joyce8/EMBER2024-capa huggingface dataset:
Function at 0x566900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x566b3d
sub esp, 0x54
mov eax, dword [esp + 0x60]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
cmp edx, 2
jl 0x566b0d
movzx ebx, byte [ecx]
shl ebx, 8
movzx ebp, byte [ecx + 1]
or ebx, ebp
add edx, 0xfffffffe
cmp ebx, edx
jne 0x566add
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x50], ecx
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
lea edx, [0x64dea0]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0040a3f0
mov eax, dword [esp + 0x40]
add eax, 0xfffffffe
mov ecx, eax
neg eax
sar eax, 0x1f
and eax, 2
mov edx, dword [esp + 0x50]
add eax, edx
mov edx, dword [esp + 0xc]
movzx ebx, byte [esp + 0x14]
mov ebp, dword [esp + 0x10]
test bl, bl
je 0x566a92
mov dword [esp + 0x38], edx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ebp
mov ebx, dword [esp + 0x58]
mov esi, dword [ebx]
mov ebx, dword [ebx + 4]
test esi, esi
je 0x566a81
mov dword [esp + 0x44], ebx
mov dword [esp + 0x34], esi
lea eax, [0x64d080]
mov dword [esp], eax
call fcn.0040c800
mov eax, dword [esp + 4]
mov dword [eax], 0x30
mov ecx, dword [esp + 0x38]
mov ecx, dword [ecx + 0x10]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x14], edx
lea edx, [0x633140]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x30]
test eax, eax
je 0x566a61
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ebp
add esp, 0x54
ret
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
add esp, 0x54
ret
mov esi, dword [0x7ccc40]
mov ebx, dword [0x7ccc44]
jmp 0x5669bf
lea eax, [0x64d2c0]
mov dword [esp], eax
call fcn.0040c800
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x40
lea ecx, [0x68b978]
mov dword [eax], ecx
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
lea ecx, [0x6cadb0]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
add esp, 0x54
ret
mov eax, dword [0x7ccc78]
mov ecx, dword [0x7ccc7c]
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
mov eax, dword [0x7ccc78]
mov ecx, dword [0x7ccc7c]
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
call fcn.0045b380
jmp fcn.00566900
Function at 0x566eb0
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x566fb5
sub esp, 0x28
lea eax, [0x65d240]
mov dword [esp], eax
call fcn.0040c800
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
nop
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
mov ecx, dword [esp + 0x30]
test ecx, ecx
jle 0x566f6d
mov edx, dword [esp + 0x2c]
xor ebx, ebx
jmp 0x566f34
mov ebp, dword [esp + 0x20]
lea edx, [ebp + 0xc]
mov ebx, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ebx
lea ecx, [0x6cd7a0]
test byte [ecx], al
mov ebp, dword [edx]
mov esi, dword [edx + 4]
mov edi, dword [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov dword [esp + 0xc], edi
call fcn.005243c0
mov eax, dword [esp + 0x1c]
inc eax
mov ecx, dword [esp + 0x30]
cmp ecx, eax
jg 0x566f27
lea eax, [0x6cd7a0]
test byte [eax], al
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.005245c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
add esp, 0x28
ret
call fcn.0045b380
jmp fcn.00566eb0
Function at 0x566fc0
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56715f
sub esp, 0x2c
lea eax, [0x643900]
mov dword [esp], eax
mov dword [esp + 4], 0x24
mov dword [esp + 8], 0x24
call fcn.00444130
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
nop
lea ecx, [0x65d0c0]
mov dword [esp], ecx
call fcn.0040c800
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
nop
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov ecx, dword [esp + 0x34]
test ecx, ecx
jle 0x56709d
mov edx, dword [esp + 0x30]
xor ebx, ebx
jmp 0x567064
mov ebp, dword [esp + 0x20]
lea edx, [ebp + 0xc]
mov ebx, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ebx
lea ecx, [0x6cd760]
test byte [ecx], al
mov ebp, dword [edx]
mov esi, dword [edx + 4]
mov edi, dword [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov dword [esp + 0xc], edi
call fcn.0052ab90
mov eax, dword [esp + 0x1c]
inc eax
mov ecx, dword [esp + 0x34]
cmp eax, ecx
jl 0x567057
lea eax, [0x6cd760]
test byte [eax], al
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.0052ad90
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp ecx, 0x24
jge 0x567155
mov edx, dword [esp + 0x28]
cmp edx, eax
je 0x5670ee
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0045d2c0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
call fcn.00566eb0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
cmp ecx, 0x14
jge 0x56714e
mov edx, dword [esp + 0x28]
lea ebx, [edx + 0x10]
cmp eax, ebx
je 0x567132
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0045d2c0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 0x24
mov dword [esp + 0x44], 0x24
add esp, 0x2c
ret
mov ecx, 0x14
jmp 0x567117
mov ecx, 0x24
jmp 0x5670d6
call fcn.0045b380
jmp fcn.00566fc0
Function at 0x569e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56a017
sub esp, 0x40
lea eax, [0x643900]
mov dword [esp], eax
mov dword [esp + 4], 0
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x68]
lea ebx, [edx + ecx]
mov dword [esp + 0x30], ebx
mov dword [esp + 8], ebx
call fcn.00444130
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x5c]
cmp ecx, edx
jb 0x569fe4
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
mov dword [esp], eax
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
call fcn.0045d2c0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
cmp eax, ecx
ja 0x569fb1
mov edx, dword [esp + 0x38]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov eax, dword [esp + 0x5c]
add eax, edx
mov dword [esp], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 8], eax
call fcn.0045d2c0
lea eax, [0x643900]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
call fcn.00444130
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
movzx ecx, word [esp + 0x44]
mov word [esp], cx
mov ecx, dword [esp + 0x48]
mov dword [esp + 4], ecx
call fcn.00569d80
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x14], ecx
mov ecx, dword [str.master_secret]
mov ebx, dword [0x61c514]
mov ebp, dword [0x61c518]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], ecx
mov ecx, dword [edx]
call ecx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x30
mov dword [esp + 0x78], 0x30
add esp, 0x40
ret
lea edx, [0x643900]
mov dword [esp], edx
mov ebx, dword [esp + 0x38]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.004441e0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
jmp 0x569ec6
lea ebx, [0x643900]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call fcn.004441e0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x5c]
jmp 0x569e96
call fcn.0045b380
jmp fcn.00569e40
Function at 0x56abb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56ad66
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x56ad37
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x56ad4d
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
je 0x56ad12
cmp ax, 0x303
jae 0x56ac86
cmp cl, 0xe3
jne 0x56ac51
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
add esp, 0x48
ret
mov edi, esp
lea esi, [esp + 0x4c]
call fcn.0045d04e
call fcn.0056a8b0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call fcn.004d9260
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x20]
mov dword [esp], ecx
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
je 0x56abd8
jmp 0x56abe4
lea eax, [0x643700]
mov dword [esp], eax
lea eax, [0x6c7b50]
mov dword [esp + 4], eax
call fcn.00431bb0
nop
call fcn.0045b380
jmp fcn.0056abb0
Function at 0x586dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x586e77
sub esp, 0xc
lea eax, [0x645ea0]
mov dword [esp], eax
call fcn.0040c800
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00586d10
mov eax, dword [esp + 8]
xor ecx, ecx
jmp 0x586e42
mov esi, ebx
shl ebx, 0xa
lea edi, [eax + ebx]
mov dword [edi + ecx*4], ebp
lea ebx, [esi + 1]
mov edx, ebp
cmp ebx, 8
jge 0x586e41
mov ebp, edx
and edx, 0xff
shr ebp, 8
xor ebp, dword [eax + edx*4]
cmp ebx, 8
jb 0x586e17
jmp 0x586e5e
inc ecx
cmp ecx, 0x100
jge 0x586e56
jae 0x586e6a
mov edx, dword [eax + ecx*4]
mov ebx, 1
jmp 0x586e27
mov dword [esp + 0x14], eax
add esp, 0xc
ret
mov eax, ebx
mov ecx, 8
call fcn.0045c9a0
mov eax, ecx
mov ecx, 0x100
call fcn.0045c9a0
nop
call fcn.0045b380
jmp fcn.00586dd0
Function at 0x5ad570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ad7b7
sub esp, 0x34
lea eax, [0x63c800]
mov dword [esp], eax
call fcn.0040c800
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
lea ecx, [0x64a600]
mov dword [esp], ecx
call fcn.0040c800
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
call fcn.0049f7d0
lea edi, [esp + 0x20]
mov esi, esp
call fcn.0045d09e
mov eax, dword [esp + 0x38]
test byte [eax], al
lea edi, [eax + 0x78]
mov ecx, dword [0x7e34e0]
test ecx, ecx
jne 0x5ad794
lea esi, [esp + 0x20]
call fcn.0045d09e
movzx ecx, byte [eax + 0x4d]
test cl, cl
je 0x5ad77b
mov ecx, 1
test cl, cl
jne 0x5ad74f
lea edi, [eax + 0x8c]
mov ecx, dword [0x7e34e0]
test ecx, ecx
jne 0x5ad738
xor eax, eax
call fcn.0045cbbb
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0x5c]
test ecx, ecx
je 0x5ad731
mov ecx, dword [ecx]
mov edx, ecx
add ecx, 1
mov ebx, edx
sar edx, 0x1f
add ebx, 1
adc edx, 0
test edx, edx
setl bl
cmp dword [eax + 0xa4], ecx
setae cl
test edx, edx
sete dl
and edx, ecx
or ebx, edx
test bl, bl
jne 0x5ad709
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
test edx, edx
je 0x5ad695
inc dword [eax + 0x64]
mov ecx, dword [eax + 0x38]
mov dword [esp], ecx
call fcn.004615f0
mov eax, dword [esp + 0x38]
dec dword [eax + 0x64]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov ebx, dword [ecx + 4]
test edx, edx
je 0x5ad5b5
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
add esp, 0x34
ret
lea eax, [0x63c800]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00405a60
mov eax, dword [0x7e34e0]
mov ecx, dword [esp + 8]
test eax, eax
jne 0x5ad6fa
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov dword [esp], 0x10
lea ecx, [0x692774]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x10], ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x14], ebp
call fcn.0043bb40
mov eax, dword [esp + 0x38]
jmp 0x5ad663
mov edi, dword [esp + 0x1c]
mov eax, ecx
call fcn.0045c920
mov eax, edi
jmp 0x5ad6bf
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
test eax, eax
jne 0x5ad727
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
add esp, 0x34
ret
mov dword [esp], eax
call fcn.004063e0
jmp 0x5ad713
xor ecx, ecx
jmp 0x5ad62a
lea eax, [0x677480]
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.00411f70
jmp 0x5ad619
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
test eax, eax
jne 0x5ad771
mov eax, dword [0x7ccf88]
mov ecx, dword [0x7ccf8c]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x34
ret
mov dword [esp], eax
call fcn.004063e0
jmp 0x5ad759
mov dword [esp], eax
call fcn.005ab450
movzx ecx, byte [esp + 4]
xor ecx, 1
mov eax, dword [esp + 0x38]
jmp 0x5ad5f6
lea eax, [0x677480]
mov dword [esp], eax
mov dword [esp + 4], edi
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
call fcn.00411d70
mov eax, dword [esp + 0x38]
jmp 0x5ad5e5
call fcn.0045b380
jmp fcn.005ad570
Function at 0x5b15a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5b17e1
sub esp, 0x64
mov eax, dword [esp + 0x6c]
movzx ecx, byte [eax + 0xa6]
test cl, cl
jne 0x5b17c9
mov byte [eax + 0xa6], 1
mov ecx, dword [esp + 0x70]
mov edx, dword [ecx]
movzx edx, byte [edx + 2]
test dl, 1
je 0x5b17b1
mov dword [esp], ecx
call fcn.005a69d0
mov eax, dword [esp + 8]
test eax, eax
jg 0x5b1799
call fcn.0040d2e0
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x70]
mov dword [esp], ecx
call fcn.005a6900
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
test eax, eax
jle 0x5b16db
mov dword [esp + 0x28], eax
xor edx, edx
jmp 0x5b1635
mov eax, dword [esp + 0x38]
add eax, 0x14
mov edx, ecx
mov ecx, eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x24], edx
lea edi, [esp + 0x50]
mov esi, ecx
call fcn.0045d09e
lea edi, [esp + 0x3c]
lea esi, [esp + 0x50]
call fcn.0045d09e
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0057e310
mov eax, dword [esp + 0x44]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x20], ecx
lea edx, [0x66eee0]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
call fcn.004112c0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
lea ebx, [ecx + 1]
mov ebp, dword [eax]
cmp ebx, edx
ja 0x5b1748
lea edx, [ecx + 1]
mov dword [eax + 4], edx
lea edx, [ebp + ecx*8 + 4]
mov ebx, dword [esp + 0x20]
mov dword [edx], ebx
mov edx, dword [0x7e34e0]
lea edi, [ebp + ecx*8]
test edx, edx
jne 0x5b173d
mov ecx, dword [esp + 0x34]
mov dword [edi], ecx
mov ecx, dword [esp + 0x24]
inc ecx
mov edx, dword [esp + 0x28]
cmp ecx, edx
jl 0x5b162a
mov ecx, dword [0x7e34e0]
test ecx, ecx
jne 0x5b1728
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x6c]
mov dword [ecx + 0xa8], eax
nop
mov eax, dword [esp + 0x68]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.005b2490
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
add esp, 0x64
ret
mov ecx, dword [esp + 0x6c]
lea edi, [ecx + 0xa8]
mov eax, dword [esp + 0x2c]
call fcn.0045c920
jmp 0x5b16f3
mov eax, dword [esp + 0x34]
call fcn.0045c920
jmp 0x5b16ca
mov dword [esp + 0x30], eax
lea eax, [0x643700]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
call fcn.004441e0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x30]
mov dword [edi + 8], edx
mov edx, dword [0x7e34e0]
test edx, edx
jne 0x5b1792
mov dword [edi], eax
mov ebp, eax
mov eax, edi
jmp 0x5b16a6
call fcn.0045c920
jmp 0x5b1789
lea eax, [0x6cb610]
mov dword [esp + 0x74], eax
lea eax, [0x6c6ad4]
mov dword [esp + 0x78], eax
add esp, 0x64
ret
lea eax, [0x6cb610]
mov dword [esp + 0x74], eax
lea eax, [0x6c6ad0]
mov dword [esp + 0x78], eax
add esp, 0x64
ret
lea eax, [0x6cb610]
mov dword [esp + 0x74], eax
lea eax, [0x6c6acc]
mov dword [esp + 0x78], eax
add esp, 0x64
ret
call fcn.0045b380
jmp fcn.005b15a0
Function at 0x5e5650
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x5e5675
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x5e5680
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x5e5675
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x5e56c8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x5e56be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x5e56ca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x5e56b0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x7ec000
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x40
lea eax, [esp + 0x44]
lea ecx, [esp]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
push esi
mov esi, dword [esp + 0x50]
push edi
push 0
push eax
push 0x40
push ecx
push esi
call ebx
test eax, eax
je 0x7ec175
cmp dword [esp + 0x54], 0x40
jne 0x7ec175
cmp word [esp + 0x10], 0x5a4d
jne 0x7ec175
mov edx, dword [esp + 0x4c]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push edx
push esi
call ebp
cmp eax, 0xffffffff
je 0x7ec175
lea eax, [esp + 0x54]
push 0
push eax
push 0xf8
push 0x7f2960
push esi
call ebx
test eax, eax
je 0x7ec175
cmp dword [esp + 0x54], 0xf8
jne 0x7ec175
cmp dword [0x7f2960], 0x4550
jne 0x7ec175
mov eax, dword [0x7f2976]
test ah, 0x20
jne 0x7ec175
mov edx, dword [0x7f2a80]
xor eax, eax
mov ax, word [0x7f2966]
add eax, edx
lea eax, [eax + eax*4]
shl eax, 3
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [0x7f2a58], eax
je 0x7ec175
push 1
push 0
push 0
push esi
call ebp
mov dword [0x7f2a6c], eax
xor eax, eax
mov ax, word [0x7f2966]
mov edx, dword [0x7f2a58]
lea ecx, [esp + 0x54]
push 0
lea edi, [eax + eax*4]
push ecx
shl edi, 3
push edi
push edx
push esi
call ebx
test eax, eax
je 0x7ec175
cmp dword [esp + 0x54], edi
jne 0x7ec175
push 1
push 0
push 0
push esi
call ebp
mov ecx, dword [0x7f2a80]
lea ecx, [ecx + ecx*4]
lea edx, [eax + ecx*8]
mov eax, dword [0x7f29b4]
cmp edx, eax
ja 0x7ec175
mov edi, dword [0x7f2a58]
mov ecx, dword [0x7f2988]
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 0xc]
add eax, edx
cmp ecx, eax
jae 0x7ec175
xor eax, eax
push 2
mov ax, word [0x7f2966]
push 0
push 0
push esi
lea ecx, [eax + eax*4]
mov ebx, dword [edi + ecx*8 - 0x18]
lea edi, [edi + ecx*8]
call ebp
mov edx, dword [edi - 0x14]
add edx, ebx
cmp eax, edx
jne 0x7ec175
cmp dword [edi - 0x20], ebx
ja 0x7ec175
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x40
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
Function at 0x7ee769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x7f2190
cmp edx, dword [eax]
je 0x7ee78b
add eax, 8
inc ecx
cmp eax, 0x7f2220
jl 0x7ee77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x7f2190]
jne 0x7ee8b9
mov eax, dword [0x7f2bb0]
cmp eax, 1
je 0x7ee893
test eax, eax
jne 0x7ee7bc
cmp dword [0x7f20e4], 1
je 0x7ee893
cmp edx, 0xfc
je 0x7ee8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x7ee7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.007ef670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.007ef490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x7ee836
lea eax, [ebp - 0x1a4]
push eax
call fcn.007ef490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x7f145c
push edi
call fcn.007eff00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.007ef670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.007ef680
lea eax, [ebp - 0xa0]
push 0x7f143c
push eax
call fcn.007ef680
push dword [esi + 0x7f2194]
lea eax, [ebp - 0xa0]
push eax
call fcn.007ef680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.007efe75
add esp, 0x2c
pop edi
jmp 0x7ee8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x7f2194]
push 0
push eax
push dword [esi]
call fcn.007ef490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret