joyce8/EMBER2024-capa huggingface dataset:
Function at 0x565ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x11c]
test eax, eax
jle 0x565ea7
mov edx, dword [edx + 0x118]
mov esi, eax
cmp dword [edx + esi*4 - 4], 0
je 0x565e69
lea edi, [esi - 1]
shl edi, 5
mov esi, dword [edx + esi*4 - 4]
xor edx, edx
test esi, esi
setne dl
mov dword [ebp - 0x18], edx
mov edx, esi
shr edx, 0x10
cmp esi, 0x10000
cmovb edx, esi
mov ebx, 0
setae bl
shl ebx, 4
mov dword [ebp - 0x14], ebx
mov esi, edx
shr esi, 8
xor ebx, ebx
cmp edx, 0x100
cmovb esi, edx
setae bl
mov dword [ebp - 0x10], ebx
mov edx, esi
shr edx, 4
xor ebx, ebx
cmp esi, 0x10
cmovb edx, esi
setae bl
mov dword [ebp - 0x1c], ebx
mov esi, edx
shr esi, 2
xor ebx, ebx
cmp edx, 4
cmovb esi, edx
setae bl
mov edx, dword [ebp - 0x18]
or edx, edi
add edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
lea edx, [edx + edi*8]
mov edi, dword [ebp - 0x1c]
lea edx, [edx + edi*4]
lea edx, [edx + ebx*2]
cmp esi, 2
sbb edx, 0xffffffff
add edx, 7
shr edx, 3
cmp edx, ecx
jne 0x565e7e
lea edx, [eax*4]
cmp edx, ecx
jb 0x565ea2
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
cmp ecx, 4
jb 0x565dd2
mov esi, dword [edi + ecx - 4]
add ecx, 0xfffffffc
bswap esi
mov dword [edx], esi
add edx, 4
dec eax
cmp ecx, 3
ja 0x565dbe
test ecx, ecx
je 0x565df3
xor esi, esi
xor edi, edi
mov ebx, edi
shl ebx, 8
mov edi, dword [ebp + 0x10]
movzx edi, byte [edi + esi]
or edi, ebx
inc esi
cmp ecx, esi
jne 0x565dda
mov dword [edx], edi
add edx, 4
dec eax
shl eax, 2
test eax, eax
jne 0x565eb6
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x11c]
mov dword [ebp - 0x10], 0x14b
test ecx, ecx
je 0x565e85
mov eax, dword [eax + 0x118]
mov dword [ebp - 0x14], eax
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + ebx*4]
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + ebx*4]
mov ecx, esi
xor ecx, edi
mov eax, esi
sub eax, edi
lea edi, [ecx - 1]
xor eax, esi
or eax, ecx
not ecx
and edi, ecx
mov ecx, dword [ebp - 0x18]
xor eax, esi
sar edi, 0x1f
sar eax, 0x1f
or eax, 1
xor edx, eax
and edx, edi
xor edx, eax
inc ebx
cmp ecx, ebx
jne 0x565e22
test edx, edx
jns 0x565e85
xor eax, eax
inc eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [esi - 1]
cmp esi, 1
mov esi, edi
jg 0x565d05
xor edx, edx
jmp 0x565d9c
mov dword [ebp - 0x10], 0x144
push dword [ebp - 0x10]
push str....._third_party_boringssl_srccrypto_fipsmoduleec_simple.c
push 0x80
push 0
push 0xf
call fcn.006baa70
add esp, 0x14
xor eax, eax
jmp 0x565e61
call fcn.005dae09
je 0x565e77
mov edx, dword [edx + 0x118]
mov esi, eax
jmp 0x565d10
push eax
push 0
push edx
call fcn.005c9b00
add esp, 0xc
jmp 0x565dfe
Function at 0x568cd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x568ce8
cmp dword [ebp + 0x10], 0
jne 0x568ce4
call fcn.0057fed0
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00568790
Function at 0x56a260
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 0xc]
movsx edx, byte [esi + 0xb]
mov eax, esi
test edx, edx
jns 0x56a27b
mov edx, dword [esi + 4]
mov eax, dword [esi]
test edx, edx
js 0x56a5ef
sete bl
test eax, eax
setne bh
or bh, bl
je 0x56a5ef
mov ebx, edx
cmp edx, 4
jb switch.0x0056a2c0
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ebx, ebx, 0x5bd1e995
xor ebx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja case.default.0x56a2c0
jmp dword [edx*4 + 0x790908]
movzx edx, byte [eax + 1]
shl edx, 8
xor ebx, edx
movzx eax, byte [eax]
xor eax, ebx
imul ebx, eax, 0x5bd1e995
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ebx, edx
jmp case.0x56a2c0.2

Function at 0x5703c0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00543760

Function at 0x5703d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
js 0x5703df
pop ebp
jmp fcn.00543bc0
call fcn.00645550
xor eax, eax
pop ebp
ret
Function at 0x577960
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00577e60
add esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
call fcn.00578dd0
test eax, eax
je 0x57798d
mov ecx, eax
call fcn.00578de0
mov ebx, dword [0x81a82c]
cmp ebx, 1
jbe 0x577b4c
push ebx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x577ace
mov edi, dword [0x81a834]
xor esi, esi
test edi, edi
je 0x577a9f
mov eax, dword [0x81a82c]
cmp eax, 1
mov dword [ebp - 0x10], ebx
jbe 0x577b0f
mov esi, dword [edi + 4]
test esi, esi
je 0x577ac7
imul eax, dword [ebp - 0x18], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0xde8f4ca8
imul ecx, dword [ebp - 0x14], 0x5bd1e995
mov edx, ecx
shr edx, 0x18
xor edx, ecx
imul ecx, edx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, ecx
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul ebx, edx, 0x1010101
shr ebx, 0x18
cmp ebx, 1
jbe 0x577ada
mov edx, ecx
cmp ecx, esi
jb 0x577a6b
mov eax, ecx
xor edx, edx
div esi
mov eax, dword [edi]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x577ac7
mov edi, dword [eax]
test edi, edi
je 0x577ac7
cmp ebx, 2
mov dword [ebp - 0x1c], edx
jb 0x577af2
mov ebx, dword [ebp - 0x10]
mov eax, dword [edi + 4]
cmp ecx, eax
jne 0x577ab0
mov eax, dword [edi + 8]
xor eax, dword [ebp - 0x18]
mov edx, dword [edi + 0xc]
xor edx, dword [ebp - 0x14]
or edx, eax
jne 0x577abf
mov esi, dword [edi + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
cmp eax, esi
jb 0x577aba
xor edx, edx
div esi
mov eax, edx
cmp eax, dword [ebp - 0x1c]
jne 0x577aca
mov edi, dword [edi]
test edi, edi
jne 0x577a85
jmp 0x577aca
mov ebx, dword [ebp - 0x10]
xor esi, esi
jmp 0x577a9f
mov ecx, ebx
call fcn.0054c5e0
jmp 0x5779ab
lea edx, [esi - 1]
and edx, ecx
jmp 0x577a6b
and eax, esi
cmp eax, edx
jne 0x577aca
mov edi, dword [edi]
test edi, edi
mov edx, dword [ebp - 0x1c]
jne 0x577af6
jmp 0x577aca
dec esi
mov ebx, dword [ebp - 0x10]
mov eax, dword [edi + 4]
cmp ecx, eax
jne 0x577ae1
mov eax, dword [edi + 8]
xor eax, dword [ebp - 0x18]
mov edx, dword [edi + 0xc]
xor edx, dword [ebp - 0x14]
or edx, eax
je 0x577a9c
jmp 0x577ae7
push 0x81a82c
call fcn.004dc660
add esp, 4
test al, al
je 0x577b99
xor esi, esi
mov dword [0x81a830], esi
mov ebx, 0x81a82c
mov ecx, 0x81a830
call fcn.0054c5d0
push ebx
push esi
push 0x81a830
push ebx
call fcn.004dc730
add esp, 0x10
jmp 0x5779cc
push 0x81a82c
call fcn.004dc660
add esp, 4
test al, al
je 0x577b8e
xor esi, esi
mov dword [0x81a830], esi
mov edi, 0x81a82c
mov ebx, 0x81a830
mov ecx, 0x81a830
call fcn.0054c5d0
push edi
push esi
push 0x81a830
push edi
call fcn.004dc730
add esp, 0x10
jmp 0x57799c
mov ebx, dword [0x81a82c]
jmp 0x57799c
mov eax, dword [0x81a82c]
jmp 0x5779cc
Function at 0x57f960
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x4eff60
lea eax, [ebp - 0x14]
push 0
push eax
push 0x4efdb0
push 0x81c300
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x57f9da
xor esi, esi
cmp dword [0x81c304], 0
jne 0x57f9c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x81c308]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x57f9c6
mov eax, dword [ebp + 8]
mov esi, dword [edi + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005dae09
int3
Function at 0x5802c0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx + 0xb]
mov eax, ecx
test edx, edx
jns 0x5802dd
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
test edx, edx
js 0x5805c9
sete cl
test eax, eax
setne ch
or ch, cl
je 0x5805c9
mov ecx, edx
cmp edx, 4
jb switch.0x00580322
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja case.default.0x580322
jmp dword [edx*4 + 0x798f3c]
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
jmp case.0x580322.2
Function at 0x5811e0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov eax, esi
mov dword [ebp - 0x18], ecx
mov edx, esi
mov dword [ebp - 0x14], esi
cmp esi, 4
jb switch.0x00581230
mov eax, dword [ebp - 0x14]
mov edx, eax
mov ecx, dword [ebp - 0x18]
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x58120a
jmp dword [edx*4 + 0x799038]
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov edi, dword [ebx + 4]
xor ecx, ecx
test edi, edi
je 0x58134c
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov esi, eax
shr esi, 0xf
xor esi, eax
mov edx, edi
shr edx, 1
and edx, 0x55555555
mov eax, edi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x20], eax
cmp eax, 1
jbe 0x581360
mov edx, esi
cmp esi, edi
jb 0x5812ba
mov eax, esi
xor edx, edx
div edi
mov eax, dword [ebx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x58134c
mov ebx, dword [eax]
test ebx, ebx
je 0x58134c
mov dword [ebp - 0x10], edx
lea eax, [edi - 1]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 4]
cmp eax, esi
jne 0x5812f8
movsx ecx, byte [ebx + 0x13]
test ecx, ecx
js 0x58131c
lea eax, [ebx + 8]
jmp 0x581322
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
jmp case.0x581230.2
cmp dword [ebp - 0x20], 1
mov ecx, dword [ebp - 0x10]
jbe 0x58135b
cmp eax, edi
jb 0x58130b
xor edx, edx
div edi
mov eax, edx
mov ecx, dword [ebp - 0x10]
cmp eax, ecx
jne 0x581318
mov ebx, dword [ebx]
test ebx, ebx
jne 0x5812d6
xor ecx, ecx
jmp 0x58134c
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
test ecx, ecx
js 0x58136a
sete dl
test eax, eax
setne dh
or dh, dl
je 0x58136a
mov edx, dword [ebp - 0x14]
cmp edx, ecx
jne 0x581312
push edx
push eax
push dword [ebp - 0x18]
call fcn.005c7efd
add esp, 0xc
test eax, eax
jne 0x581312
mov ecx, ebx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
and eax, dword [ebp - 0x1c]
jmp 0x58130e
lea edx, [edi - 1]
and edx, esi
jmp 0x5812ba
ud2
Function at 0x586040
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x200c
call fcn.005c6f70
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x80d0e4]
cmp eax, 0xffffffff
jne 0x58608b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
add esp, 0x200c
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
push dword [ebp - 0x2018]
call fcn.00515a40
add esp, 8
jmp 0x586064
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x586064
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.005c9580
add esp, 0xc
mov ecx, dword [0x80d0e4]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x2018], ecx
push ecx
call fcn.00515a40
add esp, 8
test ebx, ebx
je 0x5860da
push ebx
call fcn.005c57fc
add esp, 4
mov esi, 0x101
lea edi, [ebp - 0x2010]
mov eax, dword [0x81eda8]
mov ecx, dword [0x80d580]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x586231
mov ebx, dword [0x81eda4]
push ebx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x586293
push 0x1000
push 0x81dda0
lea eax, [ebp - 0x1810]
push eax
call fcn.005c9580
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0x800
push 0xff
push edi
call fcn.005c9b00
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x1804]
nop word cs:[eax + eax]
mov edx, dword [ecx]
mov dword [ebp + eax*8 - 0x2010], edx
mov word [ebp + eax*8 - 0x200c], ax
inc eax
add ecx, 0x10
cmp eax, 0x100
jne 0x586160
mov ecx, edi
lea edx, [ebp - 0x1810]
push 1
push 0x10
call fcn.005862d0
add esp, 8
mov ebx, 4
xor eax, eax
nop word [eax + eax]
movzx edx, word [ebp + ebx - 0x2010]
mov edi, dword [ebp + edx*8 - 0x810]
test edi, edi
jne 0x5861d8
add ebx, 8
cmp ebx, 0x804
jne 0x5861a0
dec esi
je 0x58627c
test al, 1
lea edi, [ebp - 0x2010]
jne 0x5860e5
jmp 0x586079
mov dword [ebp - 0x2014], eax
mov eax, esi
mov ecx, edx
shl ecx, 4
cmp dword [ebp + ecx - 0x1810], 0
je 0x586286
add ecx, ebp
add ecx, 0xffffe7f0
mov esi, dword [ebp + edx*8 - 0x80c]
cmp esi, dword [ecx + 8]
jne 0x586286
mov ecx, dword [ecx + 4]
test ecx, ecx
mov esi, eax
mov eax, dword [ebp - 0x2014]
je 0x5861b3
mov dword [ebp + edx*8 - 0x810], 0
call dword [0x8010bc]
push edi
call ecx
add esp, 4
mov al, 1
jmp 0x5861b3
push 0x81eda8
call fcn.005c580d
add esp, 4
cmp dword [0x81eda8], 0xffffffff
jne 0x586106
push 4
call fcn.005c5789
add esp, 4
mov ebx, eax
mov dword [eax], 0
mov ecx, eax
call fcn.0054c5d0
mov dword [0x81eda4], ebx
push 0x81eda8
call fcn.005c5887
add esp, 4
jmp 0x586106
call fcn.00645550
jmp 0x586079
mov esi, eax
mov eax, dword [ebp - 0x2014]
jmp 0x5861b3
mov ecx, ebx
call fcn.0054c5e0
jmp 0x58611b
Function at 0x59f240
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x118]
inc esi
cmp esi, 3
mov eax, 2
cmovae eax, esi
lea ecx, [edi + 0x120]
mov dword [edi + 0x120], 0x3020100
dec eax
mov ebx, 0x7060504
xor esi, esi
mov dword [edi + esi*4 + 0x124], ebx
add ebx, 0x4040404
inc esi
cmp eax, esi
jne 0x59f279
test edx, edx
je 0x59f2e1
lea eax, [edi + 0x11f]
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov dword [ebp - 0x14], edx
xor esi, esi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + ebx]
mov edx, dword [ebp - 0x10]
mov al, byte [edx + edi]
mov byte [ecx + ebx], al
mov ecx, dword [ebp - 0x18]
mov byte [ecx], al
lea eax, [edi + 1]
push eax
push ecx
push edx
call fcn.005c9580
add esp, 0xc
or esi, edi
inc ebx
cmp dword [ebp - 0x14], ebx
jne 0x59f2a2
shr esi, 2
mov edi, dword [ebp + 8]
mov dword [edi + 0x118], esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x59f2d3

Function at 0x5a2130
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [esp + 8], eax
mov byte [ecx], 0
mov eax, dword [0x80d580]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
lea ecx, [eax + 0x168]
mov dword [esi + 4], ecx
mov edx, dword [eax + 0x168]
mov dword [eax + 0x168], esi
mov ecx, dword [ebp + 8]
mov dword [esi + 8], edx
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi + 0x30], 0
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x38], eax
mov eax, dword [0x788e74]
movzx eax, byte [eax + 0x80]
test al, al
setne byte [esi + 0x20]
jne 0x5a21c9
mov ecx, dword [esp + 8]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea edi, [esi + 0x10]
mov ebx, esp
push ebx
call fcn.005897b0
movsd xmm0, qword [ebx]
movsd qword [edi], xmm0
jmp 0x5a21b2
Function at 0x5c6419
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5c6458
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5c6458
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5c6458
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x5c6458
cmp dword [ecx + 0x74], 0xe
jbe 0x5c6458
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x5d4dd7
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.005d4f6e
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x5d4f46
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x5d4f46
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x5d4efb
jg 0x5d4e33
test eax, eax
je 0x5d4ef1
push 1
push 0x1000
call fcn.004bfce0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x5d4e56
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x5d4ee8
push 0x8000
push ebx
call fcn.005daecc
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x5d4e7f
jg 0x5d4e7a
cmp ecx, 0x1000
jb 0x5d4e7f
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.005de5ad
add esp, 0x10
cmp eax, 0xffffffff
je 0x5d4ec4
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x5d4e7a
jl 0x5d4eab
test ecx, ecx
jne 0x5d4e6c
push dword [ebp - 0xc]
push ebx
call fcn.005daecc
push esi
call fcn.004bfb50
add esp, 0xc
xor ebx, ebx
jmp 0x5d4f54
cmp byte [edi + 0x24], 0
je 0x5d4edb
cmp dword [edi + 0x20], 5
jne 0x5d4edb
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x5d4ee6
mov ebx, dword [edi + 0x18]
jmp 0x5d4ee8
xor ebx, ebx
push esi
call fcn.004bfb50
pop ecx
jmp 0x5d4f54
test ecx, ecx
jg 0x5d4ebd
jl 0x5d4efb
test eax, eax
jae 0x5d4ebd
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005ee29d
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x5d4f1b
cmp byte [edi + 0x1c], 0
je 0x5d4ebd
jmp 0x5d4f4c
push ebx
call fcn.005d905a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x5d4ebd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x5d4f54
cmp byte [edi + 0x1c], 0
je 0x5d4f51
mov ebx, dword [edi + 0x18]
jmp 0x5d4f54
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.005ee29d
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5d8497
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x769510
push esi
call fcn.005ef1df
pop ecx
pop ecx
test eax, eax
jne 0x5d84c5
xor al, al
jmp 0x5d8542
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.005d8226
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x5d84ff
push dword [ebp - 0x210]
call fcn.004bfb50
xor al, al
jmp 0x5d8540
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x5d8505
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x5d8525
push edx
call fcn.005d83e9
pop ecx
test al, al
je 0x5d84f0
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x5d8533
mov bl, 1
push dword [ebp - 0x210]
call fcn.004bfb50
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005c6b46
leave
ret
Function at 0x5d89d4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.005c6f70
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.005d7e3d
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x5d8a16
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x5d8b72
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.005f2060
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x80e030]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.005ee2fb
mov ecx, dword [esi*4 + 0x80e030]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x5d8b6b
cmp eax, dword [ecx + edi + 0x24]
jne 0x5d8b6b
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5d8b6b
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005ee2fb
add esp, 0x14
test edx, edx
jl 0x5d8b6b
jg 0x5d8ae1
test eax, eax
jb 0x5d8b6b
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x5d8b6b
jl 0x5d8afb
cmp dword [ebp - 0x1008], eax
ja 0x5d8b6b
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x5d8b19
test ebx, ebx
je 0x5d8b52
cmp ecx, edi
jae 0x5d8b52
mov al, byte [ecx]
cmp al, 0xd
jne 0x5d8b33
lea eax, [edi - 1]
cmp ecx, eax
jae 0x5d8b3f
cmp byte [ecx + 1], 0xa
jne 0x5d8b3f
inc ecx
jmp 0x5d8b3f
movzx eax, al
movsx eax, byte [eax + 0x8082f0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x5d8b19
cmp edx, ebx
jne 0x5d8b19
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x5d8b70
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005c6b46
leave
ret