joyce8/EMBER2024-capa huggingface dataset:
Function at 0x503969
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x34]
push edi
mov ebx, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov ecx, dword [ebp + 8]
mov edi, eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0xc]
add eax, dword [ecx]
mov ecx, dword [edi + 4]
mov dword [ebp - 8], eax
xor eax, eax
test byte [ebx + 0x134], 1
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], ecx
jne 0x5039d1
cmp dword [ebp + 0x10], eax
je 0x5039d1
push eax
push eax
call sub.msvcrt.dll__controlfp
push 0x30000
push 0
mov dword [ebx + 0x130], eax
call sub.msvcrt.dll__controlfp
add esp, 0x10
or dword [ebx + 0x134], 1
xor edx, edx
cmp dword [esi + 0x38], edx
je 0x503ab3
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [edi + 0x10]
add ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + 0x14]
add ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [edi + 0x18]
add ecx, eax
cmp word [esi + 0x4a], dx
mov dword [ebp - 0x10], ecx
mov dword [ebp + 0xc], edx
jbe 0x503aa2
movzx eax, word [ebp + 0xc]
mov ecx, dword [esi + 0x30]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 8]
mov edx, dword [edx]
cmp edx, dword [ebx + 0x34]
jbe 0x503a8f
mov eax, dword [eax + 8]
movzx edx, word [eax + 4]
sub edx, 0
je 0x503a6d
dec edx
je 0x503a49
dec edx
jne 0x503a8f
push 0xffffffffffffffff
lea edx, [ebp + 0x10]
push edx
movzx edx, word [eax + 8]
push eax
movzx eax, word [eax + 6]
shl eax, 5
add eax, dword [ebp - 0xc]
jmp 0x503a5e
push 0xffffffffffffffff
lea edx, [ebp + 0x10]
push edx
movzx edx, word [eax + 8]
push eax
movzx eax, word [eax + 6]
shl eax, 5
add eax, dword [ebp - 0x10]
push dword [esi + 0x38]
push edx
push eax
push ecx
mov ecx, ebx
call fcn.00502981
jmp 0x503a8f
push 0xffffffffffffffff
lea edx, [ebp + 0x10]
push edx
movzx edx, word [eax + 8]
push eax
push dword [esi + 0x38]
movzx eax, word [eax + 6]
push edx
mov edx, dword [ebp - 0x14]
lea eax, [edx + eax*8]
push eax
push ecx
mov ecx, ebx
call fcn.00502d1f
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [esi + 0x4a]
jb 0x503a06
xor edx, edx
mov eax, dword [edi + 0x10]
mov ecx, dword [ebp + 8]
add eax, dword [ecx]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 8]
mov dword [ebp + 0xc], eax
push dword [ebp - 4]
lea eax, [ebp - 0x1c]
push dword [ebp - 4]
push dword [ebp - 4]
push edx
push dword [ebp + 0xc]
push edx
push dword [ebp - 8]
push dword [ebp - 8]
push dword [ebp - 8]
push edx
push dword [ebp - 0xc]
push eax
push dword [esi + 0x40]
push dword [esi + 0x3c]
call fcn.004e8943
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x576d79
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x576dc4
mov esi, dword [ebp + 0x10]
and dword [ebp - 4], 0
sub esi, edi
cmp esi, 0x400000
jbe 0x576d9e
mov esi, 0x400000
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push esi
add eax, edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x576dcc
cmp dword [ebp - 4], esi
jne 0x576dcc
add edi, esi
cmp edi, dword [ebp + 0x10]
jne 0x576d88
xor eax, eax
pop edi
pop esi
leave
ret 0xc
mov eax, 0x80004005
jmp 0x576dc6

Function at 0x576dd8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x576e29
mov esi, dword [ebp + 0x10]
and dword [ebp - 4], 0
sub esi, edi
cmp esi, 0x400000
jbe 0x576dfd
mov esi, 0x400000
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push esi
add eax, edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x576e31
cmp dword [ebp - 4], 0
je 0x576e31
cmp dword [ebp - 4], esi
jne 0x576e31
add edi, esi
cmp edi, dword [ebp + 0x10]
jne 0x576de7
xor eax, eax
pop edi
pop esi
leave
ret 0xc
mov eax, 0x80004005
jmp 0x576e2b
Function at 0x57705b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov dword [ebp - 4], ebx
je 0x577170
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x577170
push ebx
push 0x8000080
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x5770a8
mov eax, 0x80004005
jmp 0x577175
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x18]
mov dword [ebp - 8], eax
push edi
and dword [ebp + 0xc], 0
push 0x18
pop edi
sub edi, ebx
mov eax, 0x400000
cmp edi, eax
jbe 0x5770f3
mov edi, eax
push 0
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp + ebx - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x577169
cmp dword [ebp + 0xc], edi
jne 0x577169
add ebx, edi
cmp ebx, 0x18
jne 0x5770df
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x1c]
push 0
push esi
call dword [eax + 0x28]
mov edi, eax
test edi, edi
jl 0x57714f
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
shl eax, 2
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00576d79
mov edi, eax
test edi, edi
jl 0x57714f
xor edi, edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x577164
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov eax, edi
pop edi
jmp 0x577175
mov edi, 0x80004005
jmp 0x57714f
mov eax, 0x8876086c
pop esi
pop ebx
leave
ret 8
Function at 0x577180
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
mov dword [ebp - 4], ebx
je 0x577295
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x577295
push ebx
push 0x8000080
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x5771cd
mov eax, 0x80004005
jmp 0x57729a
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x18]
mov dword [ebp - 8], eax
push edi
and dword [ebp + 0xc], 0
push 0x18
pop edi
sub edi, ebx
mov eax, 0x400000
cmp edi, eax
jbe 0x577218
mov edi, eax
push 0
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp + ebx - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x57728e
cmp dword [ebp + 0xc], edi
jne 0x57728e
add ebx, edi
cmp ebx, 0x18
jne 0x577204
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x1c]
push 0
push esi
call dword [eax + 0x28]
mov edi, eax
test edi, edi
jl 0x577274
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
shl eax, 2
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00576d79
mov edi, eax
test edi, edi
jl 0x577274
xor edi, edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x577289
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov eax, edi
pop edi
jmp 0x57729a
mov edi, 0x80004005
jmp 0x577274
mov eax, 0x8876086c
pop esi
pop ebx
leave
ret 8
Function at 0x577cba
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
je 0x577e3c
cmp dword [ebp + 0xc], edi
je 0x577e3c
push edi
push 0x8000080
push 3
push edi
push edi
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x577d07
mov eax, 0x80004005
jmp 0x577e41
push ebx
push esi
mov ebx, 0x400000
and dword [ebp + 8], 0
push 0x18
pop esi
sub esi, edi
cmp esi, ebx
jbe 0x577d1d
mov esi, ebx
push 0
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp + edi - 0x24]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x577d91
cmp dword [ebp + 8], 0
je 0x577d91
cmp dword [ebp + 8], esi
jne 0x577d91
add edi, esi
cmp edi, 0x18
jne 0x577d0e
xor ebx, ebx
cmp dword [ebp - 0x24], ebx
je 0x577e19
cmp dword [ebp - 0x20], ebx
je 0x577e19
cmp dword [ebp - 0x1c], ebx
je 0x577e19
cmp dword [ebp - 0x10], ebx
je 0x577d7a
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x24]
jne 0x577e19
push 0x2c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x577d9b
mov ecx, eax
call fcn.00577baa
mov esi, eax
jmp 0x577d9d
mov edi, 0x80004005
jmp 0x577e1e
xor esi, esi
cmp esi, ebx
mov dword [ebp - 0xc], esi
jne 0x577dab
mov edi, 0x8007000e
jmp 0x577e1e
cmp dword [ebp - 0x10], ebx
push dword [ebp - 0x1c]
mov ecx, esi
push dword [ebp - 0x20]
je 0x577dc5
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00577a41
jmp 0x577dcd
push dword [ebp - 0x24]
call fcn.00577916
mov edi, eax
cmp edi, ebx
mov eax, dword [esi]
jge 0x577dde
push 1
mov ecx, esi
call dword [eax + 0x4c]
jmp 0x577e1e
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x24]
push ebx
push esi
call dword [eax + 0x28]
mov edi, eax
cmp edi, ebx
jl 0x577e1e
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x24]
shl eax, 2
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00576dd8
mov edi, eax
test edi, edi
jl 0x577e1e
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor edi, edi
jmp 0x577e1e
mov edi, 0x8876086c
cmp dword [ebp - 4], 0
pop esi
pop ebx
je 0x577e2f
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x577e41
mov eax, 0x8876086c
pop edi
leave
ret 8
Function at 0x577e4b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
je 0x577fcd
cmp dword [ebp + 0xc], edi
je 0x577fcd
push edi
push 0x8000080
push 3
push edi
push edi
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x577e98
mov eax, 0x80004005
jmp 0x577fd2
push ebx
push esi
mov ebx, 0x400000
and dword [ebp + 8], 0
push 0x18
pop esi
sub esi, edi
cmp esi, ebx
jbe 0x577eae
mov esi, ebx
push 0
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp + edi - 0x24]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x577f22
cmp dword [ebp + 8], 0
je 0x577f22
cmp dword [ebp + 8], esi
jne 0x577f22
add edi, esi
cmp edi, 0x18
jne 0x577e9f
xor ebx, ebx
cmp dword [ebp - 0x24], ebx
je 0x577faa
cmp dword [ebp - 0x20], ebx
je 0x577faa
cmp dword [ebp - 0x1c], ebx
je 0x577faa
cmp dword [ebp - 0x10], ebx
je 0x577f0b
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x24]
jne 0x577faa
push 0x2c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x577f2c
mov ecx, eax
call fcn.00577baa
mov esi, eax
jmp 0x577f2e
mov edi, 0x80004005
jmp 0x577faf
xor esi, esi
cmp esi, ebx
mov dword [ebp - 0xc], esi
jne 0x577f3c
mov edi, 0x8007000e
jmp 0x577faf
cmp dword [ebp - 0x10], ebx
push dword [ebp - 0x1c]
mov ecx, esi
push dword [ebp - 0x20]
je 0x577f56
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00577a41
jmp 0x577f5e
push dword [ebp - 0x24]
call fcn.00577916
mov edi, eax
cmp edi, ebx
mov eax, dword [esi]
jge 0x577f6f
push 1
mov ecx, esi
call dword [eax + 0x4c]
jmp 0x577faf
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x24]
push ebx
push esi
call dword [eax + 0x28]
mov edi, eax
cmp edi, ebx
jl 0x577faf
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x24]
shl eax, 2
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00576dd8
mov edi, eax
test edi, edi
jl 0x577faf
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor edi, edi
jmp 0x577faf
mov edi, 0x8876086c
cmp dword [ebp - 4], 0
pop esi
pop ebx
je 0x577fc0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x577fd2
mov eax, 0x8876086c
pop edi
leave
ret 8
Function at 0x57aa3f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x606091
call fcn.00605168
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 0x10]
mov dword [ebp - 0x10], esi
mov dword [esi], 0x421f68
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call fcn.0057a892
fld1
xor ebx, ebx
fstp dword [esi + 0x20]
inc ebx
lea ecx, [esi + 0x74]
mov dword [ebp - 4], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], 0x3ba3d70a
mov dword [esi + 0x6c], edi
call fcn.00587e5c
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x4c], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x587e5c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x6063a3
call fcn.00605168
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi], ebx
lea ecx, [esi + 0x10]
mov dword [ebp - 4], ebx
call fcn.0059373a
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 1
call fcn.0059373a
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0059373a
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 3
call fcn.0058624c
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 4
call fcn.005862b5
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 5
call fcn.005862b5
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 6
call fcn.00587e0b
or dword [esi + 0x90], 0xffffffff
or dword [esi + 0x94], 0xffffffff
or dword [esi + 0x98], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov byte [esi + 0xac], bl
mov byte [esi + 0xad], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x5a382f
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x20
lea eax, [ebp - 0x24]
push eax
push dword [ecx + 0x30]
mov dword [ebp - 0x24], 0x20666f78
mov dword [ebp - 0x20], 0x34303330
mov dword [ebp - 0x1c], 0x206e6962
mov dword [ebp - 0x18], 0x32333030
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
leave
ret
Function at 0x5a3e1f
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 4], ebx
jne 0x5a3e52
mov eax, 0x88760389
jmp 0x5a3f14
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5a3e69
mov esi, 0x8876038f
jmp 0x5a3ed1
push esi
push esi
push esi
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5a3e62
push esi
push esi
push esi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x5a3e97
mov esi, 0x8876038f
jmp 0x5a3eca
push 0x24
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x5a3eb6
push edi
push dword [ebp + 8]
mov ecx, eax
push ebx
push dword [ebp - 4]
call fcn.005a8af0
mov edi, eax
jmp 0x5a3eb8
xor edi, edi
cmp edi, esi
jne 0x5a3ede
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, 0x8007000e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x5a3f13
push 0x30
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x5a3ef7
push edi
push dword [ebp + 0xc]
mov ecx, eax
call fcn.005a3b56
jmp 0x5a3ef9
xor eax, eax
cmp eax, esi
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jne 0x5a3f11
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov eax, 0x8007000e
jmp 0x5a3f13
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x5a3f1f
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x625894]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x118], ebx
call fcn.0042a1fb
test eax, eax
jne 0x5a3f7f
push 0x104
lea eax, [ebp - 0x108]
push edi
push eax
call sub.msvcrt.dll_wcstombs
add esp, 0xc
push ebx
push esi
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 5], 0
call fcn.005a3e1f
jmp 0x5a407e
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5a3fa5
mov eax, 0x88760389
jmp 0x5a407e
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5a3fbb
mov esi, 0x8876038f
jmp 0x5a4038
push esi
push esi
push esi
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10c], eax
je 0x5a3fb4
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [ebp - 0x110], eax
jne 0x5a3ff0
mov esi, 0x8876038f
jmp 0x5a402c
push 0x24
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x5a4015
push edi
push dword [ebp - 0x110]
mov ecx, eax
push dword [ebp - 0x10c]
push ebx
call fcn.005a8af0
mov edi, eax
jmp 0x5a4017
xor edi, edi
cmp edi, esi
jne 0x5a4043
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, 0x8007000e
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x5a407e
push 0x30
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x5a405f
push edi
push dword [ebp - 0x114]
mov ecx, eax
call fcn.005a3b56
jmp 0x5a4061
xor eax, eax
cmp eax, esi
mov ecx, dword [ebp - 0x118]
mov dword [ecx], eax
jne 0x5a407c
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov eax, 0x8007000e
jmp 0x5a407e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.006056c0
leave
ret 0xc
Function at 0x5a5cac
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5a5cb7
push ebx
sub eax, edx
push esi
lea esi, [eax + 1]
push esi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
xor eax, eax
cmp ebx, eax
pop ecx
jne 0x5a5cde
mov eax, 0x8007000e
jmp 0x5a5d97
push edi
mov ecx, esi
mov esi, dword [ebp + 0xc]
mov edx, ecx
shr ecx, 2
push eax
push 0x8000080
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 2
push eax
push eax
mov ecx, edx
push 0x40000000
push dword [ebp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5a5d1a
mov esi, 0x8876038f
jmp 0x5a5d60
push 0x60
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x5a5d45
mov edx, dword [ebp + 0x10]
mov ecx, edx
shr ecx, 1
and ecx, 1
push ecx
and edx, 1
push edx
push edi
push ebx
push dword [ebp + 8]
mov ecx, eax
call fcn.005a47e3
mov esi, eax
jmp 0x5a5d47
xor esi, esi
test esi, esi
jne 0x5a5d6b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, 0x8007000e
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
jmp 0x5a5d96
mov ecx, esi
call fcn.005a49c6
test eax, eax
je 0x5a5d8f
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x18]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0x8876038f
jmp 0x5a5d96
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10