joyce8/EMBER2024-capa huggingface dataset:
Function at 0x581180
Capabilities:
Check os version
Get memory capacity

Disassembly:
mov dword [0x72cf70], 0
sub esp, 0xb8
fld dword [0x72cf70]
fstp dword [0x72cf6c]
mov dword [0x8f437c], 0x72cf60
mov dword [0x72cf68], 0
mov dword [0x72cf78], 0
mov dword [0x72cf7c], 0
mov dword [0x72cf80], 0
mov dword [0x72cf84], 0
call fcn.00478f80
call fcn.00580bb0
push eax
call fcn.00591ea0
pop ecx
call fcn.00582160
mov ecx, 0x8f59d8
call fcn.00488ee0
mov dword [0x8f5838], 0
call fcn.00581120
mov dword [esp + 4], 0x94
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x14]
mov dword [0x70f290], 0
cmp eax, 2
jne 0x581290
mov eax, dword [esp + 8]
cmp eax, 4
jne 0x581250
push str.Operating_System_is_WinNT_n
call fcn.00405db0
mov dword [0x70f290], 2
pop ecx
jmp 0x5812d6
cmp eax, 5
jne 0x581270
push str.Operating_System_is_Win2000_n
call fcn.00405db0
mov dword [0x70f290], 3
pop ecx
jmp 0x5812d6
cmp eax, 5
jbe 0x5812d6
push str.Operating_System_is_WinXP_or_greater_n
call fcn.00405db0
mov dword [0x70f290], 4
pop ecx
jmp 0x5812d6
cmp eax, 1
jne 0x5812d6
mov eax, dword [esp + 8]
cmp eax, 4
ja 0x5812aa
cmp eax, 4
jne 0x5812c1
cmp dword [esp + 0xc], 0
je 0x5812c1
push str.Operating_System_is_Win98_n
call fcn.00405db0
mov dword [0x70f290], 1
pop ecx
jmp 0x5812d6
push str.Operating_System_is_Win95_n
call fcn.00405db0
mov dword [0x70f290], 0
pop ecx
call fcn.00580fa0
push eax
mov dword [0x70f294], eax
push str.DirectX_version_0x_x_n
call fcn.00405db0
cmp dword [0x70f290], 0
pop ecx
pop ecx
jne 0x581330
mov ecx, 0x941520
push 0
push str.WIN_TTL
call fcn.0052c5a0
mov ecx, 0x941520
push eax
push str.WIN_95
call fcn.0052c5a0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
add esp, 0xb8
ret
cmp dword [0x70f294], 0x801
jae 0x581370
mov ecx, 0x941520
push 0
push str.WIN_TTL
call fcn.0052c5a0
mov ecx, 0x941520
push eax
push str.WIN_DX
call fcn.0052c5a0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
add esp, 0xb8
ret
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0xa0]
mov dword [0x70f298], eax
mov eax, dword [esp + 0xa4]
mov dword [0x70f29c], eax
mov eax, dword [esp + 0xb0]
mov dword [0x70f2a0], eax
mov eax, dword [esp + 0xb4]
push 0x70f2ac
push 0x70f2a8
mov dword [0x70f2a4], eax
call fcn.00580f30
mov eax, dword [0x70f298]
pop ecx
pop ecx
push eax
push str.Physical_memory_size__d_n
call fcn.00405db0
mov eax, dword [0x70f29c]
pop ecx
pop ecx
push eax
push str.Available_physical_memory__d_n
call fcn.00405db0
mov eax, dword [0x70f2a8]
pop ecx
pop ecx
push eax
push str.Video_memory_size__d_n
call fcn.00405db0
mov eax, dword [0x70f2ac]
pop ecx
pop ecx
push eax
push str.Available_video_memory__d_n
call fcn.00405db0
cmp dword [0x70f2ac], 0xc00000
pop ecx
pop ecx
jae 0x581446
mov ecx, 0x941520
push 0
push str.WIN_TTL
call fcn.0052c5a0
mov ecx, 0x941520
push eax
push str.WIN_VDM
call fcn.0052c5a0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
add esp, 0xb8
ret
mov ecx, 0x941520
call fcn.0052c580
mov eax, 1
add esp, 0xb8
ret
Function at 0x581630
Capabilities:
Hide graphical window

Disassembly:
push 0
call fcn.005a7550
pop ecx
mov ecx, 0x8f59d8
call fcn.0047a440
mov eax, dword [esp + 4]
push eax
call fcn.005a0e70
push eax
call fcn.00581f90
test eax, eax
pop ecx
pop ecx
jne 0x5816a0
mov dword [0x8f4378], 1
mov edx, dword [0x8f437c]
mov eax, dword [edx]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x941520
push 0
push str.WIN_TTL
call fcn.0052c5a0
mov ecx, 0x941520
push eax
push str.WIN_RSZ
call fcn.0052c5a0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
ret
mov ecx, 0x8f59d8
call fcn.0047a230
ret

Function at 0x5816e0
Capabilities:
Print debug messages

Disassembly:
push ebx
push ebp
sub esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 8]
lea ecx, [esp + 4]
push 0
push edx
push eax
mov eax, dword [0x885ad4]
push ecx
mov ebp, dword [eax]
push eax
xor ebx, ebx
call dword [ebp + 0x20]
test eax, eax
jl 0x581786
mov eax, dword [esp + 8]
mov ebp, dword [esp + 0xc]
mov edx, dword [esp + 4]
push ebp
push eax
mov eax, dword [0x885ad4]
mov ebx, dword [eax]
push edx
push eax
call dword [ebx + 0x30]
cmp dword [esp + 4], 1
mov ebx, eax
jne 0x581766
mov ecx, dword [0x8f5838]
lea eax, [ecx - 2]
cmp eax, 2
ja case.0x581738.3
jmp dword [eax*4 + 0x60fc74]
mov dword [0x8f5838], 3
jmp case.0x581738.3
mov dword [0x8f5838], 5
mov eax, dword [0x885ad4]
mov ebp, dword [eax]
push 0
push 0
push 0
push eax
call dword [ebp + 0x34]
lea eax, [esp + 8]
lea edx, [esp + 0xc]
lea ecx, [esp + 4]
push 0
push edx
push eax
mov eax, dword [0x885ad4]
push ecx
mov ebp, dword [eax]
push eax
call dword [ebp + 0x20]
test eax, eax
jge 0x581707
mov eax, ebx
add esp, 0x10
pop ebp
pop ebx
ret
Function at 0x582160
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
movzx ebx, ax
and ebx, 0x3ff
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
movzx ebp, ax
push 0
and ebp, 0x3ff
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx esi, ax
and esi, 0x3ff
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
movzx ecx, ax
mov dword [esp + 4], ecx
sar dword [esp + 4], 0xa
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
movzx edi, ax
push 0
sar edi, 0xa
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
sar eax, 0xa
cmp ebx, 7
je 0x5821d1
cmp ebp, 7
je 0x5821d1
cmp esi, 7
jne 0x5821e6
mov byte [0x5f4dd4], 0
mov byte [0x5f2e64], 0
mov byte [0x95cd1e], 1
cmp ebx, 0xc
je 0x5821f5
cmp ebp, 0xc
je 0x5821f5
cmp esi, 0xc
jne 0x58220a
mov byte [0x5f4dd4], 0
mov byte [0x5f2e64], 0
mov byte [0x95cdcb], 1
cmp dword [esp + 4], 3
je 0x58221b
cmp edi, 3
je 0x58221b
cmp eax, 3
jne 0x582222
mov byte [0x95cdcf], 1
cmp ebp, 7
jne 0x582230
mov eax, 7
jmp 0x582275
cmp ebp, 0xc
jne 0x582240
mov eax, 0xc
jmp 0x582275
cmp ebp, 0xa
jne 0x582250
mov eax, 0xa
jmp 0x582275
cmp ebp, 0x10
jne 0x582260
mov eax, 0x10
jmp 0x582275
cmp edi, 3
jne 0x582270
mov eax, 0xffffff9d
jmp 0x582275
mov eax, 9
mov edx, eax
sub eax, 7
cmp eax, 9
mov dword [0x5f2f78], ebx
ja case.0x582285.8
jmp dword [eax*4 + 0x60fc98]
mov dword [0x941238], 1
jmp 0x5822ca
mov dword [0x941238], 2
jmp 0x5822ca
mov dword [0x941238], 4
jmp 0x5822ca
mov dword [0x941238], 3
jmp 0x5822ca
mov dword [0x941238], 0
mov ecx, 0x941520
call fcn.0052c580
mov ecx, 0x941520
call fcn.0052c3c0
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x583e50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, dword [esp + 0x14]
mov dword [esi], 0x420
mov ecx, dword [esp + 0x10]
lea eax, [ecx - 0xa0]
cmp eax, 1
ja case.default.0x583e6f
jmp dword [eax*4 + 0x60ff10]
push 0xa0
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
movzx eax, bl
and edx, 0x8000
shr edx, 0xf
cmp eax, edx
jne case.default.0x583e6f
mov dword [esi], 0x416
jmp case.default.0x583e6f
push 0xa1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
movzx eax, bl
and ecx, 0x8000
shr ecx, 0xf
cmp eax, ecx
jne case.default.0x583e6f
mov dword [esi], 0x417
cmp dword [esi], 0x420
jne 0x583ed0
xor al, al
pop esi
pop ebx
ret
mov al, 1
pop esi
pop ebx
ret

Function at 0x5922f0
Capabilities:
Delete file

Disassembly:
push ebx
mov dword [0x8e2c60], 0
sub esp, 0xd0
mov ebx, dword [esp + 0xd8]
mov eax, ebx
mov dword [esp + 4], ecx
inc eax
push eax
lea eax, [esp + 0xc]
push 0x8e28c0
push str._s_i.b
push eax
call fcn.0059e5b0
lea eax, [esp + 0x18]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, ebx
lea eax, [edx*8]
lea eax, [edx + eax*4]
lea eax, [eax + edx*2]
mov word [eax*4 + 0x72b858], 0
mov al, 1
add esp, 0xd0
pop ebx
ret 4
Function at 0x5ab8f0
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
sub esp, 0x408
mov edx, dword [esp + 0x40c]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x5ab960
lea eax, [esp + 4]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp byte [esp + 5], 0x3a
jne 0x5ab955
mov byte [esp + 0x404], 0x3d
mov al, byte [esp + 4]
mov byte [esp + 0x405], al
mov byte [esp + 0x406], 0x3a
mov byte [esp + 0x407], 0
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
add esp, 0x408
ret
or eax, 0xffffffff
add esp, 0x408
ret
Function at 0x5c3f10
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 8
mov esi, dword [ebp + 8]
cmp byte [0x663720], 0
jne 0x5c3f36
mov dword [0x66371c], 0
mov byte [0x663720], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [eax + 8], 0
mov ebx, dword [0x663718]
jmp 0x5c3f53
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x5c3f5d
mov eax, dword [ebx]
cmp dword [eax], esi
ja 0x5c3f50
test ebx, ebx
jne 0x5c3f70
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
mov edi, dword [ebx]
mov eax, dword [ebx + 4]
sub eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
xor edx, edx
mov ecx, eax
cmp eax, 1
je 0x5c3fa9
lea eax, [eax]
lea ebx, [edx + ecx]
sar ebx, 1
cmp dword [edi + ebx*8], esi
ja 0x5c3fa0
mov edx, ebx
jmp 0x5c3fa2
mov ecx, ebx
mov ebx, edx
inc ebx
cmp ebx, ecx
jne 0x5c3f90
cmp esi, dword [edi + edx*8]
jb 0x5c408c
mov ecx, edx
inc ecx
cmp ecx, eax
je 0x5c3fc3
cmp esi, dword [edi + edx*8 + 8]
jae 0x5c408c
mov ecx, dword [edi + edx*8 + 4]
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [eax]
movsx eax, byte [ecx]
and eax, 1
jne 0x5c4082
movzx eax, word [ecx + 5]
mov dword [ebp - 0x10], eax
add ebx, 7
mov dword [ebp - 0x14], 0
test eax, eax
jle 0x5c4082
mov edi, dword [ebx]
mov al, byte [edi]
cmp al, 0xe8
je 0x5c4001
cmp al, 0xcc
jne 0x5c4006
add edi, 5
jmp case.default.0x5c403a
cmp al, 0xff
jne 0x5c4050
movzx eax, byte [edi + 1]
mov edx, eax
sar edx, 6
and eax, 7
add edi, 2
cmp edx, 3
je case.default.0x5c403a
cmp eax, 4
jne 0x5c4024
inc edi
test edx, edx
jne 0x5c4032
cmp eax, 5
jne 0x5c4032
add edi, 4
jmp case.default.0x5c403a
mov eax, edx
dec edx
cmp edx, 1
ja case.default.0x5c403a
jmp dword [edx*4 + 0x619e2c]
inc edi
jmp case.default.0x5c403a
add edi, 4
jmp case.default.0x5c403a
call fcn.005d9a60
cmp edi, esi
jne 0x5c4070
add ebx, 4
mov ecx, dword [ebx]
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], ecx
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
add ebx, 8
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jl 0x5c3ff5
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5c4dd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
mov ecx, dword [0x61a0c8]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x5c4f05
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5c4f00
push 0x288
call fcn.005bd500
pop ecx
mov esi, eax
test esi, esi
jne 0x5c4e10
xor eax, eax
pop esi
pop ebx
ret
mov ebx, 0x6ee2b8
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x663728]
mov dword [esi], eax
mov dword [0x663728], esi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esi + 4], 0
mov dword [esi + 8], 1
mov dword [esi + 0xc], 0x61a0cc
mov dword [esi + 0x10], 0x61a0cc
mov eax, dword [esp + 0xc]
mov dword [esi + 0x14], eax
mov dword [esi + 0x280], 0x61a0d0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 1
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 1
mov dword [esi + 0x58], 0
or dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 0
or dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x27c], 0x61b5e0
mov dword [esi + 0x284], 0
push esi
mov eax, dword [0x61a0c8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebx
ret
xor eax, eax
pop esi
pop ebx
ret
mov eax, 1
pop esi
pop ebx
ret
Function at 0x5c6140
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x5c62f1
mov ebp, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x34]
mov eax, 1
mov ecx, ebp
xor edx, edx
mov dl, byte [edi + 4]
xor ebx, ebx
shl eax, cl
xor ecx, ecx
mov bl, byte [edi + 5]
mov cl, byte [esi]
mov dword [esp + 0x10], ecx
sub ecx, edx
xor edx, edx
mov dl, byte [esi + 1]
mov dword [esp + 0x14], edx
sub edx, ebx
mov dword [esp + 0x30], edx
xor edx, edx
mov dl, byte [esi + 2]
xor ebx, ebx
mov bl, byte [edi + 6]
mov dword [esp + 0x18], edx
sub edx, ebx
xor ebx, ebx
mov bl, byte [edi + 7]
mov dword [esp + 0x2c], edx
xor edx, edx
mov dl, byte [esi + 3]
mov dword [esp + 0x1c], edx
sub edx, ebx
test ecx, ecx
mov dword [esp + 0x20], edx
jge 0x5c62f1
mov ebx, dword [esp + 0x30]
test ebx, ebx
jge 0x5c62f1
mov ebx, dword [esp + 0x2c]
test ebx, ebx
jge 0x5c62f1
test edx, edx
jge 0x5c62f1
mov ebx, dword [esp + 0x10]
xor edx, edx
mov dl, byte [edi]
sub edx, ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x34], edx
xor edx, edx
mov dl, byte [edi + 1]
sub edx, ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x10], edx
xor edx, edx
mov dl, byte [edi + 2]
sub edx, ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x18], edx
xor edx, edx
mov dl, byte [edi + 3]
sub edx, ebx
mov ebx, dword [esp + 0x34]
cmp ebx, eax
jge 0x5c62f1
cmp dword [esp + 0x10], eax
jge 0x5c62f1
mov ebx, dword [esp + 0x18]
cmp ebx, eax
jge 0x5c62f1
cmp edx, eax
jge 0x5c62f1
neg eax
cmp ecx, eax
jg 0x5c6283
cmp dword [esp + 0x30], eax
jg 0x5c6283
cmp dword [esp + 0x2c], eax
jg 0x5c6283
cmp dword [esp + 0x20], eax
jg 0x5c6283
mov eax, dword [esp + 0x34]
test eax, eax
jg 0x5c6283
mov eax, dword [esp + 0x10]
test eax, eax
jg 0x5c6283
test ebx, ebx
jg 0x5c6283
test edx, edx
jg 0x5c6283
test ebp, ebp
jne 0x5c6283
mov ecx, dword [esp + 0x28]
mov al, byte [esp + 0x38]
pop edi
pop esi
pop ebp
mov byte [ecx + 0x18], al
pop ebx
add esp, 0x14
ret
dec ebp
xor ebx, ebx
mov edx, ebx
mov al, byte [esi]
sar edx, 3
and dl, 1
mov ecx, ebp
shl dl, cl
add dl, al
mov eax, ebx
sar eax, 2
and al, 1
mov byte [esp + 0x30], dl
shl al, cl
mov cl, byte [esi + 1]
mov edx, ebx
sar edx, 1
and dl, 1
add al, cl
mov ecx, ebp
shl dl, cl
mov byte [esp + 0x31], al
mov al, byte [esi + 2]
add dl, al
mov al, bl
and al, 1
mov byte [esp + 0x32], dl
shl al, cl
mov cl, byte [esi + 3]
lea edx, [esp + 0x30]
add al, cl
mov ecx, dword [esp + 0x38]
mov byte [esp + 0x33], al
mov eax, dword [esp + 0x28]
push ecx
push edi
mov ecx, dword [eax + ebx*4]
push ebp
push edx
push ecx
call fcn.005c6140
add esp, 0x14
inc ebx
cmp ebx, 0x10
jl 0x5c6286
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x5c6300
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x5c64e1
mov ebp, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x34]
mov eax, 1
mov ecx, ebp
xor edx, edx
mov dl, byte [edi + 4]
xor ebx, ebx
shl eax, cl
xor ecx, ecx
mov bl, byte [edi + 5]
mov cl, byte [esi]
mov dword [esp + 0x10], ecx
sub ecx, edx
xor edx, edx
mov dl, byte [esi + 1]
mov dword [esp + 0x14], edx
sub edx, ebx
mov dword [esp + 0x30], edx
xor edx, edx
mov dl, byte [esi + 2]
xor ebx, ebx
mov bl, byte [edi + 6]
mov dword [esp + 0x18], edx
sub edx, ebx
xor ebx, ebx
mov bl, byte [edi + 7]
mov dword [esp + 0x2c], edx
xor edx, edx
mov dl, byte [esi + 3]
mov dword [esp + 0x1c], edx
sub edx, ebx
test ecx, ecx
mov dword [esp + 0x20], edx
jge 0x5c64e1
mov ebx, dword [esp + 0x30]
test ebx, ebx
jge 0x5c64e1
mov ebx, dword [esp + 0x2c]
test ebx, ebx
jge 0x5c64e1
test edx, edx
jge 0x5c64e1
mov ebx, dword [esp + 0x10]
xor edx, edx
mov dl, byte [edi]
sub edx, ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x34], edx
xor edx, edx
mov dl, byte [edi + 1]
sub edx, ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x10], edx
xor edx, edx
mov dl, byte [edi + 2]
sub edx, ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x18], edx
xor edx, edx
mov dl, byte [edi + 3]
sub edx, ebx
mov ebx, dword [esp + 0x34]
cmp ebx, eax
jge 0x5c64e1
cmp dword [esp + 0x10], eax
jge 0x5c64e1
mov ebx, dword [esp + 0x18]
cmp ebx, eax
jge 0x5c64e1
cmp edx, eax
jge 0x5c64e1
neg eax
cmp ecx, eax
jg 0x5c6473
cmp dword [esp + 0x30], eax
jg 0x5c6473
cmp dword [esp + 0x2c], eax
jg 0x5c6473
cmp dword [esp + 0x20], eax
jg 0x5c6473
mov eax, dword [esp + 0x34]
test eax, eax
jg 0x5c6473
mov eax, dword [esp + 0x10]
test eax, eax
jg 0x5c6473
test ebx, ebx
jg 0x5c6473
test edx, edx
jg 0x5c6473
test ebp, ebp
jne 0x5c6473
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x38]
pop edi
pop esi
fld dword [ecx]
fadd dword [eax]
pop ebp
pop ebx
fstp dword [eax]
fld dword [ecx + 4]
fadd dword [eax + 4]
fstp dword [eax + 4]
fld dword [ecx + 8]
fadd dword [eax + 8]
fstp dword [eax + 8]
fld dword [ecx + 0xc]
fadd dword [eax + 0xc]
fstp dword [eax + 0xc]
fld dword [ecx + 0x10]
fadd dword [eax + 0x10]
fstp dword [eax + 0x10]
fld dword [ecx + 0x14]
fadd dword [eax + 0x14]
fstp dword [eax + 0x14]
add esp, 0x14
ret
dec ebp
xor ebx, ebx
mov eax, ebx
mov ecx, ebp
sar eax, 3
and al, 1
mov edx, ebx
shl al, cl
mov cl, byte [esi]
sar edx, 2
and dl, 1
add al, cl
mov ecx, ebp
shl dl, cl
mov byte [esp + 0x30], al
mov al, byte [esi + 1]
add dl, al
mov eax, ebx
sar eax, 1
and al, 1
mov byte [esp + 0x31], dl
mov dl, byte [esi + 2]
shl al, cl
add al, dl
mov dl, bl
and dl, 1
mov byte [esp + 0x32], al
mov al, byte [esi + 3]
shl dl, cl
lea ecx, [esp + 0x30]
add dl, al
mov eax, dword [esp + 0x38]
mov byte [esp + 0x33], dl
mov edx, dword [esp + 0x28]
push eax
push edi
mov eax, dword [edx + ebx*4]
push ebp
push ecx
push eax
call fcn.005c6300
add esp, 0x14
inc ebx
cmp ebx, 0x10
jl 0x5c6476
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x5c7f20
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 0x10
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], 0
cmp edi, 0x100
jge 0x5c7f4e
mov edx, dword [edi*4 + 0x713ff8]
test edx, edx
jne 0x5c7f68
push 1
call fcn.005c4f80
pop ecx
mov dword [eax + 4], 9
or eax, 0xffffffff
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [edx]
mov dword [esp + 8], eax
movsx eax, byte [edx + 4]
test eax, eax
je 0x5c7fbb
xor esi, esi
xor eax, eax
jmp 0x5c7f88
cmp byte [eax + ebp], 0xa
jne 0x5c7f87
inc esi
inc eax
cmp eax, ebx
jb 0x5c7f80
lea eax, [esi + ebx]
push eax
call fcn.005bd500
pop ecx
mov dword [esp + 4], eax
mov ecx, eax
xor edx, edx
jmp 0x5c7fb1
cmp byte [edx + ebp], 0xa
jne 0x5c7faa
mov byte [ecx], 0xd
inc ecx
mov al, byte [edx + ebp]
mov byte [ecx], al
inc ecx
inc edx
cmp edx, ebx
jb 0x5c7fa0
add ebx, esi
mov ebp, dword [esp + 4]
mov eax, dword [edi*4 + 0x713ff8]
cmp byte [eax + 5], 0
je 0x5c7fd5
push 2
push 0
push edi
call fcn.005c7eb0
add esp, 0xc
push 0
lea eax, [esp + 0x10]
push eax
push ebx
push ebp
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
cmp dword [esp + 4], 0
je 0x5c7ffb
push dword [esp + 4]
call fcn.005bd530
pop ecx
test esi, esi
je 0x5c8010
mov eax, dword [esp + 0xc]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x94056c], eax
xor eax, eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5c8090
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
cmp dword [esp + 0x1c], 0x100
jge 0x5c80b0
mov eax, dword [esp + 0x1c]
mov edx, dword [eax*4 + 0x713ff8]
test edx, edx
jne 0x5c80d0
push 1
call fcn.005c4f80
pop ecx
mov dword [eax + 4], 9
or eax, 0xffffffff
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
movsx ebx, byte [edx + 4]
push 0
lea eax, [esp + 8]
push eax
push dword [esp + 0x2c]
push dword [esp + 0x2c]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5c8180
cmp dword [esp + 4], 0
je 0x5c8172
test ebx, ebx
je 0x5c8172
mov esi, dword [esp + 0x20]
mov ecx, esi
xor ebx, ebx
xor ebp, ebp
jmp 0x5c8135
mov al, byte [ecx]
cmp al, 0xd
jne 0x5c8130
mov edx, dword [esp + 4]
dec edx
cmp edi, edx
jae 0x5c8130
cmp byte [ecx + 1], 0xa
jne 0x5c8130
inc ecx
inc ebx
jmp 0x5c8134
mov byte [esi], al
inc ecx
inc esi
inc ebp
mov edi, ebp
cmp edi, dword [esp + 4]
jb 0x5c8110
mov eax, dword [esp + 0x24]
cmp dword [esp + 4], eax
jne 0x5c816e
cmp dword [esp + 4], 1
jbe 0x5c816e
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x20]
cmp byte [ecx + eax - 1], 0xd
jne 0x5c816e
push 1
push 0xffffffffffffffff
push dword [esp + 0x24]
call fcn.005c7eb0
add esp, 0xc
inc ebx
sub dword [esp + 4], ebx
mov eax, dword [esp + 4]
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x94056c], eax
xor eax, eax
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5d8ef0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x150
mov ebx, dword [0x94059c]
mov edx, dword [0x9405b4]
mov eax, dword [ebx + edx*4 - 4]
mov dword [ebp - 0x158], eax
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ebx, 0xfffffffe
sub ebx, ecx
add ebx, dword [ebp - 0x158]
jmp 0x5d8f31
dec ebx
cmp ebx, dword [ebp - 0x158]
jbe 0x5d8f4e
movsx eax, byte [ebx - 1]
push eax
push 0x61b59c
call fcn.005a0a50
pop ecx
pop ecx
test eax, eax
je 0x5d8f30
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 0x158]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x150], eax
cmp eax, 0xffffffff
je 0x5d9007
lea esi, [ebp - 0x120]
sub ebx, dword [ebp - 0x158]
mov dword [ebp - 0x154], ebx
mov edi, esi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, 0xfffffffe
sub eax, ecx
add eax, dword [ebp - 0x154]
inc eax
push eax
call fcn.005bd500
pop ecx
mov edi, eax
push dword [ebp - 0x158]
push edi
call fcn.005a0920
pop ecx
pop ecx
push esi
lea eax, [ebx + edi]
push eax
call fcn.005a0920
pop ecx
pop ecx
call fcn.005d8ea0
test eax, eax
je 0x5d8ffb
mov ecx, dword [0x94059c]
mov edx, dword [0x9405b4]
mov dword [ecx + edx*4 - 4], edi
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 0x150]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x5d8ffb
mov eax, dword [0x9405b4]
inc dword [0x9405b4]
test eax, eax
jne 0x5d8f82
push dword [ebp - 0x150]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret