joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5aac00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61a83d
mov eax, dword fs:[0]
push eax
sub esp, 0x104
mov eax, dword [0x6e377c]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6e377c]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov edi, dword [esp + 0x128]
xor ebx, ebx
mov esi, ecx
mov ecx, edi
mov dword [esp + 0x120], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], ebx
call fcn.00511750
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
lea ecx, [esp + 0x1c]
push ecx
mov ebp, 1
mov ecx, esi
mov dword [esp + 0x124], ebx
mov dword [esp + 0x24], ebp
call edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, 0xdc
mov word [esp + 0x7c], cx
lea ecx, [esp + 0x38]
push ecx
push ebx
xor edx, edx
push eax
mov dword [esp + 0x12c], ebp
mov dword [esp + 0x30], eax
mov word [esp + 0x8a], dx
mov dword [esp + 0x24], ebx
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
test eax, eax
je 0x5aad5e
mov esi, dword [esp + 0x12c]
mov ecx, dword [esp + 0xf0]
mov edi, dword [esp + 0xe8]
mov ebp, dword [esp + 0xe0]
mov edx, 1
cmp edx, ecx
mov edx, dword [esp + 0xe4]
sbb eax, eax
and eax, ecx
mov ecx, dword [esi]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
cmp ecx, ebx
je 0x5aad07
cmp edx, ecx
jne 0x5aad38
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x5aad12
cmp edi, ecx
jne 0x5aad38
mov ecx, dword [esi + 8]
cmp ecx, ebx
je 0x5aad1d
cmp ebp, ecx
jne 0x5aad38
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x5aad28
cmp eax, ecx
jl 0x5aad38
mov ecx, dword [esp + 0x14]
push 1
lea eax, [esp + 0x2c]
push eax
call fcn.00596f80
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x38]
inc eax
push ecx
push eax
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
test eax, eax
jne 0x5aacc6
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x120], bl
cmp eax, 0xffffffff
je 0x5aad80
dec eax
mov dword [ecx], eax
cmp eax, ebx
jne 0x5aad80
call fcn.0050ec00
mov eax, edi
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.005bae23
add esp, 0x110
ret 8
Function at 0x5ab6c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x61a981
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6e377c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
mov esi, dword [esp + 0x28]
push esi
call fcn.00545860
mov dword [edi], vtable.wxNotifyEvent.0
movzx eax, byte [esi + 0x38]
mov byte [edi + 0x38], al
mov dword [edi], vtable.wxTreeEvent.0
mov ecx, dword [0x6f2e9c]
lea ebx, [edi + 0x3c]
push ecx
xor ebp, ebp
mov ecx, ebx
mov dword [esp + 0x24], ebp
call fcn.00545710
mov dword [edi + 0x7c], ebp
mov dword [edi + 0x80], ebp
mov dword [edi + 0x84], ebp
mov dword [edi + 0x88], ebp
mov edx, dword [0x6db93c]
lea ecx, [edi + 0x8c]
mov dword [ecx], edx
mov eax, dword [esi + 0x60]
mov dword [ebx + 0x24], eax
mov edx, dword [esi + 0x64]
mov dword [ebx + 0x28], edx
mov eax, dword [esi + 0x68]
mov dword [ebx + 0x2c], eax
movzx edx, byte [esi + 0x6c]
mov byte [ebx + 0x30], dl
movzx eax, byte [esi + 0x6d]
mov byte [ebx + 0x31], al
movzx edx, byte [esi + 0x6e]
mov byte [ebx + 0x32], dl
movzx eax, byte [esi + 0x6f]
mov byte [ebx + 0x33], al
movzx edx, byte [esi + 0x70]
mov byte [ebx + 0x34], dl
mov eax, dword [esi + 0x74]
mov dword [ebx + 0x38], eax
mov edx, dword [esi + 0x78]
mov dword [ebx + 0x3c], edx
mov ax, word [esi + 0x72]
mov word [ebx + 0x36], ax
mov edx, dword [esi + 0x7c]
mov dword [edi + 0x7c], edx
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
mov edx, dword [esi + 0x84]
mov dword [edi + 0x84], edx
mov eax, dword [esi + 0x88]
lea edx, [esi + 0x8c]
push edx
mov byte [esp + 0x24], 2
mov dword [edi + 0x88], eax
call fcn.0050f610
movzx eax, byte [esi + 0x90]
mov byte [edi + 0x90], al
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4

Function at 0x5ab880
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x61a9a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6e377c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esi + 4], edi
lea ecx, [esi + 0x10]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.wxDragImage.0
call fcn.0057b7a0
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov ecx, esi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call fcn.005ab870
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x5abf00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x61aa0b
mov eax, dword fs:[0]
push eax
sub esp, 0x100
push esi
mov eax, dword [0x6e377c]
xor eax, esp
push eax
lea eax, [esp + 0x108]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x18]
push eax
lea ecx, [esp + 0xc]
call fcn.00557610
mov edx, dword [esi]
mov edx, dword [edx + 0x34]
lea eax, [esp + 8]
push eax
mov ecx, esi
mov dword [esp + 0x114], 0
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call edx
lea ecx, [esp + 8]
mov dword [esp + 0x110], 0xffffffff
call fcn.00557300
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10c
ret 4
Function at 0x5ad360
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61ab28
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6e377c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00515920
xor ecx, ecx
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi], vtable.wxTimerBase.0
mov dword [esi + 0x30], ecx
mov byte [esi + 0x34], cl
mov dword [esi + 0x28], esi
mov eax, dword [0x6de040]
dec eax
mov dword [0x6de040], eax
mov dword [esi + 0x2c], eax
mov dword [esp + 0x14], ecx
mov ecx, esi
mov dword [esi], vtable.wxTimer.0
call fcn.005b3950
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x5b521b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x5b524c
call fcn.005bcc92
mov dword [eax], esi
call fcn.005bcc7f
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005b5425
add esp, 0x14
push 0x16
pop eax
jmp 0x5b52a1
test dword [ebp + 0xc], 0xfffffff9
jne 0x5b5228
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5b5279
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005bcca5
pop ecx
call fcn.005bcc7f
mov eax, dword [eax]
jmp 0x5b52a1
test al, 0x10
jne 0x5b529f
test al, 1
je 0x5b529f
test byte [ebp + 0xc], 2
je 0x5b529f
call fcn.005bcc92
mov dword [eax], 5
call fcn.005bcc7f
mov dword [eax], 0xd
jmp 0x5b5270
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5b96c5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x5b96f6
call fcn.005bcc92
mov dword [eax], esi
call fcn.005bcc7f
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005b5425
add esp, 0x14
push 0x16
pop eax
jmp 0x5b974b
test dword [ebp + 0xc], 0xfffffff9
jne 0x5b96d2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5b9723
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005bcca5
pop ecx
call fcn.005bcc7f
mov eax, dword [eax]
jmp 0x5b974b
test al, 0x10
jne 0x5b9749
test al, 1
je 0x5b9749
test byte [ebp + 0xc], 2
je 0x5b9749
call fcn.005bcc92
mov dword [eax], 5
call fcn.005bcc7f
mov dword [eax], 0xd
jmp 0x5b971a
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5bae23
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6e377c]
jne 0x5bae2d
repz ret
jmp fcn.005ce5fd
Function at 0x5d73e2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005c5326
and dword [ebp - 4], 0
cmp dword [0x718c14], 0
mov ebx, eax
jne 0x5d7493
push 0x66a454
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x5d7544
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x66a448
push edi
call esi
test eax, eax
je 0x5d7544
push eax
call fcn.005c52b4
mov dword [esp], 0x66a438
push edi
mov dword [0x718c14], eax
call esi
push eax
call fcn.005c52b4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x718c18], eax
call esi
push eax
call fcn.005c52b4
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x718c1c], eax
call esi
push eax
call fcn.005c52b4
pop ecx
mov dword [0x718c24], eax
test eax, eax
je 0x5d7493
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005c52b4
pop ecx
mov dword [0x718c20], eax
mov eax, dword [0x718c20]
cmp eax, ebx
je 0x5d74eb
cmp dword [0x718c24], ebx
je 0x5d74eb
push eax
call fcn.005c532f
push dword [0x718c24]
mov esi, eax
call fcn.005c532f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5d74eb
test edi, edi
je 0x5d74eb
call esi
test eax, eax
je 0x5d74e2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5d74e2
test byte [ebp - 0xc], 1
jne 0x5d74eb
or dword [ebp + 0x10], 0x200000
jmp 0x5d7524
mov eax, dword [0x718c18]
cmp eax, ebx
je 0x5d7524
push eax
call fcn.005c532f
pop ecx
test eax, eax
je 0x5d7524
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5d7524
mov eax, dword [0x718c1c]
cmp eax, ebx
je 0x5d7524
push eax
call fcn.005c532f
pop ecx
test eax, eax
je 0x5d7524
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x718c14]
call fcn.005c532f
pop ecx
test eax, eax
je 0x5d7544
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5d7546
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5dc9e4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005c5326
and dword [ebp - 4], 0
cmp dword [0x718c98], 0
mov ebx, eax
jne 0x5dca95
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5dcb46
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x66aef0
push edi
call esi
test eax, eax
je 0x5dcb46
push eax
call fcn.005c52b4
mov dword [esp], 0x66a438
push edi
mov dword [0x718c98], eax
call esi
push eax
call fcn.005c52b4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x718c9c], eax
call esi
push eax
call fcn.005c52b4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x718ca0], eax
call esi
push eax
call fcn.005c52b4
pop ecx
mov dword [0x718ca8], eax
test eax, eax
je 0x5dca95
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005c52b4
pop ecx
mov dword [0x718ca4], eax
mov eax, dword [0x718ca4]
cmp eax, ebx
je 0x5dcaed
cmp dword [0x718ca8], ebx
je 0x5dcaed
push eax
call fcn.005c532f
push dword [0x718ca8]
mov esi, eax
call fcn.005c532f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5dcaed
test edi, edi
je 0x5dcaed
call esi
test eax, eax
je 0x5dcae4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5dcae4
test byte [ebp - 0xc], 1
jne 0x5dcaed
or dword [ebp + 0x10], 0x200000
jmp 0x5dcb26
mov eax, dword [0x718c9c]
cmp eax, ebx
je 0x5dcb26
push eax
call fcn.005c532f
pop ecx
test eax, eax
je 0x5dcb26
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5dcb26
mov eax, dword [0x718ca0]
cmp eax, ebx
je 0x5dcb26
push eax
call fcn.005c532f
pop ecx
test eax, eax
je 0x5dcb26
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x718c98]
call fcn.005c532f
pop ecx
test eax, eax
je 0x5dcb46
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5dcb48
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5e3a00
Capabilities:
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x61b5b3
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6e377c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.EL_TPointerSingleton_class_EL_Environment_.0
mov dword [0x71c210], esi
lea eax, [esp + 0xb]
push eax
lea edx, [esp + 0xf]
lea ecx, [esi + 8]
push edx
mov dword [esp + 0x20], 0
mov dword [esi + 4], vtable.EL_TStringTable_wchar_t__32_.0
call fcn.005e3540
mov eax, 7
xor ecx, ecx
mov dword [esi + 0x68], eax
mov dword [esi + 0x64], 0
mov word [esi + 0x54], cx
xor edx, edx
lea ecx, [esi + 0x90]
mov dword [esi], vtable.EL_Environment.1.0
mov dword [esi + 4], vtable.EL_Environment.0
push edx
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], 0
push 0x683698
mov byte [esp + 0x20], 1
mov word [ecx + 4], dx
call fcn.0040302e
lea eax, [esi + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret

Function at 0x5e3c20
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x6e377c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, dword [0x6e4d0c]
push ebx
push esi
push edi
jle 0x5e3c54
xor al, al
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bae23
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x10]
test eax, eax
jl 0x5e3c78
mov eax, dword [0x7194c8]
test eax, eax
je 0x5e3c9d
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 8]
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x5e3c9d
mov eax, dword [0x7194cc]
test eax, eax
je 0x5e3c93
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 8]
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ebx, [edi*4]
lea eax, [ebx + 8]
cmp eax, 0x400
ja 0x5e3cc4
call fcn.005c9ee0
mov esi, esp
test esi, esi
je 0x5e3cdc
mov dword [esi], 0xcccc
add esi, 8
jmp 0x5e3cdc
push eax
call fcn.005b57b0
add esp, 4
test eax, eax
je 0x5e3cda
mov dword [eax], 0xdddd
add eax, 8
mov esi, eax
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
push ecx
call fcn.00420bf0
add esp, 0x10
cmp dword [ebp + 8], 0xffffffff
jne 0x5e3d0e
mov ecx, dword [0x718cc4]
test ecx, ecx
je 0x5e3d0e
push ecx
push 1
push eax
push esi
call fcn.005ba135
mov edx, dword [0x718cc4]
push edx
jmp 0x5e3d28
mov ecx, dword [0x718cc0]
test ecx, ecx
je 0x5e3d30
push ecx
push 1
push eax
push esi
call fcn.005ba135
mov eax, dword [0x718cc0]
push eax
call fcn.005ba4f2
add esp, 0x14
test esi, esi
je 0x5e3d49
cmp dword [esi - 8], 0xdddd
lea eax, [esi - 8]
jne 0x5e3d49
push eax
call fcn.005b5a6b
add esp, 4
mov al, 1
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bae23
mov esp, ebp
pop ebp
ret
Function at 0x5e3eb0
Capabilities:
Read file via mapping

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
lea esi, [ebx + ebp]
call edx
cmp esi, eax
ja 0x5e3f21
mov ecx, dword [esp + 0x14]
call fcn.005e5420
push 0
push esi
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [edi + 0x24], eax
test eax, eax
jne 0x5e3f2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push eax
call fcn.005e5510
push eax
push str.CREATE_FILE_MAPPING_ERROR_diskFile_s__errno_lu_
push str.EL_MappedFile::Map
push 0x4f
push str..MappedFile.cpp
push 0xffffffffffffffff
push 0x200
call fcn.005e5310
add esp, 0x20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
mov ecx, dword [0x71c210]
call fcn.0059f570
mov ecx, dword [edi + 0x24]
mov esi, eax
dec esi
and esi, ebx
lea eax, [esi + ebp]
push eax
sub ebx, esi
push ebx
push 0
push 4
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 8], eax
test eax, eax
jne 0x5e3f90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push eax
call fcn.005e5510
push eax
push str.MAP_VIEW_OF_FILE_ERROR_diskFile_s__errno_lu_
push str.EL_MappedFile::Map
push 0x60
push str..MappedFile.cpp
push 0xffffffffffffffff
push 0x200
call fcn.005e5310
add esp, 0x20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
add eax, esi
mov dword [edi + 0x18], ebp
mov dword [edi + 4], eax
mov dword [edi + 0x14], 0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0xc
Function at 0x5e43b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
push esi
cmp edx, 0x10
jb 0x5e4533
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 1]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 2]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 3]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 4]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 5]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 6]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 7]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 8]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 9]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 0xa]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 0xb]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 0xc]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 0xd]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 0xe]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
movzx esi, byte [ecx + 0xf]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
add ecx, 0x10
sub edx, 0x10
cmp edx, 0x10
jae 0x5e43c5
test edx, edx
je 0x5e455b
jmp 0x5e4540
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e4d90]
inc ecx
sub edx, 1
jne 0x5e4540
not eax
pop esi
ret
Function at 0x5e4f60
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x668
mov eax, dword [0x6e377c]
xor eax, esp
mov dword [esp + 0x664], eax
mov eax, dword [esp + 0x66c]
push ebx
push ebp
push edi
mov edi, dword [esp + 0x67c]
push eax
push 0x66b334
mov dword [esp + 0x18], eax
lea eax, [esp + 0x278]
push 0x200
push eax
call fcn.004211b0
mov ebp, 0x200
add esp, 0x10
sub ebp, eax
lea ebx, [esp + eax*2 + 0x270]
push 0x687028
mov edx, ebp
mov ecx, ebx
call fcn.00421110
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
jne 0x5e501c
test edi, edi
je 0x5e5002
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push 0x45
mov ecx, edi
mov dword [esp + 0x1c], str.NO_FILES
mov dword [esp + 0x24], 0
call fcn.005e4e00
pop edi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x664]
xor ecx, esp
call fcn.005bae23
add esp, 0x668
ret
push esi
lea ecx, [ecx]
cmp word [esp + 0x50], 0
lea esi, [esp + 0x50]
jne 0x5e5033
lea esi, [esp + 0x258]
push 1
push 0x68701c
push esi
call fcn.00420fa0
add esp, 0xc
test eax, eax
jne 0x5e506b
push 0x68701c
push esi
call fcn.00420f10
add esp, 8
test eax, eax
je 0x5e50c4
push 0x687014
push esi
call fcn.00420f10
add esp, 8
test eax, eax
je 0x5e50c4
push esi
mov edx, ebp
mov ecx, ebx
call fcn.00421110
test byte [esp + 0x24], 0x10
je 0x5e508f
lea ecx, [esp + 0x274]
push edi
push ecx
call fcn.005e4f60
add esp, 8
jmp 0x5e50c4
lea edx, [esp + 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x5e50c4
test edi, edi
je 0x5e50c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x278]
push eax
push str.DELETE_FILE_ERROR_filePath_s__errorCode_d_
push 0x45
push edi
call fcn.005e4ee0
add esp, 0x14
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x5e5020
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x5e5112
test edi, edi
je 0x5e5112
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.REMOVE_DIRECTORY_ERROR_dir_s__errorCode_d_
push 0x45
push edi
call fcn.005e4ee0
add esp, 0x14
mov ecx, dword [esp + 0x674]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.005bae23
add esp, 0x668
ret

Function at 0x5e5480
Capabilities:
Get file size
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
push esi
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 0x28]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5e54a8
xor al, al
pop esi
ret 0xc
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5e54b6
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov edx, dword [esi + 0x28]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov al, 1
pop esi
ret 0xc