joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d3100
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73dd3d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80
push esi
mov dword [ebp - 0x18], 0
call fcn.005d0210
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.005d5300
add esp, 0xc
cmp dword [ebp - 0x20], 3
jne 0x5d316e
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x5d315d
mov dword [esi], 0
call fcn.005d0210
mov dword [esi + 4], eax
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.005d2220
cmp dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
je 0x5d31e5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.005d5300
add esp, 0xc
cmp dword [ebp - 0x20], 1
jne 0x5d31e5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.005d3100
mov edi, dword [ebp - 0x18]
add esp, 8
test edi, edi
je 0x5d31e5
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x5d3286
mov eax, dword [ebp - 0x14]
mov dword [ecx], edi
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x40]
call fcn.0047c860
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x5d31ef
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x5d3217
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x5d3211
mov dword [esi], 0
call fcn.005d0210
mov dword [esi + 4], eax
mov byte [ebp - 0xd], 1
jmp 0x5d326b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.005d0210
cmp edi, 0xb7
jne 0x5d3256
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.005d5300
add esp, 0xc
cmp dword [eax], 3
jne 0x5d3256
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x5d3267
mov dword [esi], 0
call fcn.005d0210
jmp 0x5d3264
mov esi, dword [ebp + 0xc]
call fcn.005d0210
test esi, esi
je 0x5d32c0
mov dword [esi], edi
mov dword [esi + 4], eax
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x40]
call fcn.0047c860
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x58]
push str.boost::filesystem::create_directories
call fcn.0047b810
push esi
push edi
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x8c]
call fcn.005d2cc0
push 0x82aacc
lea eax, [ebp - 0x8c]
push eax
call fcn.006f41a3
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00501610
push str.boost::filesystem::create_directory
lea ecx, [ebp - 0x58]
mov edi, dword [eax]
mov esi, dword [eax + 4]
call fcn.0047b810
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x8c]
call fcn.005d2cc0
push 0x82aacc
lea eax, [ebp - 0x8c]
push eax
call fcn.006f41a3
int3
Function at 0x5d3350
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73dd65
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x280
push esi
push edi
push dword [ebp + 0x10]
lea ecx, [ebp - 0x24]
call fcn.00489e30
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x5d33c9
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
mov esi, dword [ebp - 0x24]
cmp edx, 8
cmovae eax, esi
cmp word [eax + ecx*2 - 2], 0x5c
je 0x5d33c2
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, esi
cmp word [eax + ecx*2 - 2], 0x2f
je 0x5d33c2
cmp edx, 8
lea eax, [ebp - 0x24]
cmovae eax, esi
cmp word [eax + ecx*2 - 2], 0x3a
jne 0x5d33c9
mov edx, 0x74d99c
jmp 0x5d33ce
mov edx, 0x7940ac
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5d33d3
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x24]
call fcn.004a03a0
cmp dword [ebp - 0x10], 8
lea ecx, [ebp - 0x28c]
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x5d344e
mov dword [ecx], 0
call fcn.005d0210
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
cmp eax, 2
je 0x5d343f
call esi
cmp eax, 0x12
je 0x5d343f
call esi
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], edi
jmp 0x5d355a
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], edi
jmp 0x5d355a
lea ecx, [ebp - 0x260]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5d3457
sub ecx, edx
lea eax, [ebp - 0x260]
sar ecx, 1
push ecx
mov ecx, dword [ebp + 0x14]
push eax
call fcn.0047e880
mov eax, dword [ebp - 0x28c]
test eax, 0x400
je 0x5d349a
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0
jmp 0x5d3549
mov esi, dword [ebp + 0x18]
lea ecx, [ebp - 0x260]
mov edi, dword [ebp + 0x1c]
lea edx, [ecx + 2]
and eax, 0x10
or eax, 0x20
shr eax, 4
mov dword [esi], eax
mov dword [edi], eax
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5d34d1
sub ecx, edx
lea eax, [ebp - 0x260]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.0047e880
push dword [ebp - 0x28c]
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
call fcn.005d4830
mov edx, dword [ebp - 0x28]
add esp, 8
mov dword [esi + 4], eax
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x5d3543
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x5d3539
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d3574
push edx
push ecx
call fcn.00503df0
add esp, 8
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov esi, dword [ebp + 8]
mov dword [esi], 0
call fcn.005d0210
mov dword [esi + 4], eax
lea ecx, [ebp - 0x24]
call fcn.0047c860
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.006fee64
int3
Function at 0x5d4c80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x5d4c95
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5d4cbb
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push esi
push eax
call fcn.005d4b60
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x5d4cd1
mov dword [edi], 0
call fcn.005d0210
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x5d4d08
push esi
call fcn.005d40b0
add esp, 4
test al, al
je 0x5d4cfd
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 9
pop ebx
mov esp, ebp
pop ebp
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d5140
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73660d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push 0x20
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.0047e6a0
movups xmm0, xmmword [str.boost::filesystem::rename]
mov dword [ebp - 0x1c], 0x19
mov dword [ebp - 0x18], 0x1f
movups xmmword [eax], xmm0
movq xmm0, qword [0x794078]
movq qword [eax + 0x10], xmm0
mov cl, byte [0x794080]
mov byte [eax + 0x18], cl
mov byte [eax + 0x19], 0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x5d51c7
mov ecx, dword [eax]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x5d51d6
mov eax, dword [edi]
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x5d51fb
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x5d5216
mov dword [esi], 0
call fcn.005d0210
mov dword [esi + 4], eax
jmp 0x5d5216
call fcn.005d0210
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x10], 0
je 0x5d5256
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], esi
mov edx, dword [ebp - 0x18]
pop edi
pop esi
cmp edx, 0x10
jb 0x5d5248
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d523e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d5283
push edx
push ecx
call fcn.00503df0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
push eax
lea ecx, [ebp - 0x14]
call fcn.00501610
lea ecx, [ebp - 0x60]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x2c]
push dword [ebp + 0xc]
push edi
push eax
call fcn.005d2b70
push 0x82aacc
lea eax, [ebp - 0x60]
push eax
call fcn.006f41a3
call fcn.006fee64
int3
Function at 0x5d5300
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x73df9d
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x5d532b
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5d535c
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.005d4b60
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
test ebx, 0x400
je 0x5d5478
cmp dword [edi + 0x14], 8
mov edx, edi
jb 0x5d5372
mov edx, dword [edi]
mov ecx, edx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5d5390
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x24]
call fcn.0047e880
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
push 0
cmovae eax, dword [ebp - 0x24]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp + 0xc], esi
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
cmp edx, 8
jb 0x5d5410
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x5d5406
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d54c1
push edx
push ecx
call fcn.00503df0
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
cmp esi, 0xffffffff
je 0x5d5339
push edi
call fcn.005d40b0
add esp, 4
test al, al
jne 0x5d546a
push ebx
push edi
call fcn.005d4830
mov edi, dword [ebp + 8]
add esp, 8
push esi
mov dword [edi], 9
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x5d548d
mov dword [esi], 0
call fcn.005d0210
mov dword [esi + 4], eax
mov esi, 3
push ebx
push edi
test bl, 0x10
jne 0x5d549e
mov esi, 2
call fcn.005d4830
mov ecx, eax
add esp, 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.006fee64
int3
Function at 0x5d6990
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x73e07d
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x8e2a30]
push ebx
cmp eax, 0xffffffff
jne 0x5d69bd
xor ebx, ebx
mov dword [ebp - 0x14], ebx
jmp 0x5d69c9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x5d6a1a
push esi
push edi
nop dword [eax]
cmp dword [ebx + 0x14], 0
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
jne 0x5d6a29
test esi, esi
jne 0x5d6a30
push esi
call fcn.005d6ac0
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x5d6a18
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x5d6a70
nop dword [eax]
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x5d6a5d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x5d6a30
mov edi, dword [ebx + 0x10]
lea eax, [ebx + 0x10]
mov dword [ebp - 0x18], eax
mov esi, dword [edi]
mov dword [ebp - 0x10], esi
cmp esi, edi
je 0x5d69e0
mov ebx, eax
lea ecx, [ebp - 0x10]
call fcn.004c43f0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x5d6aa4
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x5d6aa4
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
mov ecx, ebx
call fcn.005d5e00
mov esi, dword [ebp - 0x10]
cmp esi, edi
jne 0x5d6a88
mov ebx, dword [ebp - 0x14]
jmp 0x5d69e0

Function at 0x5d6b60
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x18]
push eax
push 4
push edx
push 0x5d6bc0
push 0
push 0
call fcn.00704e7b
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x5d6b89
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x5d6ba7
cmp eax, 0xffffffff
je 0x5d6ba7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x5df0d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
lea ecx, [edx + 0x3f8]
lea esi, [eax + 0x3f8]
cmp eax, ecx
ja 0x5df10d
cmp esi, edx
jb 0x5df10d
sub edx, eax
mov esi, 0x80
mov ecx, dword [eax + edx]
lea eax, [eax + 8]
xor dword [eax - 8], ecx
mov ecx, dword [eax + edx - 4]
xor dword [eax - 4], ecx
sub esi, 1
jne 0x5df0f5
pop esi
pop ebp
ret
lea esi, [edx + 0x30]
sub edx, eax
lea ecx, [eax + 0x10]
mov eax, 0x10
nop word [eax + eax]
lea ecx, [ecx + 0x40]
lea esi, [esi + 0x40]
movups xmm0, xmmword [ecx - 0x50]
movups xmm1, xmmword [esi - 0x70]
pxor xmm1, xmm0
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [edx + ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [esi - 0x50]
pxor xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm0, xmmword [ecx - 0x20]
movups xmm1, xmmword [esi - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
sub eax, 1
jne 0x5df120
pop esi
pop ebp
ret
Function at 0x5e3ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
xor eax, eax
mov dword [ebp + 8], 0
push esi
nop word [eax + eax]
mov ecx, dword [ebp + 0xc]
mov cl, byte [ecx + eax]
movzx edx, cl
mov ecx, dword [ebp - 4]
movzx esi, byte [ecx + eax]
inc eax
mov ecx, dword [ebp + 8]
xor esi, edx
or ecx, esi
mov dword [ebp + 8], ecx
cmp eax, 0x10
jl 0x5e3cc0
mov eax, dword [ebp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x611600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x9c
call fcn.006f2580
mov eax, dword [0x8e6704]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
sub ecx, edi
mov dword [ebp - 0x94], ecx
cmp edx, edi
jb 0x6117e7
cmp edi, 0x40
ja 0x6117e7
lea eax, [ebp - 0x84]
neg eax
lea ecx, [ebp - 0x84]
and eax, 0x3f
add ecx, eax
lea eax, [edi + 0x100]
mov dword [ebp - 0x98], ecx
cmp edx, eax
jbe 0x611676
mov ebx, edx
sub ebx, edi
sub ebx, 0x100
push esi
push edi
xor esi, esi
mov dword [ebp - 0x8c], 0
push esi
push ecx
call fcn.006f4b50
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x90], esi
cmp ebx, dword [eax + 0xc]
jae 0x611746
mov ecx, ebx
sub ecx, dword [eax + 8]
mov dword [ebp - 0x88], ecx
nop dword [eax + eax]
mov edi, dword [ebp + 0xc]
mov eax, ebx
xor eax, dword [ebp - 0x94]
lea edx, [eax - 1]
not eax
shr eax, 0x1f
shr edx, 0x1f
and edx, eax
mov eax, dword [ebp + 0xc]
neg edx
xor ecx, dword [eax + 8]
mov eax, ebx
xor eax, dword [edi + 8]
or ecx, eax
mov eax, edx
or eax, dword [ebp - 0x8c]
xor ecx, ebx
and edx, dword [ebp - 0x90]
shr ecx, 0x1f
or esi, edx
mov edx, dword [ebp - 0x90]
neg ecx
and ecx, eax
mov eax, dword [edi + 0x14]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x8c], ecx
mov al, byte [eax + ebx]
inc ebx
and al, cl
mov ecx, dword [ebp - 0x98]
or byte [edx + ecx], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
mov eax, dword [ebp + 0xc]
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [ebp - 0x88]
inc ecx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x88], ecx
cmp ebx, dword [eax + 0xc]
jb 0x6116b0
mov dword [ebp - 0x88], 0
test edi, edi
je 0x6117d1
mov ecx, dword [ebp - 0x98]
mov eax, esi
and eax, 0xffffffdf
mov bl, byte [eax + ecx]
mov eax, esi
or eax, 0x20
mov dl, byte [eax + ecx]
mov ecx, esi
and ecx, 0x20
inc esi
lea eax, [ecx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and al, cl
neg al
movzx eax, al
mov dword [ebp - 0x8c], eax
not eax
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x8c]
and cl, dl
mov edx, dword [ebp - 0x88]
and al, bl
or al, cl
mov ecx, dword [ebp - 0x9c]
mov byte [ecx + edx], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
mov dword [ebp - 0x88], edx
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x611754
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f384a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.006f384a
mov esp, ebp
pop ebp
ret
Function at 0x612840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.006f2580
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax + 4]
mov edi, dword [ebp + 0x14]
inc edi
mov eax, dword [eax + 0x64]
test byte [eax + 0x30], 1
je 0x61288a
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi + 8]
lea eax, [edi + ecx]
cmp eax, edx
jbe 0x61287a
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
add dword [esi + 0x14], ecx
sub edx, ecx
add dword [esi + 0x18], ecx
sub dword [esi + 0xc], ecx
mov dword [esi + 8], edx
jmp 0x61288f
cmp edi, dword [esi + 8]
ja 0x612872
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x14]
push ebx
mov al, byte [ecx + eax - 1]
movzx ebx, al
mov byte [ebp + 0x17], al
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
push dword [eax + 0x3cc]
call fcn.00560ca0
push eax
call fcn.005e6940
add esp, 8
test eax, 0x200000
je 0x6128d5
or eax, 0xffffffff
sub eax, ebx
add dword [esi + 8], eax
mov eax, 1
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 8]
lea ecx, [ebx + edi]
mov ebx, edx
mov dword [ebp + 8], edx
sub ebx, ecx
mov eax, edx
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, edx
shr ebx, 0x1f
dec ebx
cmp edx, eax
cmovb eax, edx
xor edi, edi
mov dword [ebp - 8], eax
test eax, eax
je 0x612953
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 4]
mov edx, ecx
mov esi, dword [ebp + 8]
shr edx, 0x1f
dec esi
mov dword [ebp - 0xc], edx
add esi, eax
sub ecx, edi
lea esi, [esi - 1]
shr ecx, 0x1f
mov eax, edi
shr eax, 0x1f
inc edi
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esi + 1]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [ebp + 0x17]
xor ecx, eax
and edx, ecx
mov ecx, dword [ebp - 4]
not edx
and ebx, edx
mov edx, dword [ebp - 0xc]
cmp edi, dword [ebp - 8]
jb 0x612917
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
not ebx
movzx eax, bl
pop ebx
pop edi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [ebp - 4]
neg ecx
inc eax
and eax, ecx
sub edx, eax
mov dword [esi + 8], edx
mov dword [ebp + 8], ecx
not ecx
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
and ecx, 1
or eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6220c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push dword [ebp + 8]
call fcn.006635e0
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.006f4d80
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x622179
push 0x45
push str.crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.0062ff40
push 0x79f180
push esi
push 0x7a9c6c
push dword [ebp + 8]
push str.fopen_
push 5
call fcn.0062f6f0
add esp, 0x2c
call fcn.006fef52
cmp dword [eax], 2
je 0x62215a
call fcn.006fef52
cmp dword [eax], 6
je 0x62215a
push 0x4e
push str.crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.0062ff40
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x4c
push str.crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.0062ff40
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x7a9c14
call fcn.0061f770
mov esi, eax
add esp, 4
test esi, esi
jne 0x62219c
push edi
call fcn.0070526f
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
push esi
call fcn.0061f140
push edi
push ebx
push 0x6a
push esi
call fcn.0061f170
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret