joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57651b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x5fbf2c]
and dword [ebp - 4], 0
push edi
mov edi, dword [eax + 0x2a8]
test edi, edi
mov dword [ebp - 8], edi
je 0x57667e
push ebx
mov ebx, dword [ebp + 8]
push esi
call fcn.005767d7
mov esi, eax
test esi, esi
jne 0x576569
mov eax, dword [0x5fbf2c]
add eax, 0x2c7
push eax
push str._n___Unexpected_EOF_in__s_n
call fcn.005746d5
push eax
call fcn.00574720
add esp, 0xc
cmp edi, esi
jg 0x57656f
mov esi, edi
cmp dword [ebx], 0
mov eax, dword [0x5fbf2c]
je 0x5765a2
cmp dword [eax + 0xf630], 0
je 0x5765a2
xor ecx, ecx
cmp edi, dword [eax + 0x2a8]
sete cl
push ecx
add eax, 0x3c0
push esi
push eax
call fcn.00577303
mov eax, dword [0x5fbf2c]
add esp, 0xc
mov edx, dword [ebx]
test edx, edx
je 0x57666a
xor ecx, ecx
test esi, esi
je 0x5765c9
movsx di, byte [eax + ecx + 0x3c0]
add dword [ebp - 4], edi
inc ecx
cmp ecx, esi
jne 0x5765b2
mov ebx, dword [ebp + 8]
mov edi, dword [ebp - 8]
test edx, edx
je 0x57666a
lea ecx, [eax + 0x7c5a]
push esi
push ecx
push dword [eax + 0x2b4]
call fcn.0059a0e4
add esp, 0xc
cmp esi, eax
je 0x576609
mov eax, dword [0x5fbf2c]
add eax, 0x33f
push eax
push str.Read_error_for__s_n
call fcn.005746d5
push eax
call fcn.00574720
add esp, 0xc
mov eax, dword [0x5fbf2c]
lea ecx, [eax + 0x7c5a]
add eax, 0x3c0
push ecx
push eax
push esi
call fcn.005767a7
add esp, 0xc
test eax, eax
je 0x57666a
mov eax, dword [0x5fbf2c]
add eax, 0x33f
push eax
push str.___Compare_error_for_file__s_n_n
call fcn.005746d5
push eax
call fcn.00574518
and dword [ebx], 0
mov eax, dword [0x5fbf2c]
push dword [eax + 0x2b4]
call fcn.005974b0
mov eax, dword [0x5fbf2c]
add esp, 0x10
or dword [eax + 0x2b4], 0xffffffff
mov eax, dword [ebp + 0xc]
inc dword [eax]
push esi
call fcn.00576929
sub edi, esi
pop ecx
mov dword [ebp - 8], edi
jne 0x576540
pop esi
pop ebx
mov ax, word [ebp - 4]
pop edi
leave
ret
Function at 0x5767d7
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [0x5fbf2c]
push esi
mov esi, 0x800
mov eax, dword [ecx + 0x3bc]
cmp eax, esi
jl 0x5767f5
cdq
idiv esi
jmp 0x576924
cmp dword [ecx + 0xf66c], 0
jne 0x576927
push ebx
mov ebx, 0x789a
mov edx, ebx
push edi
sub edx, eax
lea eax, [eax + ecx + 0x3c0]
shr edx, 0xb
shl edx, 0xb
mov esi, edx
sub esi, dword [ecx + 0xf4f4]
push esi
push eax
push dword [ecx + 0x2b0]
call fcn.0059a0e4
mov edi, eax
add esp, 0xc
cmp edi, esi
je 0x5768ef
test edi, edi
jge 0x576842
xor edi, edi
mov eax, dword [0x5fbf2c]
cmp byte [eax + 0x1be], 0x59
je 0x5768e3
add dword [eax + 0x3bc], edi
call fcn.005770fb
mov eax, dword [0x5fbf2c]
mov ecx, dword [eax + 0x3bc]
sub ebx, ecx
shr ebx, 0xb
shl ebx, 0xb
mov esi, ebx
sub esi, dword [eax + 0xf4f4]
test esi, esi
jle 0x57689e
lea ecx, [ecx + eax + 0x3c0]
push esi
push ecx
push dword [eax + 0x2b0]
call fcn.0059a0e4
mov edi, eax
mov eax, dword [0x5fbf2c]
add esp, 0xc
jmp 0x5768a2
xor edi, edi
xor esi, esi
cmp edi, esi
je 0x5768dd
cmp byte [eax + 0x1be], 0x59
jne 0x5768bf
test edi, edi
jl 0x5768bf
mov dword [eax + 0xf66c], 1
jmp 0x5768d8
add eax, 0x2c7
push eax
push str.Read_error__s_n
call fcn.005746d5
push eax
call fcn.00574720
add esp, 0xc
mov eax, dword [0x5fbf2c]
test edi, edi
je 0x576900
jmp 0x5768f4
mov dword [eax + 0xf66c], 1
jmp 0x5768fb
mov eax, dword [0x5fbf2c]
and dword [eax + 0xf4f4], 0
mov eax, dword [0x5fbf2c]
add dword [eax + 0x3bc], edi
mov eax, dword [0x5fbf2c]
pop edi
pop ebx
cmp dword [eax + 0xf66c], 0
mov eax, dword [eax + 0x3bc]
jne 0x576927
cdq
mov ecx, 0x800
idiv ecx
shl eax, 0xb
pop esi
ret
Function at 0x5769df
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebx, ebx
call fcn.00576c31
mov eax, dword [0x5fbf2c]
cmp dword [eax + 0xf658], ebx
jne 0x576c03
mov ebp, 0x9a
lea ecx, [eax + 0x214]
push ebp
push ecx
push dword [eax + 0x2b0]
call fcn.0059a0e4
mov esi, eax
add esp, 0xc
cmp esi, ebp
je 0x576ac5
test esi, esi
jg 0x576a4f
mov eax, dword [0x5fbf2c]
push dword [eax + 0x2b0]
call fcn.005a3909
cmp eax, 1
pop ecx
jne 0x576a4f
mov eax, dword [0x5fbf2c]
cmp byte [eax + 0x1be], 0x59
je 0x576c03
jmp 0x576a54
mov eax, dword [0x5fbf2c]
test esi, esi
jl 0x576aac
push dword [eax + 0x2b0]
call fcn.005a3909
cmp eax, 1
pop ecx
jne 0x576aa7
mov eax, dword [0x5fbf2c]
cmp byte [eax + 0x1be], 0x4e
jne 0x576aac
call fcn.005770fb
mov eax, dword [0x5fbf2c]
mov edi, ebp
sub edi, esi
lea ecx, [eax + esi + 0x214]
push edi
push ecx
push dword [eax + 0x2b0]
call fcn.0059a0e4
add esp, 0xc
xor ebx, ebx
cmp edi, eax
sete bl
test ebx, ebx
jne 0x576ac5
mov eax, dword [0x5fbf2c]
add eax, 0x2c7
push eax
push str.Read_error_for_file__s_n
call fcn.005746d5
push eax
call fcn.00574720
add esp, 0xc
mov eax, dword [0x5fbf2c]
lea ecx, [eax + 0x214]
add eax, 0x33f
push ecx
push eax
call fcn.00592d40
mov eax, dword [0x5fbf2c]
xor esi, esi
pop ecx
cmp dword [eax + 0xf634], esi
pop ecx
jne 0x576b1c
push dword [eax + 0x294]
lea ecx, [eax + 0x33f]
movsx eax, word [eax + 0x3b8]
sub eax, ebx
push ecx
push eax
push str._d____s___ld__n
call fcn.005746d5
push eax
call fcn.004507f0
mov eax, dword [0x5fbf2c]
add esp, 0x14
xor ebx, ebx
inc dword [eax + 0xf4f8]
mov eax, dword [0x5fbf2c]
mov ecx, dword [eax + 0x294]
add dword [eax + 0xf4fc], ecx
mov eax, dword [0x5fbf2c]
test byte [eax + 0x293], 0x40
je 0x576b50
mov dword [eax + 0x2a8], esi
mov eax, dword [0x5fbf2c]
jmp 0x576b58
mov esi, dword [eax + 0x2a8]
inc esi
inc esi
push dword [eax + 0x2b0]
call fcn.00598449
mov edi, eax
mov eax, dword [0x5fbf2c]
push dword [eax + 0x2b0]
call fcn.005a3cf7
mov dword [esp + 0x18], edi
mov edi, eax
mov eax, dword [esp + 0x18]
pop ecx
pop ecx
sub edi, eax
cmp esi, edi
jle 0x576bb8
call fcn.005770fb
mov eax, dword [0x5fbf2c]
sub esi, edi
push dword [eax + 0x2b0]
call fcn.00598449
mov edi, eax
mov eax, dword [0x5fbf2c]
push dword [eax + 0x2b0]
call fcn.005a3cf7
pop ecx
sub eax, edi
pop ecx
mov edi, eax
jmp 0x576b83
mov eax, dword [0x5fbf2c]
push 1
push esi
push dword [eax + 0x2b0]
call fcn.00595983
add esp, 0xc
cmp eax, 0xffffffff
jne 0x576bf1
mov eax, dword [0x5fbf2c]
add eax, 0x2c7
push eax
push str.seek_error_for_file__s_n
call fcn.005746d5
push eax
call fcn.00574720
add esp, 0xc
mov eax, dword [0x5fbf2c]
cmp dword [eax + 0xf658], 0
je 0x576a01
cmp dword [eax + 0xf634], 0
pop edi
pop esi
pop ebp
pop ebx
jne 0x576c2f
push dword [eax + 0xf4fc]
push dword [eax + 0xf4f8]
push str._nTotal_number_of_files___d___ld_bytes__n_n
call fcn.005746d5
push eax
call fcn.004507f0
add esp, 0x10
pop ecx
ret
Function at 0x576f06
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x5fbf2c]
cmp dword [eax + 0xf624], 0
je 0x576f59
call fcn.0059607d
mov eax, dword [0x5fbf2c]
lea ecx, [eax + 0x2c4]
push ecx
push dword [eax + 0xf668]
push str._n_nPlace__s_disk_in_drive__s_and_n
call fcn.005746d5
push eax
call fcn.004507f0
push str.Strike_any_key_when_ready...
call fcn.004507f0
call fcn.00450818
push 0x5c2bb0
call fcn.004507f0
add esp, 0x18
jmp 0x576f63
mov dword [eax + 0xf624], 1
mov eax, dword [0x5fbf2c]
push 0x8000
add eax, 0x2c7
push eax
call fcn.005745b5
pop ecx
push eax
call fcn.005a0209
pop ecx
pop ecx
mov ecx, dword [0x5fbf2c]
mov dword [ecx + 0x2b0], eax
mov eax, dword [0x5fbf2c]
cmp dword [eax + 0x2b0], 0xffffffff
jne 0x576fa7
push str._nNot_a_bar_disk._n
call fcn.004507f0
pop ecx
ret
mov dword [eax + 0xf4f4], 0x5e
mov eax, dword [0x5fbf2c]
push 0x5e
lea ecx, [eax + 0x1b6]
push ecx
push dword [eax + 0x2b0]
call fcn.0059a0e4
add esp, 0xc
cmp eax, 0x5e
je 0x576ff0
mov eax, dword [0x5fbf2c]
add eax, 0x2c7
push eax
push str.Read_error_for_file__s_n
call fcn.005746d5
push eax
call fcn.00574720
add esp, 0xc
mov eax, dword [0x5fbf2c]
mov ax, word [eax + 0x1b6]
cmp ax, 4
je 0x57702b
movsx eax, ax
push eax
push str.This_disk_was_created_with_version__d_n
call fcn.005746d5
push eax
call fcn.004507f0
mov eax, dword [0x5fbf2c]
push dword [eax + 0x2b0]
call fcn.005974b0
add esp, 0x10
jmp 0x577061
call fcn.0057706e
mov eax, dword [0x5fbf2c]
cmp byte [eax + 0x1be], 0x59
jne 0x577045
push str.This_is_the_last_disk_in_the_set._n_n
jmp 0x57704a
push str.This_is_not_the_last_disk_in_the_set._n_n
call fcn.004507f0
mov eax, dword [0x5fbf2c]
pop ecx
push dword [eax + 0x2b0]
call fcn.005974b0
pop ecx
mov eax, dword [0x5fbf2c]
or dword [eax + 0x2b0], 0xffffffff
ret

Function at 0x577393
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5773a6
push 1
pop eax
ret
mov ecx, dword [esp + 8]
and word [ecx], 0
test al, 0x20
je 0x5773b7
mov word [ecx], 0x20
test al, 0x10
je 0x5773be
or byte [ecx], 0x10
test al, 2
je 0x5773c5
or byte [ecx], 2
test al, 1
je 0x5773cc
or byte [ecx], 1
test al, 4
je 0x5773d3
or byte [ecx], 4
xor eax, eax
ret

Function at 0x5773d6
Capabilities:
Set file attributes

Disassembly:
mov cl, byte [esp + 8]
xor eax, eax
test cl, 0x20
je 0x5773e4
push 0x20
pop eax
test cl, 2
je 0x5773eb
or al, 2
test cl, 1
je 0x5773f2
or al, 1
test cl, 4
je 0x5773f9
or al, 4
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
dec eax
neg eax
sbb eax, eax
neg eax
ret
Function at 0x5776c9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x5e56d4], 0
push esi
je 0x57777d
cmp dword [0x5ddec8], 0
je 0x57779c
call fcn.005767d7
mov esi, eax
test esi, esi
jne 0x577710
mov eax, dword [0x5fbf2c]
add eax, 0x2c7
push eax
push str._n___Unexpected_EOF_in__s_n
call fcn.005746d5
push eax
call fcn.00574720
add esp, 0xc
mov eax, dword [0x5ddec8]
cmp eax, esi
jg 0x57771b
mov esi, eax
cmp dword [ebp + 0xc], esi
jg 0x577723
mov esi, dword [ebp + 0xc]
mov eax, dword [0x5fbf2c]
push esi
add eax, 0x3c0
push eax
push dword [ebp + 8]
call fcn.00593530
push esi
call fcn.00576929
add esp, 0x10
cmp dword [0x5e56d0], 0
je 0x577775
mov eax, dword [0x5fbf2c]
cmp dword [eax + 0xf630], 0
je 0x577775
mov edx, dword [0x5ddec8]
xor ecx, ecx
cmp edx, dword [eax + 0x2a8]
sete cl
push ecx
push esi
push dword [ebp + 8]
call fcn.00577303
add esp, 0xc
sub dword [0x5ddec8], esi
jmp 0x5777ac
push dword [ebp + 0xc]
mov eax, dword [0x5fbf2c]
push dword [ebp + 8]
push dword [eax + 0x2b0]
call fcn.0059a0e4
mov esi, eax
add esp, 0xc
test esi, esi
jg 0x5777a1
or eax, 0xffffffff
jmp 0x5777ae
push esi
push dword [ebp + 8]
call fcn.0057789b
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
ret

Function at 0x57796d
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [0x5ecedc]
test ecx, ecx
je 0x577a88
mov eax, dword [0x5e56d4]
cmp eax, 2
jne 0x577a35
mov eax, dword [0x5fbf2c]
push ecx
lea ecx, [eax + 0x7c5a]
push ecx
push dword [eax + 0x2b4]
call fcn.0059a0e4
add esp, 0xc
cmp dword [0x5ecedc], eax
je 0x5779ca
mov eax, dword [0x5fbf2c]
add eax, 0x33f
push eax
push str.Read_error_for__s_n
call fcn.005746d5
push eax
call fcn.00574720
add esp, 0xc
mov eax, dword [0x5fbf2c]
add eax, 0x7c5a
push eax
push 0x5e56dc
push dword [0x5ecedc]
call fcn.005767a7
add esp, 0xc
test eax, eax
je 0x577a66
mov eax, dword [0x5fbf2c]
add eax, 0x33f
push eax
push str.___Compare_error_for_file__s_n_n
call fcn.005746d5
push eax
call fcn.00574518
mov eax, dword [0x5fbf2c]
and dword [0x5e56d0], 0
push dword [eax + 0x2b4]
call fcn.005974b0
mov eax, dword [0x5fbf2c]
add esp, 0x10
or dword [eax + 0x2b4], 0xffffffff
inc dword [0x5ddec4]
jmp 0x577a66
cmp eax, 3
je 0x577a66
mov eax, dword [0x5fbf2c]
push ecx
push 0x5e56dc
push dword [eax + 0x2b4]
call fcn.0059bcdb
add esp, 0xc
cmp dword [0x5ecedc], eax
je 0x577a66
push str.Write_error_n
call fcn.00574720
pop ecx
mov eax, dword [0x5ecedc]
test eax, eax
je 0x577a88
movsx cx, byte [eax + 0x5e56db]
add word [0x5e56d8], cx
dec eax
test eax, eax
jne 0x577a6f
mov dword [0x5ecedc], eax
ret
Function at 0x579fa0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
lea edx, [esp + 4]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
push edx
push eax
mov dword [esp + 0x10], ecx
call fcn.00598035
add esp, 8
test eax, eax
je 0x57a029
mov cx, word [esi + 6]
and ecx, 0xf000
cmp ecx, 0x4000
je 0x57a029
mov eax, dword [0x5ecf00]
test eax, eax
jne 0x57a000
mov edx, dword [0x630964]
push edx
push str._s:
push 0x5d9410
call fcn.00595a5b
add esp, 0xc
mov eax, dword [0x5ecf0c]
test eax, eax
jne 0x57a013
mov dword [0x5ecf0c], 2
mov eax, dword [0x5ecf00]
test eax, eax
jne 0x57a029
push 0x5fbf80
call fcn.00577a89
add esp, 4
pop esi
add esp, 8
ret

Function at 0x57ace0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
test ecx, ecx
jne 0x57acf5
or eax, 0xffffffff
pop esi
mov dword [0x5d727c], eax
not eax
ret
mov esi, dword [esp + 0xc]
mov eax, dword [0x5d727c]
test esi, esi
je 0x57ad22
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5d7280]
xor eax, edx
inc ecx
dec esi
jne 0x57ad03
pop ebx
mov dword [0x5d727c], eax
pop esi
not eax
ret

Function at 0x57b8d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp esi, 1
push edi
jl 0x57b8e0
cmp esi, 9
jle 0x57b8ed
push str.bad_pack_level
call fcn.0057b160
add esp, 4
mov ecx, 0x1000
xor eax, eax
mov edi, 0x5fc000
xor edx, edx
mov dx, word [esi*8 + 0x5d78ac]
mov dword [0x5ecf58], esi
rep stosd dword es:[edi], eax
mov ax, word [esi*8 + 0x5d78aa]
xor ecx, ecx
mov cx, word [esi*8 + 0x5d78a8]
mov dword [0x5ecf4c], eax
xor eax, eax
cmp esi, 1
mov ax, word [esi*8 + 0x5d78ae]
mov dword [0x5fbf58], ecx
mov dword [0x5fbf50], edx
mov dword [0x5fbf54], eax
jne 0x57b94b
mov eax, dword [esp + 0x10]
or byte [eax], 4
jmp 0x57b957
cmp esi, 9
jne 0x57b957
mov eax, dword [esp + 0x10]
or byte [eax], 2
xor esi, esi
push 0x10000
push 0x6208c0
mov dword [0x5fbf4c], esi
mov dword [0x5fbf60], esi
call dword [0x5fbf3c]
add esp, 8
cmp eax, esi
mov dword [0x5ecf5c], eax
je 0x57b9d6
cmp eax, 0xffffffff
je 0x57b9d6
mov edi, 0x106
mov dword [0x5ecf54], esi
cmp eax, edi
jae 0x57b9aa
cmp dword [0x5ecf54], esi
jne 0x57b9aa
call fcn.0057bb40
cmp dword [0x5ecf5c], edi
jb 0x57b995
xor ecx, ecx
xor eax, eax
xor edx, edx
and ecx, 0xff
mov dl, byte [eax + 0x6208c0]
and edx, 0x1fff
shl ecx, 5
xor ecx, edx
inc eax
cmp eax, 2
jb 0x57b9ae
pop edi
mov dword [0x5ecf50], ecx
pop esi
ret
mov dword [0x5ecf5c], esi
pop edi
mov dword [0x5ecf54], 1
pop esi
ret
Function at 0x57bf50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x5ecf5c]
push esi
xor esi, esi
mov dword [0x5fbf48], 2
test eax, eax
je 0x57c14f
mov edx, dword [0x5ecf50]
mov ecx, dword [0x5fbf4c]
push ebx
push edi
xor eax, eax
and edx, 0xff
mov al, byte [ecx + 0x6208c2]
mov edi, ecx
and eax, 0x1fff
and edi, 0x7fff
shl edx, 5
xor eax, edx
xor edx, edx
mov dword [0x5ecf50], eax
mov dx, word [eax*2 + 0x5fc000]
mov word [eax*2 + 0x5fc000], cx
test edx, edx
mov word [edi*2 + 0x6108a0], dx
je 0x57bfe2
mov eax, ecx
sub eax, edx
cmp eax, 0x7efa
ja 0x57bfe2
push edx
call fcn.0057b9f0
mov esi, eax
mov eax, dword [0x5ecf5c]
add esp, 4
cmp esi, eax
jbe 0x57bfdc
mov esi, eax
mov ecx, dword [0x5fbf4c]
cmp esi, 3
jb 0x57c0a3
mov ebx, dword [0x5fbf5c]
lea edx, [esi - 3]
sub ecx, ebx
push edx
push ecx
call fcn.0057cdb0
mov ecx, dword [0x5ecf5c]
mov edi, eax
mov eax, dword [0x5ecf4c]
add esp, 8
sub ecx, esi
cmp esi, eax
mov dword [0x5ecf5c], ecx
ja 0x57c070
mov edx, dword [0x5ecf50]
mov ecx, dword [0x5fbf4c]
dec esi
inc ecx
xor eax, eax
and edx, 0xff
mov al, byte [ecx + 0x6208c2]
and eax, 0x1fff
shl edx, 5
xor edx, eax
mov eax, ecx
and eax, 0x7fff
dec esi
mov bx, word [edx*2 + 0x5fc000]
mov word [edx*2 + 0x5fc000], cx
mov word [eax*2 + 0x6108a0], bx
jne 0x57c026
inc ecx
mov dword [0x5ecf50], edx
mov dword [0x5fbf4c], ecx
jmp 0x57c0d8
mov ecx, dword [0x5fbf4c]
xor edx, edx
add ecx, esi
xor eax, eax
xor esi, esi
mov dword [0x5fbf4c], ecx
mov dl, byte [ecx + 0x6208c1]
mov al, byte [ecx + 0x6208c0]
and edx, 0x1fff
shl eax, 5
xor edx, eax
mov dword [0x5ecf50], edx
jmp 0x57c0d8
xor edx, edx
mov dl, byte [ecx + 0x6208c0]
push edx
push 0
call fcn.0057cdb0
mov ecx, dword [0x5ecf5c]
add esp, 8
mov edx, dword [0x5ecf50]
dec ecx
mov dword [0x5ecf5c], ecx
mov ecx, dword [0x5fbf4c]
inc ecx
mov edi, eax
mov dword [0x5fbf4c], ecx
test edi, edi
je 0x57c110
mov edx, dword [0x5fbf60]
test edx, edx
jl 0x57c0ee
lea eax, [edx + 0x6208c0]
jmp 0x57c0f0
xor eax, eax
sub ecx, edx
push 0
push ecx
push eax
call fcn.0057c4a0
mov ecx, dword [0x5fbf4c]
mov edx, dword [0x5ecf50]
add esp, 0xc
mov dword [0x5fbf60], ecx
mov eax, dword [0x5ecf5c]
cmp eax, 0x106
jae 0x57c143
mov edi, dword [0x5ecf54]
test edi, edi
jne 0x57c143
call fcn.0057bb40
mov eax, dword [0x5ecf5c]
mov edx, dword [0x5ecf50]
mov ecx, dword [0x5fbf4c]
cmp eax, 0x106
jb 0x57c11c
test eax, eax
jne 0x57bf78
pop edi
pop ebx
jmp 0x57c155
mov ecx, dword [0x5fbf4c]
mov edx, dword [0x5fbf60]
pop esi
test edx, edx
jl 0x57c175
sub ecx, edx
lea eax, [edx + 0x6208c0]
push 1
push ecx
push eax
call fcn.0057c4a0
add esp, 0xc
ret
sub ecx, edx
xor eax, eax
push 1
push ecx
push eax
call fcn.0057c4a0
add esp, 0xc
ret
Function at 0x57ea70
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x5d7c58]
push esi
push edi
push eax
call fcn.005a3cf7
mov esi, eax
mov eax, dword [0x5ef254]
add esp, 4
test eax, eax
je 0x57eaa4
mov ecx, dword [0x5ef250]
push 0x145
push str.doslock.c
push ecx
call fcn.00586720
add esp, 0xc
mov edx, dword [esp + 0xc]
push 0x146
push str.doslock.c
push 0x146
lea eax, [esi + edx]
push str.doslock.c
push eax
call fcn.005866f0
add esp, 0xc
push eax
call fcn.00585b20
mov dword [0x5ef250], eax
mov eax, dword [0x5ef258]
add esp, 0xc
mov dword [0x5ef254], esi
test eax, eax
je 0x57eaee
push eax
call fcn.005862d0
add esp, 4
push 0x64
call fcn.00586220
push 0
push eax
mov dword [0x5ef258], eax
call fcn.00528930
mov ecx, dword [0x5ef258]
push 0
push ecx
call fcn.005862b0
mov edx, dword [0x5d7c58]
push 0
push 0
push edx
call fcn.00595983
mov eax, dword [0x5ef254]
mov ecx, dword [0x5ef250]
mov edx, dword [0x5d7c58]
push eax
push ecx
push edx
call fcn.0059a0e4
mov ecx, dword [0x5ef254]
add esp, 0x2c
cmp eax, ecx
je 0x57eb5d
push 0x152
push str.doslock.c
push str.Read_error_for_lock_file.
call fcn.00585b50
add esp, 0xc
mov eax, dword [0x5ef254]
xor esi, esi
test eax, eax
mov edi, 1
jbe 0x57eba3
mov ecx, dword [0x5ef258]
mov eax, edi
push eax
mov eax, dword [0x5ef250]
add eax, esi
inc edi
push eax
push ecx
call fcn.00586380
mov edx, dword [0x5ef250]
add edx, esi
push edx
call fcn.00586750
lea esi, [esi + eax + 1]
mov eax, dword [0x5ef254]
add esp, 0x10
cmp esi, eax
jb 0x57eb6d
mov eax, edi
pop edi
pop esi
ret

Function at 0x586cf0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x18]
push 0
push ebp
mov eax, dword [edi + 0xc4]
push eax
call fcn.00595983
add esp, 0xc
test eax, eax
jge 0x586d21
push 0x23
call fcn.0057f440
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, dword [esp + 0x24]
test si, si
jne 0x586d2e
mov si, word [edi + 4]
cmp word [esp + 0x14], 0
jne 0x586d82
mov ebx, dword [esp + 0x20]
mov ecx, dword [edi + 0xc4]
and esi, 0xffff
push esi
push ebx
push ecx
call fcn.0059a0e4
add esp, 0xc
cmp eax, esi
je 0x586d64
push 0x24
call fcn.0057f440
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, dword [edi + 0xc0]
test edi, edi
je 0x586d7a
push edi
push ebp
push esi
push ebx
call fcn.00586e90
add esp, 0x10
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
ret
mov edx, dword [edi + 0xc0]
mov eax, dword [esp + 0x20]
and esi, 0xffff
push esi
push edx
push ebp
push esi
push eax
call fcn.00586dd0
mov ecx, dword [edi + 0xc4]
add esp, 0x10
push eax
push ecx
call fcn.0059bcdb
add esp, 0xc
cmp eax, esi
je 0x586d7a
push 0x25
call fcn.0057f440
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x58b900
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x5efb14]
sub esp, 0x34
test eax, eax
jne 0x58b911
call fcn.0044e5e8
push 2
push eax
call dword [0x5bf8b0]
mov eax, dword [0x5ef9b8]
add esp, 8
test eax, eax
jne 0x58b92b
call fcn.004c5f20
push esi
push 0x46
push 0xf
push str.File_Error_Popup
push eax
call dword [0x5bf9c4]
mov esi, eax
mov eax, dword [0x5ef2a8]
push eax
push str.System
push esi
call fcn.0058bae0
mov eax, dword [esp + 0x5c]
add esp, 0x1c
test eax, eax
je 0x58b969
push eax
push str.Source_File
push esi
call fcn.0058bae0
add esp, 0xc
mov eax, dword [esp + 0x44]
test eax, eax
je 0x58b994
push eax
lea ecx, [esp + 8]
push 0x5b3518
push ecx
call fcn.005929d6
lea edx, [esp + 0x10]
push edx
push str.Source_Line
push esi
call fcn.0058bae0
add esp, 0x18
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x58b9ab
push eax
push str.Calling_Function
push esi
call fcn.0058bae0
add esp, 0xc
mov eax, dword [0x5ef2ac]
push eax
push str.File_Function
push esi
call fcn.0058bae0
mov eax, dword [0x5ef2b0]
add esp, 0xc
test eax, eax
je 0x58ba3d
mov ecx, dword [eax + 4]
push ecx
push str.Logical_File
push esi
call fcn.0058bae0
mov edx, dword [0x5ef2b0]
mov eax, dword [edx]
push eax
push str.Physical_File
push esi
call fcn.0058bae0
mov ecx, dword [0x5ef2b0]
add esp, 0x18
mov eax, dword [ecx + 0x24]
test eax, eax
je 0x58ba64
mov edx, dword [eax + 0x4c]
push edx
push str.Current_Index
push esi
call fcn.0058bae0
mov eax, dword [0x5ef2b0]
push 0
push 0x634da0
movsx edx, word [eax + 0x28]
mov ecx, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
push ecx
push edx
push eax
call fcn.0058e970
push 0x634da0
push 0x5d8cbc
push esi
call fcn.0058bae0
add esp, 0x2c
jmp 0x58ba64
mov ecx, dword [0x5ef2b4]
push ecx
push str.Logical_File
push esi
call fcn.0058bae0
mov edx, dword [0x5ef2b8]
push edx
push str.Physical_File
push esi
call fcn.0058bae0
add esp, 0x18
movsx eax, word [0x634ce2]
push eax
push 0x5b3518
push 0x634da0
call fcn.005929d6
push 0x634da0
push str.File_Error
push esi
call fcn.0058bae0
mov cx, word [0x634ce2]
push esi
push ecx
call fcn.0058bb50
lea edx, [esp + 0x24]
push 0x32
push edx
call fcn.00594284
add esp, 0x28
test eax, eax
je 0x58babb
push eax
push str.Working_directory
push esi
call fcn.0058bae0
add esp, 0xc
push esi
call dword [0x5bef8c]
add esp, 4
push str.File_Error.
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 1
call fcn.00593892
pop esi
nop
nop
nop
nop
nop
nop
Function at 0x58d820
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x458
push ebx
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x468]
xor ebx, ebx
test eax, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x20], 0x44
jne 0x58d863
mov ebx, 0x8000000
mov dword [esp + 0x4c], 1
mov word [esp + 0x50], 0
mov esi, dword [esp + 0x470]
push esi
call fcn.0058d9f0
add esp, 4
test eax, eax
push esi
je 0x58d884
lea eax, [esp + 0x68]
push str.cmd.exe__c__s
push eax
jmp 0x58d8c1
call fcn.0058d990
add esp, 4
test eax, eax
je 0x58d8cd
push str.COMSPEC
call fcn.00592c1a
add esp, 4
test eax, eax
push esi
je 0x58d8b7
push eax
lea ecx, [esp + 0x6c]
push str._s__c__s
push ecx
call fcn.005929d6
add esp, 0x10
jmp 0x58d8c9
lea edx, [esp + 0x68]
push str.command.com__c__s
push edx
call fcn.005929d6
add esp, 0xc
lea esi, [esp + 0x64]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push 0
push ebx
push 1
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x58d8fc
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x458
ret
mov eax, dword [esp + 0x46c]
cmp eax, 2
jne 0x58d90f
push 0
call fcn.005938a3
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x58d952
mov edx, dword [esp + 0x10]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 0x10]
push edx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x458
ret
cmp eax, 4
jne 0x58d973
mov eax, dword [esp + 0x10]
push eax
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x458
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push edx
mov dword [esp + 0x10], ecx
call esi
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x458
ret