joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58c8d0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ebx
mov edi, dword [edi]
mov al, byte [edi]
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x58c93e
xor edx, edx
nop dword [eax]
lea ecx, [edx - 0x30]
movzx eax, al
add ecx, eax
inc edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov eax, 0x66666667
imul esi
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
lea edx, [ecx + ecx*4]
add edx, edx
cmp edx, ebx
jg 0x58c926
test esi, esi
je 0x58c926
mov al, byte [edi]
cmp al, 0x30
jb 0x58c926
cmp al, 0x39
jbe 0x58c8f0
cmp ecx, dword [ebp + 0x10]
jl 0x58c93e
cmp ecx, ebx
jg 0x58c93e
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov eax, 1
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x58d5e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, eax
mov ecx, dword [ebp + 0xc]
neg edx
and edx, 3
dec edx
cmp edx, 3
ja case.default.0x58d5f6
jmp dword [edx*4 + 0x58d698]
mov dl, byte [eax]
cmp dl, cl
je 0x58d695
test dl, dl
je 0x58d695
inc eax
mov dl, byte [eax]
cmp dl, cl
je 0x58d695
test dl, dl
je 0x58d695
inc eax
mov dl, byte [eax]
cmp dl, cl
je 0x58d695
test dl, dl
je 0x58d695
inc eax
mov dl, byte [eax]
cmp dl, cl
je 0x58d695
test dl, dl
je 0x58d695
inc eax
mov edx, dword [eax]
push esi
movzx ecx, cl
push edi
imul edi, ecx, 0x1010101
mov ecx, edx
xor ecx, edi
lea esi, [ecx - 0x1010101]
not ecx
and esi, ecx
lea ecx, [edx - 0x1010101]
not edx
and ecx, edx
or esi, ecx
and esi, 0x80808080
jne 0x58d688
mov edx, dword [eax + 4]
add eax, 4
mov ecx, edx
xor ecx, edi
lea esi, [ecx - 0x1010101]
not ecx
and esi, ecx
lea ecx, [edx - 0x1010101]
not edx
and ecx, edx
or esi, ecx
and esi, 0x80808080
je 0x58d660
bsf ecx, esi
pop edi
mov dword [ebp + 8], ecx
sar ecx, 3
add eax, ecx
pop esi
pop ebp
ret

Function at 0x590c10
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push 1
call fcn.00593180
push dword [ebp + 8]
push 0
mov esi, dword [eax]
call fcn.00593180
add esp, 0x10
push 1
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop esi
test eax, eax
je 0x590c41
xor eax, eax
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00596e5a
add esp, 4
or eax, 0xffffffff
pop ebp
ret
Function at 0x5911f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push dword [ebp + 8]
push 0
call fcn.00593180
push dword [eax]
call fcn.005abc45
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x5912f3
mov ecx, dword [0x667e2c]
not ecx
and ecx, dword [ebp + 0xc]
test cl, 2
je 0x5912f3
mov dword [ebp - 0xc], eax
xorps xmm0, xmm0
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 1
lea eax, [ebp - 0x14]
mov word [ebp - 0x10], 0x100
push eax
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push eax
call fcn.00590b90
add esp, 4
test eax, eax
je 0x5912c2
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x10000000
push eax
push 1
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 5
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x5912c2
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.005932f0
add esp, 8
push esi
push dword [ebp - 8]
push esi
push esi
push 4
push 1
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
lea eax, [ebp - 0xc]
push eax
call fcn.005932c0
mov eax, dword [ebp - 4]
add esp, 4
test eax, eax
je 0x5912e3
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x5912f1
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x591450
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.005aac94
Function at 0x591460
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push 0
movups xmmword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x18], xmm0
call fcn.00593180
add esp, 8
mov ebx, dword [eax]
lea eax, [ebp - 0x28]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
push eax
call fcn.00590b90
neg eax
push ebx
sbb esi, esi
inc esi
call dword [ebp + 8]
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
jne 0x59151d
test esi, esi
jne 0x59151d
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
push eax
call fcn.00590b90
add esp, 4
test eax, eax
jne 0x59151a
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
add esi, 0x28f0
mov eax, dword [esi]
test eax, eax
jne 0x5914f1
call fcn.00596e90
cmp dword [eax], 5
jne 0x59151a
call edi
sub eax, dword [ebp - 4]
cmp eax, 2
ja 0x591524
lea eax, [ebp - 0x28]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
push eax
call fcn.00590b90
add esp, 4
test eax, eax
je 0x5914e6
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5919b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0
jne 0x5919de
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x5919d3
call fcn.00596e90
mov dword [eax], 2
xor eax, eax
pop ebx
pop ebp
ret
push ebx
push 0
call fcn.00593180
add esp, 8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call fcn.00590b90
add esp, 4
cmp eax, 0xffffffff
je 0x5919d9
test al, 0x10
jne 0x591a25
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x591a1a
call fcn.00596e90
mov dword [eax], 0x14
xor eax, eax
pop ebx
pop ebp
ret
push esi
push edi
push 1
push 0x1c
call fcn.00596ea3
push 1
push 0x128
mov edi, eax
call fcn.00596ea3
push ebx
mov esi, eax
call fcn.00591ea0
add esp, 0x14
mov dword [esi], eax
mov dword [edi], esi
mov eax, edi
mov dword [edi + 8], 0xffffffff
mov dword [edi + 0xc], 0x128
mov dword [edi + 0x10], 0x128
mov dword [edi + 4], 8
mov dword [edi + 0x14], 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x591a80
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov ebx, dword [esi]
cmp eax, 0xffffffff
jne 0x591b4d
mov ecx, dword [ebx]
lea edx, [ebp - 0x108]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x591aa7
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x591ac0
sub ecx, edx
cmp byte [ebp + ecx - 0x109], 0x2f
je 0x591af3
lea edi, [ebp - 0x108]
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x591ae0
mov ax, word [0x5c3b14]
mov word [edi], ax
lea edi, [ebp - 0x108]
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x591b00
mov ax, word [0x5d6bc8]
mov word [edi], ax
lea eax, [ebp - 0x108]
push eax
push 0
call fcn.00593180
add esp, 8
lea ecx, [ebp - 0x358]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push eax
call fcn.00590b90
add esp, 4
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x591ba2
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x358]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push eax
call fcn.00590b90
add esp, 4
test eax, eax
jne 0x591ba2
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
mov eax, dword [esi + 0x28f0]
test eax, eax
jne 0x591b7f
call fcn.00596e90
cmp dword [eax], 0x12
jne 0x591b99
mov eax, dword [esi + 0x28f0]
test eax, eax
jne 0x591b93
call fcn.00596e90
mov dword [eax], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test byte [ebp - 0x358], 0x10
mov dword [ebx + 8], 0
sete al
mov dword [ebx + 0xc], 0
lea eax, [eax*4 + 4]
mov byte [ebx + 0x120], al
mov eax, 0x120
mov word [ebx + 0x10], ax
lea eax, [ebp - 0x32c]
push eax
push 0
call fcn.00592e90
push 0x104
lea esi, [ebx + 0x14]
push dword [eax]
push esi
call fcn.005930e0
add esp, 0x14
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x591bf4
mov eax, dword fs:[0x2c]
sub esi, ecx
mov word [ebx + 0x12], si
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x591c18
call fcn.00596e90
pop edi
mov dword [eax], 0
lea eax, [ebx + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x592150
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
push 0
push 0x2000080
push 3
push 0
push 3
push 0x100
push dword [ebp + 8]
or edi, 0xffffffff
call fcn.00593450
push eax
call fcn.00590bc0
add esp, 0x20
mov dword [ebp - 4], eax
test eax, eax
je 0x5921de
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
test esi, esi
jne 0x5921a4
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
jmp 0x5921ba
push esi
call fcn.00593660
lea eax, [ebp - 0x14]
push eax
lea eax, [esi + 8]
push eax
call fcn.00593660
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push eax
call fcn.00590b90
add esp, 4
xor ecx, ecx
test eax, eax
cmovne edi, ecx
pop esi
lea eax, [ebp - 4]
push eax
call fcn.00593420
add esp, 4
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x592a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
xor esi, esi
push esi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
call fcn.00590bc0
mov edi, eax
add esp, 4
test edi, edi
jne 0x592ab9
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x592b11
cmp eax, 9
je 0x592af7
cmp eax, 0x16
je 0x592af7
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x592ae1
call fcn.00596e90
push edi
mov dword [eax], 0x16
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
call fcn.00590b90
or ecx, 0xffffffff
add esp, 4
test eax, eax
cmove esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x592d40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x2c]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, esi
mov edx, dword [eax]
add edx, 0x2cb4
push edi
mov dword [ebp - 4], edx
lea ecx, [ebx + 1]
xor edi, edi
mov al, byte [ebx]
inc ebx
test al, al
jne 0x592d64
push dword [edx]
sub ebx, ecx
call fcn.00596eae
lea eax, [ebx*2 + 2]
push eax
call fcn.00596eb3
mov ebx, eax
add esp, 8
mov eax, dword [ebp - 4]
mov dword [ebp + 8], ebx
mov dword [eax], ebx
mov cl, byte [esi]
test cl, cl
je 0x592daf
lea edx, [esi + 1]
cmp cl, 0xc0
jae 0x592dce
movzx eax, cl
mov word [ebx + edi*2], ax
inc edi
mov esi, edx
mov cl, byte [esi]
test cl, cl
jne 0x592d94
mov eax, dword [ebp - 4]
xor ecx, ecx
mov word [ebx + edi*2], cx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
pop edi
setne cl
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp cl, 0xe0
jae 0x592e1c
mov dl, byte [edx]
lea eax, [edi + 1]
mov dword [ebp - 8], eax
mov al, dl
and al, 0xc0
cmp al, 0x80
jne 0x592e09
and cl, 0x1f
and dl, 0x3f
movzx ecx, cl
shl cx, 6
movzx eax, dl
or cx, ax
movzx eax, cx
mov ecx, 2
mov word [ebx + edi*2], ax
add esi, ecx
mov edi, dword [ebp - 8]
jmp 0x592da6
movzx eax, cl
mov ecx, 1
mov word [ebx + edi*2], ax
add esi, ecx
mov edi, dword [ebp - 8]
jmp 0x592da6
cmp cl, 0xf0
jae 0x592da4
mov dl, byte [edx]
mov al, dl
and al, 0xc0
cmp al, 0x80
jne 0x592e6d
mov bl, byte [esi + 2]
mov al, bl
and al, 0xc0
cmp al, 0x80
jne 0x592e6a
and dl, 0x3f
movzx eax, cl
shl ax, 6
and bl, 0x3f
movzx edx, dl
or dx, ax
movzx eax, bl
mov ebx, dword [ebp + 8]
shl dx, 6
or dx, ax
mov eax, 3
movzx ecx, dx
add esi, eax
mov word [ebx + edi*2], cx
inc edi
jmp 0x592da6
mov ebx, dword [ebp + 8]
movzx ecx, cl
mov eax, 1
add esi, eax
mov word [ebx + edi*2], cx
inc edi
jmp 0x592da6

Function at 0x596b23
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x646698
push 0x646690
push 0x646698
push 0
call fcn.00596a9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x596b55
push dword [ebp + 8]
mov ecx, esi
call fcn.00594959
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x596b97
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x6466c8
push 0x6466c0
push 0x6466c8
push 3
call fcn.00596a9c
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x596bcb
mov ecx, esi
call fcn.00594959
call esi
jmp 0x596bd1
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x5aea96
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005ae915

Function at 0x5b268a
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005b258f

Function at 0x5b308f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005b29fd
Function at 0x5b309a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005b2c38

Function at 0x5b9290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x668a68], 0
je 0x5b9346
cmp dword [0x668a80], 0
je 0x5b9346
call fcn.005bca00
test eax, eax
je 0x5b930e
push dword [0x668a80]
lea eax, [ebp - 4]
push dword [0x668a78]
push eax
push 0
call fcn.005bc1b0
add esp, 0x10
test eax, eax
je 0x5b930e
push dword [0x668a68]
push 1
push dword [ebp - 4]
push eax
call fcn.0059dc18
mov eax, dword [0x668a80]
add esp, 0x10
cdq
add dword [0x668a70], eax
mov dword [0x668a80], 0
adc dword [0x668a74], edx
call fcn.005b94d0
mov esp, ebp
pop ebp
ret
push dword [0x668a68]
push 1
push dword [0x668a80]
push dword [0x668a78]
call fcn.0059dc18
mov eax, dword [0x668a80]
add esp, 0x10
cdq
add dword [0x668a70], eax
mov dword [0x668a80], 0
adc dword [0x668a74], edx
mov esp, ebp
pop ebp
ret

Function at 0x5b96e0
Capabilities:
Write file on windows

Disassembly:
cmp dword [0x668b04], 0
jne fcn.005bb0d0
jmp fcn.005b9290

Function at 0x5b97f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x668a98], 0
jne 0x5b981d
call fcn.005bca00
test eax, eax
jne 0x5b981d
push dword [0x668a68]
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0059dc18
add esp, 0x10
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
nop word [eax + eax]
mov eax, dword [0x668a84]
mov esi, edi
sub eax, dword [0x668a80]
cmp edi, eax
cmovge esi, eax
mov eax, dword [0x668a78]
add eax, dword [0x668a80]
push esi
push ebx
push eax
call fcn.00594dc0
add dword [0x668a80], esi
add esp, 0xc
add ebx, esi
sub edi, esi
je 0x5b987b
cmp dword [0x668b04], 0
je 0x5b9874
call fcn.005bb0d0
jmp 0x5b9830
call fcn.005b9290
jmp 0x5b9830
cmp dword [0x668a98], 0
pop edi
pop esi
pop ebx
jne 0x5b981b
cmp dword [0x668b04], 0
je 0x5b9896
pop ebp
jmp fcn.005bb0d0
pop ebp
jmp fcn.005b9290
Function at 0x5badb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push 0x5bb440
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00475ff0
push 0x80
push str.last__dKB_of_log_file:_n
push dword [ebp + 8]
mov dword [ebp - 8], eax
xor edi, edi
mov dword [ebp - 4], 0x30400
call fcn.0041a860
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00477260
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push dword [ebp - 4]
push dword [eax]
push dword [ebp + 0xc]
call fcn.00479370
add esp, 0x30
test eax, eax
jne 0x5bae86
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push esi
mov esi, dword [eax]
cmp ecx, 0x20000
jle 0x5bae6d
push ecx
push esi
call fcn.005bc880
add esp, 8
test eax, eax
je 0x5bae62
nop
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x10400
jge 0x5bae57
mov edi, eax
inc eax
sub edx, eax
add edx, dword [ebp - 4]
push edx
push eax
call fcn.005bc880
add esp, 8
test eax, eax
jne 0x5bae30
test edi, edi
je 0x5bae62
mov ecx, dword [ebp - 4]
mov esi, edi
jmp 0x5bae6d
mov ecx, dword [ebp - 4]
add esi, 0xfffe0000
add esi, ecx
mov eax, dword [ebp - 8]
push dword [ebp + 8]
mov eax, dword [eax]
sub eax, esi
add eax, ecx
push eax
push 1
push esi
call fcn.0059dc18
add esp, 0x10
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x5bc420
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
cmp ecx, 0xffffffff
jne 0x5bc43e
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5bc434
sub ecx, esi
pop esi
push ecx
push edx
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.005bc1b0
add esp, 0x10
test eax, eax
je 0x5bc464
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push 1
push eax
call fcn.0059dc18
add esp, 0x10
pop ebp
ret

Function at 0x5bc810
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push str.wbEe
push dword [ebp + 8]
call fcn.00478e10
mov esi, eax
add esp, 8
mov dword [ebp - 8], esi
test esi, esi
je 0x5bc87a
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
cmp ecx, 0xffffffff
jne 0x5bc84b
mov ecx, edx
push edi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5bc841
sub ecx, edi
pop edi
push ecx
push edx
lea eax, [ebp - 4]
push eax
push 0
call fcn.005bc1b0
add esp, 0x10
test eax, eax
je 0x5bc86e
push esi
push dword [ebp - 4]
push 1
push eax
call fcn.0059dc18
add esp, 0x10
lea eax, [ebp - 8]
push eax
call fcn.00478df0
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x195ce90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call fcn.0195d0ec
mov dword [ebp - 0x14], eax
mov eax, dword [0x1962fdc]
mov dword [ebp - 0x18], eax
mov eax, dword [0x1962fe0]
mov dword [ebp - 0xc], eax
push 0x40
push 0x3000
push dword [ebp - 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
push dword [ebp - 8]
call fcn.0195dee0
add esp, 0x10
mov dword [ebp - 0xc], eax
push dword [ebp - 0x14]
call fcn.0195d0bf
pop ecx
and dword [ebp - 4], 0
jmp 0x195cef0
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [0x1962fe4]
je 0x195cf63
imul eax, dword [ebp - 4], 0xc
mov eax, dword [eax + 0x1962fe8]
add eax, 0x1962f80
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
push 0x40
imul eax, dword [ebp - 4], 0xc
push dword [eax + 0x1962fec]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
imul eax, dword [ebp - 4], 0xc
push dword [eax + 0x1962fec]
imul eax, dword [ebp - 4], 0xc
mov ecx, dword [ebp - 8]
add ecx, dword [eax + 0x1962ff0]
push ecx
push dword [ebp - 0x10]
call fcn.0195d3d7
add esp, 0xc
push 0
push dword [ebp - 0x1c]
imul eax, dword [ebp - 4], 0xc
push dword [eax + 0x1962fec]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x195cee9
push dword [0x1962fa4]
mov eax, dword [0x1962fa0]
add eax, 0x1962f80
push eax
mov eax, dword [0x1962f90]
add eax, 0x1962f80
push eax
call fcn.0195cfca
add esp, 0xc
mov eax, 0x1962f80
sub eax, dword [0x1962f88]
push eax
push dword [0x1962f9c]
mov eax, dword [ebp - 8]
add eax, dword [0x1962f98]
push eax
mov eax, dword [0x1962f90]
add eax, 0x1962f80
push eax
call fcn.0195d19a
add esp, 0x10
push 0x8000
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
leave
ret

Function at 0x195d0ec
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push 0x208
lea eax, [ebp - 0x410]
push eax
call fcn.0195d168
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1962f64], eax
push 0
push 0
push 0
push 2
push 0
push dword [0x1962f64]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x1962f68], eax
push 0
push 0
push 0
push 4
push dword [0x1962f68]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
add eax, dword [0x1962fd8]
leave
ret
Function at 0x195d19a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [ebp + 0x14], 0
jne 0x195d1ad
xor eax, eax
jmp 0x195d331
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x14c
jne 0x195d1eb
mov eax, dword [ebp - 8]
add eax, 0xf8
mov dword [ebp - 0xc], eax
jmp 0x195d204
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x8664
jne 0x195d204
mov eax, dword [ebp - 8]
add eax, 0x108
mov dword [ebp - 0xc], eax
and dword [ebp - 0x10], 0
jmp 0x195d211
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x10], eax
je 0x195d24a
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x24]
push eax
push 0x40
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x195d20a
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x2c]
jae 0x195d2ea
mov eax, dword [ebp + 0xc]
add eax, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
jmp 0x195d27a
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x30]
je 0x195d2d9
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
test eax, eax
jne 0x195d292
jmp 0x195d273
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
and eax, 0xfff
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
add ecx, eax
add ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
sar eax, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
je 0x195d2ca
jmp 0x195d2d7
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x195d273
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
jmp 0x195d24a
and dword [ebp - 0x14], 0
jmp 0x195d2f7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
je 0x195d32f
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x38], edx
push 0
push dword [ebp - 0x24]
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x195d2f0
xor eax, eax
leave
ret