joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55d718
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x55d7b4
test ebx, ebx
je 0x55d7c0
test esi, esi
je 0x55d7cc
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
mov dword [ebp - 0x30], edx
call fcn.004f53fc
test eax, eax
mov edx, dword [ebp - 0x30]
je 0x55d774
mov eax, dword [eax + 8]
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
mov edi, 0x6bdc20
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
jne 0x55d794
mov dword [esp], edx
mov dword [ebp - 0x30], edx
call sub.msvcrt.dll_getenv
test eax, eax
mov edx, dword [ebp - 0x30]
jne 0x55d76a
mov dword [ebp - 0x24], 0x6bdc24
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.004f53fc
test eax, eax
jne 0x55d767
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], edx
call sub.msvcrt.dll_getenv
jmp 0x55d76a
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], eax
jmp 0x55d794

Function at 0x55e0ec
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x10
mov dword [esp], str.OPENSSL_CONF
call sub.msvcrt.dll_getenv
test eax, eax
je 0x55e118
mov dword [esp], eax
call fcn.004fd9e8
mov edi, eax
mov eax, edi
add esp, 0x10
pop ebx
pop edi
leave
ret
call fcn.005654ec
mov edi, eax
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea ebx, [ecx + 0xc]
mov dword [esp + 8], 0x231
mov dword [esp + 4], str.crypto_conf_conf_mod.c
mov dword [esp], ebx
call fcn.004f3b10
mov edi, eax
test eax, eax
je 0x55e10e
call fcn.005654ec
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004fd908
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x6bdccb
mov dword [esp], edi
call fcn.004fda20
mov dword [esp + 8], ebx
mov dword [esp + 4], str.openssl.cnf
mov dword [esp], edi
call fcn.004fda20
jmp 0x55e10e
Function at 0x5635cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x16c
mov ebx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x1c]
mov dword [esp], eax
call fcn.00503ce0
mov dword [ebp - 0x140], eax
xor eax, eax
cmp dword [ebp - 0x140], 0
js 0x5637bc
lea edi, [ebp - 0x12c]
mov dword [esp], edi
call fcn.00510198
cmp dword [ebp + 8], 0
je 0x5637c7
cmp dword [ebp + 0xc], 0xffffffff
je 0x5637d3
test ebx, ebx
je 0x5637a9
mov dword [ebp - 0x14c], ebx
mov edx, dword [ebp + 0x24]
mov dword [ebp - 0x148], 1
lea ebx, [ebp - 0x5c]
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x144], eax
mov edi, dword [ebp - 0x140]
cmp eax, edi
jle 0x563657
mov dword [ebp - 0x144], edi
mov eax, dword [ebp - 0x148]
shr eax, 0x18
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x148]
shr eax, 0x10
mov byte [ebp - 0x1b], al
mov eax, dword [ebp - 0x148]
shr eax, 8
mov byte [ebp - 0x1a], al
mov al, byte [ebp - 0x148]
mov byte [ebp - 0x19], al
mov dword [esp + 0x10], 0
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0xc], edi
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov edi, dword [ebp + 8]
mov dword [esp + 4], edi
lea eax, [ebp - 0x12c]
mov dword [esp], eax
mov dword [ebp - 0x154], edx
call fcn.0050fe90
mov edi, dword [ebp + 0x14]
mov dword [esp + 8], edi
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
lea edi, [ebp - 0x12c]
mov dword [esp], edi
call fcn.00510100
mov dword [esp + 8], 4
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00510100
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.00510118
mov edx, dword [ebp - 0x154]
mov edi, edx
mov esi, ebx
mov ecx, dword [ebp - 0x144]
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 0x18], 1
jle 0x56378e
mov esi, 1
mov dword [ebp - 0x13c], esi
mov esi, dword [ebp - 0x144]
mov dword [ebp - 0x150], edi
mov edi, edx
lea esi, [esi]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebx
mov eax, dword [ebp - 0x140]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp], eax
call fcn.005102dc
test esi, esi
jle 0x563777
xor eax, eax
lea esi, [esi]
mov dl, byte [ebx + eax]
xor byte [edi + eax], dl
inc eax
cmp eax, esi
jne 0x56376c
inc dword [ebp - 0x13c]
mov eax, dword [ebp - 0x13c]
cmp dword [ebp + 0x18], eax
jg 0x563730
mov edi, dword [ebp - 0x150]
mov eax, dword [ebp - 0x144]
sub dword [ebp - 0x14c], eax
je 0x5637a9
inc dword [ebp - 0x148]
mov edx, edi
jmp 0x56363b
lea edi, [ebp - 0x12c]
mov dword [esp], edi
call fcn.0051029c
mov eax, 1
add esp, 0x16c
pop ebx
pop esi
pop edi
leave
ret
mov dword [ebp + 0xc], 0
jmp 0x56361d
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp + 0xc], ecx
jmp 0x56361d
Function at 0x565b3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov dword [ebp - 0x4c], ecx
dec ecx
cmp ecx, 0x7f
jbe 0x565b58
add esp, 0x6c
pop ebx
pop esi
pop edi
leave
ret
lea ecx, [ebp - 0x39]
mov dword [ebp - 0x5c], ecx
mov ecx, 4
mov edi, dword [ebp - 0x5c]
mov esi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], ecx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edx
call dword [ebp + 0x14]
mov esi, dword [ebp - 0x4c]
add esi, 7
sar esi, 3
mov eax, dword [ebp + 0x10]
test eax, eax
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x54]
je 0x565c00
xor ecx, ecx
mov edi, dword [ebp + 0xc]
mov bl, byte [edi + ecx]
xor bl, byte [eax + ecx]
mov byte [ebp + ecx - 0x29], bl
mov byte [edx + ecx], bl
inc ecx
cmp esi, ecx
jg 0x565ba0
mov edx, dword [ebp - 0x4c]
sar edx, 3
mov eax, dword [ebp - 0x4c]
and eax, 7
mov dword [ebp - 0x4c], eax
je 0x565c1c
mov ebx, 8
sub ebx, dword [ebp - 0x4c]
lea ecx, [ebp - 0x39]
lea edx, [ecx + edx]
xor eax, eax
mov edi, ebx
lea esi, [esi]
movzx esi, byte [edx + 1]
mov ecx, edi
sar esi, cl
movzx ebx, byte [edx]
mov cl, byte [ebp - 0x4c]
shl ebx, cl
or ebx, esi
mov ecx, dword [ebp + 0xc]
mov byte [ecx + eax], bl
inc eax
inc edx
cmp eax, 0x10
jne 0x565bd8
add esp, 0x6c
pop ebx
pop esi
pop edi
leave
ret
xor ecx, ecx
mov edi, dword [ebp + 0xc]
lea esi, [esi]
mov bl, byte [eax + ecx]
mov byte [ebp + ecx - 0x29], bl
xor bl, byte [edi + ecx]
mov byte [edx + ecx], bl
inc ecx
cmp esi, ecx
jg 0x565c08
jmp 0x565bb2
lea esi, [ebp - 0x39]
add esi, edx
mov ecx, 4
mov edi, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
jmp 0x565b4e
Function at 0x565f3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x1c]
mov edx, dword [eax]
test edx, edx
je 0x565f86
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x566030
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
jmp 0x565f70
test edi, edi
je 0x566030
mov al, byte [ebx + edx]
xor al, byte [esi]
mov byte [ecx], al
inc ecx
inc esi
dec edi
inc edx
and edx, 0xf
jne 0x565f68
mov dword [ebp + 8], esi
mov dword [ebp + 0x10], edi
cmp dword [ebp + 0x10], 0xf
jbe 0x565ff7
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], ecx
mov edi, dword [ebp - 0x24]
sub edi, dword [ebp - 0x1c]
mov esi, dword [ebp + 8]
sub esi, dword [ebp - 0x1c]
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], ebx
call dword [ebp + 0x20]
xor eax, eax
nop
mov edx, dword [ebx + eax]
xor edx, dword [esi + eax]
mov dword [edi + eax], edx
add eax, 4
cmp eax, 0x10
jne 0x565fbc
sub dword [ebp - 0x20], 0x10
sub dword [ebp - 0x1c], 0x10
cmp dword [ebp - 0x20], 0xf
ja 0x565f9c
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp + 0x10]
sub eax, 0x10
mov edx, eax
and edx, 0xf
mov dword [ebp + 0x10], edx
and eax, 0xfffffff0
add eax, 0x10
add ecx, eax
add dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x56603d
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], ebx
mov dword [ebp - 0x28], ecx
call dword [ebp + 0x20]
mov esi, dword [ebp + 0x10]
xor eax, eax
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
lea esi, [esi]
mov dl, byte [ebx + eax]
xor dl, byte [edi + eax]
mov byte [ecx + eax], dl
inc eax
dec esi
jne 0x566020
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x1c]
mov dword [eax], edx
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
xor edx, edx
mov eax, dword [ebp + 0x1c]
mov dword [eax], edx
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x56efb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebx + 4]
mov eax, dword [edx + 4]
cmp ecx, eax
jl 0x56f05c
mov eax, ecx
mov esi, edx
mov edx, dword [ebp + 8]
cmp dword [edx + 8], eax
jl 0x56f06c
mov eax, dword [esi + 4]
test eax, eax
jle 0x56f099
mov ecx, dword [ebp + 8]
mov edi, dword [ecx]
mov ecx, dword [ebx]
mov edx, dword [esi]
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov ebx, edx
mov edx, dword [ebx + eax*4]
xor edx, dword [ecx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp dword [esi + 4], eax
jg 0x56eff8
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebx + 4]
cmp eax, edx
jge 0x56f026
mov edx, dword [ebp + 8]
mov esi, dword [edx]
mov ecx, dword [ebx]
mov edx, dword [ecx + eax*4]
mov dword [esi + eax*4], edx
inc eax
mov edx, dword [ebx + 4]
cmp edx, eax
jg 0x56f018
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edx
test edx, edx
jle 0x56f08c
lea eax, [edx*4 - 4]
add eax, dword [ecx]
lea esi, [esi]
mov ecx, dword [eax]
sub eax, 4
test ecx, ecx
jne 0x56f048
dec edx
jne 0x56f03c
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, 1
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
mov esi, ebx
mov ebx, edx
mov edx, dword [ebp + 8]
cmp dword [edx + 8], eax
jge 0x56efdd
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0050a0ec
test eax, eax
jne 0x56efdd
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
mov eax, 1
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
xor eax, eax
jmp 0x56f00a
Function at 0x57cbe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test ebx, ebx
je 0x57cbfc
cmp byte [ebx + 0x5c], 0x77
je 0x57cc10
add esp, 0x1c
mov eax, 0xfffffffe
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx], edi
test esi, esi
mov ecx, esi
mov dword [ebx + 4], esi
je 0x57cc8c
mov edx, dword [ebx + 0x10]
nop
test edx, edx
jne 0x57cc61
mov eax, dword [ebx + 0x48]
mov ecx, 0x4000
mov edx, dword [ebx + 0x40]
mov dword [ebx + 0xc], eax
mov dword [esp + 0xc], edx
mov edx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, 0x4000
jne 0x57ccb1
mov dword [ebx + 0x10], 0x4000
mov ecx, dword [ebx + 4]
mov edx, 0x4000
add dword [ebx + 0x64], ecx
xor eax, eax
add dword [ebx + 0x68], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0057dc20
mov dword [ebx + 0x38], eax
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 0x10]
sub dword [ebx + 0x64], ecx
sub dword [ebx + 0x68], edx
test eax, eax
jne 0x57cc8c
test ecx, ecx
jne 0x57cc20
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov edi, dword [ebx + 0x4c]
mov dword [esp], edi
call fcn.005807b0
mov dword [ebx + 0x4c], eax
mov eax, esi
mov esi, dword [ebx + 4]
add esp, 0x1c
pop ebx
sub eax, esi
pop esi
pop edi
pop ebp
ret
mov dword [ebx + 0x38], 0xffffffff
jmp 0x57cc8c
Function at 0x57d570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x57d709
cmp byte [ebx + 0x5c], 0x77
je 0x57d598
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0057be30
mov dword [ebx + 4], 0
mov edx, dword [ebx + 0x10]
xor edi, edi
lea esi, [esi]
lea edi, [edi]
mov eax, 0x4000
mov esi, eax
sub esi, edx
jne 0x57d6c0
test edi, edi
jne 0x57d6f5
mov ecx, dword [ebx + 0x10]
mov edi, 4
add dword [ebx + 0x68], ecx
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0057dc20
mov edx, dword [ebx + 0x10]
sub dword [ebx + 0x68], edx
test esi, esi
jne 0x57d5f1
cmp eax, 0xfffffffb
je 0x57d690
mov dword [ebx + 0x38], eax
xor edi, edi
test edx, edx
jne 0x57d6b0
mov eax, dword [ebx + 0x38]
cmp eax, 1
je 0x57d6b3
cmp eax, 1
jbe 0x57d5b0
cmp eax, 1
je 0x57d61c
test eax, eax
jne 0x57d58a
mov esi, dword [ebx + 0x40]
mov edi, 3
mov dword [ebp - 0x10], esi
mov esi, dword [ebx + 0x4c]
lea esi, [esi]
mov edx, dword [ebp - 0x10]
mov eax, esi
and eax, 0xff
mov dword [esp], eax
shr esi, 8
mov dword [esp + 4], edx
call fcn.005a0f68
dec edi
jns 0x57d630
mov edi, dword [ebx + 0x40]
mov esi, dword [ebx + 0x64]
mov dword [ebp - 0x14], edi
mov edi, 3
lea esi, [esi]
mov eax, dword [ebp - 0x14]
mov ecx, esi
and ecx, 0xff
mov dword [esp], ecx
shr esi, 8
mov dword [esp + 4], eax
call fcn.005a0f68
dec edi
jns 0x57d660
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0057be30
mov dword [ebx + 0x38], 0
xor edi, edi
test edx, edx
je 0x57d5fe
jmp 0x57d6b0
mov eax, dword [ebx + 0x38]
mov edi, 1
jmp 0x57d60a
mov eax, dword [ebx + 0x40]
mov ecx, 1
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov edx, dword [ebx + 0x48]
mov dword [esp], edx
call sub.msvcrt.dll_fwrite
cmp eax, esi
jne 0x57d6fd
mov dword [ebx + 0x10], 0x4000
mov edx, dword [ebx + 0x48]
mov dword [ebx + 0xc], edx
jmp 0x57d5bf
mov eax, dword [ebx + 0x38]
jmp 0x57d60f
mov dword [ebx + 0x38], 0xffffffff
jmp 0x57d58a
add esp, 0x1c
mov eax, 0xfffffffe
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x57f630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x1c
mov eax, dword [eax + 0x2c]
mov edx, dword [edi + 0x74]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], edx
jmp 0x57f709
mov ebx, dword [edi]
mov edx, dword [ebx + 4]
mov dword [ebp - 0x18], ebx
test edx, edx
je 0x57f7c0
mov eax, dword [edi + 0x38]
mov ebx, edx
add esi, eax
mov eax, dword [edi + 0x74]
add esi, eax
cmp edx, dword [ebp - 0x10]
jbe 0x57f674
mov ebx, dword [ebp - 0x10]
xor ecx, ecx
test ebx, ebx
je 0x57f6be
mov eax, dword [ebp - 0x18]
sub edx, ebx
mov ecx, dword [eax + 0x1c]
mov dword [eax + 4], edx
mov edx, eax
mov eax, dword [ecx + 0x18]
cmp eax, 1
je 0x57f7c8
cmp eax, 2
je 0x57f7e8
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov dword [esp], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov esi, dword [ebp - 0x18]
mov ecx, ebx
mov eax, dword [edi + 0x74]
add dword [esi], ebx
add dword [esi + 8], ebx
lea esi, [eax + ecx]
cmp esi, 2
mov dword [ebp - 0x1c], esi
mov dword [edi + 0x74], esi
jbe 0x57f6ed
mov ebx, dword [edi + 0x38]
mov edx, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx eax, byte [ebx + edx]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [ebx + edx + 1]
mov ebx, dword [edi + 0x54]
xor eax, ecx
and eax, ebx
mov dword [edi + 0x48], eax
cmp esi, 0x105
ja 0x57f7c0
mov eax, dword [edi]
mov esi, dword [eax + 4]
test esi, esi
je 0x57f7c0
mov eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x3c]
mov ebx, dword [ebp - 0x1c]
mov esi, dword [edi + 0x6c]
sub ecx, ebx
sub ecx, esi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x14]
lea eax, [eax + ecx - 0x106]
cmp esi, eax
jb 0x57f650
mov dword [esp + 8], ecx
mov esi, dword [edi + 0x38]
lea ebx, [esi + ecx]
mov dword [esp], esi
mov dword [esp + 4], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x14]
mov esi, dword [edi + 0x6c]
mov ecx, dword [edi + 0x4c]
sub dword [edi + 0x70], eax
mov edx, dword [edi + 0x44]
sub esi, eax
sub dword [edi + 0x5c], eax
mov dword [edi + 0x6c], esi
lea eax, [edx + ecx*2]
nop
lea esi, [esi]
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x57f774
mov ebx, edx
mov edx, dword [ebp - 0x14]
sub ebx, edx
mov word [eax], bx
dec ecx
jne 0x57f760
mov ecx, dword [ebp - 0x14]
mov eax, dword [edi + 0x40]
lea eax, [eax + ecx*2]
lea esi, [esi]
lea edi, [edi]
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x57f7a4
mov ebx, edx
mov edx, dword [ebp - 0x14]
sub ebx, edx
mov word [eax], bx
dec ecx
jne 0x57f790
mov ebx, dword [edi]
mov ecx, dword [ebp - 0x14]
add dword [ebp - 0x10], ecx
mov edx, dword [ebx + 4]
mov dword [ebp - 0x18], ebx
test edx, edx
jne 0x57f660
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov eax, dword [edx]
mov dword [esp + 4], eax
mov ecx, dword [edx + 0x30]
mov dword [esp], ecx
call fcn.00585770
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x30], eax
jmp 0x57f69c
mov dword [esp + 8], ebx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov dword [esp + 4], eax
mov ecx, dword [edx + 0x30]
mov dword [esp], ecx
call fcn.005807b0
jmp 0x57f7dd
Function at 0x58da1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ecx, ecx
je 0x58da34
cmp dword [eax + 0x118], 0
jne 0x58da30
jmp fcn.00587b94
ret
mov dword [eax + 0x118], 1
ret

Function at 0x58e024
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx], 0x2d
je 0x58e040
cmp dword [eax + 0x118], 0
jne 0x58e03f
jmp fcn.00587b94
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [ecx + 4]
mov edi, dword [edx + 8]
mov ebp, dword [edx + 4]
test edi, edi
je 0x58e038
mov edx, dword [eax + 0x100]
xor ebx, ebx
jmp 0x58e077
mov esi, edx
inc edx
mov byte [eax + esi], cl
mov dword [eax + 0x100], edx
mov byte [eax + 0x104], cl
inc ebx
cmp edi, ebx
je 0x58e038
mov cl, byte [ebp + ebx]
cmp edx, 0xff
jne 0x58e060
mov byte [eax + 0xff], 0
mov edx, dword [eax + 0x10c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xff
mov dword [esp], eax
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
call dword [eax + 0x108]
mov eax, dword [esp + 0x18]
inc dword [eax + 0x120]
mov edx, 1
xor esi, esi
mov cl, byte [esp + 0x1c]
jmp 0x58e063
Function at 0x5927e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x592840
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x592936
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x5928b0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x592885
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sub.msvcrt.dll_memcpy
cmp byte [esp + 0x1f], 0
je 0x592895
cmp byte [esp + 0x1e], 0
je 0x592895
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x592895
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.005927e0
nop

Function at 0x592bd0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6f92c4
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x6f92dc]
sub esp, 4
test ebx, ebx
je 0x592c1b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x592c14
test esi, esi
je 0x592c14
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x592bf0
mov dword [esp], 0x6f92c4
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x595860
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x6f92f8], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateSemaphoreA
sub esp, 0x10
mov dword [0x6f92fc], eax
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x5958c0
mov dword [0x6f9304], eax
mov dword [esp + 4], 0x595824
mov dword [esp], eax
call fcn.005a1530
test eax, eax
jne 0x5958c7
add esp, 0x1c
ret
call sub.KERNEL32.dll_GetLastError
jmp 0x5958b8
call sub.msvcrt.dll_abort
Function at 0x598710
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x13c
mov dword [esp + 0x12c], ebx
mov ebx, dword [esp + 0x140]
mov dword [esp + 0x130], esi
mov dword [esp + 0x134], edi
mov dword [esp + 0x138], ebp
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x59890c
cmp byte [ebx], 0
je 0x5988e0
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
cmp eax, 0xffffffff
je 0x5988f0
test al, 0x10
je 0x5988e0
lea ebp, [esp + 0x1c]
mov dword [esp + 4], ebx
mov ebx, ebp
mov dword [esp + 8], 0x104
mov dword [esp], ebp
call sub.msvcrt.dll__fullpath
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x59878b
test eax, 0x8080
je 0x5988c2
add al, al
sbb ebx, 3
sub ebx, ebp
lea eax, [ebx + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je 0x5988ff
lea edi, [eax + 0x22c]
lea eax, [ebx + 1]
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov dword [esp], edi
call sub.msvcrt.dll_memcpy
cmp byte [esi + 0x22c], 0
je 0x598826
mov dword [esp + 4], 0x2f
lea ebp, [esi + ebx + 0x22b]
mov dword [esp], edi
call sub.msvcrt.dll_strrchr
cmp eax, ebp
je 0x598826
mov dword [esp + 4], 0x5c
mov dword [esp], edi
call sub.msvcrt.dll_strrchr
cmp ebp, eax
je 0x598826
mov word [esi + ebx + 0x22c], 0x5c
mov eax, edi
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x598828
test edx, 0x8080
je 0x5988d0
add dl, dl
mov ecx, 0x41
sbb eax, 3
sub eax, edi
lea edx, [esi + 0x120]
mov word [esi + eax + 0x22c], 0x2a
mov edi, edx
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esi + 0x224], 0xffffffff
mov dword [esi + 0x228], 0
mov dword [esi + 0x118], 0
mov word [esi + 0x11c], 0
mov word [esi + 0x11e], 0
mov eax, esi
mov ebx, dword [esp + 0x12c]
mov esi, dword [esp + 0x130]
mov edi, dword [esp + 0x134]
mov ebp, dword [esp + 0x138]
add esp, 0x13c
ret
shr eax, 0x10
add ebx, 2
jmp 0x5987ac
shr edx, 0x10
add eax, 2
jmp 0x59884b
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [eax], 0x14
jmp 0x59889d
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [eax], 2
jmp 0x59889d
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
jmp 0x59889d
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [eax], 0xe
jmp 0x59889d