joyce8/EMBER2024-capa huggingface dataset:
Function at 0x556095
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00556011
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x556204
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x556204
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x5561b9
jg 0x5560f1
test eax, eax
je 0x5561af
push 1
push 0x1000
call fcn.00549a0d
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x556114
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x5561a6
push 0x8000
push ebx
call fcn.00543418
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x55613d
jg 0x556138
cmp ecx, 0x1000
jb 0x55613d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.005497f1
add esp, 0x10
cmp eax, 0xffffffff
je 0x556182
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x556138
jl 0x556169
test ecx, ecx
jne 0x55612a
push dword [ebp - 0xc]
push ebx
call fcn.00543418
push esi
call fcn.0054717d
add esp, 0xc
xor ebx, ebx
jmp 0x556212
cmp byte [edi + 0x24], 0
je 0x556199
cmp dword [edi + 0x20], 5
jne 0x556199
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x5561a4
mov ebx, dword [edi + 0x18]
jmp 0x5561a6
xor ebx, ebx
push esi
call fcn.0054717d
pop ecx
jmp 0x556212
test ecx, ecx
jg 0x55617b
jl 0x5561b9
test eax, eax
jae 0x55617b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00549eb2
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x5561d9
cmp byte [edi + 0x1c], 0
je 0x55617b
jmp 0x55620a
push ebx
call fcn.00538650
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x55617b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x556212
cmp byte [edi + 0x1c], 0
je 0x55620f
mov ebx, dword [edi + 0x18]
jmp 0x556212
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00549eb2
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5597c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0
call fcn.00561240
mov esi, dword [ebp + 0xc]
add esp, 4
cmp dword [esi], eax
jne 0x559949
mov ebx, dword [ebp + 8]
push 0
push ebx
call fcn.004d9740
push esi
mov dword [ebp - 0x24], 0x20
mov dword [ebp - 0x20], 0x83f000
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x18], 0
call fcn.004d95b0
add esp, 0xc
test al, al
je 0x55995d
lea eax, [ebp - 0x24]
push eax
call fcn.004d95b0
add esp, 4
test al, al
je 0x559971
mov edi, dword [esi]
cmp edi, dword [ebp - 0x24]
je 0x559847
push 0x22
call fcn.004d86d0
add esp, 4
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
mov byte [ebp - 1], 0
mov byte [ebp + 0xf], 1
test edi, edi
je 0x5598a4
mov edx, dword [ebp - 0x20]
mov ebx, eax
sub ebx, edx
nop dword [eax]
movzx eax, byte [ebx + edx]
lea edx, [edx + 1]
mov dword [ebp - 0xc], eax
movzx eax, byte [edx - 1]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
movzx ecx, byte [ebp + 0xf]
sar eax, 0x1f
and ecx, eax
mov al, byte [ebp - 1]
or al, cl
mov byte [ebp - 1], al
mov ecx, dword [ebp - 8]
xor ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0xf]
dec ecx
sar ecx, 0x1f
and al, cl
and al, 1
mov byte [ebp + 0xf], al
sub edi, 1
jne 0x559860
mov ebx, dword [ebp + 8]
mov al, byte [ebp + 0xf]
movzx ecx, al
movzx eax, byte [ebp - 1]
add eax, ecx
movzx ecx, byte [ebp - 1]
add ecx, eax
cmp ecx, 1
jbe 0x5598c7
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.004d9da0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push ebx
mov dword [ebp - 0x10], edx
call fcn.004d9070
add esp, 0xc
test eax, eax
je 0x5598f0
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.004d95b0
add esp, 4
test al, al
je 0x559985
mov esi, dword [ebx]
xor edx, edx
mov edi, dword [ebx + 4]
mov dword [ebp - 0xc], 1
test esi, esi
je 0x559940
mov ecx, esi
sub ecx, edx
inc edx
movzx eax, byte [ecx + edi - 1]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
shr eax, 8
and eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov byte [ecx + edi - 1], al
cmp edx, esi
jb 0x559913
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0xee
push str.D:_sdk_cpp_workspace_win32_aws_iot_device_sdk_cpp_v2crt_aws_crt_cppcrt_aws_c_auth_sourcekey_derivation.c
push str.k0__len__aws_ecc_key_coordinate_byte_size_from_curve_name_AWS_CAL_ECDSA_P256_
call fcn.004d8990
push 0x9d
push str.D:_sdk_cpp_workspace_win32_aws_iot_device_sdk_cpp_v2crt_aws_crt_cppcrt_aws_c_auth_sourcekey_derivation.c
push str.aws_byte_buf_is_valid_lhs_raw_be_bigint_
call fcn.004d8990
push 0x9e
push str.D:_sdk_cpp_workspace_win32_aws_iot_device_sdk_cpp_v2crt_aws_crt_cppcrt_aws_c_auth_sourcekey_derivation.c
push str.aws_byte_buf_is_valid_rhs_raw_be_bigint_
call fcn.004d8990
push 0xc6
push str.D:_sdk_cpp_workspace_win32_aws_iot_device_sdk_cpp_v2crt_aws_crt_cppcrt_aws_c_auth_sourcekey_derivation.c
push str.aws_byte_buf_is_valid_raw_be_bigint_
call fcn.004d8990
int3
Function at 0x563360
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push edi
mov ebx, dword [ebx]
lea ecx, [ebx + 2]
cmp ecx, ebx
jb 0x5634d2
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
mov dword [ebp - 0x10], eax
lea edi, [eax*4 + 1]
cmp edi, eax
jb 0x5634d2
mov ecx, dword [ebp + 0xc]
mov eax, edi
push esi
not eax
mov esi, dword [ecx]
mov dword [ebp - 8], esi
cmp esi, eax
jbe 0x5633ba
push 5
call fcn.004d86d0
add esp, 4
or eax, 0xffffffff
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + edi]
cmp dword [ecx + 8], eax
jae 0x5633d6
push 4
call fcn.004d86d0
add esp, 4
or eax, 0xffffffff
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [edi - 1]
mov edi, ebx
mov dword [ebp - 0x14], eax
mov eax, 0xaaaaaaab
mul ebx
shr edx, 1
lea eax, [edx + edx*2]
sub edi, eax
mov dword [ebp - 0xc], edi
test ebx, ebx
je 0x56349c
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 4]
add esi, ecx
lea ecx, [ebx - 1]
mov edx, dword [eax + 4]
or eax, 0xffffffff
sub eax, edx
mov dword [ebp - 4], eax
mov eax, 0xaaaaaaab
lea edi, [edx + 2]
mul ecx
mov eax, edx
mov edx, 2
shr eax, 1
inc eax
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
movzx eax, byte [edi - 2]
add ecx, edi
shl eax, 8
cmp ecx, ebx
jae 0x56343a
movzx ecx, byte [edi - 1]
or eax, ecx
shl eax, 8
cmp edx, ebx
jae 0x563446
movzx ecx, byte [edi]
or eax, ecx
mov ecx, eax
add edx, 3
shr ecx, 0x12
add edi, 3
movzx ecx, byte [ecx + 0x75edb0]
mov byte [esi], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x75edb0]
mov byte [esi + 1], cl
mov ecx, eax
shr ecx, 6
and eax, 0x3f
and ecx, 0x3f
mov al, byte [eax + 0x75edb0]
movzx ecx, byte [ecx + 0x75edb0]
mov byte [esi + 2], cl
mov byte [esi + 3], al
add esi, 4
sub dword [ebp + 8], 1
jne 0x563424
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x5634b8
mov eax, dword [ecx + 4]
mov edx, dword [ebp - 0x10]
lea eax, [eax + edx*4]
mov byte [eax + esi - 1], 0x3d
cmp edi, 1
jne 0x5634b8
mov byte [eax + esi - 2], 0x3d
mov eax, dword [ecx + 4]
mov edx, dword [ebp - 0x14]
add eax, esi
mov byte [eax + edx], 0
lea eax, [esi + edx]
pop esi
pop edi
mov dword [ecx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 5
call fcn.004d86d0
add esp, 4
or eax, 0xffffffff
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x584e30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x83e264]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.004db1d0
mov esi, eax
test esi, esi
je 0x584e7a
mov ecx, dword [esi]
push 0x404
push esi
mov ecx, dword [ecx + 4]
call ecx
add esp, 8
cmp eax, 5
jl 0x584e7a
mov eax, dword [esi]
push str.static:_This_library_was_built_with_Windows_8.1_or_later__probing_OS_to_see_what_were_actually_running_on.
push 0x404
push 5
mov eax, dword [eax]
push esi
call eax
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edi
push 3
push 2
push 0
push 0
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push 0x9c
mov edi, eax
mov esi, edx
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.00520480
add esp, 0xc
mov dword [ebp - 0x9c], 6
xor eax, eax
mov dword [ebp - 0x98], 2
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x9c
push esi
push edi
push 0x33
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
pop edi
test eax, eax
je 0x584f3e
call fcn.004db1d0
mov esi, eax
test esi, esi
je 0x584f2d
mov ecx, dword [esi]
push 0x404
push esi
mov ecx, dword [ecx + 4]
call ecx
add esp, 8
cmp eax, 5
jl 0x584f2d
mov eax, dword [esi]
push str.static:_Were_running_on_Windows_8.1_or_later._ALPN_is_available.
push 0x404
push 5
mov eax, dword [eax]
push esi
call eax
add esp, 0x10
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051deb6
mov esp, ebp
pop ebp
ret
call fcn.004db1d0
mov esi, eax
test esi, esi
je 0x584f74
mov ecx, dword [esi]
push 0x404
push esi
mov ecx, dword [ecx + 4]
call ecx
add esp, 8
cmp eax, 3
jl 0x584f74
mov eax, dword [esi]
push str.static:_Running_on_older_version_of_windows__ALPN_is_not_supported._Please_update_your_OS_to_take_advantage_of_modern_features.
push 0x404
push 3
mov eax, dword [eax]
push esi
call eax
add esp, 0x10
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0051deb6
mov esp, ebp
pop ebp
ret
Function at 0x596b50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push dword [esi + 0x224]
call fcn.00588290
add esp, 4
test al, al
jne 0x596b7c
push 0x40f
call fcn.004d86d0
add esp, 4
or eax, 0xffffffff
pop esi
pop ebp
ret
test byte [esi + 0x22c], 8
push edi
jne 0x596bd7
call fcn.004db1d0
mov edi, eax
test edi, edi
je 0x596bc3
mov ecx, dword [edi]
push 0x402
push edi
mov ecx, dword [ecx + 4]
call ecx
add esp, 8
cmp eax, 2
jl 0x596bc3
push dword [esi + 0x21c]
mov eax, dword [edi]
push esi
push str.id_p_handle_p:_cannot_write_to_because_it_is_not_connected
push 0x402
mov eax, dword [eax]
push 2
push edi
call eax
add esp, 0x18
push 0x41c
call fcn.004d86d0
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
ret
push ebx
push 0x70
push 1
push dword [esi]
call fcn.004d8260
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x596bfe
pop ebx
pop edi
mov dword [esi + 0x22c], 0x200
or eax, 0xffffffff
pop esi
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x64], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x68], eax
mov eax, dword [ebp + 0xc]
push ebx
push 0x598170
mov eax, dword [eax]
mov dword [ebx + 0x60], eax
mov eax, dword [esi]
mov dword [ebx], eax
lea eax, [ebx + 8]
push eax
mov byte [ebx + 0x58], 1
mov dword [ebx + 4], esi
call fcn.00592ce0
mov ecx, dword [esi + 0x244]
lea edx, [ebx + 0x24]
add ecx, 0x138
add esp, 0xc
mov dword [edx], ecx
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 4]
mov dword [eax], edx
mov dword [ecx + 4], edx
call fcn.004db1d0
mov edi, eax
test edi, edi
je 0x596c92
mov ecx, dword [edi]
push 0x402
push edi
mov ecx, dword [ecx + 4]
call ecx
add esp, 8
cmp eax, 6
jl 0x596c92
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi]
push 0
push dword [ecx]
mov eax, dword [eax]
push dword [esi + 0x21c]
push esi
push str.id_p_handle_p:_queueing_write_of__llu_bytes
push 0x402
push 6
push edi
call eax
add esp, 0x20
lea eax, [ebx + 8]
push eax
call fcn.004815b0
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push 0
push dword [eax]
push dword [eax + 4]
push dword [esi + 0x21c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x596d63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
cmp eax, 0x3e5
je 0x596d63
call fcn.004db1d0
mov edi, eax
test edi, edi
je 0x596d11
mov ecx, dword [edi]
push 0x402
push edi
mov ecx, dword [ecx + 4]
call ecx
add esp, 8
cmp eax, 2
jl 0x596d11
push dword [ebp + 8]
mov eax, dword [edi]
push dword [esi + 0x21c]
push esi
mov eax, dword [eax]
push str.id_p_handle_p:_WriteFile___failed_with_error__d
push 0x402
push 2
push edi
call eax
add esp, 0x1c
mov ecx, dword [ebx + 0x28]
xorps xmm0, xmm0
mov eax, dword [ebx + 0x24]
push ebx
mov dword [ecx], eax
mov ecx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov dword [ecx + 4], eax
movq qword [ebx + 0x24], xmm0
push dword [esi]
call fcn.004d84f0
push dword [ebp + 8]
call fcn.00596e30
cmp eax, 0x41b
mov edx, 0x200
mov ecx, 0x100
cmovne ecx, edx
push eax
mov dword [esi + 0x22c], ecx
call fcn.004d86d0
add esp, 0x10
or eax, 0xffffffff
pop ebx
pop edi
pop esi
pop ebp
ret
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x598710
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov ecx, 0x40
push esi
mov esi, dword [ebp + 0xc]
push edi
lea edi, [ebx + 4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.004db1d0
mov esi, eax
test esi, esi
je 0x598771
mov ecx, dword [esi]
push 0x402
push esi
mov ecx, dword [ecx + 4]
call ecx
add esp, 8
cmp eax, 4
jl 0x598771
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi]
movzx eax, word [edx + 0x100]
push eax
mov eax, dword [ecx]
push edx
push dword [ebx + 0x21c]
push ebx
push str.id_p_handle_p:_binding_to_tcp__s:_d
push 0x402
push 4
push esi
call eax
add esp, 0x20
push 4
lea eax, [ebp + 8]
mov dword [ebp + 8], 1
push eax
push 0xfffffffffffffffb
push 0xffff
push dword [ebx + 0x21c]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x5987e3
call fcn.004db1d0
mov edi, eax
test edi, edi
je 0x598856
mov ecx, dword [edi]
push 0x402
push edi
mov ecx, dword [ecx + 4]
call ecx
add esp, 8
cmp eax, 3
jl 0x598856
mov esi, dword [edi]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [ebx + 0x21c]
mov eax, dword [esi]
push ebx
push str.id_p_handle_p:_setsockopt___call_for_enabling_SO_EXCLUSIVEADDRUSE_failed_with_WSAError__d
push 0x402
push 3
push edi
call eax
add esp, 0x1c
jmp 0x598856
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebx + 0x21c]
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x598808
pop edi
pop esi
mov dword [ebx + 0x22c], 0x20
pop ebx
pop ebp
ret
call fcn.004db1d0
mov edi, eax
test edi, edi
je 0x59884c
mov ecx, dword [edi]
push 0x402
push edi
mov ecx, dword [ecx + 4]
call ecx
add esp, 8
cmp eax, 2
jl 0x59884c
mov esi, dword [edi]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [ebx + 0x21c]
mov eax, dword [esi]
push ebx
push str.id_p_handle_p:_error_binding._error__d
push 0x402
push 2
push edi
call eax
add esp, 0x1c
mov dword [ebx + 0x22c], 0x200
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00596e30
push eax
call fcn.004d86d0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5a3af0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push 0x40
mov dword [esp + 0xc], 0x40
call fcn.0053dc5a
mov esi, eax
add esp, 4
test esi, esi
jne 0x5a3b35
call fcn.004f4dc0
test eax, eax
je 0x5a3b2e
push str.Failure_allocating_sqm_info
push 1
push 0x63
push str._get_win_sqm_info
push str.C:Userslaurence_liuDesktop_vcpkg_2023.02.24_buildtrees_azure_c_shared_utility_src10753faee5_044a82ff07.clean_adaptersplatform_win32.c
push esi
call eax
add esp, 0x18
mov eax, esi
pop esi
add esp, 0xc
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftSQMClient
push reloc.WS2_32.dll_bind
call edi
test eax, eax
je 0x5a3b9a
call fcn.004f4dc0
mov edi, eax
test edi, edi
je 0x5a3b89
push str.SoftwareMicrosoftSQMClient
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failure_opening_registry_key:__d:_s
push 1
push 0x67
push str._get_win_sqm_info
push str.C:Userslaurence_liuDesktop_vcpkg_2023.02.24_buildtrees_azure_c_shared_utility_src10753faee5_044a82ff07.clean_adaptersplatform_win32.c
push 0
call edi
add esp, 0x20
push esi
call fcn.00531f15
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0xc
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegGetValueA]
lea eax, [esp + 0x10]
push eax
push esi
lea eax, [esp + 0x1c]
push eax
push 0xffff
push str.MachineId
push 0
push dword [esp + 0x24]
call ebx
test eax, eax
je 0x5a3c9a
lea eax, [esp + 0xc]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftSQMClient
push reloc.WS2_32.dll_bind
call edi
test eax, eax
je 0x5a3c06
call fcn.004f4dc0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x5a3c5a
push str.SoftwareMicrosoftSQMClient
call edi
push eax
push str.Failure_opening_registry_sub_key:__d:_s
push 1
push 0x74
jmp 0x5a3c49
lea eax, [esp + 0x10]
push eax
push esi
lea eax, [esp + 0x1c]
push eax
push 0xffff
push str.MachineId
push 0
push dword [esp + 0x24]
call ebx
test eax, eax
je 0x5a3c9a
call fcn.004f4dc0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x5a3c5a
push str.SoftwareMicrosoftSQMClient
call edi
push eax
push str.Failure_opening_registry_sub_key:__d:_s
push 1
push 0x7a
push str._get_win_sqm_info
push str.C:Userslaurence_liuDesktop_vcpkg_2023.02.24_buildtrees_azure_c_shared_utility_src10753faee5_044a82ff07.clean_adaptersplatform_win32.c
push 0
call ebx
add esp, 0x20
push esi
call fcn.00531f15
add esp, 4
call fcn.004f4dc0
mov esi, eax
test esi, esi
je 0x5a3c8e
call edi
push eax
push str.Failure_retrieving_SQM_info_Error_value:__d
push 1
push 0x82
push str._get_win_sqm_info
push str.C:Userslaurence_liuDesktop_vcpkg_2023.02.24_buildtrees_azure_c_shared_utility_src10753faee5_044a82ff07.clean_adaptersplatform_win32.c
push 0
call esi
add esp, 0x1c
push 0
call fcn.00531f15
add esp, 4
xor esi, esi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x5a3cd0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0xc0
mov eax, dword [0x83e264]
xor eax, esp
mov dword [esp + 0xbc], eax
push esi
push edi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [esp + 0xc]
cmp eax, 9
ja case.0x5a3d02.1
movzx eax, byte [eax + 0x5a3ebc]
jmp dword [eax*4 + 0x5a3ea8]
mov edi, 0x78708c
jmp 0x5a3d2a
mov edi, 0x787090
jmp 0x5a3d2a
mov edi, str.IA64
jmp 0x5a3d2a
mov edi, 0x78709c
jmp 0x5a3d2a
mov edi, 0x74fad0
push 0x90
lea eax, [esp + 0x38]
push 0
push eax
call fcn.00520480
add esp, 0xc
mov dword [esp + 0x30], 0x94
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x5a3d90
lea eax, [esp + 8]
push eax
push 0
push 0
push dword [esp + 0x44]
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
test eax, eax
je 0x5a3d90
push edi
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x14]
push str._native__WindowsProduct:0x_08x__d._d___s
call fcn.005a4d90
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x5a3dd3
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, ax
push edi
shr ecx, 8
push ecx
movzx eax, al
push eax
push str._native__WindowsProduct:Windows_NT__d._d___s
call fcn.005a4d90
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x5a3dd3
call fcn.004f4dc0
test eax, eax
je 0x5a3e8d
push str.STRING_construct_sprintf_failed
push 1
push 0xc5
jmp 0x5a3e7c
test byte [esp + 0xcc], 2
je 0x5a3e55
call fcn.005a3af0
mov edi, eax
test edi, edi
je 0x5a3e2c
push edi
push 0x787118
push esi
call fcn.005a5160
add esp, 0xc
test eax, eax
je 0x5a3e21
call fcn.004f4dc0
test eax, eax
je 0x5a3e21
push str.failure_concat_file
push 1
push 0xcf
push str._platform_get_platform_info
push str.C:Userslaurence_liuDesktop_vcpkg_2023.02.24_buildtrees_azure_c_shared_utility_src10753faee5_044a82ff07.clean_adaptersplatform_win32.c
push 0
call eax
add esp, 0x18
push edi
call fcn.00531f15
add esp, 4
jmp 0x5a3e8d
push 0x817bd8
push esi
call fcn.005a4a70
add esp, 8
test eax, eax
je 0x5a3e8d
call fcn.004f4dc0
test eax, eax
je 0x5a3e8d
push str.failure_concat_file
push 1
push 0xd7
jmp 0x5a3e7c
push 0x817bd8
push esi
call fcn.005a4a70
add esp, 8
test eax, eax
je 0x5a3e8d
call fcn.004f4dc0
test eax, eax
je 0x5a3e8d
push str.failure_concat_file
push 1
push 0xdf
push str._platform_get_platform_info
push str.C:Userslaurence_liuDesktop_vcpkg_2023.02.24_buildtrees_azure_c_shared_utility_src10753faee5_044a82ff07.clean_adaptersplatform_win32.c
push 0
call eax
add esp, 0x18
mov ecx, dword [esp + 0xc4]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0051deb6
add esp, 0xc0
ret
Function at 0x5a3ed0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x83e264]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
lea eax, [esp + 4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, eax
test esi, esi
je 0x5a3f3a
call fcn.004f4dc0
test eax, eax
je 0x5a3f1f
push esi
push 0x786ed0
push 1
push 0x28
push str._platform_init
push str.C:Userslaurence_liuDesktop_vcpkg_2023.02.24_buildtrees_azure_c_shared_utility_src10753faee5_044a82ff07.clean_adaptersplatform_win32.c
push 0
call eax
add esp, 0x1c
mov eax, 0x29
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0051deb6
add esp, 0x194
ret
call fcn.005a72d0
cmp eax, 2
jne 0x5a3f82
call fcn.004f4dc0
test eax, eax
je 0x5a3f67
push str.HTTP_for_upload_to_blob_failed_on_initialization.
push 1
push 0x31
push str._platform_init
push str.C:Userslaurence_liuDesktop_vcpkg_2023.02.24_buildtrees_azure_c_shared_utility_src10753faee5_044a82ff07.clean_adaptersplatform_win32.c
push 0
call eax
add esp, 0x18
mov eax, 0x32
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0051deb6
add esp, 0x194
ret
mov ecx, dword [esp + 0x194]
xor eax, eax
pop esi
xor ecx, esp
call fcn.0051deb6
add esp, 0x194
ret

Function at 0x5a5bf0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x5a5c68
mov eax, dword [esp + 0xc]
test eax, eax
je 0x5a5c68
push 0
push 0
push dword [esp + 0x18]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
jne 0x5a5c61
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0xe
setne bl
add ebx, 3
call fcn.004f4dc0
test eax, eax
je 0x5a5c5c
push ebx
push dword [ebx*4 + 0x841c64]
push 0x80f4fc
push str._result___s_s___d__
push 1
push 0x1b
push str._ThreadAPI_Create
push str.C:Userslaurence_liuDesktop_vcpkg_2023.02.24_buildtrees_azure_c_shared_utility_src10753faee5_044a82ff07.clean_adapters_threadapi_win32.c
push 0
call eax
add esp, 0x24
mov eax, ebx
pop ebx
pop esi
ret
mov eax, 1
pop esi
ret
call fcn.004f4dc0
test eax, eax
je 0x5a5c98
push 2
push dword [0x841c6c]
push 0x80f4fc
push str._result___s_s___d__
push 1
push 0x12
push str._ThreadAPI_Create
push str.C:Userslaurence_liuDesktop_vcpkg_2023.02.24_buildtrees_azure_c_shared_utility_src10753faee5_044a82ff07.clean_adapters_threadapi_win32.c
push 0
call eax
add esp, 0x24
mov eax, 2
pop esi
ret

Function at 0x5a7a00
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x5a7a09
ret
mov ecx, dword [esp + 8]
test ecx, ecx
je fcn.005a50b0
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
jmp fcn.005a7a30