joyce8/EMBER2024-capa huggingface dataset:
Function at 0x571b80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov eax, 0xcccccccc
mov dword [esp], eax
push dword [ebp + 0xc]
call sym.X86RunHoudini.exe_ConvertToWin32KeyCode
pop ecx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp ax, 0
jge 0x571bb2
mov eax, 1
leave
ret
mov eax, 0
leave
ret

Function at 0x571d20
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
sub esp, 0x78
push ecx
lea edi, [esp + 4]
mov eax, 0xcccccccc
mov ecx, 0x1e
rep stosd dword es:[edi], eax
pop ecx
push dword [ebp + 0xc]
call fcn.00571bc0
pop ecx
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x571d56
mov eax, dword [ebp - 0x70]
lea esp, [ebp - 8]
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0xc], 0
push dword [ebp + 0xc]
call sym.X86RunHoudini.exe_ConvertToWin32KeyCode
pop ecx
mov dword [ebp - 0x74], eax
push 0
movsx eax, word [ebp - 0x74]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 0x78], eax
shl dword [ebp - 0x78], 0x10
call fcn.0056d3b0
cmp al, 0
je 0x571db8
lea edi, [ebp - 0x4c]
mov eax, 0
mov ecx, 0x10
rep stosd dword es:[edi], eax
push 0x20
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
mov dword [ebp - 0x7c], eax
push dword [ebp - 0x7c]
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xc]
call fcn.0058a000
jmp 0x571df9
lea edi, [ebp - 0x6c]
mov eax, 0
mov ecx, 8
rep stosd dword es:[edi], eax
push 0x20
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
mov dword [ebp - 0x80], eax
push dword [ebp - 0x80]
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0xc]
call fcn.00589f70
call fcn.00546dd0
cmp dword [ebp - 0xc], 0
je 0x571df9
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x10], eax
lea ecx, [ebp - 0xc]
call fcn.0058a350
mov ebx, eax
cmp dword [ebp - 0xc], 0
je 0x571e11
mov ecx, dword [ebp - 0xc]
call fcn.00589d70
mov eax, ebx
lea esp, [ebp - 8]
pop edi
pop ebx
pop ebp
ret
Function at 0x583490
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
movzx ebx, word [edx + 0x14]
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
add edx, 0x18
add ebx, edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], 0
jmp 0x58356f
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x10], 0
jne 0x583524
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jle 0x583568
push 4
push 0x1000
push dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add edx, dword [eax + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
push dword [ebp - 0xc]
push 0
push dword [ebp - 0x14]
call fcn.0058ec80
add esp, 0xc
jmp 0x583568
push 4
push 0x1000
mov eax, dword [ebp - 0x18]
push dword [eax + 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add edx, dword [eax + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
push dword [eax + 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
add edx, dword [eax + 0x14]
push edx
push dword [ebp - 0x14]
call fcn.0058ec40
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
inc dword [ebp - 8]
add dword [ebp - 0x18], 0x28
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
movzx edx, word [edx + 6]
cmp dword [ebp - 8], edx
jl 0x5834d4
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x583590
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 8
rep stosd dword es:[edi], eax
pop edi
pop ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
movzx ebx, word [edx + 0x14]
mov eax, dword [ebp + 8]
mov edx, dword [eax]
add edx, 0x18
add ebx, edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0
jmp 0x5836c2
mov eax, dword [ebp - 0x10]
test dword [eax + 0x24], 0x20000000
setne dl
movzx edx, dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
test dword [eax + 0x24], 0x40000000
setne dl
movzx edx, dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
test dword [eax + 0x24], 0x80000000
setne dl
movzx edx, dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x10]
test dword [eax + 0x24], 0x2000000
je 0x58362e
push 0x4000
mov eax, dword [ebp - 0x10]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x10]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x5836bb
mov edx, dword [ebp - 0x1c]
lea edx, [edx + edx]
add edx, dword [ebp - 0x20]
lea edx, [edx + edx]
add edx, dword [ebp - 0x24]
mov eax, dword [edx*4 + 0x639370]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
test dword [eax + 0x24], 0x4000000
je 0x58365a
or dword [ebp - 0x14], 0x200
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x583699
mov eax, dword [ebp - 0x10]
test dword [eax + 0x24], 0x40
je 0x583682
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
mov dword [ebp - 0x18], eax
jmp 0x583699
mov eax, dword [ebp - 0x10]
test dword [eax + 0x24], 0x80
je 0x583699
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x5836bb
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
sete al
inc dword [ebp - 0xc]
add dword [ebp - 0x10], 0x28
mov eax, dword [ebp + 8]
mov edx, dword [eax]
movzx edx, word [edx + 6]
cmp dword [ebp - 0xc], edx
jl 0x5835cd
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x584360
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0xcccccccc
mov dword [esp], eax
mov dword [esp + 4], eax
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 2]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 0
jne 0x584393
mov eax, 0xffffffff
leave
ret
cmp dword [ebp - 8], 2
je 0x5843a0
mov eax, 0xffffffff
leave
ret
cmp word [ebp - 2], 0
je 0x5843ae
mov eax, 0xffffffff
leave
ret
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 2]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 0
jne 0x5843cf
mov eax, 0xffffffff
leave
ret
cmp dword [ebp - 8], 2
je 0x5843dc
mov eax, 0xffffffff
leave
ret
cmp word [ebp - 2], 1
je 0x5843ea
mov eax, 0xffffffff
leave
ret
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 2]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 0
jne 0x58440b
mov eax, 0xffffffff
leave
ret
cmp dword [ebp - 8], 2
je 0x584418
mov eax, 0xffffffff
leave
ret
movzx eax, word [ebp - 2]
leave
ret
Function at 0x58c710
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x666ec4]
sub esp, 0x104
test eax, eax
jle 0x58c72f
inc eax
mov dword [0x666ec4], eax
xor ax, ax
add esp, 0x104
ret
push esi
push str.QuickTime.qts
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x58c765
lea ecx, [esp + 4]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x58c765
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
jmp 0x58c7e4
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x58c7e4
push ebp
push edi
mov edi, 0x63df9c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.QuickTime.qts
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov esi, eax
pop ebp
test esi, esi
mov dword [0x666ec8], esi
jne 0x58c7fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xfffff7d3
jmp 0x58c87f
push str._CallComponentFunctionWithStorage
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
mov dword [0x63df4c], eax
je 0x58c87a
mov ecx, dword [0x666ec8]
push str._CallComponent
push ecx
call esi
test eax, eax
mov dword [0x63df48], eax
je 0x58c87a
mov edx, dword [0x666ec8]
push str.theQuickTimeDispatcher
push edx
call esi
test eax, eax
mov dword [0x63df44], eax
je 0x58c87a
mov eax, dword [esp + 0x10c]
mov dword [0x63df40], 0
push eax
call fcn.0058c590
mov esi, eax
add esp, 4
test si, si
jne 0x58c87f
mov eax, dword [0x666ec4]
inc eax
mov dword [0x666ec4], eax
mov ax, si
pop esi
add esp, 0x104
ret
mov esi, 0xfffff7d2
mov eax, dword [0x666ec8]
test eax, eax
je 0x58c899
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x666ec8], 0
mov eax, 0x58c5b0
mov dword [0x63df40], 0x58c8d0
mov dword [0x63df48], eax
mov dword [0x63df4c], eax
mov dword [0x63df44], eax
mov ax, si
pop esi
add esp, 0x104
ret
Function at 0x5915f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63f978
push 0x592860
push dword fs:[0]
mov dword fs:[0], esp
push eax
push ebx
sub esp, 0x48
mov dword [ebp - 0x14], esp
mov dword [ebp - 4], 0
push ebp
mov eax, 0xffffffff
push eax
push eax
push 0x592aa0
push dword fs:[0]
mov dword fs:[0], esp
sub esp, 0x20
and esp, 0xffffffe0
push 0x63eb08
call fcn.00592b10
pop ecx
call fcn.00592580
test eax, eax
jne 0x591659
push 0xffffffffffffffff
call fcn.00591120
pop ecx
push section..CRT
call fcn.00592f00
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
test ebx, ebx
je 0x591676
add ebx, dword [0x6691fc]
lea edx, [ebp - 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test dword [ebp - 0x34], 1
je 0x591690
movzx eax, word [ebp - 0x30]
jmp 0x591695
mov eax, 0xa
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00591120
pop ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x5916d4
lea esp, [ebp - 0x18]
pop ebx
pop ecx
pop dword fs:[0]
add esp, 0xc
pop ebp
ret
Function at 0x591990
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push dword [0x63eb18]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x591b75
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x591b70
push 0x1d0
call fcn.0058d4e0
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x5919d0
xor eax, eax
pop ebp
pop ebx
ret
mov ebp, 0x669150
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x667560]
mov dword [ebx], edx
mov dword [0x667560], ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebx + 4], 0
mov dword [ebx + 8], 1
mov dword [ebx + 0xc], 0x63eb1c
mov dword [ebx + 0x10], 0x63eb1c
mov eax, dword [esp + 0xc]
mov dword [ebx + 0x14], eax
lea edx, [ebx + 0x188]
mov dword [ebx + 0x180], 0x63eb20
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 1
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 1
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0xffffffff
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 1
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 1
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x184], 0
push 0x63f240
push edx
call fcn.0058d850
pop ecx
pop ecx
mov ecx, dword [0x63f270]
mov dword [ebx + 0x1b8], ecx
mov eax, dword [0x63f274]
mov dword [ebx + 0x1bc], eax
mov edx, dword [0x63f278]
mov dword [ebx + 0x1c0], edx
mov ecx, dword [0x63f27c]
mov dword [ebx + 0x1c4], ecx
mov eax, dword [0x63f280]
mov dword [ebx + 0x1c8], eax
xor edx, edx
mov ecx, dword [edx + 0x63f23c]
mov dword [edx + ebx + 0x184], ecx
mov ecx, dword [edx + 0x63f240]
mov dword [edx + ebx + 0x188], ecx
mov ecx, dword [edx + 0x63f244]
mov dword [edx + ebx + 0x18c], ecx
mov ecx, dword [edx + 0x63f248]
mov dword [edx + ebx + 0x190], ecx
add edx, 0x10
cmp edx, 0x40
jl 0x591af5
mov ecx, dword [0x63f27c]
mov dword [ebx + 0x1c4], ecx
mov ecx, dword [0x63f280]
mov dword [ebx + 0x1c8], ecx
mov dword [ebx + 0x17c], 0x63f164
mov dword [ebx + 0x1cc], 0
push ebx
push dword [0x63eb18]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop ebp
pop ebx
ret
xor eax, eax
pop ebp
pop ebx
ret
mov eax, 1
pop ebp
pop ebx
ret
Function at 0x592b50
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
sub esp, 4
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 0
mov edi, dword [0x63ef30]
jmp 0x592b77
mov edi, dword [edi + 8]
test edi, edi
je 0x592b84
mov esi, dword [edi]
mov eax, dword [ebp + 8]
cmp dword [esi], eax
ja 0x592b74
test edi, edi
jne 0x592b90
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
mov ebx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
xor edx, edx
cmp eax, 1
mov ecx, eax
je 0x592bcd
lea eax, [eax]
lea esi, [edx + ecx]
mov edi, dword [ebp + 8]
sar esi, 1
add edi, 0xffffffff
cmp dword [ebx + esi*8], edi
ja 0x592bc4
mov edx, esi
jmp 0x592bc6
mov ecx, esi
lea esi, [edx + 1]
cmp esi, ecx
jne 0x592bb0
mov edi, dword [ebp + 8]
add edi, 0xffffffff
cmp edi, dword [ebx + edx*8]
jb 0x592cc9
lea esi, [edx + 1]
cmp esi, eax
je 0x592bf3
mov ecx, dword [ebp + 8]
add ecx, 0xffffffff
cmp ecx, dword [ebx + edx*8 + 8]
jae 0x592cc9
mov esi, dword [ebx + edx*8 + 4]
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
movsx eax, byte [ecx]
test eax, 1
mov edi, esi
jne 0x592cbf
movzx eax, word [ecx + 5]
add edi, 7
xor esi, esi
test eax, eax
mov dword [ebp - 0x10], eax
jle 0x592cbf
mov ebx, dword [edi]
movzx ecx, byte [ebx]
cmp cl, 0xe8
je 0x592c34
cmp cl, 0xcc
jne 0x592c40
add ebx, 5
jmp case.default.0x592c78
cmp cl, 0xff
jne 0x592c90
movzx edx, byte [ebx + 1]
mov ecx, edx
sar ecx, 6
and edx, 7
add ebx, 2
cmp ecx, 3
je case.default.0x592c78
cmp edx, 4
jne 0x592c61
add ebx, 1
test ecx, ecx
jne 0x592c70
cmp edx, 5
jne 0x592c70
add ebx, 4
jmp case.default.0x592c78
lea eax, [ecx - 1]
cmp eax, 1
ja case.default.0x592c78
jmp dword [eax*4 + 0x597d0c]
add ebx, 1
jmp case.default.0x592c78
add ebx, 4
jmp case.default.0x592c78
call fcn.00593bc0
cmp ebx, dword [ebp + 8]
jne 0x592cb0
mov esi, dword [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], esi
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
add esi, 1
add edi, 8
cmp esi, dword [ebp - 0x10]
jl 0x592c25
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x592c7f
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
sub esp, 4
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 0
mov edi, dword [0x63ef30]
jmp 0x592b77
mov edi, dword [edi + 8]
test edi, edi
je 0x592b84
mov esi, dword [edi]
mov eax, dword [ebp + 8]
cmp dword [esi], eax
ja 0x592b74
test edi, edi
jne 0x592b90
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
mov ebx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
xor edx, edx
cmp eax, 1
mov ecx, eax
je 0x592bcd
lea eax, [eax]
lea esi, [edx + ecx]
mov edi, dword [ebp + 8]
sar esi, 1
add edi, 0xffffffff
cmp dword [ebx + esi*8], edi
ja 0x592bc4
mov edx, esi
jmp 0x592bc6
mov ecx, esi
lea esi, [edx + 1]
cmp esi, ecx
jne 0x592bb0
mov edi, dword [ebp + 8]
add edi, 0xffffffff
cmp edi, dword [ebx + edx*8]
jb 0x592cc9
lea esi, [edx + 1]
cmp esi, eax
je 0x592bf3
mov ecx, dword [ebp + 8]
add ecx, 0xffffffff
cmp ecx, dword [ebx + edx*8 + 8]
jae 0x592cc9
mov esi, dword [ebx + edx*8 + 4]
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
movsx eax, byte [ecx]
test eax, 1
mov edi, esi
jne 0x592cbf
movzx eax, word [ecx + 5]
add edi, 7
xor esi, esi
test eax, eax
mov dword [ebp - 0x10], eax
jle 0x592cbf
mov ebx, dword [edi]
movzx ecx, byte [ebx]
cmp cl, 0xe8
je 0x592c34
cmp cl, 0xcc
jne 0x592c40
add ebx, 5
jmp case.default.0x592c78
cmp cl, 0xff
jne 0x592c90
movzx edx, byte [ebx + 1]
mov ecx, edx
sar ecx, 6
and edx, 7
add ebx, 2
cmp ecx, 3
je case.default.0x592c78
cmp edx, 4
jne 0x592c61
add ebx, 1
test ecx, ecx
jne 0x592c70
cmp edx, 5
jne 0x592c70
add ebx, 4
jmp case.default.0x592c78
lea eax, [ecx - 1]
cmp eax, 1
ja case.default.0x592c78
jmp dword [eax*4 + 0x597d0c]
add ebx, 1
jmp case.default.0x592c78
add ebx, 4
jmp case.default.0x592c78
call fcn.00593bc0
cmp ebx, dword [ebp + 8]
jne 0x592cb0
mov esi, dword [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], esi
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
add esi, 1
add edi, 8
cmp esi, dword [ebp - 0x10]
jl 0x592c25
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x593040
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x14c
or ecx, 0xffffffff
mov edx, dword [0x66921c]
mov ebx, dword [0x669218]
mov esi, dword [edx + ebx*4 - 4]
mov edi, esi
repne scasb al, byte es:[edi]
mov edi, 0xfffffffe
sub edi, ecx
add edi, esi
jmp 0x593073
sub edi, 1
cmp edi, esi
jbe 0x59308c
movsx edx, byte [edi - 1]
push edx
push 0x63efd8
call fcn.0058d930
pop ecx
test eax, eax
pop ecx
je 0x593070
lea ecx, [ebp - 0x150]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x154], eax
je 0x593145
mov dword [ebp - 0x10], edi
sub dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
lea ebx, [ebp - 0x124]
mov dword [ebp - 0x158], eax
mov eax, eax
xor eax, eax
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
mov edx, 0xfffffffe
sub edx, ecx
add edx, dword [ebp - 0x158]
add edx, 1
push edx
call fcn.0058d4e0
mov edi, eax
pop ecx
push esi
push edi
call fcn.0058d850
pop ecx
pop ecx
push ebx
mov ecx, edi
add ecx, dword [ebp - 0x10]
push ecx
call fcn.0058d850
pop ecx
pop ecx
call fcn.00592ff0
test eax, eax
je 0x593139
mov eax, dword [0x66921c]
mov edx, dword [0x669218]
lea ecx, [ebp - 0x150]
mov dword [eax + edx*4 - 4], edi
push ecx
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x593139
mov edx, dword [0x669218]
add dword [0x669218], 1
test edx, edx
jne 0x5930c0
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x593150
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 8
mov dword [0x668788], 1
push 4
mov dword [0x669218], 0
call fcn.0058d4e0
mov dword [0x66921c], eax
test eax, eax
pop ecx
mov dword [0x6691fc], 0
jne 0x593195
call fcn.00592fd0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x14], eax
mov esi, eax
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
mov edx, 0xfffffffe
sub edx, ecx
add edx, 1
push edx
call fcn.0058d4e0
mov ebx, eax
test ebx, ebx
pop ecx
mov dword [0x668780], eax
jne 0x5931d5
call fcn.00592fd0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
add esi, 1
movsx eax, byte [esi]
push eax
push 0x63efdc
call fcn.0058d930
pop ecx
test eax, eax
pop ecx
jne 0x5931d2
cmp byte [esi], 0
je 0x59336c
call fcn.00592ff0
test eax, eax
je 0x59336c
cmp dword [0x669218], 1
mov dword [ebp - 0x10], 0
jne 0x59321a
mov ecx, esi
sub ecx, dword [ebp - 0x14]
mov dword [0x6691fc], ecx
mov edx, dword [0x66921c]
mov eax, dword [0x669218]
mov dword [edx + eax*4], ebx
add dword [0x669218], 1
movzx ecx, byte [esi]
xor edi, edi
test cl, cl
je 0x593358
lea eax, [eax]
test edi, edi
jne 0x593296
movsx ecx, cl
push ecx
push 0x63efe4
call fcn.0058d930
pop ecx
test eax, eax
pop ecx
je 0x593281
add esi, 1
movzx ecx, byte [esi]
test cl, cl
je 0x593276
movsx edx, cl
push edx
push str.__t_r_n_v
call fcn.0058d930
pop ecx
test eax, eax
pop ecx
jne 0x593258
mov byte [ebx], 0
add ebx, 1
jmp 0x593358
movzx ecx, byte [esi]
cmp cl, 0x22
jne 0x5932c0
add esi, 1
mov edi, 1
jmp 0x59334d
cmp cl, 0x22
jne 0x5932b0
cmp byte [esi + 1], 0x22
jne 0x5932b0
mov byte [ebx], 0x22
add ebx, 1
add esi, 2
jmp 0x59334d
cmp cl, 0x22
jne 0x5932c0
add esi, 1
xor edi, edi
jmp 0x59334d
cmp cl, 0x5c
jne 0x593314
cmp byte [esi + 1], 0x5c
jne 0x593314
cmp byte [esi + 2], 0x5c
mov eax, 2
jne 0x5932df
add eax, 1
cmp byte [esi + eax], 0x5c
je 0x5932d6
cmp byte [esi + eax], 0x22
jne 0x59330d
and eax, 0xfffffffe
je 0x59334d
lea eax, [eax]
movzx ecx, byte [esi]
mov byte [ebx], cl
add ebx, 1
add esi, 2
sub eax, 2
jne 0x5932f0
jmp 0x59334d
movzx edx, byte [esi]
mov byte [ebx], dl
add esi, 1
add ebx, 1
sub eax, 1
jae 0x593302
jmp 0x59334d
cmp cl, 0x5c
jne 0x593330
cmp byte [esi + 1], 0x22
jne 0x593330
mov byte [ebx], 0x22
add ebx, 1
add esi, 2
jmp 0x59334d
test edi, edi
jne 0x593345
cmp cl, 0x2a
je 0x59333e
cmp cl, 0x3f
jne 0x593345
mov dword [ebp - 0x10], 1
mov byte [ebx], cl
add esi, 1
add ebx, 1
movzx ecx, byte [esi]
test cl, cl
jne 0x593240
cmp dword [ebp - 0x10], 0
je 0x593363
call fcn.00593040
cmp byte [esi], 0
jne 0x5931f2
mov byte [ebx], 0
cmp dword [0x669218], 1
jne 0x593382
mov eax, esi
sub eax, dword [ebp - 0x14]
mov dword [0x6691fc], eax
mov ecx, dword [0x66921c]
mov edx, dword [0x669218]
mov dword [ecx + edx*4], 0
push 0x592f90
call fcn.005910f0
pop ecx
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret