joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b3b1b
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x5b3b48
push esi
call fcn.005b519f
cmp byte [esi + 0x40], 0
pop ecx
je 0x5b3b41
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x5b3bb7
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x5b3bac
mov eax, dword [esi + 8]
test eax, eax
je 0x5b3b69
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x190]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x5b3ba8
cmp eax, 2
je 0x5b3bac
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5b3b5e
cmp eax, 3
je 0x5b3b8d
cmp eax, 1
jne 0x5b3b5e
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x5b3b5e
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x5b3b5e
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x5b3bd5
cmp eax, 0xcc
je 0x5b3bd5
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.005b39ee
pop esi
ret
Function at 0x5c5df0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x30]
push edi
jmp 0x5c5f6f
cmp al, 0x5c
jne 0x5c5e3c
inc esi
mov al, byte [esi]
test al, al
je 0x5c5ee6
cmp al, 0x51
jne 0x5c5f6e
inc esi
mov al, byte [esi]
test al, al
je 0x5c5ee6
cmp al, 0x5c
jne 0x5c5e1a
test al, al
je 0x5c5ee6
inc esi
cmp byte [esi], 0x45
jne 0x5c5e1a
jmp 0x5c5f6e
cmp al, 0x5b
jne 0x5c5ec9
xor edi, edi
inc esi
movzx eax, byte [esi]
cmp eax, 0x5c
jne 0x5c5e74
lea eax, [esi + 1]
cmp byte [eax], 0x45
jne 0x5c5e5b
mov esi, eax
jmp 0x5c5e46
push 3
push 0x605470
push eax
call fcn.005ddd40
add esp, 0xc
test eax, eax
jne 0x5c5e80
add esi, 3
jmp 0x5c5e46
test edi, edi
jne 0x5c5e80
cmp eax, 0x5e
jne 0x5c5e80
inc edi
jmp 0x5c5e46
lea eax, [esi + 1]
cmp byte [eax], 0x5d
jne 0x5c5ebd
mov ecx, dword [ebp + 8]
test byte [ecx + 0x43], 2
jne 0x5c5ebd
mov esi, eax
jmp 0x5c5ebd
test al, al
je 0x5c5ee6
cmp al, 0x5c
jne 0x5c5ebd
inc esi
mov al, byte [esi]
test al, al
je 0x5c5ee6
cmp al, 0x51
jne 0x5c5ebd
inc esi
mov al, byte [esi]
test al, al
je 0x5c5ee6
cmp al, 0x5c
jne 0x5c5ea8
test al, al
je 0x5c5ee6
inc esi
cmp byte [esi], 0x45
jne 0x5c5ea8
inc esi
mov al, byte [esi]
cmp al, 0x5d
jne 0x5c5e95
jmp 0x5c5f6e
cmp dword [ebp + 0x14], 0
je 0x5c5eee
cmp al, 0x23
jne 0x5c5eee
inc esi
mov al, byte [esi]
test al, al
je 0x5c5ee6
cmp al, 0xa
jne 0x5c5ed3
test al, al
jne 0x5c5f6e
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x28
jne 0x5c5f6e
mov al, byte [esi + 1]
cmp al, 0x3f
je 0x5c5f09
cmp al, 0x2a
je 0x5c5f09
inc ebx
cmp dword [ebp + 0xc], 0
jne 0x5c5f6e
cmp ebx, dword [ebp + 0x10]
jmp 0x5c5f6c
inc esi
inc esi
cmp byte [esi], 0x50
jne 0x5c5f11
inc esi
mov cl, byte [esi]
cmp cl, 0x3c
jne 0x5c5f23
mov al, byte [esi + 1]
cmp al, 0x21
je 0x5c5f23
cmp al, 0x3d
jne 0x5c5f28
cmp cl, 0x27
jne 0x5c5f6e
inc ebx
cmp dword [ebp + 0xc], 0
jne 0x5c5f34
cmp ebx, dword [ebp + 0x10]
je 0x5c5f7e
movzx eax, cl
inc esi
cmp eax, 0x3c
jne 0x5c5f40
push 0x3e
pop eax
mov ecx, esi
jmp 0x5c5f45
inc esi
movzx edx, byte [esi]
cmp edx, eax
jne 0x5c5f44
cmp dword [ebp + 0xc], 0
je 0x5c5f6e
mov eax, esi
sub eax, ecx
cmp dword [ebp + 0x10], eax
jne 0x5c5f6e
push dword [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
call fcn.005ddd40
add esp, 0xc
test eax, eax
je 0x5c5f7e
inc esi
mov al, byte [esi]
test al, al
jne 0x5c5e03
jmp 0x5c5ee6
mov eax, ebx
jmp 0x5c5ee9
Function at 0x5cb3dd
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test eax, eax
je 0x5cb412
push edi
mov edi, 0x120
cmp dword [esp + 0x10], edi
jae 0x5cb405
push eax
call fcn.005cfafd
push 2
call fcn.005cfaec
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.005dfec0
add esp, 0xc
pop edi
pop esi
ret

Function at 0x5d55af
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
cmp eax, ecx
mov dword [ebp - 8], edi
jb 0x5d563c
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.005dfb80
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x5d55fc
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x5d561e
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x5d56fa
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
cmp ecx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jbe 0x5d5664
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x5d566f
xor eax, eax
jmp 0x5d56bb
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x5d568c
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.005d7801
jmp 0x5d569c
cmp ecx, 2
jne 0x5d56a5
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.005d77e7
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.005dfb80
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x5d56e6
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x5d56fa
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x5d55ba
pop edi
pop ebx
leave
ret
Function at 0x5d9da8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 8
call fcn.005e1dec
xor esi, esi
inc esi
cmp dword [0x6b1d48], esi
pop ecx
jne 0x5d9dd0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x6b1d44], esi
mov byte [0x6b1d40], al
jne 0x5d9e36
mov ecx, dword [0x6b36a8]
test ecx, ecx
je 0x5d9e17
mov eax, dword [0x6b36a4]
sub eax, 4
cmp eax, ecx
jmp 0x5d9e10
mov eax, dword [eax]
test eax, eax
je 0x5d9e02
call eax
mov eax, dword [0x6b36a4]
sub eax, 4
cmp eax, dword [0x6b36a8]
mov dword [0x6b36a4], eax
jae 0x5d9dfa
mov eax, 0x618048
mov esi, 0x618050
cmp eax, esi
mov edi, eax
jae 0x5d9e36
mov eax, dword [edi]
test eax, eax
je 0x5d9e2f
call eax
add edi, 4
cmp edi, esi
jb 0x5d9e27
mov eax, 0x618054
mov esi, 0x61805c
cmp eax, esi
mov edi, eax
jae 0x5d9e55
mov eax, dword [edi]
test eax, eax
je 0x5d9e4e
call eax
add edi, 4
cmp edi, esi
jb 0x5d9e46
cmp dword [ebp + 0x10], 0
pop edi
pop esi
je 0x5d9e66
push 8
call fcn.005e1d58
jmp 0x5d9e78
push dword [ebp + 8]
mov dword [0x6b1d48], 1
call fcn.005d9d01
pop ecx
pop ebp
ret

Function at 0x5da759
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x5da776
call fcn.005dc5b5
mov dword [eax], 0x16
xor eax, eax
jmp 0x5da7e0
push esi
push 0x88
push 1
call fcn.005de0e4
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x5da7cb
push esi
call fcn.005e163e
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x5da7a9
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x5da6b5
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x5da7df
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.005d9fa3
test ebx, ebx
pop ecx
je 0x5da7dd
push ebx
call fcn.005dc5c7
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5df5dd
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x60b2a8
call fcn.005dfaf8
mov edi, 0x94
mov eax, edi
call fcn.005d9990
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x6b1d08], ecx
mov eax, dword [esi + 4]
mov dword [0x6b1d14], eax
mov edx, dword [esi + 8]
mov dword [0x6b1d18], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x6b1d0c], esi
cmp ecx, 2
je 0x5df63d
or esi, 0x8000
mov dword [0x6b1d0c], esi
shl eax, 8
add eax, edx
mov dword [0x6b1d10], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x5df678
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5df678
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x5df690
cmp eax, 0x20b
je 0x5df67d
mov dword [ebp - 0x1c], esi
jmp 0x5df6a4
cmp dword [ecx + 0x84], 0xe
jbe 0x5df678
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x5df69e
cmp dword [ecx + 0x74], 0xe
jbe 0x5df678
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.005e1ebf
pop ecx
test eax, eax
jne 0x5df6b8
push 0x1c
call fcn.005df5b9
pop ecx
call fcn.005e182d
test eax, eax
jne 0x5df6c9
push 0x10
call fcn.005df5b9
pop ecx
call fcn.005e1e1d
mov dword [ebp - 4], esi
call fcn.005e5d31
test eax, eax
jge 0x5df6e2
push 0x1b
call fcn.005df594
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x6b3464], eax
call fcn.005ee29d
mov dword [0x6b1d88], eax
call fcn.005ee1fb
test eax, eax
jge 0x5df708
push 8
call fcn.005df594
pop ecx
call fcn.005edfc8
test eax, eax
jge 0x5df719
push 9
call fcn.005df594
pop ecx
call fcn.005d9d43
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x5df72c
push eax
call fcn.005df594
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.005edf5f
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x5df74d
movzx eax, word [ebp - 0x34]
jmp 0x5df750
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.00503e80
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x5df76e
push edi
call fcn.005d9e7b
call fcn.005d9e9d
jmp 0x5df7a0
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.005dfb33
ret
Function at 0x5e5998
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x5e5b60
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x6b2320]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x5e5b60
test cl, 0x48
je 0x5e59fe
mov al, byte [eax + 5]
cmp al, 0xa
je 0x5e59fe
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5e5a50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x5e5a38
call fcn.005dc5b5
mov dword [eax], 9
call fcn.005dc5be
mov dword [eax], esi
jmp 0x5e5a48
cmp eax, 0x6d
je 0x5e5b60
push eax
call fcn.005dc5c7
pop ecx
or eax, 0xffffffff
jmp 0x5e5b62
mov eax, dword [edi]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x5e5b5b
test edx, edx
je 0x5e5a73
cmp byte [ebx], 0xa
jne 0x5e5a73
or al, 4
jmp 0x5e5a75
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x5e5b55
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x5e5b45
cmp al, 0xd
je 0x5e5aa9
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x5e5b37
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x5e5ac3
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x5e5abe
add dword [ebp + 0x10], 2
jmp 0x5e5b17
mov dword [ebp + 0x10], eax
jmp 0x5e5b33
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5e5aeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5e5b33
cmp dword [ebp - 0xc], 0
je 0x5e5b33
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x5e5b0c
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x5e5b17
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x5e5b36
cmp ebx, dword [ebp + 0xc]
jne 0x5e5b1c
cmp byte [ebp - 1], 0xa
jne 0x5e5b1c
mov byte [ebx], 0xa
jmp 0x5e5b36
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.005f0685
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x5e5b37
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x5e5a8d
jmp 0x5e5b55
mov eax, dword [edi]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x5e5b55
or al, 2
mov byte [esi], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x5e5b62
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5e5fca
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x61d110]
xor eax, dword [ebp + 4]
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
jne 0x5e5ff3
xor eax, eax
jmp 0x5e6161
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x6b2320]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x5e6026
push 2
push edi
push edi
push dword [ebp + 8]
call fcn.005f0685
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x5e60f8
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
jbe 0x5e6133
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x420]
mov dword [ebp - 0xc], edi
cmp ecx, dword [ebp + 0x10]
jae 0x5e6081
mov edx, dword [ebp - 0x10]
inc dword [ebp - 0x10]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x5e6072
inc dword [ebp - 0x18]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0xc]
mov byte [eax], dl
inc eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x400
jl 0x5e6055
mov edi, eax
lea eax, [ebp - 0x420]
sub edi, eax
push 0
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5e60c1
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x14], eax
cmp eax, edi
jl 0x5e60ca
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x5e6046
jmp 0x5e60cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
xor edi, edi
mov eax, dword [ebp - 0x14]
cmp eax, edi
jne 0x5e615c
cmp dword [ebp - 8], edi
je 0x5e6133
push 5
pop esi
cmp dword [ebp - 8], esi
jne 0x5e6125
call fcn.005dc5b5
mov dword [eax], 9
call fcn.005dc5be
mov dword [eax], esi
jmp 0x5e612e
push edi
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5e611a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
jmp 0x5e60cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x5e60cc
push dword [ebp - 8]
call fcn.005dc5c7
pop ecx
or eax, 0xffffffff
jmp 0x5e615f
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x5e6148
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x5e6148
xor eax, eax
jmp 0x5e615f
call fcn.005dc5b5
mov dword [eax], 0x1c
call fcn.005dc5be
mov dword [eax], edi
jmp 0x5e612e
sub eax, dword [ebp - 0x18]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
call fcn.005df800
leave
ret
Function at 0x5edacc
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ebx
je 0x5edb37
push 0x3d
push dword [ebp + 8]
call fcn.005f1101
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], esi
je 0x5edb37
cmp dword [ebp + 8], esi
je 0x5edb37
xor eax, eax
cmp byte [esi + 1], al
sete al
mov dword [ebp - 4], eax
mov eax, dword [0x6b1d28]
cmp eax, dword [0x6b1d2c]
jne 0x5edb1d
mov edi, eax
call fcn.005eda6b
mov dword [0x6b1d28], eax
cmp eax, ebx
jne 0x5edb76
cmp dword [ebp + 0xc], ebx
je 0x5edb3f
cmp dword [0x6b1d30], ebx
je 0x5edb3f
call fcn.005e6a5c
test eax, eax
je 0x5edb76
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
jne 0x5edc7a
push 4
call fcn.005d9f91
cmp eax, ebx
pop ecx
mov dword [0x6b1d28], eax
je 0x5edb37
mov dword [eax], ebx
cmp dword [0x6b1d30], ebx
jne 0x5edb76
push 4
call fcn.005d9f91
cmp eax, ebx
pop ecx
mov dword [0x6b1d30], eax
je 0x5edb37
mov dword [eax], ebx
mov ebx, dword [0x6b1d28]
mov edi, esi
mov esi, dword [ebp + 8]
sub edi, esi
push esi
call fcn.005eda1e
mov edi, eax
test edi, edi
pop ecx
jl 0x5edbcf
cmp dword [ebx], 0
je 0x5edbcf
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.005d9fa3
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x5edbb7
mov eax, dword [ebp + 8]
mov dword [esi], eax
jmp 0x5edc05
mov ecx, dword [esi + 4]
mov dword [esi], ecx
inc edi
add esi, 4
cmp dword [esi], eax
jne 0x5edbae
mov eax, edi
shl eax, 2
push eax
push ebx
call fcn.005dbd64
test eax, eax
pop ecx
pop ecx
je 0x5edc05
jmp 0x5edc00
cmp dword [ebp - 4], 0
jne 0x5edc73
test edi, edi
jge 0x5edbdf
neg edi
lea eax, [edi*4 + 8]
push eax
push ebx
call fcn.005dbd64
test eax, eax
pop ecx
pop ecx
je 0x5edb37
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov dword [0x6b1d28], eax
cmp dword [ebp + 0xc], 0
je 0x5edc5c
push dword [ebp + 8]
call fcn.005e0390
inc eax
inc eax
push eax
call fcn.005d9f91
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x5edc5c
push dword [ebp + 8]
push esi
call fcn.005e0520
mov eax, esi
sub eax, dword [ebp + 8]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
and byte [eax], 0
mov ecx, dword [ebp - 4]
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x5edc55
or dword [ebp - 8], 0xffffffff
push esi
call fcn.005d9fa3
pop ecx
cmp dword [ebp - 4], 0
je 0x5edc6b
push dword [ebp + 8]
call fcn.005d9fa3
pop ecx
mov eax, dword [ebp - 8]
jmp 0x5edb3a
push esi
call fcn.005d9fa3
pop ecx
xor eax, eax
jmp 0x5edb3a
Function at 0x5edcde
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.005d9990
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x5edd73
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x6b1d08]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x5edd73
cmp eax, 1
je 0x5edd8b
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x5edd73
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x5edd48
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x5edd6f
xor eax, eax
inc eax
jmp 0x5edda7
cmp esi, ebx
jae 0x5edd77
xor eax, eax
jmp 0x5edda7
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x6b1d08]
jmp 0x5edd8d
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5eddaf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x61d110]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x61db18]
je 0x5edddc
inc eax
cmp eax, 0x12
jb 0x5eddcd
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x61db18]
jne 0x5edf10
mov eax, dword [0x6b1d90]
cmp eax, 1
je 0x5edeeb
cmp eax, edx
jne 0x5ede0c
cmp dword [0x61d10c], 1
je 0x5edeeb
cmp ecx, 0xfc
je 0x5edf10
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5ede45
lea eax, [ebp - 0x10c]
push str._program_name_unknown_
push eax
call fcn.005e0520
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call fcn.005e0390
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x5ede87
lea eax, [ebp - 0x10c]
push eax
call fcn.005e0390
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x6107b0
push edi
call fcn.005da020
add esp, 0x10
push edi
call fcn.005e0390
push dword [esi + 0x61db1c]
mov ebx, eax
call fcn.005e0390
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.005d9990
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.005e0520
push edi
push ebx
call fcn.005e0530
push 0x610d80
push ebx
call fcn.005e0530
push dword [esi + 0x61db1c]
push ebx
call fcn.005e0530
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.005f117c
add esp, 0x2c
jmp 0x5edf10
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x61db1c]
push dword [esi]
call fcn.005e0390
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.005df800
pop edi
pop esi
pop ebx
leave
ret