joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57f320
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
fld qword [0x5ae748]
fdiv qword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0x14], ecx
mov ecx, 0x12
mov esi, eax
lea edi, [esp + 0xa0]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x30], edx
mov edi, eax
lea edx, [esp + 0xa8]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0x3ff00000
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0x3ff00000
lea ecx, [esp + 0xa8]
sub edi, edx
mov ebx, 3
fstp qword [esp + 0x58]
fld qword [0x5ae748]
fdiv qword [ebp + 0x18]
fstp qword [esp + 0x78]
lea eax, [esp + 0x28]
lea edx, [edi + ecx]
mov esi, 3
fld qword [eax - 0x18]
fmul qword [ecx - 8]
fld qword [eax + 0x18]
fmul qword [ecx + 8]
add eax, 8
add edx, 8
dec esi
faddp st(1)
fld qword [eax - 8]
fmul qword [ecx]
faddp st(1)
fstp qword [edx - 8]
jne 0x57f493
add ecx, 0x18
dec ebx
jne 0x57f487
mov eax, dword [ebp + 0xc]
mov ecx, 0x12
mov esi, eax
lea edi, [esp + 0xa0]
rep movsd dword es:[edi], dword [esi]
mov edi, eax
lea eax, [esp + 0x60]
lea ecx, [esp + 0x60]
sub edi, eax
mov ebx, 3
lea eax, [esp + 0xb8]
lea edx, [edi + ecx]
mov esi, 3
fld qword [eax - 0x18]
fmul qword [ecx - 8]
fld qword [eax + 0x18]
fmul qword [ecx + 8]
add eax, 8
add edx, 8
dec esi
faddp st(1)
fld qword [ecx]
fmul qword [eax - 8]
faddp st(1)
fstp qword [edx - 8]
jne 0x57f4ed
add ecx, 0x18
dec ebx
jne 0x57f4de
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x57f930
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5aa90f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 8], 0
call fcn.00537e60
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x40], 1
mov ecx, edi
call fcn.005381d0
fstp qword [esp + 0xc]
mov ecx, edi
call fcn.005381e0
fld st(0)
fmul qword [esi + 0x30]
fld qword [esp + 0xc]
fmul qword [esi + 0x18]
sub esp, 8
lea ecx, [esp + 0x20]
sub esp, 8
faddp st(1)
sub esp, 8
fadd qword [esi + 0x48]
fstp qword [esp + 0x10]
fld st(0)
fmul qword [esi + 0x28]
fld qword [esp + 0x24]
fmul qword [esi + 0x10]
faddp st(1)
fadd qword [esi + 0x40]
fstp qword [esp + 8]
fmul qword [esi + 0x20]
fld qword [esp + 0x24]
fmul qword [esi + 8]
faddp st(1)
fadd qword [esi + 0x38]
fstp qword [esp]
call fcn.00538000
mov esi, dword [ebp + 8]
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.00546910
mov dword [esp + 8], 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 0
call fcn.00537fc0
mov ecx, dword [esp + 0x38]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x583c10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5aac1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 8], 0
call fcn.00537a20
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x50], 1
mov ecx, edi
call fcn.00533a20
fstp qword [esp + 0x14]
mov ecx, edi
call fcn.00533a30
fstp qword [esp + 0xc]
mov ecx, edi
call fcn.00533a40
fld st(0)
fmul qword [esi + 0x58]
fld qword [esp + 0xc]
fmul qword [esi + 0x38]
sub esp, 8
lea ecx, [esp + 0x28]
sub esp, 8
faddp st(1)
fld qword [esp + 0x24]
fmul qword [esi + 0x18]
sub esp, 8
faddp st(1)
fstp qword [esp + 0x10]
fld st(0)
fmul qword [esi + 0x50]
fld qword [esp + 0x24]
fmul qword [esi + 0x30]
faddp st(1)
fld qword [esp + 0x2c]
fmul qword [esi + 0x10]
faddp st(1)
fstp qword [esp + 8]
fmul qword [esi + 0x48]
fld qword [esp + 0x24]
fmul qword [esi + 0x28]
faddp st(1)
fld qword [esp + 0x2c]
fmul qword [esi + 8]
faddp st(1)
fstp qword [esp]
call fcn.00537a40
mov esi, dword [ebp + 8]
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00533e20
mov dword [esp + 8], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x50], 0
call fcn.00533eb0
mov ecx, dword [esp + 0x48]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x583e10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5aac6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 8], 0
call fcn.00442a20
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x50], 1
mov ecx, edi
call fcn.00442960
fstp qword [esp + 0xc]
mov ecx, edi
call fcn.004429a0
fstp qword [esp + 0x14]
mov ecx, edi
call fcn.004429e0
fld qword [esp + 0xc]
fld qword [esp + 0x14]
fld st(2)
fmul qword [esi + 0x60]
fld st(1)
fmul qword [esi + 0x40]
sub esp, 8
lea ecx, [esp + 0x28]
sub esp, 8
faddp st(1)
fld st(2)
fmul qword [esi + 0x20]
sub esp, 8
sub esp, 8
faddp st(1)
fadd qword [esi + 0x80]
fstp qword [esp + 0x18]
fld st(2)
fmul qword [esi + 0x58]
fld st(1)
fmul qword [esi + 0x38]
faddp st(1)
fld st(2)
fmul qword [esi + 0x18]
faddp st(1)
fadd qword [esi + 0x78]
fstp qword [esp + 0x10]
fld st(2)
fmul qword [esi + 0x50]
fld st(1)
fmul qword [esi + 0x30]
faddp st(1)
fld st(2)
fmul qword [esi + 0x10]
faddp st(1)
fadd qword [esi + 0x70]
fstp qword [esp + 8]
fxch st(2)
fmul qword [esi + 0x48]
fxch st(2)
fmul qword [esi + 0x28]
faddp st(2)
fmul qword [esi + 8]
faddp st(1)
fadd qword [esi + 0x68]
fstp qword [esp]
call fcn.00442f00
mov esi, dword [ebp + 8]
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00533b20
mov dword [esp + 8], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x50], 0
call fcn.00442d70
mov ecx, dword [esp + 0x48]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x584070
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5aacbf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x28]
mov dword [esp + 8], 0
call fcn.005509f0
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x58], 1
mov ecx, edi
call fcn.0057d140
fstp qword [esp + 0x1c]
mov ecx, edi
call fcn.0057d150
fstp qword [esp + 0x14]
mov ecx, edi
call fcn.0057d160
fstp qword [esp + 0xc]
mov ecx, edi
call fcn.0057d180
sub esp, 8
mov ecx, edi
fstp qword [esp]
call fcn.0057d170
sub esp, 8
lea ecx, [esp + 0x38]
fstp qword [esp]
fld qword [esp + 0x1c]
fmul qword [esi + 0x58]
fld qword [esp + 0x24]
fmul qword [esi + 0x38]
sub esp, 8
sub esp, 8
faddp st(1)
fld qword [esp + 0x3c]
fmul qword [esi + 0x18]
sub esp, 8
faddp st(1)
fadd qword [esi + 0x78]
fstp qword [esp + 0x10]
fld qword [esp + 0x34]
fmul qword [esi + 0x50]
fld qword [esp + 0x3c]
fmul qword [esi + 0x30]
faddp st(1)
fld qword [esp + 0x44]
fmul qword [esi + 0x10]
faddp st(1)
fadd qword [esi + 0x70]
fstp qword [esp + 8]
fld qword [esp + 0x34]
fmul qword [esi + 0x48]
fld qword [esp + 0x3c]
fmul qword [esi + 0x28]
faddp st(1)
fld qword [esp + 0x44]
fmul qword [esi + 8]
faddp st(1)
fadd qword [esi + 0x68]
fstp qword [esp]
call fcn.0054fc10
mov esi, dword [ebp + 8]
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call fcn.0057d190
mov dword [esp + 8], 1
lea ecx, [esp + 0x28]
mov byte [esp + 0x58], 0
call fcn.00550a30
mov ecx, dword [esp + 0x50]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x584510
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5aad57
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x48]
mov dword [esp + 8], 0
call fcn.00537a20
lea ecx, [esp + 0x20]
mov dword [esp + 0x78], 1
call fcn.005389d0
mov edi, dword [ebp + 0xc]
mov byte [esp + 0x78], 2
mov ecx, edi
call fcn.00533a20
fstp qword [esp + 0x14]
mov ecx, edi
call fcn.00533a30
fstp qword [esp + 0xc]
mov ecx, edi
call fcn.00533a40
fld st(0)
fmul qword [esi + 0x58]
fld qword [esp + 0xc]
fmul qword [esi + 0x38]
sub esp, 8
lea ecx, [esp + 0x50]
sub esp, 8
faddp st(1)
fld qword [esp + 0x24]
fmul qword [esi + 0x18]
sub esp, 8
faddp st(1)
fstp qword [esp + 0x10]
fld st(0)
fmul qword [esi + 0x50]
fld qword [esp + 0x24]
fmul qword [esi + 0x30]
faddp st(1)
fld qword [esp + 0x2c]
fmul qword [esi + 0x10]
faddp st(1)
fstp qword [esp + 8]
fmul qword [esi + 0x48]
fld qword [esp + 0x24]
fmul qword [esi + 0x28]
faddp st(1)
fld qword [esp + 0x2c]
fmul qword [esi + 8]
faddp st(1)
fstp qword [esp]
call fcn.00537a40
lea eax, [esp + 0x48]
lea ecx, [esp + 0x20]
push eax
call fcn.005389f0
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00538ad0
mov dword [esp + 8], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x78], 1
call fcn.005389a0
lea ecx, [esp + 0x48]
call fcn.00533eb0
mov ecx, dword [esp + 0x70]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x584910
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5aae49
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00442ab0
mov edi, dword [esp + 0x1c]
lea ecx, [esi + 8]
mov dword [esp + 0x14], 0
lea eax, [edi + 8]
push eax
call fcn.00538ad0
lea ecx, [edi + 0x30]
mov byte [esp + 0x14], 1
push ecx
lea ecx, [esi + 0x30]
call fcn.00538ad0
lea edx, [edi + 0x58]
lea ecx, [esi + 0x58]
push edx
mov byte [esp + 0x18], 2
call fcn.00538ad0
add edi, 0x80
lea ecx, [esi + 0x80]
push edi
mov byte [esp + 0x18], 3
call fcn.00533b20
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x5be868
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x584926
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5aae49
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00442ab0
mov edi, dword [esp + 0x1c]
lea ecx, [esi + 8]
mov dword [esp + 0x14], 0
lea eax, [edi + 8]
push eax
call fcn.00538ad0
lea ecx, [edi + 0x30]
mov byte [esp + 0x14], 1
push ecx
lea ecx, [esi + 0x30]
call fcn.00538ad0
lea edx, [edi + 0x58]
lea ecx, [esi + 0x58]
push edx
mov byte [esp + 0x18], 2
call fcn.00538ad0
add edi, 0x80
lea ecx, [esi + 0x80]
push edi
mov byte [esp + 0x18], 3
call fcn.00533b20
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x5be868
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x5850f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ab017
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
mov edi, ecx
push esi
call fcn.00584cc0
mov ecx, dword [esi + 0x7c]
mov edx, dword [esi + 0x78]
mov eax, dword [esi + 0x74]
push ecx
mov ecx, dword [esi + 0x70]
push edx
mov edx, dword [esi + 0x6c]
push eax
mov eax, dword [esi + 0x68]
push ecx
mov ecx, dword [esi + 0x64]
push edx
mov edx, dword [esi + 0x60]
push eax
push ecx
push edx
lea ecx, [esp + 0x78]
call fcn.00533bd0
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push eax
push ecx
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x170], 0
call fcn.00585290
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x30]
mov edx, dword [esi + 0x2c]
push eax
mov eax, dword [esi + 0x28]
push ecx
mov ecx, dword [esi + 0x24]
push edx
mov edx, dword [esi + 0x20]
push eax
push ecx
push edx
lea ecx, [esp + 0x98]
mov byte [esp + 0x170], 1
call fcn.00585290
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x4c]
push eax
mov eax, dword [esi + 0x48]
push ecx
mov ecx, dword [esi + 0x44]
push edx
mov edx, dword [esi + 0x40]
push eax
push ecx
push edx
lea ecx, [esp + 0x48]
mov byte [esp + 0x170], 2
call fcn.00585290
lea eax, [esp + 0x30]
lea ecx, [esp + 0x80]
push eax
mov byte [esp + 0x15c], 3
push ecx
lea edx, [esp + 0x10]
lea eax, [esp + 0x60]
push edx
push eax
lea ecx, [esp + 0xb8]
call fcn.005849c0
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0xa8]
push ecx
push edx
mov ecx, edi
mov byte [esp + 0x160], 4
call fcn.00584cc0
lea ecx, [esp + 0xa8]
mov byte [esp + 0x158], 3
call fcn.00584a50
lea ecx, [esp + 0x30]
mov byte [esp + 0x158], 2
call fcn.005389a0
lea ecx, [esp + 0x80]
mov byte [esp + 0x158], 1
call fcn.005389a0
lea ecx, [esp + 8]
mov byte [esp + 0x158], 0
call fcn.005389a0
lea ecx, [esp + 0x58]
mov dword [esp + 0x158], 0xffffffff
call fcn.00442d70
mov ecx, dword [esp + 0x150]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5859d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ab16f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.00538ad0
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x38], 1
push ecx
lea ecx, [esp + 0xc]
call fcn.00585a50
mov esi, dword [esp + 0x40]
push eax
mov ecx, esi
call fcn.00538ad0
mov dword [esp + 4], 1
lea ecx, [esp + 8]
mov byte [esp + 0x38], 0
call fcn.005389a0
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x5878f0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x60a58c]
cmp eax, 0x190
jbe 0x58797a
mov eax, dword [sym.imp.MSVCIRT.dll_class_ostream____cdecl_endl_class_ostream__]
mov ecx, dword [sym.imp.MSVCIRT.dll_class_ostream_withassign_cerr]
push esi
mov esi, dword [sym.imp.MSVCIRT.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push eax
push str.______________________________________________________________
call esi
mov ecx, eax
call dword [sym.imp.MSVCIRT.dll_public:_class_ostream____thiscall_ostream::operator___class_ostream_____cdecl___class_ostream___]
mov ecx, dword [sym.imp.MSVCIRT.dll_class_ostream____cdecl_endl_class_ostream__]
push ecx
mov ecx, dword [sym.imp.MSVCIRT.dll_class_ostream_withassign_cerr]
push str.CPPUG:_BCLASS_TABLE_OVERFLOW___
call esi
mov ecx, eax
call dword [sym.imp.MSVCIRT.dll_public:_class_ostream____thiscall_ostream::operator___class_ostream_____cdecl___class_ostream___]
mov edx, dword [sym.imp.MSVCIRT.dll_class_ostream____cdecl_endl_class_ostream__]
mov ecx, dword [sym.imp.MSVCIRT.dll_class_ostream_withassign_cerr]
push edx
push str.Abort_the_program__
call esi
mov ecx, eax
call dword [sym.imp.MSVCIRT.dll_public:_class_ostream____thiscall_ostream::operator___class_ostream_____cdecl___class_ostream___]
mov eax, dword [sym.imp.MSVCIRT.dll_class_ostream____cdecl_endl_class_ostream__]
mov ecx, dword [sym.imp.MSVCIRT.dll_class_ostream_withassign_cerr]
push eax
push str.______________________________________________________________
call esi
mov ecx, eax
call dword [sym.imp.MSVCIRT.dll_public:_class_ostream____thiscall_ostream::operator___class_ostream_____cdecl___class_ostream___]
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
mov ecx, dword [0x60a580]
mov edx, dword [esp + 4]
shl eax, 5
mov dword [eax + ecx + 0x14], edx
mov eax, dword [0x60a58c]
mov ecx, dword [0x60a580]
mov edx, dword [esp + 8]
shl eax, 5
mov dword [eax + ecx + 4], edx
mov eax, dword [0x60a58c]
mov ecx, dword [0x60a580]
mov edx, dword [esp + 0xc]
shl eax, 5
mov dword [eax + ecx], edx
mov eax, dword [0x60a58c]
mov ecx, dword [0x60a580]
mov edx, dword [esp + 0x10]
shl eax, 5
mov dword [eax + ecx + 8], edx
mov eax, dword [0x60a58c]
mov ecx, dword [0x60a580]
mov edx, dword [esp + 0x14]
shl eax, 5
mov dword [eax + ecx + 0xc], edx
mov ecx, dword [0x60a58c]
mov edx, dword [0x60a580]
xor eax, eax
shl ecx, 5
mov dword [ecx + edx + 0x10], eax
mov ecx, dword [0x60a58c]
mov edx, dword [0x60a580]
shl ecx, 5
mov dword [ecx + edx + 0x18], eax
mov eax, dword [0x60a58c]
mov edx, dword [0x60a580]
mov ecx, dword [esp + 0x18]
shl eax, 5
mov dword [eax + edx + 0x1c], ecx
mov eax, dword [0x60a58c]
inc eax
mov dword [0x60a58c], eax
ret
Function at 0x587c40
Capabilities:
Terminate process

Disassembly:
mov edx, dword [0x60a58c]
push ebx
push ebp
push esi
push edi
xor edi, edi
test edx, edx
jbe 0x587c92
mov ebp, dword [0x60a580]
mov esi, dword [ebp]
mov eax, dword [esp + 0x14]
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x587c81
test cl, cl
je 0x587c7d
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x587c81
add eax, 2
add esi, 2
test cl, cl
jne 0x587c5d
xor eax, eax
jmp 0x587c86
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x587d06
inc edi
add ebp, 0x20
cmp edi, edx
jb 0x587c56
mov ecx, dword [sym.imp.MSVCIRT.dll_class_ostream____cdecl_endl_class_ostream__]
mov esi, dword [sym.imp.MSVCIRT.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
push ecx
mov ecx, dword [sym.imp.MSVCIRT.dll_class_ostream_withassign_cerr]
push str._nObject_Storer_Unrecoverable_Error:
call esi
mov ecx, eax
call dword [sym.imp.MSVCIRT.dll_public:_class_ostream____thiscall_ostream::operator___class_ostream_____cdecl___class_ostream___]
mov edx, dword [sym.imp.MSVCIRT.dll_class_ostream____cdecl_endl_class_ostream__]
mov eax, dword [esp + 0x14]
mov ecx, dword [sym.imp.MSVCIRT.dll_class_ostream_withassign_cerr]
push edx
push str.__not_found_in_BClass_table___
push eax
push str.Class__
call esi
mov ecx, eax
call esi
mov ecx, eax
call esi
mov ecx, eax
call dword [sym.imp.MSVCIRT.dll_public:_class_ostream____thiscall_ostream::operator___class_ostream_____cdecl___class_ostream___]
mov ecx, dword [sym.imp.MSVCIRT.dll_class_ostream____cdecl_endl_class_ostream__]
push ecx
mov ecx, dword [sym.imp.MSVCIRT.dll_class_ostream_withassign_cerr]
push str.Aborting...
call esi
mov ecx, eax
call dword [sym.imp.MSVCIRT.dll_public:_class_ostream____thiscall_ostream::operator___class_ostream_____cdecl___class_ostream___]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [0x60a580]
shl edi, 5
call dword [edi + eax + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x5881f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ab428
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0058a080
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
mov ecx, esi
mov dword [esp + 0x10], eax
mov dword [esi], 0x5be920
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
call fcn.005880a0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x588206
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ab428
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0058a080
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
mov ecx, esi
mov dword [esp + 0x10], eax
mov dword [esi], 0x5be920
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
call fcn.005880a0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x58b380
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor ebx, ebx
mov esi, ecx
cmp dword [edi + 8], ebx
jne 0x58b3a6
call fcn.0058ad90
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], ebx
mov eax, esi
pop edi
pop esi
pop ebx
ret 4
mov eax, dword [edi + 0xc]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jne 0x58b3ba
mov ecx, dword [edi + 0x10]
mov eax, dword [esi + 0x10]
cmp ecx, eax
je 0x58b404
mov ecx, esi
call fcn.0058ad90
mov edx, dword [edi + 0xc]
mov ecx, esi
mov dword [esi + 0xc], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
push eax
mov eax, edx
push eax
call fcn.0058ad20
test eax, eax
jne 0x58b404
mov ecx, dword [sym.imp.MSVCIRT.dll_class_ostream____cdecl_flush_class_ostream__]
push ecx
mov ecx, dword [sym.imp.MSVCIRT.dll_class_ostream_withassign_cerr]
push str.K_Matrix::operator___get_mem___failed_n
call dword [sym.imp.MSVCIRT.dll_public:_class_ostream____thiscall_ostream::operator___char_const__]
mov ecx, eax
call dword [sym.imp.MSVCIRT.dll_public:_class_ostream____thiscall_ostream::operator___class_ostream_____cdecl___class_ostream___]
push 0xffffffffffffffff
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [esi + 0xc]
xor ecx, ecx
cmp eax, ebx
jle 0x58b446
mov edx, dword [esi + 0x10]
xor eax, eax
test edx, edx
jle 0x58b43e
mov edx, dword [edi + 8]
mov edi, dword [esi + 8]
inc eax
mov edx, dword [edx + ecx*4]
mov edi, dword [edi + ecx*4]
mov ebx, dword [edx + eax*8 - 8]
mov dword [edi + eax*8 - 8], ebx
mov edx, dword [edx + eax*8 - 4]
mov dword [edi + eax*8 - 4], edx
mov edx, dword [esi + 0x10]
mov edi, dword [esp + 0x10]
cmp eax, edx
jl 0x58b416
mov eax, dword [esi + 0xc]
inc ecx
cmp ecx, eax
jl 0x58b40d
mov eax, esi
pop edi
pop esi
pop ebx
ret 4
Function at 0x58c6b0
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x5abbeb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x18], 1
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x58c729
push esi
push 8
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 8], esi
test esi, esi
mov byte [esp + 0x14], 2
je 0x58c70e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0058b930
jmp 0x58c710
xor eax, eax
lea edx, [esp + 4]
push 0x5dc018
push edx
mov byte [esp + 0x1c], 1
mov dword [esp + 0xc], eax
call sub.MSVCRT.dll__CxxThrowException
pop esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x10], 0
call fcn.0058df86
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], 0xffffffff
call fcn.0058df86
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 8