joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5905fc80
Capabilities:
Get session user name

Disassembly:
sub esp, 0x64
xor eax, eax
push ebx
mov ebx, dword [esp + 0x70]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x70]
push esi
mov edx, ecx
push edi
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.590b2990
test eax, eax
je 0x5905fd44
push 0x41
push 0
push 1
push str.default
call dword [0x59198f98]
mov esi, eax
test esi, esi
jne 0x5905fccf
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push 0x5905fde0
push esi
call dword [0x59198f74]
push esi
call dword [0x59198fa4]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jb 0x5905fd16
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x84], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esi, eax
test esi, esi
je 0x5905fdc2
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jb 0x5905fd94
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
jne 0x5905fdd4
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
Function at 0x59061340
Capabilities:
Create directory
Get file attributes
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x591490c8
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
test ebp, ebp
je 0x590614be
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x590614be
push ebp
lea ecx, [esp + 0x10]
call fcn.590994d0
push 3
push 0x5c
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0
call fcn.5909aee0
push 2
push 0x591808c0
push ebp
mov esi, eax
call fcn.5908374e
add esp, 0xc
test eax, eax
jne 0x590613bd
inc esi
lea ecx, [esp + 0xc]
push esi
push 0x5c
call fcn.5909aee0
mov esi, eax
push 0x5919cc20
lea ecx, [esp + 0x28]
call fcn.590994d0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or ebp, 0xffffffff
cmp esi, ebp
mov byte [esp + 0x1c], 1
je 0x5906143e
lea eax, [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x14]
call fcn.5909c420
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 2
call fcn.59099f80
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 1
call fcn.59099e00
mov ecx, dword [esp + 0x24]
push ecx
call edi
cmp eax, ebp
jne 0x59061427
mov edx, dword [esp + 0x24]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x590614a3
jmp 0x5906142b
test al, 0x10
je 0x590614a3
inc esi
lea ecx, [esp + 0xc]
push esi
push 0x5c
call fcn.5909aee0
mov esi, eax
cmp esi, ebp
jne 0x590613dd
mov esi, dword [esp + 0xc]
call fcn.590d0400
push eax
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov eax, dword [esp + 0x24]
push eax
call edi
mov ecx, dword [esp + 0x28]
mov edx, ecx
or edx, 0x10
cmp eax, edx
je 0x59061471
mov eax, dword [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 0
call fcn.59099e00
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], ebp
call fcn.59099e00
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 0
call fcn.59099e00
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], ebp
call fcn.59099e00
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x59063bc0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x59149358
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
test ebx, ebx
jne 0x59063bec
test ebp, ebp
jbe 0x59063c9e
mov eax, dword [esp + 0x24]
push esi
lea edx, [esp + 0x20]
push eax
push edx
call fcn.59066390
mov eax, dword [esp + 0x20]
push 0
push 0
push 4
push 0
push 3
push 0xc0000000
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x59063c51
push 2
push 0
push 0
push esi
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x24]
push 0
push ecx
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [esp + 0x10], eax
push 0
lea edx, [esp + 0x30]
push 0
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push 0
push esi
mov ecx, 0x5919dd48
call fcn.59063380
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.59099e00
pop esi
mov ecx, dword [esp + 0xc]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x59067440
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x5914979f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push esi
mov dword [esp + 8], 0
call fcn.59066dd0
add esp, 4
test eax, eax
jne 0x5906749a
mov esi, dword [esp + 0x18]
push 0x5919dc50
mov ecx, esi
call fcn.5909e9e0
mov dword [esp + 4], 1
mov eax, esi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, dword [0x59155850]
mov dword [esp + 0x1c], ecx
mov ecx, esi
mov dword [esp + 0x10], 1
dec ecx
jne 0x590674fa
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0x30]
mov esi, dword [eax + 4]
push ecx
push edx
push ecx
push esi
mov esi, dword [eax + 0x34]
push esi
mov esi, dword [eax + 0x2c]
push esi
push edx
mov edx, dword [eax + 0x28]
push edx
mov edx, dword [eax + 0x24]
push edx
mov edx, dword [eax + 0x20]
push edx
mov edx, dword [eax + 0x1c]
push edx
mov edx, dword [eax + 0x18]
push edx
mov edx, dword [eax + 0x14]
push edx
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0xc]
push edx
push eax
push ecx
lea ecx, [esp + 0x5c]
push str.SELECT__s__s__s__s__s__s__s__s__s__s__s__s_FROM__s_WHERE__s____1_OR__s____2_ORDER_BY__s_DESC
push ecx
call fcn.590a2100
add esp, 0x48
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.5909e780
lea ecx, [esp + 0x1c]
mov dword [esp + 4], 1
mov byte [esp + 0x10], 0
call fcn.5909f180
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x59067540
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x591497cf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push esi
mov dword [esp + 8], 0
call fcn.59066dd0
add esp, 4
test eax, eax
jne 0x5906759a
mov esi, dword [esp + 0x18]
push 0x5919dc50
mov ecx, esi
call fcn.5909e9e0
mov dword [esp + 4], 1
mov eax, esi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, dword [0x59155850]
mov dword [esp + 0x1c], ecx
mov ecx, esi
mov dword [esp + 0x10], 1
dec ecx
jne 0x590675d7
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0x38]
mov esi, dword [eax + 0x34]
push ecx
push ecx
push edx
push edx
mov edx, dword [eax + 4]
push esi
push esi
push edx
push ecx
lea eax, [esp + 0x3c]
push str.SELECT__s_FROM__s_WHERE____s______AND__s___1__OR___s______AND__s___2___AND__s____3_ORDER_BY__s_DESC
push eax
call fcn.590a2100
add esp, 0x28
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.5909e780
lea ecx, [esp + 0x1c]
mov dword [esp + 4], 1
mov byte [esp + 0x10], 0
call fcn.5909f180
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x59067670
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x591497ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x59155850]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], 1
push esi
call fcn.59067610
mov ecx, esi
add esp, 4
dec ecx
jne 0x590676d2
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax + 0xc]
push ecx
push edx
push eax
lea ecx, [esp + 0x10]
push str.SELECT__s_FROM__s_WHERE__s___1
push ecx
call fcn.590a2100
add esp, 0x14
mov esi, dword [esp + 0x1c]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.5909e780
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.5909f180
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x59067850
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x5914984f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push 1
mov dword [esp + 0xc], 0
call fcn.59067830
add esp, 4
test eax, eax
jne 0x590678a9
mov esi, dword [esp + 0x1c]
push 0x5919dc50
mov ecx, esi
call fcn.5909e9e0
mov dword [esp + 8], 1
mov eax, esi
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x59155850]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], 1
dec ecx
jne 0x590678e8
mov edx, dword [eax + 8]
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax + 0x14]
push ecx
mov ecx, dword [eax + 0x10]
push edx
mov edx, dword [eax + 0xc]
push ecx
push edx
lea eax, [esp + 0x18]
push str.SELECT__s__s__s_FROM__s_WHERE__s___1
push eax
call fcn.590a2100
add esp, 0x1c
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.5909e780
lea ecx, [esp + 4]
mov dword [esp + 8], 1
mov byte [esp + 0x14], 0
call fcn.5909f180
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x590685c0
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x591499d7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push 0x5919dc50
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.5909e9e0
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], 1
test eax, eax
je 0x59068703
mov esi, dword [esp + 0x24]
test esi, esi
je 0x59068703
mov eax, dword [eax + 4]
push eax
call fcn.59066dd0
add esp, 4
test eax, eax
je 0x59068703
mov ecx, dword [0x59155850]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x38]
push ecx
push ecx
push edx
push eax
lea ecx, [esp + 0x34]
push str.SELECT__s_FROM__s_WHERE__s___1_ORDER_BY__s_DESC
push ecx
mov byte [esp + 0x2c], 2
call fcn.590a2100
mov eax, dword [esp + 0x3c]
add esp, 0x18
lea edx, [esp + 0x20]
mov ecx, 0x5919cbc8
push 0
push edx
push 0xffffffffffffffff
push eax
push esi
mov dword [esp + 0x34], 0
call fcn.59002260
test eax, eax
jne 0x590686d1
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push ecx
push edx
push 1
push eax
mov ecx, 0x5919cbc8
call fcn.59002290
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, 0x5919cbc8
call fcn.590022f0
cmp eax, 0x64
jne 0x590686c0
mov edx, dword [esp + 0x20]
push 0
push edx
mov ecx, 0x5919cbc8
call fcn.59002340
push eax
lea ecx, [esp + 8]
call fcn.5909f400
mov eax, dword [esp + 0x20]
mov ecx, 0x5919cbc8
push eax
call fcn.590024a0
jmp 0x590686f5
mov ecx, dword [0x5919cca0]
test ecx, ecx
je 0x590686f5
push eax
push str.MailMasterGetSentIdFromMailId_sqlite3_prepare16_v2__Failed__nSqlRet:__d_
push str.History
push 0xffffffffffffffff
push 0x5919cc34
call fcn.5907cd70
add esp, 0x14
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 1
call fcn.5909f180
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.5909e780
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.5909f180
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x59069d40
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x59149bbe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x59155850]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi + 0x28], eax
mov ecx, dword [0x59155850]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x2c], ecx
mov edx, dword [0x59155850]
mov byte [esp + 0x14], 1
mov dword [esi + 0x30], edx
mov eax, dword [0x59155850]
mov byte [esp + 0x14], 2
mov dword [esi + 0x34], eax
mov ecx, dword [0x59155850]
mov byte [esp + 0x14], 3
mov dword [esi + 0x38], ecx
mov edx, dword [0x59155850]
mov byte [esp + 0x14], 4
mov dword [esi + 0x3c], edx
mov eax, dword [0x59155850]
mov byte [esp + 0x14], 5
mov dword [esi + 0x40], eax
lea ecx, [esi + 0x44]
mov byte [esp + 0x14], 6
call fcn.590a4b00
lea ecx, [esi + 0x54]
mov byte [esp + 0x14], 7
call fcn.590a4b00
lea ecx, [esi + 0x64]
mov byte [esp + 0x14], 8
call fcn.590ab1c0
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x14], 9
mov dword [esi + 0x18], edi
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi], 0x591509d8
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x74], 1
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], edi
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x59069e50
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x59149c3e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x591509d8
lea edi, [esi + 0x44]
push 0xffffffffffffffff
push 0
mov ecx, edi
mov dword [esp + 0x24], 9
call fcn.590a4b70
lea ebx, [esi + 0x54]
push 0xffffffffffffffff
push 0
mov ecx, ebx
call fcn.590a4b70
lea ebp, [esi + 0x64]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.590ab1e0
mov ecx, ebp
mov byte [esp + 0x1c], 8
call fcn.590ab1d0
mov ecx, ebx
mov byte [esp + 0x1c], 7
call fcn.590a4b10
mov ecx, edi
mov byte [esp + 0x1c], 6
call fcn.590a4b10
lea ecx, [esi + 0x40]
mov byte [esp + 0x1c], 5
call fcn.5909f180
lea ecx, [esi + 0x3c]
mov byte [esp + 0x1c], 4
call fcn.5909f180
lea ecx, [esi + 0x38]
mov byte [esp + 0x1c], 3
call fcn.5909f180
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 2
call fcn.5909f180
lea ecx, [esi + 0x30]
mov byte [esp + 0x1c], 1
call fcn.5909f180
lea ecx, [esi + 0x2c]
mov byte [esp + 0x1c], 0
call fcn.5909f180
lea ecx, [esi + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.5909f180
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5906b830
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
cmp dword [esi], 0
jne 0x5906b840
pop edi
xor eax, eax
pop esi
ret
cmp dword [esi + 0xc], 0xffffffff
je 0x5906b89f
mov eax, dword [esi + 8]
test eax, eax
je 0x5906b856
push eax
call fcn.59080a36
add esp, 4
mov eax, dword [esi]
push eax
call fcn.59080b1f
mov edi, eax
add esp, 4
test edi, edi
mov dword [esi + 8], edi
jne 0x5906b86d
pop edi
pop esi
ret
mov ecx, dword [esi]
xor eax, eax
mov edx, ecx
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0xc]
push eax
call fcn.59082606
mov ecx, dword [esi]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
push ecx
push edx
push eax
call fcn.5908298b
add esp, 0x18
mov eax, dword [esi + 8]
pop edi
pop esi
ret
Function at 0x59074920
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
mov edx, dword [esp + 8]
push ebx
cmp dword [edx + 4], 1
jne 0x59074ac8
cmp word [edx + 0x18], 0x14
jae 0x5907493d
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x14]
lea ebx, [eax + 0x10]
mov eax, dword [eax + 0x10]
test eax, eax
mov dword [esp + 4], eax
jne 0x59074955
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov al, byte [ebx + 4]
add ebx, 4
test al, al
mov dword [esp + 0x14], ebx
je 0x59074acd
mov ecx, dword [0x5919e11c]
push ebp
mov ebp, dword [esp + 0x14]
xor eax, eax
push esi
push edi
test ecx, ecx
jbe 0x590749df
mov esi, dword [0x5919e118]
mov edi, dword [edx + 8]
cmp edi, dword [esi]
jne 0x5907499f
mov edi, dword [edx + 0x10]
cmp edi, dword [esi + 8]
jne 0x5907499f
mov edi, dword [edx + 0x14]
cmp edi, dword [esi + 0xc]
jne 0x5907499f
mov edi, dword [edx + 0x1c]
cmp edi, dword [esi + 0x10]
je 0x590749ac
inc eax
add esi, 0x220
cmp eax, ecx
jb 0x59074980
jmp 0x590749df
lea edi, [esi + 0x14]
push 0x103
lea ecx, [ebp + 0x2c]
push edi
push ecx
call fcn.590802cd
push 0x103
lea edx, [ebp + 0x234]
push edi
push edx
call fcn.590802cd
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x21c], eax
mov edx, dword [0x5919e10c]
xor eax, eax
test edx, edx
jbe 0x59074a67
mov ebx, dword [0x5919e108]
lea esi, [ebp + 8]
mov ecx, 4
mov edi, ebx
xor ebp, ebp
repe cmpsd dword [esi], dword es:[edi]
jne 0x59074a23
mov ecx, dword [esp + 0x18]
mov edi, dword [ebx + 0x10]
mov esi, dword [ecx + 0x10]
cmp esi, edi
jne 0x59074a23
mov esi, dword [ecx + 0x14]
mov edi, dword [ebx + 0x14]
cmp esi, edi
jne 0x59074a23
mov ecx, dword [ecx + 0x1c]
mov esi, dword [ebx + 0x18]
cmp ecx, esi
je 0x59074a34
mov ebp, dword [esp + 0x1c]
inc eax
add ebx, 0x230
cmp eax, edx
jb 0x590749f1
jmp 0x59074a63
mov ebp, dword [esp + 0x1c]
lea edx, [ebx + 0x1c]
push 0x103
push edx
lea eax, [ebp + 0x2c]
push eax
call fcn.590802cd
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x224], eax
mov dword [ebp + 0x43c], 5
mov ebx, dword [esp + 0x20]
lea edi, [ebp + 0x234]
push edi
call fcn.5908146d
mov edx, dword [esp + 0x14]
xor cx, cx
mov cl, al
mov esi, 0x102
push edx
push ebx
sub esi, ecx
call fcn.59074ae0
add esp, 0xc
cmp ax, si
ja 0x59074a94
mov esi, eax
push 0x59180c9c
call fcn.5908146d
push eax
push 0x59180c9c
push edi
call fcn.59083cb1
and esi, 0xffff
push esi
push ebx
push edi
call fcn.59083cb1
add esp, 0x1c
mov dword [ebp + 0x43c], 9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, 0xfffffffe
pop ebx
pop ecx
ret
Function at 0x59075590
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x220
push ebx
push esi
mov esi, dword [esp + 0x22c]
push edi
mov ax, word [esi + 0x18]
cmp ax, 8
jae 0x590755b7
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x220
ret
mov ecx, dword [esi + 4]
mov edi, dword [esp + 0x238]
add eax, 0xfffffffc
cmp ecx, 1
mov word [esi + 0x18], ax
jne 0x590756b8
cmp ax, 5
jae 0x590755e4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x220
ret
mov cx, word [edi + 4]
add eax, 0xfffffffe
cmp ax, 3
mov word [esi + 0x18], ax
jb 0x590756d4
cmp cx, 0x48
jb 0x590756d4
mov dx, word [edi + 6]
add eax, 0xfffffffe
and ecx, 0xffff
mov word [esi + 0x18], ax
and edx, 0xffff
and eax, 0xffff
lea esi, [ecx + edi - 0x40]
add eax, 8
lea ecx, [edx + ecx - 0x40]
cmp eax, ecx
jge 0x5907563d
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x220
ret
cmp byte [esi], 0
je 0x590756e8
mov eax, dword [esp + 0x23c]
mov ebx, dword [esp + 0x234]
test eax, eax
je 0x590756a2
push edx
push esi
call fcn.59074ae0
mov edi, eax
push 0x59186980
lea edx, [edi + edi]
push edx
push esi
call fcn.590751f0
add esp, 0x14
cmp eax, 0xffffffff
je 0x59075687
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
add esp, 0x220
ret
cmp edi, 0x103
jbe 0x59075694
mov edi, 0x103
push edi
lea eax, [ebx + 0x2c]
push esi
push eax
call fcn.590802cd
add esp, 0xc
pop edi
mov dword [ebx + 0x43c], 0xa
pop esi
xor eax, eax
pop ebx
add esp, 0x220
ret
cmp ecx, 2
jne 0x5907573a
mov ecx, dword [esp + 0x234]
lea ebx, [ecx + 0x2c]
push ebx
call fcn.5908146d
add esp, 4
test eax, eax
jne 0x590756e1
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x220
ret
mov edx, dword [esi + 8]
test edx, edx
jne 0x590756f7
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x220
ret
mov ecx, 0x86
xor eax, eax
lea edi, [esp + 0x14]
push 0x103
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x10], edx
mov edx, dword [esi + 0x10]
mov dword [esp + 0x18], edx
lea edx, [esp + 0x24]
push ebx
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
call fcn.590802cd
lea eax, [esp + 0x18]
push eax
call fcn.59074260
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x220
ret
Function at 0x590959d0
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov ax, word [ebp]
push eax
call fcn.59095306
mov cx, word [ebp + 2]
mov word [esp + 0x10], ax
push ecx
call fcn.59095306
sub esp, 0xc
mov word [esp + 0x1e], ax
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x1c]
mov edx, esp
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [edx], esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov dword [edx + 4], ecx
mov dword [edx + 8], eax
call fcn.59095440
mov ecx, dword [0x591a0820]
mov edx, eax
mov eax, dword [0x591a082c]
add esp, 0xc
cmp eax, ecx
mov dword [esp + 0x20], edx
jle 0x59095a7a
mov ecx, dword [0x591a0834]
mov byte [ecx + 0xc], 5
mov edx, dword [0x591a0834]
mov esi, dword [edx + 0x10]
test esi, esi
je 0x59095a67
mov ecx, dword [0x591a0834]
lea eax, [esi + 4]
push eax
push ecx
call dword [esi]
mov esi, dword [esi + 0xc]
add esp, 8
test esi, esi
jne 0x59095a50
mov edx, dword [0x591a0834]
push edx
call fcn.59095870
mov edx, dword [esp + 0x24]
add esp, 4
mov esi, dword [0x591a081c]
test esi, esi
jne 0x59095a9d
push str.gdb_me_..._n
push 0x5918a530
call fcn.5912530f
add esp, 8
push 0xffffffffffffffff
call fcn.59084a66
mov edi, dword [0x591a082c]
mov eax, dword [esi + 0xb4]
mov ecx, dword [0x591a0818]
inc edi
mov dword [0x591a081c], eax
mov dword [0x591a082c], edi
mov ebx, dword [ecx + edx*4]
mov ecx, 0x2e
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xa4], edx
mov edx, esi
mov byte [esi + 0x14], 2
mov dword [edx], eax
mov eax, dword [esp + 0x18]
mov dword [edx + 4], ecx
mov dword [edx + 8], eax
mov ecx, dword [ebp + 4]
push ecx
call fcn.590952f4
inc eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov dx, word [ebp + 0xe]
push edx
call fcn.59095306
xor ecx, ecx
mov word [esi + 0x4c], ax
cmp ebx, ecx
mov byte [esi + 0x58], 7
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ecx
je 0x59095b23
mov dword [ebx + 0xa0], esi
mov eax, dword [0x591a0818]
mov edx, dword [esp + 0x20]
mov dword [eax + edx*4], esi
mov eax, dword [0x591a0830]
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], ecx
cmp dword [0x591a0834], ecx
jne 0x59095b4e
mov dword [0x591a0834], esi
mov eax, dword [0x591a0830]
cmp eax, ecx
je 0x59095b5d
mov dword [eax + 0xac], esi
mov dword [0x591a0830], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x590975c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x590975cd
xor eax, eax
pop esi
ret
mov al, byte [esi + 0x6c]
test al, al
jne 0x590975d8
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x590975ee
push esi
call fcn.59097660
add esp, 4
test eax, eax
jne 0x590975ee
pop esi
ret
lea eax, [esi + 0x64]
mov dword [esi + 0x68], 0
push eax
push 0
push esi
push 0x59097620
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 0x60], eax
test eax, eax
setne cl
mov eax, ecx
pop esi
ret