joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5638c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x78]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], 4
mov edi, dword [esp + 0x70]
sub esi, eax
lea ebx, [esi + 1]
movzx ecx, byte [edi]
movzx edx, byte [edi + 1]
mov dword [esp + 0x28], esi
test ebx, ebx
jle 0x563a70
mov ebx, dword [esp + 0x6c]
shl edx, 8
mov esi, dword [esp + 0x68]
mov dword [esp + 8], edi
add ecx, edx
add esi, dword [esp + 0x74]
add ebx, eax
imul eax, ecx
add eax, dword [esp + 0x74]
mov dword [esp + 0x2c], ecx
imul ebx, dword [esp + 0x64]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
mov dword [esp], eax
add esi, ebx
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x7c]
sub esi, dword [esp + 0x74]
mov dword [esp + 0x18], esi
add esi, 1
mov dword [esp + 0x1c], esi
call fcn.00563f70
mov dword [esp + 0x24], 0
lea esi, [esi]
lea esi, [esi]
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x563a02
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
xor ebp, ebp
xor esi, esi
xor ebx, ebx
jmp 0x5639c6
mov edx, dword [esp + 0x1c]
sub edx, ebx
cmp edx, eax
jle 0x563a58
lea edx, [eax + ebx]
mov esi, 1
movzx ebx, byte [edi + ecx]
lea ebp, [ecx + 1]
mov eax, ebx
cmp ebx, 0xf7
jg 0x5639d0
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x20]
add ecx, edx
mov byte [ecx + ebx], al
mov ecx, ebp
xor eax, eax
lea ebx, [edx + 1]
mov ebp, 1
cmp dword [esp + 0x18], edx
jle 0x5639f4
test eax, eax
jne 0x563980
mov edx, ebx
jmp 0x563996
cmp ebx, 0xf8
je 0x563a40
mov eax, 0xff
mov ecx, ebp
mov esi, 1
mov ebp, 1
sub eax, ebx
lea ebx, [edx + 1]
cmp dword [esp + 0x18], edx
jg 0x5639c6
mov dword [esp + 0x38], ecx
mov ecx, esi
test cl, cl
je 0x563a02
mov dword [esp + 0x3c], eax
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x28], esi
jle 0x563a22
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
sub edx, dword [esp + 0x1c]
mov eax, ecx
sub eax, edx
mov dword [esp + 0x3c], eax
js 0x563a80
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x64]
add dword [esp + 0x20], edx
lea eax, [esi + 1]
cmp dword [esp + 0x28], esi
je 0x563a70
mov dword [esp + 0x24], eax
jmp 0x563960
movzx eax, byte [edi + ebp]
add ecx, 2
mov esi, 1
sub eax, 1
jmp 0x5639b8
mov ebx, ebp
test bl, bl
je 0x563a62
mov dword [esp + 0x38], ecx
sub eax, edx
mov dword [esp + 0x3c], eax
jmp 0x563a02
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x38]
sub edx, ecx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.00563f70
jmp 0x563a22
Function at 0x563aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x78]
mov edi, dword [esp + 0x80]
mov dword [esp + 0x38], 4
mov ebp, dword [esp + 0x70]
sub edi, eax
lea ebx, [edi + 1]
movzx ecx, byte [ebp]
movzx edx, byte [ebp + 1]
mov dword [esp + 0x20], edi
test ebx, ebx
jle 0x563c48
mov ebx, dword [esp + 0x6c]
mov esi, dword [esp + 0x68]
shl edx, 8
mov dword [esp + 8], ebp
add esi, dword [esp + 0x74]
add ebx, eax
imul ebx, dword [esp + 0x64]
lea edi, [ebx + esi]
lea esi, [edx + ecx]
imul eax, esi
add eax, dword [esp + 0x74]
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], eax
lea eax, [esp + 0x38]
mov edi, dword [esp + 0x7c]
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
sub edi, dword [esp + 0x74]
mov dword [esp], eax
mov dword [esp + 0x24], edi
add edi, 1
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edi
call fcn.00563f70
mov dword [esp + 0x1c], 0
lea esi, [esi]
mov eax, dword [esp + 0x24]
test eax, eax
js 0x563bd4
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
xor ebx, ebx
xor edi, edi
mov eax, dword [esp + 0x24]
jmp 0x563b7e
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x18]
add ecx, eax
mov byte [ecx + ebx], dl
mov ecx, esi
xor edx, edx
sub eax, 1
mov ebx, 1
cmp eax, 0xffffffff
je 0x563bc6
test edx, edx
je 0x563b91
cmp edx, eax
jg 0x563c30
sub eax, edx
mov edi, 1
movzx ebx, byte [ebp + ecx]
lea esi, [ecx + 1]
mov edx, ebx
cmp ebx, 0xf7
jle 0x563b60
cmp ebx, 0xf8
je 0x563c18
mov edx, 0xff
sub eax, 1
mov ecx, esi
mov edi, 1
sub edx, ebx
mov ebx, 1
cmp eax, 0xffffffff
jne 0x563b7e
mov eax, edi
mov dword [esp + 0x38], ecx
test al, al
je 0x563bd4
mov dword [esp + 0x3c], edx
mov edi, dword [esp + 0x1c]
cmp dword [esp + 0x20], edi
jle 0x563bf4
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x28]
sub edx, dword [esp + 0x2c]
mov eax, ecx
sub eax, edx
mov dword [esp + 0x3c], eax
js 0x563c50
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x64]
add dword [esp + 0x18], ebx
lea eax, [edi + 1]
cmp dword [esp + 0x20], edi
je 0x563c48
mov dword [esp + 0x1c], eax
jmp 0x563b40
movzx edx, byte [ebp + esi]
add ecx, 2
mov edi, 1
sub edx, 1
jmp 0x563b71
test bl, bl
je 0x563c38
mov dword [esp + 0x38], ecx
add eax, 1
sub edx, eax
mov dword [esp + 0x3c], edx
jmp 0x563bd4
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x38]
sub edx, ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.00563f70
jmp 0x563bf4
Function at 0x563fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x78]
mov edi, dword [esp + 0x80]
mov dword [esp + 0x38], 4
mov ebp, dword [esp + 0x70]
sub edi, esi
lea ecx, [edi + 1]
movzx edx, byte [ebp]
movzx eax, byte [ebp + 1]
mov dword [esp + 0x20], edi
test ecx, ecx
jle 0x564190
mov ecx, dword [esp + 0x6c]
mov ebx, dword [esp + 0x68]
shl eax, 8
mov dword [esp + 8], ebp
add ebx, dword [esp + 0x74]
add ecx, esi
imul ecx, dword [esp + 0x64]
lea edi, [ecx + ebx]
mov dword [esp + 0x18], edi
lea edi, [eax + edx]
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], eax
add eax, 1
mov dword [esp + 0x2c], eax
lea eax, [esi + 1]
imul eax, edi
sub eax, dword [esp + 0x7c]
sub eax, 1
mov dword [esp + 0xc], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
mov dword [esp], eax
call fcn.00563f70
mov dword [esp + 0x1c], 0
nop
mov eax, dword [esp + 0x24]
test eax, eax
js 0x56411f
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
xor ebx, ebx
xor edi, edi
mov eax, dword [esp + 0x24]
jmp 0x5640be
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x18]
add ecx, eax
mov byte [ecx + ebx], dl
mov ecx, esi
xor edx, edx
sub eax, 1
mov ebx, 1
cmp eax, 0xffffffff
je 0x564111
test edx, edx
je 0x5640d1
cmp edx, eax
jg 0x564178
sub eax, edx
mov edi, 1
movzx edx, byte [ebp + ecx]
mov ebx, dword [esp + 0x84]
lea esi, [ecx + 1]
movzx ebx, byte [ebx + edx]
mov edx, ebx
cmp ebx, 0xf7
jle 0x5640a0
cmp ebx, 0xf8
je 0x564160
mov edx, 0xff
sub eax, 1
mov ecx, esi
mov edi, 1
sub edx, ebx
mov ebx, 1
cmp eax, 0xffffffff
jne 0x5640be
mov eax, edi
mov dword [esp + 0x38], ecx
test al, al
je 0x56411f
mov dword [esp + 0x3c], edx
mov edi, dword [esp + 0x1c]
cmp dword [esp + 0x20], edi
jle 0x56413f
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x28]
sub edx, dword [esp + 0x2c]
mov eax, ecx
sub eax, edx
mov dword [esp + 0x3c], eax
js 0x5641a0
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x64]
add dword [esp + 0x18], ecx
lea eax, [edi + 1]
cmp dword [esp + 0x20], edi
je 0x564190
mov dword [esp + 0x1c], eax
jmp 0x564080
movzx edx, byte [ebp + esi]
add ecx, 2
mov edi, 1
sub edx, 1
jmp 0x5640b1
test bl, bl
je 0x564180
mov dword [esp + 0x38], ecx
add eax, 1
sub edx, eax
mov dword [esp + 0x3c], edx
jmp 0x56411f
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x38]
sub edx, ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.00563f70
jmp 0x56413f
Function at 0x56b010
Capabilities:
Initialize winsock library

Disassembly:
push ebx
sub esp, 0x1a8
lea eax, [esp + 0x10]
mov dword [esp], 0x101
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x56b078
mov ebx, eax
movzx eax, word [esp + 0x10]
cmp al, 1
jne 0x56b068
shr ax, 8
cmp ax, 1
jne 0x56b068
mov dword [esp], 1
call dword [sym.imp.WINMM.DLL_timeBeginPeriod]
sub esp, 4
add esp, 0x1a8
mov eax, ebx
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ebx, 0xffffffff
jmp 0x56b058
mov ebx, 0xffffffff
jmp 0x56b058

Function at 0x56b1a0
Capabilities:
Resolve dns

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
sub esp, 4
test eax, eax
je 0x56b1c4
cmp word [eax + 8], 2
je 0x56b1e0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp fcn.0056b0f0
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi], eax
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret

Function at 0x56b380
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
sub esp, 0x38
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x10
mov ebx, dword [esp + 0x44]
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getsockname]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x56b3d2
mov eax, dword [esp + 0x24]
mov dword [ebx], eax
movzx eax, word [esp + 0x22]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [ebx + 4], ax
sub esp, 4
xor eax, eax
add esp, 0x38
pop ebx
ret

Function at 0x56b420
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp dword [esp + 0x20], 2
mov dword [esp + 8], 0
sete al
mov dword [esp], 2
add eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
add esp, 0x1c
ret
Function at 0x56b450
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x3c
mov eax, dword [esp + 0x44]
cmp eax, 0xa
ja case.0x56b460.60
jmp dword [eax*4 + 0x5ac380]
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
sete al
movzx eax, al
neg eax
add esp, 0x3c
ret
mov eax, dword [esp + 0x48]
mov dword [esp + 4], 0x8004667e
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
sub esp, 0xc
jmp 0x56b4a0
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
lea esi, [esi]
nop
mov eax, dword [esp + 0x40]
mov dword [esp + 4], 0xffff
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
jmp 0x56b4a0
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1002
jmp 0x56b500
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1001
jmp 0x56b500
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
jmp 0x56b500
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1006
jmp 0x56b500
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1005
jmp 0x56b500
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
jmp 0x56b4a0
mov eax, 0xffffffff
jmp 0x56b4ab

Function at 0x56b840
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
xor eax, eax
sub esp, 0x58
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x3c], 0
test ebx, ebx
je 0x56b8a4
mov eax, 2
mov dword [esp + 0x40], 0
mov word [esp + 0x40], ax
movzx eax, word [ebx + 4]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htons]
sub esp, 4
mov word [esp + 0x42], ax
mov eax, dword [ebx]
lea ebx, [esp + 0x40]
mov dword [esp + 0x44], eax
mov eax, 0x10
mov dword [esp + 0x18], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x20], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x1c], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSASendTo]
sub esp, 0x24
mov edx, eax
mov eax, dword [esp + 0x3c]
cmp edx, 0xffffffff
je 0x56b900
add esp, 0x58
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
setne al
add esp, 0x58
movzx eax, al
pop ebx
neg eax
ret
Function at 0x56b920
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
sub esp, 0x58
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x34], 0x10
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
test ebx, ebx
je 0x56b9d0
lea edx, [esp + 0x34]
lea eax, [esp + 0x40]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x20], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x1c], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x18], edx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
sub esp, 0x24
cmp eax, 0xffffffff
je 0x56b9e0
test byte [esp + 0x39], 0x80
jne 0x56ba11
test ebx, ebx
je 0x56b9c3
mov eax, dword [esp + 0x44]
mov dword [ebx], eax
movzx eax, word [esp + 0x42]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [ebx + 4], ax
sub esp, 4
mov eax, dword [esp + 0x3c]
add esp, 0x58
pop ebx
ret
xor edx, edx
xor eax, eax
jmp 0x56b950
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov eax, 0xfffffffe
cmp edx, 0x2738
je 0x56b9c7
xor eax, eax
cmp edx, 0x2746
je 0x56b9c7
xor eax, eax
cmp edx, 0x2733
setne al
add esp, 0x58
neg eax
pop ebx
ret
mov eax, 0xfffffffe
jmp 0x56b9c7

Function at 0x56ba80
Capabilities:
Get socket status

Disassembly:
push ebp
mov edx, 0x10624dd3
push edi
push esi
push ebx
sub esp, 0x23c
mov ecx, dword [esp + 0x258]
mov esi, dword [esp + 0x254]
mov dword [esp + 0x28], 0
mov dword [esp + 0x12c], 0
mov ebx, dword [esp + 0x250]
mov eax, ecx
mul edx
mov eax, dword [esi]
shr edx, 6
mov dword [esp + 0x20], edx
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
mov dword [esp + 0x24], ecx
test al, 1
je 0x56baec
mov dword [esp + 0x130], ebx
mov dword [esp + 0x12c], 1
test al, 2
je 0x56bafc
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 1
lea eax, [esp + 0x20]
lea ebp, [esp + 0x12c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
lea edi, [esp + 0x28]
lea eax, [ebx + 1]
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_select]
sub esp, 0x14
test eax, eax
js 0x56bb7e
mov dword [esi], 0
jne 0x56bb50
xor eax, eax
add esp, 0x23c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sub.WS2_32.dll___WSAFDIsSet
sub esp, 8
test eax, eax
je 0x56bb66
or dword [esi], 1
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.WS2_32.dll___WSAFDIsSet
sub esp, 8
test eax, eax
je 0x56bb3a
or dword [esi], 2
jmp 0x56bb3a
mov eax, 0xffffffff
jmp 0x56bb3c

Function at 0x56beb0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00565ed0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00565ed0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x56bf10
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x5cf2f4]
test esi, esi
jle 0x56c030
mov eax, dword [0x5cf2f8]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x56bf44
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x56bfc7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x56bf30
mov dword [esp], ebx
call fcn.0056c920
mov edi, eax
test eax, eax
je 0x56c057
mov eax, dword [0x5cf2f8]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0056ca60
mov edx, dword [0x5cf2f8]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x56c037
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x56bfc0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x56bfd0
add dword [0x5cf2f4], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x5cf2f8]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x56bfc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0056beb0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x56bf4e
mov eax, dword [0x5cf2f8]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0056beb0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0056beb0
lea esi, [esi]
nop

Function at 0x56c5a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x5cf310
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x5cf308]
sub esp, 4
test ebx, ebx
je 0x56c5f5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x56c5ee
test esi, esi
je 0x56c5ee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x56c5d0
mov dword [esp], 0x5cf310
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x56c920
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x56c945
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x56c950
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x56c945
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x56c998
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x56c98e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x56c99a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x56c980
xor eax, eax
pop ebx
pop esi
ret
Function at 0x56cbf0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x1c]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
sub esp, 8
test eax, eax
je 0x56ccff
mov edi, eax
mov eax, dword [esp + 0x1c]
lea ebx, [eax*4 + 4]
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x14], eax
call eax
mov dword [esp + 8], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov dword [esp + 0x18], eax
call eax
sub esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
je 0x56ccff
mov edx, dword [esp + 0x1c]
test edx, edx
jle 0x56cd37
xor ebx, ebx
jmp 0x56ccc7
mov dword [esp], eax
call sub.SDL2.dll_SDL_strlen
mov esi, eax
mov eax, dword [esp + 0x14]
call eax
lea ecx, [esi + 1]
mov dword [esp + 4], 8
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 8], ecx
call eax
sub esp, 0xc
mov edx, dword [esp + 0x10]
mov dword [edx + ebx*4], eax
test eax, eax
je 0x56ccff
mov dword [esp + 8], esi
add ebx, 1
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.SDL2.dll_SDL_memcpy
mov dword [esp], ebp
call sub.SDL2.dll_SDL_free
cmp dword [esp + 0x1c], ebx
jle 0x56cd30
mov eax, dword [edi + ebx*4]
mov dword [esp], eax
call sub.SDL2.dll_SDL_wcslen
lea eax, [eax + eax + 2]
mov dword [esp + 0xc], eax
mov eax, dword [edi + ebx*4]
mov dword [esp + 4], str.UTF_16LE
mov dword [esp + 8], eax
mov dword [esp], str.UTF_8
call sub.SDL2.dll_SDL_iconv_string
mov ebp, eax
test eax, eax
jne 0x56cc70
mov dword [esp + 0xc], 0
xor esi, esi
mov dword [esp + 8], str.Out_of_memory___aborting
mov dword [esp + 4], str.Fatal_Error
mov dword [esp], 0x10
call sub.SDL2.dll_SDL_ShowSimpleMessageBox
add esp, 0x20
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x10]
lea eax, [eax + ebx*4]
mov dword [eax], 0
mov dword [esp], edi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
call sub.SDL2.dll_SDL_SetMainReady
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.004020c0
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, eax
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x56cdaa
mov dword [esp + 0x18], esi
mov esi, edi
mov edi, dword [esp + 0x14]
nop
mov eax, dword [esp + 0x10]
mov ebx, dword [eax + esi*4]
add esi, 1
call edi
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
mov dword [esp], eax
call ebp
sub esp, 0xc
cmp dword [esp + 0x1c], esi
jg 0x56cd80
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
call eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], ecx
call ebp
mov eax, esi
sub esp, 0xc
add esp, 0x20
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x570290
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
sub esp, 0x88
lea edi, [esp + 0x40]
mov dword [esp + 0x15], 0x6f727245
mov dword [esp + 0x19], 0x6c632072
mov dword [esp + 0x1d], 0x696e6165
mov dword [esp + 0x21], 0x7520676e
mov dword [esp + 0x25], 0x70732070
mov dword [esp + 0x29], 0x6b5f6e69
mov dword [esp + 0x2d], 0x20737965
mov dword [esp + 0x31], 0x20726f66
mov dword [esp + 0x35], 0x65726874
mov dword [esp + 0x39], 0x206461
mov dword [esp + 0x3d], 0
mov dword [esp + 0x7c], 0
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
je 0x57036b
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x57033d
cmp eax, 0x6a
je 0x57035a
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x570338
cmp eax, 0x6a
je 0x57035a
add ecx, 2
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + ecx + 0x15], 0
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sub.msvcrt.dll_abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x570350

Function at 0x5706f0
Capabilities:
Allocate thread local storage

Disassembly:
push edi
mov eax, 0x5cf36c
push esi
push ebx
sub esp, 0x10
call fcn.00570050
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call fcn.0056ec00
mov edi, dword [0x5cf36c]
test edi, edi
jne 0x570758
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x59ae84], eax
cmp eax, 0xffffffff
je 0x597925
mov dword [0x5cf36c], 1
mov dword [esp], esi
call fcn.0056ef50
test ebx, ebx
je 0x570748
mov eax, ebx
call fcn.00570380
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
cmp edi, 1
je 0x570735
mov dword [esp], 2
call dword [0x59ae48]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x5cf36c
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x570735
call sub.msvcrt.dll_abort