joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56e320
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub esp, 0x18
mov eax, dword [0x70903c]
xor eax, esp
mov dword [esp + 0x14], eax
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [0x74cd0c], eax
cmp dword [0x74d594], eax
je 0x56e46a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 8
lea ecx, [esp + 0x14]
push ecx
movzx edx, ax
push 0x1004
push edx
mov dword [0x74d594], eax
call esi
lea edx, [esp + 0x10]
call fcn.0056e290
mov dword [0x74d550], eax
cmp dword [0x6efdb4], eax
je 0x56e469
push 0x74cc6c
mov dword [0x6efdb4], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
movzx ecx, word [0x74cd0c]
mov eax, ecx
and eax, 0x3ff
sub eax, 4
je 0x56e3d3
sub eax, 0xd
je 0x56e3c0
sub eax, 1
jne case.default.0x56e3e5
mov byte [0x74b846], al
mov dword [0x74b840], 0x6efd96
jmp 0x56e44c
mov byte [0x74b846], 1
mov dword [0x74b840], 0x6efd9c
jmp 0x56e44c
mov eax, ecx
shr eax, 0xa
dec eax
mov byte [0x74b846], 1
cmp eax, 4
ja case.default.0x56e3e5
jmp dword [eax*4 + 0x56e47c]
mov byte [0x74b846], 0
mov dword [0x74b840], 0x6efd8a
jmp 0x56e44c
mov dword [0x74b840], 0x6efd90
jmp 0x56e44c
push 0xa
lea edx, [esp + 8]
push edx
push 3
push ecx
mov dword [0x74b840], 0x6efd84
call esi
movsx ax, byte [esp + 4]
mov ecx, dword [0x74b840]
mov word [ecx], ax
movsx dx, byte [esp + 5]
movzx eax, dx
push eax
call fcn.0061a5da
mov ecx, dword [0x74b840]
add esp, 4
mov word [ecx + 2], ax
cmp dword [0x74d54c], 0x4e8
je 0x56e469
mov edx, dword [0x74d550]
mov dword [0x74d54c], edx
call fcn.0056d840
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00613e6e
add esp, 0x18
ret
Function at 0x56f400
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x10c
mov eax, dword [0x70903c]
xor eax, esp
mov dword [esp + 0x108], eax
cmp byte [0x74d538], 0
mov eax, dword [esp + 0x110]
push edi
mov edi, ecx
jne 0x56f5d3
cmp byte [0x74d57c], 0
mov dword [0x74cd10], eax
jne 0x56f467
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x56f467
push 0x74d578
push 0x68e4a4
push 1
push 0
push 0x6a7268
mov byte [0x74d57c], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
push 0x74cc78
mov dword [0x74cc78], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x105
lea eax, [esp + 8]
push eax
mov byte [0x74d539], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x56f54d
lea eax, [esp + 4]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x56f4a0
mov ecx, dword [str.imm32.dll]
mov edx, dword [0x68e6f4]
mov dword [eax], ecx
mov cx, word [0x68e6f8]
mov dword [eax + 4], edx
mov dl, byte [0x68e6fa]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x74cc68], eax
test eax, eax
je 0x56f546
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImmLockIMC
push eax
call esi
mov ecx, dword [0x74cc68]
push str.ImmUnlockIMC
push ecx
mov dword [0x74cd28], eax
call esi
mov edx, dword [0x74cc68]
push str.ImmLockIMCC
push edx
mov dword [0x74cd24], eax
call esi
mov dword [0x74cd20], eax
mov eax, dword [0x74cc68]
push str.ImmUnlockIMCC
push eax
call esi
mov ecx, dword [0x74cc68]
push str.ImmDisableTextFrameService
push ecx
mov dword [0x74cd1c], eax
call esi
pop esi
test eax, eax
je 0x56f54d
push 0xffffffffffffffff
call eax
jmp 0x56f54d
mov byte [0x74d539], 1
mov edx, dword [0x74cd10]
push edx
mov byte [0x74d538], 1
call sub.IMM32.dll_ImmGetContext
push eax
mov dword [edi + 4], eax
mov eax, dword [0x74cd10]
push eax
call sub.IMM32.dll_ImmReleaseContext
call fcn.0056e320
call fcn.0056ed70
push 2
call fcn.0056eda0
add esp, 4
call fcn.0056f2b0
test eax, eax
setne cl
mov byte [0x74d53b], cl
call fcn.0056e490
cmp byte [0x74d53b], 0
je 0x56f5d3
mov edx, dword [0x74cd0c]
and edx, 0x3ff
cmp edx, 4
jne 0x56f5c2
call fcn.0056e880
mov byte [0x74d53d], 1
test eax, eax
jne 0x56f5c9
mov byte [0x74d53d], 0
push 0
call fcn.0056ef70
add esp, 4
mov ecx, dword [esp + 0x10c]
pop edi
xor ecx, esp
mov al, 1
call fcn.00613e6e
add esp, 0x10c
ret 4

Function at 0x56f8d0
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0x804
mov eax, dword [0x70903c]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [esp + 0x808]
push esi
push 0x800
mov esi, ecx
lea ecx, [esp + 8]
push ecx
push 0x800
push eax
call sub.IMM32.dll_ImmGetCompositionStringW
shr eax, 1
test eax, eax
jle 0x56f916
push eax
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.0056f800
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.00613e6e
add esp, 0x804
ret 4
Function at 0x56fe70
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x66792b
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x70903c]
xor eax, esp
mov dword [esp + 0x81c], eax
push ebp
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x830]
mov dword fs:[0], eax
mov ebp, ecx
cmp byte [ebp + 0x2c], 0
je 0x56ff91
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x56ff91
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x56fef1
sub ecx, edi
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00417040
push esi
mov dword [esp + 0x83c], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x56ff33
cmp dword [esp + 0x28], 0x10
jb 0x56ff91
mov eax, dword [esp + 0x14]
push eax
jmp 0x56ff89
mov ecx, dword [esp + 0x14]
mov esi, 0x10
cmp dword [esp + 0x28], esi
jae 0x56ff46
lea ecx, [esp + 0x14]
push 0x400
lea edx, [esp + 0x30]
push edx
push eax
mov eax, dword [0x74d550]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
call fcn.0056f800
mov ecx, dword [0x74b83c]
test ecx, ecx
je 0x56ff7e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x28], esi
jb 0x56ff91
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00613a18
add esp, 4
mov ecx, dword [esp + 0x830]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x81c]
xor ecx, esp
call fcn.00613e6e
add esp, 0x82c
ret

Function at 0x56ffc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x667968
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x70903c]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
mov esi, ecx
mov ecx, dword [esp + 8]
push ecx
push edx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.0056fa80
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.0056fd60
cmp dword [esp + 0x24], 0x10
jb 0x57005a
mov edx, dword [esp + 0x10]
push edx
call fcn.00613a18
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00613e6e
add esp, 0x30
ret 0x1c
Function at 0x5760b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x667e33
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0056a9d0
xor eax, eax
mov dword [esi], vtable.CGraphicImageTexture.0
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x20], al
mov ecx, esi
mov byte [esp + 0x14], 1
call fcn.00576010
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x576120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x667e33
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CGraphicImageTexture.0
mov dword [esp + 0x14], 1
call fcn.00576040
cmp dword [esi + 0x34], 0x10
jb 0x57616d
mov eax, dword [esi + 0x20]
push eax
call fcn.00613a18
add esp, 4
xor eax, eax
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], eax
mov ecx, esi
mov byte [esi + 0x20], al
mov dword [esp + 0x14], 0xffffffff
call fcn.0056a9f0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x5761c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x667e58
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
push eax
call fcn.0056b090
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.CGraphicImage.0
call fcn.005760b0
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x78], ecx
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8

Function at 0x576230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x667e88
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CGraphicImage.0
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.00576120
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.0056b000
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x576580
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
mov esi, ecx
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x576597
xor al, al
pop esi
ret 4
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esi + 4], eax
mov al, 1
pop esi
ret 4
Function at 0x578010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x667fb3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
push eax
call fcn.0056b090
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CAttributeData.0
call fcn.0051c710
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 1
call fcn.0051c710
fldz
fstp dword [esi + 0x30]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x57de60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x668293
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov ecx, 0xf
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov byte [esi + 4], al
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x20], al
lea ecx, [esi + 0x38]
mov byte [esp + 0x14], 1
call fcn.0051c710
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x582460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x667e88
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
push eax
call fcn.0056b090
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CGraphicText.0
call fcn.00582220
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x5824c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x667e88
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CGraphicText.0
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.00581da0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.0056b000
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x582a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x6685f0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x70903c]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x20], eax
mov eax, 7
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], esi
mov word [esp + 0x48], cx
xor edx, edx
mov dword [esp + 0x6c], esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], esi
mov word [esp + 0x2c], dx
mov ebp, dword [esp + 0x78]
xor bl, bl
cmp ebp, esi
mov byte [esp + 0x6c], 1
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
jle 0x582b2c
mov eax, dword [esp + 0x20]
lea edi, [eax + esi*2]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x28]
push edx
mov eax, ebp
sub eax, esi
push eax
push edi
call fcn.00582840
add esp, 0x10
cmp eax, 2
jne 0x582aae
mov bl, 1
mov dword [esp + 0x14], esi
jmp 0x582b0a
cmp eax, 5
jne 0x582ab7
xor bl, bl
jmp 0x582b0a
test eax, eax
je 0x582ade
cmp eax, 1
je 0x582ade
cmp eax, 3
jne 0x582acf
mov dword [esp + 0x18], 1
jmp 0x582b0a
cmp eax, 4
jne 0x582b0a
mov dword [esp + 0x18], 0
jmp 0x582b0a
cmp dword [esp + 0x18], 0
jne 0x582b0a
test bl, bl
jne 0x582aed
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x7c]
cmp ecx, dword [esp + 0x1c]
jle 0x582b76
movzx edx, word [edi]
inc dword [esp + 0x1c]
push edx
push 1
lea ecx, [esp + 0x4c]
call fcn.00562300
add esi, dword [esp + 0x24]
cmp esi, ebp
jl 0x582a82
cmp dword [esp + 0x40], 8
jb 0x582b2a
mov eax, dword [esp + 0x2c]
push eax
call fcn.00613a18
add esp, 4
xor esi, esi
xor ecx, ecx
cmp dword [esp + 0x5c], 8
mov dword [esp + 0x3c], esi
mov word [esp + 0x2c], cx
mov dword [esp + 0x40], 7
jb 0x582b53
mov edx, dword [esp + 0x48]
push edx
call fcn.00613a18
add esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00613e6e
add esp, 0x5c
ret
mov esi, 8
cmp dword [esp + 0x40], esi
jb 0x582b8e
mov eax, dword [esp + 0x2c]
push eax
call fcn.00613a18
add esp, 4
xor ecx, ecx
cmp dword [esp + 0x5c], esi
mov dword [esp + 0x3c], 0
jmp 0x582b37
Function at 0x5876a0
Capabilities:
Create directory

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x587747
cmp byte [edi], 0
je 0x587747
mov eax, edi
lea edx, [eax + 1]
jmp 0x5876c0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5876c0
sub eax, edx
cmp eax, 3
jb 0x5876d7
cmp byte [edi + 1], 0x3a
jne 0x5876d7
add edi, 3
mov eax, edi
mov dword [esp + 8], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5876e0
push ebp
sub eax, edx
lea ebp, [eax + 1]
push esi
push ebp
call fcn.0061278d
add esp, 4
cmp byte [edi], 0
mov esi, eax
je 0x58773c
push ebx
xor ebx, ebx
mov eax, dword [esp + 0x14]
mov al, byte [eax]
cmp al, 0x2f
je 0x58770f
cmp al, 0x5c
jne 0x58772c
push ebp
push 0
push esi
call fcn.006135b0
push ebx
push edi
push esi
call fcn.00616c70
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esp + 0x14]
inc eax
inc ebx
cmp byte [eax], 0
mov dword [esp + 0x14], eax
jne 0x587701
pop ebx
push esi
call fcn.00616e52
add esp, 4
pop esi
pop ebp
pop edi
ret
Function at 0x587c00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x668b30
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x70903c]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, dword [esp + 0x78]
mov eax, dword [esp + 0x74]
mov ebp, dword [esp + 0x70]
push 0xa
mov ecx, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
call fcn.00494770
mov esi, dword [edi + 0x10]
cmp dword [edi + 0xc], esi
jbe 0x587c5c
call fcn.00615e0c
mov ebx, dword [edi]
mov edi, dword [edi + 0xc]
mov ecx, dword [esp + 0x14]
cmp edi, dword [ecx + 0x10]
jbe 0x587c73
call fcn.00615e0c
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
push esi
push ebx
push edi
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.004504d0
xor ebx, ebx
mov eax, ebp
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x587ca0
sub eax, edx
push eax
push ebp
lea ecx, [esp + 0x48]
call fcn.00417040
mov dword [esp + 0x68], ebx
xor edi, edi
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov eax, ebp
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x587cd0
sub eax, edx
push eax
push edi
push ebp
lea ecx, [esp + 0x4c]
call fcn.00496150
mov esi, eax
cmp esi, ebx
jl 0x587dc9
cmp esi, dword [esp + 0x54]
jbe 0x587cfa
call fcn.00615e0c
mov eax, dword [esp + 0x44]
mov edi, 0x10
cmp dword [esp + 0x58], edi
jae 0x587d0d
lea eax, [esp + 0x44]
cmp byte [eax + esi], 0x22
jne 0x587d32
push 1
inc esi
push esi
push 0x6b51d0
lea ecx, [esp + 0x4c]
call fcn.004499e0
cmp eax, ebx
jl 0x587de1
lea edi, [eax + 1]
jmp 0x587d4e
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x587d37
sub eax, edx
push eax
push esi
push ebp
lea ecx, [esp + 0x4c]
call fcn.004499e0
mov edi, eax
sub eax, esi
push eax
push esi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x4c]
call fcn.00494720
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x6c], 1
call fcn.0044fd10
mov esi, 0x10
mov byte [esp + 0x68], bl
cmp dword [esp + 0x3c], esi
jb 0x587d8b
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00613a18
add esp, 4
cmp edi, dword [esp + 0x54]
jb 0x587cc0
cmp dword [esp + 0x58], esi
jb 0x587da8
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00613a18
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00613e6e
add esp, 0x58
ret
cmp dword [esp + 0x58], 0x10
jb 0x587ddd
mov edx, dword [esp + 0x44]
push edx
call fcn.00613a18
add esp, 4
xor al, al
jmp 0x587daa
cmp dword [esp + 0x58], edi
jb 0x587ddd
mov eax, dword [esp + 0x44]
push eax
call fcn.00613a18
add esp, 4
xor al, al
jmp 0x587daa
Function at 0x588880
Capabilities:
Get system information on windows
Print debug messages
Read file via mapping

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x24
push esi
mov esi, ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x130], ecx
test eax, eax
jne 0x58889e
mov eax, dword [esi + 0x114]
mov edx, eax
add edx, ecx
mov dword [esi + 0x134], eax
cmp edx, dword [esi + 0x114]
jbe 0x5888b9
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
push ebx
push ebp
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esi + 0x130]
mov edi, dword [esp + 0x2c]
mov eax, ecx
xor edx, edx
div edi
push 0
imul eax, edi
mov ebx, eax
mov eax, dword [esi + 0x134]
mov edi, ecx
add ecx, eax
push ecx
mov ecx, dword [esi + 0x110]
push 0
push 2
push 0
push ecx
lea ebp, [eax + edx]
sub edi, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 0x12c], eax
test eax, eax
jne 0x588922
push str.CMappedFile::Map__m_hFM_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
push ebp
push ebx
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x138], eax
test eax, eax
jne 0x588959
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CMappedFile::Map__m_lpMapData__lu
call fcn.00587390
add esp, 8
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
mov edx, dword [esp + 0x38]
add eax, edi
mov dword [esi + 0x13c], eax
mov dword [edx], eax
mov eax, dword [esi + 0x13c]
mov ecx, dword [esi + 0x134]
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x128], 0
call fcn.00588780
mov eax, dword [esi + 0x134]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x24
ret 0xc
Function at 0x589430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x668b30
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x70903c]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70903c]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, dword [esp + 0x74]
mov eax, dword [esp + 0x78]
mov ebp, ecx
push 0xa
mov ecx, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
call fcn.00494770
mov esi, dword [edi + 0x10]
cmp dword [edi + 0xc], esi
jbe 0x58948a
call fcn.00615e0c
mov ebx, dword [edi]
mov edi, dword [edi + 0xc]
mov ecx, dword [esp + 0x14]
cmp edi, dword [ecx + 0x10]
jbe 0x5894a1
call fcn.00615e0c
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
push esi
push ebx
push edi
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.004504d0
xor esi, esi
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], esi
mov byte [esp + 0x44], 0
mov eax, dword [esp + 0x70]
push eax
mov ecx, ebp
mov dword [esp + 0x6c], esi
call fcn.005892a0
mov edi, eax
xor ebp, ebp
jmp 0x5894e0
mov ebx, dword [esp + 0x18]
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5894f0
sub eax, edx
push eax
push ebp
push ebx
mov ecx, edi
call fcn.00496150
mov esi, eax
test esi, esi
jl 0x5895fd
cmp esi, dword [edi + 0x14]
jbe 0x589517
call fcn.00615e0c
mov ebp, 0x10
cmp dword [edi + 0x18], ebp
jb 0x589526
mov eax, dword [edi + 4]
jmp 0x589529
lea eax, [edi + 4]
cmp byte [eax + esi], 0x22
jne 0x58954c
push 1
inc esi
push esi
push 0x6b51d0
mov ecx, edi
call fcn.004499e0
test eax, eax
jl 0x589616
lea ebp, [eax + 1]
jmp 0x589566
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x589551
sub eax, edx
push eax
push esi
push ebx
mov ecx, edi
call fcn.004499e0
mov ebp, eax
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
call fcn.00494720
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x6c], 1
call fcn.0044fd10
mov esi, 0x10
mov byte [esp + 0x68], 0
cmp dword [esp + 0x3c], esi
jb 0x5895a2
mov edx, dword [esp + 0x28]
push edx
call fcn.00613a18
add esp, 4
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5895a7
sub eax, edx
push eax
push ebp
push ebx
mov ecx, edi
call fcn.00496150
test eax, eax
jl 0x5895c7
cmp ebp, dword [edi + 0x14]
jb 0x5894e0
cmp dword [esp + 0x58], esi
jb 0x5895da
mov edx, dword [esp + 0x44]
push edx
call fcn.00613a18
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00613e6e
add esp, 0x58
ret 0xc
cmp dword [esp + 0x58], 0x10
jb 0x589611
mov eax, dword [esp + 0x44]
push eax
call fcn.00613a18
add esp, 4
or eax, 0xffffffff
jmp 0x5895dc
cmp dword [esp + 0x58], ebp
jb 0x589629
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00613a18
add esp, 4
mov eax, 0xfffffffe
jmp 0x5895dc