310e
mov ecx, dword [edi + 0x58]
push ecx
call fcn.0059785b
add esp, 4
test eax, eax
je 0x54310e
call fcn.00598f71
mov edx, dword [eax]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.004d1480
add esp, 8
push eax
push 1
mov ecx, esi
call fcn.00544c20
mov ecx, dword [esp + 0x18]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x543101
mov eax, dword [esp + 0x18]
push eax
call fcn.004d8200
add esp, 4
or eax, 0xffffffff
pop edi
or edx, eax
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
mov ecx, edi
call fcn.00541b40
pop edi
pop esi
add esp, 0xc
ret 0xc
Function at 0x543130
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [esp + 0x10], eax
cmp dword [ebp + 0x58], edi
jne 0x54320e
or eax, 0xffffffff
cmp dword [ebp + 0x70], eax
jne 0x54320e
cmp dword [ebp + 0x5c], eax
jne 0x543164
pop edi
mov edx, eax
pop ebp
add esp, 0x14
ret 0xc
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov dword [esp + 0x20], edi
xor esi, esi
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
cmp ebx, 0x2000000
jb 0x543185
mov eax, 0x6681e0
mov eax, dword [eax]
mov edx, dword [esp + 0x28]
push 0
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [ebp + 0x5c]
push eax
lea eax, [esi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5431d5
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x5431c7
xor eax, eax
add esi, ecx
adc edi, eax
sub ebx, ecx
sbb dword [esp + 0x20], eax
cmp edi, dword [esp + 0x30]
jg 0x5431c7
jl 0x543170
cmp esi, dword [esp + 0x2c]
jb 0x543170
mov eax, esi
pop esi
pop ebx
mov edx, edi
pop edi
pop ebp
add esp, 0x14
ret 0xc
mov edx, esi
or edx, edi
jne 0x5431c7
lea eax, [esp + 0x28]
push 0xffffffffffffffff
push eax
call fcn.004d1480
mov ecx, dword [esp + 0x20]
add esp, 8
push eax
push 2
call fcn.00544c20
lea ecx, [esp + 0x28]
call fcn.00401110
pop esi
pop ebx
or eax, 0xffffffff
pop edi
or edx, eax
pop ebp
add esp, 0x14
ret 0xc
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.00541e70
pop edi
pop ebp
add esp, 0x14
ret 0xc
Function at 0x543920
Capabilities:
Clear file content

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x5c]
push edi
cmp ecx, 0xffffffff
jne 0x543a07
cmp dword [eax + 0x70], ecx
jne 0x543a07
cmp dword [eax + 0x58], 0
jne 0x543a07
lea edi, [eax + 0x10]
mov ecx, edi
call fcn.00545a90
test al, al
jne 0x543aaf
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.00545570
push eax
lea ecx, [esp + 0x18]
call fcn.005254d0
mov ecx, dword [esp + 0x10]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x54398d
mov eax, dword [esp + 0x10]
push eax
call fcn.004d8200
add esp, 4
push ecx
mov eax, esp
lea ecx, [esp + 0x18]
mov dword [eax], 3
call fcn.00524ba0
test al, al
je 0x5439f2
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.005258a0
mov bl, al
test bl, bl
jne 0x5439dd
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.0051e160
push eax
push 0xc
mov ecx, esi
call fcn.00544c20
lea ecx, [esp + 0x20]
call fcn.00401110
lea ecx, [esp + 0x14]
call fcn.00525880
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
lea ecx, [esp + 0x14]
call fcn.00525880
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov edi, ecx
cmp edi, 0xffffffff
jne 0x543a39
mov ecx, dword [eax + 0x58]
test ecx, ecx
je 0x543a26
push ecx
call fcn.0059d2ad
push eax
call fcn.0059cebc
add esp, 8
jmp 0x543a32
mov ecx, dword [eax + 0x70]
push ecx
call fcn.0059cebc
add esp, 4
mov edi, eax
cmp edi, 0xffffffff
je 0x543aaf
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x20]
mov ebp, eax
mov eax, dword [esp + 0x24]
mov ebx, edx
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebx
call edx
test al, al
je 0x543aa4
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x543aa4
cmp ebx, dword [esp + 0x24]
jg 0x543a84
jl 0x543a7e
cmp ebp, dword [esp + 0x20]
jae 0x543a84
lea eax, [esp + 0x14]
jmp 0x543a88
lea eax, [esp + 0x20]
mov ecx, dword [eax + 4]
mov edx, dword [esi]
mov eax, dword [eax]
mov edx, dword [edx + 0x18]
push ecx
push eax
mov ecx, esi
call edx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
push ebx
push ebp
mov ecx, esi
call edx
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
Function at 0x545fc0
Capabilities:
Create directory

Disassembly:
push ecx
push ebx
push 0
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00542e90
add esp, 8
mov ecx, eax
call fcn.004d9f60
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [esp + 4]
test eax, eax
setne bl
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x545fff
mov ecx, dword [esp + 4]
push ecx
call fcn.004d8200
add esp, 4
mov al, bl
pop ebx
pop ecx
ret

Function at 0x546010
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x25c
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0x258], eax
mov eax, dword [esp + 0x260]
mov eax, dword [eax]
push ebx
mov dword [esp + 4], eax
mov ecx, 1
lock xadd dword [eax], ecx
mov eax, dword [esp + 4]
cmp dword [eax + 8], 2
jne 0x546063
mov edx, dword [eax + 0xc]
cmp word [edx + 2], 0x3a
jne 0x546063
push ecx
mov eax, esp
mov ecx, 0x5c
mov word [eax], cx
lea ecx, [esp + 8]
call fcn.004d95d0
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
call fcn.00542e90
add esp, 8
mov ecx, eax
call fcn.004d9f60
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 8]
mov ebx, eax
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x54609f
mov eax, dword [esp + 8]
push eax
call fcn.004d8200
add esp, 4
cmp ebx, 0xffffffff
jne 0x5460da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x5460b4
cmp eax, 0x20
jne 0x5460da
lea ecx, [esp + 0xc]
push ecx
push ecx
mov edx, esp
lea eax, [esp + 0xc]
push eax
push edx
call fcn.00542e90
add esp, 8
call fcn.00545ef0
add esp, 8
test al, al
je 0x5460da
mov ebx, dword [esp + 0xc]
test esi, esi
je 0x5460e6
cmp ebx, 0xffffffff
setne cl
mov byte [esi], cl
mov edx, dword [esp + 4]
or eax, 0xffffffff
cmp ebx, eax
jne 0x54611c
lock xadd dword [edx], eax
jne 0x546104
mov ecx, dword [esp + 4]
push ecx
call fcn.004d8200
add esp, 4
xor al, al
pop ebx
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.0059393a
add esp, 0x25c
ret
shr ebx, 4
and bl, 1
lock xadd dword [edx], eax
jne 0x546135
mov ecx, dword [esp + 4]
push ecx
call fcn.004d8200
add esp, 4
mov ecx, dword [esp + 0x25c]
mov al, bl
pop ebx
xor ecx, esp
call fcn.0059393a
add esp, 0x25c
ret
Function at 0x5466a0
Capabilities:
Copy file

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push ebx
push 1
lea eax, [esp + 0xc]
push eax
call fcn.00545ab0
mov ecx, eax
call fcn.004d9f60
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00545ab0
mov ecx, eax
call fcn.004d9f60
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, dword [esp + 4]
test eax, eax
setne bl
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x5466f7
mov ecx, dword [esp + 4]
push ecx
call fcn.004d8200
add esp, 4
mov edx, dword [esp + 8]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x546711
mov ecx, dword [esp + 8]
push ecx
call fcn.004d8200
add esp, 4
test bl, bl
jne 0x546729
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x18]
mov ecx, 2
mov dword [edx], eax
mov dword [edx + 4], ecx
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x546730
Capabilities:
Move file

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push ebx
lea eax, [esp + 8]
push eax
call fcn.00545ab0
mov ecx, eax
call fcn.004d9f60
push eax
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x18]
call fcn.00545ab0
mov ecx, eax
call fcn.004d9f60
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edx, dword [esp + 4]
test eax, eax
setne bl
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x546785
mov ecx, dword [esp + 4]
push ecx
call fcn.004d8200
add esp, 4
mov edx, dword [esp + 8]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x54679f
mov ecx, dword [esp + 8]
push ecx
call fcn.004d8200
add esp, 4
test bl, bl
jne 0x5467b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x18]
mov ecx, 2
mov dword [edx], eax
mov dword [edx + 4], ecx
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x5467c0
Capabilities:
Delete file

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
lea eax, [esp + 4]
push eax
call fcn.00545ab0
mov ecx, eax
call fcn.004d9f60
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 4]
test eax, eax
setne bl
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x5467fd
mov eax, dword [esp + 4]
push eax
call fcn.004d8200
add esp, 4
test bl, bl
jne 0x546815
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x10]
mov ecx, 2
mov dword [edx], eax
mov dword [edx + 4], ecx
mov al, bl
pop ebx
pop ecx
ret
Function at 0x546c60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
mov ebx, dword [esp + 0x420]
push ebp
push esi
mov dword [esp + 0x10], 0x6d00d4
mov eax, 0x6d00d4
mov ecx, 1
lock xadd dword [eax], ecx
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edx, [esp + 0x20]
push edx
push 0x200
call ebp
mov esi, eax
test esi, esi
je 0x546d56
cmp esi, 0x200
jbe 0x546d1f
xor ecx, ecx
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.005928f7
add esp, 4
mov edi, eax
push edi
push 0x200
call ebp
test eax, eax
je 0x546d13
push esi
lea eax, [esp + 0x14]
push edi
push eax
call fcn.004db100
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
call fcn.004d5a10
mov ecx, dword [esp + 0x10]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x546d13
mov eax, dword [esp + 0x10]
push eax
call fcn.004d8200
add esp, 4
push edi
call fcn.0059478b
add esp, 4
pop edi
jmp 0x546d56
push esi
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.004db100
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
call fcn.004d5a10
mov eax, dword [esp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x546d56
mov edx, dword [esp + 0xc]
push edx
call fcn.004d8200
add esp, 4
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
cmp eax, 2
jl 0x546dab
cmp eax, 1
jle 0x546d70
mov eax, dword [ecx + 0xc]
movzx eax, word [eax + 2]
jmp 0x546d72
xor eax, eax
cmp ax, 0x3a
jne 0x546dab
mov ecx, dword [ecx + 0xc]
mov dx, word [ecx]
lea ecx, [esp + 0xc]
lea eax, [esp + 0x10]
push ecx
lea ecx, [esp + 0x1a]
mov word [esp + 0x1a], dx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
call fcn.004d7920
push eax
lea ecx, [esp + 0x1c]
call fcn.004dca00
mov byte [esp + 0xc], 0
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.00545370
mov ecx, dword [esp + 0x10]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x546ddb
mov eax, dword [esp + 0x10]
push eax
call fcn.004d8200
add esp, 4
mov ecx, dword [esp + 0x420]
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0059393a
add esp, 0x418
ret
Function at 0x548890
Capabilities:
Get disk information

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, eax
mov ecx, esi
mov byte [esp + 9], 0
xor ebx, ebx
call fcn.00545460
test al, al
je 0x548913
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00545570
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov ax, word [edx]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xe]
mov word [esp + 0xe], ax
call fcn.004d7920
movzx ecx, word [eax]
mov edx, dword [esp + 0x10]
sub ecx, 0x41
mov esi, 1
shl esi, cl
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x5488ff
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004d8200
add esp, 4
test ebx, esi
je 0x548a09
mov ebx, 0x14
mov al, 1
jmp 0x5489ce
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.00545ab0
push 1
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], str._UNC
call fcn.004d9a40
test al, al
je 0x5489ac
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0xc]
mov ax, word [edx]
push 1
mov word [esp + 0x14], ax
mov ecx, dword [esp + 0x14]
push 7
push ecx
lea ecx, [esp + 0x18]
call fcn.004d9860
test eax, eax
jle 0x548991
mov edx, dword [esp + 0xc]
mov ecx, dword [edx + 0xc]
mov dx, word [ecx]
push 1
inc eax
push eax
mov word [esp + 0x18], dx
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
call fcn.004d9860
test eax, eax
jle 0x548991
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 8]
dec edx
cmp eax, edx
jne 0x5489ac
lea eax, [esp + 0xc]
push eax
call fcn.005486b0
add esp, 4
test al, al
je 0x5489ac
mov ebx, 0x10
mov byte [esp + 9], 1
mov ecx, dword [esp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x5489c6
mov eax, dword [esp + 0xc]
push eax
call fcn.004d8200
add esp, 4
mov al, byte [esp + 9]
test al, al
je 0x548a0d
mov dword [edi + 0x10], ebx
test bl, 2
je 0x5489dd
or dword [edi + 4], 0x100000
and bl, 0x10
movzx ecx, bl
neg ecx
sbb ecx, ecx
and ecx, 0x20000
add ecx, 0x20000
or dword [edi + 4], ecx
or dword [edi + 4], 0x400000
or dword [edi], 0x560000
pop esi
pop ebx
add esp, 0xc
ret
mov al, byte [esp + 9]
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x554a90
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 8], eax
jle 0x554abb
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x677490]
mov esi, eax
shl esi, 3
xor edx, esi
xor eax, edx
inc ecx
dec dword [ebp + 8]
cmp dword [ebp + 8], 0
jg 0x554a9d
pop esi
pop ebp
ret

Function at 0x554f54
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x20]
push edi
test eax, eax
je 0x554f97
cdq
push esi
mov esi, eax
add eax, dword [ebp + 0xc]
mov edi, edx
mov ecx, edx
adc ecx, dword [ebp + 0x10]
push edi
sub eax, 1
push esi
sbb ecx, 0
push ecx
push eax
call fcn.005990d0
push edi
push esi
push edx
push eax
call fcn.00599090
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
pop esi
push dword [ebp + 0x10]
mov edi, ebx
push dword [ebp + 0xc]
call fcn.00554dea
pop ecx
pop ecx
test eax, eax
jne 0x554fc0
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x554fc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x10], eax
mov dword [ebp - 4], 0x60a
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x554ff7
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x555029
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x555029
mov dword [esi + 0x10], eax
mov eax, 0x70a
jmp 0x555049
push 1
push 0
push 0
push dword [ebp + 8]
call fcn.00599090
mov ecx, eax
xor eax, eax
add ecx, edi
adc edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x55534e
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00555313
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x555372
push 7
pop eax
jmp 0x555401
push esi
call fcn.00554bed
test eax, eax
je 0x5553b1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x55539e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x5553e6
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jge 0x5553e6
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x55537c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5553d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x5553e6
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jge 0x5553e6
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x5553b1
push edi
call fcn.00593fc0
pop ecx
cmp esi, 0xffffffff
pop esi
jne 0x5553fc
cmp ebx, 2
jne 0x5553fc
xor eax, eax
jmp 0x555401
mov eax, 0xa0a
pop edi
pop ebx
leave
ret
Function at 0x55bf7a
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x6d26f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x6e7fa4]
push ebx
push esi
test eax, eax
je 0x55bfb6
push eax
push 0x6947bc
lea eax, [ebp - 0x10c]
push eax
push 0xe6
call fcn.0055b7b8
add esp, 0x10
jmp 0x55c02e
call fcn.00554bed
mov esi, 0xe6
test eax, eax
je 0x55bff6
lea eax, [ebp - 0x314]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x314]
push eax
call fcn.00554ca5
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x55c012
push 7
pop eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0059393a
leave
ret
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x210]
push eax
call fcn.00554d6d
jmp 0x55bfde
push ebx
push 0x6947bc
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.0055b7b8
push ebx
call fcn.00593fc0
add esp, 0x14
mov ecx, str.etilqs_
call fcn.0055408c
lea ecx, [ebp - 0x10c]
mov edx, eax
call fcn.0055408c
lea eax, [edx + eax + 0x11]
mov edx, dword [ebp + 8]
cmp eax, edx
jl 0x55c055
xor eax, eax
inc eax
jmp 0x55bfe8
lea ecx, [ebp - 0x10c]
call fcn.0055408c
test eax, eax
jbe 0x55c06e
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x55c06e
dec eax
jne 0x55c065
mov byte [ebp + eax - 0x10c], 0
lea eax, [ebp - 0x10c]
push eax
push str._setilqs_
add edx, 0xffffffef
push edi
push edx
call fcn.0055b7b8
mov ecx, edi
call fcn.0055408c
mov esi, eax
lea eax, [edi + esi]
push eax
push 0xf
call fcn.0055b974
add esp, 0x18
push 0xf
pop ecx
movzx eax, byte [edi + esi]
xor edx, edx
push 0x3e
pop ebx
div ebx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi], al
inc esi
dec ecx
jne 0x55c0a6
mov byte [edi + esi], cl
xor eax, eax
jmp 0x55bfe8
Function at 0x55c259
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x6d26f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x10c]
push ecx
push 0x104
push eax
push dword [ebp + 8]
mov dword [ebp - 0x114], 0x200
call fcn.0055c181
add esp, 0x10
test eax, eax
jne 0x55c343
push ebx
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.00555313
mov esi, eax
xor ebx, ebx
pop ecx
cmp esi, ebx
je 0x55c337
push edi
call fcn.00554bed
test eax, eax
mov eax, esi
je 0x55c2fa
cmp word [esi], bx
je 0x55c2db
cmp word [eax], 0x5c
je 0x55c2d6
inc eax
inc eax
cmp word [eax], bx
jne 0x55c2c7
jmp 0x55c2db
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x110]
push eax
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x55c329
cmp byte [esi], bl
je 0x55c30c
cmp byte [eax], 0x5c
je 0x55c30a
inc eax
cmp byte [eax], bl
jne 0x55c2fe
jmp 0x55c30c
mov byte [eax], bl
lea eax, [ebp - 0x110]
push eax
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.00593fc0
pop ecx
cmp edi, ebx
pop edi
jne 0x55c341
mov dword [ebp - 0x114], 0x200
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x114]
xor ecx, ebp
call fcn.0059393a
leave
ret