joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d20a0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x5d20bf
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x5d20d4
mov edx, dword [edi + 0x38]
push edx
push 1
lea eax, [esp + 0x14]
push 1
push eax
call fcn.006986f1
add esp, 0x10
cmp eax, 1
jne 0x5d2126
mov cl, byte [esp + 0xc]
mov edx, dword [esp + 0x10]
test cl, cl
jbe 0x5d2132
lea eax, [edi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov ecx, dword [esi + 0x48]
mov edx, dword [edx]
mov eax, dword [ecx + 0x3c]
inc edx
test eax, eax
je 0x5d2108
movzx ecx, byte [esp + 0xc]
push ecx
push edx
push esi
call eax
add esp, 0xc
jmp 0x5d211d
mov eax, dword [ecx + 0x38]
movzx ecx, byte [esp + 0xc]
push eax
push ecx
push 1
push edx
call fcn.006986f1
add esp, 0x10
movzx ecx, byte [esp + 0xc]
cmp eax, ecx
je 0x5d2138
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov dword [edx], 0
pop edi
mov eax, 1
pop esi
ret

Function at 0x5d22c0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x5d22da
push 2
lea eax, [esp + 4]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x5d22ef
mov ecx, dword [eax + 0x38]
push ecx
push 2
lea edx, [esp + 8]
push 1
push edx
call fcn.006986f1
add esp, 0x10
cmp eax, 2
je 0x5d22ff
mov dword [esi + 0x40], 0x66
xor eax, eax
pop ecx
ret
mov ax, word [esp]
movzx ecx, ah
movzx edx, al
mov eax, dword [esp + 8]
shl ecx, 8
or ecx, edx
mov dword [eax], ecx
mov eax, 1
pop ecx
ret

Function at 0x5d2320
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi + 0x48]
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x5d233f
push 1
lea ecx, [esp + 0x10]
push ecx
push edi
call eax
add esp, 0xc
jmp 0x5d2354
mov edx, dword [esi + 0x38]
push edx
push 1
lea eax, [esp + 0x14]
push 1
push eax
call fcn.006986f1
add esp, 0x10
cmp eax, 1
jne 0x5d23a6
mov cl, byte [esp + 0xc]
mov edx, dword [esp + 0x10]
test cl, cl
jbe 0x5d23b2
lea eax, [esi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov ecx, dword [edi + 0x48]
mov edx, dword [edx]
mov eax, dword [ecx + 0x3c]
inc edx
test eax, eax
je 0x5d2388
movzx ecx, byte [esp + 0xc]
push ecx
push edx
push edi
call eax
add esp, 0xc
jmp 0x5d239d
mov eax, dword [ecx + 0x38]
movzx ecx, byte [esp + 0xc]
push eax
push ecx
push 1
push edx
call fcn.006986f1
add esp, 0x10
movzx ecx, byte [esp + 0xc]
cmp eax, ecx
je 0x5d23c3
mov dword [edi + 0x40], 0x66
pop edi
xor eax, eax
pop esi
ret
mov dword [edx], 0
mov byte [esi + 0x44], 0
mov dword [esi + 0x34], 0
pop edi
mov eax, 1
pop esi
ret
Function at 0x5d23d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [eax + 0x48]
xor ebx, ebx
push edi
mov ecx, esi
cmp dword [esi + 0x3c], ebx
je 0x5d23f2
push 1
lea edx, [esp + 0x13]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
add esp, 0xc
jmp 0x5d2407
mov edx, dword [ecx + 0x38]
push edx
push 1
lea eax, [esp + 0x17]
push 1
push eax
call fcn.006986f1
add esp, 0x10
movzx ecx, byte [esp + 0xf]
mov eax, 1
shl eax, cl
mov dword [esi + 8], ecx
inc ecx
mov edx, 1
mov dword [esi + 0xc], eax
inc eax
mov dword [esi + 0x10], eax
inc eax
shl edx, cl
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov eax, 0x1002
mov byte [esi + 0x44], bl
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea edi, [esi + 0x2144]
mov dword [esi + 0x1c], edx
mov ecx, 0x1000
rep stosd dword es:[edi], eax
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x5d2490
Capabilities:
Read file on windows

Disassembly:
cmp byte [esi], 0
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push edi
jne 0x5d2536
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x5d24b9
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x5d24ca
mov eax, dword [ecx + 0x38]
push eax
push 1
push 1
push esi
call fcn.006986f1
add esp, 0x10
cmp eax, 1
je 0x5d24dc
pop edi
pop ebp
mov dword [ebx + 0x40], 0x66
xor eax, eax
pop ebx
ret
mov al, byte [esi]
test al, al
jne 0x5d24ef
pop edi
pop ebp
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop ebx
ret
mov ecx, dword [ebx + 0x48]
mov edx, dword [ecx + 0x3c]
lea edi, [esi + 1]
test edx, edx
je 0x5d2509
movzx ecx, al
push ecx
push edi
push ebx
call edx
add esp, 0xc
jmp 0x5d251c
mov edx, dword [ecx + 0x38]
push edx
movzx eax, al
push eax
push 1
push edi
call fcn.006986f1
add esp, 0x10
movzx ecx, byte [esi]
cmp eax, ecx
jne 0x5d24cf
mov dl, byte [edi]
mov byte [ebp], dl
dec byte [esi]
mov byte [edi], 2
pop edi
pop ebp
mov eax, 1
pop ebx
ret
movzx eax, byte [esi + 1]
mov cl, byte [eax + esi]
mov byte [ebp], cl
inc byte [esi + 1]
dec byte [esi]
pop edi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x5d2550
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x5d2568
mov dword [esi + 0x40], 0x6f
xor eax, eax
pop esi
ret
push esi
call fcn.005d22c0
add esp, 4
test eax, eax
je 0x5d2564
lea ecx, [esi + 4]
push ecx
call fcn.005d22c0
add esp, 4
test eax, eax
je 0x5d2564
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x5d259e
push 3
lea edx, [esp + 0xc]
push edx
push esi
call ecx
add esp, 0xc
jmp 0x5d25b3
mov eax, dword [eax + 0x38]
push eax
push 3
lea ecx, [esp + 0x10]
push 1
push ecx
call fcn.006986f1
add esp, 0x10
cmp eax, 3
je 0x5d25d6
mov edx, dword [esi + 0x14]
push edx
mov dword [esi + 0x40], 0x66
call fcn.005d4af0
add esp, 4
mov dword [esi + 0x14], 0
xor eax, eax
pop esi
ret
mov dl, byte [esp + 8]
movzx eax, dl
mov ecx, eax
shr ecx, 4
push ebx
and eax, 7
and ecx, 7
inc eax
inc ecx
push edi
mov bl, dl
shr bl, 3
mov edi, eax
movzx eax, byte [esp + 0x11]
mov dword [esi + 8], ecx
mov cl, byte [esp + 0x12]
and bl, 1
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], cl
test dl, dl
jns 0x5d26db
mov ecx, edi
mov edx, 1
shl edx, cl
push 0
push edx
call fcn.005d4a60
add esp, 8
mov dword [esi + 0x14], eax
test eax, eax
jne 0x5d2636
pop edi
pop ebx
mov dword [esi + 0x40], 0x6d
pop esi
ret
mov byte [eax + 8], bl
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp dword [eax], ebx
jle 0x5d26e2
xor edi, edi
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x5d2661
push 3
lea edx, [esp + 0x14]
push edx
push esi
call ecx
add esp, 0xc
jmp 0x5d2676
mov eax, dword [eax + 0x38]
push eax
push 3
lea ecx, [esp + 0x18]
push 1
push ecx
call fcn.006986f1
add esp, 0x10
cmp eax, 3
jne 0x5d26bb
mov edx, dword [esi + 0x14]
mov eax, dword [edx + 0xc]
movzx ecx, byte [esp + 0x10]
mov byte [edi + eax], cl
mov edx, dword [esi + 0x14]
mov eax, dword [edx + 0xc]
movzx ecx, byte [esp + 0x11]
mov byte [eax + edi + 1], cl
mov edx, dword [esi + 0x14]
movzx ecx, byte [esp + 0x12]
mov eax, dword [edx + 0xc]
mov byte [eax + edi + 2], cl
mov edx, dword [esi + 0x14]
inc ebx
add edi, 3
cmp ebx, dword [edx]
jl 0x5d2648
pop edi
pop ebx
mov eax, 1
pop esi
ret
mov eax, dword [esi + 0x14]
push eax
call fcn.005d4af0
add esp, 4
pop edi
pop ebx
mov dword [esi + 0x14], 0
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov dword [esi + 0x14], 0
pop edi
pop ebx
mov eax, 1
pop esi
ret
Function at 0x5d2950
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x5d2968
mov dword [esi + 0x40], 0x6f
xor eax, eax
pop esi
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x5d297e
push 1
lea eax, [esp + 0xc]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x5d2993
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0x10]
push 1
push edx
call fcn.006986f1
add esp, 0x10
cmp eax, 1
je 0x5d29a3
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x10]
movzx eax, byte [esp + 8]
mov ecx, dword [esp + 0xc]
push edx
push esi
mov dword [ecx], eax
call fcn.005d20a0
add esp, 8
pop esi
ret

Function at 0x5d2aa0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x7dcee0]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push 0x4c
call fcn.006955b9
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
jne 0x5d2ae6
cmp ebp, ebx
je 0x5d2ad2
mov dword [ebp], 0x6d
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0069528d
add esp, 0xc
ret
push edi
push 0x4c
push ebx
push esi
call fcn.00695690
push 0x614c
mov dword [esi + 0x34], ebx
mov dword [esi + 0x14], ebx
call fcn.006955b9
mov edi, eax
add esp, 0x10
cmp edi, ebx
jne 0x5d2b32
cmp ebp, ebx
je 0x5d2b14
mov dword [ebp], 0x6d
push esi
call fcn.00695d3f
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0069528d
add esp, 0xc
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x48], edi
mov dword [edi + 4], ebx
mov dword [edi + 0x38], ebx
mov dword [edi], 8
mov dword [edi + 0x3c], eax
mov dword [esi + 0x44], ecx
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
cmp eax, ebx
je 0x5d2b68
push 6
lea edx, [esp + 0x14]
push edx
push esi
call eax
add esp, 0xc
jmp 0x5d2b7d
mov eax, dword [ecx + 0x38]
push eax
push 6
lea ecx, [esp + 0x18]
push 1
push ecx
call fcn.006986f1
add esp, 0x10
cmp eax, 6
je 0x5d2b8f
cmp ebp, ebx
je 0x5d2bb6
mov dword [ebp], 0x66
jmp 0x5d2bb6
push 3
lea edx, [esp + 0x14]
push edx
push str.GIFVER
mov byte [esp + 0x22], bl
call fcn.00696343
add esp, 0xc
test eax, eax
je 0x5d2bda
cmp ebp, ebx
je 0x5d2bb6
mov dword [ebp], 0x67
push edi
call fcn.00695d3f
push esi
call fcn.00695d3f
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0069528d
add esp, 0xc
ret
push esi
call fcn.005d2550
add esp, 4
test eax, eax
je 0x5d2bb6
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x40], ebx
cmp byte [esp + 0x13], 0x39
sete al
mov byte [edi + 0x6148], al
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0069528d
add esp, 0xc
ret
Function at 0x5d5890
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x2008
call fcn.00697010
mov eax, dword [0x7dcee0]
xor eax, esp
mov dword [esp + 0x2004], eax
mov eax, dword [esp + 0x2014]
push ebx
mov ebx, dword [esp + 0x2010]
push ebp
mov ebp, dword [esp + 0x2018]
push edi
mov edi, ecx
mov dword [esp + 0xc], eax
test edi, edi
jne 0x5d58e4
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2004]
xor ecx, esp
call fcn.0069528d
add esp, 0x2008
ret
push esi
test edi, edi
jle 0x5d5933
lea esp, [esp]
mov eax, 0x2000
cmp edi, 0x2000
ja 0x5d58ff
mov eax, edi
push ebx
push eax
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.006986f1
mov esi, eax
add esp, 0x10
test esi, esi
jl 0x5d594e
je 0x5d596a
push ebp
push esi
lea edx, [esp + 0x1c]
push 1
push edx
call fcn.00697336
add esp, 0x10
cmp eax, esi
jne 0x5d5980
sub edi, esi
test edi, edi
jg 0x5d58f0
xor eax, eax
mov ecx, dword [esp + 0x2014]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0069528d
add esp, 0x2008
ret
call fcn.006a1a12
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push eax
push 5
push ecx
call fcn.005d8100
add esp, 0xc
or eax, 0xffffffff
jmp 0x5d5935
mov edx, dword [esp + 0x10]
push 0
push 0x11
push edx
call fcn.005d8100
add esp, 0xc
or eax, 0xffffffff
jmp 0x5d5935
call fcn.006a1a12
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push eax
push 6
push ecx
call fcn.005d8100
add esp, 0xc
or eax, 0xffffffff
jmp 0x5d5935

Function at 0x5d59a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [0x7dcee0]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [ebp + 0xc]
push ebx
push esi
push edi
call fcn.005d7dc0
add esp, 0xc
test eax, eax
jl 0x5d5a3a
push 0
push 1
push ebp
call fcn.005d8cd0
add esp, 0xc
test eax, eax
je 0x5d5a8c
push esi
call fcn.0069c57f
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
push ebx
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push ecx
push edx
push esi
call fcn.005d84d0
add esp, 0x18
test eax, eax
jl 0x5d5a3a
mov eax, dword [esp + 8]
push eax
push str._08lX
lea ecx, [esp + 0x14]
push 9
push ecx
call fcn.00696275
push 0
add ebp, 0xfffffff8
push ebp
push esi
call fcn.00699333
add esp, 0x1c
test eax, eax
jge 0x5d5a4e
call fcn.006a1a12
mov edx, dword [eax]
push edx
push 4
push ebx
call fcn.005d8100
add esp, 0xc
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0069528d
add esp, 0x14
ret
push esi
push 1
lea eax, [esp + 0x14]
push 8
push eax
call fcn.00697336
add esp, 0x10
cmp eax, 1
je 0x5d5a8c
call fcn.006a1a12
mov ecx, dword [eax]
push ecx
push 6
push ebx
call fcn.005d8100
add esp, 0xc
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0069528d
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0069528d
add esp, 0x14
ret
Function at 0x5d5c50
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2010
call fcn.00697010
mov eax, dword [0x7dcee0]
xor eax, esp
mov dword [esp + 0x200c], eax
mov eax, dword [esp + 0x201c]
push ebx
mov ebx, dword [esp + 0x2018]
push ebp
mov ebp, dword [esp + 0x2020]
push esi
push 1
push 0x2000
lea edx, [esp + 0x20]
push edx
push ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov dword [edi + 0x1c], 0
call ebx
mov esi, eax
add esp, 0x10
test esi, esi
jle 0x5d5cdd
mov eax, dword [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x20]
push 1
push ecx
call fcn.00697336
add esp, 0x10
cmp eax, esi
jne 0x5d5d23
add dword [edi + 0x1c], esi
push 1
push 0x2000
lea edx, [esp + 0x20]
push edx
push ebp
call ebx
mov esi, eax
add esp, 0x10
test esi, esi
jg 0x5d5ca7
test esi, esi
jge 0x5d5d7d
push 4
push 8
lea edx, [esp + 0x18]
push edx
push ebp
call ebx
add esp, 0x10
cmp eax, 8
mov eax, dword [esp + 0xc]
jge 0x5d5d55
pop esi
pop ebp
mov dword [eax], 0x14
mov dword [eax + 4], 0
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x200c]
xor ecx, esp
call fcn.0069528d
add esp, 0x2010
ret
call fcn.006a1a12
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push eax
push 6
push ecx
call fcn.005d8100
add esp, 0xc
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x200c]
xor ecx, esp
call fcn.0069528d
add esp, 0x2010
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x200c]
xor ecx, esp
call fcn.0069528d
add esp, 0x2010
ret
mov ecx, dword [esp + 0x2018]
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0069528d
add esp, 0x2010
ret
Function at 0x5d6dd0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
lea eax, [edi + 1]
test ebx, ebx
jne 0x5d6de4
mov eax, edi
push eax
call fcn.006955b9
mov esi, eax
add esp, 4
test esi, esi
jne 0x5d6e05
push eax
push 0xe
push ebp
call fcn.005d8100
add esp, 0xc
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x10]
push eax
push edi
push 1
push esi
call fcn.006986f1
add esp, 0x10
cmp eax, edi
jae 0x5d6e39
push esi
call fcn.00695d3f
call fcn.006a1a12
mov ecx, dword [eax]
push ecx
push 5
push ebp
call fcn.005d8100
add esp, 0x10
pop esi
pop ebp
xor eax, eax
pop ebx
ret
test ebx, ebx
je 0x5d6e5d
lea ecx, [esi + edi]
mov byte [ecx], 0
mov eax, esi
cmp esi, ecx
jae 0x5d6e5d
lea esp, [esp]
cmp byte [eax], 0
jne 0x5d6e58
mov byte [eax], 0x20
inc eax
cmp eax, ecx
jb 0x5d6e50
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x5d7dc0
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
push esi
call fcn.0069c57f
xor ebp, ebp
add esp, 4
cmp dword [edi + 4], ebp
mov dword [edi + 0xc], eax
jle 0x5d7e07
xor ebx, ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi]
push eax
push 0
add ecx, ebx
push esi
push ecx
call fcn.005d7a00
add esp, 0x10
test eax, eax
jne 0x5d7f5a
inc ebp
add ebx, 0x40
cmp ebp, dword [edi + 4]
jl 0x5d7de1
push esi
call fcn.0069c57f
sub eax, dword [edi + 0xc]
push esi
push 4
push 1
push 0x775d94
mov dword [edi + 8], eax
call fcn.00697336
push esi
push 0
call fcn.006a2aa7
push esi
push 0
call fcn.006a2aa7
push esi
push 0
call fcn.006a2aa7
push esi
push 0
call fcn.006a2aa7
movzx eax, word [edi + 4]
movzx ebx, ax
mov edx, ebx
and edx, 0xff
push esi
push edx
call fcn.006a2aa7
push esi
shr ebx, 8
push ebx
call fcn.006a2aa7
movzx eax, word [edi + 4]
movzx ebx, ax
add esp, 0x44
mov eax, ebx
and eax, 0xff
push esi
push eax
call fcn.006a2aa7
push esi
shr ebx, 8
push ebx
call fcn.006a2aa7
mov ebx, dword [edi + 8]
mov ecx, ebx
and ecx, 0xff
push esi
push ecx
call fcn.006a2aa7
mov edx, ebx
shr edx, 8
and edx, 0xff
push esi
push edx
call fcn.006a2aa7
mov eax, ebx
shr eax, 0x10
and eax, 0xff
push esi
push eax
call fcn.006a2aa7
push esi
shr ebx, 0x18
push ebx
call fcn.006a2aa7
mov ebx, dword [edi + 0xc]
mov ecx, ebx
and ecx, 0xff
push esi
push ecx
call fcn.006a2aa7
mov edx, ebx
shr edx, 8
and edx, 0xff
push esi
push edx
call fcn.006a2aa7
add esp, 0x40
push esi
mov eax, ebx
shr eax, 0x10
and eax, 0xff
push eax
call fcn.006a2aa7
push esi
shr ebx, 0x18
push ebx
call fcn.006a2aa7
movzx eax, word [edi + 0x14]
movzx ebx, ax
mov ecx, ebx
and ecx, 0xff
push esi
push ecx
call fcn.006a2aa7
push esi
shr ebx, 8
push ebx
call fcn.006a2aa7
movzx edx, word [edi + 0x14]
mov eax, dword [edi + 0x10]
push esi
push edx
push 1
push eax
call fcn.00697336
push esi
call fcn.00698742
add esp, 0x34
test eax, eax
je 0x5d7f62
call fcn.006a1a12
mov ecx, dword [eax]
mov edx, dword [esp + 0x1c]
push ecx
push 6
push edx
call fcn.005d8100
add esp, 0xc
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x5d84d0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2008
call fcn.00697010
mov eax, dword [0x7dcee0]
xor eax, esp
mov dword [esp + 0x2004], eax
push ebx
mov ebx, dword [esp + 0x201c]
push ebp
mov ebp, dword [esp + 0x2014]
push esi
mov esi, dword [esp + 0x2028]
push 0
push 0
push 0
mov dword [esp + 0x18], esi
call fcn.0060d400
mov dword [ebx], eax
mov eax, dword [esp + 0x2028]
push 0
push eax
push ebp
call fcn.00699333
add esp, 0x18
test eax, eax
je 0x5d8556
call fcn.006a1a12
mov ecx, dword [eax]
push ecx
push 4
push esi
call fcn.005d8100
add esp, 0xc
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x2004]
xor ecx, esp
call fcn.0069528d
add esp, 0x2008
ret
push edi
mov edi, dword [esp + 0x2024]
test edi, edi
jle 0x5d85a1
cmp edi, 0x2000
mov eax, 0x2000
jg 0x5d8571
mov eax, edi
push ebp
push eax
lea edx, [esp + 0x1c]
push 1
push edx
call fcn.006986f1
mov esi, eax
add esp, 0x10
test esi, esi
jbe 0x5d85bc
mov ecx, dword [ebx]
push esi
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.0060d400
sub edi, esi
add esp, 0xc
mov dword [ebx], eax
test edi, edi
jg 0x5d8562
xor eax, eax
mov ecx, dword [esp + 0x2014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0069528d
add esp, 0x2008
ret
call fcn.006a1a12
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
push edx
push 5
push eax
call fcn.005d8100
add esp, 0xc
or eax, 0xffffffff
jmp 0x5d85a3
Function at 0x5d8610
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
xor edi, edi
cmp dword [esi + 4], edi
lea ebp, [esi + 4]
je 0x5d8628
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret
test byte [esi + 0x10], 1
push ebx
jne 0x5d8735
cmp dword [esi + 0x20], edi
jbe 0x5d8735
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x5d8735
mov eax, dword [esi]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x5d867f
mov eax, dword [esi + 0x18]
push 0
push eax
push ecx
call fcn.00699333
add esp, 0xc
test eax, eax
jge 0x5d8696
call fcn.006a1a12
mov ecx, dword [eax]
push ecx
push 4
push ebp
call fcn.005d8100
add esp, 0xc
pop ebx
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret
cmp dword [eax + 8], edi
je 0x5d8696
mov eax, dword [eax + 8]
mov ecx, dword [esi + 0x18]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push ecx
push 0
mov ecx, eax
call edx
mov edx, dword [esi + 0x20]
cmp ebx, edx
jae 0x5d869f
mov edx, ebx
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
test eax, eax
je 0x5d86db
push eax
mov eax, dword [esp + 0x18]
push edx
push 1
push eax
call fcn.006986f1
mov edi, eax
add esp, 0x10
test edi, edi
je 0x5d86f5
jge 0x5d8728
call fcn.006a1a12
mov ecx, dword [eax]
push ecx
push 5
push ebp
call fcn.005d8100
add esp, 0xc
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x5d872e
push edx
mov edx, dword [esp + 0x18]
push 1
push edx
call fcn.0055c0e0
mov edi, eax
test edi, edi
jne 0x5d870c
push 0
push 0x11
push ebp
call fcn.005d8100
add esp, 0xc
or edi, 0xffffffff
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
jge 0x5d8728
call fcn.006a1a12
mov eax, dword [eax]
push eax
push 5
push ebp
call fcn.005d8100
add esp, 0xc
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
add dword [esi + 0x18], edi
sub dword [esi + 0x20], edi
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret
Function at 0x5d8800
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
test ebp, ebp
jl 0x5d884d
cmp ebp, dword [edi + 0x2c]
jge 0x5d884d
mov cl, byte [esp + 0x14]
test cl, 8
jne 0x5d8845
mov edx, dword [edi + 0x34]
lea eax, [ebp + ebp*4]
mov eax, dword [edx + eax*4]
cmp eax, 2
je 0x5d8830
cmp eax, 3
jne 0x5d8845
push 0
push 0xf
add edi, 0xc
push edi
call fcn.005d8100
add esp, 0xc
pop edi
xor eax, eax
pop ebp
ret
mov eax, dword [edi + 0x20]
cmp ebp, dword [eax + 4]
jl 0x5d8862
push 0
push 0x12
add edi, 0xc
push edi
call fcn.005d8100
add esp, 0xc
pop edi
xor eax, eax
pop ebp
ret
mov eax, dword [eax]
push ebx
mov ebx, ebp
shl ebx, 6
movzx eax, word [eax + ebx + 6]
mov dword [esp + 0x14], 0
test eax, eax
je 0x5d88aa
cmp eax, 8
je 0x5d889b
test cl, 4
jne 0x5d88b2
push 0
push 0x10
add edi, 0xc
push edi
call fcn.005d8100
add esp, 0xc
pop ebx
pop edi
xor eax, eax
pop ebp
ret
test cl, 4
jne 0x5d88b2
mov dword [esp + 0x14], 6
jmp 0x5d88b2
mov dword [esp + 0x14], 4
push esi
mov eax, edi
call fcn.005d8740
mov ecx, dword [esp + 0x18]
mov esi, eax
mov dword [esi + 0x10], ecx
mov edx, dword [edi + 0x20]
mov eax, dword [edx]
movzx ecx, word [eax + ebx + 6]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0x20]
mov eax, dword [edx]
mov ecx, dword [eax + ebx + 0x18]
mov dword [esi + 0x1c], ecx
mov edx, dword [edi + 0x20]
mov eax, dword [edx]
mov ecx, dword [eax + ebx + 0x14]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x20]
mov eax, dword [edx]
mov ecx, dword [eax + ebx + 0x10]
push ebp
push edi
mov dword [esi + 0x28], ecx
call fcn.005d83e0
xor ebp, ebp
add esp, 8
mov dword [esi + 0x18], eax
cmp eax, ebp
jne 0x5d8917
push esi
call fcn.005d8320
add esp, 4
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
ret
test byte [esi + 0x10], 2
jne 0x5d892a
mov edx, dword [esi + 0x20]
mov dword [esi + 0x1c], edx
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret
push 0x2000
call fcn.006955b9
add esp, 4
mov dword [esi + 0x2c], eax
cmp eax, ebp
je 0x5d8981
push esi
push 0x2000
push eax
call fcn.005d8610
mov ebx, eax
add esp, 0xc
cmp ebx, ebp
jg 0x5d8970
lea eax, [esi + 4]
push eax
add edi, 0xc
push edi
call fcn.005d8070
push esi
call fcn.005d8320
add esp, 0xc
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
ret
push 0x38
call fcn.006955b9
add esp, 4
mov dword [esi + 0x30], eax
cmp eax, ebp
jne 0x5d899d
push ebp
push 0xe
add edi, 0xc
push edi
call fcn.005d8100
push esi
call fcn.005d8320
add esp, 0x10
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
ret
mov dword [eax + 0x20], ebp
mov ecx, dword [esi + 0x30]
mov dword [ecx + 0x24], ebp
mov edx, dword [esi + 0x30]
mov dword [edx + 0x28], ebp
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
mov dword [eax], ecx
mov edx, dword [esi + 0x30]
push 0x38
push 0x6e37bc
mov dword [edx + 4], ebx
mov eax, dword [esi + 0x30]
push 0xfffffffffffffff1
push eax
call fcn.00611670
add esp, 0x10
cmp eax, ebp
je 0x5d8923
push eax
push 0xd
jmp 0x5d8984