joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55a790
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x638928
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x70a308]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x14]
call fcn.004024e0
mov byte [ebp - 4], 1
push 1
mov eax, dword [0x710418]
push eax
mov ecx, esi
call fcn.0054cc90
push 0x6511cc
mov ecx, dword [esi + 0xb0]
mov edx, dword [ecx + 0x10]
push edx
push str.PASS__s_s
lea eax, [ebp - 0x14]
push eax
call fcn.00402f60
add esp, 0x10
mov edx, dword [ebp - 0x14]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x55a808
sub eax, edi
push str.send___PASS_n
push ebx
push eax
push edx
mov ecx, dword [esi + 0x31e4]
push ecx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0054cd80
mov edi, eax
cmp edi, ebx
je 0x55a85e
mov edx, dword [esi + 0x31f4]
mov dword [edx + 0x140], edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00402550
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 3
lea ecx, [esi + 0x31d8]
call fcn.0058dd80
mov ecx, esi
call fcn.0054c710
mov dword [esi + 0x8c], 4
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00402550
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55a8e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x638958
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x70a308]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x184]
cmp dword [eax], ebx
je 0x55aa2f
cmp dword [eax + 0x16c], ebx
je 0x55aa2f
lea ecx, [ebp - 0x14]
call fcn.004024e0
mov byte [ebp - 4], 1
push 1
mov eax, dword [0x710418]
push eax
mov ecx, esi
call fcn.0054cc90
push 0x6511cc
mov ecx, dword [esi + 0x184]
mov edx, dword [ecx + 0x16c]
push edx
push str.PASS__s_s
lea eax, [ebp - 0x14]
push eax
call fcn.00402f60
add esp, 0x10
mov edx, dword [ebp - 0x14]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x55a975
sub eax, edi
push str.send___proxy_PASS_n
push ebx
push eax
push edx
mov ecx, dword [esi + 0x31e4]
push ecx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0054cd80
mov edi, eax
cmp edi, ebx
je 0x55a9cb
mov edx, dword [esi + 0x31f4]
mov dword [edx + 0x140], edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00402550
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x15
lea ecx, [esi + 0x31d8]
call fcn.0058dd80
mov ecx, esi
call fcn.0054c710
mov dword [esi + 0x8c], 4
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00402550
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55b240
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x638a18
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x70a308]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x14]
call fcn.004024e0
mov byte [ebp - 4], 1
push 1
mov eax, dword [0x7103f4]
push eax
mov ecx, esi
call fcn.0054cc90
mov ecx, dword [esi + 0xb0]
mov eax, dword [ecx + 4]
push 0x6511cc
push 0x6511cc
cmp eax, ebx
je 0x55b2bb
push eax
push str.CWD__s_sTYPE_I_s
lea edx, [ebp - 0x14]
push edx
call fcn.00402f60
add esp, 0x14
jmp 0x55b2cc
push str.TYPE_I_sNOOP_s
lea eax, [ebp - 0x14]
push eax
call fcn.00402f60
add esp, 0x10
mov dword [esi + 0x8c], 0xb
mov ecx, esi
call fcn.0054c710
push 0x3ff
push ebx
lea ecx, [esi + 0x3230]
push ecx
call fcn.005f8cb0
add esp, 0xc
mov edx, dword [ebp - 0x14]
mov eax, edx
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x55b300
sub eax, edi
push str.send___test_sequence
push ebx
push eax
push edx
mov edx, dword [esi + 0x31e4]
push edx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0054cd80
mov edi, eax
cmp edi, ebx
je 0x55b337
mov eax, dword [esi + 0x31f4]
mov dword [eax + 0x140], edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00402550
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55b460
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x638a71
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x70a308]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x28], esi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x1c]
call fcn.004024e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004024e0
mov byte [ebp - 4], 2
mov eax, dword [esi + 0x184]
cmp dword [eax], ebx
je 0x55b50b
mov ecx, dword [esi + 0xb0]
mov eax, dword [ecx + 0x14]
cmp eax, 0x15
je 0x55b4dc
push eax
push str.:_ld
lea edx, [ebp - 0x18]
push edx
call fcn.00402f60
add esp, 0xc
jmp 0x55b4e9
push 0x64f8bc
lea ecx, [ebp - 0x18]
call fcn.00402fc0
mov eax, dword [esi + 0xb0]
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [eax]
push edx
mov eax, dword [eax + 0xc]
push eax
push str._s__s_s
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00402f60
add esp, 0x14
lea ecx, [ebp - 0x14]
call fcn.004024e0
mov byte [ebp - 4], 3
push 1
mov edx, dword [0x710414]
push edx
mov ecx, esi
call fcn.0054cc90
mov eax, dword [esi + 0x184]
cmp dword [eax], ebx
je 0x55b536
mov eax, dword [ebp - 0x1c]
jmp 0x55b556
mov ecx, dword [esi + 0xb0]
mov edx, dword [ecx + 0xc]
push edx
lea ecx, [ebp - 0x24]
call fcn.004030e0
mov byte [ebp - 4], 4
mov ebx, 1
mov dword [ebp - 0x20], ebx
mov eax, dword [eax]
push 0x6511cc
push eax
push str.USER__s_s
lea eax, [ebp - 0x14]
push eax
call fcn.00402f60
add esp, 0x10
mov dword [ebp - 4], 3
test bl, 1
je 0x55b587
and ebx, 0xfffffffe
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x24]
call fcn.00402550
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, esi
call fcn.0054c540
mov edx, dword [ebp - 0x14]
mov eax, edx
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x55b5a0
sub eax, edi
push str.send___USER_n
push 0
push eax
push edx
mov edx, dword [esi + 0x31e4]
push edx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0054cd80
mov edi, eax
test edi, edi
je 0x55b610
mov eax, dword [esi + 0x31f4]
mov dword [eax + 0x140], edi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00402550
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00402550
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00402550
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
lea ecx, [esi + 0x31d8]
call fcn.0058dd80
mov ecx, esi
call fcn.0054c710
mov dword [esi + 0x8c], 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00402550
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00402550
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00402550
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x55d460
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x638d39
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x70a308]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x24], esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x18]
call fcn.004024e0
mov byte [ebp - 4], 1
push 0x64f8bc
lea ecx, [ebp - 0x14]
call fcn.004030e0
mov byte [ebp - 4], 2
mov eax, dword [esi + 0xb0]
mov ecx, dword [eax + 4]
cmp ecx, ebx
je 0x55d4f8
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x55d4c7
sub eax, edi
test eax, eax
jle 0x55d4f8
cmp byte [ecx + eax - 1], 0x2f
mov eax, 0x64f8bc
je 0x55d4e5
mov eax, 0x653d00
push eax
push ecx
push 0x64ed70
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f60
add esp, 0x10
push str.Get_MDTM..._r_n
mov ecx, esi
call fcn.0054c540
mov edx, dword [esi + 0xb0]
cmp byte [edx + 0x195], 0
je 0x55d518
mov eax, dword [ebp - 0x14]
jmp 0x55d533
push 0x64f8bc
lea ecx, [ebp - 0x20]
call fcn.004030e0
mov byte [ebp - 4], 3
mov ebx, 1
mov dword [ebp - 0x1c], ebx
mov eax, dword [eax]
push 0x6511cc
mov ecx, dword [esi + 0xb0]
mov edx, dword [ecx + 8]
push edx
push eax
push str.MDTM__s_s_s
lea eax, [ebp - 0x18]
push eax
call fcn.00402f60
add esp, 0x14
mov dword [ebp - 4], 2
test bl, 1
je 0x55d56e
and ebx, 0xfffffffe
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x20]
call fcn.00402550
mov edx, dword [ebp - 0x18]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x55d576
sub eax, edi
push str.send___MDTM
push 0
push eax
push edx
mov ecx, dword [esi + 0x31e4]
push ecx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0054cd80
mov edi, eax
test edi, edi
je 0x55d5da
mov edx, dword [esi + 0x31f4]
mov dword [edx + 0x140], edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00402550
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402550
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x13
lea ecx, [esi + 0x31d8]
call fcn.0058dd80
mov ecx, esi
call fcn.0054c710
mov dword [esi + 0x8c], 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00402550
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402550
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5622f0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6390d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x70a308]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
call fcn.00598de0
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi], vtable.FTPSession.0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [esi + 0x14c], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0xfc], eax
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0xc], ecx
mov ecx, esi
call fcn.00598670
mov edx, dword [ebp + 0x18]
mov dword [esi + 8], edx
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x24c], eax
mov ecx, esi
call fcn.00561960
push edi
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi + 0x880], eax
mov dword [ebp - 4], edi
jmp 0x56239e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x564fe0
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
lea ecx, [ebx + 3]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
push esi
mov esi, dword [esp + 0x18]
lea edx, [edx + ebx + 7]
push edx
push esi
call fcn.00564350
add esp, 8
test eax, eax
jne 0x56500f
pop esi
pop ebx
pop ecx
ret 0xc
push esi
call fcn.00540d70
mov ecx, eax
add esp, 4
xor eax, eax
test ebx, ebx
jbe 0x5650de
lea edx, [ebx - 1]
mov eax, 0xaaaaaaab
mul edx
push ebp
mov ebp, edx
shr ebp, 1
inc ebp
mov esi, 2
lea eax, [ebp + ebp*2]
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], eax
lea ebx, [ebx]
lea edx, [esi - 1]
cmp edx, ebx
jae 0x56505c
mov al, byte [edi + 1]
jmp 0x56505e
xor al, al
cmp esi, ebx
jae 0x565067
mov dl, byte [edi + 2]
jmp 0x565069
xor dl, dl
movzx esi, byte [edi]
shr esi, 2
movzx ebx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
movzx esi, byte [edi]
movzx eax, al
and esi, 3
mov ebx, eax
shl esi, 4
shr ebx, 4
or esi, ebx
movzx ebx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx esi, dl
and eax, 0xf
mov edx, esi
mov byte [ecx + 1], bl
mov ebx, dword [esp + 0x1c]
add eax, eax
inc ecx
shr edx, 6
add eax, eax
or edx, eax
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
and esi, 0x3f
mov byte [ecx], al
mov dl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov esi, dword [esp + 0x20]
inc ecx
mov byte [ecx], dl
add esi, 3
inc ecx
add edi, 3
sub ebp, 1
mov dword [esp + 0x20], esi
jne 0x565050
mov eax, dword [esp + 0x10]
pop edi
pop ebp
lea edx, [ebx + 1]
cmp eax, edx
jne 0x5650f7
pop esi
mov byte [ecx - 1], 0x3d
mov byte [ecx], 0
mov eax, 1
pop ebx
pop ecx
ret 0xc
add ebx, 2
cmp eax, ebx
jne 0x565106
mov al, 0x3d
mov byte [ecx - 1], al
mov byte [ecx - 2], al
pop esi
mov byte [ecx], 0
mov eax, 1
pop ebx
pop ecx
ret 0xc
Function at 0x565cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6392b0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x70a308]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x31e8]
mov ecx, dword [eax + 0xb8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [esi + 0xb0]
call fcn.005b4270
mov eax, dword [esi + 0x31e8]
mov edi, 1
mov dword [eax + 0x138], edi
mov ecx, dword [esi + 0xb0]
cmp dword [ecx + 0x310], 0
je 0x565d57
mov eax, dword [esi + 0x31e8]
test eax, eax
je 0x565d57
cmp dword [eax + 0x40], 0
jne 0x565e0e
mov eax, dword [esi + 0x31e8]
mov edx, dword [eax + 0xc8]
or edx, dword [eax + 0xcc]
je 0x565e07
xor bl, bl
mov byte [ebp - 0x11], bl
mov dword [ebp + 8], 4
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push str.bIgnMTCh
mov edx, dword [0x70f604]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x565da7
cmp dword [ebp - 0x18], eax
je 0x565da7
mov bl, 1
mov byte [ebp - 0x11], bl
mov eax, dword [esi + 0xb0]
mov eax, dword [eax + 8]
test eax, eax
je 0x565e07
test bl, bl
jne 0x565e07
push 0x3f
push eax
call fcn.005f9b50
add esp, 8
test eax, eax
jne 0x565e07
mov ecx, dword [esi + 0x31e8]
cmp dword [ecx + 0x13c], eax
jne 0x565dfa
push 0x50044
mov edx, dword [esi + 0xb0]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [0x7104dc]
push ecx
push 0
call fcn.00469b60
add esp, 0x10
cmp eax, 7
je 0x565e0e
mov dword [esi + 0x3240], edi
mov byte [esi + 0x3244], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x578090
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x639fb0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x70a308]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
lea esi, [edi + 0x86c]
mov dword [esi], eax
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x14]
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
xor eax, eax
cmp dword [esi], 0xffffffff
je 0x578113
mov dword [ebp - 0x18], eax
cmp eax, 0x20
jge 0x578133
mov edx, eax
imul edx, edx, 0x3458
mov ecx, dword [edi + 0x25c]
mov dword [edx + ecx + 0xf8], esi
inc eax
jmp 0x5780f3
mov dword [ebp - 0x1c], eax
cmp eax, 0x20
jge 0x578133
mov edx, eax
imul edx, edx, 0x3458
mov ecx, dword [edi + 0x25c]
mov dword [edx + ecx + 0xf8], ebx
inc eax
jmp 0x578113
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5788b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
mov eax, dword [0x70a308]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
lea esp, [esp]
push 0
lea edx, [esp + 0x1c]
mov eax, esi
sub eax, 4
push edx
mov ecx, ebx
push eax
sbb ecx, 0
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
call ebp
cmp eax, 0xffffffff
jne 0x578910
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x578a00
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x578a00
cmp dword [esp + 0x10], 4
jne 0x578a00
lea edx, [esp + 0x20]
push edx
call fcn.0058e660
add esp, 4
test eax, eax
jbe 0x578a00
xor ecx, ecx
mov edx, 0xfffffffc
sub edx, eax
mov eax, 0xffffffff
sbb eax, ecx
add esi, edx
adc ebx, eax
js 0x578a00
jg 0x578979
test esi, esi
jbe 0x578a00
push 0
lea ecx, [esp + 0x1c]
push ecx
push esi
push edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebx
call ebp
cmp eax, 0xffffffff
jne 0x57899b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x578a00
push 0
lea edx, [esp + 0x14]
push edx
push 0xc
lea eax, [esp + 0x2c]
push eax
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5789c3
cmp dword [esp + 0x10], 0xc
jne 0x578a00
lea ecx, [esp + 0x24]
push ecx
call fcn.0058e630
movsx edx, byte [esp + 0x2b]
shl edx, 0x18
add esp, 4
or eax, edx
je 0x5788e0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005f85e7
add esp, 0x20
ret 0x10
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.005f85e7
add esp, 0x20
ret 0x10
Function at 0x57a070
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x63a1c0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70a308]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, dword [esp + 0x50]
cmp edi, 0x7d000
ja 0x57a260
push edi
call fcn.005cfaa6
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
je 0x57a260
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov ebp, dword [esp + 0x44]
push ebx
lea edx, [esp + 0x20]
push edx
push eax
push ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x57a0f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x57a257
push ebx
lea eax, [esp + 0x18]
push eax
push edi
push esi
push ebp
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x57a257
cmp dword [esp + 0x14], edi
jne 0x57a257
lea ecx, [esp + 0x20]
call fcn.0053fcc0
mov dword [esp + 0x3c], ebx
push ebx
push edi
push esi
lea ecx, [esp + 0x2c]
call fcn.00540b10
cmp eax, ebx
jge 0x57a152
push esi
call fcn.005cfa9b
add esp, 4
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.0053fd20
jmp 0x57a260
push ebx
lea ecx, [esp + 0x24]
call fcn.0053fc30
mov ecx, eax
call fcn.0053fcb0
push eax
lea ecx, [esp + 0x54]
call fcn.004030e0
mov byte [esp + 0x3c], 1
lea ecx, [esp + 0x50]
push str.onMetaData
push ecx
call fcn.004216f0
add esp, 8
test al, al
je 0x57a23c
lea edx, [esp + 0x44]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push str.duration
call fcn.004030e0
mov byte [esp + 0x44], 2
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x48], 1
call fcn.0058f490
add esp, 0xc
cmp al, bl
je 0x57a1fa
mov ecx, dword [esp + 0x44]
call fcn.0053fb20
mov ecx, dword [esp + 0x54]
push esi
fstp qword [ecx]
call fcn.005cfa9b
add esp, 4
mov byte [esp + 0x3c], bl
lea ecx, [esp + 0x50]
call fcn.00402550
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.0053fd20
mov eax, 1
jmp 0x57a262
lea edx, [esp + 0x44]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push str.isLive
call fcn.004030e0
mov byte [esp + 0x44], 3
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x48], 1
call fcn.0058f490
add esp, 0xc
cmp al, bl
je 0x57a23c
mov ecx, dword [esp + 0x44]
call fcn.0053fb30
test al, al
je 0x57a23c
fldz
jmp 0x57a1c6
push esi
call fcn.005cfa9b
add esp, 4
mov byte [esp + 0x3c], bl
lea ecx, [esp + 0x50]
call fcn.00402550
jmp 0x57a13c
push esi
call fcn.005cfa9b
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x14
Function at 0x57a280
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x24
mov eax, dword [0x70a308]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
xor ebp, ebp
push ebp
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x14]
push ecx
push ebp
push ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x57a2dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x57a2dc
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005f85e7
add esp, 0x24
ret 0x10
push ebp
lea edx, [esp + 0xc]
push edx
push 3
lea eax, [esp + 0x28]
push eax
push ebx
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x57a2c7
cmp dword [esp + 8], 3
jne 0x57a2c7
cmp byte [esp + 0x1c], 0x46
jne 0x57a2c7
cmp byte [esp + 0x1d], 0x4c
jne 0x57a2c7
cmp byte [esp + 0x1e], 0x56
jne 0x57a2c7
push esi
push edi
mov esi, 0xd
xor edi, edi
lea ecx, [ecx]
push ebp
lea ecx, [esp + 0x1c]
push ecx
push esi
push ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x57a349
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x57a3e3
push ebp
lea edx, [esp + 0x14]
push edx
push 0xb
lea eax, [esp + 0x30]
push eax
push ebx
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x57a3e3
cmp dword [esp + 0x10], 0xb
jne 0x57a3e3
lea ecx, [esp + 0x25]
push ecx
call fcn.0058e630
add esp, 4
add esi, 0xb
adc edi, 0
cmp byte [esp + 0x24], 0x12
mov ebp, eax
jne 0x57a39e
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edx
push ebp
push edi
push esi
push ebx
call fcn.0057a070
test eax, eax
jne 0x57a3c9
add ebp, 4
add esi, ebp
adc edi, 0
cmp edi, dword [esp + 0x40]
jg 0x57a3e3
jl 0x57a3b4
cmp esi, dword [esp + 0x3c]
ja 0x57a3e3
test edi, edi
jg 0x57a3e3
jl 0x57a3c2
cmp esi, 0x500000
ja 0x57a3e3
xor ebp, ebp
jmp 0x57a320
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005f85e7
add esp, 0x24
ret 0x10
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.005f85e7
add esp, 0x24
ret 0x10