joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019bd9
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10019bd5
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10019bf3
movzx eax, ax
lea eax, [eax + eax*4]
add al, 0x80
add al, 0x80
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10019c51
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10019c38
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10019c41
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10019c4b
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10019c2d
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10019bb7
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10019c9e
dec eax
je 0x10019c95
sub eax, 3
je 0x10019c8c
mov dword [ebp - 4], 0x40
jmp 0x10019cbb
mov dword [ebp - 4], 4
jmp 0x10019ca1
mov dword [ebp - 4], 0x20
jmp 0x10019ca1
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10019ced
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10019c6d
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100194fe
xchg esi, eax
sbb esi, eax
sar edi, 0x75
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x10019cf9
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001c9e3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100347ee
call fcn.10031d20
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
mov dword [esi], edi
call fcn.1001bb2c
push edi
lea ecx, [esi + 0x28]
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
call fcn.1001bb2c
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov dword [esi + 0x30], edi
call fcn.1001bb2c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1001e2f2
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x1001e31d
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esi + 8]
push eax
push 0
push esi
push 0x1001e356
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
pop esi
ret
Function at 0x1002b130
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1002b153
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
pop ecx
ret
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x1002b100
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x14], eax
push edi
jne 0x1002b17e
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, 1
pop esi
pop ecx
ret
Function at 0x476190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x4880b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x488b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x48adf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x48b880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x48c710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x551e90
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0
push 1
push 0x5e2570
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x551f1c
mov eax, 0x51eb851f
mov ecx, ebx
imul ebx
sar edx, 5
mov eax, ebx
sar ecx, 0x1f
sub edx, ecx
imul esi, edx, 0x64
sub eax, esi
jne 0x551f1c
cmp ebx, 0x15f90
jl 0x551f13
cmp ebx, 0x1d4c0
jge 0x551ef0
mov eax, 0x32
jmp 0x551f15
cmp ebx, 0x2bf20
jge 0x551eff
mov eax, 0x64
jmp 0x551f15
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x551f15
mov eax, 0xfa
jmp 0x551f15
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x551f30
inc ebx
cmp ebx, 0x57e40
jl 0x551ea8
mov eax, dword [ebp - 4]
test eax, eax
je 0x551f4a
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.005713a0
add esp, 4
mov eax, dword [0x5e2574]
test eax, eax
jne 0x551f80
cmp dword [0x5dcd40], 1
je 0x552004
xor ebx, ebx
xor esi, esi
cmp dword [0x5e256c], 0
je 0x551fc4
mov dword [0x5e2574], 1
cmp dword [0x5dcd40], 1
je 0x551faf
mov dword [0x5e2570], 0
push dword [0x5e2568]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x552022
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.0058e632
push ebx
push 0x16
call fcn.0058e632
add esp, 0x10
jmp 0x551f80
mov dword [0x5e256c], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x5e2568], eax
cmp eax, 0xffffffff
jne 0x551fe8
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x551f6d
push 0x551e70
call fcn.0058eb38
push 0x551e30
call fcn.0058eb38
add esp, 8
jmp 0x551f6d
push 1
push 2
call fcn.0058e632
mov esi, eax
push 1
push 0x16
call fcn.0058e632
add esp, 0x10
mov ebx, eax
jmp 0x551f64
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.005586b0
add esp, 0xc
test eax, eax
je 0x55204c
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x5dcc9c]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x5dcc98]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x5dcc94]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x5dcc90]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x552054
push dword [ebp - 0x10]
push dword [0x5e2568]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x10]
jmp 0x551f9e
Function at 0x5520a0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0
push 1
push 0x5e2570
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x55212c
mov eax, 0x51eb851f
mov ecx, ebx
imul ebx
sar edx, 5
mov eax, ebx
sar ecx, 0x1f
sub edx, ecx
imul esi, edx, 0x64
sub eax, esi
jne 0x55212c
cmp ebx, 0x15f90
jl 0x552123
cmp ebx, 0x1d4c0
jge 0x552100
mov eax, 0x32
jmp 0x552125
cmp ebx, 0x2bf20
jge 0x55210f
mov eax, 0x64
jmp 0x552125
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x552125
mov eax, 0xfa
jmp 0x552125
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x552140
inc ebx
cmp ebx, 0x57e40
jl 0x5520b8
mov eax, dword [ebp - 4]
test eax, eax
je 0x55215a
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.005713a0
add esp, 4
mov eax, dword [0x5e2574]
test eax, eax
jne 0x552190
cmp dword [0x5dcd40], 1
je 0x552229
xor ebx, ebx
xor esi, esi
cmp dword [0x5e256c], 0
je 0x5521e6
mov dword [0x5e2574], 1
cmp dword [0x5dcd40], 1
je 0x5521d1
mov dword [0x5e2570], 0
push dword [0x5e2568]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x552267
mov eax, dword [ebp + 8]
mov dword [eax], ebx
cmp dword [0x5dcd40], 1
je 0x552247
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.0058e632
push ebx
push 0x16
call fcn.0058e632
add esp, 0x10
jmp 0x552190
mov dword [0x5e256c], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x5e2568], eax
cmp eax, 0xffffffff
jne 0x55220d
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x55217d
push 0x551e70
call fcn.0058eb38
push 0x551e30
call fcn.0058eb38
add esp, 8
jmp 0x55217d
push 1
push 2
call fcn.0058e632
mov esi, eax
push 1
push 0x16
call fcn.0058e632
add esp, 0x10
mov ebx, eax
jmp 0x552174
push 1
push 2
call fcn.0058e632
push 1
push 0x16
mov dword [ebx + 0x64], eax
call fcn.0058e632
add esp, 0x10
mov dword [ebx + 0x68], eax
jmp 0x5521c5
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.005586b0
add esp, 0xc
test eax, eax
je 0x55228e
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x5dcc9c]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x5dcc98]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x5dcc94]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x5dcc90]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x552296
push dword [ebp - 0x10]
push dword [0x5e2568]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp - 0x10]
jmp 0x5521b3
Function at 0x5543d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x5543f5
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x554423
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x554498
mov ecx, 1
jmp 0x554498
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x554433
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x554462
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x554498
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x554474
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x554485
mov dword [ebp - 4], esi
test esi, esi
jne 0x554489
jmp 0x55448d
test esi, esi
je 0x55448d
test eax, eax
ja 0x55443b
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x5544f8
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x55b500
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x561920
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x5658cc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], edi
mov edx, eax
mov dword [ecx], 0
cmp dword [0x5ec960], 0
je 0x5659a3
cmp dword [ebp + 0x20], 2
je 0x565903
cmp dword [ebp + 0x20], 1
jne 0x565912
mov eax, 0xffffffff
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
je 0x565922
cmp dword [ebp + 0x20], 0xfffffffa
je 0x565a68
cmp dword [ebp + 0x20], 0
je 0x565a74
xor ecx, ecx
xor edi, edi
cmp dword [ebp + 0x18], 0
je 0x565957
cmp dword [ebp + 0x1c], 0
je 0x565957
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
call fcn.005b4350
push edi
call fcn.005b4370
mov edx, dword [ebp - 0x10]
add esp, 8
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x5659a3
push edi
push esi
push ebx
call fcn.005b4350
add esp, 0xc
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp esi, 0xffffffff
mov dword [eax], esi
je 0x565a98
push 0
push edi
push 2
push 0x5cb634
call fcn.005b4350
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov eax, 1
mov byte [esi + ebx], 0xa
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
inc dword [edx]
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], edx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x24]
test ecx, ecx
mov edx, dword [ebp - 0x10]
mov dword [edi], 0
je 0x5659cb
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x5659d0
mov edi, 0x20000
cmp esi, edi
jbe 0x565a44
cmp dword [ebp + 0x20], 0
je 0x565a44
test ecx, ecx
je 0x5659e8
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x5659ed
mov edi, 0x20000
mov dword [ebp - 0x10], edx
push 0
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x565a32
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
add ebx, edx
sub esi, edx
add dword [ecx], edx
cmp dword [ebp + 0x24], 0
je 0x565a27
mov edx, dword [ebp + 0x24]
mov edx, dword [edx + 0x13c]
test edx, edx
jne 0x565a2c
mov edx, 0x20000
cmp esi, edx
ja 0x565a32
mov edi, esi
test esi, esi
je 0x565a5b
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
jne 0x565a5b
test eax, eax
jne 0x5659f0
jmp 0x565a5b
push 0
lea ecx, [ebp - 0x18]
push ecx
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edi, edx
mov ecx, 1
jmp 0x565936
mov dword [ebp - 0x10], edx
call fcn.005b4370
mov edx, dword [ebp - 0x10]
mov edi, eax
cmp dword [0x5ec960], 0
je 0x56595b
mov ecx, 1
jmp 0x565930
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x566740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
movzx ecx, byte [edx + 0x16d]
and ecx, 0x20
shr ecx, 5
mov ebx, dword [eax]
test ecx, ecx
mov eax, dword [eax + 8]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
je 0x5667b9
cmp eax, 5
jl 0x5667b9
cmp eax, 0x11
jg 0x5667b9
mov edx, dword [ebp + 0x10]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
test eax, eax
jle 0x5667aa
mov edx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x1c], eax
xor ecx, ecx
lea edi, [edx + ebx]
movzx eax, byte [ebx]
inc esi
movzx edx, byte [ecx + edi - 1]
xor eax, edx
mov byte [ebx], dl
inc ebx
xor byte [ecx + edi - 1], al
dec ecx
cmp esi, dword [ebp - 0x1c]
jl 0x566792
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
movsx edi, byte [edx + 0x158]
cmp eax, 0x19
jl 0x5667aa
cmp eax, 0x1f
jle 0x5667e0
cmp eax, 0x32
jl 0x5667d6
cmp eax, 0x34
jle 0x5667e0
jmp 0x5667aa
cmp eax, 0x28
jl 0x5667aa
cmp eax, 0x30
jg 0x5667aa
test ecx, ecx
je 0x566843
test edi, edi
je 0x5667f2
cmp eax, 0x34
je 0x5667f2
cmp eax, 0x32
jne 0x566843
mov edx, dword [ebp + 0x10]
mov esi, edx
shr esi, 0x1f
add esi, edx
sar esi, 1
test esi, esi
jle 0x566843
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
lea ecx, [eax + ebx]
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov esi, dword [ebp - 0x14]
mov eax, ebx
movzx edi, byte [eax]
inc edx
movzx ebx, byte [ecx + esi - 1]
xor edi, ebx
mov byte [eax], bl
inc eax
mov ebx, edi
xor byte [ecx + esi - 1], bl
dec ecx
cmp edx, dword [ebp - 0x10]
jl 0x56681d
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov edx, dword [eax*4 + 0x5cb69c]
cmp edx, 0xffffffff
je 0x5668d8
lea eax, [edx*4]
shl edx, 5
sub edx, eax
mov edx, dword [edx + edi*4 + 0x5cb780]
test edx, edx
je 0x5667aa
lea eax, [ebp - 0x1c]
push eax
push 0
push ebx
call edx
add esp, 0xc
cmp eax, 1
jne 0x5668d8
cmp dword [ebp + 0x10], 4
jne 0x566894
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov dword [ecx], edx
jmp 0x5667aa
cmp dword [ebp + 0x10], 8
jne 0x5668b1
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov dword [edx], eax
mov esi, dword [ecx]
mov ebx, dword [ebp - 0x18]
mov dword [esi + 4], ebx
jmp 0x5667aa
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov dword [ecx], edx
mov esi, dword [eax]
mov ebx, dword [ebp - 0x18]
mov dword [esi + 4], ebx
mov edx, dword [eax]
mov edi, dword [ebp - 0x14]
mov dword [edx + 8], edi
mov ecx, dword [eax]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
jmp 0x5667aa
mov eax, 0x5f
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x5711d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x7c]
test esi, esi
mov dword [ebp - 0xc], edi
je 0x57138c
mov edx, dword [0x5dcd40]
mov edi, dword [esi + 0x14]
lea eax, [edi*4]
shl edi, 5
sub edi, eax
cmp edx, 2
lea ebx, [edi + 0x5e70c8]
jge 0x57121f
mov eax, dword [ebx]
test eax, eax
jne 0x571260
mov dword [edi + 0x5e70c8], 1
jmp 0x571260
push ebx
call fcn.00552330
add esp, 4
test eax, eax
jne 0x57125a
cmp dword [edi + 0x5e70c4], 0
je 0x57136c
mov dword [edi + 0x5e70c8], 0
push 0xffffffffffffffff
push dword [edi + 0x5e70c4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.00552330
add esp, 4
mov edx, dword [0x5dcd40]
cmp edx, 1
je 0x571358
mov eax, dword [esi + 0x18]
dec eax
mov dword [esi + 0x18], eax
test eax, eax
jle 0x5712cf
mov eax, dword [0x5dcd40]
cmp eax, 1
je 0x5712b4
cmp eax, 2
jge 0x57128f
mov dword [edi + 0x5e70c8], 0
jmp 0x5712a5
mov dword [edi + 0x5e70c8], 0
push dword [edi + 0x5e70c4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push dword [edi + 0x5e70d8]
push dword [edi + 0x5e70d4]
call fcn.00552310
add esp, 8
mov eax, dword [0x5dcd40]
jmp 0x57127e
mov edx, dword [esi]
test edx, edx
je 0x5712db
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x5712e6
mov dword [eax], edx
jmp 0x5712ec
mov dword [edi + 0x5e70c0], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x7c], 0
mov eax, dword [0x5dcd40]
cmp eax, 1
je 0x57133d
cmp eax, 2
jge 0x571311
mov dword [edi + 0x5e70c8], 0
jmp 0x571327
mov dword [edi + 0x5e70c8], 0
push dword [edi + 0x5e70c4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call fcn.00558770
push esi
call fcn.00558770
add esp, 8
jmp 0x5712a5
push dword [edi + 0x5e70d8]
push dword [edi + 0x5e70d4]
call fcn.00552310
add esp, 8
mov eax, dword [0x5dcd40]
jmp 0x571300
lea eax, [edi + 0x5e70d4]
push eax
call fcn.005522e0
add esp, 4
jmp 0x571269
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0x5e70c4], eax
mov dword [edi + 0x5e70c8], 0
jmp 0x571243
xor eax, eax
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x58d0b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
cmp dword [0x5de470], 0
je 0x58d13c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x34]
push edx
push ecx
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x58d132
fld qword [0x5d04c8]
fild qword [esp + 0x3c]
fdiv st(1)
fst qword [0x5eb4b0]
fild qword [esp + 0x34]
fdivrp st(2)
mov eax, dword [ebp + 8]
fxch st(1)
fst qword [0x5eb4b8]
fld qword [0x5eb4a8]
mov dword [0x5de470], 0
fsubrp st(1)
fchs
fst dword [eax + 4]
fxch st(1)
fsub qword [0x5eb4a0]
fst dword [eax]
fxch st(1)
jmp 0x58d20a
fld dword [0x5d04f8]
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5de46c]
lea edx, [esp]
mov dword [esp], 0xffffffff
xchg dword [edx], eax
mov eax, dword [esp]
cmp eax, 0xffffffff
jne 0x58d171
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x1c]
mov edx, 0x5de46c
mov dword [esp], eax
xchg dword [edx], eax
mov eax, dword [esp]
cmp eax, 1
jg 0x58d1c9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x34]
push edx
push ecx
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x58d1bf
fld qword [0x5d04c8]
fild qword [esp + 0x3c]
fdiv st(1)
fst qword [0x5eb4a0]
fild qword [esp + 0x34]
fdivrp st(2)
fxch st(1)
fst qword [0x5eb4a8]
fxch st(1)
jmp 0x58d1e8
fld dword [0x5d04f8]
mov esp, ebp
pop ebp
ret
call fcn.00591416
mov dword [esp], eax
fldz
fst qword [0x5eb4a8]
fild dword [esp]
fdiv qword [0x5d04d0]
fst qword [0x5eb4a0]
mov eax, dword [ebp + 8]
mov dword [0x5de470], 1
fsubr qword [0x5eb4b0]
fchs
fst dword [eax]
fxch st(1)
fsub qword [0x5eb4b8]
fst dword [eax + 4]
faddp st(1)
mov esp, ebp
pop ebp
ret

Function at 0x5969a6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5df1b0]
jne 0x5969b0
repz ret
jmp fcn.0059c0cd