joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bdfb0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp word [edi], 0
push ebx
mov ebx, dword [esp + 0xc]
je 0x5bdfc9
mov dword [esi], 2
mov eax, esi
pop ebx
pop ecx
ret 4
mov edx, dword [ebx + 8]
push 0
lea eax, [esp + 8]
push eax
push 2
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
mov eax, dword [edx + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 4], 2
jne 0x5bdfbc
cmp word [edi + 2], 1
jne 0x5bdfbc
mov edx, dword [ebx + 8]
push 1
call fcn.005c2540
test al, al
je 0x5bdfbc
movzx eax, word [edi + 4]
test ax, ax
je 0x5bdfbc
mov edx, dword [ebx + 8]
push eax
call fcn.005c2540
test al, al
je 0x5bdfbc
mov dword [esi], 0
mov eax, esi
pop ebx
pop ecx
ret 4

Function at 0x5be030
Capabilities:
Write file on windows

Disassembly:
push ecx
mov al, byte [esi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
mov ebp, dword [esp + 0x10]
push 0
lea ecx, [esp + 0xc]
push ecx
mov byte [esp + 0x18], al
mov eax, dword [edi + 8]
mov ecx, dword [eax + 0x10]
push 1
lea edx, [esp + 0x1c]
push edx
push ecx
call ebx
cmp dword [esp + 8], 1
je 0x5be070
mov dword [ebp], 2
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
mov dl, byte [esi + 1]
push 0
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x18], dl
mov edx, dword [edi + 8]
mov eax, dword [edx + 0x10]
push 1
lea ecx, [esp + 0x1c]
push ecx
push eax
call ebx
cmp dword [esp + 8], 1
jne 0x5be061
mov cl, byte [esi + 2]
push 0
lea edx, [esp + 0xc]
push edx
mov byte [esp + 0x18], cl
mov ecx, dword [edi + 8]
mov edx, dword [ecx + 0x10]
push 1
lea eax, [esp + 0x1c]
push eax
push edx
call ebx
cmp dword [esp + 8], 1
jne 0x5be061
cmp byte [esi + 3], 0
jne 0x5be061
mov edx, dword [edi + 8]
push 0
call fcn.0048edb0
test al, al
je 0x5be061
movzx eax, word [esi + 4]
mov edx, dword [edi + 8]
push eax
call fcn.005c2540
test al, al
je 0x5be061
movzx ecx, word [esi + 6]
mov edx, dword [edi + 8]
push ecx
call fcn.005c2540
test al, al
je 0x5be061
mov edx, dword [esi + 8]
push edx
mov edx, dword [edi + 8]
call fcn.0057ab90
test al, al
je 0x5be061
mov eax, dword [esi + 0xc]
mov edx, dword [edi + 8]
push eax
call fcn.0057ab90
test al, al
je 0x5be061
mov dword [ebp], 0
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x5be5e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x40
push ebx
mov ebx, dword [esp + 0x48]
push ebp
push 0x39
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.006a1300
mov eax, dword [esi + 4]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
lea edx, [esp + 0x58]
mov byte [esp + 0x58], 0xa
mov ecx, dword [eax + 0x10]
push edx
push ecx
call ebp
cmp dword [esp + 8], 1
je 0x5be638
pop ebp
mov dword [ebx], 2
mov eax, ebx
pop ebx
add esp, 0x40
ret 4
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0xc]
push edx
push 1
lea eax, [esp + 0x58]
mov byte [esp + 0x58], 5
mov edx, dword [ecx + 0x10]
push eax
push edx
call ebp
cmp dword [esp + 8], 1
jne 0x5be628
mov al, byte [edi + 2]
push 0
lea ecx, [esp + 0xc]
push ecx
mov byte [esp + 0x54], al
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x10]
push 1
lea edx, [esp + 0x58]
push edx
push ecx
call ebp
cmp dword [esp + 8], 1
jne 0x5be628
movzx edx, byte [edi + 3]
push edx
mov edx, dword [esi + 4]
call fcn.0048edb0
test al, al
je 0x5be628
movzx eax, word [edi + 4]
mov edx, dword [esi + 4]
push eax
call fcn.005c2540
test al, al
je 0x5be628
movzx ecx, word [edi + 6]
mov edx, dword [esi + 4]
push ecx
call fcn.005c2540
test al, al
je 0x5be628
movzx edx, word [edi + 8]
push edx
mov edx, dword [esi + 4]
call fcn.005c2540
test al, al
je 0x5be628
movzx eax, word [edi + 0xa]
mov edx, dword [esi + 4]
push eax
call fcn.005c2540
test al, al
je 0x5be628
movzx ecx, word [edi + 0xc]
mov edx, dword [esi + 4]
push ecx
call fcn.005c2540
test al, al
je 0x5be628
movzx edx, word [edi + 0xe]
push edx
mov edx, dword [esi + 4]
call fcn.005c2540
test al, al
je 0x5be628
mov eax, dword [esi + 4]
push eax
mov ecx, 0x31
lea edx, [esp + 0x10]
call fcn.0048b210
cmp eax, 0x31
jne 0x5be628
movzx ecx, byte [edi + 0x10]
mov edx, dword [esi + 4]
push ecx
call fcn.0048edb0
test al, al
je 0x5be628
movzx edx, word [edi + 0x11]
push edx
mov edx, dword [esi + 4]
call fcn.005c2540
test al, al
je 0x5be628
mov edx, dword [esi + 4]
push 1
call fcn.005c2540
test al, al
je 0x5be628
mov eax, dword [esi + 4]
push eax
mov ecx, 0x3a
lea edx, [esp + 0x10]
call fcn.0048b210
cmp eax, 0x3a
jne 0x5be628
pop ebp
mov dword [ebx], 0
invalid
Function at 0x5bf110
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
mov ebp, dword [esp + 0x10]
push 0
bswap eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x18], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x10]
push 4
lea edx, [esp + 0x1c]
push edx
push ecx
call ebx
cmp dword [esp + 8], 4
je 0x5bf152
mov dword [ebp], 2
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
mov edx, dword [esi + 4]
push 0
bswap edx
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x18], edx
mov edx, dword [edi + 4]
mov eax, dword [edx + 0x10]
push 4
lea ecx, [esp + 0x1c]
push ecx
push eax
call ebx
cmp dword [esp + 8], 4
jne 0x5bf143
mov ecx, dword [esi + 8]
push 0
bswap ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x18], ecx
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 0x10]
push 4
lea eax, [esp + 0x1c]
push eax
push edx
call ebx
cmp dword [esp + 8], 4
jne 0x5bf143
mov eax, dword [esi + 0xc]
mov edx, dword [edi + 4]
push eax
call fcn.005c25b0
test al, al
je 0x5bf143
mov ecx, dword [esi + 0x10]
mov edx, dword [edi + 4]
push ecx
call fcn.005c25b0
test al, al
je 0x5bf143
mov edx, dword [esi + 0x14]
push edx
mov edx, dword [edi + 4]
call fcn.005c25b0
test al, al
je 0x5bf143
mov eax, dword [esi + 0x18]
mov edx, dword [edi + 4]
push eax
call fcn.005c25b0
test al, al
je 0x5bf143
mov ecx, dword [esi + 0x1c]
mov edx, dword [edi + 4]
push ecx
call fcn.005c25b0
test al, al
je 0x5bf143
mov dword [ebp], 0
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x5bf210
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x224
mov eax, dword [esi]
mov eax, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x230]
push ebp
mov ebp, dword [esp + 0x230]
push edi
mov edi, 0xa
lea ecx, [esp + 0x128]
call fcn.00552760
mov ecx, dword [esi]
mov eax, dword [ecx + 8]
lea ecx, [esp + 0x20]
call fcn.00552760
xor edi, edi
push str._svg_r_n_xmlns_http:__www.w3.org_2000_svg__r_n_xmlns:xlink_http:__www.w3.org_1999_xlink__r_n_version_1.1__r_n
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.00552eb0
add esp, 4
lea edx, [esp + 0x128]
push edx
push str._width__s__r_n
lea eax, [esp + 0x18]
call fcn.00552eb0
lea eax, [esp + 0x28]
push eax
push str._height__s___r_n
lea eax, [esp + 0x20]
call fcn.00552eb0
push str.__g__r_n
lea eax, [esp + 0x24]
call fcn.00552eb0
add esp, 0x14
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x12c]
push edx
push str._____image_x_0__y_0__width__s__height__s__r_n
lea eax, [esp + 0x1c]
call fcn.00552eb0
mov eax, dword [esp + 0x248]
mov ecx, dword [eax]
add esp, 0xc
push ecx
push str._______xlink:href_data:image_png_base64__s____r_n
lea eax, [esp + 0x18]
call fcn.00552eb0
push str.___g__r_n
lea eax, [esp + 0x1c]
call fcn.00552eb0
add esp, 0xc
push str.__svg__r_n
lea eax, [esp + 0x14]
call fcn.00552eb0
mov edx, dword [ebx]
mov eax, dword [edx]
add esp, 4
mov ecx, ebx
call eax
test al, al
mov ecx, dword [esp + 0x10]
je 0x5bf315
mov dword [ebp], 1
jmp 0x5bf335
mov eax, dword [esp + 0x14]
push edi
lea edx, [esp + 0x20]
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [edx + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x10]
mov dword [ebp], edi
push ecx
call fcn.0069c8fa
add esp, 4
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x224
ret 0xc
Function at 0x5bf350
Capabilities:
Write file on windows

Disassembly:
push ecx
mov al, byte [esi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
mov ebp, dword [esp + 0x10]
push 0
lea ecx, [esp + 0xc]
push ecx
mov byte [esp + 0x18], al
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x10]
push 1
lea edx, [esp + 0x1c]
push edx
push ecx
call ebx
cmp dword [esp + 8], 1
je 0x5bf390
mov dword [ebp], 2
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
mov dl, byte [esi + 1]
push 0
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x18], dl
mov edx, dword [edi + 4]
mov eax, dword [edx + 0x10]
push 1
lea ecx, [esp + 0x1c]
push ecx
push eax
call ebx
cmp dword [esp + 8], 1
jne 0x5bf381
mov cl, byte [esi + 2]
push 0
lea edx, [esp + 0xc]
push edx
mov byte [esp + 0x18], cl
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 0x10]
push 1
lea eax, [esp + 0x1c]
push eax
push edx
call ebx
cmp dword [esp + 8], 1
jne 0x5bf381
movzx eax, word [esi + 3]
mov edx, dword [edi + 4]
push eax
call fcn.005c2540
test al, al
je 0x5bf381
movzx ecx, word [esi + 5]
mov edx, dword [edi + 4]
push ecx
call fcn.005c2540
test al, al
je 0x5bf381
movzx edx, byte [esi + 7]
push edx
mov edx, dword [edi + 4]
call fcn.0048edb0
test al, al
je 0x5bf381
movzx eax, word [esi + 8]
mov edx, dword [edi + 4]
push eax
call fcn.005c2540
test al, al
je 0x5bf381
movzx ecx, word [esi + 0xa]
mov edx, dword [edi + 4]
push ecx
call fcn.005c2540
test al, al
je 0x5bf381
movzx edx, word [esi + 0xc]
push edx
mov edx, dword [edi + 4]
call fcn.005c2540
test al, al
je 0x5bf381
movzx eax, word [esi + 0xe]
mov edx, dword [edi + 4]
push eax
call fcn.005c2540
test al, al
je 0x5bf381
movzx ecx, byte [esi + 0x10]
mov edx, dword [edi + 4]
push ecx
call fcn.0048edb0
test al, al
je 0x5bf381
movzx edx, byte [esi + 0x11]
push edx
mov edx, dword [edi + 4]
call fcn.0048edb0
test al, al
je 0x5bf381
mov dword [ebp], 0
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x5bf7a0
Capabilities:
Write file on windows

Disassembly:
cmp byte [esp + 0x10], 0
push ebp
mov ebp, dword [esp + 0x10]
push esi
je 0x5bf7ea
mov ecx, dword [ebp]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [edx + 4]
lea esi, [edi*4]
push esi
push ecx
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x18], esi
je 0x5bf875
mov eax, dword [esp + 0x10]
pop esi
mov dword [eax], 2
pop ebp
ret 0x10
push ebx
lea ebx, [edi + edi*2]
push ebx
call fcn.0069c0de
add esp, 4
xor esi, esi
test edi, edi
mov dword [esp + 0x1c], eax
jbe 0x5bf829
mov edx, dword [ebp]
mov ecx, dword [edx + esi*4]
mov byte [eax], cl
add eax, 1
mov edx, ecx
shr edx, 8
mov byte [eax], dl
add eax, 1
shr ecx, 0x10
mov byte [eax], cl
add esi, 1
add eax, 1
cmp esi, edi
jb 0x5bf801
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x14]
push ecx
push ebx
push eax
mov eax, dword [edx + 4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x10], ebx
pop ebx
je 0x5bf868
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
push edx
mov dword [esi], 2
call fcn.0069c8fa
add esp, 4
mov eax, esi
pop esi
pop ebp
ret 0x10
mov eax, dword [esp + 0x18]
push eax
call fcn.0069c8fa
add esp, 4
mov eax, dword [esp + 0x10]
pop esi
mov dword [eax], 0
pop ebp
ret 0x10

Function at 0x5bf890
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov cl, al
and cl, 0x7f
mov byte [esp], cl
mov edx, eax
mov ecx, eax
push ebx
mov ebx, dword [esp + 0x10]
shr edx, 7
shr ecx, 0xe
and dl, 0x7f
and cl, 0x7f
shr eax, 0x15
push esi
and al, 0x7f
push edi
mov byte [esp + 0xd], dl
mov byte [esp + 0xe], cl
mov byte [esp + 0xf], al
mov esi, 3
jmp 0x5bf8d0
cmp byte [esp + esi + 0xc], 0
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
jne 0x5bf91d
sub esi, 1
test esi, esi
jg 0x5bf8d0
mov cl, byte [esp + esi + 0xc]
push 0
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x20], cl
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 0x10]
push 1
lea eax, [esp + 0x24]
push eax
push edx
call edi
cmp dword [esp + 0x10], 1
mov eax, dword [esp + 0x1c]
jne 0x5bf957
pop edi
pop esi
mov dword [eax], 0
pop ebx
add esp, 8
ret 8
test esi, esi
jle 0x5bf8e4
mov dl, byte [esp + esi + 0xc]
push 0
or dl, 0x80
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x20], dl
mov edx, dword [ebx + 4]
mov eax, dword [edx + 0x10]
push 1
lea ecx, [esp + 0x24]
push ecx
push eax
call edi
sub esi, 1
cmp dword [esp + 0x10], 1
jne 0x5bf953
test esi, esi
jg 0x5bf921
jmp 0x5bf8e4
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [eax], 2
pop ebx
add esp, 8
ret 8

Function at 0x5c2540
Capabilities:
Write file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [edx + 0x10]
push 2
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
cmp dword [esp], 2
sete al
pop ecx
ret 4
Function at 0x5c2570
Capabilities:
Write file on windows

Disassembly:
mov ax, word [esp + 8]
mov ch, al
push 0
mov cl, ah
lea eax, [esp + 8]
push eax
push 2
movzx edx, cx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x10]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
cmp dword [esp + 4], 2
sete al
ret 8

Function at 0x5c25b0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
bswap eax
push 0
mov dword [esp + 0xc], eax
lea eax, [esp + 4]
push eax
mov eax, dword [edx + 0x10]
push 4
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
cmp dword [esp], 4
sete al
pop ecx
ret 4
Function at 0x5c5ea0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, eax
movzx eax, word [esi + 0xe]
mov cx, ax
sub cx, 0x20
neg cx
mov word [esi + 0xc], 1
sbb ecx, ecx
and ecx, 0xffffffac
add ecx, 0x7c
cmp ax, 8
mov dword [esi], ecx
jbe 0x5c5ed5
mov dword [esi + 0x20], 0
mov edx, dword [esi + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, ecx
push 0
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 8]
mov ecx, dword [eax + 0x10]
mov dword [esi + 0x24], edx
push 4
lea edx, [esp + 0x20]
push edx
push ecx
call ebx
cmp dword [esp + 0xc], 4
je 0x5c5f15
pop esi
mov dword [ebp], 2
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x1c], edx
mov edx, dword [edi + 8]
mov eax, dword [edx + 0x10]
push 4
lea ecx, [esp + 0x20]
push ecx
push eax
call ebx
cmp dword [esp + 0xc], 4
jne 0x5c5f05
mov ecx, dword [esi + 8]
push 0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [edi + 8]
mov edx, dword [ecx + 0x10]
push 4
lea eax, [esp + 0x20]
push eax
push edx
call ebx
cmp dword [esp + 0xc], 4
jne 0x5c5f05
movzx eax, word [esi + 0xc]
mov edx, dword [edi + 8]
push eax
call fcn.005c2540
test al, al
je 0x5c5f05
movzx ecx, word [esi + 0xe]
mov edx, dword [edi + 8]
push ecx
call fcn.005c2540
test al, al
je 0x5c5f05
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [edi + 8]
call fcn.0057ab90
test al, al
je 0x5c5f05
mov eax, dword [esi + 0x14]
mov edx, dword [edi + 8]
push eax
call fcn.0057ab90
test al, al
je 0x5c5f05
mov ecx, dword [esi + 0x18]
mov edx, dword [edi + 8]
push ecx
call fcn.0057ab90
test al, al
je 0x5c5f05
mov edx, dword [esi + 0x1c]
push edx
mov edx, dword [edi + 8]
call fcn.0057ab90
test al, al
je 0x5c5f05
mov eax, dword [esi + 0x20]
mov edx, dword [edi + 8]
push eax
call fcn.0057ab90
test al, al
je 0x5c5f05
mov ecx, dword [esi + 0x24]
mov edx, dword [edi + 8]
push ecx
call fcn.0057ab90
test al, al
je 0x5c5f05
cmp word [esi + 0xe], 0x20
jne 0x5c60aa
mov edx, dword [edi + 8]
push 0xff0000
mov dword [esi + 0x28], 0xff0000
call fcn.0057ab90
test al, al
je 0x5c5f05
mov edx, dword [edi + 8]
push 0xff00
mov dword [esi + 0x2c], 0xff00
call fcn.0057ab90
test al, al
je 0x5c5f05
mov edx, dword [edi + 8]
push 0xff
mov dword [esi + 0x30], 0xff
call fcn.0057ab90
test al, al
je 0x5c5f05
mov edx, dword [edi + 8]
push 0xff000000
mov dword [esi + 0x34], 0xff000000
call fcn.0057ab90
test al, al
je 0x5c5f05
mov edx, dword [edi + 8]
push 0x73524742
call fcn.0057ab90
test al, al
je 0x5c5f05
xor esi, esi
jmp 0x5c6090
mov edx, dword [edi + 8]
push 0
call fcn.0057ab90
test al, al
je 0x5c5f05
add esi, 1
cmp esi, 0x10
jb 0x5c6090
pop esi
mov dword [ebp], 0
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x5c60c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
cmp byte [ebx + 0x30], 0
push ebp
push esi
push edi
je 0x5c60de
mov eax, dword [ebx]
cmp dword [eax + 0x10], 0xffffffff
setne cl
test cl, cl
jne 0x5c60ea
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
push 0
lea ecx, [esp + 0x14]
push ecx
push 1
lea edx, [esp + 0x28]
mov byte [esp + 0x28], 0x3b
mov eax, dword [eax + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x10], 1
mov ecx, dword [ebx + 0xc]
movzx edi, word [ecx]
movzx ebp, word [ecx + 2]
sete al
test al, al
je 0x5c6197
test di, di
je 0x5c6127
test bp, bp
jne 0x5c6197
xor ecx, ecx
push ecx
push ecx
push ecx
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x10]
xor eax, eax
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov esi, dword [ebx]
lea eax, [ebx + 8]
push eax
call fcn.005c61b0
test di, di
jne 0x5c6151
movzx eax, word [ebx + 0x10]
jmp 0x5c6154
movzx eax, di
test bp, bp
jne 0x5c615f
movzx edi, word [ebx + 0x12]
jmp 0x5c6162
movzx edi, bp
mov esi, dword [ebx + 0xc]
movzx ecx, byte [esi + 4]
test cl, cl
jns 0x5c617c
and ecx, 7
add ecx, 1
mov edx, 1
shl edx, cl
jmp 0x5c617e
xor edx, edx
movzx ecx, byte [esi + 5]
push ecx
push edi
push eax
lea eax, [esp + 0x1c]
call fcn.004ce610
mov esi, dword [ebx]
mov edi, eax
call fcn.005c6200
pop edi
pop esi
pop ebp
mov byte [ebx + 0x30], 0
pop ebx
add esp, 8
ret 4

Function at 0x5c61b0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 8]
push eax
push 3
push 0x6dbae8
push ecx
call edi
mov edx, dword [esp + 0xc]
cmp dword [edx], 1
mov eax, 0x6dbaec
je 0x5c61df
mov eax, 0x6dbaf0
mov edx, dword [esi + 0x10]
push 0
lea ecx, [esp + 0x10]
push ecx
push 3
push eax
push edx
call edi
xor eax, eax
cmp dword [esp + 0xc], 3
pop edi
sete al
pop ecx
ret 4

Function at 0x5c6200
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
movzx eax, word [edi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x10]
push ecx
push 2
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x10]
push edx
push eax
call ebx
movzx ecx, word [edi + 2]
push 0
lea edx, [esp + 0x10]
push edx
push 2
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x10]
push eax
push ecx
call ebx
mov ecx, dword [esi + 0x10]
push 0
lea edx, [esp + 0x10]
push edx
push 1
lea eax, [edi + 4]
push eax
push ecx
call ebx
mov dl, byte [edi + 5]
push 0
lea eax, [esp + 0x10]
push eax
push 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], dl
mov edx, dword [esi + 0x10]
push ecx
push edx
call ebx
mov al, byte [edi + 6]
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
lea edx, [esp + 0x10]
mov byte [esp + 0x10], al
mov eax, dword [esi + 0x10]
push edx
push eax
call ebx
xor eax, eax
cmp dword [esp + 8], 1
pop ebx
sete al
add esp, 0xc
ret
Function at 0x5c62a0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
mov ebp, dword [esp + 0xc]
mov edx, dword [ebp + 0x10]
push esi
push edi
mov edi, eax
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push 0
lea esi, [eax + eax*2]
lea eax, [esp + 0x18]
push eax
push esi
push ecx
push edx
call ebx
cmp dword [esp + 0x14], esi
sete al
test al, al
je 0x5c633c
mov edi, dword [edi + 4]
xor ecx, ecx
test edi, edi
jbe 0x5c62e7
lea edx, [edi - 1]
mov edi, edi
add ecx, 1
shr edx, 1
jne 0x5c62e0
mov esi, 1
shl esi, cl
sub esi, edi
je 0x5c633c
xor ecx, ecx
mov eax, esi
mov edx, 3
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0069c0de
lea esi, [esi + esi*2]
push esi
mov edi, eax
push 0
push edi
call fcn.006a1300
mov ecx, dword [ebp + 0x10]
add esp, 0x10
push 0
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ecx
call ebx
cmp dword [esp + 0x14], esi
push edi
sete bl
call fcn.0069c8fa
add esp, 4
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x5c6350
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10c
push esi
push edi
mov edi, eax
mov esi, ecx
call fcn.005ca040
test al, al
jne 0x5c636e
pop edi
pop esi
add esp, 0x10c
ret
mov al, byte [esi + 6]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 1
lea edx, [esp + 0x18]
mov byte [esp + 0x18], al
mov eax, dword [edi + 0x10]
push edx
push eax
call ebp
mov eax, dword [edi + 0x10]
push 0
lea ecx, [esp + 0x14]
push ecx
push 8
lea edx, [esi + 7]
push edx
push eax
call ebp
mov eax, dword [edi + 0x10]
push 0
lea ecx, [esp + 0x14]
push ecx
push 3
lea edx, [esi + 0x10]
push edx
push eax
call ebp
mov esi, dword [esi + 0x13]
test esi, esi
pop ebp
je 0x5c63d2
mov edi, edi
push edi
mov eax, esi
call fcn.005ca0b0
test esi, esi
je 0x5c63d2
mov esi, dword [esi]
test esi, esi
jne 0x5c63c0
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
call fcn.005ca0b0
pop edi
pop esi
add esp, 0x10c
ret

Function at 0x5c6400
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, eax
mov esi, ecx
call fcn.005ca040
test al, al
jne 0x5c6418
pop edi
pop esi
add esp, 0xc
ret
mov al, byte [esi + 0xa]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 1
lea edx, [esp + 0x18]
mov byte [esp + 0x18], al
mov eax, dword [edi + 0x10]
push edx
push eax
call ebx
cmp dword [esp + 0x10], 1
je 0x5c644a
pop ebx
pop edi
xor al, al
pop esi
add esp, 0xc
ret
mov eax, dword [edi + 0x10]
push 0
lea ecx, [esp + 0x14]
push ecx
push 1
lea edx, [esi + 0xb]
push edx
push eax
call ebx
movzx ecx, word [esi + 0xc]
push 0
lea edx, [esp + 0x18]
push edx
push 2
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [edi + 0x10]
push eax
push ecx
call ebx
mov dl, byte [esi + 0xe]
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], dl
mov edx, dword [edi + 0x10]
push ecx
push edx
call ebx
push edi
lea eax, [esi + 0xf]
call fcn.005ca0b0
pop ebx
pop edi
pop esi
add esp, 0xc
ret