joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5385f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], eax
push edi
lea eax, [esp + 0x10]
push eax
mov ebp, 0xf4240
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
lea ecx, [ecx]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x10]
cmp eax, esi
mov ecx, dword [esp + 0x14]
jne 0x538659
cmp ecx, edi
jne 0x538659
mov edx, dword [esp + 0x1c]
add ebp, 0xffffffff
adc edx, 0xffffffff
mov dword [esp + 0x1c], edx
mov edx, ebp
or edx, dword [esp + 0x1c]
je 0x538669
sub eax, esi
sbb ecx, edi
cmp ecx, ebx
jb 0x538620
ja 0x538669
cmp eax, dword [esp + 0x24]
jb 0x538620
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x5386a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 8
push ebx
push ebp
push edi
lea eax, [esp + 0xc]
push eax
xor ebp, ebp
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
xor edi, edi
push edi
push 5
push ecx
push edx
call fcn.005819f0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
push esi
push 0
push 1
call fcn.005385f0
add esp, 8
rdtsc
mov ecx, dword [esp + 0x10]
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
push ecx
call fcn.005385f0
add esp, 8
rdtsc
sub eax, esi
test edi, edi
je 0x538714
cmp eax, ebp
jb 0x538710
test ebp, ebp
je 0x538710
cmp eax, ebx
jb 0x53870c
test ebx, ebx
jne 0x538714
mov ebx, eax
jmp 0x538714
mov ebx, ebp
mov ebp, eax
inc edi
cmp edi, 5
jl 0x5386d2
test ebx, ebx
pop esi
mov eax, ebp
je 0x538723
mov eax, ebx
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x538fe0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ecx, dword [0x669834]
mov eax, dword [0x669830]
add eax, ecx
mov ecx, dword [0x669824]
mov edx, eax
sar eax, 0x10
add ecx, eax
mov eax, dword [0x669810]
and edx, 0xffff
test eax, eax
mov dword [0x669834], edx
mov dword [0x669824], ecx
je 0x53907e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, eax
mov eax, dword [0x669824]
sub eax, ecx
dec eax
cmp eax, 1
jge 0x539047
cmp eax, 0xfffffc18
jge 0x539042
call esi
inc eax
mov dword [0x669824], eax
inc dword [0x669844]
mov eax, 1
mov edx, dword [0x669814]
push 0
push 0
push fcn.00538fe0
push edx
push eax
call dword [sym.imp.WINMM.dll_timeSetEvent]
test eax, eax
mov dword [0x669828], eax
pop esi
jne 0x53907e
mov dword [0x66964c], eax
mov dword [0x669810], eax
mov eax, dword [0x669814]
push eax
call dword [sym.imp.WINMM.dll_timeEndPeriod]
mov eax, dword [0x66982c]
test eax, eax
je 0x53909d
mov eax, dword [0x669840]
test eax, eax
jne 0x53909d
push 0x669838
call fcn.00539d00
add esp, 4
call fcn.0053b280
ret 0x14
Function at 0x539160
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xc
mov eax, dword [0x669848]
push ebx
push ebp
push esi
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [esp + 0x10], 5
mov esi, 1
jne 0x539193
mov ecx, 8
xor eax, eax
mov edi, 0x66962c
mov dword [0x669848], esi
rep stosd dword es:[edi], eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esp + 0x20]
lea ecx, [ecx]
call fcn.005390d0
cmp edi, ebx
je 0x5391c3
cmp edi, esi
jl 0x5391b5
cmp edi, 0x2710
jle 0x5391c8
push edi
push str.TIMER_init___BAD_TIMER_FREQUENCY_SPECIFIED__d_n
call fcn.00537b20
add esp, 8
mov edi, 0x64
mov eax, 0x3e80000
cdq
idiv edi
push 8
mov dword [0x669834], ebx
mov dword [0x669650], ebx
mov dword [0x669830], eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
test eax, eax
jne 0x53930a
cmp dword [0x669830], 0x10000
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [0x669814], esi
jl 0x53932d
push 0xc
push 0x669818
call fcn.0053a7f0
push 2
push ebx
push ebx
push 0x538f40
push 0x669818
call fcn.005383f0
add esp, 0x1c
test al, al
je 0x539350
mov ecx, dword [0x669814]
push ecx
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
mov esi, eax
cmp esi, ebx
jne 0x539373
push fcn.005390d0
call fcn.0053a780
add esp, 4
cmp edi, ebx
mov dword [0x66964c], edi
mov dword [0x669810], edi
je 0x5392a1
cmp dword [0x669828], ebx
jne 0x5392a1
mov esi, dword [0x669840]
mov dword [0x669840], 1
call ebp
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [0x669824], eax
call fcn.00538fe0
mov dword [0x669840], esi
call fcn.00537eb0
mov ebx, eax
call ebp
mov esi, eax
mov eax, dword [0x66964c]
lea edx, [eax + eax*4]
add esi, edx
call ebp
cmp eax, esi
jge 0x5392d9
lea esp, [esp]
call fcn.00537eb0
cmp ebx, eax
jne 0x5392d9
push 1
call fcn.00538100
add esp, 4
call ebp
cmp eax, esi
jl 0x5392c0
call fcn.00537eb0
cmp ebx, eax
jne 0x5392e7
call fcn.005390d0
mov eax, dword [0x66964c]
test eax, eax
jne 0x5393b1
dec dword [esp + 0x10]
je 0x5393a4
xor ebx, ebx
mov esi, 1
jmp 0x5391a0
push str.TIMER_init___MULTIMEDIA_TIMER_NOT_FOUND._n
call fcn.00537b20
add esp, 4
pop edi
pop esi
pop ebp
mov dword [0x66964c], ebx
mov dword [0x669810], ebx
xor eax, eax
pop ebx
add esp, 0xc
ret
push str.TIMER_init___MULTIMEDIA_TIMER_CANNOT_SUPPORT_THIS_FREQUENCY._n
call fcn.00537b20
add esp, 4
pop edi
pop esi
pop ebp
mov dword [0x66964c], ebx
mov dword [0x669810], ebx
xor eax, eax
pop ebx
add esp, 0xc
ret
push str.TIMER_init___FAILED_TO_CREATE_TIMER_THREAD._n
call fcn.00537b20
add esp, 4
pop edi
pop esi
pop ebp
mov dword [0x66964c], ebx
mov dword [0x669810], ebx
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0x669838
mov dword [0x66964c], ebx
mov dword [0x669810], ebx
call fcn.00539d00
push esi
push str.TIMER_init___FAILED_TO_INITIALIZE_MULTIMEDIA_TIMER_:_0x_x._n
call fcn.00537b20
mov eax, dword [0x66964c]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push str.TIMER_init___FAILED_TO_INITIALIZE_WINDOWS_MULTIMEDIA_TIMER__TRY_RE_RUNNING._n
call fcn.00537b20
add esp, 4
mov eax, dword [0x66964c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x53a8d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
movzx eax, word [esp + 0x14]
xor edx, edx
xor esi, esi
dec ecx
jns 0x53a8f0
jmp 0x53a904
xor eax, esi
mov dl, byte [ebx]
xor dl, al
inc ebx
shr eax, 8
dec ecx
mov esi, dword [edx*4 + 0x5c2590]
jns 0x53a8f0
xor eax, esi
pop esi
pop ebx
ret
Function at 0x542970
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ax, word [edi + 2]
mov word [ecx + 2], ax
movsx esi, word [edi + 2]
mov edx, dword [0x66a10c]
imul esi, esi, 0x114
add esi, edx
xor eax, eax
mov dword [esi + 0xe4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
movsx ebp, word [edi + 2]
mov edx, dword [edi + 0x10]
movzx eax, byte [edi + 4]
add ecx, 4
push ecx
movzx ecx, byte [edi + 6]
push ecx
mov ecx, dword [edi + 0xc]
lea ebx, [esi + 0xe4]
push ebp
push edx
mov edx, dword [edi + 8]
push eax
movzx eax, byte [edi + 5]
push ecx
mov ecx, dword [edi + 0x14]
push edx
push eax
push ecx
call fcn.00546e60
mov dword [esi + 0x18], eax
mov word [eax + 0x18], 5
mov edx, dword [esi + 0x18]
push edx
push ebx
call fcn.00542600
push 0x1c
call fcn.0053f8f0
push eax
mov dword [esi + 0x1c], eax
call fcn.00546060
mov eax, dword [esi + 0x1c]
mov word [eax + 0x18], 1
mov ecx, dword [esi + 0x1c]
push ecx
push ebx
call fcn.00542600
mov eax, dword [edi + 0x18]
add esp, 0x3c
test eax, eax
je 0x542a58
mov eax, dword [edi + 0x10]
test eax, eax
je 0x542a2a
or ebp, 0xffffffff
push 0x1828
call fcn.0053f8f0
mov dword [esi + 0x20], eax
mov edx, dword [edi + 0x18]
push ebp
push edx
push eax
call fcn.00545f70
mov eax, dword [esi + 0x20]
mov word [eax + 0x18], 4
mov ecx, dword [esi + 0x20]
push ecx
push ebx
call fcn.00542600
add esp, 0x18
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x556170
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x1b], 0
mov byte [esp + 0x1a], 0
call fcn.00552c90
mov eax, dword [esp + 0x34]
movzx ecx, byte [eax + 6]
xor edx, edx
mov dl, byte [eax + 7]
add esp, 8
and edx, 0xf
mov ebp, edx
lea edx, [ecx + ecx + 3]
and edx, 0xfffffffc
test ebp, ebp
lea eax, [edx + eax + 0xc]
mov dword [esp + 0x20], eax
jle 0x5562c2
mov ecx, 7
mov dword [esp + 0x14], ecx
mov edi, eax
mov dword [esp + 0x18], ebp
jmp 0x5561d0
movzx eax, byte [edi + 1]
test eax, eax
movzx edx, byte [edi]
mov byte [esp + 0x2c], 0
je 0x55622a
mov bl, 1
shl bl, cl
mov ecx, dword [0x66d6bc]
test ecx, ecx
je 0x556218
mov esi, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x34]
mov eax, dword [esi + eax*4]
push eax
push edx
mov edx, dword [esp + 0x34]
push edx
call ecx
add esp, 0x10
test eax, eax
jne 0x556210
mov byte [esp + 0x2c], al
jmp 0x55621c
jle 0x556218
mov byte [esp + 0x2c], bl
jmp 0x55621c
or byte [esp + 0x12], bl
mov cl, byte [esp + 0x13]
mov al, byte [esp + 0x2c]
or cl, al
mov byte [esp + 0x13], cl
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
add edi, 3
dec ecx
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
jne 0x5561d0
test ebp, ebp
mov eax, dword [esp + 0x20]
jle 0x5562c2
mov edi, 7
mov esi, eax
movzx eax, byte [esi + 1]
test eax, eax
movzx edx, byte [esi]
mov byte [esp + 0x2c], 0
jne 0x5562a5
mov eax, dword [0x66d6bc]
mov bl, 1
mov ecx, edi
shl bl, cl
test eax, eax
je 0x556293
mov ecx, dword [esp + 0x1c]
push ecx
push 0
push edx
mov edx, dword [esp + 0x34]
push edx
call eax
add esp, 0x10
test eax, eax
jne 0x55628b
mov byte [esp + 0x2c], al
jmp 0x556297
jle 0x556293
mov byte [esp + 0x2c], bl
jmp 0x556297
or byte [esp + 0x12], bl
mov cl, byte [esp + 0x13]
mov al, byte [esp + 0x2c]
or cl, al
mov byte [esp + 0x13], cl
add esi, 3
dec edi
dec ebp
jne 0x556250
mov ecx, dword [esp + 0x34]
mov dl, byte [esp + 0x12]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
mov byte [ecx], dl
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x34]
mov cl, byte [esp + 0x12]
pop edi
pop esi
pop ebp
mov byte [eax], cl
mov al, byte [esp + 7]
pop ebx
add esp, 0x14
ret

Function at 0x558780
Capabilities:
Print debug messages

Disassembly:
dec dword [ebx - 0x7efbdbb4]
in al, dx
add byte [ecx], al
add byte [eax], al
lea eax, [esp + 0x108]
push eax
push ecx
lea edx, [esp + 8]
push edx
call dword [0x5bf470]
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 0x100
ret
Function at 0x567ad0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
call fcn.0057eda1
add esp, 4
push 1
call fcn.00581c92
int3
Function at 0x574034
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x57408c
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x57408c
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x57408c
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x5740b5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x574123
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x57411a
cmp dword [ebp - 0xc], 4
jne 0x57411a
cmp dword [ebp - 0x10], edi
je 0x57411a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5c6b5c], edi
xor eax, eax
jmp 0x57414b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x5c6b5c], edi
jge 0x574146
mov dword [0x5c6b5c], edi
call fcn.00574090
test eax, eax
je 0x574146
emms
mov dword [0x5c6b5c], 1
mov eax, dword [0x5c6b5c]
pop edi
leave
ret

Function at 0x57422b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x574262
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x574284
cmp dword [ebp - 0x20], 4
ja 0x57428e
jne 0x57427e
cmp dword [ebp - 0x1c], 0xa
jb 0x57427e
cmp word [ebp - 0x18], 0x55d
jae 0x57428e
mov byte [ebp + 0x73], 1
jmp 0x57428e
cmp dword [ebp - 0x14], 2
jne 0x5742a4
test bl, bl
je 0x5742bf
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x5742af
dec eax
je 0x5742a8
sub eax, 3
jne 0x5742a4
cmp byte [ebp + 0x73], 0
je 0x5742d0
xor eax, eax
jmp 0x5742d8
call fcn.0057414e
jmp 0x5742d8
cmp byte [ebp + 0x73], 0
jne 0x5742a4
call fcn.00574186
and eax, 4
jmp 0x5742d8
cmp dword [ebp + 0x7c], 0xa
je 0x5742d0
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x5742d8
call fcn.00574186
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x57d7da
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x18], eax
jae 0x57d8fb
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jae 0x57d8df
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 0xc], edi
shr edi, 2
and edi, esi
mov dword [ebp - 4], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 0xc]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp - 4]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 0xc]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 8
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov esi, 0xffc03fc0
jne 0x57d831
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x18]
mov dword [ebp + 0xc], edx
jb 0x57d80f
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret
Function at 0x580744
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x58090a
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x106fb60]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x58090a
test cl, 0x48
je 0x5807aa
mov al, byte [eax + 5]
cmp al, 0xa
je 0x5807aa
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5807fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x5807e4
call fcn.00583f67
mov dword [eax], 9
call fcn.00583f70
mov dword [eax], esi
jmp 0x5807f4
cmp eax, 0x6d
je 0x58090a
push eax
call fcn.00583f79
pop ecx
or eax, 0xffffffff
jmp 0x58090c
mov eax, dword [edi]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x580905
test edx, edx
je 0x58081f
cmp byte [ebx], 0xa
jne 0x58081f
or al, 4
jmp 0x580821
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x5808ff
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x5808ef
cmp al, 0xd
je 0x580855
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x5808e1
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x58086f
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x58086a
add dword [ebp + 0x10], 2
jmp 0x5808c3
mov dword [ebp + 0x10], eax
jmp 0x5808dd
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x580897
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5808dd
cmp dword [ebp - 0xc], 0
je 0x5808dd
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x5808b8
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x5808c3
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x5808e0
cmp ebx, dword [ebp + 0xc]
jne 0x5808c8
cmp byte [ebp - 1], 0xa
jne 0x5808c8
mov byte [ebx], 0xa
jmp 0x5808e0
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00586e0b
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x5808e1
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x580839
jmp 0x5808ff
mov eax, dword [edi]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x5808ff
or al, 2
mov byte [esi], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x58090c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5809bc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x5ca59c]
xor eax, dword [ebp + 4]
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
jne 0x5809e5
xor eax, eax
jmp 0x580b53
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x106fb60]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x580a18
push 2
push edi
push edi
push dword [ebp + 8]
call fcn.00587446
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x580aea
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
jbe 0x580b25
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x420]
mov dword [ebp - 0xc], edi
cmp ecx, dword [ebp + 0x10]
jae 0x580a73
mov edx, dword [ebp - 0x10]
inc dword [ebp - 0x10]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x580a64
inc dword [ebp - 0x18]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0xc]
mov byte [eax], dl
inc eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x400
jl 0x580a47
mov edi, eax
lea eax, [ebp - 0x420]
sub edi, eax
push 0
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x580ab3
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x14], eax
cmp eax, edi
jl 0x580abc
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x580a38
jmp 0x580abe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
xor edi, edi
mov eax, dword [ebp - 0x14]
cmp eax, edi
jne 0x580b4e
cmp dword [ebp - 8], edi
je 0x580b25
push 5
pop esi
cmp dword [ebp - 8], esi
jne 0x580b17
call fcn.00583f67
mov dword [eax], 9
call fcn.00583f70
mov dword [eax], esi
jmp 0x580b20
push edi
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x580b0c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
jmp 0x580abe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x580abe
push dword [ebp - 8]
call fcn.00583f79
pop ecx
or eax, 0xffffffff
jmp 0x580b51
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x580b3a
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x580b3a
xor eax, eax
jmp 0x580b51
call fcn.00583f67
mov dword [eax], 0x1c
call fcn.00583f70
mov dword [eax], edi
jmp 0x580b20
sub eax, dword [ebp - 0x18]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
call fcn.005824ab
leave
ret
Function at 0x58150e
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x58152a
call fcn.00583f67
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x58159c
push esi
push 0x88
push 1
call fcn.005824b9
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x581582
push esi
call fcn.00582a34
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x58146e
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x58157a
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x581599
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00580342
test ebx, ebx
pop ecx
je 0x581594
push ebx
call fcn.00583f79
pop ecx
or eax, 0xffffffff
jmp 0x58159b
mov eax, edi
pop esi
pop edi
pop ebx
ret