joyce8/EMBER2024-capa huggingface dataset:
Function at 0x590b1dc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59155940
push 0x590896fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x591a193c]
xor ebx, ebx
cmp eax, ebx
jne 0x590b1f20
mov byte [ebp - 0x11c], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x590b1f1b
mov byte [ebp - 0x224], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x223]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.user32.dll
lea ecx, [ebp - 0x11c]
push ecx
push 0x59178af8
lea edx, [ebp - 0x224]
push edx
call fcn.59081190
add esp, 0x10
mov dword [ebp - 0x22c], ebx
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call fcn.5910ce7e
mov dword [ebp - 0x120], eax
push eax
call fcn.591315b0
add esp, 4
mov esi, eax
mov dword [ebp - 0x238], esi
cmp esi, ebx
je 0x590b1f1b
push esi
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call fcn.5910ce6c
test eax, eax
je 0x590b1f12
mov dword [ebp - 0x230], ebx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x230]
push eax
push str.VarFileInfoTranslation
push esi
call fcn.5910ce5a
test eax, eax
je 0x590b1f12
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x234], eax
mov ecx, dword [eax]
mov dword [0x591a193c], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x590b1f12
push esi
call fcn.591315d9
add esp, 4
mov eax, dword [0x591a193c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x590b22c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x591a1ab8]
sub esp, 0x114
test eax, eax
jne 0x590b240d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
push 0x591a1950
mov dword [0x591a1ab8], 1
mov dword [0x591a1950], 0x94
call esi
mov edx, dword [0x591a1960]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x5918bed8], eax
je 0x590b23e8
push ebx
push 0x591a19e8
mov dword [0x591a19e8], 0x9c
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.kernel32.dll
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x591a1aac], eax
call edi
mov dword [0x591a1ab0], eax
mov eax, dword [0x591a1aac]
test eax, eax
push 0x591a1a88
je 0x590b2364
call eax
jmp 0x590b236a
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x591a19ec]
cmp eax, 6
jae 0x590b2382
cmp eax, 5
jne 0x590b2396
cmp dword [0x591a19f0], 2
jb 0x590b2396
cmp word [0x591a1a88], 9
jne 0x590b2396
mov dword [0x591a1944], 1
push str.Ntdll.dll
call ebx
test eax, eax
pop ebx
je 0x590b23b4
push str.RtlGetVersion
push eax
call edi
mov edx, eax
mov dword [0x591a1ab4], edx
jmp 0x590b23ba
mov edx, dword [0x591a1ab4]
test edx, edx
je 0x590b23e8
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
call edx
test eax, eax
jne 0x590b23e8
mov ecx, dword [esp + 0x14]
mov dword [0x591a195c], ecx
push 0x591a1958
push 0x591a1954
call fcn.590b27b0
add esp, 8
call fcn.590b2420
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
mov eax, 1
add esp, 0x114
ret
Function at 0x590b3640
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59155950
push 0x590896fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x591a1abc]
xor ebx, ebx
cmp eax, ebx
jne 0x590b37a0
mov byte [ebp - 0x11c], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x590b379b
mov byte [ebp - 0x224], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x223]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.user32.dll
lea ecx, [ebp - 0x11c]
push ecx
push 0x59178af8
lea edx, [ebp - 0x224]
push edx
call fcn.59081190
add esp, 0x10
mov dword [ebp - 0x22c], ebx
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call fcn.5910ce7e
mov dword [ebp - 0x120], eax
push eax
call fcn.591315b0
add esp, 4
mov esi, eax
mov dword [ebp - 0x238], esi
cmp esi, ebx
je 0x590b379b
push esi
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call fcn.5910ce6c
test eax, eax
je 0x590b3792
mov dword [ebp - 0x230], ebx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x230]
push eax
push str.VarFileInfoTranslation
push esi
call fcn.5910ce5a
test eax, eax
je 0x590b3792
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x234], eax
mov ecx, dword [eax]
mov dword [0x591a1abc], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x590b3792
push esi
call fcn.591315d9
add esp, 4
mov eax, dword [0x591a1abc]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x590b43c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5914bd8f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x5915584c]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], 1
mov cl, byte [eax + 0xf]
mov dl, byte [eax + 0xe]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xd]
mov dl, byte [eax + 0xc]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xb]
mov dl, byte [eax + 0xa]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 9]
mov dl, byte [eax + 8]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 6]
mov dx, word [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push str._08lX__04lX__04lX__02lX_02lX__02lX_02lX_02lX_02lX_02lX_02lX
push ecx
call fcn.5909cc60
mov esi, dword [esp + 0x50]
add esp, 0x34
lea edx, [esp + 4]
mov ecx, esi
push edx
call fcn.590993d0
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.59099e00
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x590b4760
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x590b476b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
mov esi, edi
not eax
jb 0x590b486d
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x5915595c]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5915595c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5915595c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5915595c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5915595c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5915595c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5915595c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5915595c]
xor eax, edx
inc ecx
dec edi
jne 0x590b4786
test esi, esi
je 0x590b488f
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5915595c]
xor eax, edx
inc ecx
dec esi
jne 0x590b4871
pop edi
pop esi
not eax
pop ebx
ret
Function at 0x590bebb0
Capabilities:
Enumerate files on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x244
test edx, edx
jne 0x590bebd9
push 0x57
mov dword [0x591a1b30], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add esp, 0x244
ret
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x14d]
mov byte [esp + 0x14c], 0
push 0x591807b8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
push 0x59178af8
lea eax, [esp + 0x158]
push 0x103
push eax
mov dword [0x591a1b30], 0
xor ebp, ebp
call fcn.59125ffb
mov ecx, 0x4f
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], ebp
rep stosd dword es:[edi], eax
add esp, 0x14
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x590beca8
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ebp, 1
cmp byte [esp + 0x38], 0x2e
jne 0x590bec93
mov al, byte [esp + 0x39]
test al, al
je 0x590bec74
cmp al, 0x2e
jne 0x590bec93
mov al, byte [esp + 0x3a]
test al, al
jne 0x590bec93
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
jne 0x590bec59
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x244
ret
push esi
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x244
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov dword [0x591a1b30], eax
je 0x590becbe
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x244
ret
Function at 0x590bf000
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
test ebx, ebx
jne 0x590bf01c
xor eax, eax
pop ebx
add esp, 0x104
ret
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.59082f60
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.59081200
mov esi, eax
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jbe 0x590bf0a0
cmp byte [esp + 0x10], 0x5c
jne 0x590bf0a0
cmp byte [esp + 0x11], 0x5c
jne 0x590bf0a0
lea edx, [esp + 0x12]
push 0x5c
push edx
call fcn.59081200
add esp, 8
test eax, eax
je 0x590bf11e
inc eax
push 0x5c
push eax
call fcn.59081200
add esp, 8
mov esi, eax
test esi, esi
je 0x590bf11e
lea eax, [esp + 0x10]
mov byte [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x590bf0e2
test bl, 1
je 0x590bf0d1
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 0xfffffffe
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x590bf154
cmp ebx, 0xffffffff
je 0x590bf0eb
test edi, edi
jne 0x590bf0fa
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x590bf154
mov byte [esi], 0x5c
inc esi
push 0x5c
push esi
call fcn.59081200
mov esi, eax
add esp, 8
test esi, esi
jne 0x590bf0a4
test ebp, ebp
je 0x590bf154
mov ebx, dword [esp + 0x118]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x590bf149
test al, 0x10
jne 0x590bf154
test al, 1
je 0x590bf13c
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x590bf154
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x590bf170
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
test ebx, ebx
jne 0x590bf18c
xor eax, eax
pop ebx
add esp, 0x208
ret
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.590802cd
mov edi, 0x5c
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.59083627
lea edx, [esp + 0x24]
mov esi, eax
push edx
call fcn.5908146d
add esp, 0x18
cmp eax, 2
jbe 0x590bf211
cmp word [esp + 0x10], di
jne 0x590bf211
cmp word [esp + 0x12], di
jne 0x590bf211
lea eax, [esp + 0x14]
push edi
push eax
call fcn.59083627
add esp, 8
test eax, eax
je 0x590bf299
add eax, 2
push edi
push eax
call fcn.59083627
add esp, 8
mov esi, eax
test esi, esi
je 0x590bf299
lea ecx, [esp + 0x10]
mov word [esi], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x590bf259
test bl, 1
je 0x590bf248
mov edx, ebx
lea eax, [esp + 0x10]
and edx, 0xfffffffe
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x590bf2cf
cmp ebx, 0xffffffff
je 0x590bf262
test edi, edi
jne 0x590bf271
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test ebp, ebp
je 0x590bf2cf
mov word [esi], 0x5c
add esi, 2
push 0x5c
push esi
call fcn.59083627
mov esi, eax
add esp, 8
test esi, esi
jne 0x590bf219
test ebp, ebp
je 0x590bf2cf
mov ebx, dword [esp + 0x21c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x590bf2c4
test al, 0x10
jne 0x590bf2cf
test al, 1
je 0x590bf2b7
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x590bf2cf
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x590bf9c0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x154
push ebx
mov ebx, dword [esp + 0x15c]
push ebp
mov ebp, dword [esp + 0x164]
push esi
mov esi, dword [esp + 0x16c]
mov eax, 0x1f3
push esi
sub eax, ebp
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x590bfa09
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x154
ret
push edi
mov dword [esp + 0x10], 1
mov eax, dword [esi]
test al, 0x10
mov dword [esp + 0x14], eax
je 0x590bfb71
mov al, byte [esi + 0x2c]
lea edx, [esi + 0x2c]
cmp al, 0x2e
jne 0x590bfa44
mov al, byte [esi + 0x2d]
test al, al
je 0x590bfb99
cmp al, 0x2e
jne 0x590bfa44
mov al, byte [esi + 0x2e]
test al, al
je 0x590bfb99
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x20]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
inc ecx
cmp eax, ecx
jb 0x590bfb99
add ebp, ebx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 1], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x174]
and ecx, 3
test dl, 0x10
rep movsb byte es:[edi], byte [esi]
je 0x590bfabc
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push 0
push ebx
call dword [esp + 0x188]
mov edx, dword [esp + 0x174]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x590bfb28
test dl, 0x40
jne 0x590bfb28
mov esi, dword [esp + 0x1c]
mov ecx, 0x4f
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], 0
mov byte [esi + ebp - 1], 0x5c
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x178]
push eax
mov eax, dword [esp + 0x170]
push ecx
push edx
lea edx, [esp + 0x30]
lea ecx, [esi + eax + 1]
push edx
push ecx
mov byte [esi + ebp], 0x2a
push ebx
mov byte [esi + ebp + 1], 0
call fcn.590bf9c0
mov edx, dword [esp + 0x18c]
add esp, 0x18
mov dword [esp + 0x10], eax
jmp 0x590bfb2c
mov esi, dword [esp + 0x1c]
test dl, 0x20
je 0x590bfb59
mov eax, dword [esp + 0x10]
test eax, eax
je 0x590bfb59
mov edx, dword [esp + 0x17c]
mov eax, dword [esp + 0x14]
push edx
push eax
push 0
push ebx
mov byte [esi + ebp - 1], 0
call dword [esp + 0x188]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x170]
mov byte [ebp - 1], 0x2a
mov byte [ebp], 0
mov ebp, dword [esp + 0x16c]
jmp 0x590bfb99
mov ecx, dword [esp + 0x17c]
lea edx, [esi + 0x2c]
push ecx
push eax
push edx
push ebx
mov byte [ebx + ebp - 2], 0
call dword [esp + 0x188]
mov byte [ebx + ebp - 2], 0x5c
mov dword [esp + 0x10], eax
mov byte [ebx + ebp - 1], 0x2a
mov edi, dword [esp + 0x10]
test edi, edi
je 0x590bfbb5
mov eax, dword [esp + 0x18]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x590bfa12
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x154
ret
Function at 0x590c3f80
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5914c620
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
push edi
mov dword [ebp - 0x14], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x590c3fda
push 0x5918cd74
call fcn.590cea80
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x6400000
jbe 0x590c3fe9
push 0x5918cd58
jmp 0x590c3fbd
lea eax, [esi + 1]
mov dword [ebp + 8], edi
push eax
mov dword [ebp - 4], edi
call fcn.591315b0
add esp, 4
lea ecx, [ebp + 8]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
push 0
push ecx
push esi
push edi
push ebx
mov byte [edi + esi], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, dword [ebp + 8]
je 0x590c402c
push edi
call fcn.591315d9
add esp, 4
push 0x5918cd48
jmp 0x590c3fbd
mov ecx, dword [ebp - 0x14]
push 1
push edi
call fcn.590c4060
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x590c6c60
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x5914ca3f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, ecx
neg esi
sbb esi, esi
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
add esi, 2
call fcn.590ab5f0
mov eax, dword [edi + 0x9c]
lea ecx, [esp + 0x10]
push eax
push ecx
push esi
mov ecx, edi
mov dword [esp + 0x34], 1
call fcn.590c8f20
push 0x5919dc50
lea ecx, [esp + 0x38]
call fcn.5909e9e0
mov eax, dword [esp + 0x14]
xor esi, esi
test eax, eax
mov byte [esp + 0x28], 2
mov edi, eax
jle 0x590c6d18
test esi, esi
je 0x590c6ce5
push str._r_n_r_n
lea ecx, [esp + 0x38]
call fcn.5909fdd0
mov edx, dword [esp + 0x10]
lea eax, [esp + 8]
push eax
mov ecx, dword [edx + esi*4]
call fcn.590cd670
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 3
call fcn.5909fe30
lea ecx, [esp + 8]
mov byte [esp + 0x28], 2
call fcn.5909f180
inc esi
cmp esi, edi
jl 0x590c6cd3
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.5909e780
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 1
call fcn.5909f180
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.590ab600
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x590c7440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5914cb30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.590ab5f0
mov eax, dword [esi + 0x9c]
lea ecx, [esp + 0xc]
push eax
push ecx
push 3
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.590c8f20
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
cmp ebp, eax
jl 0x590c74b4
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.590ab600
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x2c]
push edi
push eax
mov esi, dword [edx + ebp*4]
mov ecx, esi
call fcn.590ce470
mov edi, dword [esp + 0x34]
push eax
mov ecx, edi
mov byte [esp + 0x2c], 1
call fcn.5909f310
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.5909f180
mov ecx, dword [edi]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x590c74ff
push ebp
push str.Data__03d
push edi
call fcn.590a2100
add esp, 0xc
lea edx, [esp + 0xc]
mov ecx, esi
push edx
mov dword [esp + 0x10], 0
call fcn.590ce780
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0xc]
push edx
mov dword [ecx], eax
call fcn.591315d9
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.590ab600
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc

Function at 0x590c75c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5914cb68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call fcn.590ab5f0
mov eax, dword [esi + 0x9c]
lea ecx, [esp + 0x10]
push eax
push ecx
push 3
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.590c8f20
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
cmp edi, eax
jge 0x590c7685
mov edx, dword [esp + 0x34]
push 0
push edx
call fcn.590cc970
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x590c762b
push 0x5918d050
jmp 0x590c767d
mov eax, dword [esp + 0x10]
lea edx, [esp + 8]
push edx
mov ecx, dword [eax + edi*4]
mov dword [esp + 0xc], 0
call fcn.590ce780
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
push edx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x590c76ab
mov eax, dword [esp + 8]
push eax
call fcn.591315d9
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5918d040
call fcn.590cea80
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.590ab600
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 8
mov ecx, dword [esp + 8]
push ecx
call fcn.591315d9
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.590ab600
mov ecx, dword [esp + 0x20]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8