joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e9930
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x54f200
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
mov eax, dword [0x5a1574]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov eax, dword [esp + 0x58]
cmp eax, 1
jne 0x4e9988
mov esi, dword [esp + 0x5c]
test esi, esi
je 0x4e9974
mov dword [esi], 0
call fcn.00503650
mov dword [esi + 4], eax
xor al, al
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x44
ret
cmp eax, 3
je 0x4e9a03
cmp eax, 0xb
je 0x4e9a03
push str.boost::filesystem::remove
lea ecx, [esp + 0x2c]
call fcn.004020cc
mov ecx, dword [esp + 0x5c]
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x58]
push ecx
push eax
push eax
mov dword [esp + 0x5c], 1
call fcn.004e8800
add esp, 4
test al, al
sete dl
movzx eax, dl
push eax
call fcn.004e97a0
add esp, 0x10
cmp dword [esp + 0x40], 0x10
mov bl, al
jb 0x4e99e7
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00514e7a
add esp, 4
test bl, bl
je 0x4e9a82
xor al, al
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x44
ret
push 0x19
xor esi, esi
push str.boost::filesystem::remove
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], esi
mov byte [esp + 0x18], 0
call fcn.004029c0
mov dword [esp + 0x4c], esi
mov esi, dword [esp + 0x54]
cmp dword [esi + 0x18], 8
jb 0x4e9a39
mov eax, dword [esi + 4]
jmp 0x4e9a3c
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x5c]
test eax, eax
setne al
lea edx, [esp + 0xc]
push edx
test al, al
sete dl
push ecx
movzx eax, dl
push esi
push eax
call fcn.004e97a0
add esp, 0x10
cmp dword [esp + 0x24], 0x10
mov bl, al
jb 0x4e9a7a
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00514e7a
add esp, 4
test bl, bl
jne 0x4e9974
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x44
ret

Function at 0x4e9bc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp dword [ebx + 0x18], 8
push edi
jb 0x4e9bd1
mov eax, dword [ebx + 4]
jmp 0x4e9bd4
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4e9bfa
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ebx
push ecx
call fcn.004e9aa0
mov eax, dword [eax]
add esp, 0xc
pop edi
pop ebx
ret
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4e9c11
mov dword [esi], 0
call fcn.00503650
mov dword [esi + 4], eax
pop esi
test edi, 0x400
je 0x4e9c44
push ebx
call fcn.004e8830
add esp, 4
test al, al
je 0x4e9c3c
mov edx, edi
and dl, 0x10
movzx eax, dl
neg eax
sbb eax, eax
and eax, 7
pop edi
add eax, 4
pop ebx
ret
pop edi
mov eax, 9
pop ebx
ret
mov eax, edi
and eax, 0x10
or eax, 0x20
pop edi
shr eax, 4
pop ebx
ret
Function at 0x4e9c60
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x54f258
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x5a1574]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0x1c
push str.boost::filesystem::copy_file
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.004029c0
mov edx, dword [esp + 0x3c]
mov ecx, 8
mov dword [esp + 0x30], 0
cmp dword [edx + 0x18], ecx
jb 0x4e9cc5
mov esi, dword [edx + 4]
jmp 0x4e9cc8
lea esi, [edx + 4]
mov eax, dword [esp + 0x38]
cmp dword [eax + 0x18], ecx
jb 0x4e9cd6
mov ecx, dword [eax + 4]
jmp 0x4e9cd9
lea ecx, [eax + 4]
lea edi, [esp + 0xc]
push edi
mov edi, dword [esp + 0x48]
push edi
push edx
push eax
xor eax, eax
cmp dword [esp + 0x50], eax
sete al
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
sete cl
movzx edx, cl
push edx
call fcn.004e9820
add esp, 0x14
cmp dword [esp + 0x24], 0x10
jb 0x4e9d1c
mov eax, dword [esp + 0x10]
push eax
call fcn.00514e7a
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x4e9fb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x54f2f0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x5a1574]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x40]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x4e9fe7
mov eax, dword [esi]
jmp 0x4e9fe9
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4ea01f
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x3c]
push eax
push edi
push esi
call fcn.004e9aa0
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
test ebx, 0x400
je 0x4ea11e
cmp dword [edi + 0x18], 8
jb 0x4ea039
mov ecx, dword [esi]
mov dword [esp + 0x40], ecx
jmp 0x4ea03d
mov dword [esp + 0x40], esi
push 0
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0x18]
call fcn.004e8010
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 0
jae 0x4ea064
lea eax, [esp + 0x14]
push 0
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x40], esi
cmp dword [esp + 0x28], 8
mov byte [esp + 0x34], 2
jb 0x4ea099
mov eax, dword [esp + 0x14]
push eax
call fcn.00514e7a
add esp, 4
xor ecx, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], cx
cmp esi, 0xffffffff
jne 0x4ea0dd
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x3c]
push edx
push edi
push esi
call fcn.004e9aa0
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
push edi
call fcn.004e8830
add esp, 4
mov dword [esp + 0x34], 0xffffffff
push esi
test al, al
jne 0x4ea118
mov edi, dword [esp + 0x40]
mov dword [edi], 9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x44]
test esi, esi
je 0x4ea134
mov dword [esi], 0
call fcn.00503650
mov dword [esi + 4], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 3
test bl, 0x10
jne 0x4ea14d
mov dword [esp + 0x40], 2
mov ecx, dword [eax]
mov eax, dword [esp + 0x3c]
mov dword [eax], ecx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x4ea170
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
cmp dword [edi + 0x18], 8
jb 0x4ea182
mov eax, dword [edi + 4]
jmp 0x4ea185
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4ea1ac
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
push eax
push edi
push esi
call fcn.004e9aa0
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret
mov esi, dword [esp + 0x18]
test esi, esi
je 0x4ea1c2
mov dword [esi], 0
call fcn.00503650
mov dword [esi + 4], eax
test ebx, 0x400
je 0x4ea1f7
push edi
call fcn.004e8830
add esp, 4
test al, al
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 4
jne 0x4ea1eb
mov dword [esp + 0x14], 9
mov ecx, dword [eax]
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
ret
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 3
test bl, 0x10
jne 0x4ea210
mov dword [esp + 0x14], 2
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov dword [eax], edx
pop ebx
ret

Function at 0x4ea5a0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x54f378
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push esi
push edi
mov eax, dword [0x5a1574]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x9c]
cmp dword [esi + 0x18], 8
jb 0x4ea5db
mov eax, dword [esi + 4]
jmp 0x4ea5de
lea eax, [esi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4ea60b
mov esi, dword [esp + 0xa0]
test esi, esi
je 0x4ea604
mov dword [esi], 0
call fcn.00503650
mov dword [esi + 4], eax
mov al, 1
jmp 0x4ea6a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.00503650
cmp ebx, 0xb7
jne 0x4ea653
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.004e9fb0
add esp, 0xc
cmp dword [eax], 3
jne 0x4ea653
mov esi, dword [esp + 0xa0]
test esi, esi
je 0x4ea6a2
mov dword [esi], 0
call fcn.00503650
mov dword [esi + 4], eax
jmp 0x4ea6a2
mov edi, dword [esp + 0xa0]
test edi, edi
jne 0x4ea698
push str.boost::filesystem::create_directory
lea ecx, [esp + 0x20]
call fcn.004020cc
mov dword [esp + 0x94], edi
call fcn.00503650
push eax
push ebx
push esi
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x48]
call fcn.004e9540
push 0x590fac
lea eax, [esp + 0x3c]
push eax
call fcn.00516926
call fcn.00503650
mov dword [edi], ebx
mov dword [edi + 4], eax
xor al, al
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x88
ret
Function at 0x4eae70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54f4b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5a1574]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x5a1574]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x4c]
mov esi, ecx
xor ecx, ecx
mov word [esp + 0x10], cx
mov ecx, dword [esp + 0x50]
push edx
push ecx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
call fcn.004e8990
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
push edx
push eax
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.0043620f
cmp dword [esp + 0x24], 8
jb 0x4eaf0c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00514e7a
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00516d58
add esp, 0x30
ret 0x1c

Function at 0x4ebb80
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
xor eax, eax
cmp ecx, edx
je 0x4ebbaf
push esi
push edi
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [ecx]
lea esi, [esi + edi - 0x61c88647]
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x4ebb90
pop edi
pop esi
ret

Function at 0x4f0480
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54f6f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a1574]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401254
mov dword [esp + 0x18], 0
test edi, edi
je 0x4f04c4
add edi, 0x28
jmp 0x4f04c6
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x4f04de
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], 0x56c22c
mov dword [esi + 0x28], 0x56c228
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4f2100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54f968
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a1574]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00401254
mov dword [esi], vtable.std::invalid_argument.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x4f214a
add edi, 0x28
jmp 0x4f214c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x4f2164
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], 0x56c22c
mov dword [esi + 0x28], 0x56c228
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4f85f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x54feb3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5a1574]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00474640
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], ebx
call fcn.00474640
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
call fcn.00474640
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x501cd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x550778
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a1574]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004011ff
mov dword [esi], 0x56cef4
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x501d35
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], 0x56cee0
mov dword [esi + 0x30], 0x56cedc
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x501dd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5507b3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a1574]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00501cd0
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_base.0
lea eax, [esi + 0x30]
mov byte [esp + 0x18], 1
mov dword [esi], 0x56ceec
mov dword [eax], 0x56cee8
mov dword [esi + 0x44], 0x56cefc
cmp edi, ecx
je 0x501e32
lea ecx, [edi + 0x30]
push ecx
push eax
call fcn.00469e60
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x503200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x576018
mov dword [esp], eax
mov dword [esp + 4], 0x55bc2c
mov dword [esp + 8], 0x55bc3c
mov dword [esp + 0xc], 0x56d354
mov dword [esp + 0x10], 0x56d350
mov dword [esp + 0x14], 0x55b0c8
mov dword [esp + 0x18], 0x55af48
mov dword [esp + 0x1c], 0x56d34c
mov dword [esp + 0x20], 0x562eb4
mov dword [esp + 0x24], 0x5764d4
mov dword [esp + 0x28], 0x5764dc
mov dword [esp + 0x2c], 0x559d68
mov dword [esp + 0x30], 0x559f4c
mov dword [esp + 0x34], 0x56d348
mov dword [esp + 0x38], 0x55ad34
mov dword [esp + 0x3c], 0x5764e0
mov dword [esp + 0x40], 0x5764ec
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], 0x56d050
mov dword [esp + 0x4c], str.BDMS
mov dword [esp + 0x50], 0x56d338
mov dword [esp + 0x54], 0x56d334
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x56d330
mov dword [esp + 0x64], 0x56d32c
mov dword [esp + 0x68], 0x576284
mov dword [esp + 0x6c], 0x5764d8
mov dword [esp + 0x70], 0x56d054
mov dword [esp + 0x74], 0x56aa94
mov dword [esp + 0x78], 0x55b0c0
mov dword [esp + 0x7c], 0x56aae8
mov dword [esp + 0x80], 0x56d018
mov dword [esp + 0x84], 0x56d010
mov dword [esp + 0x88], 0x56d008
mov dword [esp + 0x8c], 0x56d04c
mov dword [esp + 0x90], 0x5764e8
mov dword [esp + 0x94], 0x55a930
mov dword [esp + 0x98], 0x576518
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x576514
mov dword [esp + 0xc0], 0x56d0d8
mov dword [esp + 0xc4], 0x56d0c0
mov dword [esp + 0xc8], 0x56b4f8
mov dword [esp + 0xcc], str.ZYXWVUTRQPOLKJIHGFA
mov dword [esp + 0xd0], 0x56d0f8
mov dword [esp + 0xd4], 0x56d328
mov dword [esp + 0xd8], 0x56d024
mov dword [esp + 0xdc], 0x56d0dc
mov dword [esp + 0xe0], 0x55b0c4
mov dword [esp + 0xe4], 0x56d324
mov dword [esp + 0xe8], 0x56d0e8
mov dword [esp + 0xec], 0x56d0d4
cmp cl, 0x3c
jae 0x50341d
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret

Function at 0x516d58
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5a1574]
jne 0x516d62
repz ret
jmp fcn.00521cec
Function at 0x534425
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0052149f
and dword [ebp - 4], 0
cmp dword [0x5a87f0], 0
mov ebx, eax
jne 0x5344d6
push 0x575658
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x534587
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x57564c
push edi
call esi
test eax, eax
je 0x534587
push eax
call fcn.0052142d
mov dword [esp], 0x57563c
push edi
mov dword [0x5a87f0], eax
call esi
push eax
call fcn.0052142d
mov dword [esp], 0x575628
push edi
mov dword [0x5a87f4], eax
call esi
push eax
call fcn.0052142d
mov dword [esp], 0x57560c
push edi
mov dword [0x5a87f8], eax
call esi
push eax
call fcn.0052142d
pop ecx
mov dword [0x5a8800], eax
test eax, eax
je 0x5344d6
push 0x5755f4
push edi
call esi
push eax
call fcn.0052142d
pop ecx
mov dword [0x5a87fc], eax
mov eax, dword [0x5a87fc]
cmp eax, ebx
je 0x53452e
cmp dword [0x5a8800], ebx
je 0x53452e
push eax
call fcn.005214a8
push dword [0x5a8800]
mov esi, eax
call fcn.005214a8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x53452e
test edi, edi
je 0x53452e
call esi
test eax, eax
je 0x534525
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x534525
test byte [ebp - 0xc], 1
jne 0x53452e
or dword [ebp + 0x10], 0x200000
jmp 0x534567
mov eax, dword [0x5a87f4]
cmp eax, ebx
je 0x534567
push eax
call fcn.005214a8
pop ecx
test eax, eax
je 0x534567
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x534567
mov eax, dword [0x5a87f8]
cmp eax, ebx
je 0x534567
push eax
call fcn.005214a8
pop ecx
test eax, eax
je 0x534567
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5a87f0]
call fcn.005214a8
pop ecx
test eax, eax
je 0x534587
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x534589
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x53ca60
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x551aa8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5a1574]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x28]
test esi, esi
jne 0x53caa0
push esi
push esi
push esi
push 2
call fcn.0053dee0
xor al, al
jmp 0x53cc24
call fcn.0053bcf0
push 2
or eax, 0xffffffff
push 0
push esi
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
call fcn.00517cb8
push esi
call fcn.0051ac26
push 0
push 0
push esi
mov edi, eax
call fcn.00517cb8
add esp, 0x1c
test edi, edi
jg 0x53cae7
push 0
push 0
push 0
push 0xd
mov ecx, ebx
call fcn.0053dee0
xor al, al
jmp 0x53cc24
mov dword [esp + 0x14], 0x5a8820
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0
call fcn.0053b9e0
lea eax, [edi + 1]
push eax
call fcn.005168c1
push esi
push 1
mov ebp, eax
push edi
push ebp
mov byte [ebp], 0
call fcn.0051a1b4
add esp, 0x14
cmp eax, 1
je 0x53cb5d
push ebp
call fcn.00514e7a
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, ebx
call fcn.0053dee0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
cmp eax, 0x5a8820
je 0x53cb56
push eax
call fcn.00514e7a
add esp, 4
xor al, al
jmp 0x53cc24
mov byte [edi + ebp], 0
cmp byte [ebp], 0
mov eax, ebp
mov esi, ebp
je 0x53cbcc
jmp 0x53cb70
mov cl, byte [esi]
cmp cl, 0xa
jne 0x53cb8c
mov ecx, esi
sub ecx, eax
inc ecx
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0053bb70
inc esi
mov eax, esi
jmp 0x53cbc7
cmp cl, 0xd
jne 0x53cbc6
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x53cba4
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0053bb70
push 1
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0xa
call fcn.0053bb70
cmp byte [esi + 1], 0xa
jne 0x53cb87
add esi, 2
mov eax, esi
jmp 0x53cbc7
inc esi
cmp byte [esi], 0
jne 0x53cb70
sub esi, eax
je 0x53cbdb
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.0053bb70
push ebp
call fcn.00514e7a
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
mov eax, dword [ebx]
mov eax, dword [eax + 8]
add esp, 4
push ecx
push 0
add edx, 8
push edx
mov ecx, ebx
call eax
cmp byte [ebx + 0x2c], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
jne 0x53cb46
cmp eax, 0x5a8820
je 0x53cc22
push eax
call fcn.00514e7a
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x53f5c0
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x88
push 0xffffffffffffffff
push 0x551d68
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5a1574]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x90]
xor edi, edi
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x53f612
xor eax, eax
jmp 0x53f756
push edi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
call fcn.00467de0
push edi
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x14]
push edx
mov byte [ebp - 4], 1
call fcn.004e9fb0
mov eax, dword [eax]
add esp, 0xc
cmp eax, edi
je 0x53f64f
cmp eax, 1
je 0x53f64f
mov eax, 1
jmp 0x53f651
xor eax, eax
test al, al
sete bl
cmp dword [ebp - 0x20], 8
mov byte [ebp - 4], 0
jb 0x53f66c
mov eax, dword [ebp - 0x34]
push eax
call fcn.00514e7a
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], edi
mov word [ebp - 0x34], cx
test bl, bl
jne 0x53f60b
push 0x55b06c
push esi
call fcn.005180e3
mov esi, eax
add esp, 8
mov dword [ebp - 0x1c], esi
cmp esi, edi
je 0x53f71d
push esi
push 1
lea edx, [ebp]
push 0x84
push edx
call fcn.0051a1b4
add esp, 0x10
cmp eax, 1
jne 0x53f70a
mov eax, dword [ebp]
cmp eax, dword [ebp + 0x94]
jne 0x53f6f7
push esi
call fcn.0053fe90
mov ecx, dword [ebp + 0x14]
add ecx, 0x84
add esp, 4
cmp eax, ecx
jne 0x53f6e4
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0xffffffff
jmp 0x53f74a
mov dword [0x5a882c], 8
mov dword [ebp - 4], 0xffffffff
jmp 0x53f74a
mov dword [0x5a882c], 6
mov dword [ebp - 4], 0xffffffff
jmp 0x53f74a
mov dword [0x5a882c], 2
mov dword [ebp - 4], 0xffffffff
jmp 0x53f74a
mov dword [0x5a882c], 1
mov dword [ebp - 4], 0xffffffff
jmp 0x53f74a
push esi
call fcn.00517df9
mov eax, dword [ebp - 0x18]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.00516d58
add ebp, 0x88
mov esp, ebp
pop ebp
ret