joyce8/EMBER2024-capa huggingface dataset:
Function at 0x546260
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa1c], ecx
cmp dword [ebp + 8], 0
jne 0x546289
mov eax, 0x74
jmp 0x546424
mov dword [ebp - 0x20c], 0
mov byte [ebp - 0x208], 0
push 0x1ff
push 0
lea eax, [ebp - 0x207]
push eax
call fcn.006665c0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str._s__s_mcc_export
lea edx, [ebp - 0x208]
push edx
call fcn.0066926d
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0xa1c]
call fcn.005433c0
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x5462f4
mov eax, dword [ebp - 0x20c]
jmp 0x546424
mov dword [0x10ac334], 1
cmp dword [0x10ac334], 0
je 0x54640d
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
lea ecx, [ebp - 0x614]
push ecx
push 1
lea edx, [ebp - 0x610]
push edx
mov eax, dword [ebp - 0xa1c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x5463d1
cmp dword [ebp - 0x614], 0
je 0x5463d1
push 0
lea edx, [ebp - 0x614]
push edx
push 0x3ff
lea eax, [ebp - 0x610]
push eax
mov ecx, dword [ebp - 0xa1c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x54637a
jmp 0x54640d
mov eax, dword [ebp - 0x614]
mov byte [ebp + eax - 0x610], 0
mov byte [ebp - 0xa18], 0
push 0x3ff
push 0
lea ecx, [ebp - 0xa17]
push ecx
call fcn.006665c0
add esp, 0xc
lea edx, [ebp - 0x610]
push edx
lea eax, [ebp - 0xa18]
push eax
call fcn.00666ba0
add esp, 8
lea ecx, [ebp - 0xa18]
push ecx
push str.mcc_s_r_n
call fcn.0066610b
add esp, 8
jmp 0x5463f3
push 1
mov edx, dword [ebp - 0xa1c]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jne 0x5463f3
jmp 0x54640d
cmp dword [0x10ac334], 0
jne 0x546408
mov dword [ebp - 0x20c], 0x7b
jmp 0x54640d
jmp 0x5462fe
mov ecx, dword [ebp - 0xa1c]
call fcn.00543590
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 4
Function at 0x546440
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x618], ecx
cmp dword [ebp + 8], 0
jne 0x546469
mov eax, 0x74
jmp 0x5466b7
mov dword [ebp - 0x20c], 0
mov byte [ebp - 0x208], 0
push 0x1ff
push 0
lea eax, [ebp - 0x207]
push eax
call fcn.006665c0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str._s__s_shut_down_battery
lea edx, [ebp - 0x208]
push edx
call fcn.0066926d
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x618]
call fcn.005433c0
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x5464d4
mov eax, dword [ebp - 0x20c]
jmp 0x5466b7
mov dword [ebp - 0x20c], 0x95
mov dword [0x10ac334], 1
cmp dword [0x10ac334], 0
je 0x5466a6
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x400
push 0
lea ecx, [ebp - 0x610]
push ecx
call fcn.006665c0
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x614]
push edx
push 0x3ff
lea eax, [ebp - 0x610]
push eax
mov ecx, dword [ebp - 0x618]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x546652
cmp dword [ebp - 0x614], 0
je 0x546652
push 0
lea eax, [ebp - 0x614]
push eax
mov ecx, dword [ebp - 0x614]
push ecx
lea edx, [ebp - 0x610]
push edx
mov eax, dword [ebp - 0x618]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x54657f
jmp 0x5466a6
mov edx, dword [ebp - 0x614]
mov byte [ebp + edx - 0x610], 0
lea eax, [ebp - 0x610]
push eax
push 0x763e8c
call fcn.0066610b
add esp, 8
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
push str.fail_to_shut_down_the_battery
lea ecx, [ebp - 0x610]
push ecx
call fcn.00404520
add esp, 8
test eax, eax
je 0x5465ec
push str.error__fail_to_shut_down_the_battery_._r_n
call fcn.0066610b
add esp, 4
mov dword [ebp - 0x20c], 0x95
mov eax, dword [ebp - 0x20c]
jmp 0x5466b7
push str.not_supported_command
lea edx, [ebp - 0x610]
push edx
call fcn.00404520
add esp, 8
test eax, eax
je 0x546626
push str.error__not_supported_command_._r_n
call fcn.0066610b
add esp, 4
mov dword [ebp - 0x20c], 0x90
mov eax, dword [ebp - 0x20c]
jmp 0x5466b7
push str.shut_down_the_battery_successfully
lea eax, [ebp - 0x610]
push eax
call fcn.00404520
add esp, 8
test eax, eax
je 0x546650
mov dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x20c]
jmp 0x5466b7
jmp 0x54668c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x210], eax
push 0
mov ecx, dword [ebp - 0x618]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jne 0x54668c
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x20c], eax
jmp 0x5466a6
cmp dword [0x10ac334], 0
jne 0x5466a1
mov dword [ebp - 0x20c], 0x7b
jmp 0x5466a6
jmp 0x5464e8
mov ecx, dword [ebp - 0x618]
call fcn.00543590
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 4
Function at 0x5474a0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x818], ecx
cmp dword [ebp + 8], 0
jne 0x5474c9
mov eax, 0x74
jmp 0x54767e
mov dword [ebp - 0x40c], 0
mov byte [ebp - 0x408], 0
push 0x3ff
push 0
lea eax, [ebp - 0x407]
push eax
call fcn.006665c0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s__s_set_scan_authcode__s
lea eax, [ebp - 0x408]
push eax
call fcn.0066926d
add esp, 0x10
lea ecx, [ebp - 0x408]
push ecx
mov ecx, dword [ebp - 0x818]
call fcn.005433c0
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
je 0x547538
mov eax, dword [ebp - 0x40c]
jmp 0x54767e
mov dword [0x10ac334], 1
cmp dword [0x10ac334], 0
je 0x54766d
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
lea edx, [ebp - 0x814]
push edx
push 1
lea eax, [ebp - 0x810]
push eax
mov ecx, dword [ebp - 0x818]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x547631
cmp dword [ebp - 0x814], 0
je 0x547631
push 0
lea eax, [ebp - 0x814]
push eax
push 0x3ff
lea ecx, [ebp - 0x810]
push ecx
mov edx, dword [ebp - 0x818]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5475be
jmp 0x54766d
mov ecx, dword [ebp - 0x814]
mov byte [ebp + ecx - 0x810], 0
cmp dword [ebp - 0x814], 0
je 0x54762f
push 0x7640f4
lea edx, [ebp - 0x810]
push edx
call fcn.00404520
add esp, 8
test eax, eax
je 0x54760f
lea eax, [ebp - 0x810]
push eax
push str.XCB_MSG:_s_r_n
call fcn.0066610b
add esp, 8
mov dword [ebp - 0x40c], 0
jmp 0x54766d
lea ecx, [ebp - 0x810]
push ecx
push str.XCB_MSG_:_s_r_n
call fcn.0066610b
add esp, 8
mov dword [ebp - 0x40c], 0xffffffff
jmp 0x54766d
jmp 0x547653
push 1
mov edx, dword [ebp - 0x818]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
jne 0x547653
jmp 0x54766d
cmp dword [0x10ac334], 0
jne 0x547668
mov dword [ebp - 0x40c], 0x7b
jmp 0x54766d
jmp 0x547542
mov ecx, dword [ebp - 0x818]
call fcn.00543590
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 8
Function at 0x549580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b0856
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], ecx
mov eax, dword [0x6c2cb8]
push eax
push 0x7642e8
mov ecx, dword [ebp + 8]
call fcn.004129c0
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [0x6c2cb8]
je 0x549611
mov edx, dword [0x6c2cb8]
push edx
mov eax, dword [ebp - 0x50]
add eax, 1
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004129f0
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x5c], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404770
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x54]
add edx, 0x3c
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.00477630
add esp, 0xc
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x64], ecx
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x64]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00404770
push 0x7642ec
mov ecx, dword [ebp + 8]
call fcn.00404810
push eax
call fcn.00669fd1
add esp, 8
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x5496a7
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
call fcn.00669854
add esp, 0x10
mov eax, dword [ebp - 0x4c]
push eax
call fcn.00669ba2
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x54]
add ecx, 0x58
call fcn.004066d0
mov al, 1
jmp 0x5496a9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5498e0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x5498fb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 0x58
call fcn.00494790
cmp dword [ebp - 4], eax
jae 0x54992a
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x58
call fcn.004a40d0
mov ecx, eax
call fcn.00404810
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x5498f2
mov ecx, dword [ebp - 8]
add ecx, 0x3c
call fcn.00404810
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 8]
add ecx, 0x58
call fcn.00408e60
mov esp, ebp
pop ebp
ret
Function at 0x54a3c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b097c
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20c], ecx
mov byte [ebp - 0x154], 0
push 0x103
push 0
lea eax, [ebp - 0x153]
push eax
call fcn.006665c0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x154]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x154]
push edx
mov ecx, dword [ebp - 0x20c]
add ecx, 0x3c
call fcn.004047f0
mov eax, dword [0x6c2cb8]
push eax
push 0x76438c
mov ecx, dword [ebp - 0x20c]
add ecx, 0x3c
call fcn.004129c0
mov dword [ebp - 0x208], eax
mov ecx, dword [ebp - 0x208]
cmp ecx, dword [0x6c2cb8]
je 0x54a4bf
mov edx, dword [ebp - 0x208]
add edx, 1
push edx
push 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x20c]
add ecx, 0x3c
call fcn.004129f0
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x210]
mov dword [ebp - 0x214], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0x20c]
add ecx, 0x3c
call fcn.00404740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404770
mov ecx, dword [ebp - 0x20c]
add ecx, 0x3c
call fcn.00405300
movzx eax, al
test eax, eax
je 0x54a4e7
push 0x764390
mov ecx, dword [ebp - 0x20c]
add ecx, 0x3c
call fcn.004047f0
lea ecx, [ebp - 0x15c]
push ecx
call fcn.0054a610
add esp, 4
push 1
push 3
lea ecx, [ebp - 0x204]
call fcn.00470ce0
mov dword [ebp - 4], 1
lea edx, [ebp - 0x204]
test edx, edx
je 0x54a527
lea eax, [ebp - 0x204]
add eax, 0x10
mov dword [ebp - 0x218], eax
jmp 0x54a531
mov dword [ebp - 0x218], 0
push 0x764394
mov ecx, dword [ebp - 0x158]
push ecx
mov edx, dword [ebp - 0x15c]
push edx
push str.AppPkg
mov eax, dword [ebp - 0x20c]
add eax, 0x3c
push eax
mov ecx, dword [ebp - 0x218]
push ecx
call fcn.0040a680
add esp, 8
push eax
call fcn.0040a270
add esp, 8
mov ecx, eax
call fcn.00476920
push eax
call fcn.0040a270
add esp, 8
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x204]
call fcn.004055d0
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x220]
push ecx
mov ecx, dword [ebp - 0x20c]
add ecx, 0x3c
call fcn.00404740
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00404770
push 0
mov ecx, dword [ebp - 0x20c]
add ecx, 0x3c
call fcn.00404810
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x204]
call fcn.004043b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret
Function at 0x551a50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b0f6d
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x140], ecx
mov ecx, dword [ebp - 0x140]
call fcn.00552e30
movzx eax, al
test eax, eax
je 0x551a9e
mov ecx, dword [ebp - 0x140]
call fcn.00552ff0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x140]
add ecx, 0x14
call fcn.0040dc60
mov ecx, dword [ebp - 0x140]
call fcn.00552d90
movzx edx, al
test edx, edx
je 0x551cd4
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea eax, [ebp - 0x11b]
push eax
call fcn.006665c0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x11c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x11c]
push edx
lea ecx, [ebp - 0x130]
call fcn.0040dbe0
mov dword [ebp - 4], 0
push 0x5c
lea ecx, [ebp - 0x130]
call fcn.00401220
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jle 0x551b7f
mov eax, dword [ebp - 0x134]
add eax, 1
push eax
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x130]
call fcn.00401270
mov dword [ebp - 0x144], eax
mov edx, dword [ebp - 0x144]
mov dword [ebp - 0x148], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x148]
push eax
lea ecx, [ebp - 0x130]
call fcn.0040fe20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x138]
call fcn.004014d0
lea ecx, [ebp - 0x130]
call fcn.0040e940
movzx ecx, al
test ecx, ecx
je 0x551ba1
push 0x7645bc
lea ecx, [ebp - 0x130]
call fcn.0040dc60
lea edx, [ebp - 0x12c]
push edx
call fcn.0066af7d
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0x124]
call fcn.00401490
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x128]
push ecx
mov edx, dword [ebp - 0x12c]
push edx
push str.FilePkg_lld__u_
lea eax, [ebp - 0x124]
push eax
call fcn.004017f0
add esp, 0x14
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x130]
push edx
lea eax, [ebp - 0x13c]
push eax
call fcn.00468e90
add esp, 0xc
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x150], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x150]
push edx
mov ecx, dword [ebp - 0x140]
add ecx, 0x10
call fcn.0040fe20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x13c]
call fcn.004014d0
push 0
mov ecx, dword [ebp - 0x140]
add ecx, 0x10
call fcn.00489570
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp - 0x140]
add eax, 0x10
push eax
mov ecx, dword [ebp - 0x140]
call fcn.00454fa0
mov ecx, dword [ebp - 0x140]
add ecx, 0x2c
call fcn.0054e2d0
mov ecx, dword [ebp - 0x140]
mov dword [ecx + 0x3c], 0
mov edx, dword [ebp - 0x140]
mov byte [edx + 0x44], 0
mov eax, dword [ebp - 0x140]
mov dword [eax + 0x40], 0xffffffff
mov ecx, dword [ebp - 0x140]
mov byte [ecx + 0x45], 0xa
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x124]
call fcn.004014d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.004014d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 4
Function at 0x552cc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b109e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x7e2670]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
jmp 0x552cfa
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
call fcn.00468f40
cmp dword [ebp - 0x10], eax
jae 0x552d7d
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004690b0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.00489570
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x552d2b
jmp 0x552d7d
push str.rmdir__s__q
lea ecx, [ebp - 0x14]
call fcn.0040dbe0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
call fcn.004174c0
lea ecx, [ebp - 0x14]
call fcn.00489570
push eax
call fcn.0066ea73
add esp, 4
push 0x7645a3
mov ecx, dword [ebp - 0x18]
call fcn.0040dc60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004014d0
jmp 0x552cf1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x5532b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x5532c6
xor eax, eax
jmp 0x5532ff
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
call fcn.00669b18
add esp, 0x10
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
cmp eax, dword [ebp - 4]
jne 0x5532f1
xor eax, eax
jmp 0x5532ff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call fcn.0066b858
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x553310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x553326
xor eax, eax
jmp 0x55335f
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
call fcn.00669854
add esp, 0x10
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
cmp eax, dword [ebp - 4]
jne 0x553351
xor eax, eax
jmp 0x55335f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call fcn.0066b858
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x5549b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x5549e2
xor eax, eax
jmp 0x5549ee
cmp dword [ebp - 0x9c], 5
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret

Function at 0x556ed0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x556ee8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x556f3b
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x556f09
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jae 0x556f2c
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp - 8]
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [ebp - 8], eax
jmp 0x556f00
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx*4 + 0x10ac5c0], eax
jmp 0x556edf
jmp 0x556f46
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x800
jae 0x556f7e
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x10ac1c0]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0xff
mov edx, dword [ebp - 0x10]
shr edx, 8
xor edx, dword [ecx*4 + 0x10ac5c0]
mov eax, dword [ebp - 4]
mov dword [eax*4 + 0x10ac5c0], edx
jmp 0x556f3d
mov dword [0x10ae5c0], fcn.00556fa0
call fcn.00554850
test eax, eax
jne 0x556f9b
mov dword [0x10ae5c0], 0x5570b0
mov esp, ebp
pop ebp
ret
Function at 0x562a10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x562a20
xor eax, eax
jmp 0x562bbd
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x562b7e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x765db0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x765db0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x765db0]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x765db0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x765db0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x765db0]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x765db0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x765db0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x562a29
cmp dword [ebp + 0x10], 0
je 0x562bb7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x765db0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x562b84
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret