joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f013
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
cmp esi, 2
jb 0x47f0ad
push ebp
mov ebp, esi
shr ebp, 1
mov ebx, dword [edi]
sub esi, 2
mov edx, dword [edi + 4]
movzx eax, cx
shr ebx, 0x10
xor ebx, eax
mov eax, edx
shr eax, 0x18
mov ecx, ebx
shr ecx, 8
mov cx, word [ecx*2 + 0x5d2a90]
xor cx, word [eax*2 + 0x5d2290]
movzx eax, byte [edi + 5]
xor cx, word [eax*2 + 0x5d1e90]
movzx eax, byte [edi + 6]
xor cx, word [eax*2 + 0x5d2090]
movzx eax, byte [edi + 1]
xor cx, word [eax*2 + 0x5d2690]
movzx eax, bl
xor cx, word [eax*2 + 0x5d2890]
mov eax, dword [edi]
add edi, 8
movzx eax, al
xor cx, word [eax*2 + 0x5d2490]
movzx eax, dl
xor cx, word [eax*2 + 0x5d1c90]
movzx ecx, cx
sub ebp, 1
jne 0x47f030
pop ebp
test esi, esi
je 0x47f0ef
mov ebx, dword [edi]
mov edx, ebx
movzx eax, cx
shr edx, 0x10
xor edx, eax
movzx eax, byte [edi + 1]
mov ecx, edx
shr ecx, 8
mov cx, word [ecx*2 + 0x5d2290]
xor cx, word [eax*2 + 0x5d1e90]
movzx eax, dl
xor cx, word [eax*2 + 0x5d2090]
movzx eax, bl
xor cx, word [eax*2 + 0x5d1c90]
movzx ecx, cx
pop edi
pop esi
mov ax, cx
pop ebx
ret

Function at 0x47f0f6
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor al, al
test edx, edx
je 0x47f11a
push esi
mov esi, dword [esp + 8]
movzx ecx, byte [esi]
movzx eax, al
xor ecx, eax
inc esi
mov al, byte [ecx + 0x5d2c90]
sub edx, 1
jne 0x47f105
pop esi
ret
Function at 0x4b5270
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x4b541f
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x4b541f
push esi
mov esi, dword [esp + 0x24]
push edi
test esi, esi
je 0x4b52a6
mov eax, dword [esi + 4]
test eax, eax
je 0x4b52b6
push dword [esi]
push 0x18
call eax
add esp, 8
jmp 0x4b52b0
push 0x18
call fcn.005785d4
add esp, 4
mov edi, eax
test edi, edi
jne 0x4b52c0
pop edi
pop esi
pop ebp
mov eax, 0xfffffffc
pop ebx
ret
mov eax, dword [esp + 0x24]
mov dword [edi + 4], eax
lea eax, [edi + 8]
mov dword [edi], ebx
test eax, eax
je 0x4b5320
test esi, esi
je 0x4b5305
cmp dword [esi], 0
jne 0x4b52eb
cmp dword [esi + 0xc], 0
jne 0x4b52f1
cmp dword [esi + 4], 0
jne 0x4b52eb
cmp dword [esi + 8], 0
je 0x4b5305
cmp dword [esi + 0xc], 0
je 0x4b5320
cmp dword [esi + 4], 0
jne 0x4b52fd
cmp dword [esi + 8], 0
je 0x4b5320
movups xmm0, xmmword [esi]
movups xmmword [eax], xmm0
jmp 0x4b5320
mov dword [eax], 0
mov dword [eax + 4], 0x481850
mov dword [eax + 8], 0x481860
mov dword [eax + 0xc], 0x4817e0
lea eax, [esp + 0x14]
push eax
push 0
push edi
push 0x4b5530
push dword [esp + 0x2c]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov dword [ebp], ecx
test ecx, ecx
jne 0x4b5385
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004b1c50
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4b5418
test esi, esi
je 0x4b5375
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4b537e
push dword [esi]
push edi
call ecx
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call fcn.005785df
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
mov eax, dword [esp + 0x18]
add eax, 5
cmp eax, 6
ja case.0x4b5391.2
jmp dword [eax*4 + 0x4b5428]
mov eax, 0xfffffff1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
or eax, 0xffffffff
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, 2
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, 0xf
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
xor eax, eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop ebp
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x4bafd0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
movzx eax, word [esi + 0x20]
cmp eax, 6
ja case.0x4bafe8.12
jmp dword [eax*4 + 0x4bb1c8]
cmp word [esi + 0x18], 8
je case.0x4bafe8.12
movzx eax, word [esi + 0x18]
mov edi, 1
mov cl, al
shl edi, cl
mov ecx, 0xff
dec edi
cmp eax, 0x10
cmove edi, ecx
lea eax, [edi + 1]
push eax
call fcn.004b62d0
add esp, 4
mov dword [esi + 0x38], eax
test eax, eax
jne 0x4bb050
push str.No_space_for_photometric_conversion_table
push dword [esi]
call fcn.004b6bc0
add esp, 4
push eax
mov eax, dword [esi]
push dword [eax + 0x304]
call fcn.004c1110
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor ebx, ebx
cmp word [esi + 0x20], bx
jne 0x4bb07a
test edi, edi
js 0x4bb096
imul ebp, edi, 0xff
mov eax, ebp
mov ecx, dword [esi + 0x38]
cdq
sub ebp, 0xff
idiv edi
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jle 0x4bb062
jmp 0x4bb096
test edi, edi
js 0x4bb096
xor ebp, ebp
mov eax, ebp
mov ecx, dword [esi + 0x38]
cdq
add ebp, 0xff
idiv edi
mov byte [ebx + ecx], al
inc ebx
cmp ebx, edi
jle 0x4bb080
cmp word [esi + 0x18], 0x10
ja case.0x4bafe8.12
movzx eax, word [esi + 0x20]
cmp eax, 1
je 0x4bb0ab
test ax, ax
jne case.0x4bafe8.12
push esi
call fcn.004bc3e0
add esp, 4
test eax, eax
jne 0x4bb0c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push dword [esi + 0x38]
call fcn.004b62c0
add esp, 4
mov dword [esi + 0x38], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
mov cl, byte [esi + 0x18]
mov eax, 1
mov ebp, dword [esi + 0x24]
mov edx, ebp
mov ebx, dword [esi + 0x2c]
mov edi, dword [esi + 0x28]
shl eax, cl
mov ecx, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
test ecx, ecx
jle 0x4bb13c
mov dword [esp + 0x1c], 0x100
nop word [eax + eax]
mov ax, word [edx]
lea edx, [edx + 2]
dec ecx
cmp ax, word [esp + 0x1c]
jae 0x4bb17e
mov ax, word [edi]
add edi, 2
cmp ax, word [esp + 0x1c]
jae 0x4bb17e
mov ax, word [ebx]
add ebx, 2
cmp ax, word [esp + 0x1c]
jae 0x4bb17e
test ecx, ecx
jg 0x4bb110
push str.Assuming_8_bit_colormap
push dword [esi]
call fcn.004b6bc0
add esp, 4
push eax
mov eax, dword [esi]
push dword [eax + 0x304]
call fcn.004c10d0
add esp, 0xc
cmp word [esi + 0x18], 8
ja case.0x4bafe8.12
push esi
call fcn.004bc690
add esp, 4
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
add edx, 0xffffffff
js 0x4bb15c
mov eax, dword [esi + 0x28]
sub ebp, eax
mov ebx, dword [esp + 0x14]
sub ebx, eax
lea ecx, [eax + edx*2]
nop word [eax + eax]
sub edx, 1
movzx eax, byte [ecx + ebp + 1]
mov word [ecx + ebp], ax
lea ecx, [ecx - 2]
movzx eax, byte [ecx + 3]
mov word [ecx + 2], ax
movzx eax, byte [ebx + ecx + 3]
mov word [ebx + ecx + 2], ax
jns 0x4bb1a0
jmp 0x4bb15c
Function at 0x4f81a0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4f81c0
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4f81c0
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4f81c0
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x542820
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x542854
push esi
call fcn.00541e40
add esp, 4
cmp byte [esi + 0x40], 0
je 0x54284b
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
jmp 0x54285b
cmp eax, 0xcb
jne 0x5428d3
mov eax, dword [esi + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x5428be
mov eax, dword [esi + 8]
test eax, eax
je 0x542876
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x5428b9
cmp eax, 2
je 0x5428be
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x542867
cmp eax, 3
je 0x54289e
cmp eax, 1
jne 0x542867
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x542867
mov eax, dword [esi + 0x128]
add eax, edi
mov dword [edx + 8], eax
jmp 0x542867
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.00542910
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x5428f5
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.00542910
add esp, 4
pop edi
pop esi
ret

Function at 0x542910
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
cmp dword [esi + 0x14], 0xcc
lea ebx, [esi + 0x78]
je 0x54293f
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [ebx], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x5429c2
nop dword [eax + eax]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x542996
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x542975
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x19c]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x5429d9
cmp eax, dword [esi + 0x60]
jb 0x542957
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
jne 0x542950
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x5485e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov edx, 0x100
mov ebp, dword [edi + 0x4c]
cmp ebp, 1
mov esi, dword [edi + 0x1c0]
sete al
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebp
mov byte [esi + 0x1c], al
mov eax, 0x2fe
push dword [edi + 0x64]
mov ecx, dword [edi + 4]
cmovne eax, edx
push eax
push 1
push edi
mov eax, dword [ecx + 8]
call eax
xor ebx, ebx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [esp + 0x10], ebx
cmp dword [edi + 0x64], ebx
jle 0x548713
nop dword [eax]
mov ecx, dword [esi + ebx*4 + 0x20]
cdq
idiv ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
cmp ebp, 1
jne 0x54865e
mov eax, dword [esi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x18]
lea edi, [ecx*2 - 2]
mov ebp, dword [eax + ebx*4]
lea eax, [ecx + 0xfe]
cdq
xor ebx, ebx
idiv edi
xor esi, esi
mov edx, eax
nop word [eax + eax]
cmp esi, edx
jle 0x5486a4
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x548692
mov ecx, dword [esp + 0x14]
movzx ecx, cl
movzx eax, bl
imul ecx, eax
mov byte [esi + ebp], cl
inc esi
mov ecx, dword [esp + 0x1c]
cmp esi, 0xff
jle 0x548680
cmp dword [esp + 0x18], 1
jne 0x5486f1
mov ecx, 1
lea edx, [ebp - 1]
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x5486d0
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
inc ebx
mov esi, dword [esp + 0x20]
cmp ebx, dword [eax + 0x64]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
jl 0x548640
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x575bd0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [ebx + 0x48]
mov ecx, dword [edi + 0x18]
cmp ecx, 0xc
jle 0x575bed
pop edi
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop ebx
ret
push ebp
push esi
cmp dword [edi + 0x2c], ecx
jge 0x575cad
lea esi, [edi + 0x44]
nop dword [eax + eax]
mov dl, byte [esi]
test dl, dl
jne 0x575c7f
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x575c1b
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x575c2b
push dword [ecx + 0x38]
push 1
push 1
push esi
call fcn.0058e4a6
add esp, 0x10
cmp eax, 1
jne 0x575d06
mov al, byte [esi]
test al, al
je 0x575cf7
mov edx, dword [ebx + 0x48]
lea ebp, [esi + 1]
movzx eax, al
mov ecx, dword [edx + 0x3c]
test ecx, ecx
je 0x575c58
push eax
push ebp
push ebx
call ecx
add esp, 0xc
jmp 0x575c67
push dword [edx + 0x38]
push eax
push 1
push ebp
call fcn.0058e4a6
add esp, 0x10
mov dl, byte [esi]
mov ecx, eax
movzx eax, dl
cmp ecx, eax
jne 0x575d06
mov al, byte [ebp]
mov byte [ebp], 2
jmp 0x575c8d
mov cl, byte [esi + 1]
movzx eax, cl
inc cl
mov al, byte [eax + esi]
mov byte [esi + 1], cl
dec dl
movzx eax, al
mov byte [esi], dl
mov ecx, dword [edi + 0x2c]
shl eax, cl
or dword [edi + 0x30], eax
lea eax, [ecx + 8]
mov dword [edi + 0x2c], eax
mov ecx, dword [edi + 0x18]
cmp eax, ecx
jl 0x575c00
mov eax, dword [esp + 0x18]
movzx ecx, word [ecx*2 + 0x60911c]
and ecx, dword [edi + 0x30]
mov dword [eax], ecx
mov ecx, dword [edi + 0x18]
shr dword [edi + 0x30], cl
sub dword [edi + 0x2c], ecx
mov eax, dword [edi + 0x14]
cmp eax, 0x1001
jge 0x575ced
mov edx, dword [edi + 0x1c]
inc eax
mov dword [edi + 0x14], eax
cmp eax, edx
jle 0x575ced
cmp ecx, 0xc
jge 0x575ced
lea eax, [edx + edx]
mov dword [edi + 0x1c], eax
lea eax, [ecx + 1]
mov dword [edi + 0x18], eax
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
ret
pop esi
pop ebp
mov eax, 0x70
mov dword [ebx + 0x40], eax
xor eax, eax
pop edi
pop ebx
ret
pop esi
pop ebp
mov eax, 0x66
mov dword [ebx + 0x40], eax
xor eax, eax
pop edi
pop ebx
ret

Function at 0x576070
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x57608f
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x5760a3
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call fcn.0058e4a6
add esp, 0x10
cmp eax, 1
jne 0x5760f9
mov al, byte [esp + 0xc]
lea ecx, [edi + 0x44]
test al, al
je 0x576105
mov edx, dword [esp + 0x10]
mov dword [edx], ecx
mov byte [ecx], al
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x5760d7
movzx eax, byte [esp + 0xc]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x5760ee
push dword [eax + 0x38]
movzx eax, byte [esp + 0x10]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call fcn.0058e4a6
add esp, 0x10
mov ecx, eax
movzx eax, byte [esp + 0xc]
cmp ecx, eax
je 0x576119
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
mov dword [eax], 0
mov byte [ecx], 0
mov dword [edi + 0x34], 0
pop edi
mov eax, 1
pop esi
ret
Function at 0x576130
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x57614f
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x576163
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call fcn.0058e4a6
add esp, 0x10
cmp eax, 1
jne 0x5761b9
mov cl, byte [esp + 0xc]
test cl, cl
je 0x5761c5
mov edx, dword [esp + 0x10]
lea eax, [edi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x576197
movzx eax, byte [esp + 0xc]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x5761ae
push dword [eax + 0x38]
movzx eax, byte [esp + 0x10]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call fcn.0058e4a6
add esp, 0x10
mov ecx, eax
movzx eax, byte [esp + 0xc]
cmp ecx, eax
je 0x5761cf
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
mov dword [eax], 0
pop edi
mov eax, 1
pop esi
ret
Function at 0x5765a0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x5765b8
mov dword [esi + 0x40], 0x6f
xor eax, eax
pop esi
ret
push esi
push esi
call fcn.00576740
add esp, 8
test eax, eax
je 0x5765b4
lea eax, [esi + 4]
push eax
push esi
call fcn.00576740
add esp, 8
test eax, eax
je 0x5765b4
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x5765f0
push 3
lea ecx, [esp + 0xc]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x576604
push dword [ecx + 0x38]
lea eax, [esp + 0xc]
push 3
push 1
push eax
call fcn.0058e4a6
add esp, 0x10
cmp eax, 3
je 0x576626
push dword [esi + 0x14]
mov dword [esi + 0x40], 0x66
call fcn.00576ea0
add esp, 4
mov dword [esi + 0x14], 0
xor eax, eax
pop esi
ret
mov dl, byte [esp + 8]
movzx ecx, dl
mov eax, ecx
shr eax, 4
and eax, 7
inc eax
push ebx
mov dword [esi + 8], eax
mov bl, dl
movzx eax, byte [esp + 0xd]
shr bl, 3
mov dword [esi + 0xc], eax
and bl, 1
mov al, byte [esp + 0xe]
mov byte [esi + 0x10], al
push edi
test dl, dl
jns 0x576723
and ecx, 7
mov eax, 1
inc ecx
shl eax, cl
push 0
push eax
call fcn.00576f50
add esp, 8
mov dword [esi + 0x14], eax
test eax, eax
jne 0x576682
pop edi
pop ebx
mov dword [esi + 0x40], 0x6d
pop esi
ret
mov byte [eax + 8], bl
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp dword [eax], ebx
jle 0x57672a
xor edi, edi
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x5766ad
push 3
lea ecx, [esp + 0x14]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x5766c1
push dword [ecx + 0x38]
lea eax, [esp + 0x14]
push 3
push 1
push eax
call fcn.0058e4a6
add esp, 0x10
mov ecx, dword [esi + 0x14]
cmp eax, 3
jne 0x576706
mov ecx, dword [ecx + 0xc]
inc ebx
movzx eax, byte [esp + 0x10]
mov byte [edi + ecx], al
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0xc]
movzx eax, byte [esp + 0x11]
mov byte [ecx + edi + 1], al
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0xc]
movzx eax, byte [esp + 0x12]
mov byte [ecx + edi + 2], al
add edi, 3
mov eax, dword [esi + 0x14]
cmp ebx, dword [eax]
jl 0x576694
pop edi
pop ebx
mov eax, 1
pop esi
ret
push ecx
call fcn.00576ea0
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x40], 0x66
xor eax, eax
pop edi
pop ebx
pop esi
ret
mov dword [esi + 0x14], 0
pop edi
pop ebx
mov eax, 1
pop esi
ret

Function at 0x576740
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x57675e
push 2
lea ecx, [esp + 0xc]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x576772
push dword [ecx + 0x38]
lea eax, [esp + 0xc]
push 2
push 1
push eax
call fcn.0058e4a6
add esp, 0x10
cmp eax, 2
je 0x576782
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov ax, word [esp + 8]
movzx ecx, ah
movzx eax, al
shl ecx, 8
or ecx, eax
mov eax, dword [esp + 0xc]
pop esi
mov dword [eax], ecx
mov eax, 1
ret
Function at 0x5767a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push edi
push 0x4c
call fcn.005785d4
mov esi, eax
add esp, 4
test esi, esi
jne 0x5767cf
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x5768f0
pop edi
mov dword [eax], 0x6d
xor eax, eax
pop esi
add esp, 8
ret
push 0x4c
push 0
push esi
call fcn.004314a0
push 0x614c
push 1
call fcn.005785fa
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x57680d
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x5767fc
mov dword [eax], 0x6d
push esi
call fcn.005785df
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 8
ret
push 0x614c
push 0
push edi
call fcn.004314a0
mov eax, dword [esp + 0x24]
add esp, 0xc
mov dword [esi + 0x48], edi
mov dword [edi + 0x3c], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 4], 0
mov dword [edi + 0x38], 0
mov dword [edi], 8
mov ecx, dword [esi + 0x48]
mov dword [esi + 0x44], eax
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x57685b
push 6
lea ecx, [esp + 0xc]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x57686f
push dword [ecx + 0x38]
lea eax, [esp + 0xc]
push 6
push 1
push eax
call fcn.0058e4a6
add esp, 0x10
cmp eax, 6
je 0x576884
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x5768af
mov dword [eax], 0x66
jmp 0x5768af
push 3
lea eax, [esp + 0xc]
mov byte [esp + 0x12], 0
push eax
push str.GIFVER
call fcn.00578610
add esp, 0xc
test eax, eax
je 0x5768c6
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x5768af
mov dword [eax], 0x67
push edi
call fcn.005785df
push esi
call fcn.005785df
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 8
ret
push esi
call fcn.005765a0
add esp, 4
test eax, eax
jne 0x5768f8
push edi
call fcn.005785df
push esi
call fcn.005785df
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x5768f0
mov dword [eax], 0x68
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov dword [esi + 0x40], 0
cmp byte [esp + 0xb], 0x39
sete al
mov byte [edi + 0x6148], al
mov eax, esi
pop edi
pop esi
add esp, 8
ret
Function at 0x5777eb
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x87aae4], 0
push ebx
push esi
mov esi, 0x87aaec
jne 0x577817
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x87ab04], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x87aae4], 1
push dword [0x87ab04]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x5778b4
push 0x14
push 8
push dword [0x876470]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x5778de
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x87aae8]
test eax, eax
je 0x577859
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x87aae8], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x5778e3
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x87ab04]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x876470]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x5778de
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x577eb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x577edd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x577edd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret