joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fa735
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x687640]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov eax, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x48], ecx
mov byte [ebp + eax - 0x44], bl
inc eax
cmp eax, 0x40
jb 0x4fa757
cmp edi, 0x40
jbe 0x4fa785
push esi
call fcn.004f9a2b
push edi
push dword [ebp - 0x48]
push esi
call fcn.004f9a5d
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.004f9113
add esp, 0x18
jmp 0x4fa797
test edi, edi
je 0x4fa797
push edi
push ecx
lea eax, [ebp - 0x44]
push eax
call fcn.005683f0
add esp, 0xc
mov eax, ebx
xor byte [ebp + eax - 0x44], 0x36
inc eax
cmp eax, 0x40
jb 0x4fa799
push esi
call fcn.004f9a2b
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.004f9a5d
add esp, 0x10
xor byte [ebp + ebx - 0x44], 0x6a
inc ebx
cmp ebx, 0x40
jb 0x4fa7b9
add esi, 0x60
push esi
call fcn.004f9a2b
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.004f9a5d
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00530cbe
leave
ret 8

Function at 0x4fb9ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x18]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0xc], eax
xor eax, eax
mov word [esi], ax
cmp byte [edi + 1], al
je 0x4fba6a
mov bl, byte [edi + 2]
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x24]
call fcn.004b11d7
movzx eax, byte [edi + 4]
mov ecx, esi
push eax
push 0x800
call fcn.004fbacf
mov eax, dword [edi + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x6c], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x7c], eax
mov al, byte [edi + 3]
mov byte [esi + 0x80], al
jmp 0x4fba73
mov ecx, esi
call fcn.004e4b99
mov bl, al
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x38]
mov dword [esi + 0x48], ecx
mov ecx, dword [edx + 0x3c]
mov dword [esi + 0x4c], ecx
xor ecx, ecx
mov dword [esi + 0x40], 0x3f
mov byte [esi + 5], cl
test bl, bl
jne 0x4fba9e
mov eax, dword [ebp + 0xc]
mov byte [ebp + 0x14], 1
cmp byte [eax + 0x24], cl
jne 0x4fbaa1
mov byte [ebp + 0x14], cl
push dword [ebp + 0x14]
mov ecx, esi
push 1
call fcn.004fbacf
test bl, bl
je 0x4fbaca
xor eax, eax
mov byte [esi + 4], 0x14
mov word [esi + 2], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4fe87f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x4fe892
xor eax, eax
jmp 0x4fe91c
lea eax, [esi + 0x30]
push edi
push eax
call fcn.004ee96a
pop ecx
test eax, eax
jne 0x4fe918
xor edi, edi
lea eax, [esi + 0x14]
inc edi
push eax
mov dword [esi + 0x28], edi
call fcn.004ee943
pop ecx
test eax, eax
jne 0x4fe918
lea eax, [esi + 0x18]
push eax
call fcn.004ee943
pop ecx
test eax, eax
jne 0x4fe918
lea eax, [esi + 0x1c]
push eax
call fcn.004ee943
pop ecx
test eax, eax
jne 0x4fe918
push dword [ebp + 0x14]
lea eax, [esi + 0x20]
push dword [ebp + 0x14]
push eax
call fcn.004eea9a
add esp, 0xc
test eax, eax
jne 0x4fe918
push dword [ebp + 0x14]
push eax
lea eax, [esi + 0x24]
push eax
call fcn.004eea9a
add esp, 0xc
test eax, eax
jne 0x4fe918
push dword [ebp + 0x10]
lea eax, [esi + 0x10]
mov dword [esi + 4], edi
push dword [ebp + 0xc]
push eax
call fcn.004eeaf9
add esp, 0xc
test eax, eax
jne 0x4fe918
mov dword [esi], edi
jmp 0x4fe91b
push 0xc
pop eax
pop edi
pop esi
pop ebp
ret

Function at 0x4fead9
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
cmp dword [ebx], 0
jne 0x4feaf0
push ebx
call fcn.004ee943
pop ecx
test eax, eax
jne 0x4feb32
push edi
lea edi, [esi + 8]
cmp dword [edi], 0
jne 0x4feb04
push edi
call fcn.004ee943
pop ecx
test eax, eax
jne 0x4feb31
push ebx
call fcn.004ee9de
push edi
call fcn.004ee9de
lea eax, [esi + 0xc]
mov byte [esi + 0x10], 0
cmp dword [eax], 0
pop ecx
pop ecx
je 0x4feb22
xor eax, eax
jmp 0x4feb31
push esi
push 0x4fea9b
push eax
call fcn.004eeaf9
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x505cd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x687640]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.004b13e1
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb al, al
xor ecx, ebp
inc al
pop esi
call fcn.00530cbe
leave
ret

Function at 0x505f8a
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x506769
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
pop ebp
ret

Function at 0x506a7d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x687640]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.004b13e1
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb al, al
xor ecx, ebp
inc al
pop esi
call fcn.00530cbe
leave
ret
Function at 0x50c370
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], 0
jne 0x50c388
mov dword [ebp - 8], 0x628190
jmp 0x50c38f
mov dword [ebp - 8], 0x628198
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0
je 0x50c3cc
mov dword [ebp - 0xc], 1
jmp 0x50c3d3
mov dword [ebp - 0xc], 0
movzx eax, byte [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x50cc70
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x687640]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x35], 0
push 0x30
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.00870b9c
add esp, 0xc
mov dword [ebp - 0x3c], 0x30
push 0
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x34]
push edx
push 0
push 5
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x50ccdf
mov dword [ebp - 0x44], 0
push 0xa
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.00595758
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov byte [ebp - 0x35], 1
movzx eax, byte [ebp - 0x35]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00530cbe
mov esp, ebp
pop ebp
ret 4

Function at 0x50cd90
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x687640]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x38], 0
push 0x30
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.00870b9c
add esp, 0xc
mov dword [ebp - 0x3c], 0x30
push 0
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x34]
push edx
push 0
push 0x13
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x50cdfc
mov dword [ebp - 0x44], 0
push 0xa
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.00595758
add esp, 0xc
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00530cbe
mov esp, ebp
pop ebp
ret
Function at 0x50d1d0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6057bd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x687640]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x28]
call fcn.007803fa
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.0050ca20
movzx ecx, al
test ecx, ecx
jne 0x50d25c
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 8]
call fcn.0073eb2a
mov eax, dword [ebp - 0x3c]
or eax, 1
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.007302b1
mov eax, dword [ebp + 8]
jmp 0x50d366
mov ecx, dword [ebp - 0x30]
call fcn.0050cd90
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x30]
cmp dword [edx + 4], 0x194
jne 0x50d28b
mov dword [ebp - 0x40], 5
push 0x677160
lea eax, [ebp - 0x40]
push eax
call fcn.00861949
push 0x1000
call fcn.00883f95
add esp, 4
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x29], 0
mov ecx, 1
test ecx, ecx
je 0x50d323
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x50d2bf
jmp 0x50d323
cmp dword [ebp - 0x38], 0
ja 0x50d2cb
mov byte [ebp - 0x29], 1
jmp 0x50d323
cmp dword [ebp - 0x38], 0x1000
jbe 0x50d2ef
mov edx, dword [ebp - 0x34]
push edx
call fcn.0088c622
add esp, 4
mov eax, dword [ebp - 0x38]
push eax
call fcn.00883f95
add esp, 4
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x50d30e
jmp 0x50d323
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x28]
call int.00732cbb
jmp 0x50d29f
mov edx, dword [ebp - 0x34]
push edx
call fcn.0088c622
add esp, 4
movzx eax, byte [ebp - 0x29]
test eax, eax
jne 0x50d33f
lea ecx, [ebp - 0x28]
call fcn.0050d580
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0073eb2a
mov edx, dword [ebp - 0x3c]
or edx, 1
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.007302b1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00530cbe
mov esp, ebp
pop ebp
ret 0x14
Function at 0x50d390
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6057fd
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x687640]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x4c]
add ecx, 0x24
call fcn.00863e31
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x60]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.0050a430
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.007302b1
push 0xa0000000
lea ecx, [ebp - 0x28]
call fcn.00855730
push eax
lea ecx, [ebp - 0x28]
call fcn.0083b0bd
push eax
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
cmp dword [ebp + 8], 0
jne 0x50d42c
mov dword [ebp - 0x50], 0
jmp 0x50d43b
mov eax, dword [ebp + 8]
push eax
call fcn.0087dc68
add esp, 4
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x48], ecx
cmp dword [ebp + 0xc], 0
jne 0x50d48e
push 0
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
cmp eax, 1
jne 0x50d474
mov dword [ebp - 0x54], 1
jmp 0x50d47b
mov dword [ebp - 0x54], 0
mov cl, byte [ebp - 0x54]
mov byte [ebp - 0x41], cl
lea ecx, [ebp - 0x28]
call fcn.004065c0
mov al, byte [ebp - 0x41]
jmp 0x50d4d5
push 0
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
cmp eax, 1
jne 0x50d4bd
mov dword [ebp - 0x58], 1
jmp 0x50d4c4
mov dword [ebp - 0x58], 0
mov dl, byte [ebp - 0x58]
mov byte [ebp - 0x42], dl
lea ecx, [ebp - 0x28]
call fcn.004065c0
mov al, byte [ebp - 0x42]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00530cbe
mov esp, ebp
pop ebp
ret 8
Function at 0x53b321
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x53b348
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x53b34b
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0053b2fd
pop esi
leave
ret 8

Function at 0x5549d1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.005b000f
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x554a10
sub eax, 1
je 0x554a0b
sub eax, 1
je 0x554a07
xor eax, eax
leave
ret
push 3
jmp 0x554a12
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x5573da
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x557419
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x557419
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x557419
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x557419
cmp dword [ecx + 0x74], 0xe
jbe 0x557419
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x55eb8f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x55ebbd
cmp eax, edi
jge 0x55ebb1
push esi
call fcn.0055b7cb
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x55ebe0
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x55ebc6
mov dword [esi + 8], edx
jmp 0x55ebf5
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x55ebeb
xor dl, dl
jmp 0x55ebf0
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x55ebe0
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x55ec2e
mov dword [0x693a08], str.zlib_corrupt
xor eax, eax
jmp 0x55ec70
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x55ec43
mov dword [0x693a08], str.read_past_buffer
jmp 0x55ec2a
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x55ec5a
push edi
push esi
call fcn.005613e0
pop ecx
pop ecx
test eax, eax
je 0x55ec2a
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.005683f0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x591e96
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x687640]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x6364d0
push esi
call fcn.005b9d07
pop ecx
pop ecx
test eax, eax
jne 0x591ec4
xor al, al
jmp 0x591f41
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.00591ad8
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x591efe
push dword [ebp - 0x210]
call fcn.0088c622
xor al, al
jmp 0x591f3f
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x591f04
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x591f24
push edx
call fcn.00591dcd
pop ecx
test al, al
je 0x591eef
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x591f32
mov bl, 1
push dword [ebp - 0x210]
call fcn.0088c622
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00530cbe
leave
ret

Function at 0x5a4f28
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5a4f67
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5a4f67
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5a4f67
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x5a4f67
cmp dword [ecx + 0x74], 0xe
jbe 0x5a4f67
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x5b596a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0085955d
mov eax, dword [0x687640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.005aaa4e
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x5b59ac
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x5b5b08
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00556ae0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x6947e8]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.005bd111
mov ecx, dword [esi*4 + 0x6947e8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x5b5b01
cmp eax, dword [ecx + edi + 0x24]
jne 0x5b5b01
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5b5b01
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005bd111
add esp, 0x14
test edx, edx
jl 0x5b5b01
jg 0x5b5a77
test eax, eax
jb 0x5b5b01
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x5b5b01
jl 0x5b5a91
cmp dword [ebp - 0x1008], eax
ja 0x5b5b01
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x5b5aaf
test ebx, ebx
je 0x5b5ae8
cmp ecx, edi
jae 0x5b5ae8
mov al, byte [ecx]
cmp al, 0xd
jne 0x5b5ac9
lea eax, [edi - 1]
cmp ecx, eax
jae 0x5b5ad5
cmp byte [ecx + 1], 0xa
jne 0x5b5ad5
inc ecx
jmp 0x5b5ad5
movzx eax, al
movsx eax, byte [eax + 0x687c10]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x5b5aaf
cmp edx, ebx
jne 0x5b5aaf
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x5b5b06
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00530cbe
leave
ret

Function at 0x5b7340
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x638e84
push 0x638e7c
push str.FlsAlloc
push 0x1f
call fcn.005b700e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5b7374
push dword [ebp + 8]
mov ecx, esi
call dword [0x60d784]
call esi
jmp 0x5b737a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x5b73be
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x638e94
push 0x638e8c
push str.FlsGetValue
push 0x21
call fcn.005b700e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5b73f5
push dword [ebp + 8]
mov ecx, esi
call dword [0x60d784]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x5b73fd
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x638e9c
push 0x638e94
push str.FlsSetValue
push 0x22
call fcn.005b700e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5b7437
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x60d784]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x5bc28b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x6947e8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x5bc2cb
cmp byte [ebx], 0xa
jne 0x5bc2cb
or byte [edi + eax + 0x28], 4
jmp 0x5bc2d0
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x5bc3cf
mov dl, byte [eax]
cmp dl, 0x1a
je 0x5bc3b2
inc eax
cmp dl, 0xd
je 0x5bc2fc
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x5bc322
cmp eax, ecx
jae 0x5bc330
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x5bc2e4
jmp 0x5bc3cf
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5bc3ad
cmp dword [ebp - 0x10], 0
je 0x5bc3ad
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x6947e8]
test byte [eax + edi + 0x28], 0x48
je 0x5bc387
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x5bc372
mov byte [esi], dl
jmp 0x5bc383
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x6947e8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x5bc3cf
cmp byte [ebp - 1], 0xa
jne 0x5bc396
cmp esi, ebx
jne 0x5bc396
mov byte [esi], 0xa
jmp 0x5bc3ce
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.005bd12f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x5bc3cf
mov byte [esi], 0xd
jmp 0x5bc3ce
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x6947e8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x5bc3cc
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x5bc3cf
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret