joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52f0b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x6c6060]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6e6a18], 0
je 0x52f10a
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.ASSERT___file:_s_line:_d___s__do_you_debug_
push 0x6e6918
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x40004
push 0
push 0x6e6918
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x52f105
int3
jmp 0x52f2d6
cmp dword [ebp + 0x10], 0
je 0x52f132
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_line:_d__msg:_s_
lea eax, [ebp - 0x118]
push eax
call fcn.0058a9be
add esp, 0x14
jmp 0x52f14e
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_line:_d_
lea eax, [ebp - 0x118]
push eax
call fcn.0058a9be
add esp, 0x10
mov byte [ebp - 0x218], 0
push 0xff
push 0
lea ecx, [ebp - 0x217]
push ecx
call fcn.0058a320
add esp, 0xc
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
push eax
movzx ecx, word [ebp - 0x12]
push ecx
movzx edx, word [ebp - 0x14]
push edx
push str.._Log_Assert__4d_02d_02d.txt
lea eax, [ebp - 0x218]
push eax
call fcn.0058a9be
add esp, 0x14
cmp dword [0x6e6a70], 0
jne 0x52f2d6
push 0
lea ecx, [ebp - 0x2b0]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xffffffff
jne 0x52f22f
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5b84fc
lea ecx, [ebp - 0x218]
push ecx
call fcn.0058a960
add esp, 8
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
je 0x52f22a
call fcn.0052f430
push eax
lea edx, [ebp - 0x118]
push edx
push str._stime:_s_n
mov eax, dword [ebp - 0x2b4]
push eax
call fcn.0058bc01
add esp, 0x10
mov ecx, dword [ebp - 0x2b4]
push ecx
call fcn.0058a65f
add esp, 4
jmp 0x52f2d6
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x224]
shl ecx, 0x10
or ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x220], 0xf4240
ja 0x52f2cc
push 0x5b84fc
lea eax, [ebp - 0x218]
push eax
call fcn.0058a960
add esp, 8
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
je 0x52f2ca
call fcn.0052f430
push eax
lea ecx, [ebp - 0x118]
push ecx
push str._stime:_s_n
mov edx, dword [ebp - 0x2b8]
push edx
call fcn.0058bc01
add esp, 0x10
mov eax, dword [ebp - 0x2b8]
push eax
call fcn.0058a65f
add esp, 4
jmp 0x52f2d6
mov dword [0x6e6a70], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058a4a9
mov esp, ebp
pop ebp
ret
Function at 0x5304a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b8
mov eax, dword [0x6c6060]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x218], 0
push 0x1ff
push 0
lea eax, [ebp - 0x217]
push eax
call fcn.0058a320
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x5304f8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_line:_d__msg:_s_
lea ecx, [ebp - 0x218]
push ecx
call fcn.0058a9be
add esp, 0x14
jmp 0x530514
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_line:_d_
lea ecx, [ebp - 0x218]
push ecx
call fcn.0058a9be
add esp, 0x10
mov byte [ebp - 0x318], 0
push 0xff
push 0
lea edx, [ebp - 0x317]
push edx
call fcn.0058a320
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0xe]
push ecx
movzx edx, word [ebp - 0x12]
push edx
movzx eax, word [ebp - 0x14]
push eax
push str.._Log_Debug__4d_02d_02d.txt
lea ecx, [ebp - 0x318]
push ecx
call fcn.0058a9be
add esp, 0x14
cmp dword [0x6e6db8], 0
jne 0x53069c
push 0
lea edx, [ebp - 0x3b0]
push edx
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0xffffffff
jne 0x5305f5
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5b84fc
lea edx, [ebp - 0x318]
push edx
call fcn.0058a960
add esp, 8
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0
je 0x5305f0
call fcn.0052f430
push eax
lea eax, [ebp - 0x218]
push eax
push str._stime:_s_n
mov ecx, dword [ebp - 0x3b4]
push ecx
call fcn.0058bc01
add esp, 0x10
mov edx, dword [ebp - 0x3b4]
push edx
call fcn.0058a65f
add esp, 4
jmp 0x53069c
lea eax, [ebp - 0x324]
push eax
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x31c], eax
mov edx, dword [ebp - 0x324]
shl edx, 0x10
or edx, dword [ebp - 0x31c]
mov dword [ebp - 0x320], edx
mov eax, dword [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x320], 0xf4240
ja 0x530692
push 0x5b84fc
lea ecx, [ebp - 0x318]
push ecx
call fcn.0058a960
add esp, 8
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0
je 0x530690
call fcn.0052f430
push eax
lea edx, [ebp - 0x218]
push edx
push str._stime:_s_n
mov eax, dword [ebp - 0x3b8]
push eax
call fcn.0058bc01
add esp, 0x10
mov ecx, dword [ebp - 0x3b8]
push ecx
call fcn.0058a65f
add esp, 4
jmp 0x53069c
mov dword [0x6e6db8], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058a4a9
mov esp, ebp
pop ebp
ret
Function at 0x551d50
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [esi + 0x4c]
add eax, 0x493e0
cmp edi, eax
jbe 0x551d7d
mov ecx, esi
call fcn.00551d10
push 0x5bad48
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esi + 0x4c], edi
pop edi
pop esi
ret

Function at 0x556a00
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [ecx + 0x1f4]
test ecx, ecx
jne 0x556a0f
xor eax, eax
ret 8
jmp 0x55a680
mov edx, dword [esp + 4]
fld dword [edx]
sub esp, 8
fld qword [0x5aee40]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jnp 0x55a784
fldz
fcom dword [edx]
fnstsw ax
test ah, 0x41
je 0x55a782
fld dword [edx + 8]
fcomp st(2)
fnstsw ax
fstp st(1)
test ah, 1
je 0x55a784
fcomp dword [edx + 8]
fnstsw ax
test ah, 0x41
je 0x55a786
push esi
fnstcw word [esp + 0x10]
mov esi, dword [esp + 0x14]
fld dword [esi + 8]
fld qword [0x5ada38]
movzx eax, word [esp + 0x10]
fdiv st(1), st(0)
or eax, 0xc00
mov dword [esp + 0x14], eax
fldcw word [esp + 0x14]
fxch st(1)
fistp qword [esp + 4]
mov eax, dword [esp + 4]
push eax
fldcw word [esp + 0x14]
fld dword [esi]
fdiv st(1)
fnstcw word [esp + 0x14]
movzx eax, word [esp + 0x14]
or eax, 0xc00
mov dword [esp + 0x18], eax
fldcw word [esp + 0x18]
fistp qword [esp + 8]
mov eax, dword [esp + 8]
push eax
fldcw word [esp + 0x18]
fld dword [edx + 8]
fdiv st(1)
fnstcw word [esp + 0x18]
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x1c], eax
fldcw word [esp + 0x1c]
fistp qword [esp + 0xc]
mov eax, dword [esp + 0xc]
push eax
fldcw word [esp + 0x1c]
fdivr dword [edx]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x20], eax
fldcw word [esp + 0x20]
fistp qword [esp + 0x10]
mov edx, dword [esp + 0x10]
push edx
fldcw word [esp + 0x20]
call fcn.0055a0a0
pop esi
add esp, 8
ret 8
fstp st(0)
fstp st(0)
push str._____________________________.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
ret 8

Function at 0x557f00
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1f4], 0
push edi
je 0x557faf
mov edi, dword [esp + 0x14]
test edi, edi
je 0x557faf
push 0
push 1
push 0x7030e0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x557faf
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov dword [0x70308c], ecx
mov edx, dword [eax + 4]
mov dword [0x703090], edx
mov eax, dword [eax + 8]
mov dword [0x703094], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov dword [0x703080], ecx
mov edx, dword [eax + 4]
mov dword [0x703084], edx
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x18]
mov dword [0x703088], eax
mov ecx, dword [esi + 0x1f4]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x557e70
push 0
push 0
mov dword [0x7030dc], ecx
mov dword [0x7030d8], edi
mov dword [0x6c4b84], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x557fb6
push eax
push 0x7030e0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
xor eax, eax
pop esi
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret 0x10
Function at 0x55c0c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea edi, [ebx + 0xa0]
mov ecx, edi
call fcn.004103b0
mov ebp, 1
cmp dword [ebx + 0x88], ebp
jbe 0x55c243
fldz
fstp dword [esp + 0x20]
fld dword [esp + 0x3c]
fmul qword [0x5a9318]
fstp qword [esp + 0x14]
jmp 0x55c100
mov ecx, dword [ebx + 0x78]
mov edx, dword [ebx + 0x84]
xor eax, eax
test ecx, ecx
je 0x55c117
mov ecx, dword [ecx]
test ecx, ecx
je 0x55c117
mov eax, dword [ecx]
lea ecx, [edx + ebp]
test eax, eax
je 0x55c12a
mov eax, dword [eax]
test eax, eax
je 0x55c12a
mov eax, dword [eax]
test eax, eax
jne 0x55c12e
xor edx, edx
jmp 0x55c130
mov edx, dword [eax]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x55c141
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x55c163
fadd dword [0x5a8f58]
fmul dword [esp + 0x3c]
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x84]
xor edx, edx
fadd qword [esp + 0x14]
fstp dword [esp + 0x1c]
test eax, eax
je 0x55c186
mov eax, dword [eax]
test eax, eax
je 0x55c186
mov edx, dword [eax]
add ecx, ebp
test edx, edx
je 0x55c198
mov edx, dword [edx]
test edx, edx
je 0x55c198
mov edx, dword [edx]
test edx, edx
jne 0x55c19c
xor edx, edx
jmp 0x55c19e
mov edx, dword [edx]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x55c1af
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x55c1d1
fadd dword [0x5a8f58]
fmul dword [esp + 0x3c]
mov ecx, dword [edi + 0x10]
inc ecx
fadd qword [esp + 0x14]
fstp dword [esp + 0x24]
cmp dword [edi + 8], ecx
ja 0x55c1ef
push 1
mov ecx, edi
call fcn.00410000
mov esi, dword [edi + 0xc]
add esi, dword [edi + 0x10]
mov eax, dword [edi + 8]
cmp eax, esi
ja 0x55c1fe
sub esi, eax
mov edx, dword [edi + 4]
cmp dword [edx + esi*4], 0
jne 0x55c21b
push 0xc
call fcn.0058a3b0
add esp, 4
test eax, eax
je 0x55c25b
mov ecx, dword [edi + 4]
mov dword [ecx + esi*4], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + esi*4]
lea edx, [esp + 0x1c]
push edx
push ecx
lea edx, [edi + 0x14]
push edx
call fcn.0053f0d0
inc dword [edi + 0x10]
inc ebp
add esp, 0xc
cmp ebp, dword [ebx + 0x88]
jb 0x55c100
mov esi, dword [esp + 0x38]
push edi
mov ecx, esi
call fcn.0055e170
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], 0
call fcn.0058b3c9
push 0x5d14b0
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], vtable.std::bad_alloc.0
call fcn.0058af8f
int3
Function at 0x55c290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea edi, [ebx + 0xb8]
mov ecx, edi
call fcn.004103b0
xor ebp, ebp
cmp dword [ebx + 0x88], ebp
jbe 0x55c413
fldz
fstp dword [esp + 0x20]
fld dword [esp + 0x3c]
fmul qword [0x5a9318]
fstp qword [esp + 0x14]
jmp 0x55c2d0
mov ecx, dword [ebx + 0x78]
mov edx, dword [ebx + 0x84]
xor eax, eax
test ecx, ecx
je 0x55c2e7
mov ecx, dword [ecx]
test ecx, ecx
je 0x55c2e7
mov eax, dword [ecx]
lea ecx, [edx + ebp]
test eax, eax
je 0x55c2fa
mov eax, dword [eax]
test eax, eax
je 0x55c2fa
mov eax, dword [eax]
test eax, eax
jne 0x55c2fe
xor edx, edx
jmp 0x55c300
mov edx, dword [eax]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x55c311
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x55c333
fadd dword [0x5a8f58]
fmul dword [esp + 0x3c]
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x84]
xor edx, edx
fadd qword [esp + 0x14]
fstp dword [esp + 0x1c]
test eax, eax
je 0x55c356
mov eax, dword [eax]
test eax, eax
je 0x55c356
mov edx, dword [eax]
add ecx, ebp
test edx, edx
je 0x55c368
mov edx, dword [edx]
test edx, edx
je 0x55c368
mov edx, dword [edx]
test edx, edx
jne 0x55c36c
xor edx, edx
jmp 0x55c36e
mov edx, dword [edx]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x55c37f
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x55c3a1
fadd dword [0x5a8f58]
fmul dword [esp + 0x3c]
mov ecx, dword [edi + 0x10]
inc ecx
fadd qword [esp + 0x14]
fstp dword [esp + 0x24]
cmp dword [edi + 8], ecx
ja 0x55c3bf
push 1
mov ecx, edi
call fcn.00410000
mov esi, dword [edi + 0xc]
add esi, dword [edi + 0x10]
mov eax, dword [edi + 8]
cmp eax, esi
ja 0x55c3ce
sub esi, eax
mov edx, dword [edi + 4]
cmp dword [edx + esi*4], 0
jne 0x55c3eb
push 0xc
call fcn.0058a3b0
add esp, 4
test eax, eax
je 0x55c42b
mov ecx, dword [edi + 4]
mov dword [ecx + esi*4], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + esi*4]
lea edx, [esp + 0x1c]
push edx
push ecx
lea edx, [edi + 0x14]
push edx
call fcn.0053f0d0
inc dword [edi + 0x10]
inc ebp
add esp, 0xc
cmp ebp, dword [ebx + 0x88]
jb 0x55c2d0
mov esi, dword [esp + 0x38]
push edi
mov ecx, esi
call fcn.0055e170
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], 0
call fcn.0058b3c9
push 0x5d14b0
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], vtable.std::bad_alloc.0
call fcn.0058af8f
int3
Function at 0x56c160
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
cmp esi, 0x12
jb 0x56c17e
push 0
push 0x72
push str.DirectoryManager.cpp
call fcn.0052f0b0
add esp, 0xc
cmp esi, dword [edi + 0x50]
je 0x56c196
cmp esi, 0x11
je 0x56c196
mov eax, dword [edi + esi*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [edi + 0x50], esi
pop edi
pop esi
ret 4
Function at 0x583c10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74c
mov eax, dword [0x6c6060]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x74c], ecx
cmp dword [ebp + 8], 0
jne 0x583c36
xor eax, eax
jmp 0x583e9b
cmp dword [ebp + 0xc], 0
jne 0x583c43
xor eax, eax
jmp 0x583e9b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x744], eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 1
lea edx, [ebp - 0x331]
push edx
call fcn.0058acaa
add esp, 0x10
mov eax, dword [ebp - 0x74c]
add eax, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0x33c], 0
push 0x200
push 0
lea ecx, [ebp - 0x330]
push ecx
call fcn.0058a320
add esp, 0xc
lea edx, [ebp - 0x130]
push edx
push str._02X
mov eax, dword [ebp - 4]
push eax
call fcn.0058c816
add esp, 0xc
test eax, eax
jle 0x583ce4
cmp dword [ebp - 0x33c], 0x200
jge 0x583ce4
mov ecx, dword [ebp - 0x33c]
mov dl, byte [ebp - 0x130]
mov byte [ebp + ecx - 0x330], dl
mov eax, dword [ebp - 0x33c]
add eax, 1
mov dword [ebp - 0x33c], eax
mov ecx, dword [ebp - 4]
add ecx, 2
mov dword [ebp - 4], ecx
jmp 0x583c8f
push 0x100
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x128]
push eax
call fcn.005826b0
add esp, 0xc
mov cl, byte [ebp + 0x14]
mov byte [ebp - 5], cl
mov dword [ebp - 0x338], 0
jmp 0x583d20
mov edx, dword [ebp - 0x338]
add edx, 0x10
mov dword [ebp - 0x338], edx
mov eax, dword [ebp - 0x338]
cmp eax, dword [ebp - 0x744]
jge 0x583e1a
mov ecx, dword [ebp + 8]
push ecx
push 0x10
push 1
lea edx, [ebp - 0x740]
push edx
call fcn.0058acaa
add esp, 0x10
cmp eax, 0x10
je 0x583d95
push 0
push str.Error__
push str.Header_Version_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
push 0
lea eax, [ebp - 0x740]
push eax
call fcn.0058a320
add esp, 0xc
push 0x118
push 0
lea ecx, [ebp - 0x128]
push ecx
call fcn.0058a320
add esp, 0xc
xor eax, eax
jmp 0x583e9b
lea edx, [ebp - 0x740]
push edx
lea eax, [ebp - 0x740]
push eax
push 0
lea ecx, [ebp - 0x128]
push ecx
call fcn.005829b0
add esp, 0x10
mov dword [ebp - 0x748], 0
jmp 0x583dcf
mov edx, dword [ebp - 0x748]
add edx, 1
mov dword [ebp - 0x748], edx
cmp dword [ebp - 0x748], 0x10
jge 0x583e15
mov eax, dword [ebp - 0x338]
add eax, dword [ebp - 0x748]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x748]
mov dl, byte [ebp + edx - 0x740]
mov byte [ecx + eax], dl
movsx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x338]
add ecx, dword [ebp - 0x748]
mov edx, dword [ebp + 0xc]
movsx ecx, byte [edx + ecx]
add eax, ecx
mov byte [ebp - 5], al
jmp 0x583dc0
jmp 0x583d11
mov edx, dword [ebp + 8]
push edx
push 1
push 1
lea eax, [ebp - 0x129]
push eax
call fcn.0058acaa
add esp, 0x10
movsx ecx, byte [ebp - 0x331]
movsx edx, byte [ebp - 0x129]
cmp ecx, edx
jne 0x583e52
movsx eax, byte [ebp - 0x331]
movsx ecx, byte [ebp - 5]
cmp eax, ecx
je 0x583e96
push 0
push str.Error__
push str.Header_Version_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
push 0
lea edx, [ebp - 0x740]
push edx
call fcn.0058a320
add esp, 0xc
push 0x118
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.0058a320
add esp, 0xc
xor eax, eax
jmp 0x583e9b
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0058a4a9
mov esp, ebp
pop ebp
ret 0x10
Function at 0x58a4a9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6c6060]
jne 0x58a4b3
repz ret
jmp fcn.00592481

Function at 0x598633
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6c6060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00596668
and dword [ebp - 0x14], 0
cmp dword [0x7066cc], 0
mov dword [ebp - 0x18], eax
jne 0x5986e6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x59878e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x59878e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5bf1a4
push ebx
mov dword [0x7066cc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x7066d0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x7066d4], eax
call edi
push eax
call esi
mov dword [0x7066dc], eax
test eax, eax
je 0x5986e6
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x7066d8], eax
mov eax, dword [0x7066d8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x59873f
cmp dword [0x7066dc], ecx
je 0x59873f
push eax
call esi
push dword [0x7066dc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x59873f
test ebx, ebx
je 0x59873f
call edi
test eax, eax
je 0x598736
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x598736
test byte [ebp - 8], 1
jne 0x59873f
or dword [ebp + 0x10], 0x200000
jmp 0x598772
mov eax, dword [0x7066d0]
cmp eax, dword [ebp - 0x18]
je 0x598772
push eax
call esi
test eax, eax
je 0x598772
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x598772
mov eax, dword [0x7066d4]
cmp eax, dword [ebp - 0x18]
je 0x598772
push eax
call esi
test eax, eax
je 0x598772
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x7066cc]
call esi
test eax, eax
je 0x59878e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x598790
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058a4a9
leave
ret
Function at 0x10015420
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1001545e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10015456
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10015460
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10015446
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10015530
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10015561
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10015561
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x10015561
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1001b24e
Capabilities:
Encode data using xor

Disassembly:
call 0x1001b1c7
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1001b1f7
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x1001b213
xor edx, 0
jmp 0x1001b21e
xor edx, edx
jmp 0x1001b235
jmp 0x1001b241
xor eax, eax
push 0x8427d7c0
call 0x1001b24e
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x1001b28a
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1001b263
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x1001b2a1
add eax, 0
jno 0x1001b2a6
add esi, 0
ret 0x10