joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cc4a0
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0xc
push esi
lea ecx, [esp + 0xc]
push ecx
push 1
lea eax, [edi + 0x17906]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push fcn.00472210
push 0
push str.SELECT_tname_cname_tsegno__t_t_t__FROM____systable_____syscolumn___t_t_t__WHERE_tsegno__segno_AND_domainname___
mov dword [esp + 0x24], 0
call fcn.0050dfb0
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x4cc5b7
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x4cc5a4
movzx eax, word [ecx]
cmp ax, word [ecx + 2]
jne 0x4cc4fe
xor edx, edx
jmp 0x4cc503
movsx edx, ax
add edx, ecx
movzx eax, word [ecx + 4]
cmp ax, word [ecx + 6]
jne 0x4cc511
xor eax, eax
jmp 0x4cc514
cwde
add eax, ecx
mov ecx, dword [eax]
push 0
push 2
push edx
push 0
push 0xffffffffffffffff
push ecx
push edi
call fcn.00484330
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x4cc5b7
mov edx, dword [esp + 4]
movzx esi, word [edx + 2]
cmp si, word [edx + 4]
jne 0x4cc545
xor ecx, ecx
jmp 0x4cc54a
movsx ecx, si
add ecx, edx
movzx eax, word [edx]
cmp ax, si
jne 0x4cc556
xor eax, eax
jmp 0x4cc559
cwde
add eax, edx
push 0
push 0
push ecx
push eax
push 0x76
push edi
call fcn.004cbb40
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x4cc5b7
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
push eax
call fcn.00490540
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4cc5b7
push edi
call fcn.00484470
mov esi, eax
add esp, 4
test esi, esi
jne 0x4cc5b7
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x4cc4f1
mov ecx, dword [esp + 8]
push ecx
call fcn.0050dec0
mov esi, eax
add esp, 4
test esi, esi
je 0x4cc5de
mov eax, dword [esp + 8]
test eax, eax
je 0x4cc5c8
push eax
call fcn.0050dec0
add esp, 4
push 0xbb9
push 0
call fcn.00406f10
add esp, 8
mov eax, esi
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x4db1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x18
mov ecx, dword [esp + 0x1c]
movzx eax, word [ecx + 0x26]
xor edx, edx
mov dword [esp + 4], edx
mov byte [esp + 2], dl
cmp ax, dx
je 0x4db1ca
movzx eax, ax
mov dword [esp + 4], eax
movzx eax, ax
mov dword [esp + 0xc], eax
jmp 0x4db1d2
mov dword [esp + 0xc], 0x3800
cmp dword [ecx + 0x18], edx
mov eax, dword [ecx + 0x14]
push ebx
push ebp
push edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
jle 0x4db30a
lea esp, [esp]
movzx ebx, word [eax + 4]
mov edi, dword [eax]
mov edx, ebx
and edx, dword [esp + 0x18]
mov byte [esp + 0xf], 0
mov dword [esp + 0x20], ebx
test dx, dx
je 0x4db2ea
mov byte [esp + 0xe], 1
mov byte [esp + 0xd], 0
cmp edi, 0x7fffffff
jbe 0x4db22b
sub edi, 0x7fffffff
mov byte [esp + 0xf], 1
mov ebp, dword [esp + 0x2c]
test ebp, ebp
jle 0x4db30a
mov eax, dword [esp + 0x30]
add eax, 7
mov edi, edi
cmp dword [eax - 7], edi
jne 0x4db2cf
cmp word [esp + 0x10], 0
je 0x4db271
cmp byte [esp + 0xf], 0
je 0x4db271
movzx edx, word [eax - 3]
movzx ecx, dl
and cl, 3
and bl, 3
cmp cl, bl
mov ebx, dword [esp + 0x20]
sbb ecx, ecx
neg ecx
jmp 0x4db284
movzx edx, word [eax - 3]
mov cl, dl
xor cl, bl
test cl, 3
mov ecx, 0
setne cl
test ecx, ecx
jne 0x4db2cf
mov ecx, dword [esp + 0x10]
mov byte [esp + 0xd], 1
test cx, cx
je 0x4db29b
or word [eax], cx
jmp 0x4db2cf
cmp byte [eax - 1], 8
jne 0x4db2cf
test dl, 8
jne 0x4db2cf
test ebx, 0x800
je 0x4db2bf
mov edx, 0x800
or word [eax], dx
mov byte [eax - 1], 2
inc dword [esi + 4]
jmp 0x4db2cf
mov ecx, ebx
and ecx, 0x3000
je 0x4db2cf
or word [eax], cx
inc dword [esi + 8]
add eax, 9
sub ebp, 1
jne 0x4db240
cmp byte [esp + 0xd], 0
mov eax, dword [esp + 0x14]
je 0x4db30a
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
inc edx
add eax, 9
cmp edx, dword [ecx + 0x18]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
jl 0x4db1f0
cmp byte [esp + 0xe], 0
jne 0x4db346
movzx edx, word [eax + 4]
mov ecx, dword [esp + 0x2c]
mov eax, dword [eax]
push ecx
movsx ecx, byte [esp + 0x11]
push edx
movsx edx, byte [esp + 0x16]
push eax
push ecx
push edx
push str.assem_retinfo
push 0x2369
push 0x961
call fcn.00406f10
add esp, 0x20
pop edi
pop ebp
mov eax, 0x961
pop ebx
add esp, 0x18
ret
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x4db350
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
movzx eax, byte [edx + 0x25]
mov ecx, dword [eax*4 + 0x6b2348]
mov eax, dword [edx + 0x18]
push ebx
push ebp
push esi
mov esi, dword [edx + 0x14]
push edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4db516
mov bl, byte [esp + 0x11]
jmp 0x4db390
mov edi, 0xf70
mov ebp, 0x4000
mov dword [esp + 0x18], ebp
test word [esi + 4], di
jne 0x4db506
movzx edx, byte [edx + 0x25]
mov edi, dword [esi]
mov eax, dword [edx*4 + 0x6b2340]
test ecx, ecx
je 0x4db4f6
lea ecx, [ecx]
mov edx, dword [eax]
test edx, edx
je 0x4db4f6
cmp edx, edi
jne 0x4db3e1
movzx edx, word [eax + 4]
mov ebp, dword [0x6d4a74]
cmp edx, dword [ebp + 0x2e]
je 0x4db3ee
mov ebp, dword [esp + 0x18]
dec ecx
add eax, 0xd
test ecx, ecx
jne 0x4db3c0
jmp 0x4db4f6
mov ecx, dword [0x6d3998]
mov dword [eax + 6], ecx
mov dl, byte [esi + 6]
movzx ecx, dl
sub ecx, 1
je 0x4db42e
sub ecx, 1
je 0x4db420
sub ecx, 6
jne 0x4db439
mov cl, byte [eax + 0xb]
mov al, byte [eax + 0xa]
mov bl, al
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], al
or bl, cl
jmp 0x4db435
mov cl, byte [eax + 0xa]
mov bl, byte [eax + 0xb]
mov byte [esp + 0x12], cl
or bl, cl
jmp 0x4db435
mov bl, byte [eax + 0xc]
mov byte [esp + 0x12], bl
mov byte [esp + 0x11], bl
movzx eax, word [esi + 4]
mov ecx, eax
and ecx, 3
cmp cx, 1
jne 0x4db44d
and bl, 0x14
jmp 0x4db450
and bl, 0x15
movzx di, bl
movzx edi, di
cmp dl, 1
je 0x4db477
test di, di
je 0x4db477
mov eax, dword [esp + 0x28]
cmp word [eax + 0x1e], 0
je 0x4db533
mov ebp, 0x4000
jmp 0x4db4f2
cmp cx, 1
jne 0x4db4c7
test byte [esp + 0x12], 0x2a
jne 0x4db4e1
cmp dl, 8
jne 0x4db4ee
mov dl, byte [esp + 0x13]
cmp cx, 3
ja 0x4db498
test dl, 0x20
jne 0x4db4ae
cmp cx, 2
ja 0x4db4a3
test dl, 0x28
jne 0x4db4ae
cmp cx, 1
jne 0x4db4ee
test dl, 2
je 0x4db4ee
mov edx, dword [esp + 0x28]
or eax, 0x800
mov byte [esi + 6], 2
mov word [esi + 4], ax
mov byte [edx + 0x1c], 1
xor ebp, ebp
jmp 0x4db4f2
cmp cx, 2
jne 0x4db4d4
test byte [esp + 0x12], 0x28
jmp 0x4db482
cmp cx, 3
jne 0x4db484
test byte [esp + 0x12], 0x20
je 0x4db484
or eax, 0x400
mov word [esi + 4], ax
xor ebp, ebp
jmp 0x4db4f2
mov ebp, dword [esp + 0x18]
mov bl, byte [esp + 0x11]
or dword [esp + 0x14], ebp
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
dec eax
add esi, 9
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x4db390
test dword [esp + 0x14], 0x4000
je 0x4db54c
pop edi
pop esi
mov eax, 0x4000
pop ebp
mov word [edx + 0x26], ax
xor eax, eax
pop ebx
add esp, 0x14
ret
mov ecx, 0x100
pop edi
mov word [eax + 0x26], cx
mov edx, ecx
or word [esi + 4], dx
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
pop edi
pop esi
xor ecx, ecx
pop ebp
mov word [edx + 0x26], cx
xor eax, eax
pop ebx
add esp, 0x14
ret
Function at 0x508dd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [str.public]
cmp dword [eax + 0x124], 1
mov eax, dword [esp + 8]
lea edx, [eax + 0x24]
je 0x508de8
lea edx, [eax + 0x28]
movsx ecx, word [eax + 0x20]
movsx eax, word [eax + 0x22]
push esi
mov esi, dword [esp + 8]
shr eax, 2
lea ecx, [ecx + esi + 0x24]
test eax, eax
jle 0x508e0f
mov esi, dword [edx]
xor dword [ecx], esi
dec eax
add edx, 4
add ecx, 4
test eax, eax
jg 0x508e00
xor eax, eax
pop esi
ret

Function at 0x508e90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x18]
push ebx
mov ebx, dword [eax + 0x14]
push esi
push edi
mov edi, dword [esp + 0x1c]
mov byte [esp + 0xf], 1
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ecx
cmp edi, eax
je 0x508ed0
mov edx, dword [str.public]
mov ecx, dword [edx + 0x13b]
push ecx
push eax
push edi
call sub.MSVCR90.dll_memcpy
add esp, 0xc
lea esp, [esp]
cmp byte [esp + 0xf], 0
jne 0x508ee0
cmp bl, 1
je 0x508ffd
lea edx, [esp + 0x20]
push edx
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0
mov byte [esp + 0x23], 0
call fcn.00507eb0
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x508fde
mov ecx, dword [esp + 0x20]
add ecx, 8
push ecx
push edi
call fcn.00576f50
add esp, 8
test eax, eax
jne 0x509046
mov edx, dword [edi + 8]
mov eax, dword [esp + 0x20]
cmp edx, dword [eax + 0x10]
jne 0x509046
movsx ecx, byte [eax]
add ecx, 0xfffffffb
cmp ecx, 7
ja case.0x508f3f.7
jmp dword [ecx*4 + 0x509068]
mov ecx, dword [str.public]
cmp dword [ecx + 0x124], 1
lea esi, [eax + 0x24]
je 0x508f5b
lea esi, [eax + 0x28]
movsx ecx, word [eax + 0x22]
movsx edx, word [eax + 0x20]
shr ecx, 2
lea edx, [edx + edi + 0x24]
test ecx, ecx
jle 0x508fb0
mov edi, edi
mov eax, dword [esi]
xor dword [edx], eax
dec ecx
add esi, 4
add edx, 4
test ecx, ecx
jg 0x508f70
jmp 0x508fac
movsx esi, word [eax + 0x26]
movsx edx, word [eax + 0x20]
movsx ecx, word [eax + 0x22]
movsx eax, word [eax + 0x24]
lea edx, [edx + edi + 0x24]
neg esi
push esi
push eax
add ecx, edx
push ecx
push edx
push edi
call fcn.005088a0
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x508fcf
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x1c]
mov dword [edi + 0x1c], ecx
mov ebx, dword [eax + 0x14]
mov dword [esp + 0x10], ebx
mov eax, dword [eax + 0x18]
mov dword [esp + 0x14], eax
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], eax
jmp 0x508ed0
push 0x3346
push 0
call fcn.00406f10
add esp, 8
push 0x33c2
push 0
call fcn.00406f10
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret
cmp byte [esp + 0x28], 0
je 0x509006
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov ecx, str.cbvlog_2
push ecx
mov eax, 0x1b
push 0x33c2
push eax
call fcn.00406f10
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov ecx, str.cbvlog_3
push ecx
mov eax, 0x1b
push 0x33c2
push eax
call fcn.00406f10
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x20]
push ecx
mov eax, 0xe74
push 0x33c2
push eax
call fcn.00406f10
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x515950
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x65ada4]
xor eax, esp
mov dword [esp + 0x48], eax
mov ecx, dword [ebx + 0x59]
mov eax, dword [esp + 0x50]
push ebp
push esi
push edi
push ecx
push 4
lea edx, [esp + 0x14]
push 1
push edx
mov dword [esp + 0x20], eax
xor edi, edi
xor esi, esi
call dword [sym.imp.MSVCR90.dll_fread]
mov ebp, eax
mov eax, dword [esp + 0x1c]
add esp, 0x10
cmp ebp, 4
jl 0x5159b0
cmp eax, dword [0x5b06ec]
jne 0x51599e
lea edi, [esi + 4]
lea esi, [edi + 6]
jmp 0x5159f7
cmp eax, dword [0x5b06f4]
jne 0x5159b0
mov edi, 4
lea esi, [edi + 7]
jmp 0x5159f7
cmp ebp, 3
jl 0x5159cf
cmp al, 0xef
jne 0x5159cf
cmp ah, 0xbb
jne 0x5159cf
cmp byte [esp + 0xe], 0xbf
jne 0x5159cf
mov edi, 3
lea esi, [edi + 2]
jmp 0x5159f7
cmp ebp, 2
jl 0x5159f7
cmp al, 0xff
jne 0x5159e4
cmp ah, 0xfe
jne 0x5159f7
mov esi, 8
jmp 0x5159f2
cmp al, 0xfe
jne 0x5159f7
cmp ah, 0xff
jne 0x5159f7
mov esi, 9
mov edi, 2
mov eax, dword [ebx + 0x59]
push 0
push edi
push eax
call dword [sym.imp.MSVCR90.dll_fseek]
mov edi, dword [esp + 0x1c]
add esp, 0xc
test esi, esi
jne 0x515a97
cmp dword [edi + 0x230], 1
jne 0x515a3c
push esi
push 0x25e8
call fcn.00406f10
add esp, 8
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00586584
add esp, 0x4c
ret
cmp dword [edi + 0x228], 0
jne 0x515b9c
cmp ebp, 4
mov eax, dword [esp + 0xc]
jl 0x515a76
test al, al
jne 0x515a61
test ah, ah
jne 0x515a61
mov esi, 0xb
jmp 0x515a97
cmp byte [esp + 0xe], 0
jne 0x515a76
cmp byte [esp + 0xf], 0
jne 0x515a76
mov esi, 0xa
jmp 0x515a97
cmp ebp, 2
jl 0x515b7d
test al, al
jne 0x515a8a
mov esi, 9
jmp 0x515a97
test ah, ah
jne 0x515b7d
mov esi, 8
mov ecx, dword [0x6b283c]
mov cl, byte [ecx + 0x10]
test cl, cl
jne 0x515af7
mov eax, dword [edi + 0x228]
test eax, eax
je 0x515af7
cmp eax, esi
je 0x515af7
push eax
call fcn.0056d930
add esp, 4
lea edx, [esp + 0x14]
nop
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x515ac0
push esi
call fcn.0056d930
push eax
lea edx, [esp + 0x1c]
push edx
push 0
push 0x25e9
call fcn.00406f10
add esp, 0x14
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00586584
add esp, 0x4c
ret
cmp dword [edi + 0x228], 0
je 0x515b04
test cl, cl
je 0x515b7d
mov ecx, dword [edi + 0x22c]
lea eax, [edi + 0x234]
push eax
push ecx
push esi
mov dword [edi + 0x228], esi
call fcn.0056e6e0
add esp, 0xc
mov dword [edi + 0x274], eax
cmp eax, 0xffffffff
jne 0x515b7d
mov edx, dword [edi + 0x228]
push edx
call fcn.0056d930
add esp, 4
lea edx, [esp + 0x14]
nop
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x515b40
mov eax, dword [edi + 0x22c]
push eax
call fcn.0056d930
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x25e7
call fcn.00406f10
add esp, 0x14
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00586584
add esp, 0x4c
ret
cmp dword [edi + 0x228], 0
jne 0x515b9c
mov edx, dword [edi + 0x22c]
mov dword [edi + 0x228], edx
mov dword [edi + 0x274], 1
call fcn.00514df0
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.00586584
add esp, 0x4c
ret
Function at 0x523ed0
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x90
mov eax, dword [0x65ada4]
xor eax, esp
mov dword [esp + 0x8c], eax
cmp byte [esp + 0x98], 3
mov eax, dword [esp + 0x94]
push esi
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], eax
push 1
jne 0x523fa5
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push fcn.00472210
push 0
push str.select__select_tname_from____systable__where_segno__sc.tsegno_____from____sysdomain__sd_____syscolumn__sc____where_sc.domainname__sd.name_and_sd.name___
call fcn.0050dfb0
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x523fc1
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x523f5a
movzx eax, word [ecx]
cmp ax, word [ecx + 2]
jne 0x523f42
xor eax, eax
jmp 0x523f45
cwde
add eax, ecx
lea edx, [esp + 0x10]
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x523f50
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0050dec0
add esp, 4
cmp dword [esp + 8], 0
je 0x523fe8
mov eax, dword [esp + 4]
lea edx, [esp + 0x10]
push edx
push eax
push 0x7dd
push 0x1f70
call fcn.00406f10
add esp, 0x10
mov eax, 0x1f70
pop esi
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.00586584
add esp, 0x90
ret
push 0
push fcn.004b5dc0
push 0
push str.INSERT_INTO____sysconstraint______segno__constraintname__attributes__constrainttext_cpos_____SELECT__tsegno______tsegno_CAST_CHAR_______cpos_CAST_CHAR_______constraintname_____CONSTRAINT__uniqueness_constraintnames______CHECK_VALUE_NOT_IN____SELECT_constraintname_FROM____sysdomain___UNION_ALL_t__t_t______SELECT_constraintname_FROM____sysconstraint__________attributes__constrainttext__cpos____FROM____sysdomain__sd_____syscolumn__sc____WHERE_constraintname__NULL_AND_sc.domainname__sd.name_AND_sd.name___
call fcn.0050df80
mov esi, eax
add esp, 0x18
test esi, esi
je 0x523fe8
push 0x7dd
push 0
call fcn.00406f10
add esp, 8
mov eax, esi
pop esi
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.00586584
add esp, 0x90
ret
mov ecx, dword [esp + 0x90]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00586584
add esp, 0x90
ret
Function at 0x55afc0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x55afdd
push 0x3e9f
push 2
call fcn.00406f10
add esp, 8
mov eax, 2
ret
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
movzx edx, word [ecx + 4]
mov word [eax + 4], dx
movzx ecx, byte [ecx + 6]
mov byte [eax + 6], cl
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
mov dword [eax + 7], edx
movzx edx, word [ecx + 4]
mov word [eax + 0xb], dx
movzx ecx, byte [ecx + 6]
mov edx, dword [esp + 0x10]
mov byte [eax + 0xd], cl
mov ecx, dword [esp + 0x14]
mov dword [eax + 0xe], edx
mov edx, dword [ecx]
mov dword [eax + 0x12], edx
movzx edx, word [ecx + 4]
mov word [eax + 0x16], dx
movzx ecx, byte [ecx + 6]
mov byte [eax + 0x18], cl
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov dword [eax + 0x19], edx
movzx edx, word [ecx + 4]
mov word [eax + 0x1d], dx
movzx ecx, byte [ecx + 6]
mov edx, dword [esp + 0x1c]
mov byte [eax + 0x1f], cl
or ecx, 0xffffffff
mov dword [eax + 0x20], edx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x24], ecx
xor eax, eax
ret
Function at 0x564d20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [0x65ada4]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x408]
push ebx
mov ebx, dword [sym.imp.MSVCR90.dll_fopen]
push esi
push edi
push 0x5a8460
push eax
mov esi, ecx
call ebx
mov edi, eax
add esp, 8
test edi, edi
jne 0x564d72
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00586584
add esp, 0x404
ret
push ebp
push 0x5a845c
push esi
call ebx
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x564e0e
mov ebx, dword [sym.imp.MSVCR90.dll_fread]
push edi
push 0x400
lea eax, [esp + 0x18]
push 1
push eax
call ebx
mov esi, eax
add esp, 0x10
test esi, esi
jbe 0x564dd4
push ebp
push esi
lea ecx, [esp + 0x18]
push 1
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x564e0e
push edi
push 0x400
lea edx, [esp + 0x18]
push 1
push edx
call ebx
mov esi, eax
add esp, 0x10
test esi, esi
ja 0x564da6
mov esi, dword [sym.imp.MSVCR90.dll_fclose]
push edi
call esi
add esp, 4
cmp eax, 0xffffffff
je 0x564e1a
push ebp
call esi
add esp, 4
cmp eax, 0xffffffff
je 0x564e24
mov eax, 1
mov ecx, dword [esp + 0x410]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00586584
add esp, 0x404
ret
mov esi, dword [sym.imp.MSVCR90.dll_fclose]
push edi
call esi
add esp, 4
test ebp, ebp
je 0x564e24
push ebp
call esi
add esp, 4
xor eax, eax
jmp 0x564df5

Function at 0x564ee0
Capabilities:
Move file

Disassembly:
sub esp, 0x204
mov eax, dword [0x65ada4]
xor eax, esp
mov dword [esp + 0x200], eax
lea edx, [esp]
mov eax, esi
sub edx, esi
jmp 0x564f00
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x564f00
push edi
push 0x5b192c
lea eax, [esp + 8]
push str.save._s
push eax
call fcn.0056af80
mov edi, dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 4
push eax
call edi
push esi
lea ecx, [esp + 0x14]
call fcn.00564d20
add esp, 0x10
test eax, eax
jne 0x564f5d
push esi
call fcn.00564e30
add esp, 4
xor eax, eax
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.00586584
add esp, 0x204
ret
cmp eax, 1
jne 0x564fe9
lea edx, [esp + 0x104]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x564f71
push 0x5b1928
lea ecx, [esp + 0x108]
push str.save._s
push ecx
call fcn.0056af80
add esp, 4
push eax
call edi
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x14]
push eax
call sub.MSVCR90.dll_rename
add esp, 0x14
test eax, eax
je 0x564fe9
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x104]
push ecx
lea edx, [esp + 8]
push edx
call sub.MSVCR90.dll_rename
add esp, 8
neg eax
sbb eax, eax
inc eax
pop edi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.00586584
add esp, 0x204
ret
mov ecx, dword [esp + 0x204]
pop edi
xor ecx, esp
mov eax, 1
call fcn.00586584
add esp, 0x204
ret
Function at 0x569510
Capabilities:
Move file

Disassembly:
sub esp, 0x320
mov eax, dword [0x65ada4]
xor eax, esp
mov dword [esp + 0x31c], eax
push ebx
xor ebx, ebx
cmp dword [0x6bb044], ebx
je 0x569547
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x31c]
xor ecx, esp
call fcn.00586584
add esp, 0x320
ret
push 1
call fcn.0056a810
add esp, 4
cmp eax, ebx
jne 0x5696d8
push ebp
push esi
push edi
lea eax, [esp + 0x20]
push eax
push str.dblist.ini
push ebx
mov dword [0x6bb044], 1
call fcn.0056b750
lea ecx, [esp + 0x2c]
push ecx
lea esi, [esp + 0x24]
call fcn.00564be0
lea edx, [esp + 0x30]
push edx
push 1
lea eax, [esp + 0x2b]
push eax
push 0x5a8a1a
push str.test
push str.test
call fcn.0056c9c0
add esp, 0x28
test eax, eax
jne 0x56969f
call fcn.005673d0
test eax, eax
jne 0x56969f
push ebx
push ebx
push 1
push ebx
lea edx, [esp + 0x30]
xor ecx, ecx
call fcn.005650b0
mov edi, eax
add esp, 0x10
cmp edi, ebx
jne 0x569690
xor ebp, ebp
cmp dword [0x6ba844], ebx
jle 0x569628
xor esi, esi
mov ecx, dword [0x6ba84c]
push ebx
lea eax, [esi + ecx]
push ebx
push 1
push eax
lea edx, [esp + 0x30]
xor ecx, ecx
mov dword [eax + 0x63b], ebx
mov dword [eax + 0x63f], ebx
mov dword [eax + 0x64f], ebx
call fcn.005650b0
mov edi, eax
add esp, 0x10
cmp edi, ebx
jne 0x569690
inc ebp
add esi, 0x7ed
cmp ebp, dword [0x6ba844]
jl 0x5695e5
lea eax, [esp + 0x124]
push eax
push str.f.db
push ebx
call fcn.0056b750
lea ecx, [esp + 0x130]
push ecx
lea edx, [esp + 0x238]
push str._s__
push edx
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x240]
push eax
lea ecx, [esp + 0x140]
push ecx
call sub.MSVCR90.dll_rename
lea edx, [esp + 0x144]
push edx
push str.f.bak
push ebx
call fcn.0056b750
lea eax, [esp + 0x150]
push eax
call sub.MSVCR90.dll__unlink
add esp, 0x30
jmp 0x5696d3
lea edx, [esp + 0x20]
push edx
call sub.MSVCR90.dll__unlink
add esp, 4
jmp 0x5696ae
lea ecx, [esp + 0x20]
call fcn.00569300
mov edi, eax
cmp edi, ebx
je 0x5696c6
push ebx
lea esi, [esp + 0x18]
call fcn.00564be0
push 1
call fcn.0056a630
add esp, 8
mov eax, edi
jmp 0x5696d5
push ebx
lea esi, [esp + 0x18]
call fcn.00564be0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x320]
pop ebx
xor ecx, esp
call fcn.00586584
add esp, 0x320
ret
Function at 0x56c1e0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push 0x44
xor esi, esi
lea eax, [esp + 0x18]
push esi
push eax
call sub.MSVCR90.dll_memset
mov ecx, 3
xor edx, edx
add esp, 0xc
mov dword [esp + 0x14], 0x44
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x40], 1
mov word [esp + 0x44], cx
mov word [esp + 0x46], dx
mov dword [esp + 0x48], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x18]
push edx
push esi
push esi
push 0x20
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x56c252
or eax, 0xffffffff
pop esi
add esp, 0x54
ret
mov eax, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov eax, dword [esp + 0xc]
pop esi
add esp, 0x54
ret

Function at 0x56c440
Capabilities:
Query environment variable

Disassembly:
jmp 0x574ac0
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.MSVCR90.dll__stricmp]
push esi
push str.TEMP
call edi
add esp, 8
test eax, eax
je 0x574b19
push esi
push 0x5a9968
call edi
add esp, 8
test eax, eax
je 0x574b19
push esi
push str.TMPDIR
call edi
add esp, 8
test eax, eax
je 0x574b19
push esi
push str.DEMO_LICENSEFILE
call edi
add esp, 8
test eax, eax
je 0x574b19
push str.TBWIN
push esi
call fcn.00574460
add esp, 8
pop edi
pop esi
ret
push esi
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
pop edi
pop esi
ret

Function at 0x56c5b0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x56c5d0
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ecx
push ebx
lea eax, [esp + 4]
push eax
push 0x28
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x56c60f
mov ecx, dword [esp + 4]
push 1
push str.SeDebugPrivilege
push ecx
call fcn.0056c350
add esp, 0xc
test eax, eax
jne 0x56c617
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xd
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
push esi
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x56c637
lea eax, [esi + 0xd]
pop esi
pop ebx
pop ecx
ret
mov ecx, dword [esp + 8]
push 0
push str.SeDebugPrivilege
push ecx
call fcn.0056c350
add esp, 0xc
push 4
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x56c65b
lea ebx, [eax + 0xd]
mov edx, dword [esp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
push esi
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret