joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bf10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x10209fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x100c002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.0100fdff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x100c002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.010076e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0101020b
push 0x10
call fcn.010101d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x100bfc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00ffc1c0
jmp 0x100bfc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.0100bb80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x100bff0
mov ecx, edi
call fcn.00ffc2c0
push edi
call fcn.010101c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100c021
inc ebx
cmp ebx, 0x20
jb 0x100bf3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x100d250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1021808
push 0x1011288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x100d329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100d329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.010101d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x100d329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x100d329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x100d32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0100d351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100dd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100dd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x100dd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100dd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100dd94
push eax
push esi
call fcn.0101020b
add esp, 8
pop esi
ret 0x10

Function at 0x100dda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100de22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x100de15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x1026320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0100fdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x100ddda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x100de30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100dec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x100deb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x1026320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0100fdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x100deab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x100de6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x100e000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x100e131
push esi
call fcn.01011145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.01000080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x100e131
push 0
push ebp
call fcn.010003a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.01000260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x100e08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.010002f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x100e121
push 0x1026918
push edi
call fcn.0100f3f0
push eax
push ebx
push esi
call fcn.0100df60
push 0x10268f8
push edi
call fcn.0100f3f0
push eax
push ebx
push esi
call fcn.0100df60
push 0x10268d8
push edi
call fcn.0100f3f0
push eax
push ebx
push esi
call fcn.0100df60
push 0x10268c0
push edi
call fcn.0100f3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0100df60
push 0x10268a0
push edi
call fcn.0100f3f0
push eax
push ebx
push esi
call fcn.0100df60
push 0x1026888
push edi
call fcn.0100f3f0
push eax
push ebx
push esi
call fcn.0100df60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0100f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0100f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0100f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0100f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x100fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x102187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x100fc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x50001798
Capabilities:
Get file size
Move file

Disassembly:
adc byte [ebx + eax*2 + 0x6c], dl
popal
jae 0x50001812
dec eax
insb byte es:[edi], dx
jo 0x50001809
jb 0x500017e8
popal
jae 0x5000180e
lea eax, [eax]
mov al, 0x17
add byte [eax + 7], dl
pop es

Function at 0x500017b0
Capabilities:
Get file size
Move file

Disassembly:
pop es
adc byte [ebx + eax*2 + 0x6c], dl
popal
jae 0x5000182b
dec eax
insb byte es:[edi], dx
jo 0x50001822
jb 0x50001801
popal
jae 0x50001827
cwde
pop ss
add byte [eax + 0x44], dl
adc eax, 0x5000
push es
push ebx
jns 0x50001843
je 0x50001837
insd dword es:[edi], dx
add byte [eax], al
lea eax, [eax]
fcom qword [edi]
add byte [eax + 1], dl
add dword [eax], ecx
push ebp
inc ebx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx], al
add byte [eax], al
add al, bl
pop ss
push ebx
je 0x50001897
imul ebp, dword [esi + 0x67], 0xc08bfde9
xor byte [eax], bl
sal byte [eax], 0x18
add byte [eax + 0xa], dl
or eax, 0x42776152
je 0x5000189e
push ebx
outsb dx, byte [esi]
imul edx, dword [ebx + 0x74], 0x61

Function at 0x500017f4
Capabilities:
Get file size
Move file

Disassembly:
adc dword [edx], ecx
push ebp
inc ebx
push ebx
xor al, 0x53
je 0x5000186f
imul ebp, dword [esi + 0x67], 4
add byte [eax], al
add byte [eax], al
add eax, dword [eax]
add byte [eax], al
fcom dword [edi]
add byte [eax + 6], dl
push ebx
jns 0x50001887
je 0x5000187b
insd dword es:[edi], dx
nop
sbb al, 0x18
add byte [eax + 0xa], dl
or cl, byte [edx]
push ebp
push esp
push eax
add dword [eax + 0x4500018], eax
add eax, 0x74614454

Function at 0x50001830
Capabilities:
Get file size
Move file

Disassembly:
or cl, byte [0x42776152]
jns 0x500018ac
push ebx
je 0x500018ae
imul ebp, dword [esi + 0x67], 0x408dffff
add byte [eax + 0x18], cl
add byte [eax + 0x11], dl
adc dword [ebx], ecx
push esp
inc edx
outsd dx, dword [esi]
add byte [eax], al
add byte [eax + ebx + 0x630d5000], dl
jae 0x5000190c
outsb dx, byte [esi]

Function at 0x50001848
Capabilities:
Get file size
Move file

Disassembly:
adc dword [ebx], ecx
push esp
inc edx
outsd dx, dword [esi]
jne 0x500018bd
inc ecx
jb 0x500018c5
popal
jns 0x5000185a
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx], al
add byte [eax], al
add byte [eax + edx + 0x53065000], al
jns 0x500018dc
je 0x500018d0
insd dword es:[edi], dx
jo 0x50001886
add byte [eax + 4], dl
or dword [esp + eax*2 + 0x61], edx
add dword gs:[eax + ebx + 0x5045000], ecx
popal
je 0x50001925
or esp, dword fs:[ebx + 0x73]

Function at 0x50001870
Capabilities:
Get file size
Move file

Disassembly:
add al, 9
push esp
inc esp
popal
je 0x500018dc
push esp
imul ebp, dword [ebp + 0x65], 0x188001
push eax

Function at 0x50001880
Capabilities:
Get file size
Move file

Disassembly:
add al, 5
push esp
inc esp
popal
je 0x500018ec
add dword [eax + ebx + 0x5045000], ecx

Function at 0x5000188c
Capabilities:
Get file size
Move file

Disassembly:
add al, 5
push esp
push esp
imul ebp, dword [ebp + 0x65], 0x189801
push eax
Function at 0x50003bf0
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
call fcn.50003bbc
push str.LocalFastMM_PID_________
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov ebx, eax
test ebx, ebx
jne 0x50003c0f
xor esi, esi
jmp 0x50003c2b
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov esi, dword [eax]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, esi
pop esi
pop ebx
ret

Function at 0x50003c94
Capabilities:
Read file via mapping

Disassembly:
call sym.rtl120.bpl__System_IsMemoryManagerSet_qqrv
test al, al
jne 0x50003cee
cmp dword [0x500a6af8], 0
jne 0x50003cee
call fcn.50003bf0
test eax, eax
jne 0x50003ceb
push str.LocalFastMM_PID_________
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x500a6af8], eax
push 0
push 0
push 0
push 2
mov eax, dword [0x500a6af8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [eax], sym.rtl120.bpl__System_SysGetMem_qqri
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov al, 1
jmp 0x50003cf0
xor eax, eax
ret
xor eax, eax
ret

Function at 0x500042f0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x5000432c
movzx eax, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x5000434c
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
push 0
call sym.rtl120.bpl__System__LStrFromArray_qqrr27System__AnsiStringT_us_i0__pcius
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x50004368
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x500043a9
movzx eax, bl
add eax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x500043c9
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call sym.rtl120.bpl__System__WStrFromWArray_qqrr17System_WideStringpbi
add esp, 0x41c
pop esi
pop ebx
ret
Function at 0x5000472c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call sym.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
test esi, esi
jne 0x50004764
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call sym.rtl120.bpl__System__UStrFromPWCharLen_qqrr20System_UnicodeStringpbi
jmp 0x50004782
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.50004610
mov edi, eax
test esi, esi
je 0x50004782
cmp dword [ebx], 0
je 0x50004782
dec esi
jmp 0x5000476b
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x5000480c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + sym.rtl120.bpl__System_RandSeed], 0x8088405
inc edx
mov dword [ebx + sym.rtl120.bpl__System_RandSeed], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x50004828
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + sym.rtl120.bpl__System_RandSeed], 0x8088405
inc edx
mov dword [ebx + sym.rtl120.bpl__System_RandSeed], edx
fld qword [ebx + 0x5009c7d8]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x5000510c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x9c
mov dword [ebp + 0x74], 0x500a213c
mov dword [ebp + 0x24], 0
add byte [ebp - 0x74afdbbb], cl
dec ebp
je 0x500050b8
push ecx
sub al, 0x52

Function at 0x50005124
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2]
test eax, eax
je 0x500050c7
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2]
push eax
call fcn.5000504c
add esp, 4
movzx ecx, ax
add ecx, dword [ebp - 8]
inc dword [ebx - 0x48f0fb3c]
enter 0x4d03, 0xfffffffffffffff8
mov dword [ebp - 8], ecx
jmp 0x50005092
mov eax, dword [ebp - 8]
mov esp, ebp
add byte [ebp - 0x74afdbbb], cl
dec ebp
je 0x500050b8
push ecx
sub al, 0x52
call fcn.500055ec
add esp, 8
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x74]
mov ecx, dword [eax + 0x30]
push ecx
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x54]
push eax
mov ecx, dword [ebp + 0x64]
push ecx
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x38]
push eax
call fcn.5000553c
add esp, 0x10

Function at 0x5000515c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp + 0x20], eax
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 0xc]
or al, 0x52
Function at 0x50005164
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or al, 0x52
push 0
call dword [ebp + 0x20]
mov dword [ebp + 0x60], eax
mov eax, dword [ebp + 0x74]
mov ecx, dword [eax + 0x30]
push ecx
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 0x64]
push ecx
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x38]
push eax
call fcn.5000553c
add esp, 0x10
mov dword [ebp + 0x1c], eax
push 0x104
mov ecx, dword [ebp + 0x60]
push ecx
push 0
call dword [ebp + 0x1c]
mov dword [ebp + 0x18], eax
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x20]
mov dword [ebp + 0x3c], eax
mov ecx, dword [ebp + 0x18]
mov dword [ebp + 0x68], ecx
mov edx, dword [ebp + 0x68]
mov eax, dword [ebp + 0x60]
movzx ecx, word [eax + edx*2 - 2]
mov edx, dword [ebp + 0x74]
movzx eax, word [edx + 0x40]
cmp ecx, eax
je 0x500051df
xor ecx, ecx
mov edx, dword [ebp + 0x68]
mov eax, dword [ebp + 0x60]
mov word [eax + edx*2], cx
mov ecx, dword [ebp + 0x68]
sub ecx, 1
mov dword [ebp + 0x68], ecx
jmp 0x500051b2
mov dword [ebp + 0x58], 0
mov edx, dword [ebp + 0x3c]
add edx, dword [ebp + 0x58]
movsx eax, byte [edx]
test eax, eax
je 0x5000521b
mov ecx, dword [ebp + 0x3c]
add ecx, dword [ebp + 0x58]
movsx dx, byte [ecx]
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x60]
mov word [ecx + eax*2], dx
mov edx, dword [ebp + 0x68]
add edx, 1
mov dword [ebp + 0x68], edx
mov eax, dword [ebp + 0x58]
add eax, 1
mov dword [ebp + 0x58], eax
jmp 0x500051e6
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 0x30]
push edx
mov eax, dword [ebp + 0x74]
mov ecx, dword [eax + 0x24]
push ecx
mov edx, dword [ebp + 0x64]
push edx
mov eax, dword [ebp + 0x74]
mov ecx, dword [eax + 0x38]
push ecx
call fcn.5000553c
add esp, 0x10
mov dword [ebp + 0x14], eax
push 0
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 0x5c]
push edx
push 0
mov eax, dword [ebp + 0x74]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x3c]
push eax
mov ecx, dword [ebp + 0x60]
push ecx
call dword [ebp + 0x14]
mov dword [ebp + 0x38], eax
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x30]
push eax
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 0x60]
push edx
mov eax, dword [ebp + 0x64]
push eax
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 0x38]
push edx
call fcn.5000553c
add esp, 0x10
mov dword [ebp + 0x10], eax
push 0
mov eax, dword [ebp + 0x38]
push eax
call dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x60]
mov dword [ebp + 0x70], ecx
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x30]
push eax
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp + 0x64]
push eax
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 0x38]
push edx
call fcn.5000553c
add esp, 0x10
mov dword [ebp + 8], eax
mov dword [ebp + 0x34], 0
add byte [eax], al
Function at 0x5000553c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
or byte [ebx + 0x4d8bf445], cl
or al, 3
dec esp
sar byte [eax - 0x77], 1
dec ebp
clc
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
jmp 0x50005594
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x500055dc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.500054cc
add esp, 8
cmp eax, dword [ebp + 0x10]
jne 0x500055da
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + eax*4]
mov eax, edx
jmp 0x500055de
jmp 0x5000558b
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x500055ec
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword fs:[0x18]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
add edx, 0xc
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx

Function at 0x50005c08
Capabilities:
Clear file content

Disassembly:
movzx edx, word [eax + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x50005c26
push dword [eax]
call sub.kernel32.dll_SetEndOfFile
dec eax
je 0x50005c30
jmp fcn.50004244
mov eax, 0x67
jmp sym.rtl120.bpl__System_SetInOutRes_qqri
ret

Function at 0x50005d18
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
movzx eax, word [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x50005d4b
push 0
mov eax, esp
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.kernel32.dll_WriteFile
pop edx
dec eax
jne 0x50005d52
cmp edx, dword [ebx + 8]
je 0x50005d5c
mov eax, 0x65
jmp 0x50005d57
mov eax, 5
jmp 0x50005d57
call sub.kernel32.dll_GetLastError
call sym.rtl120.bpl__System_SetInOutRes_qqri
mov eax, ebx
pop ebx
ret