joyce8/EMBER2024-capa huggingface dataset:
Function at 0x565c00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x54
push edi
xor edi, edi
xor eax, eax
cmp esi, edi
je 0x565c6a
mov edx, dword [esi]
push edi
push edi
xor ecx, ecx
push ecx
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
push 0xc
lea edx, [esp + 0x20]
push edx
push esi
call dword [eax + 0xc]
cmp eax, edi
jl 0x565da7
lea eax, [esp + 4]
test eax, eax
je 0x565c42
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
cmp dword [esp + 4], edi
je 0x565da7
push ebx
mov ebx, dword [esp + 0x60]
push ebp
lea edx, [esp + 0x18]
push edx
push 0x20657563
push ebx
call fcn.00562bb0
mov ebp, eax
cmp ebp, edi
jge 0x565c71
pop ebp
pop ebx
pop edi
add esp, 0x54
ret 0xc
push edi
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x565d99
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
xor ebx, ebx
cmp eax, edi
mov dword [esp + 0x14], edx
jbe 0x565d7c
cmp ebp, edi
jl 0x565d7c
mov eax, dword [esi]
lea ecx, [esp + 0x1c]
push ecx
push 0x1c
lea edx, [esp + 0x4c]
push edx
push esi
call dword [eax + 0xc]
mov ebp, eax
cmp ebp, edi
jne 0x565d6f
mov edx, dword [esp + 0x68]
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x4c]
lea ecx, [ebx + 1]
push edx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x4c]
push eax
push ecx
call fcn.0047e560
mov ecx, dword [esp + 0x64]
push edi
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x48], eax
push 0x18
lea eax, [esp + 0x38]
push eax
push ecx
mov dword [esp + 0x48], 0x61746164
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x565d99
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x58]
add ecx, edx
cmp eax, edi
mov dword [esp + 0x14], ecx
je 0x565d50
mov eax, dword [esp + 0x6c]
mov dword [eax], 1
mov ecx, dword [esp + 0x5c]
cmp ecx, edi
je 0x565d6f
mov edx, dword [esp + 0x6c]
push edi
push 1
xor eax, eax
push eax
push ecx
mov dword [edx], 1
mov edx, dword [esi]
push esi
call dword [edx + 0x14]
mov eax, dword [esp + 0xc]
inc ebx
cmp ebx, eax
jb 0x565ca3
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x64]
push eax
push ecx
push edx
call fcn.00562c00
pop ebp
pop ebx
pop edi
add esp, 0x54
ret 0xc
pop ebp
pop ebx
mov eax, 0x8004e009
pop edi
add esp, 0x54
ret 0xc
xor eax, eax
pop edi
add esp, 0x54
ret 0xc
Function at 0x565db0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3c
xor eax, eax
test esi, esi
push ebp
mov ebp, dword [esp + 0x44]
mov dword [esp + 4], 4
je 0x565e28
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 0x44]
push ecx
push 0xc
lea edx, [esp + 0x20]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x565f4d
lea ecx, [esp + 0x44]
test ecx, ecx
je 0x565dfc
mov edx, dword [esp + 0x20]
mov dword [esp + 0x44], edx
test eax, eax
jne 0x565f4d
mov eax, dword [esp + 0x44]
test eax, eax
je 0x565f4d
push edi
lea eax, [esp + 0x14]
push eax
push 0x5453494c
push ebp
call fcn.00562bb0
mov edi, eax
test edi, edi
jge 0x565e2f
pop edi
pop ebp
add esp, 0x3c
ret 8
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x20], 0x6c746461
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x565e5d
pop edi
mov eax, 0x8004e009
pop ebp
add esp, 0x3c
ret 8
mov eax, dword [esp + 0x48]
push ebx
xor ebx, ebx
test eax, eax
jbe 0x565ed0
test edi, edi
jl 0x565ed0
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push 0x1c
lea edx, [esp + 0x34]
push edx
push esi
call dword [eax + 0xc]
mov edi, eax
test edi, edi
jne 0x565ec7
mov eax, dword [esp + 0x40]
test eax, eax
je 0x565eb2
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
call fcn.0047e560
lea ecx, [esp + 0xc]
push ecx
push eax
lea edx, [ebx + 1]
push edx
push ebp
call fcn.00562db0
mov edi, eax
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x565ec7
mov edx, dword [esi]
xor eax, eax
push eax
push 1
push eax
push ecx
push esi
call dword [edx + 0x14]
mov eax, dword [esp + 0x4c]
inc ebx
cmp ebx, eax
jb 0x565e68
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 0x50]
push ecx
push 0xc
lea edx, [esp + 0x28]
push edx
push esi
call dword [eax + 0xc]
mov ebx, dword [esp + 0x4c]
xor edi, edi
test ebx, ebx
jbe 0x565f34
lea ebx, [ebx]
test eax, eax
jl 0x565f34
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push 0x1c
lea edx, [esp + 0x34]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jne 0x565f2f
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0xc]
push eax
push ecx
lea edx, [edi + 1]
push edx
push esi
push ebp
call fcn.00565a80
inc edi
cmp edi, ebx
jb 0x565f00
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push ebp
call fcn.00562c00
pop ebx
pop edi
pop ebp
add esp, 0x3c
ret 8
xor eax, eax
pop ebp
add esp, 0x3c
ret 8
Function at 0x565f60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x50
xor eax, eax
test esi, esi
push ebp
mov ebp, dword [esp + 0x58]
mov dword [esp + 4], 4
je 0x56613b
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 0x58]
push ecx
push 0x1c
lea edx, [esp + 0x40]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x56613b
lea eax, [esp + 0x58]
test eax, eax
je 0x565fb0
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x58], ecx
mov eax, dword [esp + 0x58]
test eax, eax
jne 0x565fc1
xor eax, eax
pop ebp
add esp, 0x50
ret 4
push edi
lea edx, [esp + 0x18]
push edx
push 0x5453494c
push ebp
call fcn.00562bb0
mov edi, eax
test edi, edi
jge 0x565fe0
pop edi
pop ebp
add esp, 0x50
ret 4
push 0
lea eax, [esp + 0x20]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push ebp
mov dword [esp + 0x20], 0x6c746461
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x56600e
pop edi
mov eax, 0x8004e009
pop ebp
add esp, 0x50
ret 4
mov eax, dword [esp + 0x5c]
push ebx
xor ebx, ebx
test eax, eax
jbe 0x56608f
lea esp, [esp]
test edi, edi
jl 0x56608f
push 0
push esi
call fcn.00562d50
test eax, eax
jl 0x566139
mov edx, dword [esi]
lea eax, [esp + 0x18]
push eax
push 0x1c
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [edx + 0xc]
mov edi, eax
test edi, edi
jne 0x566086
mov eax, dword [esp + 0x38]
test eax, eax
jl 0x566071
mov eax, dword [esp + 0x34]
jg 0x56605e
test eax, eax
jb 0x566071
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [esp + 0x30]
push eax
push ebp
call fcn.00562db0
mov edi, eax
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x566086
mov edx, dword [esi]
xor eax, eax
push eax
push 1
push eax
push ecx
push esi
call dword [edx + 0x14]
mov eax, dword [esp + 0x60]
inc ebx
cmp ebx, eax
jb 0x566020
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push 0x1c
lea edx, [esp + 0x48]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x566139
mov ecx, dword [esp + 0x60]
xor edi, edi
test ecx, ecx
jbe 0x566129
mov ebx, 0x64
test eax, eax
jl 0x566129
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push 0x1c
lea edx, [esp + 0x48]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x566139
cmp dword [esp + 0x44], ebx
jne 0x566142
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x40]
jne 0x566142
test eax, eax
jl 0x566139
mov edx, dword [esi]
lea eax, [esp + 0x18]
push eax
push 0x1c
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [edx + 0xc]
test eax, eax
jne 0x566120
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0xc]
push edx
push eax
push ecx
push esi
push ebp
call fcn.00565a80
mov ecx, dword [esp + 0x60]
inc edi
cmp edi, ecx
jb 0x5660c6
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
push edx
push eax
push ebp
call fcn.00562c00
pop ebx
pop edi
pop ebp
add esp, 0x50
ret 4
pop ebx
pop edi
mov eax, 0x8004e008
pop ebp
add esp, 0x50
ret 4
Function at 0x5661b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x58
push ebx
push ebp
xor eax, eax
test esi, esi
push edi
je 0x56636c
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 0x18]
push ecx
push 0xc
lea edx, [esp + 0x28]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x56636a
lea eax, [esp + 0xc]
test eax, eax
je 0x5661f6
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x56636a
mov ecx, dword [0x5eef38]
mov edi, dword [esp + 0x68]
lea edx, [esp + 0x18]
push edx
mov edx, dword [0x5eef3c]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x5eef40]
mov dword [eax + 4], edx
mov edx, dword [0x5eef44]
mov dword [eax + 8], ecx
push edi
mov dword [eax + 0xc], edx
call fcn.00565910
test eax, eax
jl 0x56636c
push 0
lea eax, [esp + 0x14]
push eax
mov ebx, 4
push ebx
lea ecx, [esp + 0x18]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x56635c
cmp dword [esp + 0x10], ebx
jne 0x56635c
mov eax, dword [esp + 0xc]
xor ebp, ebp
xor edi, edi
test eax, eax
jbe 0x56632f
lea esp, [esp]
mov edx, dword [esi]
lea eax, [esp + 0x14]
push eax
push 0x1c
lea ecx, [esp + 0x50]
push ecx
push esi
call dword [edx + 0xc]
test eax, eax
jl 0x56634e
cmp dword [esp + 0x14], 0x1c
jne 0x56634e
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x50]
push eax
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x50]
push ecx
push edx
mov dword [esp + 0x3c], edi
call fcn.0047e560
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x5c]
test eax, eax
mov dword [esp + 0x38], edx
je 0x5662ef
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x54]
push eax
push ecx
push edx
call fcn.0047e560
mov dword [esp + 0x40], edx
jmp 0x5662f6
or eax, 0xffffffff
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x64]
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x70]
push esi
push eax
call fcn.00562e60
test eax, eax
jl 0x56636c
add ebx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
adc ebp, 0
inc edi
cmp edi, eax
jb 0x566280
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x68]
push ebp
push ebx
push ecx
push edx
push eax
call fcn.00565990
pop edi
pop ebp
pop ebx
add esp, 0x58
ret 8
mov eax, 0x8004e008
pop edi
pop ebp
pop ebx
add esp, 0x58
ret 8
mov eax, 0x8004e009
pop edi
pop ebp
pop ebx
add esp, 0x58
ret 8
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x58
ret 8
Function at 0x566380
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x4c
push ebx
push ebp
xor eax, eax
test esi, esi
push edi
je 0x5664cc
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 0x18]
push ecx
push 0x1c
lea edx, [esp + 0x28]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x5664cc
lea ecx, [esp + 0xc]
test ecx, ecx
je 0x5663c6
mov edx, dword [esp + 0x28]
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x5664cc
mov edx, dword [0x5eef38]
mov edi, dword [esp + 0x5c]
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x5eef3c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [0x5eef40]
mov dword [ecx + 4], eax
mov eax, dword [0x5eef44]
mov dword [ecx + 8], edx
push edi
mov dword [ecx + 0xc], eax
call fcn.00565910
test eax, eax
jl 0x5664cc
push 0
lea ecx, [esp + 0x14]
push ecx
push 4
lea edx, [esp + 0x18]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5664c7
cmp dword [esp + 0x10], 4
jne 0x5664c7
mov eax, dword [esp + 0xc]
xor ebp, ebp
xor ebx, ebx
test eax, eax
mov edi, 4
jbe 0x56649a
push 0
push esi
call fcn.00562d50
test eax, eax
jl 0x5664cc
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push 0x1c
lea edx, [esp + 0x44]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x5664b9
cmp dword [esp + 0x14], 0x1c
jne 0x5664b9
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
push edx
call fcn.00562e60
test eax, eax
jl 0x5664cc
add edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
adc ebp, 0
inc ebx
cmp ebx, eax
jb 0x566448
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x5c]
push ebp
push edi
push eax
push ecx
push edx
call fcn.00565990
pop edi
pop ebp
pop ebx
add esp, 0x4c
ret 4
mov eax, 0x8004e008
pop edi
pop ebp
pop ebx
add esp, 0x4c
ret 4
mov eax, 0x8004e009
pop edi
pop ebp
pop ebx
add esp, 0x4c
ret 4
Function at 0x5664e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x828
push ebp
push esi
xor eax, eax
test ebx, ebx
push edi
je 0x566719
mov edx, dword [ebx]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push ebx
call dword [edx + 0x14]
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
push 0xc
lea edx, [esp + 0x30]
push edx
push ebx
call dword [eax + 0xc]
test eax, eax
jl 0x566717
lea ecx, [esp + 0x10]
test ecx, ecx
je 0x566529
mov edx, dword [esp + 0x30]
mov dword [esp + 0x10], edx
test eax, eax
jne 0x566717
mov eax, dword [esp + 0x10]
test eax, eax
je 0x566717
mov edx, dword [0x5eef48]
mov esi, dword [esp + 0x838]
lea eax, [esp + 0x28]
push eax
mov eax, dword [0x5eef4c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [0x5eef50]
mov dword [ecx + 4], eax
mov eax, dword [0x5eef54]
mov dword [ecx + 8], edx
push esi
mov dword [ecx + 0xc], eax
call fcn.00565910
test eax, eax
jl 0x566719
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebp
test eax, eax
je 0x5666f5
cmp dword [esp + 0xc], 4
jne 0x5666f5
mov eax, dword [esp + 0x10]
xor edi, edi
test eax, eax
mov esi, 4
mov dword [esp + 0x14], edi
jbe 0x5666bf
mov edi, edi
mov eax, dword [ebx]
lea ecx, [esp + 0x18]
push ecx
push 0xc
lea edx, [esp + 0x24]
push edx
push ebx
call dword [eax + 0xc]
test eax, eax
jl 0x566706
cmp dword [esp + 0x18], 0xc
jne 0x566706
cmp dword [esp + 0x24], 0x800
ja 0x5666e4
mov edx, dword [esp + 0x838]
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push edx
call ebp
test eax, eax
je 0x5666f5
cmp dword [esp + 0xc], 4
jne 0x5666f5
mov edx, dword [esp + 0x838]
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x30]
push ecx
add esi, 4
push edx
adc edi, 0
call ebp
test eax, eax
je 0x5666f5
cmp dword [esp + 0xc], 4
jne 0x5666f5
mov edx, dword [esp + 0x24]
mov eax, dword [ebx]
lea ecx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x3c]
push ecx
add esi, 4
push ebx
adc edi, 0
call dword [eax + 0xc]
test eax, eax
jl 0x566706
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x18]
jne 0x566706
mov ecx, dword [esp + 0x838]
push 0
lea edx, [esp + 0x10]
push edx
push eax
lea eax, [esp + 0x40]
push eax
push ecx
call ebp
test eax, eax
je 0x5666f5
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x24], eax
jne 0x5666f5
mov ecx, dword [esp + 0x10]
add esi, eax
mov eax, dword [esp + 0x14]
adc edi, 0
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jb 0x5665c0
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x838]
push edi
push esi
push edx
push eax
push ecx
call fcn.00565990
pop edi
pop esi
pop ebp
add esp, 0x828
ret 4
mov eax, 0x80070057
pop edi
pop esi
pop ebp
add esp, 0x828
ret 4
mov eax, 0x8004e009
pop edi
pop esi
pop ebp
add esp, 0x828
ret 4
mov eax, 0x8004e008
pop edi
pop esi
pop ebp
add esp, 0x828
ret 4
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x828
ret 4
Function at 0x566730
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x840
push ebx
push ebp
mov ebp, dword [esp + 0x84c]
xor eax, eax
test esi, esi
push edi
je 0x566945
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push 0x1c
lea edx, [esp + 0x38]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x566945
lea ecx, [esp + 0x10]
test ecx, ecx
je 0x566780
mov edx, dword [esp + 0x38]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x566945
mov edx, dword [0x5eef48]
lea eax, [esp + 0x28]
push eax
mov eax, dword [0x5eef4c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [0x5eef50]
mov dword [ecx + 4], eax
mov eax, dword [0x5eef54]
mov dword [ecx + 8], edx
push ebp
mov dword [ecx + 0xc], eax
call fcn.00565910
test eax, eax
jl 0x566945
push 0
lea ecx, [esp + 0x10]
push ecx
mov edi, 4
push edi
lea edx, [esp + 0x1c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x566940
cmp dword [esp + 0xc], edi
jne 0x566940
mov eax, dword [esp + 0x10]
xor ebx, ebx
test eax, eax
mov dword [esp + 0x14], ebx
jbe 0x566900
push 0
push esi
call fcn.00562d50
test eax, eax
jl 0x566945
mov eax, dword [esi]
lea ecx, [esp + 0x18]
push ecx
push 0xc
lea edx, [esp + 0x24]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x56692f
cmp dword [esp + 0x18], 0xc
jne 0x56692f
cmp dword [esp + 0x24], 0x800
ja 0x56691e
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x566940
cmp dword [esp + 0xc], 4
jne 0x566940
push 0
lea edx, [esp + 0x10]
push edx
push 4
lea eax, [esp + 0x30]
push eax
add edi, 4
push ebp
adc ebx, 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x566940
cmp dword [esp + 0xc], 4
jne 0x566940
mov eax, dword [esp + 0x24]
mov ecx, dword [esi]
lea edx, [esp + 0x18]
push edx
push eax
lea edx, [esp + 0x54]
push edx
add edi, 4
push esi
adc ebx, 0
call dword [ecx + 0xc]
test eax, eax
jl 0x56692f
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x18]
jne 0x56692f
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
lea edx, [esp + 0x58]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x566940
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x24], eax
jne 0x566940
mov ecx, dword [esp + 0x10]
add edi, eax
mov eax, dword [esp + 0x14]
adc ebx, 0
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jb 0x566802
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push ebx
push edi
push eax
push ecx
push ebp
call fcn.00565990
pop edi
pop ebp
pop ebx
add esp, 0x840
ret 4
mov eax, 0x80070057
pop edi
pop ebp
pop ebx
add esp, 0x840
ret 4
mov eax, 0x8004e008
pop edi
pop ebp
pop ebx
add esp, 0x840
ret 4
mov eax, 0x8004e009
pop edi
pop ebp
pop ebx
add esp, 0x840
ret 4
Function at 0x566960
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1d4
xor eax, eax
test esi, esi
je 0x566a61
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 4]
push ecx
push 0x1c
lea edx, [esp + 0x18]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x56699e
lea ecx, [esp + 4]
test ecx, ecx
mov ecx, dword [esp + 0x18]
jne 0x5669a2
mov ecx, dword [esp + 4]
test eax, eax
jl 0x566a61
test ecx, ecx
jbe 0x566a61
push 0
push esi
call fcn.00562d50
test eax, eax
jl 0x566a61
mov edx, dword [esi]
lea eax, [esp]
push eax
push 0x1a8
lea ecx, [esp + 0x34]
push ecx
push esi
call dword [edx + 0xc]
test eax, eax
jl 0x566a61
cmp dword [esp], 0x1a8
ja 0x566a61
mov ecx, dword [0x5eef68]
lea edx, [esp + 4]
push edx
mov edx, dword [0x5eef6c]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x5eef70]
mov dword [eax + 4], edx
mov edx, dword [0x5eef74]
mov dword [eax + 8], ecx
push edi
mov dword [eax + 0xc], edx
call fcn.00565910
test eax, eax
jl 0x566a61
mov ecx, dword [esp]
push 0
lea eax, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x38]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x566a5c
mov eax, dword [esp]
cmp dword [esp + 0xc], eax
jne 0x566a5c
mov ecx, dword [esp + 4]
push 0
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edi
call fcn.00565990
add esp, 0x1d4
ret
mov eax, 0x8004e008
add esp, 0x1d4
ret
Function at 0x566c10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x48
push ebx
push ebp
xor eax, eax
test esi, esi
push edi
je 0x566d68
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 0x18]
push ecx
push 0x1c
lea edx, [esp + 0x40]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x566d68
lea ecx, [esp + 0xc]
test ecx, ecx
je 0x566c56
mov edx, dword [esp + 0x40]
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x566d68
mov edx, dword [0x5eef98]
mov edi, dword [esp + 0x58]
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x5eef9c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [0x5eefa0]
mov dword [ecx + 4], eax
mov eax, dword [0x5eefa4]
mov dword [ecx + 8], edx
push edi
mov dword [ecx + 0xc], eax
call fcn.00565910
test eax, eax
jl 0x566d68
push 0
lea ecx, [esp + 0x14]
push ecx
mov ebx, 4
push ebx
lea edx, [esp + 0x18]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x566d63
cmp dword [esp + 0x10], ebx
jne 0x566d63
mov eax, dword [esp + 0xc]
xor ebp, ebp
xor edi, edi
test eax, eax
jbe 0x566d36
push 0
push esi
call fcn.00562d50
test eax, eax
jl 0x566d68
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push 0x18
lea edx, [esp + 0x28]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x566d68
cmp dword [esp + 0x14], 0x18
jne 0x566d55
mov edx, dword [esp + 0x58]
push 0
lea eax, [esp + 0x14]
push eax
push 0x18
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x566d63
cmp dword [esp + 0x10], 0x18
jne 0x566d63
mov eax, dword [esp + 0xc]
add ebx, 0x18
adc ebp, 0
inc edi
cmp edi, eax
jb 0x566cd6
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x58]
push ebp
push ebx
push eax
push ecx
push edx
call fcn.00565990
pop edi
pop ebp
pop ebx
add esp, 0x48
ret 4
mov eax, 0x8004e008
pop edi
pop ebp
pop ebx
add esp, 0x48
ret 4
mov eax, 0x8004e009
pop edi
pop ebp
pop ebx
add esp, 0x48
ret 4
Function at 0x567000
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x2c
xor eax, eax
test esi, esi
je 0x5670ef
mov edx, dword [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push esi
call dword [edx + 0x14]
mov eax, dword [esi]
lea ecx, [esp + 4]
push ecx
push 0x1c
lea edx, [esp + 0x18]
push edx
push esi
call dword [eax + 0xc]
test eax, eax
jl 0x56703a
lea ecx, [esp]
test ecx, ecx
mov ecx, dword [esp + 0x18]
jne 0x56703d
mov ecx, dword [esp]
test eax, eax
jl 0x5670ef
test ecx, ecx
jbe 0x5670ef
push 0
push esi
call fcn.00562d50
test eax, eax
jl 0x5670ef
mov edx, dword [esi]
lea eax, [esp]
push eax
push 0x14
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [edx + 0xc]
test eax, eax
jl 0x5670ef
cmp dword [esp], 0x14
ja 0x5670ef
mov ecx, dword [0x5eefe8]
lea edx, [esp + 8]
push edx
mov edx, dword [0x5eefec]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x5eeff0]
mov dword [eax + 4], edx
mov edx, dword [0x5eeff4]
mov dword [eax + 8], ecx
push edi
mov dword [eax + 0xc], edx
call fcn.00565910
test eax, eax
jl 0x5670ef
mov ecx, dword [esp]
push 0
lea eax, [esp + 8]
push eax
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5670ea
mov eax, dword [esp]
cmp dword [esp + 4], eax
jne 0x5670ea
mov ecx, dword [esp + 8]
push 0
push eax
mov eax, dword [esp + 0x14]
push eax
push ecx
push edi
call fcn.00565990
add esp, 0x2c
ret
mov eax, 0x8004e008
add esp, 0x2c
ret