joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ce080
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
lea esi, [ebx + 1]
push esi
push ebx
call dword [0x8f1cb4]
mov edi, eax
add esp, 8
test edi, edi
je 0x5ce0da
nop dword [eax]
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x5ce0f6
cmp esi, ebx
je 0x5ce0f6
cmp esi, 0x8000
ja 0x5ce0f6
cmp esi, ebx
jb 0x5ce0ed
push esi
push edi
call dword [0x8f1cb4]
mov edi, eax
add esp, 8
test edi, edi
jne 0x5ce0a0
mov ebx, dword [ebp - 4]
push ebx
call dword [0x8f1cb0]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [0x8f1cb0]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5cfb10
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp esi, 4
jb 0x5cfc55
mov ebx, dword [ebp + 0xc]
sub esi, 2
inc ebx
push str.0123456789abcdefABCDEF:.
push ebx
call fcn.0071dce0
add esp, 8
cmp esi, eax
je 0x5cfbe9
mov dword [ebp + 0x10], eax
add eax, ebx
mov dword [ebp - 4], eax
cmp byte [eax], 0x25
jne 0x5cfc55
push 2
lea esi, [eax + 1]
xor edi, edi
push 0x7a0d7c
push esi
call fcn.00716350
add esp, 0xc
test eax, eax
jne 0x5cfb7c
mov cl, byte [esi + 2]
lea eax, [esi + 2]
test cl, cl
je 0x5cfb7c
cmp cl, 0x5d
cmovne esi, eax
mov al, byte [esi]
test al, al
je 0x5cfc55
lea ecx, [ebp - 0x14]
sub ecx, esi
nop dword [eax + eax]
cmp al, 0x5d
je 0x5cfba5
cmp edi, 0xf
jge 0x5cfba5
mov byte [ecx + esi], al
inc edi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x5cfb90
test edi, edi
je 0x5cfc55
cmp byte [esi], 0x5d
jne 0x5cfc55
lea eax, [ebp - 0x14]
mov byte [ebp + edi - 0x14], 0
push eax
call dword [0x8f1cb8]
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [ecx + 0x14], eax
test eax, eax
jne 0x5cfbde
pop edi
pop esi
mov eax, 7
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 0x10]
mov word [eax], 0x5d
lea eax, [ebp - 0x14]
mov byte [ebx + esi], 0
push eax
push ebx
lea edi, [ebx + esi]
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x5cfc55
push 0x2e
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x17
call sub.WS2_32.dll_inet_ntop
test eax, eax
je 0x5cfc49
lea edx, [ebp - 0x44]
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x5cfc20
sub edx, ecx
cmp edx, esi
jae 0x5cfc49
lea ecx, [ebp - 0x44]
mov esi, ebx
mov eax, ecx
sub esi, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x5cfc36
lea edi, [ebx + edx]
mov byte [edi + 1], al
mov byte [edi], 0x5d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x16
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d2f60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov eax, dword [ebx]
push 0
push dword [ebp + 0x10]
mov eax, dword [eax + 8]
push dword [ebp + 0xc]
mov dword [edi], 0
push dword [eax + 0x98]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5d2fe5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x5d2fb0
mov dword [edi], 0x51
jmp 0x5d2fe2
push 0x100
lea eax, [ebp - 0x100]
push eax
push esi
call fcn.005a1e90
push eax
push str.Recv_failure:__s
push dword [ebx + 4]
call fcn.005b6f30
mov eax, dword [ebx + 4]
add esp, 0x18
mov dword [eax + 0x8e4], esi
mov dword [edi], 0x38
or esi, 0xffffffff
push dword [edi]
push esi
push dword [ebp + 0x10]
push str.nw_in_read_len_zu______d__err_d
push dword [ebx]
push dword [ebx + 4]
call fcn.005b7030
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5d3010
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x180
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [eax + 8]
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x1c4]
test dword [eax + 0x44], 0x800
jne 0x5d3100
push 0x80
lea eax, [ebp - 0x80]
mov dword [ebp + 8], 0x80
push 0
push eax
call fcn.007012e0
add esp, 0xc
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [esi + 0x98]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x5d30a1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x180]
push 0x100
push eax
push esi
call fcn.005a1e90
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.005b6f30
add esp, 0x1c
mov eax, 2
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x120]
push eax
lea eax, [esi + 0xf0]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x80]
push eax
call fcn.005b8260
add esp, 0x10
test al, al
jne 0x5d3100
push edi
call fcn.0070b7d2
mov esi, dword [eax]
call fcn.0070b7d2
mov edi, eax
lea eax, [ebp - 0x180]
push 0x100
push eax
push esi
call fcn.005a1e90
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.005b6f30
add esp, 0x1c
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5dbc90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push dword [ebp + 0x10]
call fcn.00536120
mov esi, dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 4], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x8f1cac]
mov edi, eax
add esp, 8
test edi, edi
je 0x5dbdf0
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x5dbd0e
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [ebp + 0xc]
push ebx
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp + 0xc], eax
push eax
mov eax, dword [esi + 8]
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp - 4]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x5dbd6b
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
nop dword [eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp - 4], 1
jne 0x5dbd30
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x5dbd97
mov eax, dword [esi + 4]
push 1
push 0x7a2e25
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x7a2e26
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x5dbd70
push dword [ebp + 0x18]
call fcn.00536120
mov ecx, dword [edi]
push eax
push dword [ebp + 0x14]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [ebp + 0x1c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x5dbdbf
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x8f1cb0]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x1b
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5dff80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x74a67d
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x8f20a4]
push ebx
cmp eax, 0xffffffff
jne 0x5dffad
xor ebx, ebx
mov dword [ebp - 0x14], ebx
jmp 0x5dffb9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x5e000a
push esi
push edi
nop dword [eax]
cmp dword [ebx + 0x14], 0
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
jne 0x5e0019
test esi, esi
jne 0x5e0020
push esi
call fcn.005e00b0
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x5e0008
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x5e0060
nop dword [eax]
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x5e004d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x5e0020
mov edi, dword [ebx + 0x10]
lea eax, [ebx + 0x10]
mov dword [ebp - 0x18], eax
mov esi, dword [edi]
mov dword [ebp - 0x10], esi
cmp esi, edi
je 0x5dffd0
mov ebx, eax
lea ecx, [ebp - 0x10]
call fcn.004cb1f0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x5e0094
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x5e0094
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
mov ecx, ebx
call fcn.005df3f0
mov esi, dword [ebp - 0x10]
cmp esi, edi
jne 0x5e0078
mov ebx, dword [ebp - 0x14]
jmp 0x5dffd0

Function at 0x5e0150
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x18]
push eax
push 4
push edx
push 0x5e01b0
push 0
push 0
call fcn.007116bf
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x5e0179
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x5e0197
cmp eax, 0xffffffff
je 0x5e0197
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x5e0b80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x74a77d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80
push esi
mov dword [ebp - 0x18], 0
call fcn.005dc9c0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.005e2d80
add esp, 0xc
cmp dword [ebp - 0x20], 3
jne 0x5e0bee
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x5e0bdd
mov dword [esi], 0
call fcn.005dc9c0
mov dword [esi + 4], eax
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.005de9d0
cmp dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
je 0x5e0c65
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.005e2d80
add esp, 0xc
cmp dword [ebp - 0x20], 1
jne 0x5e0c65
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.005e0b80
mov edi, dword [ebp - 0x18]
add esp, 8
test edi, edi
je 0x5e0c65
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x5e0d06
mov eax, dword [ebp - 0x14]
mov dword [ecx], edi
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x40]
call fcn.00481f60
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x5e0c6f
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x5e0c97
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x5e0c91
mov dword [esi], 0
call fcn.005dc9c0
mov dword [esi + 4], eax
mov byte [ebp - 0xd], 1
jmp 0x5e0ceb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.005dc9c0
cmp edi, 0xb7
jne 0x5e0cd6
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.005e2d80
add esp, 0xc
cmp dword [eax], 3
jne 0x5e0cd6
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x5e0ce7
mov dword [esi], 0
call fcn.005dc9c0
jmp 0x5e0ce4
mov esi, dword [ebp + 0xc]
call fcn.005dc9c0
test esi, esi
je 0x5e0d40
mov dword [esi], edi
mov dword [esi + 4], eax
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x40]
call fcn.00481f60
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x58]
push str.boost::filesystem::create_directories
call fcn.00480f10
push esi
push edi
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x8c]
call fcn.005e0750
push 0x83a780
lea eax, [ebp - 0x8c]
push eax
call fcn.00700933
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004e6020
push str.boost::filesystem::create_directory
lea ecx, [ebp - 0x58]
mov edi, dword [eax]
mov esi, dword [eax + 4]
call fcn.00480f10
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x8c]
call fcn.005e0750
push 0x83a780
lea eax, [ebp - 0x8c]
push eax
call fcn.00700933
int3
Function at 0x5e0dd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x74a7a5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x280
push esi
push edi
push dword [ebp + 0x10]
lea ecx, [ebp - 0x24]
call fcn.0048f7c0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x5e0e49
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
mov esi, dword [ebp - 0x24]
cmp edx, 8
cmovae eax, esi
cmp word [eax + ecx*2 - 2], 0x5c
je 0x5e0e42
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, esi
cmp word [eax + ecx*2 - 2], 0x2f
je 0x5e0e42
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, esi
cmp word [eax + ecx*2 - 2], 0x3a
jne 0x5e0e49
mov edx, 0x75bc44
jmp 0x5e0e4e
mov edx, 0x7a30d4
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5e0e53
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x24]
call fcn.004a60a0
cmp dword [ebp - 0x10], 8
lea ecx, [ebp - 0x28c]
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x5e0ece
mov dword [ecx], 0
call fcn.005dc9c0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
cmp eax, 2
je 0x5e0ebf
call esi
cmp eax, 0x12
je 0x5e0ebf
call esi
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], edi
jmp 0x5e0fda
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], edi
jmp 0x5e0fda
lea ecx, [ebp - 0x260]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5e0ed7
sub ecx, edx
lea eax, [ebp - 0x260]
sar ecx, 1
push ecx
mov ecx, dword [ebp + 0x14]
push eax
call fcn.00483f80
mov eax, dword [ebp - 0x28c]
test eax, 0x400
je 0x5e0f1a
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0
jmp 0x5e0fc9
mov esi, dword [ebp + 0x18]
lea ecx, [ebp - 0x260]
mov edi, dword [ebp + 0x1c]
lea edx, [ecx + 2]
and eax, 0x10
or eax, 0x20
shr eax, 4
mov dword [esi], eax
mov dword [edi], eax
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5e0f51
sub ecx, edx
lea eax, [ebp - 0x260]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.00483f80
push dword [ebp - 0x28c]
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
call fcn.005e22b0
mov edx, dword [ebp - 0x28]
add esp, 8
mov dword [esi + 4], eax
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x5e0fc3
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x5e0fb9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5e0ff4
push edx
push ecx
call fcn.00512900
add esp, 8
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov esi, dword [ebp + 8]
mov dword [esi], 0
call fcn.005dc9c0
mov dword [esi + 4], eax
lea ecx, [ebp - 0x24]
call fcn.00481f60
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0070b6e4
int3
Function at 0x5e2700
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x5e2715
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5e273b
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push esi
push eax
call fcn.005e25e0
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x5e2751
mov dword [edi], 0
call fcn.005dc9c0
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x5e2788
push esi
call fcn.005e1b30
add esp, 4
test al, al
je 0x5e277d
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 9
pop ebx
mov esp, ebp
pop ebp
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5e2bc0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x74334d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push 0x20
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.00483da0
movups xmm0, xmmword [str.boost::filesystem::rename]
mov dword [ebp - 0x1c], 0x19
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x7a30a0]
movq qword [eax + 0x10], xmm0
mov cl, byte [0x7a30a8]
mov byte [eax + 0x18], cl
mov byte [eax + 0x19], 0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x5e2c47
mov ecx, dword [eax]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x5e2c56
mov eax, dword [edi]
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x5e2c7b
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x5e2c96
mov dword [esi], 0
call fcn.005dc9c0
mov dword [esi + 4], eax
jmp 0x5e2c96
call fcn.005dc9c0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x10], 0
je 0x5e2cd6
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], esi
mov edx, dword [ebp - 0x18]
pop edi
pop esi
cmp edx, 0x10
jb 0x5e2cc8
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5e2cbe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5e2d03
push edx
push ecx
call fcn.00512900
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
push eax
lea ecx, [ebp - 0x14]
call fcn.004e6020
lea ecx, [ebp - 0x60]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x2c]
push dword [ebp + 0xc]
push edi
push eax
call fcn.005e0600
push 0x83a780
lea eax, [ebp - 0x60]
push eax
call fcn.00700933
call fcn.0070b6e4
int3
Function at 0x5e2d80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x74a9dd
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x5e2dab
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5e2ddc
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.005e25e0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
test ebx, 0x400
je 0x5e2ef8
cmp dword [edi + 0x14], 8
mov edx, edi
jb 0x5e2df2
mov edx, dword [edi]
mov ecx, edx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5e2e10
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x24]
call fcn.00483f80
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
push 0
cmovae eax, dword [ebp - 0x24]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp + 0xc], esi
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
cmp edx, 8
jb 0x5e2e90
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x5e2e86
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5e2f41
push edx
push ecx
call fcn.00512900
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
cmp esi, 0xffffffff
je 0x5e2db9
push edi
call fcn.005e1b30
add esp, 4
test al, al
jne 0x5e2eea
push ebx
push edi
call fcn.005e22b0
mov edi, dword [ebp + 8]
add esp, 8
push esi
mov dword [edi], 9
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x5e2f0d
mov dword [esi], 0
call fcn.005dc9c0
mov dword [esi + 4], eax
mov esi, 3
push ebx
push edi
test bl, 0x10
jne 0x5e2f1e
mov esi, 2
call fcn.005e22b0
mov ecx, eax
add esp, 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0070b6e4
int3
Function at 0x5eb870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
lea ecx, [edx + 0x3f8]
lea esi, [eax + 0x3f8]
cmp eax, ecx
ja 0x5eb8ad
cmp esi, edx
jb 0x5eb8ad
sub edx, eax
mov esi, 0x80
mov ecx, dword [eax + edx]
lea eax, [eax + 8]
xor dword [eax - 8], ecx
mov ecx, dword [eax + edx - 4]
xor dword [eax - 4], ecx
sub esi, 1
jne 0x5eb895
pop esi
pop ebp
ret
lea esi, [edx + 0x30]
sub edx, eax
lea ecx, [eax + 0x10]
mov eax, 0x10
nop word [eax + eax]
lea ecx, [ecx + 0x40]
lea esi, [esi + 0x40]
movups xmm0, xmmword [ecx - 0x50]
movups xmm1, xmmword [esi - 0x70]
pxor xmm1, xmm0
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [edx + ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [esi - 0x50]
pxor xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm0, xmmword [ecx - 0x20]
movups xmm1, xmmword [esi - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
sub eax, 1
jne 0x5eb8c0
pop esi
pop ebp
ret
Function at 0x5f0440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
xor eax, eax
mov dword [ebp + 8], 0
push esi
nop word [eax + eax]
mov ecx, dword [ebp + 0xc]
mov cl, byte [ecx + eax]
movzx edx, cl
mov ecx, dword [ebp - 4]
movzx esi, byte [ecx + eax]
inc eax
mov ecx, dword [ebp + 8]
xor esi, edx
or ecx, esi
mov dword [ebp + 8], ecx
cmp eax, 0x10
jl 0x5f0460
mov eax, dword [ebp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
pop esi
mov esp, ebp
pop ebp
ret