joyce8/EMBER2024-capa huggingface dataset:
Function at 0x574765
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0xffffffffffffffff
push 0x581
push 0x7cd398
push 0
mov ecx, dword [ebp - 0xc]
call fcn.004f9816
mov eax, dword [eax + 0x5c]
push eax
call fcn.004ff770
add esp, 0x14
test eax, eax
je 0x5747e4
push 0xffffffffffffffff
push 0x581
push 0x7cd3d4
push 0x581
push 0x7cd410
call fcn.004ff360
add esp, 0x14
push 0xffffffffffffffff
push 0x581
push 0x7cd44c
call fcn.004f6ce3
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.005e843a
mov ecx, dword [ebp + 8]
call fcn.004e1270
push eax
call fcn.005e8634
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.00539090
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jle 0x574831
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 4]
jg 0x574831
mov edx, dword [ebp - 8]
sub edx, 1
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.005014b0
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov dword [ecx + 0x14], edx
jmp 0x574866
push 0x82c36c
mov ecx, dword [ebp + 8]
call fcn.00500d90
and eax, 0xff
test eax, eax
je 0x574866
push 0
lea eax, [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x14]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.00574884
mov esp, ebp
pop ebp
ret 0xc
Function at 0x579b37
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push edi
mov dword [ebp - 0x214], ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov word [ebp - 0x210], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0x7ce6c0
lea eax, [ebp - 0x210]
push eax
call fcn.005e8046
add esp, 8
test eax, eax
je 0x579ba9
xor al, al
jmp 0x579c55
push 0
push str.ComboBoxEx32
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x579bcc
xor al, al
jmp 0x579c55
push 0
push str.ComboBox
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x579bec
xor al, al
jmp 0x579c55
push 0
push str.Edit
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x579c0c
xor al, al
jmp 0x579c55
mov ecx, dword [ebp + 8]
call fcn.004e1270
push eax
push 0
push 0xc
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0xd
push 0x100
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x12c
call fcn.004e4aa0
push 0
push 0xd
push 0x101
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x57ac1e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6117ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
call fcn.0057b5f0
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
call fcn.00539090
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
and ecx, 0xff
test ecx, ecx
jne 0x57ac73
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
je 0x57ae1f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
jmp 0x57ac93
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x14]
jge 0x57ae1f
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.005390b0
mov ecx, dword [eax]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x38]
push ecx
call dword [eax + 0x24]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x57acd6
cmp dword [ebp - 0x20], 0
jne 0x57acd8
jmp 0x57ac8a
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
je 0x57acff
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x20]
push eax
call dword [edx + 0xf8]
mov ecx, dword [ebp + 8]
and ecx, 0xff
test ecx, ecx
je 0x57ae0e
mov dword [ebp - 0x28], 0
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
push edx
call dword [ecx + 0xe8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x28], 0
je 0x57ae0e
mov eax, dword [ebp - 0x28]
push eax
call fcn.005e611d
add esp, 4
add eax, 0x64
push eax
lea ecx, [ebp - 0x2c]
call fcn.004e06e0
mov dword [ebp - 4], 0
push 0
push str.__h2_
mov ecx, dword [ebp - 0x1c]
add ecx, 1
push ecx
push 0
push str._h2_style_background_color:red__body
lea ecx, [ebp - 0x2c]
call fcn.004e56e0
mov ecx, eax
call fcn.004f5480
mov ecx, eax
call fcn.004e5570
push 0
mov edx, dword [ebp - 0x28]
push edx
lea ecx, [ebp - 0x2c]
call fcn.004e5570
lea ecx, [ebp - 0x2c]
call fcn.004e1270
push eax
lea ecx, [ebp - 0x30]
call fcn.005005b0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x40]
call fcn.00519570
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x20]
push eax
call dword [edx + 0xe4]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00500470
cmp dword [ebp - 0x18], 0
jl 0x57ade3
mov dword [ebp - 0x44], 0x7ce8d0
jmp 0x57adea
mov dword [ebp - 0x44], str.false
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x7ce8dc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004e0030
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [eax + 8]
jmp 0x57ac8a
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x57d6e1
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6119fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push 0x7d0
lea ecx, [ebp - 0x14]
call fcn.004e06e0
mov dword [ebp - 4], 0
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x7d0
lea ecx, [ebp - 0x14]
call fcn.004e1270
push eax
call fcn.004de460
add esp, 0x10
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
call fcn.004e1270
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004e0030
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x57e0b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.0057e3e0
and eax, 0xff
test eax, eax
jne 0x57e0e8
xor eax, eax
jmp 0x57e126
cmp dword [ebp + 0xc], 0
jne 0x57e0f3
mov eax, dword [ebp - 4]
jmp 0x57e126
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x57e130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.0057e460
and eax, 0xff
test eax, eax
jne 0x57e168
xor eax, eax
jmp 0x57e19b
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x57e1b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x57e1c5
xor al, al
jmp 0x57e206
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp dword [eax + 0xc], 0
sete cl
mov al, cl
mov esp, ebp
pop ebp
ret 8
Function at 0x57e210
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x57e225
xor al, al
jmp 0x57e272
cmp dword [ebp + 0xc], 0
jne 0x57e232
mov dword [ebp + 0xc], 0x81d660
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.005e7e80
add esp, 4
add eax, 1
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 8]
xor eax, eax
cmp dword [edx + 0xc], 0
sete al
mov esp, ebp
pop ebp
ret 8

Function at 0x57e280
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x57e293
xor al, al
jmp 0x57e2b5
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
xor eax, eax
cmp dword [edx + 0xc], 0
sete al
mov esp, ebp
pop ebp
ret 4

Function at 0x57e2c0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x57e2d3
xor al, al
jmp 0x57e2f5
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
xor eax, eax
cmp dword [edx + 0xc], 0
sete al
mov esp, ebp
pop ebp
ret 4
Function at 0x57e300
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jne 0x57e318
xor al, al
jmp 0x57e3d8
cmp dword [ebp + 8], 0
je 0x57e345
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
xor eax, eax
cmp dword [edx + 0xc], 0
sete al
jmp 0x57e3d8
push 0x5c
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call fcn.004e49a0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x57e363
xor al, al
jmp 0x57e3d8
mov edx, dword [ebp - 4]
mov word [edx], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 2
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
mov word [edx], 0x5c
cmp dword [ebp - 8], 0
jne 0x57e3a5
cmp dword [ebp - 0xc], 0
jne 0x57e3a9
xor al, al
jmp 0x57e3d8
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp dword [eax + 0xc], 0
sete cl
mov al, cl
mov esp, ebp
pop ebp
ret 4

Function at 0x57e3e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
cmp dword [ebp + 0x10], 0
je 0x57e401
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
mov edx, dword [ebp - 8]
cmp dword [edx], 0
jne 0x57e40d
xor al, al
jmp 0x57e450
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
cmp dword [ebp + 0x10], 0
je 0x57e444
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov edx, dword [ebp - 8]
xor eax, eax
cmp dword [edx + 0xc], 0
sete al
mov esp, ebp
pop ebp
ret 0xc
Function at 0x57e460
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
cmp dword [ebp + 0x10], 0
je 0x57e481
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
mov edx, dword [ebp - 8]
cmp dword [edx], 0
jne 0x57e48d
xor al, al
jmp 0x57e4d0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
cmp dword [ebp + 0x10], 0
je 0x57e4c4
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov edx, dword [ebp - 8]
xor eax, eax
cmp dword [edx + 0xc], 0
sete al
mov esp, ebp
pop ebp
ret 0xc

Function at 0x57e91a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x611bbf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
cmp dword [ebp + 8], 0
jne 0x57e940
or eax, 0xffffffff
jmp 0x57e9a8
push 0x7cf310
push 1
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.00502390
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
call fcn.00500d90
mov byte [ebp - 0x10], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004e0030
mov edx, dword [ebp - 0x10]
and edx, 0xff
test edx, edx
je 0x57e997
push 0x7cf314
mov ecx, dword [ebp + 8]
call fcn.0057c9a0
push 0
mov ecx, dword [ebp + 8]
call fcn.004e1270
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x57ed20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x611c1d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 0x10], 0
je 0x57ed80
mov ecx, dword [ebp + 0x10]
call fcn.004e1270
push eax
call fcn.0057e8d5
add esp, 4
and eax, 0xff
test eax, eax
jne 0x57ed80
mov eax, dword [ebp + 0x10]
push eax
call fcn.0057e91a
add esp, 4
test eax, eax
jne 0x57ed80
push 0x7cf318
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x57ee78
mov cl, byte [ebp + 8]
mov byte [0x82c63c], cl
mov dl, byte [ebp + 0xc]
mov byte [0x82c63d], dl
xor eax, eax
mov al, byte [0x82c63c]
test eax, eax
jne 0x57edbb
xor ecx, ecx
mov cl, byte [0x82c63d]
test ecx, ecx
jne 0x57edbb
push 0x7cf364
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x57ee78
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x10]
call fcn.005013a0
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
je 0x57ede3
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x10]
call fcn.004e07b0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.005814dc
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x28]
push ecx
mov ecx, 0x82c638
call fcn.004e07b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004e0030
push 1
push 0x57eaa4
push 0x82c6f0
mov ecx, 0x82c670
call fcn.0057c6b0
push 1
push 0x57eb96
push 0x82c68c
mov ecx, 0x82c658
call fcn.0057c6b0
push 1
push 0x57ec5d
push 0x82c6a8
mov ecx, 0x82c6d8
call fcn.0057c6b0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004e0030
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x57fbda
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x14], 0xffffffff
jne 0x57fc39
mov ecx, 0x82c628
call fcn.0057c7d0
push 0
push 0
mov ecx, 0x82c640
call fcn.0051b350
push 0
push 0
mov ecx, 0x82c644
call fcn.0051b350
mov dword [0x82c64c], 0
mov dword [0x82c650], 0
mov byte [0x82c648], 0
mov byte [0x82c654], 0
mov al, 1
jmp 0x57fdcd
mov ecx, dword [ebp + 8]
call fcn.00539090
test eax, eax
jne 0x57fc57
push 0x7cf584
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
jmp 0x57fdcd
mov ecx, dword [ebp + 8]
call fcn.00539090
mov esi, eax
mov ecx, dword [ebp + 0xc]
call fcn.00539090
cmp esi, eax
je 0x57fc7f
push 0x7cf5a4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
jmp 0x57fdcd
mov ecx, 0x82c640
call fcn.00539090
cmp eax, 1
jne 0x57fccb
push 0x82c70c
push 0
mov ecx, 0x82c640
call fcn.00585970
mov ecx, eax
call fcn.00500d50
and eax, 0xff
test eax, eax
je 0x57fccb
push 0
push 0
mov ecx, 0x82c640
call fcn.0051b350
push 0
push 0
mov ecx, 0x82c644
call fcn.0051b350
mov ecx, 0x82c640
call fcn.00539090
test eax, eax
jle 0x57fd4c
mov dword [ebp - 8], 0
jmp 0x57fceb
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
call fcn.00539090
cmp dword [ebp - 8], eax
jge 0x57fd4a
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00585970
push eax
call fcn.0057f5c9
add esp, 4
and eax, 0xff
test eax, eax
jne 0x57fd48
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp + 8]
call fcn.00585970
push eax
mov ecx, 0x82c640
call fcn.0051ac20
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00585970
push eax
mov ecx, 0x82c644
call fcn.0051ac20
jmp 0x57fce2
jmp 0x57fd9f
mov dword [ebp - 0xc], 0
jmp 0x57fd5e
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 8]
call fcn.00539090
cmp dword [ebp - 0xc], eax
jge 0x57fd9f
push 0xffffffffffffffff
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.00585970
push eax
mov ecx, 0x82c640
call fcn.0051ac20
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00585970
push eax
mov ecx, 0x82c644
call fcn.0051ac20
jmp 0x57fd55
mov cl, byte [ebp + 0x10]
mov byte [0x82c648], cl
mov edx, dword [ebp + 0x14]
mov dword [0x82c64c], edx
push 1
push 0x57f8e0
push 0x82c6ec
mov ecx, 0x82c628
call fcn.0057c6b0
mov byte [ebp - 4], al
mov al, byte [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x57ff09
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x611d93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x14]
call fcn.005013a0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x57ff48
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.004e07b0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.0058395a
cmp dword [ebp + 8], 0
je 0x57ff6d
push 0
mov ecx, dword [ebp + 8]
call fcn.00585620
xor edx, edx
mov dx, word [eax]
test edx, edx
jne 0x57ff77
mov ecx, 0x82c6c8
call fcn.0057c7d0
push 0
push 0x7cf5e0
lea ecx, [ebp - 0x1c]
call fcn.004e0720
mov byte [ebp - 4], 1
push 1
push 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00500e40
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov byte [ebp - 0x18], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004e0030
mov edx, dword [ebp - 0x18]
and edx, 0xff
test edx, edx
je 0x57ffe1
push 0x7cf5e4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004e0030
mov al, byte [ebp - 0x20]
jmp 0x580020
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x82c688
call fcn.004e07b0
push 1
push 0x57fe39
push 0x82c5e0
mov ecx, 0x82c6c8
call fcn.0057c6b0
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x10]
mov byte [ebp - 0x24], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004e0030
mov al, byte [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4