joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59a490
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebp, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
test ebp, ebp
mov eax, ebp
jle 0x59a4cf
mov ebx, ebp
jmp 0x59a4ba
je 0x59a4d7
sub ebx, eax
add esi, eax
test ebx, ebx
jle 0x59a4e3
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll__read_1
cmp eax, 0
jge 0x59a4b0
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
mov eax, ebp
sub eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x59a930
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x2c
mov eax, dword [0x8519b4]
test eax, eax
je 0x59a960
mov dword [0x85f758], 0xffffffff
mov dword [0x85f75c], 0xffffffff
call fcn.00599e10
call fcn.0059a9f0
add esp, 0x2c
ret
mov dword [esp], 0
call fcn.005d7030
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call fcn.005d6a20
mov eax, dword [esp + 0x18]
mov dword [esp], 0x73251a
mov dword [0x85f758], eax
mov eax, dword [esp + 0x1c]
mov dword [0x85f75c], eax
call fcn.004518c0
test eax, eax
js 0x59a9b2
mov dword [esp], str.EMACS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x59a9bc
mov dword [0x85f758], 0xffffffff
mov eax, dword [0x8663b4]
mov dword [esp], eax
call fcn.0059ebf0
test eax, eax
jne 0x59a950
mov dword [0x85f758], 0xffffffff
call fcn.00599e10
call fcn.0059a9f0
add esp, 0x2c
ret
Function at 0x5b0f50
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x54]
test eax, eax
je 0x5b0f68
cmp byte [eax], 0
jne 0x5b1068
mov edx, dword [esp + 0x50]
mov dword [esp + 4], 0x7371cf
mov dword [esp], edx
call sub.msvcrt.dll_fopen
mov edi, eax
xor eax, eax
test edi, edi
je 0x5b1038
mov dword [esp], edi
xor ebx, ebx
mov esi, 0x1000
call fcn.0059a030
mov dword [esp], 0x1000
mov dword [esp + 0x1c], eax
call fcn.005c2e50
mov dword [esp], fcn.0059c460
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.0048e4f0
mov eax, dword [esp + 0x2c]
jmp 0x5b0fe9
mov dword [esp], edi
add ebx, ebp
call sub.msvcrt.dll_feof
test eax, eax
jne 0x5b1040
mov eax, dword [esp + 0x2c]
add esi, esi
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.005c2e80
mov dword [esp + 0x2c], eax
lea edx, [esi - 1]
add eax, ebx
sub edx, ebx
mov dword [esp + 8], edx
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp], edi
mov ebp, eax
call sub.msvcrt.dll_ferror
test eax, eax
je 0x5b0fc5
mov edx, dword [esp + 0x50]
mov dword [esp], str.Read_error_from___s_
mov dword [esp + 4], edx
call fcn.0059b580
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.0048e650
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.0048e670
mov eax, dword [esp + 0x2c]
mov byte [eax + ebx], 0
mov eax, dword [esp + 0x2c]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x50]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x7371cd
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.00641f40
test eax, eax
mov ebx, eax
je 0x5b10ad
mov dword [esp + 4], 0x7371cf
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [esp], ebx
mov edi, eax
call fcn.005c2f40
jmp 0x5b0f7e
mov dword [esp], 0
call fcn.0059c410
lea esi, [esi]
Function at 0x5c6c30
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ebp
test ebx, ebx
je 0x5c6db1
cmp byte [ebx], 0x7e
jne 0x5c6d23
movzx eax, byte [ebx + 1]
cmp al, 0x2f
jne 0x5c6c93
mov dword [esp], 0x740ac8
call fcn.005d7380
test eax, eax
je 0x5c6d99
mov edx, ebx
mov esi, dword [esp + 0x30]
mov ecx, 1
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
jmp fcn.005c6b90
test al, al
je 0x5c6c60
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [esp], eax
call fcn.005c2e50
mov esi, eax
movzx eax, byte [ebx + 1]
cmp al, 0x2f
je 0x5c6da5
test al, al
je 0x5c6da5
mov edx, 1
mov ebp, 1
jmp 0x5c6cd4
test al, al
je 0x5c6ce5
add ebp, 1
mov byte [esi + edx - 1], al
movzx eax, byte [ebx + ebp]
mov edx, ebp
cmp al, 0x2f
jne 0x5c6cd0
lea eax, [ebp - 1]
mov byte [esi + eax], 0
mov eax, dword [0x8606c8]
test eax, eax
je 0x5c6d56
mov dword [esp], esi
call eax
test eax, eax
mov edi, eax
je 0x5c6d56
mov ecx, ebp
mov edx, ebx
call fcn.005c6b90
mov dword [esp], esi
mov dword [esp + 0x1c], eax
call fcn.005d73b0
mov dword [esp], edi
call fcn.005d73b0
mov eax, dword [esp + 0x1c]
jmp 0x5c6d42
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
add eax, 1
mov dword [esp], eax
call fcn.005c2e50
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
ret
mov eax, dword [0x8606c4]
test eax, eax
je 0x5c6db5
mov dword [esp], esi
call eax
test eax, eax
mov edi, eax
je 0x5c6db5
mov ecx, ebp
mov edx, ebx
call fcn.005c6b90
mov dword [esp], edi
mov dword [esp + 0x1c], eax
call fcn.005d73b0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x5c6db5
mov dword [esp + 0x1c], eax
mov dword [esp], esi
call fcn.005d73b0
mov eax, dword [esp + 0x1c]
jmp 0x5c6d42
call fcn.005d7390
nop
jmp 0x5c6c74
xor eax, eax
mov ebp, 1
jmp 0x5c6ce8
xor eax, eax
jmp 0x5c6d42
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
add eax, 1
mov dword [esp], eax
call fcn.005c2e50
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
jmp 0x5c6d87
Function at 0x5caec0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x1c
mov eax, dword [0x860818]
test eax, eax
je 0x5caf52
mov eax, dword [0x8607c0]
mov dword [0x867228], 0
mov dword [0x867294], 0
mov dword [0x867290], 0
mov byte [eax], 0
mov dword [0x86080c], eax
and dword [0x860800], 0xfeffffff
mov dword [0x867220], 0
call fcn.005d30a0
call fcn.005d4110
mov eax, dword [0x6a98b8]
mov dword [0x8607fc], 0
mov byte [0x8607b4], 0
test eax, eax
jne 0x5caf38
call fcn.005d9a50
mov dword [esp + 4], 1
mov dword [esp], 1
call fcn.005d35e0
xor eax, eax
add esp, 0x1c
ret
mov edx, dword [0x8607f8]
or dword [0x860800], 1
test edx, edx
je 0x5cb080
mov eax, dword [0x8607f4]
test eax, eax
je 0x5cb091
mov ecx, dword [0x8607c0]
mov dword [0x86728c], edx
mov dword [0x867298], eax
test ecx, ecx
je 0x5cb0e0
mov eax, dword [0x8607d0]
test eax, eax
je 0x5cb0c4
mov dword [esp], eax
call fcn.005d6ae0
mov edx, dword [0x6a989c]
test edx, edx
jne 0x5cb050
call fcn.005db6f0
call fcn.005db7e0
mov dword [esp], 0
call fcn.005d0bb0
mov eax, dword [0x8607cc]
test eax, eax
jne 0x5cb030
call fcn.005d0d20
mov eax, 0x6ab9a0
call fcn.005ca150
mov eax, 0x6aa140
call fcn.005ca150
cmp byte [0x6aa218], 1
je 0x5cb0a3
mov eax, 0x6a9920
call fcn.005ca150
mov eax, dword [0x6a98f8]
test eax, eax
jne 0x5cb062
mov eax, dword [0x8606f4]
test eax, eax
je 0x5cb070
mov eax, dword [0x860800]
add dword [0x860818], 1
and eax, 0xfffffffe
or eax, 2
mov dword [0x860800], eax
jmp 0x5caed0
mov eax, dword [0x6a98fc]
test eax, eax
je 0x5cafcf
mov eax, dword [0x8672e8]
sub dword [0x8672d0], 1
sub dword [0x8672c8], eax
jmp 0x5cafcf
mov eax, dword [0x6a98bc]
mov dword [esp], eax
call fcn.005d8ae0
jmp 0x5cafb0
call fcn.005d71b0
jmp 0x5cb008
mov eax, dword [str.__t_n________]
mov dword [0x8606f4], eax
jmp 0x5cb011
mov edx, dword [sym.imp.msvcrt.dll__iob]
mov dword [0x8607f8], edx
jmp 0x5caf67
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [0x8607f4], eax
jmp 0x5caf74
mov dword [esp + 8], 0x6aa140
mov dword [esp + 4], 0
mov dword [esp], 0x740b9e
call fcn.005cf9f0
jmp 0x5caff5
mov dword [esp], 0x740b99
call fcn.005d7380
mov dword [0x8607d0], eax
jmp 0x5caf9a
mov dword [0x8607bc], 0x100
mov dword [esp], 0x100
call fcn.005c2e50
mov dword [0x8607c0], eax
jmp 0x5caf8d
Function at 0x5d08c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, edx
push edi
push esi
xor esi, esi
push ebx
mov ebx, eax
sub esp, 0x5c
mov dword [esp], eax
mov dword [0x8608d8], edx
mov dword [0x8608d4], eax
call fcn.005c6de0
mov edi, eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__stati64]
test eax, eax
js 0x5d098f
mov dword [esp + 8], 0x1b6
mov dword [esp + 4], 0
mov dword [esp], edi
call sub.msvcrt.dll__open_1
test eax, eax
mov edx, eax
js 0x5d098f
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
test eax, eax
jne 0x5d0ad7
lea eax, [ecx + 1]
cmp ecx, eax
ja 0x5d0ad7
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.005c2e50
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 8], ecx
mov dword [esp], edx
mov esi, eax
mov dword [esp + 4], eax
call sub.msvcrt.dll__read_1
mov edx, dword [esp + 0x18]
mov dword [esp], edx
mov dword [esp + 0x14], eax
call sub.msvcrt.dll__close_1
mov ecx, dword [esp + 0x14]
test ecx, ecx
js 0x5d0b19
mov eax, dword [0x860aec]
test eax, eax
jne 0x5d0af2
mov dword [esp + 0x1c], ecx
mov byte [esi + ecx], 0
mov dword [esp], edi
call fcn.005d73b0
mov eax, dword [0x860aec]
test eax, eax
jne 0x5d0ac5
test esi, esi
je 0x5d0b0c
test ebp, ebp
je 0x5d0a79
mov ebp, dword [esp + 0x1c]
mov edi, esi
mov dword [0x8608dc], 1
mov dword [0x8608e0], 1
add ebp, esi
cmp ebp, esi
jbe 0x5d0a30
xor ebx, ebx
cmp ebp, edi
mov edx, ebp
je 0x5d09fa
cmp byte [edi], 0xa
mov edx, edi
lea eax, [edi + 1]
jne 0x5d09f1
jmp 0x5d09fa
add eax, 1
cmp byte [eax - 1], 0xa
je 0x5d09fa
add ebx, 1
cmp eax, ebp
mov edx, eax
jne 0x5d09e8
mov byte [edx], 0
movzx eax, byte [edi]
test al, al
je 0x5d0a21
cmp al, 0x20
je 0x5d0a14
jmp 0x5d0abb
cmp al, 9
jne 0x5d0a50
add edi, 1
sub ebx, 1
movzx eax, byte [edi]
test al, al
jne 0x5d0a10
lea edi, [edi + ebx + 1]
add dword [0x8608e0], 1
cmp ebp, edi
ja 0x5d09d4
mov dword [esp], esi
call fcn.005d73b0
xor eax, eax
mov dword [0x8608dc], 0
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp al, 0x20
je 0x5d0a14
cmp al, 0x23
je 0x5d0a21
test al, al
je 0x5d0a21
mov dword [esp], edi
lea edi, [edi + ebx + 1]
call fcn.005d0160
add dword [0x8608e0], 1
cmp ebp, edi
ja 0x5d09d4
jmp 0x5d0a30
mov eax, dword [0x8608d0]
cmp ebx, eax
je 0x5d09b4
test eax, eax
je 0x5d0a92
mov dword [esp], eax
call fcn.006a4590
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
add eax, 1
mov dword [esp], eax
call fcn.005c2e50
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [0x8608d0], eax
jmp 0x5d09b4
cmp al, 9
je 0x5d0a14
jmp 0x5d0a54
mov eax, dword [0x860aec]
mov dword [esp], eax
call fcn.005d7760
jmp 0x5d09a4
mov dword [esp], edx
xor esi, esi
call sub.msvcrt.dll__close_1
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0x1b
jmp 0x5d098f
mov eax, dword [0x860aec]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.005d7760
mov ecx, dword [esp + 0x14]
jmp 0x5d0987
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
jmp 0x5d0a44
mov dword [esp], esi
xor esi, esi
call fcn.005d73b0
jmp 0x5d098f
Function at 0x5d0bb0
Capabilities:
Query environment variable
Read file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x5d0be6
cmp byte [eax], 0
jne 0x5d0bd5
xor edx, edx
mov eax, str._.inputrc
call fcn.005d08c0
test eax, eax
je 0x5d0be0
mov eax, str._etc_inputrc
xor edx, edx
add esp, 0x1c
jmp fcn.005d08c0
xor eax, eax
add esp, 0x1c
ret
mov eax, dword [0x8608d0]
test eax, eax
jne 0x5d0bbb
mov dword [esp], str.INPUTRC
call fcn.005d7380
test eax, eax
je 0x5d0bc0
jmp 0x5d0bbb
Function at 0x5d5eb0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x1c
test eax, eax
mov dword [esp + 0x10], ebx
mov ebx, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
je 0x5d5f00
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 1
mov dword [esp], eax
call fcn.005c2e50
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
test eax, eax
mov ebx, eax
je 0x5d5f00
mov eax, ebx
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
add esp, 0x1c
ret
mov dword [esp], str.HOME
xor ebx, ebx
call fcn.005d7380
test eax, eax
mov esi, eax
je 0x5d5eea
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edi, eax
lea eax, [eax + 0xa]
mov dword [esp], eax
call fcn.005c2e50
mov dword [esp + 4], esi
mov ebx, eax
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
lea eax, [ebx + edi + 1]
mov byte [ebx + edi], 0x2f
mov dword [eax], 0x7369682e
mov dword [eax + 4], 0x79726f74
mov byte [eax + 8], 0
jmp 0x5d5eea
Function at 0x5d6800
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, 0xffffffff
push ebx
mov ebx, 0xffffffff
sub esp, 0x30
mov edi, dword [esp + 0x44]
mov dword [esp], 0xfffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 4
cmp eax, 0xffffffff
je 0x5d6845
lea edx, [esp + 0x1a]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
sub esp, 8
test eax, eax
jne 0x5d68c5
test edi, edi
jne 0x5d6856
mov eax, dword [0x860a88]
test eax, eax
jne 0x5d68e0
test ebx, ebx
mov eax, esi
mov dword [0x8672d0], ebx
mov dword [0x8672e8], esi
jle 0x5d6a07
test eax, eax
jle 0x5d6930
cmp dword [0x8672d0], 1
jle 0x5d6980
test eax, eax
jle 0x5d6968
mov edx, dword [0x8672d0]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.005d7300
mov edx, dword [0x6a98fc]
mov eax, dword [0x8672d0]
test edx, edx
jne 0x5d68b2
sub eax, 1
mov dword [0x8672d0], eax
imul eax, dword [0x8672e8]
mov dword [0x8672c8], eax
add esp, 0x30
pop ebx
pop esi
pop edi
ret
movsx esi, word [esp + 0x2a]
movsx eax, word [esp + 0x26]
movsx ebx, word [esp + 0x1a]
sub esi, eax
add esi, 1
jmp 0x5d6845
mov dword [0x8672e8], 0xffffffff
mov dword [0x8672d0], 0xffffffff
mov dword [esp], str.COLUMNS
call fcn.005d7380
test eax, eax
je 0x5d69f2
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [0x8672d0], eax
test eax, eax
jle 0x5d69c0
mov eax, dword [0x8672e8]
test eax, eax
jg 0x5d6874
lea esi, [esi]
test edi, edi
je 0x5d6990
test esi, esi
mov eax, esi
mov dword [0x8672e8], esi
jg 0x5d6874
mov ecx, dword [0x860a8c]
test ecx, ecx
je 0x5d6874
mov dword [esp], 0x741811
call fcn.004518c0
mov dword [0x8672e8], eax
jmp 0x5d6874
mov dword [0x8672e8], 0x18
mov eax, 0x18
jmp 0x5d6889
mov dword [0x8672d0], 0x50
jmp 0x5d6881
mov dword [esp], str.LINES
call fcn.005d7380
test eax, eax
je 0x5d6a00
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [0x8672e8], eax
test eax, eax
jg 0x5d6874
jmp 0x5d6934
test ebx, ebx
mov dword [0x8672d0], ebx
jg 0x5d691d
mov ebx, dword [0x860a8c]
test ebx, ebx
je 0x5d691d
mov dword [esp], 0x741808
call fcn.004518c0
mov dword [0x8672d0], eax
jmp 0x5d691d
mov eax, dword [0x8672d0]
jmp 0x5d6915
mov eax, dword [0x8672e8]
jmp 0x5d69ad
test edi, edi
je 0x5d68f4
mov dword [0x8672d0], ebx
jmp 0x5d69ce
Function at 0x5d7060
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [0x867298]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
add esp, 0x1c
ret

Function at 0x5d7b00
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0xa
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.readline:
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
add esp, 0x18
pop ebx
ret

Function at 0x5db7e0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
sub esp, 0x14
mov dword [esp], str.LC_ALL
call fcn.005d7380
test eax, eax
je 0x5db854
cmp byte [eax], 0
je 0x5db854
mov dword [esp + 4], eax
mov dword [esp], 2
call sub.msvcrt.dll_setlocale
xor edx, edx
test eax, eax
je 0x5db84c
movzx ecx, byte [eax]
test cl, cl
je 0x5db84c
cmp cl, 0x43
je 0x5db8a5
cmp cl, 0x50
je 0x5db8b1
mov dword [0x8607a8], 1
mov edx, 1
mov dword [0x6a98a0], 0
mov dword [0x8607b0], 1
add esp, 0x14
mov eax, edx
pop esi
pop edi
ret
mov dword [esp], str.LC_CTYPE
call fcn.005d7380
test eax, eax
je 0x5db869
cmp byte [eax], 0
jne 0x5db7fa
mov dword [esp], str.LANG
call fcn.005d7380
test eax, eax
je 0x5db882
cmp byte [eax], 0
jne 0x5db7fa
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.msvcrt.dll_setlocale
mov edx, 0x7426a0
test eax, eax
cmove eax, edx
jmp 0x5db7fa
cmp byte [eax + 1], 0
jne 0x5db829
jmp 0x5db84c
mov edi, str.POSIX
mov ecx, 6
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x5db829
jmp 0x5db84c
Function at 0x60fc40
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
test eax, eax
je 0x60fc96
mov edi, str.default
mov ecx, 8
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x60fca6
test ebx, ebx
je 0x60fc76
and byte [ebx + 0xb4], 0xfd
call fcn.0060fb40
test eax, eax
je 0x60fc86
test ebx, ebx
je 0x60fc86
mov dword [ebx + 8], eax
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x1c
ret
mov dword [esp], str.GNUTARGET
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x60fc5b
mov eax, dword [0x6acc24]
test eax, eax
je 0x60fcd0
test ebx, ebx
je 0x60fc86
or byte [ebx + 0xb4], 2
mov esi, dword [esp + 0x14]
mov dword [ebx + 8], eax
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
add esp, 0x1c
ret
mov eax, dword [0x6acc2c]
mov eax, dword [eax]
jmp 0x60fcaf
Function at 0x611100
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
mov edi, dword [esp + 0x40]
movzx edx, byte [esi]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x4c]
test edx, edx
mov dword [esp + 0x18], ebp
lea ebp, [esi + 1]
je 0x611149
nop
lea esi, [esi]
add eax, edx
shl edx, 0x11
add edx, eax
mov eax, edx
shr eax, 2
xor eax, edx
movzx edx, byte [ebp]
add ebp, 1
test edx, edx
jne 0x611130
sub ebp, esi
sub ebp, 1
mov edx, ebp
add eax, ebp
shl edx, 0x11
add eax, edx
xor edx, edx
mov ebx, eax
shr ebx, 2
xor ebx, eax
mov eax, ebx
div dword [edi + 0xc]
mov eax, dword [edi]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x6111b8
mov dword [esp + 0x1c], edi
mov edi, esi
mov esi, ebx
mov ebx, edx
jmp 0x611186
mov ebx, dword [ebx]
test ebx, ebx
je 0x6111b0
cmp dword [ebx + 8], esi
jne 0x611180
mov dword [esp + 4], edi
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x611180
mov edx, ebx
add esp, 0x2c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, esi
mov esi, edi
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x61125e
mov eax, dword [esp + 0x18]
test eax, eax
je 0x611212
mov edx, ebp
mov ecx, dword [edi + 8]
mov eax, 8
add edx, 1
jne 0x611230
mov ebp, dword [ecx + 4]
cmp ebp, eax
mov dword [esp + 0x18], ebp
jae 0x611243
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0065a4d0
mov edx, dword [esp + 0x10]
mov ebp, eax
test ebp, ebp
je 0x611265
mov dword [esp + 4], esi
mov esi, ebp
mov dword [esp + 8], edx
mov dword [esp], ebp
call sub.msvcrt.dll_memcpy
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], edi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00610f10
lea eax, [ebp + 8]
and eax, 0xfffffff8
je 0x6111e6
mov ebp, dword [ecx + 4]
cmp ebp, eax
mov dword [esp + 0x18], ebp
jb 0x6111e6
mov ebp, dword [ecx]
add ebp, eax
mov dword [esp + 0x14], ebp
mov dword [ecx], ebp
mov ebp, dword [esp + 0x18]
sub ebp, eax
mov dword [ecx + 4], ebp
mov ebp, dword [esp + 0x14]
sub ebp, eax
jmp 0x6111fc
xor edx, edx
jmp 0x6111a0
mov dword [esp], 6
call fcn.005e6110
xor edx, edx
jmp 0x6111a0
Function at 0x64f610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3c
cmp dword [ecx], 0x2f
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ebp
je 0x64f640
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
jmp fcn.0064ad50
mov edx, dword [ecx + 4]
mov edi, dword [edx + 8]
mov ebp, dword [edx + 4]
test edi, edi
je 0x64f6c2
mov edx, dword [eax + 0x100]
xor ebx, ebx
jmp 0x64f672
mov esi, edx
add edx, 1
add ebx, 1
cmp edi, ebx
mov byte [eax + esi], cl
mov dword [eax + 0x100], edx
mov byte [eax + 0x104], cl
je 0x64f6c2
cmp edx, 0xff
movzx ecx, byte [ebp + ebx]
jne 0x64f657
mov edx, dword [eax + 0x10c]
xor esi, esi
mov byte [eax + 0xff], 0
mov dword [esp], eax
mov dword [esp + 0x18], eax
mov dword [esp + 8], edx
mov byte [esp + 0x1c], cl
mov dword [esp + 4], 0xff
call dword [eax + 0x108]
mov eax, dword [esp + 0x18]
mov edx, 1
movzx ecx, byte [esp + 0x1c]
add dword [eax + 0x120], 1
jmp 0x64f65c
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
ret

Function at 0x64f6e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x24], ebx
mov ebx, eax
mov eax, dword [ecx]
mov dword [esp + 0x28], esi
cmp eax, 0x2e
je 0x64f6f9
cmp eax, 1
ja 0x64f710
mov eax, ebx
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
add esp, 0x2c
jmp fcn.0064ad50
cmp eax, 6
je 0x64f6f9
mov eax, dword [ebx + 0x100]
cmp eax, 0xff
lea esi, [eax + 1]
je 0x64f7a2
mov byte [ebx + eax], 0x28
mov eax, ebx
mov dword [ebx + 0x100], esi
mov byte [ebx + 0x104], 0x28
call fcn.0064ad50
mov eax, dword [ebx + 0x100]
cmp eax, 0xff
lea edx, [eax + 1]
je 0x64f770
mov byte [ebx + eax], 0x29
mov esi, dword [esp + 0x28]
mov dword [ebx + 0x100], edx
mov byte [ebx + 0x104], 0x29
mov ebx, dword [esp + 0x24]
add esp, 0x2c
ret
mov eax, dword [ebx + 0x10c]
mov byte [ebx + 0xff], 0
mov dword [esp + 4], 0xff
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [ebx + 0x108]
mov edx, 1
xor eax, eax
add dword [ebx + 0x120], 1
jmp 0x64f74d
mov eax, dword [ebx + 0x10c]
mov esi, 1
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov byte [ebx + 0xff], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0xff
mov dword [esp], ebx
call dword [ebx + 0x108]
xor eax, eax
mov ecx, dword [esp + 0x18]
add dword [ebx + 0x120], 1
mov edx, dword [esp + 0x1c]
jmp 0x64f725
Function at 0x6590f0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [esp + 4], 1
jmp fcn.00658c70