joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f359
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
je 0x41f3df
cmp dword [ebp + 8], 0
je 0x41f3df
cmp dword [ebp + 0xc], 0
je 0x41f3df
mov ecx, dword [ebp - 0xc]
add ecx, 4
push ecx
push 0xf003f
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41f3d7
mov edx, dword [ebp - 0xc]
cmp dword [edx + 4], 0
je 0x41f3d7
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41f3d7
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0xc]
call sym.PcMFStation.exe_private:_void___thiscall_CRegOpe::CloseKeyProc_void_
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xcef143b
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x110410a4
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x443b51
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push 0x40135c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x443bc1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x4051c0
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x443bb8
cmp dword [ebp - 0xc], 4
jne 0x443bb8
cmp dword [ebp - 0x10], edi
je 0x443bb8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5f6298], edi
xor eax, eax
jmp 0x443c00
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x5f6298], edi
jge 0x443bfb
lea eax, [ebp - 0x34]
push eax
mov dword [0x5f6298], edi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x443bfb
cmp word [ebp - 0x14], 5
jb 0x443bfb
call fcn.0055dace
test eax, eax
je 0x443bfb
emms
mov dword [0x5f6298], 1
mov eax, dword [0x5f6298]
pop edi
leave
ret

Function at 0x4cdd0c
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x60e890]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x20]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 0x24]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
je 0x4cde09
mov edi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
xor esi, esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ebx
push esi
push esi
call edi
mov dword [ebp - 0xac], eax
add eax, 3
and eax, 0xfffffffc
call fcn.005f00d0
cmp dword [ebp - 0xac], esi
mov dword [ebp - 0xa8], esp
jne 0x4cddba
push 0x40604c
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, 0x8876086c
jmp 0x4cde34
push esi
push esi
push dword [ebp - 0xac]
push dword [ebp - 0xa8]
push 0xffffffffffffffff
push ebx
push esi
push esi
call edi
fld dword [ebp + 0x18]
push dword [ebp - 0xa4]
push dword [ebp - 0x9c]
push dword [ebp - 0xa0]
push ecx
push ecx
fstp dword [esp + 4]
fld dword [ebp + 0x14]
fstp dword [esp]
push dword [ebp - 0xa8]
push dword [ebp - 0xb0]
push dword [ebp - 0xb4]
call fcn.0055dace
jmp 0x4cde34
fld dword [ebp + 0x18]
push 1
push dword [ebp - 0xa4]
push dword [ebp - 0x9c]
push dword [ebp - 0xa0]
push ecx
push ecx
fstp dword [esp + 4]
fld dword [ebp + 0x14]
fstp dword [esp]
push ebx
push edi
push esi
call fcn.0055dace
lea esp, [ebp - 0xc0]
mov ecx, dword [ebp - 4]
call fcn.005f059d
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0x55dace
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x55dadd
pop dword [ebp - 0x48]
mov eax, 0x4cc157f0
sub eax, 0x4c6b7d13
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x711ea
push 0
mov eax, 0x1dbdbd6a
sub eax, 0x1d7dac8a
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x4efe
mov esi, eax
mov edi, 0xfd3dde79
sub edi, 0xfcda6a79
add edi, dword [ebp - 0x48]
mov edx, 0x258d8fd
add edx, 0x505d7361
sub dword [ebp - 0x44], ebx
mov ebx, dword [edi]
sub dword [ebp - 0x3c], 0x8044ec8c
add ebx, edx
xor dword [ebp - 0x30], edi
mov dword [esi], ebx
xor dword [ebp - 0x44], edx
add esi, 0x87da4634
add esi, 0x7825b9d0
add edi, 0xa0b2b4d7
add edi, 0x5f4d4b2d
loop 0x55db36
add eax, 0x2c5aad8
add eax, 0xfd3b83f3
mov ebx, eax
add eax, 0x526e4f3f
add eax, 0xad91b0c6
mov ecx, 0x7fda4978
add ecx, 0x8065b688
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x585395
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 4], edi
je 0x585479
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x585479
push 0x4213a8
push dword [ebp + 8]
call sub.msvcrt.dll_fopen
mov ebx, eax
cmp ebx, edi
pop ecx
pop ecx
je 0x585479
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x18]
push ebx
push 6
mov dword [ebp - 8], eax
lea eax, [ebp - 0x1c]
push 4
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp eax, 6
je 0x585425
mov edi, 0x8876086c
jmp 0x585462
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x1c]
push edi
push esi
call dword [eax + 0x28]
mov edi, eax
test edi, edi
jl 0x585462
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
push ebx
push dword [ebp - 0x1c]
shl eax, 2
push eax
push dword [ebp - 4]
call sub.msvcrt.dll_fwrite
mov edi, dword [ebp - 0x1c]
sub edi, eax
add esp, 0x10
neg edi
sbb edi, edi
and edi, 0x8876086c
push ebx
call sub.msvcrt.dll_fclose
cmp dword [ebp - 4], 0
pop ecx
je 0x585475
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov eax, edi
jmp 0x58547e
mov eax, 0x8876086c
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x585fb3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
push esi
xor esi, esi
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
je 0x5860ec
cmp dword [ebp + 0xc], ebx
je 0x5860ec
push 0x4213b0
push dword [ebp + 8]
call sub.msvcrt.dll_fopen
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp + 8], eax
je 0x5860ec
push edi
push eax
push 6
lea eax, [ebp - 0x1c]
push 4
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
cmp eax, 6
jne 0x5860ce
cmp dword [ebp - 0x1c], ebx
je 0x5860ce
cmp dword [ebp - 0x18], ebx
je 0x5860ce
cmp dword [ebp - 0x14], ebx
je 0x5860ce
cmp dword [ebp - 8], ebx
je 0x58603b
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jne 0x5860ce
push 0x2c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x586052
mov ecx, eax
call fcn.00585ea3
mov esi, eax
jmp 0x586054
xor esi, esi
cmp esi, ebx
jne 0x58605f
mov edi, 0x8007000e
jmp 0x5860d3
cmp dword [ebp - 8], ebx
push dword [ebp - 0x14]
mov ecx, esi
push dword [ebp - 0x18]
je 0x586079
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.0055dace
jmp 0x586081
push dword [ebp - 0x1c]
call fcn.0055dace
mov edi, eax
cmp edi, ebx
mov eax, dword [esi]
jge 0x586092
push 1
mov ecx, esi
call dword [eax + 0x4c]
jmp 0x5860d3
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x1c]
push ebx
push esi
call dword [eax + 0x28]
mov edi, eax
cmp edi, ebx
jl 0x5860d3
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
push dword [ebp + 8]
shl eax, 2
push dword [ebp - 0x1c]
push eax
push dword [ebp - 4]
call sub.msvcrt.dll_fread
add esp, 0x10
cmp dword [ebp - 0x1c], eax
jne 0x5860ce
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor edi, edi
jmp 0x5860d3
mov edi, 0x8876086c
cmp dword [ebp - 4], ebx
je 0x5860de
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
push dword [ebp + 8]
call sub.msvcrt.dll_fclose
pop ecx
mov eax, edi
pop edi
jmp 0x5860f1
mov eax, 0x8876086c
pop esi
pop ebx
leave
ret 8
Function at 0x5860fc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x60e890]
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, ebx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], 0x72
mov word [ebp - 0xa], 0x62
mov word [ebp - 8], bx
je 0x586251
cmp ecx, ebx
je 0x586251
lea ecx, [ebp - 0xc]
push ecx
push eax
call sub.msvcrt.dll__wfopen
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
je 0x586251
push edi
push eax
push 6
lea eax, [ebp - 0x28]
push 4
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
cmp eax, 6
jne 0x586233
cmp dword [ebp - 0x28], ebx
je 0x586233
cmp dword [ebp - 0x24], ebx
je 0x586233
cmp dword [ebp - 0x20], ebx
je 0x586233
cmp dword [ebp - 0x14], ebx
je 0x5861a0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x28]
jne 0x586233
push 0x2c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x5861b7
mov ecx, eax
call fcn.00585ea3
mov esi, eax
jmp 0x5861b9
xor esi, esi
cmp esi, ebx
jne 0x5861c4
mov edi, 0x8007000e
jmp 0x586238
cmp dword [ebp - 0x14], ebx
push dword [ebp - 0x20]
mov ecx, esi
push dword [ebp - 0x24]
je 0x5861de
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0055dace
jmp 0x5861e6
push dword [ebp - 0x28]
call fcn.0055dace
mov edi, eax
cmp edi, ebx
mov eax, dword [esi]
jge 0x5861f7
push 1
mov ecx, esi
call dword [eax + 0x4c]
jmp 0x586238
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x28]
push ebx
push esi
call dword [eax + 0x28]
mov edi, eax
cmp edi, ebx
jl 0x586238
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x24]
push dword [ebp - 0x2c]
shl eax, 2
push dword [ebp - 0x28]
push eax
push dword [ebp - 0x10]
call sub.msvcrt.dll_fread
add esp, 0x10
cmp dword [ebp - 0x28], eax
jne 0x586233
mov eax, dword [ebp - 0x30]
mov dword [eax], esi
xor edi, edi
jmp 0x586238
mov edi, 0x8876086c
cmp dword [ebp - 0x10], ebx
je 0x586243
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
push dword [ebp - 0x2c]
call sub.msvcrt.dll_fclose
pop ecx
mov eax, edi
pop edi
jmp 0x586256
mov eax, 0x8876086c
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.005f059d
leave
ret 8
Function at 0x586f09
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 8], esi
je 0x58707b
cmp dword [ebp + 0xc], esi
je 0x58707b
push 0x4213b0
push dword [ebp + 8]
call sub.msvcrt.dll_fopen
cmp eax, esi
pop ecx
pop ecx
mov dword [ebp + 8], eax
je 0x58707b
push ebx
push eax
push 8
lea eax, [ebp - 0x2c]
push 4
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
cmp eax, 8
je 0x586f64
mov ebx, 0x8876086c
jmp 0x58706d
cmp dword [ebp - 0x2c], esi
push edi
je 0x587059
cmp dword [ebp - 0x28], esi
je 0x587059
cmp dword [ebp - 0x24], esi
je 0x587059
cmp dword [ebp - 0x18], esi
je 0x586f95
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x2c]
jne 0x587059
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
push 0x38
mov dword [ebp - 4], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x586fb3
mov ecx, eax
call fcn.00586e58
mov esi, eax
test esi, esi
mov dword [ebp - 8], esi
jne 0x586fc4
mov ebx, 0x8007000e
jmp 0x58705e
push dword [ebp - 0x18]
mov ecx, esi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0055dace
mov ebx, eax
test ebx, ebx
jl 0x58705e
mov ecx, dword [esi + 0x20]
push dword [ebp + 8]
mov eax, dword [esi + 0x18]
push dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov ebx, dword [esi + 0x1c]
lea ecx, [edi + 1]
imul ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x28]
shl ecx, 2
push ecx
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
cmp dword [ebp - 4], eax
jne 0x587059
push dword [ebp + 8]
mov eax, edi
push dword [ebp - 0x2c]
shl eax, 2
push eax
push ebx
call sub.msvcrt.dll_fread
add esp, 0x10
cmp dword [ebp - 0x2c], eax
jne 0x587059
cmp dword [ebp - 4], 1
je 0x587050
push dword [ebp + 8]
push dword [ebp - 0x2c]
push 4
push dword [ebp - 0xc]
call sub.msvcrt.dll_fread
add esp, 0x10
cmp dword [ebp - 0x2c], eax
jne 0x587059
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor ebx, ebx
jmp 0x58706c
mov ebx, 0x8876086c
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x58706c
mov eax, dword [ecx]
push 1
call dword [eax + 0x44]
pop edi
push dword [ebp + 8]
call sub.msvcrt.dll_fclose
pop ecx
mov eax, ebx
pop ebx
jmp 0x587080
mov eax, 0x8876086c
pop esi
leave
ret 8
Function at 0x58708a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x60e890]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x18], esi
mov word [ebp - 0xc], 0x72
mov word [ebp - 0xa], 0x62
mov word [ebp - 8], si
je 0x587218
cmp ecx, esi
je 0x587218
lea ecx, [ebp - 0xc]
push ecx
push eax
call sub.msvcrt.dll__wfopen
cmp eax, esi
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
je 0x587218
push ebx
push eax
push 8
lea eax, [ebp - 0x38]
push 4
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
cmp eax, 8
je 0x587101
mov ebx, 0x8876086c
jmp 0x58720a
cmp dword [ebp - 0x38], esi
push edi
je 0x5871f6
cmp dword [ebp - 0x34], esi
je 0x5871f6
cmp dword [ebp - 0x30], esi
je 0x5871f6
cmp dword [ebp - 0x24], esi
je 0x587132
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x38]
jne 0x5871f6
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
push 0x38
mov dword [ebp - 0x14], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x587150
mov ecx, eax
call fcn.00586e58
mov esi, eax
test esi, esi
mov dword [ebp - 0x18], esi
jne 0x587161
mov ebx, 0x8007000e
jmp 0x5871fb
push dword [ebp - 0x24]
mov ecx, esi
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.0055dace
mov ebx, eax
test ebx, ebx
jl 0x5871fb
mov ecx, dword [esi + 0x20]
push dword [ebp - 0x10]
mov eax, dword [esi + 0x18]
push dword [ebp - 0x14]
mov dword [ebp - 0x3c], ecx
mov ebx, dword [esi + 0x1c]
lea ecx, [edi + 1]
imul ecx, dword [ebp - 0x30]
imul ecx, dword [ebp - 0x34]
shl ecx, 2
push ecx
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
cmp dword [ebp - 0x14], eax
jne 0x5871f6
push dword [ebp - 0x10]
mov eax, edi
push dword [ebp - 0x38]
shl eax, 2
push eax
push ebx
call sub.msvcrt.dll_fread
add esp, 0x10
cmp dword [ebp - 0x38], eax
jne 0x5871f6
cmp dword [ebp - 0x14], 1
je 0x5871ed
push dword [ebp - 0x10]
push dword [ebp - 0x38]
push 4
push dword [ebp - 0x3c]
call sub.msvcrt.dll_fread
add esp, 0x10
cmp dword [ebp - 0x38], eax
jne 0x5871f6
mov eax, dword [ebp - 0x40]
mov dword [eax], esi
xor ebx, ebx
jmp 0x587209
mov ebx, 0x8876086c
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x587209
mov eax, dword [ecx]
push 1
call dword [eax + 0x44]
pop edi
push dword [ebp - 0x10]
call sub.msvcrt.dll_fclose
pop ecx
mov eax, ebx
pop ebx
jmp 0x58721d
mov eax, 0x8876086c
mov ecx, dword [ebp - 4]
pop esi
call fcn.005f059d
leave
ret 8