joyce8/EMBER2024-capa huggingface dataset:
Function at 0x538d10
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
push ebx
xor ebx, ebx
push ebp
cmp eax, ebx
push esi
jne 0x538d2e
mov eax, dword [esp + 0x10]
push eax
call fcn.00538f40
add esp, 4
pop esi
pop ebp
pop ebx
ret
push edi
push 0x21c
call fcn.00535b60
mov ebp, dword [esp + 0x18]
mov esi, eax
add esp, 4
mov dword [esi], ebp
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push ebx
push 0x1f4
push ebx
push ebx
mov dword [esi + 0x20], ebx
call edi
push ebx
push 0x1f4
push ebx
push ebx
mov dword [esi + 8], eax
call edi
lea ecx, [esp + 0x14]
mov dword [esi + 0xc], eax
push ecx
push ebx
push esi
push 0x538ea0
push 0x1388
push ebx
call fcn.00596b60
push eax
mov dword [esi + 4], eax
call fcn.00536b60
mov dword [esi + 0x218], eax
mov eax, dword [esi + 4]
add esp, 0x1c
cmp eax, ebx
pop edi
jne 0x538dae
push ebp
call fcn.00538f40
add esp, 4
pop esi
pop ebp
pop ebx
ret
mov edx, dword [0x5dd498]
push 1
push 0x538dd0
push fcn.00538a20
push esi
push edx
call fcn.00536d20
add esp, 0x14
pop esi
pop ebp
pop ebx
ret

Function at 0x539780
Capabilities:
Create pipe

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push 0
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x5397c7
mov edx, dword [esp]
push esi
push 0
push edx
call fcn.005970f4
mov esi, dword [esp + 0x18]
push 0
mov dword [esi], eax
mov eax, dword [esp + 0x14]
push eax
call fcn.005970f4
add esp, 0x10
mov dword [esi + 4], eax
xor eax, eax
pop esi
add esp, 8
ret
mov eax, 1
add esp, 8
ret

Function at 0x53deb0
Capabilities:
Terminate process

Disassembly:
push ecx
call fcn.005458f0
lea ecx, [esp]
cmp ecx, eax
sbb edx, edx
neg edx
mov dword [0x5fbd44], edx
je 0x53dee9
mov eax, dword [0x5fbe3c]
push str.Stack_grows_UP__not_DOWN._n
test eax, eax
je 0x53deda
call eax
jmp 0x53dedf
call fcn.005934e7
add esp, 4
push 1
call fcn.00593892
call fcn.00571eb0
sub eax, 0xf3cb0
mov dword [0x5fbd50], eax
pop ecx
ret
Function at 0x543c90
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0xb4]
test eax, eax
je 0x543cc9
mov eax, dword [esi + 0xb0]
test al, 4
je 0x543cb2
add eax, 0xfffffffc
mov dword [esi + 0xb0], eax
lea eax, [esi + 0xc]
push 1
push eax
mov dword [esi + 0x2c], esi
mov word [esi + 0x36], 1
call fcn.00541e20
add esp, 8
mov eax, dword [esi + 4]
test eax, eax
jne 0x543ce7
mov eax, dword [0x5fbe40]
test eax, eax
je 0x543ce0
push 0
call eax
add esp, 4
push 0
call fcn.00593892
push esi
call fcn.00543350
push 0
call fcn.005432e0
add esp, 8
pop esi
ret

Function at 0x5454b0
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call fcn.0059306c
mov esi, eax
add esp, 4
test esi, esi
jne 0x5454d0
mov eax, dword [0x5ddc20]
test eax, eax
je 0x5454e9
call eax
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, esi
pop edi
pop esi
ret
mov eax, dword [0x5fbe3c]
push str.out_of_memory_n
test eax, eax
je 0x5454fb
call eax
jmp 0x545500
call fcn.005934e7
add esp, 4
push 1
call fcn.00593892
nop
nop
nop
nop
nop
nop
Function at 0x561f90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x561fa3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ebx, dword [eax + 0xc]
lea ebp, [ecx + edx]
mov eax, dword [ebx + 0x10]
push 0
push edi
push ebp
push eax
call sub.WSOCK32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x561fd3
call fcn.00596b0d
cmp dword [eax], 4
je 0x561fb5
cmp esi, edi
je 0x5620b3
call sub.WSOCK32.dll_WSAGetLastError
test esi, esi
jg 0x562019
cmp edi, 1
jle 0x561ff0
cmp eax, 0x2738
je 0x56204b
cmp eax, 0x2733
je 0x562002
cmp eax, 0x2734
jne 0x56209a
push 0
push ebx
push 0x562180
push 0x5620c0
call fcn.005441b0
add esp, 0x10
jmp 0x561fb5
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x5620b3
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esi + edx]
push 0
sub edi, esi
push eax
push edi
push ecx
call fcn.00561f90
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov eax, edi
push ebp
cdq
sub eax, edx
mov edx, dword [esp + 0x20]
mov ebx, eax
mov eax, dword [esp + 0x18]
sar ebx, 1
push esi
push edx
push ebx
push eax
call fcn.00561f90
add esp, 0x14
test esi, esi
jne 0x5620b5
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push ebp
push esi
lea edx, [ebx + ecx]
sub edi, ebx
push edx
push edi
push eax
call fcn.00561f90
mov esi, eax
add esp, 0x14
add esi, ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
test eax, eax
je 0x5620b3
mov ecx, dword [esp + 0x24]
push eax
push str.tcp_write:_error_writing___e_
push ecx
push 0x14
call fcn.0052ab90
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x562520
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x5ddb84]
sub esp, 0x190
test eax, eax
jne 0x562577
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x562560
push 0x562580
mov dword [0x5ddb84], 1
call fcn.00595da8
add esp, 4
add esp, 0x190
ret
mov ecx, dword [esp + 0x194]
push ecx
push str._s:_not_supported_on_this_machine__no_winsock_driver_
push 0x1b
call fcn.0052ab90
add esp, 0xc
add esp, 0x190
ret
Function at 0x562770
Capabilities:
Get socket status

Disassembly:
sub esp, 8
mov eax, dword [0x5ddb74]
mov dword [esp], 0
test eax, eax
mov dword [esp + 4], 0
push 1
je 0x562796
push eax
call fcn.00536980
jmp 0x56279d
push 1
call fcn.00536920
mov dword [0x5ddb74], eax
mov eax, dword [0x5ddb64]
add esp, 8
test eax, eax
push 1
je 0x5627b8
push eax
call fcn.00536980
jmp 0x5627bf
push 1
call fcn.00536920
add esp, 8
mov dword [0x5ddb64], eax
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [eax + 0xc]
cmp word [esi + 0xc], 0
je 0x5627e0
mov eax, 1
pop esi
add esp, 8
ret
mov cx, word [esi + 8]
cmp cx, word [esi + 0xa]
jge 0x5627f4
mov eax, 1
pop esi
add esp, 8
ret
mov edx, dword [0x5ddb74]
push edx
call fcn.005369d0
mov eax, dword [0x5ddb64]
push eax
call fcn.005369d0
mov ecx, dword [esi + 0x10]
mov edx, dword [0x5ddb74]
push ecx
push edx
call fcn.00536a50
mov eax, dword [esi + 0x10]
mov ecx, dword [0x5ddb64]
push eax
push ecx
call fcn.00536a50
mov eax, dword [0x5ddb64]
mov ecx, dword [0x5ddb74]
add esp, 0x18
lea edx, [esp + 4]
push edx
mov edx, dword [esi + 0x10]
push eax
push 0
inc edx
push ecx
push edx
call sub.WSOCK32.dll_select
pop esi
add esp, 8
ret

Function at 0x562d70
Capabilities:
Get socket status

Disassembly:
sub esp, 8
mov eax, dword [0x5ddb60]
mov dword [esp], 0
test eax, eax
mov dword [esp + 4], 0
push 1
je 0x562d96
push eax
call fcn.00536980
jmp 0x562d9d
push 1
call fcn.00536920
mov dword [0x5ddb60], eax
mov eax, dword [0x5ddb7c]
add esp, 8
test eax, eax
push 1
je 0x562db8
push eax
call fcn.00536980
jmp 0x562dbf
push 1
call fcn.00536920
add esp, 8
mov dword [0x5ddb7c], eax
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [eax + 4]
cmp esi, 0xffffffff
jne 0x562dde
mov eax, 1
pop esi
add esp, 8
ret
mov ecx, dword [0x5ddb60]
push ecx
call fcn.005369d0
mov edx, dword [0x5ddb7c]
push edx
call fcn.005369d0
mov eax, dword [0x5ddb60]
push esi
push eax
call fcn.00536a50
mov ecx, dword [0x5ddb7c]
push esi
push ecx
call fcn.00536a50
mov eax, dword [0x5ddb7c]
mov ecx, dword [0x5ddb60]
add esp, 0x18
lea edx, [esp + 4]
inc esi
push edx
push eax
push 0
push ecx
push esi
call sub.WSOCK32.dll_select
pop esi
add esp, 8
ret

Function at 0x56c5a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x10]
lea ecx, [esp + 8]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push esi
push edi
call fcn.0056c320
xor ecx, ecx
add esp, 0x14
cmp word [edi + 2], cx
sete cl
xor edx, edx
cmp word [esi + 2], dx
sete dl
xor ecx, edx
mov edx, dword [esp + 0x10]
neg ecx
sbb ecx, ecx
inc ecx
mov word [edx + 2], cx
lea ecx, [eax - 1]
test eax, eax
je 0x56c606
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 8]
mov esi, dword [esi + ecx*4]
mov edi, dword [edx + ecx*4]
xor edi, esi
mov dword [edx + ecx*4], edi
mov edx, ecx
dec ecx
test edx, edx
jne 0x56c5ec
mov ecx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push eax
push ecx
call fcn.0056c490
add esp, 0xc
pop edi
pop esi
pop ecx
ret
Function at 0x56fbc0
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [0x5ddd40]
test eax, eax
jne 0x56fcd7
call fcn.00571e10
push 0x5fbcbc
push 0x5f1360
call fcn.005725d0
add esp, 8
call fcn.00571f00
mov eax, dword [0x5ddd30]
test eax, eax
jne 0x56fbfd
call fcn.00571eb0
mov dword [0x5ddd30], eax
lea ecx, [esp]
cmp ecx, eax
jbe 0x56fc3a
push str.STACK_GROWS_DOWN_is_defd__but_stack_appears_to_grow_up_n
call fcn.0056fec0
mov edx, dword [0x5ddd30]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push edx
push eax
push str.sp__0x_lx__GC_stackbottom__0x_lx_n
call fcn.0056fe00
push str.stack_direction_3_n
call fcn.0056ff30
add esp, 0x24
mov eax, dword [0x5ddda4]
test eax, eax
je 0x56fc57
call fcn.00571c30
call fcn.0056f820
call fcn.005736e0
call fcn.00545cc0
call fcn.005720d0
call fcn.0056e1c0
call fcn.00573300
call fcn.00570870
push 0x10
call fcn.0056ec90
add esp, 4
test eax, eax
jne 0x56fc8d
push str.Cant_start_up:_not_enough_memory_n
call fcn.0056fec0
add esp, 4
push 1
call fcn.00593892
push 0
call fcn.005728d0
add esp, 4
test eax, eax
jne 0x56fcaf
push str.Cant_start_up:_not_enough_memory_n
call fcn.0056fec0
add esp, 4
push 1
call fcn.00593892
push 0
call fcn.00572830
call fcn.0056f860
push fcn.0058db60
call fcn.0056e7a0
add esp, 8
call fcn.00545960
mov dword [0x5ddd40], 1
pop ecx
ret

Function at 0x56fd30
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x5ddd38]
sub esp, 0x404
test eax, eax
jne 0x56fdf2
mov eax, dword [esp + 0x420]
mov ecx, dword [esp + 0x41c]
mov edx, dword [esp + 0x418]
push eax
mov eax, dword [esp + 0x418]
push ecx
mov ecx, dword [esp + 0x418]
push edx
mov edx, dword [esp + 0x418]
push eax
mov eax, dword [esp + 0x418]
push ecx
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x420], 0x15
call fcn.005929d6
mov al, byte [esp + 0x420]
add esp, 0x20
cmp al, 0x15
je 0x56fda8
push str.GC_printf_clobbered_stack
call fcn.0056ff30
add esp, 4
push edi
call fcn.0056fce0
lea edi, [esp + 4]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
mov eax, dword [0x5ddd44]
push 0x5f134c
not ecx
dec ecx
lea edx, [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [0x5f1344], eax
pop edi
neg eax
sbb eax, eax
and eax, 2
dec eax
jns 0x56fdf2
push str.write_to_stdout_failed
call fcn.0056ff30
add esp, 4
add esp, 0x404
ret
Function at 0x56fe00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [esp + 0x420]
mov ecx, dword [esp + 0x41c]
mov edx, dword [esp + 0x418]
push eax
mov eax, dword [esp + 0x418]
push ecx
mov ecx, dword [esp + 0x418]
push edx
mov edx, dword [esp + 0x418]
push eax
mov eax, dword [esp + 0x418]
push ecx
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x420], 0x15
call fcn.005929d6
mov al, byte [esp + 0x420]
add esp, 0x20
cmp al, 0x15
je 0x56fe6b
push str.GC_err_printf_clobbered_stack
call fcn.0056ff30
add esp, 4
push edi
call fcn.0056fce0
lea edi, [esp + 4]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
mov eax, dword [0x5f1358]
push 0x5f134c
not ecx
dec ecx
lea edx, [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [0x5f1344], eax
pop edi
neg eax
sbb eax, eax
and eax, 2
dec eax
jns 0x56feb5
push str.write_to_stderr_failed
call fcn.0056ff30
add esp, 4
add esp, 0x404
ret

Function at 0x56fec0
Capabilities:
Write file on windows

Disassembly:
push edi
call fcn.0056fce0
mov edx, dword [esp + 8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x5f1358]
push 0
not ecx
dec ecx
push 0x5f134c
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [0x5f1344], eax
pop edi
neg eax
sbb eax, eax
and eax, 2
dec eax
jns 0x56ff06
push str.write_to_stderr_failed
call fcn.0056ff30
pop ecx
ret

Function at 0x5707b0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
lea eax, [ebx*8]
push eax
call fcn.0056e120
mov edx, dword [0x5ddd54]
add esp, 4
test edx, edx
mov esi, eax
mov dword [0x5ddd5c], 0
je 0x570833
test esi, esi
je 0x570857
mov ecx, dword [0x5f1330]
push edi
mov edi, dword [0x5f1340]
lea edx, [edx*8]
lea eax, [ecx - 1]
and eax, edi
je 0x570803
push ebp
mov ebp, ecx
sub ebp, eax
mov eax, ebp
pop ebp
dec ecx
sub edx, eax
not ecx
and ecx, edx
jle 0x570818
add edi, eax
push ecx
push edi
call fcn.0056eae0
add esp, 8
mov ecx, esi
mov dword [0x5f1340], esi
pop edi
add ecx, 0xfffffff8
mov dword [0x5ddd54], ebx
pop esi
mov dword [0x5f133c], ecx
pop ebx
ret
test esi, esi
jne 0x57084b
push str.No_space_for_mark_stack_n
call fcn.0056fec0
add esp, 4
push 1
call fcn.00593892
mov dword [0x5f1340], esi
mov dword [0x5ddd54], ebx
mov ecx, dword [0x5f1340]
pop esi
add ecx, 0xfffffff8
pop ebx
mov dword [0x5f133c], ecx
ret
Function at 0x571140
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push edi
mov ecx, dword [eax]
cmp ecx, 0xffffffff
lea edi, [ecx + 1]
mov dword [esp + 0x18], edi
jne 0x571162
mov dword [esp + 0xc], 0
jmp 0x57116d
mov eax, 1
shl eax, cl
mov dword [esp + 0xc], eax
mov eax, 1
mov ecx, edi
shl eax, cl
push 1
mov dword [esp + 0x18], eax
lea ecx, [eax*4]
push ecx
call fcn.00571c80
mov ebp, dword [esp + 0x28]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x5711a7
test ebp, ebp
jne 0x57120c
push str.Insufficient_space_for_initial_table_allocation
call fcn.0056ff30
add esp, 4
mov ecx, dword [esp + 0xc]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x10], eax
jbe 0x571203
push esi
mov edx, dword [ebp]
mov esi, dword [edx + eax*4]
test esi, esi
je 0x5711f5
lea ecx, [edi + 3]
mov eax, dword [esi]
mov edi, dword [esi + 4]
not eax
mov edx, eax
shr edx, cl
shr eax, 3
xor edx, eax
mov eax, dword [esp + 0x18]
dec eax
and edx, eax
test edi, edi
mov eax, dword [ebx + edx*4]
mov dword [esi + 4], eax
mov dword [ebx + edx*4], esi
mov esi, edi
jne 0x5711c3
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jb 0x5711b6
pop esi
mov ecx, dword [esp + 0x24]
mov dword [ecx], edi
mov dword [ebp], ebx
pop edi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x571e10
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 4]
mov dword [0x5f1330], ecx
add esp, 0x24
ret

Function at 0x571f10
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x40
lea eax, [esp + 0x1c]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x5f1330]
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 0x30]
lea esi, [ecx - 1]
not esi
and esi, edi
mov eax, esi
sub eax, ecx
cmp eax, esi
ja 0x571f6f
mov edi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp eax, ebx
jb 0x571f6f
lea ecx, [esp + 0xc]
push 0x1c
push ecx
push eax
call edi
cmp eax, 0x1c
jne 0x571f6f
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x571f6f
mov edx, dword [0x5f1330]
mov eax, ecx
sub eax, edx
mov esi, ecx
cmp eax, ecx
jbe 0x571f44
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x40
ret
Function at 0x572000
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [0x5ddd8c]
sub esp, 0x40
test eax, eax
push ebx
push ebp
push esi
je 0x5720c7
mov eax, dword [esp + 0x50]
push eax
call fcn.00571f10
add esp, 4
lea ecx, [esp + 0x28]
mov esi, eax
push ecx
mov ebp, esi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [esp + 0x34]
jae 0x5720c7
push edi
lea edx, [esp + 0x10]
push 0x1c
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp eax, 0x1c
jne 0x5720b6
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5720b6
push eax
call fcn.00571f80
add esp, 4
test eax, eax
jne 0x5720b6
mov eax, dword [esp + 0x1c]
lea edi, [eax + ebx]
mov eax, dword [esp + 0x20]
cmp eax, 0x1000
jne 0x5720a8
mov eax, dword [esp + 0x24]
cmp eax, 4
je 0x572090
cmp eax, 8
je 0x572090
cmp eax, 0x40
je 0x572090
cmp eax, 0x80
jne 0x5720a8
cmp ebx, esi
je 0x5720a6
cmp ebp, esi
je 0x5720a4
push 0
push esi
push ebp
call fcn.005723a0
add esp, 0xc
mov ebp, ebx
mov esi, edi
cmp ebx, edi
ja 0x5720b6
mov eax, dword [esp + 0x38]
mov ebx, edi
cmp edi, eax
jb 0x57203c
cmp ebp, esi
pop edi
je 0x5720c7
push 0
push esi
push ebp
call fcn.005723a0
add esp, 0xc
pop esi
pop ebp
pop ebx
add esp, 0x40
ret

Function at 0x572140
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x5ddd9c]
push ebp
test eax, eax
push edi
je 0x5721d2
mov eax, dword [0x5f1330]
mov edx, dword [esp + 0xc]
xor ebp, ebp
lea edi, [eax - 1]
not edi
and edi, edx
shr eax, 0xc
je 0x5721d2
push ebx
push esi
mov esi, edi
mov edx, eax
mov eax, esi
shr eax, 0xc
and eax, 0x3fff
mov ecx, eax
sar eax, 5
and ecx, 0x1f
lea eax, [eax*4 + 0x5f7cb8]
mov ebx, dword [eax]
shr ebx, cl
test bl, 1
jne 0x57219d
mov ebp, 1
mov ebx, ebp
shl ebx, cl
mov ecx, dword [eax]
or ebx, ecx
mov dword [eax], ebx
add esi, 0x1000
dec edx
jne 0x57216c
pop esi
pop ebx
test ebp, ebp
je 0x5721d2
mov edx, dword [0x5f1330]
push 0x5ddd84
push 0x40
push edx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x5721d2
push str.un_VirtualProtect_failed
call fcn.0056ff30
add esp, 4
pop edi
pop ebp
ret

Function at 0x5727d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x5dddb8]
test eax, eax
jne 0x572819
push 0x1000
call fcn.0056e120
add esp, 4
mov dword [0x5dddb8], eax
test eax, eax
jne 0x572803
push str.Cant_initialize_GC_invalid_map:_insufficient_memory_n
call fcn.0056fec0
add esp, 4
push 1
call fcn.00593892
xor ecx, ecx
jmp 0x57280c
mov eax, dword [0x5dddb8]
mov byte [eax + ecx], 0x7f
inc ecx
cmp ecx, 0x1000
jb 0x572807
mov eax, dword [esp + 4]
mov ecx, dword [0x5dddb8]
mov dword [eax + 0x10], ecx
ret
Function at 0x573300
Capabilities:
Terminate process

Disassembly:
push 0x800
call fcn.0056e120
push 0x800
mov dword [0x5f131c], eax
call fcn.0056e120
mov ecx, dword [0x5f131c]
add esp, 8
test ecx, ecx
mov dword [0x5f132c], eax
je 0x573399
test eax, eax
je 0x573399
push ecx
call fcn.005733b0
mov eax, dword [0x5f132c]
push eax
call fcn.005733b0
push 0x800
call fcn.0056e120
push 0x800
mov dword [0x5f1320], eax
call fcn.0056e120
mov ecx, dword [0x5f1320]
add esp, 0x10
test ecx, ecx
mov dword [0x5f1324], eax
je 0x573385
test eax, eax
je 0x573385
push ecx
call fcn.005733b0
mov ecx, dword [0x5f1324]
push ecx
call fcn.005733b0
add esp, 8
ret
push str.Insufficient_memory_for_black_list_n
call fcn.0056fec0
add esp, 4
push 1
call fcn.00593892
push str.Insufficient_memory_for_black_list_n
call fcn.0056fec0
add esp, 4
push 1
call fcn.00593892
nop
nop
nop

Function at 0x573a90
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [0x5ddd8c]
sub esp, 0x40
test eax, eax
jne 0x573b48
push ebx
push ebp
push esi
lea eax, [esp + 0x28]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x48]
cmp esi, eax
mov ebx, esi
mov ebp, esi
mov dword [0x5f1318], ecx
jae 0x573b3a
lea edx, [esp + 0x10]
push 0x1c
push edx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp eax, 0x1c
je 0x573ae9
push str.Weird_VirtualQuery_result
call fcn.0056ff30
add esp, 4
mov eax, dword [esp + 0x1c]
lea edi, [eax + esi]
mov eax, dword [esp + 0x20]
cmp eax, 0x1000
jne 0x573b2c
mov eax, dword [esp + 0x24]
cmp eax, 0x40
je 0x573b09
cmp eax, 4
jne 0x573b2c
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00571f80
add esp, 4
test eax, eax
jne 0x573b2c
cmp esi, ebx
je 0x573b2a
push ebx
push ebp
call fcn.00573a50
add esp, 8
mov ebp, esi
mov ebx, edi
cmp esi, edi
ja 0x573b3a
mov eax, dword [esp + 0x38]
mov esi, edi
cmp edi, eax
jb 0x573ac9
push ebx
push ebp
call fcn.00573a50
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x574bf1
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x5fbf2c]
cmp dword [eax + 0xf624], 0
je 0x574c3d
call fcn.0059607d
mov eax, dword [0x5fbf2c]
push dword [eax + 0xf668]
push str._n_nAbout_to_append_to_an_existing__s_disk._n
call fcn.005746d5
push eax
call fcn.004507f0
push str.Strike_any_key_when_ready...
call fcn.004507f0
call fcn.00450818
push 0x5c2bb0
call fcn.004507f0
add esp, 0x14
jmp 0x574c47
mov dword [eax + 0xf624], 1
mov eax, dword [0x5fbf2c]
push 0x8002
add eax, 0x33f
push eax
call fcn.005745b5
pop ecx
push eax
call fcn.005a0209
pop ecx
pop ecx
mov ecx, dword [0x5fbf2c]
mov dword [ecx + 0x2b4], eax
mov eax, dword [0x5fbf2c]
cmp dword [eax + 0x2b4], 0xffffffff
jne 0x574c9d
add eax, 0x33f
push eax
push str.Cant_open__s_n
call fcn.005746d5
push eax
call fcn.00574720
mov eax, dword [0x5fbf2c]
add esp, 0xc
lea ecx, [eax + 0x1b6]
push 0x5e
push ecx
push dword [eax + 0x2b4]
call fcn.0059a0e4
add esp, 0xc
cmp eax, 0x5e
je 0x574cd7
mov eax, dword [0x5fbf2c]
add eax, 0x33f
push eax
push str.Read_error_for_file__s_n
call fcn.005746d5
push eax
call fcn.00574720
add esp, 0xc
mov eax, dword [0x5fbf2c]
mov cx, word [eax + 0x1b6]
cmp cx, 4
je 0x574d05
movsx eax, cx
push eax
push str.This_backup_was_created_with_backup_version__d_n
call fcn.005746d5
push eax
call fcn.00574720
mov eax, dword [0x5fbf2c]
add esp, 0xc
cmp byte [eax + 0x1be], 0x59
je 0x574d2e
movsx eax, word [eax + 0x1b8]
push eax
push str._nThis_is_disk_number__d__not_the_last_disk____Cannot_append._n
call fcn.005746d5
push eax
call fcn.004507f0
add esp, 0xc
jmp fcn.00574bf1
push 2
push 0
push dword [eax + 0x2b4]
call fcn.00595983
add esp, 0xc
cmp eax, 0xffffffff
jne 0x574d63
mov eax, dword [0x5fbf2c]
add eax, 0x33f
push eax
push str.Seek_error_for_file__s_n
call fcn.005746d5
push eax
call fcn.00574720
add esp, 0xc
mov eax, dword [0x5fbf2c]
push dword [eax + 0x2b4]
call fcn.00598449
pop ecx
cdq
mov ecx, 0x800
idiv ecx
mov eax, dword [0x5fbf2c]
mov dword [eax + 0xf4f4], edx
mov eax, dword [0x5fbf2c]
mov cx, word [eax + 0x1b8]
mov word [eax + 0x3b8], cx
mov eax, dword [0x5fbf2c]
cmp dword [eax + 0xf634], 0
jne 0x574dc3
movsx eax, word [eax + 0x3b8]
push eax
push str._nThis_is_disk_number__d_n_n
call fcn.005746d5
push eax
call fcn.004507f0
add esp, 0xc
ret
Function at 0x5751ba
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5fbf2c]
and dword [ebp - 4], 0
push ebx
mov ebx, dword [eax + 0x2a8]
test ebx, ebx
je 0x575280
push esi
push edi
call fcn.00575549
cmp ebx, eax
mov esi, eax
jg 0x5751e5
mov esi, ebx
mov eax, dword [0x5fbf2c]
push esi
mov ecx, dword [eax + 0x3bc]
lea edi, [ecx + eax + 0x3c0]
push edi
push dword [eax + 0x2b0]
call fcn.0059a0e4
add esp, 0xc
cmp esi, eax
je 0x575229
mov eax, dword [0x5fbf2c]
add eax, 0x2c7
push eax
push str.Read_error_for_file__s_n
call fcn.005746d5
push eax
call fcn.00574720
add esp, 0xc
test esi, esi
je 0x57523a
mov eax, esi
movsx cx, byte [edi]
add dword [ebp - 4], ecx
inc edi
dec eax
jne 0x57522f
mov eax, dword [0x5fbf2c]
cmp dword [eax + 0xf630], 0
je 0x575270
xor ecx, ecx
cmp ebx, dword [eax + 0x2a8]
sete cl
push ecx
mov ecx, dword [eax + 0x3bc]
push esi
lea eax, [ecx + eax + 0x3c0]
push eax
call fcn.00577303
mov eax, dword [0x5fbf2c]
add esp, 0xc
add dword [eax + 0x3bc], esi
sub ebx, esi
jne 0x5751d8
pop edi
pop esi
mov eax, dword [0x5fbf2c]
pop ebx
cmp byte [eax + 0x2ac], 0x59
jne 0x575295
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.00575549
lea eax, [ebp - 4]
push 2
push eax
mov eax, dword [0x5fbf2c]
mov ecx, dword [eax + 0x3bc]
lea eax, [ecx + eax + 0x3c0]
push eax
call fcn.00593530
mov eax, dword [0x5fbf2c]
add esp, 0xc
add dword [eax + 0x3bc], 2
leave
ret