joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8850
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, ecx
mov esi, dword [esp + 0x18]
mov eax, dword [esi + 0x40]
mov dword [esp], eax
mov ebp, dword [esi + 0x44]
push ebp
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov edi, eax
xor eax, eax
test edi, edi
je 0x4b88af
push 0
push 0
push dword [ebx]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
movzx eax, word [esi + 0x20]
add eax, dword [esi + 0x58]
movzx ecx, word [esi + 0x22]
add eax, ecx
add eax, 0x1e
push 0
push eax
push dword [ebx]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
test eax, eax
je 0x4b88b9
push edi
call fcn.00439b84
add esp, 4
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
movzx eax, word [esi + 0x36]
cmp ax, 8
je 0x4b88dc
test ax, ax
jne 0x4b88a4
push dword [ebx]
push ebp
push 1
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, ebp
jne 0x4b88a4
jmp 0x4b88ef
push dword [esp]
push ebp
push edi
push dword [ebx]
call fcn.004909f0
add esp, 0x10
test al, al
je 0x4b88a4
mov eax, edi
jmp 0x4b88af
Function at 0x4bbd60
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov al, byte [0x57e3d0]
test al, al
je 0x4bbe64
push dword [0x57e3cc]
push dword [0x57e3c8]
push esi
push edi
call fcn.004bde60
add esp, 0x10
mov dword [esp + 0xc], eax
sub edi, eax
sbb esi, 0
mov eax, dword [ebp + 0x1c]
and eax, 2
add eax, 2
push 0
push 0
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x4bbe12
mov ebx, eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0xc]
add eax, ecx
mov ecx, dword [ebp + 0x1c]
test cl, 2
mov ecx, 4
mov edx, 0xf001f
cmove edx, ecx
push eax
push edi
push esi
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x4bbe4c
mov esi, eax
push 0x10
call fcn.004227e0
add esp, 4
mov dword [eax], esi
mov ecx, dword [ebp + 0x18]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
jmp 0x4bbe5c
cmp dword [ebp + 0x18], 0
jne 0x4bbe53
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ee
jne 0x4bbe53
push 0x10
call fcn.004227e0
add esp, 4
mov dword [eax], 0x560278
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
jmp 0x4bbe09
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov dword [eax], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x57e3d0
call fcn.0043e0b0
add esp, 4
test eax, eax
je 0x4bbd82
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x2c]
mov dword [0x57e3c8], eax
mov dword [0x57e3cc], 0
push 0x57e3d0
call fcn.0043e220
add esp, 4
jmp 0x4bbd82
Function at 0x4cd1c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, eax
je 0x4cd2a3
cmp byte [eax], 0x64
jne 0x4cd2a3
cmp ecx, 1
je 0x4cd2a3
movsx ecx, byte [eax + 1]
cmp ecx, 0x58
je 0x4cd2b1
cmp ecx, 0x78
je 0x4cd364
cmp ecx, 0x69
jne 0x4cd2a3
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.004d0250
xor edi, edi
test eax, eax
je 0x4cd3f1
mov ebx, eax
mov ecx, esi
call fcn.004cd1c0
test eax, eax
je 0x4cd3f1
mov ebp, eax
mov edi, dword [esi + 0x116c]
mov ecx, dword [edi + 4]
lea eax, [ecx - 0xfd8]
cmp eax, 0xfffff007
ja 0x4cd26c
push 0x1000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x4cd3fb
mov dword [eax], edi
mov dword [eax + 4], 0
mov dword [esi + 0x116c], eax
xor ecx, ecx
mov edi, eax
add ecx, 0x20
mov dword [edi + 4], ecx
mov eax, dword [esi + 0x116c]
mov ecx, dword [eax + 4]
lea edi, [eax + ecx]
add edi, 0xffffffe8
mov dword [eax + ecx - 0x14], 0x1010141
mov dword [eax + ecx - 0x18], 0x564b84
mov dword [eax + ecx - 0x10], ebx
mov dword [eax + ecx - 0xc], ebp
mov byte [eax + ecx - 8], 0
jmp 0x4cd3f1
mov ecx, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004ca270
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.004ca270
xor edi, edi
test eax, eax
je 0x4cd3f1
mov ebx, eax
mov ecx, esi
call fcn.004ca270
test eax, eax
je 0x4cd3f1
mov ebp, eax
mov ecx, esi
call fcn.004cd1c0
test eax, eax
je 0x4cd3f1
mov edi, dword [esi + 0x116c]
mov ecx, dword [edi + 4]
lea edx, [ecx - 0xfd8]
cmp edx, 0xfffff007
ja 0x4cd32e
mov dword [esp], eax
push 0x1000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x4cd3fb
mov dword [eax], edi
mov dword [eax + 4], 0
mov dword [esi + 0x116c], eax
xor ecx, ecx
mov edi, eax
mov eax, dword [esp]
add ecx, 0x20
mov dword [edi + 4], ecx
mov edx, dword [esi + 0x116c]
mov ecx, dword [edx + 4]
lea edi, [edx + ecx]
add edi, 0xffffffe8
mov dword [edx + ecx - 0x14], 0x1010142
mov dword [edx + ecx - 0x18], 0x564bf0
mov dword [edx + ecx - 0x10], ebx
mov dword [edx + ecx - 0xc], ebp
mov dword [edx + ecx - 8], eax
jmp 0x4cd3f1
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.004ca270
xor edi, edi
test eax, eax
je 0x4cd3f1
mov ebx, eax
mov ecx, esi
call fcn.004cd1c0
test eax, eax
je 0x4cd3f1
mov ebp, eax
mov edi, dword [esi + 0x116c]
mov ecx, dword [edi + 4]
lea eax, [ecx - 0xfd8]
cmp eax, 0xfffff007
ja 0x4cd3bf
push 0x1000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x4cd3fb
mov dword [eax], edi
mov dword [eax + 4], 0
mov dword [esi + 0x116c], eax
xor ecx, ecx
mov edi, eax
add ecx, 0x20
mov dword [edi + 4], ecx
mov eax, dword [esi + 0x116c]
mov ecx, dword [eax + 4]
lea edi, [eax + ecx]
add edi, 0xffffffe8
mov dword [eax + ecx - 0x14], 0x1010141
mov dword [eax + ecx - 0x18], 0x564b84
mov dword [eax + ecx - 0x10], ebx
mov dword [eax + ecx - 0xc], ebp
mov byte [eax + ecx - 8], 1
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00485220
Function at 0x4d6778
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x57d170
call fcn.004d6592
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x4d67a4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x4d67e6
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str._buildbot_src_android_mingw_toolchain_mingw_mingw_w64_v6.x_mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call fcn.00486b40
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x57d170
call fcn.004d65f0
mov eax, dword [ebp + 0xc]
leave
ret
Function at 0x4e1d10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x6c]
mov edi, dword [esp + 0x68]
mov dword [esp + 8], ecx
mov ecx, dword [ecx + 0xc]
call fcn.0048dbe0
mov ebx, eax
mov eax, dword [ebp]
mov dword [esp], eax
mov ecx, ebp
call fcn.0041e000
mov dword [esp + 0x10], eax
mov eax, dword [esi]
mov dword [esp + 0xc], eax
mov ecx, esi
call fcn.0041e000
mov ebp, eax
mov esi, dword [edi]
mov ecx, edi
call fcn.0041e000
mov ecx, ebx
push 0
push eax
push esi
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x24]
push dword [esp + 0x18]
call fcn.00413050
xor esi, esi
test eax, eax
jne 0x4e1edc
mov al, byte [esp + 0x88]
mov edx, dword [esp + 0x84]
mov dword [esp + 4], 0
movzx esi, al
lea ecx, [esp + 4]
push 0
push edx
push esi
push dword [esp + 0x70]
push dword [esp + 0x80]
push dword [esp + 0x80]
push dword [esp + 0x80]
mov eax, dword [esp + 0x24]
push eax
call fcn.004e8650
mov ebx, dword [esp + 4]
test ebx, ebx
je 0x4e1ed7
mov dword [esp], esi
mov esi, dword [esp + 0x74]
mov ecx, esi
call fcn.0041e000
test eax, eax
je 0x4e1de7
lea ecx, [ebx + 0xc]
push esi
call fcn.0041e040
lea edi, [esp + 0x14]
mov ecx, edi
push dword [esp + 0x78]
call fcn.0041dba0
lea ecx, [esp + 0x18]
call fcn.004b67f0
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x24]
call fcn.0041db90
lea esi, [esp + 0x28]
mov ecx, esi
push 0
push 0x10
call fcn.0041f240
mov dword [esp + 0x28], 0x566a90
mov dword [esp + 0x3c], 0xffff
mov dword [esp + 0x40], 0
mov byte [esp + 0x44], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
lea ecx, [ebx + 0x50]
push edi
call fcn.00420200
mov ebp, eax
mov dword [esp + 0x28], 0x566a90
mov ecx, esi
call fcn.0041ff60
mov ecx, esi
call fcn.0041f2b0
lea ecx, [esp + 0x24]
call fcn.0041da60
lea ecx, [esp + 0x18]
call fcn.004b6810
mov ecx, edi
call fcn.0041da60
movzx eax, byte [esp + 0x8c]
mov ecx, ebx
push dword [esp + 0x90]
push eax
push dword [esp + 8]
push dword [esp + 0x8c]
push dword [esp + 0x8c]
push dword [esp + 0x8c]
push dword [esp + 0x7c]
call fcn.004e89c0
mov esi, eax
test ebp, ebp
jns 0x4e1ec9
test esi, esi
jne 0x4e1ec9
mov eax, dword [esp + 8]
add dword [eax + 0x40], 1
mov ecx, ebx
lea eax, [esp + 4]
push eax
call fcn.0041c020
jmp 0x4e1edc
mov esi, 0x80000000
mov eax, esi
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret 0x30
Function at 0x4fce50
Capabilities:
Enumerate pe sections
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov edi, ecx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [esp + 0x1e], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov eax, esp
push ebx
push 0x2e
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
mov esi, 0x80000000
cmp eax, 0x2e
jne 0x4fcfe4
cmp dword [esp], 0x2014b50
jne 0x4fcfd0
movzx eax, word [esp + 4]
mov word [edi + 4], ax
movzx eax, word [esp + 6]
mov word [edi + 6], ax
movzx eax, word [esp + 8]
mov word [edi + 8], ax
movzx eax, word [esp + 0xa]
mov word [edi + 0xa], ax
movzx eax, word [esp + 0xc]
mov word [edi + 0xc], ax
movzx eax, word [esp + 0xe]
mov word [edi + 0xe], ax
mov eax, dword [esp + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x18], eax
movzx ecx, word [esp + 0x1c]
mov word [edi + 0x1c], cx
movzx eax, word [esp + 0x1e]
mov word [edi + 0x1e], ax
movzx edx, word [esp + 0x20]
mov word [edi + 0x20], dx
movzx edx, word [esp + 0x22]
mov word [edi + 0x22], dx
movzx edx, word [esp + 0x24]
mov word [edi + 0x24], dx
mov edx, dword [esp + 0x26]
mov dword [edi + 0x28], edx
mov edx, dword [esp + 0x2a]
mov dword [edi + 0x2c], edx
test ecx, ecx
je 0x4fcf5e
add ecx, 1
push ecx
call fcn.004228d0
add esp, 4
mov dword [edi + 0x30], eax
movzx ecx, word [edi + 0x1c]
push ebx
push ecx
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
movzx ecx, word [edi + 0x1c]
cmp eax, ecx
jne 0x4fcfe4
mov ecx, dword [edi + 0x30]
mov byte [ecx + eax], 0
movzx eax, word [edi + 0x1e]
test ax, ax
je 0x4fcf95
movzx eax, ax
add eax, 1
push eax
call fcn.004228d0
add esp, 4
mov dword [edi + 0x34], eax
movzx ecx, word [edi + 0x1e]
push ebx
push ecx
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
movzx ecx, word [edi + 0x1e]
cmp eax, ecx
jne 0x4fcfe4
mov ecx, dword [edi + 0x34]
mov byte [ecx + eax], 0
movzx eax, word [edi + 0x20]
test eax, eax
je 0x4fcfcc
add eax, 1
push eax
call fcn.004228d0
add esp, 4
mov dword [edi + 0x38], eax
movzx ecx, word [edi + 0x20]
push ebx
push ecx
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
movzx ecx, word [edi + 0x20]
cmp eax, ecx
jne 0x4fcfe4
mov ecx, dword [edi + 0x38]
mov byte [ecx + eax], 0
xor esi, esi
jmp 0x4fcfe4
push str.Whoops:_didnt_find_expected_signature_n
push 0x56adc8
push 3
call fcn.00420f20
add esp, 0xc
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4fcff0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov edi, ecx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [esp + 0xe], xmm0
movaps xmmword [esp], xmm0
mov eax, esp
push ebx
push 0x1e
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
mov esi, 0x80000000
cmp eax, 0x1e
jne 0x4fd112
cmp dword [esp], 0x4034b50
jne 0x4fd0fe
movzx eax, word [esp + 4]
mov word [edi + 4], ax
movzx eax, word [esp + 6]
mov word [edi + 6], ax
movzx eax, word [esp + 8]
mov word [edi + 8], ax
movzx eax, word [esp + 0xa]
mov word [edi + 0xa], ax
movzx eax, word [esp + 0xc]
mov word [edi + 0xc], ax
mov eax, dword [esp + 0xe]
mov dword [edi + 0x10], eax
mov eax, dword [esp + 0x12]
mov dword [edi + 0x14], eax
mov eax, dword [esp + 0x16]
mov dword [edi + 0x18], eax
movzx ecx, word [esp + 0x1a]
mov word [edi + 0x1c], cx
movzx eax, word [esp + 0x1c]
mov word [edi + 0x1e], ax
test ecx, ecx
je 0x4fd0c3
add ecx, 1
push ecx
call fcn.004228d0
add esp, 4
mov dword [edi + 0x20], eax
movzx ecx, word [edi + 0x1c]
push ebx
push ecx
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
movzx ecx, word [edi + 0x1c]
cmp eax, ecx
jne 0x4fd112
mov ecx, dword [edi + 0x20]
mov byte [ecx + eax], 0
movzx eax, word [edi + 0x1e]
test ax, ax
je 0x4fd0fa
movzx eax, ax
add eax, 1
push eax
call fcn.004228d0
add esp, 4
mov dword [edi + 0x24], eax
movzx ecx, word [edi + 0x1e]
push ebx
push ecx
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
movzx ecx, word [edi + 0x1e]
cmp eax, ecx
jne 0x4fd112
mov ecx, dword [edi + 0x24]
mov byte [ecx + eax], 0
xor esi, esi
jmp 0x4fd112
push str.whoops:_didnt_find_expected_signature_n
push 0x56adc8
push 3
call fcn.00420f20
add esp, 0xc
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4fd920
Capabilities:
Enumerate pe sections
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov esi, ecx
mov ebx, dword [esp + 0x40]
mov dword [esp + 2], 0x2014b50
movzx eax, word [ecx + 4]
mov word [esp + 6], ax
movzx eax, word [ecx + 6]
mov word [esp + 8], ax
movzx eax, word [ecx + 8]
mov word [esp + 0xa], ax
movzx eax, word [ecx + 0xa]
mov word [esp + 0xc], ax
movzx eax, word [ecx + 0xc]
mov word [esp + 0xe], ax
movzx eax, word [ecx + 0xe]
mov word [esp + 0x10], ax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x12], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x16], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x1a], eax
movzx eax, word [ecx + 0x1c]
mov word [esp + 0x1e], ax
movzx eax, word [ecx + 0x1e]
mov word [esp + 0x20], ax
movzx eax, word [ecx + 0x20]
mov word [esp + 0x22], ax
movzx eax, word [ecx + 0x22]
mov word [esp + 0x24], ax
movzx eax, word [ecx + 0x24]
mov word [esp + 0x26], ax
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x28], eax
mov eax, dword [ecx + 0x2c]
mov dword [esp + 0x2c], eax
lea eax, [esp + 2]
push ebx
push 0x2e
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
mov edi, 0x80000000
cmp eax, 0x2e
jne 0x4fda35
movzx eax, word [esi + 0x1c]
test eax, eax
je 0x4fd9f5
push ebx
push eax
push 1
push dword [esi + 0x30]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
movzx ecx, word [esi + 0x1c]
cmp eax, ecx
jne 0x4fda35
movzx eax, word [esi + 0x1e]
test eax, eax
je 0x4fda14
push ebx
push eax
push 1
push dword [esi + 0x34]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
movzx ecx, word [esi + 0x1e]
cmp eax, ecx
jne 0x4fda35
movzx eax, word [esi + 0x20]
test eax, eax
je 0x4fda33
push ebx
push eax
push 1
push dword [esi + 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
movzx ecx, word [esi + 0x20]
cmp eax, ecx
jne 0x4fda35
xor edi, edi
mov eax, edi
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
Function at 0x4fde80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov eax, 0xfffffffe
test esi, esi
je case.0x4fdebb.58
cmp dword [esi + 0x20], 0
je case.0x4fdebb.58
mov edx, dword [esi + 0x24]
test edx, edx
je case.0x4fdebb.58
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je case.0x4fdebb.58
cmp dword [ecx], esi
je 0x4fdeac
pop esi
pop edi
pop ebx
ret
mov edi, dword [ecx + 4]
lea ebx, [edi - 0x39]
cmp ebx, 0x38
ja case.default.0x4fdebb
jmp dword [ebx*4 + 0x56b040]
mov eax, dword [ecx + 8]
test eax, eax
je 0x4fded5
push eax
push dword [esi + 0x28]
call edx
add esp, 8
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx + 0x94]
test eax, eax
je 0x4fdeec
push eax
push dword [esi + 0x28]
call dword [esi + 0x24]
add esp, 8
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx + 0x90]
test eax, eax
je 0x4fdf03
push eax
push dword [esi + 0x28]
call dword [esi + 0x24]
add esp, 8
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx + 0x88]
test eax, eax
je 0x4fdf1a
push eax
push dword [esi + 0x28]
call dword [esi + 0x24]
add esp, 8
mov ecx, dword [esi + 0x1c]
push ecx
push dword [esi + 0x28]
call dword [esi + 0x24]
add esp, 8
mov dword [esi + 0x1c], 0
xor eax, eax
cmp edi, 0x71
setne al
lea eax, [eax + eax*2]
add eax, 0xfffffffd
pop esi
pop edi
pop ebx
ret
cmp edi, 0x29a
je case.0x4fdebb.57
cmp edi, 0x2a
jne case.0x4fdebb.58
jmp case.0x4fdebb.57
Function at 0x506980
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, edx
mov esi, ecx
mov dword [ecx + 0x114], 0x508c90
lea eax, [ecx + 0xfc]
push eax
call fcn.0053b030
add esp, 4
test edi, edi
je 0x5069d7
xor ebp, ebp
nop word [eax + eax]
cmp byte [edi + ebp], 0
lea ebp, [ebp + 1]
jne 0x5069b0
push ebp
call dword [esi + 0xc]
add esp, 4
mov ebx, eax
test eax, eax
je 0x5069d1
push ebp
push edi
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [esi + 0xe4], ebx
mov dword [esi + 0x164], 0
lea eax, [esi + 0x94]
lea ecx, [esi + 0x90]
push 0
push ecx
push eax
call fcn.00530ef0
add esp, 0xc
mov dword [esi], 0
mov dword [esi + 4], 0
xorps xmm0, xmm0
movups xmmword [esi + 0x34], xmm0
movups xmmword [esi + 0x44], xmm0
movups xmmword [esi + 0x54], xmm0
movups xmmword [esi + 0x64], xmm0
mov dword [esi + 0x74], esi
mov dword [esi + 0x78], 0
movups xmmword [esi + 0x80], xmm0
mov eax, dword [esi + 8]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x198], 0
mov dword [esi + 0x194], 0
movups xmmword [esi + 0x118], xmm0
mov dword [esi + 0x128], 0
movups xmmword [esi + 0x138], xmm0
movups xmmword [esi + 0x148], xmm0
mov dword [esi + 0x156], 0
mov dword [esi + 0x15a], 0
mov byte [esi + 0x130], 1
mov dword [esi + 0x134], 0
mov dword [esi + 0x168], 0
mov dword [esi + 0x170], 0
mov dword [esi + 0x17c], 0
mov dword [esi + 0xec], 0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xf0], 0
mov dword [esi + 0x1d8], 0
mov dword [esi + 0x1dc], 0
mov word [esi + 0x1e4], 0
movups xmmword [esi + 0x1e8], xmm0
movups xmmword [esi + 0x1f8], xmm0
mov dword [esi + 0x208], 0
mov dword [esi + 0x20c], 0
push str.EXPAT_ACCOUNTING_DEBUG
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
xor edi, edi
mov ebx, 0
test eax, eax
je 0x506b6e
mov ebp, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0
mov dword [esp], ebp
mov eax, esp
push 0xa
push eax
push ebp
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov ebx, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0
jne 0x506b60
mov eax, dword [esp]
cmp byte [eax], 0
je 0x506b6e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0
xor ebx, ebx
mov dword [esi + 0x200], ebx
mov dword [esi + 0x204], 0x42c80000
mov dword [esi + 0x20c], 0
mov dword [esi + 0x208], 0x800000
xorps xmm0, xmm0
movups xmmword [esi + 0x210], xmm0
push str.EXPAT_ENTITY_DEBUG
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x506bf1
mov ebx, eax
mov ebp, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call ebp
mov dword [eax], 0
mov dword [esp + 4], ebx
lea eax, [esp + 4]
push 0xa
push eax
push ebx
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov edi, eax
call ebp
cmp dword [eax], 0
jne 0x506be3
mov eax, dword [esp + 4]
cmp byte [eax], 0
je 0x506bf1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0
xor edi, edi
mov dword [esi + 0x21c], edi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x512bd0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, edx
mov edi, ecx
push str.EXPAT_ENTROPY_DEBUG
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x512c28
mov ebx, eax
mov ebp, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call ebp
mov dword [eax], 0
mov dword [esp], ebx
mov eax, esp
push 0xa
push eax
push ebx
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov ebx, eax
call ebp
cmp dword [eax], 0
jne 0x512c1c
mov eax, dword [esp]
cmp byte [eax], 0
je 0x512c32
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
je 0x512c28
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push 4
push esi
push 8
push edi
push str.expat:_Entropy:__s_____0x_0lx___lu_bytes__n
push eax
call fcn.0050e880
add esp, 0x18
jmp 0x512c28

Function at 0x515990
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov bl, byte [esp + 0x2c]
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [esp], 0
mov esi, esp
mov ecx, esi
push eax
call fcn.0041dba0
mov ecx, esi
push ebp
call fcn.0041e250
mov ecx, esi
push edi
call fcn.0041e250
mov eax, 0x57ef30
mov edx, 0x57ef34
test bl, bl
cmovne edx, eax
mov ecx, esi
push edx
call fcn.0041e250
mov ebx, dword [esp]
movzx edx, word [ebx]
test dx, dx
je 0x515a19
lea ecx, [ebx + 2]
mov esi, 0x1505
mov eax, esi
nop word cs:[eax + eax]
nop
movzx edx, dx
shl eax, 5
add eax, esi
add eax, edx
movzx edx, word [ecx]
add ecx, 2
mov esi, eax
test dx, dx
jne 0x515a00
jmp 0x515a1e
mov eax, 0x1505
mov dword [esp + 8], eax
mov ecx, dword [0x57ef3c]
test ecx, ecx
je 0x515a5f
mov ebp, 0x57ef3c
nop word cs:[eax + eax]
nop dword [eax + eax]
xor edx, edx
cmp dword [ecx + 0x10], eax
setb dl
cmovae ebp, ecx
mov ecx, dword [ecx + edx*4]
test ecx, ecx
jne 0x515a40
cmp ebp, 0x57ef3c
je 0x515a5f
cmp eax, dword [ebp + 0x10]
jae 0x515a79
add dword [0x57ef44], 1
xor esi, esi
mov ecx, esp
call fcn.0041da60
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp + 0x14]
mov ecx, esp
call fcn.0041e000
mov dword [esp + 4], eax
mov edi, dword [ebp + 0x14]
mov ecx, esi
call fcn.0041e000
push eax
push edi
push dword [esp + 0xc]
push ebx
call fcn.0041ed00
add esp, 0x10
test eax, eax
je 0x515abc
add dword [0x57ef4c], 1
lea eax, [esp + 8]
mov ecx, 0x57ef38
push eax
call fcn.00515d20
jmp 0x515a66
add dword [0x57ef48], 1
mov esi, dword [ebp + 0x18]
jmp 0x515a68