joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a9324
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x194
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 8], eax
test byte [ebp + 8], 2
jne 0x5a93a2
call fcn.00634d48
mov esi, eax
test eax, eax
jne 0x5a93e8
push str.iphlpapi.dll
call fcn.005a93fd
add esp, 4
mov dword [0x7c0440], eax
test eax, eax
je 0x5a9378
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5a9378
mov dword [0x7c043c], eax
sub esp, 0x10
movaps xmm0, xmmword [0x74fb70]
movups xmmword [esp], xmm0
call fcn.00634f74
add esp, 0x10
mov byte [0x7c0444], al
push 0x7c0448
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor esi, esi
jmp 0x5a93e8
lea esi, [ebp - 0x198]
push 0x190
push 0xff
push esi
call fcn.006ccfc0
add esp, 0xc
push esi
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x5a93e3
movzx eax, word [ebp - 0x198]
cmp eax, 0x202
je 0x5a933e
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov esi, 2
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.006c9121
mov eax, esi
add esp, 0x194
pop esi
pop ebp
ret

Function at 0x5a93fd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
push 0x74fbaa
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5a9448
mov edi, eax
mov ebx, dword [ebp + 8]
push 0x74fbbc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x74fbcc
push ebx
call fcn.006e7336
add esp, 8
test eax, eax
je 0x5a944e
test esi, esi
je 0x5a9476
mov ecx, esi
call dword [section..00cfg]
push 8
jmp 0x5a946f
xor ebx, ebx
mov eax, ebx
jmp 0x5a947d
test esi, esi
je 0x5a9485
push str.AddDllDirectory
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5a9485
mov ecx, esi
call dword [section..00cfg]
push 0x800
push 0
push ebx
call esi
jmp 0x5a947d
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x5a944a
mov edi, eax
push dword [ebp + 8]
call fcn.006e6814
add esp, 4
mov ecx, dword [fcn.00474d30]
mov dword [ebp - 0x10], edi
add eax, edi
lea ebx, [eax + eax]
add ebx, 2
call dword [section..00cfg]
push ebx
call ecx
add esp, 4
mov edi, eax
xor ebx, ebx
test eax, eax
je 0x5a9523
push dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x5a9523
push edi
call fcn.006e6814
add esp, 4
lea eax, [edi + eax*2]
push 0x7320a0
push eax
call fcn.006e7104
add esp, 8
push edi
call fcn.006e6814
add esp, 4
lea eax, [edi + eax*2]
push dword [ebp + 8]
push eax
call fcn.006e7104
add esp, 8
test esi, esi
je 0x5a951a
mov ecx, esi
call dword [section..00cfg]
push 8
push 0
push edi
call esi
jmp 0x5a9521
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov ecx, dword [fcn.00474d80]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
jmp 0x5a944a
Function at 0x5ae961
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x6e1], 0
je 0x5ae9f2
mov esi, dword [ebp + 0xc]
cmp dword [edi + 0x1b0], 0
je 0x5ae9bb
push 1
push edi
call fcn.004ed8af
add esp, 8
mov ebx, dword [edi + 0x14c]
mov ecx, dword [edi + 0x1b0]
call dword [section..00cfg]
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push edi
call ecx
add esp, 0x14
mov esi, eax
push 0
push edi
call fcn.004ed8af
add esp, 8
mov eax, esi
jmp 0x5ae9f4
cmp esi, 2
ja 0x5ae9f2
lea eax, [esi + esi*2]
add eax, 0x750477
xor esi, esi
inc esi
push dword [edi + 0x148]
push esi
push 2
push eax
call fcn.006e4d30
add esp, 0x10
push dword [edi + 0x148]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.006e4d30
add esp, 0x10
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5aeb50
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x110
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [ecx + 0xc]
mov eax, dword [ebx + 0x288]
test byte [eax + 0x40], 3
mov esi, dword [ebx + edi*4 + 0x148]
je 0x5aec82
cmp dword [ebx + edi*4 + 0x160], 0x5aed90
jne 0x5aec82
shl edi, 4
mov eax, dword [ebx + edi + 0x174]
sub eax, dword [ebx + edi + 0x178]
cmp dword [ebx + edi + 0x170], 0
je 0x5aebba
test eax, eax
je 0x5aec82
sub esp, 0x14
movaps xmm0, xmmword [0x6fbe00]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [ebp - 0x114], eax
call fcn.005be08f
add esp, 0x14
cmp eax, 0xffffffff
je 0x5aec82
and eax, 1
je 0x5aec82
lea edx, [ebx + edi]
add edx, 0x178
mov eax, dword [edx - 8]
test eax, eax
mov dword [ebp - 0x118], edx
je 0x5aec0c
mov ecx, dword [edx]
mov edx, dword [ebp - 0x114]
jmp 0x5aec69
lea ecx, [ebx + edi]
add ecx, 0x174
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4c8]
add eax, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x11c], ecx
mov dword [ecx], eax
mov ecx, dword [fcn.00474d30]
call dword [section..00cfg]
push dword [ebp - 0x114]
call ecx
mov edx, dword [ebp - 0x118]
add esp, 4
mov dword [edx - 8], eax
test eax, eax
je 0x5aed19
xor ecx, ecx
mov dword [edx], ecx
mov dword [ebx + edi + 0x17c], ecx
mov edx, dword [ebp - 0x11c]
mov edx, dword [edx]
add ecx, eax
push 0
push edx
push ecx
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x5aec82
mov ecx, dword [ebp - 0x118]
add dword [ecx], eax
xor edi, edi
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
cmp esi, 0xffffffff
jne 0x5aed02
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x5aecb7
mov dword [edi], 0x51
xor esi, esi
jmp 0x5aed02
mov esi, eax
mov edi, 0x100
lea ebx, [ebp - 0x110]
push edi
push 0xff
push ebx
call fcn.006ccfc0
add esp, 0xc
push edi
push ebx
push esi
call fcn.005a7355
add esp, 0xc
push eax
push str.Send_failure:__s
mov edi, dword [ebp + 8]
push edi
call fcn.005ae9f9
add esp, 0xc
mov dword [edi + 0x92c], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x37
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006c9121
mov eax, esi
add esp, 0x110
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x1b
jmp 0x5aecff
Function at 0x5b369e
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
xor edi, edi
test ecx, ecx
je 0x5b3722
mov esi, ecx
call fcn.005b3562
test al, al
jne 0x5b3722
push esi
call fcn.006e65e0
add esp, 4
mov edi, eax
push eax
push 0x2e
push esi
call fcn.00637a7c
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x5b36eb
sub eax, esi
push eax
push 0x2e
push esi
call fcn.00637a7c
add esp, 0xc
test eax, eax
je 0x5b36eb
inc eax
add edi, esi
sub edi, eax
mov ebx, eax
test ebx, ebx
cmovne esi, ebx
test edi, edi
jle 0x5b371d
add edi, esi
mov eax, 0x1505
mov ebx, eax
shl ebx, 5
add ebx, eax
movsx eax, byte [esi]
inc esi
push eax
call fcn.00621780
add esp, 4
movzx eax, al
xor eax, ebx
cmp esi, edi
jb 0x5b36fb
movzx edi, al
jmp 0x5b3722
mov edi, 5
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5b4729
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1a0
mov esi, dword [ebp + 0xc]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0x198], eax
lea ebx, [esp + 0x98]
push 0x100
push 0xff
push ebx
call fcn.006ccfc0
add esp, 0xc
lea eax, [esp + 0xc]
mov dword [eax], 0x80
xorps xmm0, xmm0
lea edi, [esp + 0x10]
movaps xmmword [edi], xmm0
movaps xmmword [edi + 0x10], xmm0
movaps xmmword [edi + 0x20], xmm0
movaps xmmword [edi + 0x30], xmm0
movaps xmmword [edi + 0x40], xmm0
movaps xmmword [edi + 0x50], xmm0
movaps xmmword [edi + 0x60], xmm0
movaps xmmword [edi + 0x70], xmm0
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x5b47c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push 0x100
push ebx
push eax
call fcn.005a7355
add esp, 0xc
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x5b4804
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], edi
call fcn.005b45b6
add esp, 0x10
test al, al
jne 0x5b480f
call fcn.006dadc4
push 0x100
push ebx
push dword [eax]
call fcn.005a7355
add esp, 0xc
mov esi, eax
call fcn.006dadc4
push esi
push dword [eax]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push dword [ebp + 8]
call fcn.005ae9f9
add esp, 0x10
mov ecx, dword [esp + 0x198]
xor ecx, ebp
call fcn.006c9121
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5b5155
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x4020
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 4
mov eax, dword [0x7c0450]
cmp eax, 2
je 0x5b51f9
test eax, eax
jne 0x5b51b9
sub esp, 0x10
movaps xmm0, xmmword [0x74fb70]
movups xmmword [esp], xmm0
call fcn.00634f74
add esp, 0x10
test al, al
je 0x5b51af
mov dword [0x7c0450], 2
jmp 0x5b51f9
mov dword [0x7c0450], 1
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
push ecx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x5b51e2
cmp dword [ebp - 0x10], 0x4020
jg 0x5b51f9
lea eax, [ebp - 0xc]
push 4
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.006c9121
add esp, 0x10
pop esi
pop ebp
ret
Function at 0x5b7e26
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x100], 2
jne 0x5b7e3b
pop ebp
jmp fcn.005b7dec
mov al, 1
pop ebp
ret

Function at 0x5b7e40
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0xc], 0x10
xor eax, eax
inc eax
mov dword [esp + 8], eax
xor esi, esi
dec esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
push 6
push eax
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, esi
je 0x5b7fef
mov edi, eax
mov ebx, dword [ebp + 0x14]
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], eax
mov word [esp + 0x28], 2
push 0x7f000001
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x2c], eax
mov word [esp + 0x2a], 0
xor esi, esi
dec esi
mov dword [ebx + 4], esi
mov dword [ebx], esi
mov eax, 4
lea ecx, [esp + 8]
push eax
push ecx
push eax
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, esi
je 0x5b7fd4
lea eax, [esp + 0x28]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x5b7fd4
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x5b7fd4
push 1
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x5b7fd4
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x5b7fd4
push 0x10
lea ecx, [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x5b7fd4
xor eax, eax
push eax
push eax
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x5b7fd4
lea eax, [esp + 0x10]
push ebx
push 0x6fb884
push 0xc
push eax
call fcn.005baa84
add esp, 0x10
lea eax, [esp + 0x10]
push eax
call fcn.006e65e0
add esp, 4
mov dword [esp + 4], eax
push 0
push eax
lea eax, [esp + 0x18]
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, dword [esp + 4]
jne 0x5b7fd4
lea eax, [esp + 0x1c]
push 0
push 0xc
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, dword [esp + 4]
jne 0x5b7fd4
push dword [esp + 4]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.006cbb2d
add esp, 0xc
test eax, eax
je 0x5b8004
mov eax, edi
mov edi, ebx
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
push eax
call ebx
push dword [edi]
call ebx
mov edi, dword [edi + 4]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.006c9121
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x5b7fe8
Function at 0x5b8008
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [0x7a8498]
xor ecx, ebp
xor edx, edx
cmp dword [ebp + 0xc], 0
mov dword [ebp - 8], ecx
setne dl
lea ecx, [ebp - 0xc]
mov dword [ecx], edx
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.006c9121
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
Function at 0x5c4faa
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 8], eax
mov eax, dword [ecx + 0xc]
xor ecx, ecx
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov esi, eax
test eax, eax
je 0x5c4fdc
mov esi, dword [esp]
mov ecx, dword [esp + 8]
xor ecx, ebp
call fcn.006c9121
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x5c50d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, esp
mov dword [esi + 0x40], ebp
mov ebx, ecx
lea eax, [esi + 0x48]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5c58a0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
cmp dword [ebx + 0xc], 0xffffffff
je 0x5c5152
cmp dword [ebx + 0x1c], 0
je 0x5c5152
cmp dword [ebx + 0x14], 0
je 0x5c5152
cmp dword [ebx + 0x18], 0
je 0x5c5152
cmp byte [ebx + 0xb], 0
js 0x5c5128
mov eax, ebx
jmp 0x5c512a
mov eax, dword [ebx]
push eax
push str.calling_reloadFromFile_while_the_cache___ws__is_still_valid
push 0xb9
push str.reloadFromFile
push str.MemoryFile_Win32.cpp
push 2
call fcn.005ca150
add esp, 0x18
mov ecx, ebx
push 0
call fcn.005c55de
mov ecx, ebx
call fcn.005c4e58
mov eax, dword [ebx + 0xc]
cmp eax, 0xffffffff
je 0x5c51eb
lea ecx, [esi + 0x20]
mov dword [ecx], eax
xorps xmm0, xmm0
movups xmmword [ecx + 4], xmm0
movups xmmword [ecx + 0x10], xmm0
lea eax, [esi + 0x14]
mov dword [eax + 8], 0xffffffff
mov dword [eax], ecx
xor edx, edx
inc edx
mov dword [eax + 4], edx
mov byte [eax + 8], 1
mov dword [esi], eax
push edx
call fcn.005c5d20
mov eax, dword [ebx + 0xc]
xor ecx, ecx
lea edx, [esi + 8]
mov dword [edx + 4], ecx
mov dword [edx], ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x5c51b4
mov ecx, dword [esi + 8]
mov dword [ebx + 0x1c], ecx
jmp 0x5c51b7
mov ecx, dword [ebx + 0x1c]
mov edi, dword [0x7bd574]
cmp ecx, edi
jb 0x5c51cb
mov eax, ecx
xor edx, edx
div edi
test edx, edx
je 0x5c51fc
mov eax, ecx
xor edx, edx
div edi
inc eax
imul eax, edi
mov dword [esi + 0x50], 0
mov ecx, ebx
push eax
call fcn.005c5234
mov ecx, esi
call fcn.004fbbf0
mov eax, dword [esi + 0x48]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x50], 0
mov dword [esi + 4], ebx
mov ecx, ebx
call fcn.005c553c
test al, al
jne 0x5c51e4
mov ecx, dword [esi + 4]
push 0
call fcn.005c55de
jmp 0x5c51e4
Function at 0x5c5376
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], edx
sub esp, 0x14
movsd xmm0, qword [esp + 0x14]
movsd qword [esp + 4], xmm0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x5c53db
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
jne 0x5c5402
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_SetEndOfFile:_d
push 0x14f
jmp 0x5c53ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_SetFilePointer:_d
push 0x152
push str.ftruncate
push str.MemoryFile_Win32.cpp
push 3
call fcn.005ca150
add esp, 0x18
xor ebx, ebx
mov ecx, dword [esp + 0xc]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret

Function at 0x5c5416
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, dword [ebp + 8]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0x10], eax
cmp esi, 0xffffffff
je 0x5c5524
mov edi, dword [ebp + 0x10]
mov bl, 1
test edi, edi
je 0x5c5526
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
sub esp, 0x14
movsd xmm0, qword [esp + 0x1c]
movsd qword [esp + 4], xmm0
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x5c54e8
cmp edi, 0x1000
jb 0x5c54b9
xor ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 4], ebx
push ebx
lea eax, [esp + 8]
push eax
push 0x1000
push 0x753d58
push dword [ebp + 8]
call esi
test eax, eax
je 0x5c54fc
sub edi, dword [esp + 4]
cmp edi, 0xfff
ja 0x5c5487
test edi, edi
mov bl, 1
mov esi, dword [ebp + 8]
je 0x5c5526
xor eax, eax
lea ecx, [esp + 4]
mov dword [ecx], eax
push eax
push ecx
push edi
push 0x753d58
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5c5526
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.fail_to_write_fd__p___error:_d
push 0x141
jmp 0x5c5510
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.fail_to_lseek_fd__p___error:_d
push 0x131
jmp 0x5c5510
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push str.fail_to_write_fd__p___error:_d
push 0x139
push str.zeroFillFile
push str.MemoryFile_Win32.cpp
push 3
call fcn.005ca150
add esp, 0x1c
xor ebx, ebx
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5c56e7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0xb]
test cl, cl
js 0x5c56f8
jne 0x5c5700
jmp 0x5c570f
cmp dword [eax + 4], 0
je 0x5c570f
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
jmp 0x5c5711
xor eax, eax
pop ebp
ret

Function at 0x5c5713
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x5c5729
mov eax, dword [ecx]
push eax
call fcn.006e2110
add esp, 4
mov dword [ebp - 0x10], eax
mov esi, eax
mov ebx, dword [ebp - 0x10]
mov edi, 0x7320a0
push edi
push esi
call fcn.006e7384
add esp, 8
lea esi, [esi + eax*2]
push edi
push esi
call fcn.006e718a
add esp, 8
mov edi, eax
movzx eax, word [esi + eax*2]
mov word [ebp - 0x12], ax
mov word [esi + edi*2], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5c5778
test al, 0x10
jne 0x5c5785
jmp 0x5c5798
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x5c57b1
lea esi, [esi + edi*2]
mov word [esi], 0x5c
cmp word [ebp - 0x12], 0
jne 0x5c573a
mov bl, 1
jmp 0x5c57e4
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
jns 0x5c57a3
mov ecx, dword [ecx]
push eax
push ecx
push str._ws_attribute:_d_not_a_directry
push 0x100
jmp 0x5c57ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
jns 0x5c57c2
mov ecx, dword [ecx]
push eax
push ecx
push str.fail_to_create_dir:_ws___d
push 0xfb
push str.mkPath
push str.MemoryFile_Win32.cpp
push 3
call fcn.005ca150
add esp, 0x1c
xor ebx, ebx
mov eax, dword [ebp - 0x10]
push eax
call fcn.00474d80
add esp, 4
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5c5b66
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x5c5cc8
mov eax, dword [ebp + 0x14]
cmp dword [ecx + 0xc], 0
jne 0x5c5bbf
mov esi, 0xf4
push esi
mov ebx, ecx
mov edi, eax
call fcn.006c90b6
add esp, 4
mov dword [ebx + 0xc], eax
push esi
push 0
push eax
mov esi, eax
call fcn.006ccfc0
add esp, 0xc
lea eax, [ebx + 0x10]
push esi
push 0x80
push eax
call fcn.006405b4
mov eax, edi
mov ecx, ebx
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x14], ebx
mov byte [eax], bl
mov ebx, eax
inc eax
mov dword [ebp - 0x1c], eax
movups xmm0, xmmword [ecx + 0x20]
movups xmmword [ebx + 1], xmm0
mov ebx, dword [ebp - 0x14]
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x18], eax
xor eax, eax
test bl, bl
je 0x5c5c53
mov dword [ebp - 0x10], edx
mov cl, 1
sub cl, bl
movzx ecx, cl
mov dword [ebp - 0x20], ecx
mov ecx, ebx
dec cl
movzx ecx, cl
mov edx, dword [ebp + 0x14]
add ecx, edx
inc ecx
mov dword [ebp - 0x24], ecx
mov cl, byte [edi + eax - 1]
xor cl, byte [esi + eax - 1]
mov edx, dword [ebp - 0x24]
mov byte [edx + eax], cl
mov edx, eax
lea ecx, [eax - 1]
cmp byte [ebp - 0x20], al
je 0x5c5c2b
mov ebx, dword [ebp + 0x10]
add ebx, eax
dec ebx
mov eax, ecx
test ebx, ebx
jne 0x5c5c07
add dword [ebp - 0x10], ecx
add esi, ecx
add edi, ecx
cmp byte [ebp - 0x20], dl
je 0x5c5c3e
mov eax, dword [ebp - 0x14]
add eax, ecx
jmp 0x5c5c50
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push eax
push eax
call fcn.00640c17
add esp, 0xc
xor eax, eax
mov edx, dword [ebp - 0x10]
mov ebx, dword [ebp + 0x14]
cmp edx, 0x10
jb 0x5c5c9f
add edx, 0xfffffff0
mov dword [ebp - 0x10], edx
cmp al, 0xf
ja 0x5c5c7f
movzx eax, al
add eax, 0xfffffffc
mov ecx, dword [edi + eax - 0xc]
xor ecx, dword [esi + eax - 0xc]
mov dword [ebx + eax + 5], ecx
add eax, 4
cmp eax, 0xc
jb 0x5c5c6b
add esi, 0xfffffff0
add edi, 0xfffffff0
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push eax
push eax
call fcn.00640c17
add esp, 0xc
xor eax, eax
mov edx, dword [ebp - 0x10]
cmp edx, 0xf
ja 0x5c5c5b
test edx, edx
je 0x5c5cc6
neg edx
xor eax, eax
mov dword [ebp - 0x10], edx
mov cl, byte [edi + eax - 1]
xor cl, byte [esi + eax - 1]
lea edx, [eax + 0xf]
movzx edx, dl
mov byte [ebx + edx + 1], cl
mov edx, dword [ebp - 0x10]
dec eax
cmp edx, eax
jne 0x5c5caa
add al, 0x10
mov byte [ebx], al
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x10