joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d89f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6677cc
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x758898]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ebx, [esi + 0x50]
mov ecx, ebx
mov dword [esi], vtable.CMp3Format.0
call fcn.00402500
xor edi, edi
mov dword [esp + 0x20], edi
lea ebp, [esi + 0x54]
mov ecx, ebp
call fcn.00402500
mov byte [esp + 0x20], 1
lea ecx, [esi + 0x58]
call fcn.00402500
mov byte [esp + 0x20], 2
lea ecx, [esi + 0x5c]
call fcn.00402500
mov byte [esp + 0x20], 3
fldz
fstp dword [esi + 0x64]
mov dword [esi + 0x60], edi
mov dword [esi + 0x44], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
xor eax, eax
mov word [esi + 0x40], ax
mov byte [esi + 0x42], al
mov dword [esi + 0x48], eax
mov byte [esi + 0x4c], al
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
push edi
mov dword [esi + 0x3c], eax
push 0x67997c
mov ecx, ebx
mov dword [esi + 0x1c], edi
call fcn.00402960
push edi
push 0x67997c
mov ecx, ebp
call fcn.00402960
push edi
push 0x67997c
lea ecx, [esi + 0x58]
call fcn.00402960
push edi
push 0x67997c
lea ecx, [esi + 0x5c]
call fcn.00402960
mov dword [esp + 0x20], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x5dbde0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0
call fcn.005daf30
add esp, 4
test eax, eax
je 0x5dbe02
xor eax, eax
add esp, 8
ret
mov ecx, dword [0x75f8cc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PEM_read_bio_RSA_PUBKEY
push ecx
call esi
mov edx, dword [0x75f8cc]
push str.PEM_read_bio_RSAPublicKey
push edx
mov dword [0x75f878], eax
call esi
mov dword [0x75f874], eax
mov eax, dword [0x75f8cc]
push str.BIO_new_mem_buf
push eax
call esi
mov ecx, dword [0x75f8cc]
push str.RSA_new
push ecx
mov dword [0x75f870], eax
call esi
mov edx, dword [0x75f8cc]
push str.RSA_free
push edx
mov dword [0x75f86c], eax
call esi
mov dword [0x75f868], eax
mov eax, dword [0x75f8cc]
push str.BIO_free_all
push eax
call esi
mov ecx, dword [0x75f8cc]
push str.RSA_size
push ecx
mov dword [0x75f864], eax
call esi
mov edx, dword [0x75f8cc]
push str.RSA_public_decrypt
push edx
mov dword [0x75f860], eax
call esi
cmp dword [0x75f878], 0
mov dword [0x75f85c], eax
je 0x5dbfad
mov ecx, dword [0x75f870]
test ecx, ecx
je 0x5dbfad
cmp dword [0x75f86c], 0
je 0x5dbfad
cmp dword [0x75f868], 0
je 0x5dbfad
cmp dword [0x75f864], 0
je 0x5dbfad
cmp dword [0x75f860], 0
je 0x5dbfad
test eax, eax
je 0x5dbfad
mov eax, dword [esp + 0x14]
push ebx
push 0xffffffffffffffff
push eax
call ecx
mov ebx, eax
call dword [0x75f86c]
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
push ebx
mov dword [esp + 0x20], eax
call dword [0x75f878]
add esp, 0x18
mov dword [esp + 8], eax
test eax, eax
jne 0x5dbf39
push ebx
call dword [0x75f864]
add esp, 4
pop ebx
xor eax, eax
pop esi
add esp, 8
ret
push edi
push eax
call dword [0x75f860]
lea edi, [eax + 1]
push edi
call fcn.005f4427
push edi
mov esi, eax
push 0
push esi
call fcn.00620850
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
push 1
push edx
push esi
push eax
push 0x100
call dword [0x75f85c]
add esp, 0x28
pop edi
test eax, eax
jl 0x5dbf81
mov ecx, dword [esp + 0x1c]
push esi
call fcn.0054f250
jmp 0x5dbf87
call dword [0x75f87c]
push esi
call fcn.005f4432
push ebx
call dword [0x75f864]
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x75f868]
add esp, 0xc
pop ebx
mov eax, 1
pop esi
add esp, 8
ret
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x5dd880
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x667ee0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x758898]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
mov ecx, dword [esi + 0x347c]
xor ebx, ebx
cmp ecx, ebx
je 0x5dd903
cmp byte [esi + 0xe3], bl
je 0x5dd8d2
mov eax, dword [esi + 0xc8]
mov eax, dword [eax + 0x17c]
jmp 0x5dd8de
mov edx, dword [esi + 0xc8]
mov eax, dword [edx + 0x178]
cmp eax, 5
jne 0x5dd903
push ecx
call dword [0x75f890]
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, 1
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x3c], eax
lea edx, [ebp - 0x34]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0xc8]
lea ecx, [ebp - 0x40]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [eax + 0x434]
call eax
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, ebx
jge 0x5dd959
mov dword [ebp - 4], 0xffffffff
jmp 0x5dda47
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], 1
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x40], ebx
mov edx, dword [esi + 0xc8]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
push ebx
push 0x10
push ebx
push 0xc11c
push ebx
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [edx + 0x424]
call edx
mov edi, eax
cmp edi, ebx
jl 0x5dda47
mov eax, dword [ebp - 0x2c]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x5dda47
mov edx, dword [ebp - 0x34]
cmp edx, ebx
je 0x5dda47
mov ecx, dword [esi + 0x19c]
cmp ecx, ebx
je 0x5dd9f3
cmp byte [ecx + 0x137], bl
je 0x5dd9f3
mov ecx, dword [esi + 0x3480]
cmp ecx, ebx
je 0x5dd9f3
push edx
push eax
call fcn.005dca60
test eax, eax
jne 0x5dda47
jmp 0x5dda0b
push ebx
push edx
push eax
mov eax, dword [esi + 0x3200]
push eax
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x5dda2b
cmp eax, ebx
je 0x5dda2b
push str.Sending_Close_Notify_n
mov ecx, esi
call fcn.00561d20
mov ecx, dword [esi + 0xc8]
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ecx + 0x44c]
call eax
jmp 0x5dda47
call sub.WS2_32.dll_WSAGetLastError
mov edi, eax
jmp 0x5dda47
mov ecx, dword [esi + 0xc8]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ecx + 0x430]
call eax
mov ecx, dword [esi + 0xc8]
add esi, 0x333c
push esi
mov edx, dword [ecx + 0x41c]
call edx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5df870
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x5df87b
xor eax, eax
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
push esi
not eax
cmp edx, 8
jb 0x5df959
mov esi, edx
shr esi, 3
push edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6b9368]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x6b9368]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x6b9368]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6b9368]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6b9368]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6b9368]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6b9368]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6b9368]
inc ecx
sub edx, 8
sub esi, 1
jne 0x5df895
pop edi
test edx, edx
je 0x5df97b
lea ecx, [ecx]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6b9368]
inc ecx
sub edx, 1
jne 0x5df960
not eax
pop esi
ret

Function at 0x5e0ab0
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
jne 0x5e0b03
cmp dword [esi + 4], 0
jne 0x5e0b0c
call fcn.00625984
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call fcn.0062515c
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x5e0b07
mov edx, dword [esi + 0x40]
push edx
mov dword [esi + 0x3c], 1
call fcn.00628440
add esp, 4
test eax, eax
je 0x5e0b03
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
ret

Function at 0x5e0ce0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x5e0d67
cmp word [esi + 0x5c], 0x77
jne 0x5e0d67
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
mov dword [esi], ebp
mov dword [esi + 4], edi
test edi, edi
je 0x5e0d4d
cmp dword [esi + 0x10], 0
jne 0x5e0d2d
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call fcn.00622cf5
add esp, 0x10
cmp eax, 0x4000
jne 0x5e0d46
mov dword [esi + 0x10], eax
push 0
push esi
call fcn.005dfa00
add esp, 8
mov dword [esi + 0x38], eax
test eax, eax
jne 0x5e0d4d
cmp dword [esi + 4], eax
jne 0x5e0d03
jmp 0x5e0d4d
mov dword [esi + 0x38], 0xffffffff
mov edx, dword [esi + 0x4c]
push edi
push ebp
push edx
call fcn.005df870
add esp, 0xc
mov dword [esi + 0x4c], eax
mov eax, edi
sub eax, dword [esi + 4]
pop edi
pop ebp
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x5e0d70
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x5e0e1a
cmp word [esi + 0x5c], 0x77
jne 0x5e0e1a
mov dword [esi + 4], ebx
push edi
lea ecx, [ecx]
mov edi, 0x4000
sub edi, dword [esi + 0x10]
je 0x5e0dbe
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call fcn.00622cf5
add esp, 0x10
cmp eax, edi
jne 0x5e0e10
mov edx, dword [esi + 0x48]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x4000
test ebx, ebx
jne 0x5e0e00
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.005dfa00
add esp, 8
mov dword [esi + 0x38], eax
test edi, edi
jne 0x5e0ddf
cmp eax, 0xfffffffb
jne 0x5e0ddf
mov dword [esi + 0x38], edi
cmp dword [esi + 0x10], 0
jne 0x5e0def
cmp dword [esi + 0x38], 1
je 0x5e0def
xor ebx, ebx
jmp 0x5e0df4
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x5e0d90
cmp eax, 1
je 0x5e0d90
mov esi, dword [esi + 0x38]
mov eax, esi
dec eax
neg eax
sbb eax, eax
pop edi
and eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebx
ret
pop esi
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x5e1200
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, ebx
test esi, esi
je 0x5e13fe
cmp word [esi + 0x5c], 0x72
jne 0x5e13fe
mov eax, dword [esi + 0x38]
cmp eax, 0xfffffffd
je 0x5e13f6
cmp eax, 0xffffffff
je 0x5e13f6
cmp eax, 1
jne 0x5e1242
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x10], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebp
test ebp, ebp
je 0x5e135d
lea esp, [esp]
cmp dword [esi + 0x58], 0
jne 0x5e137e
cmp dword [esi + 4], 0
jne 0x5e12bf
cmp dword [esi + 0x3c], 0
jne 0x5e12bf
call fcn.00625984
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call fcn.0062515c
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x5e12ba
mov edx, dword [esi + 0x40]
push edx
mov dword [esi + 0x3c], 1
call fcn.00628440
add esp, 4
test eax, eax
jne 0x5e13ea
mov eax, dword [esi + 0x44]
mov dword [esi], eax
push 0
push esi
call fcn.005e2c20
add esp, 8
mov dword [esi + 0x38], eax
cmp eax, 1
jne 0x5e133a
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x4c]
sub ecx, edi
push ecx
push edi
push edx
call fcn.005df870
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x24], eax
add esp, 0xc
mov eax, esi
call fcn.005e0e80
cmp eax, dword [esi + 0x4c]
jne 0x5e1352
mov eax, esi
call fcn.005e0e80
mov eax, esi
call fcn.005e0b20
cmp dword [esi + 0x38], 0
jne 0x5e1359
mov edi, dword [esi + 8]
mov ebx, dword [esi + 0x14]
push esi
call fcn.005e2a80
push 0
push 0
push 0
mov dword [esi + 8], edi
mov dword [esi + 0x14], ebx
call fcn.005df870
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
add esp, 0x10
mov dword [esi + 0x4c], eax
cmp dword [esi + 0x38], 0
jne 0x5e135d
cmp dword [esi + 0x3c], 0
jne 0x5e135d
cmp dword [esi + 0x10], 0
jne 0x5e1260
jmp 0x5e135d
mov dword [esi + 0x38], 0xfffffffd
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x4c]
sub eax, edi
push eax
push edi
push ecx
call fcn.005df870
add esp, 0xc
mov dword [esi + 0x4c], eax
mov eax, ebp
sub eax, dword [esi + 0x10]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
mov edi, dword [esi + 4]
mov eax, dword [esi + 0x10]
cmp edi, eax
jbe 0x5e138a
mov edi, eax
test edi, edi
jbe 0x5e13b0
mov ecx, dword [esi]
mov edx, dword [esi + 0xc]
push edi
push ecx
push edx
call fcn.00621d10
add dword [esi], edi
sub dword [esi + 0x10], edi
lea eax, [edi + ebx]
add esp, 0xc
sub dword [esi + 4], edi
mov dword [esp + 0x10], eax
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x10]
test eax, eax
jbe 0x5e13ce
mov ecx, dword [esi + 0x40]
mov edx, dword [esp + 0x10]
push ecx
push eax
push 1
push edx
call fcn.0062515c
add esp, 0x10
sub dword [esi + 0x10], eax
sub ebp, dword [esi + 0x10]
add dword [esi + 8], ebp
add dword [esi + 0x14], ebp
test ebp, ebp
jne 0x5e13e2
mov dword [esi + 0x3c], 1
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
mov dword [esi + 0x38], 0xffffffff
jmp 0x5e135d
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
pop ecx
ret
Function at 0x5e51b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push 1
lea eax, [esp + 0xb]
push 1
push eax
call fcn.0062515c
add esp, 0x10
cmp eax, 1
jne 0x5e51d7
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 8]
mov dword [edx], ecx
xor eax, eax
pop ecx
ret
push esi
call fcn.00628440
add esp, 4
neg eax
sbb eax, eax
pop ecx
ret

Function at 0x5e52c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, dword [esp + 0x18]
push 2
push 0
mov ebp, 0xffff
push esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 0
call fcn.006272f2
add esp, 0xc
test eax, eax
je 0x5e52f3
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
push edi
push esi
call fcn.006271fa
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
cmp edi, ebp
jae 0x5e530d
mov dword [esp + 0xc], edi
mov ebp, eax
push 0x404
call fcn.0062279f
mov esi, eax
add esp, 4
test esi, esi
jne 0x5e5327
pop edi
pop esi
pop ebp
add esp, 0xc
ret
push ebx
mov ebx, 4
cmp ebp, ebx
jbe 0x5e53d4
jmp 0x5e5348
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
lea eax, [ebx + 0x400]
mov ebx, ebp
cmp eax, ebp
ja 0x5e5356
mov ebx, eax
mov ebp, edi
sub ebp, ebx
mov eax, edi
sub eax, ebp
mov edi, 0x404
cmp eax, 0x404
ja 0x5e536c
mov edi, eax
mov eax, dword [esp + 0x20]
push 0
push ebp
push eax
call fcn.006272f2
add esp, 0xc
test eax, eax
jne 0x5e53d4
mov ecx, dword [esp + 0x20]
push ecx
push 1
push edi
push esi
call fcn.0062515c
add esp, 0x10
cmp eax, 1
jne 0x5e53d4
lea eax, [edi - 3]
test eax, eax
jle 0x5e53ca
lea ecx, [ecx]
dec eax
cmp byte [eax + esi], 0x50
jne 0x5e53bc
cmp byte [eax + esi + 1], 0x4b
jne 0x5e53bc
cmp byte [eax + esi + 2], 5
jne 0x5e53bc
cmp byte [eax + esi + 3], 6
je 0x5e53c2
test eax, eax
jg 0x5e53a0
jmp 0x5e53ca
add eax, ebp
mov dword [esp + 0x14], eax
jne 0x5e53d4
cmp ebx, dword [esp + 0x10]
jb 0x5e5340
push esi
call fcn.006216ac
mov eax, dword [esp + 0x18]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x5e59e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], 0
test eax, eax
jne 0x5e5a03
mov eax, 0xffffff9a
add esp, 8
ret
push esi
mov esi, dword [eax + 0x7c]
test esi, esi
jne 0x5e5a13
lea eax, [esi - 0x66]
pop esi
add esp, 8
ret
cmp dword [esi], 0
jne 0x5e5a22
mov eax, 0xffffff9c
pop esi
add esp, 8
ret
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x5e5a31
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x14], ecx
cmp ecx, eax
jbe 0x5e5a45
mov dword [esi + 0x14], eax
cmp dword [esi + 0x14], 0
push ebx
push ebp
push edi
jbe 0x5e5b5d
cmp dword [esi + 8], 0
jne 0x5e5ab8
mov eax, dword [esi + 0x58]
test eax, eax
jbe 0x5e5ab8
mov edi, 0x4000
cmp eax, edi
jae 0x5e5a72
mov edi, eax
test edi, edi
je 0x5e5b69
mov ecx, dword [esi + 0x68]
add ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x60]
push 0
push ecx
push edx
call fcn.006272f2
add esp, 0xc
test eax, eax
jne 0x5e5b73
mov eax, dword [esi + 0x60]
mov ecx, dword [esi]
push eax
push 1
push edi
push ecx
call fcn.0062515c
add esp, 0x10
cmp eax, 1
jne 0x5e5b73
mov edx, dword [esi]
add dword [esi + 0x3c], edi
sub dword [esi + 0x58], edi
mov dword [esi + 4], edx
mov dword [esi + 8], edi
cmp dword [esi + 0x64], 0
jne 0x5e5b0d
mov eax, dword [esi + 0x14]
mov edi, dword [esi + 8]
cmp eax, edi
jae 0x5e5aca
mov edi, eax
xor eax, eax
test edi, edi
jbe 0x5e5ae1
mov ecx, dword [esi + 4]
mov cl, byte [eax + ecx]
mov edx, dword [esi + 0x10]
mov byte [eax + edx], cl
inc eax
cmp eax, edi
jb 0x5e5ad0
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x50]
push edi
push edx
push eax
call fcn.005df870
sub dword [esi + 0x5c], edi
sub dword [esi + 8], edi
sub dword [esi + 0x14], edi
add dword [esi + 0x10], edi
add dword [esi + 4], edi
add dword [esi + 0x18], edi
add esp, 0xc
add dword [esp + 0x10], edi
mov dword [esi + 0x50], eax
jmp 0x5e5b4c
mov ebx, dword [esi + 0x18]
mov ebp, dword [esi + 0x10]
lea ecx, [esi + 4]
push 2
push ecx
call fcn.005e2c20
mov edi, dword [esi + 0x18]
mov edx, dword [esi + 0x50]
sub edi, ebx
push edi
push ebp
push edx
mov dword [esp + 0x28], eax
call fcn.005df870
sub dword [esi + 0x5c], edi
add dword [esp + 0x24], edi
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x28]
add esp, 0x14
cmp eax, 1
je 0x5e5b5d
test eax, eax
jne 0x5e5b7e
cmp dword [esi + 0x14], 0
ja 0x5e5a52
cmp dword [esp + 0x14], 0
jne 0x5e5b7e
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 8
ret
pop edi
pop ebp
pop ebx
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
Function at 0x5e6110
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5e6156
mov edx, dword [edi + 4]
mov eax, dword [edi + 0xc]
push 0
lea ecx, [esp + 0x10]
push ecx
add edx, edx
add edx, edx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret 4

Function at 0x5e6160
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5e6181
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
push ebp
push 0
push 0
push 4
push 0
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
mov dword [esp + 0x18], ebp
cmp ebp, 0xffffffff
jne 0x5e61ae
pop ebp
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
push ebx
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
xor ebx, ebx
cmp edi, 0xffffffff
jne 0x5e61e5
test ebx, ebx
jne 0x5e61e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x5e61e5
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
mov ecx, dword [esp + 0x10]
push 1
push 0
push 0
push ecx
call fcn.00624ab0
add edi, eax
adc ebx, edx
mov edx, edi
or edx, ebx
je 0x5e6269
push 0
push 4
push ebx
push edi
call fcn.00624150
mov ebp, eax
cmp ebp, dword [esi + 8]
jl 0x5e6243
mov eax, dword [esi + 0xc]
push eax
call fcn.005f4432
xor ecx, ecx
lea eax, [ebp + 0x2710]
mov dword [esi + 8], eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005f4427
add esp, 8
mov dword [esi + 0xc], eax
test eax, eax
je 0x5e61d9
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x18]
push eax
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5e61d9
mov dword [esi + 4], ebp
mov ebp, dword [esp + 0x1c]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop ebp
pop edi
mov eax, 1
pop esi
add esp, 8
ret 4
Function at 0x5e6460
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5e6481
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
push ebp
push 0
push 0
push 4
push 0
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
mov dword [esp + 0x18], ebp
cmp ebp, 0xffffffff
jne 0x5e64ae
pop ebp
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
push ebx
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
xor ebx, ebx
cmp edi, 0xffffffff
jne 0x5e64e5
test ebx, ebx
jne 0x5e64e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x5e64e5
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
mov ecx, dword [esp + 0x10]
push 1
push 0
push 0
push ecx
call fcn.00624ab0
add edi, eax
adc ebx, edx
mov edx, edi
or edx, ebx
je 0x5e6569
push 0
push 0x10
push ebx
push edi
call fcn.00624150
mov ebp, eax
cmp ebp, dword [esi + 8]
jl 0x5e6543
mov eax, dword [esi + 0xc]
push eax
call fcn.005f4432
xor ecx, ecx
lea eax, [ebp + 0x2710]
mov dword [esi + 8], eax
mov edx, 0x10
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005f4427
add esp, 8
mov dword [esi + 0xc], eax
test eax, eax
je 0x5e64d9
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x18]
push eax
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5e64d9
mov dword [esi + 4], ebp
mov ebp, dword [esp + 0x1c]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop ebp
pop edi
mov eax, 1
pop esi
add esp, 8
ret 4

Function at 0x5e66d0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5e6715
mov edx, dword [edi + 4]
mov eax, dword [edi + 0xc]
push 0
lea ecx, [esp + 0x10]
push ecx
shl edx, 4
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret 4

Function at 0x5e6840
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5e6888
mov edx, dword [edi + 4]
mov eax, dword [edi + 0xc]
push 0
add edx, edx
lea ecx, [esp + 0x10]
push ecx
add edx, edx
add edx, edx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret 4