joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
cmp eax, ecx
mov dword [esp + 0xc], edx
je 0x4a1030
mov edi, dword [esp + 0xc]
cmp edi, dword [ebp + 8]
cmova edi, dword [ebp + 8]
lea edx, [edi + edi]
mov dword [esp + 8], edi
mov edi, edx
sar edi, 1
cmp edx, 0x1e
jle 0x4a10e2
xor esi, esi
jmp 0x4a0f9c
lea ebx, [esi + 0x1f]
lea edx, [esi + 0x10]
cmp edi, ebx
jle 0x4a0ff0
mov esi, edx
movdqu xmm3, xmmword [eax + esi*2 + 0x10]
movdqu xmm5, xmmword [ecx + esi*2 + 0x10]
movdqu xmm2, xmmword [eax + esi*2]
pcmpeqw xmm3, xmm5
movdqu xmm4, xmmword [ecx + esi*2]
pmovmskb edx, xmm3
pcmpeqw xmm2, xmm4
shl edx, 0x10
pmovmskb ebx, xmm2
or edx, ebx
xor edx, 0xffffffff
je 0x4a0f90
tzcnt edx, edx
shr edx, 1
add esi, edx
movzx eax, word [eax + esi*2]
movzx edx, word [ecx + esi*2]
sub eax, edx
test eax, eax
je 0x4a100b
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add esi, 0x17
cmp edi, esi
jg 0x4a1060
lea ebx, [edx + 3]
cmp ebx, edi
jl 0x4a1090
mov esi, dword [esp + 8]
and esi, 3
jne 0x4a1043
mov eax, dword [esp + 0xc]
cmp eax, dword [ebp + 8]
je 0x4a1039
cmp dword [ebp + 8], eax
sbb eax, eax
lea esp, [ebp - 0xc]
and eax, 2
pop ebx
sub eax, 1
pop esi
pop edi
pop ebp
ret
cmp edx, dword [ebp + 8]
jne 0x4a0f68
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, word [eax + edx*2]
lea edi, [edx + edx]
movzx edx, word [ecx + edx*2]
cmp bx, dx
je 0x4a10c0
movzx eax, bx
sub eax, edx
jmp 0x4a0fde
movdqu xmm6, xmmword [eax + edx*2]
movdqu xmm7, xmmword [ecx + edx*2]
pcmpeqw xmm6, xmm7
pmovmskb ebx, xmm6
not ebx
test bx, bx
je 0x4a10b1
tzcnt ebx, ebx
shr ebx, 1
add edx, ebx
movzx eax, word [eax + edx*2]
movzx edx, word [ecx + edx*2]
sub eax, edx
jmp 0x4a0fde
movq xmm0, qword [eax + edx*2]
movq xmm1, qword [ecx + edx*2]
pcmpeqw xmm0, xmm1
pmovmskb ebx, xmm0
not ebx
test bx, bx
jne 0x4a1079
add edx, 4
jmp 0x4a1002
add edx, 8
jmp 0x4a0ff7
sub esi, 1
je 0x4a100b
movzx edx, word [eax + edi + 2]
movzx ebx, word [ecx + edi + 2]
cmp dx, bx
je 0x4a10ee
movzx eax, dx
sub eax, ebx
jmp 0x4a0fde
mov esi, 7
xor edx, edx
jmp 0x4a0ff3
cmp esi, 1
je 0x4a100b
movzx eax, word [eax + edi + 4]
movzx edx, word [ecx + edi + 4]
cmp ax, dx
je 0x4a100b
sub eax, edx
jmp 0x4a0fde
Function at 0x4cc740
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [0x73b8a0]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
add esp, 0x1c
ret

Function at 0x4cc7a0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [0x73b8a0]
mov esi, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x4cc8c3
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
jne 0x4cc8b9
mov eax, esi
test al, al
je 0x4cc8b9
mov dword [esp], 0x44
call fcn.00708230
mov dword [esp], 1
mov ecx, eax
mov ebx, eax
call fcn.004cc9a0
mov eax, dword [0x73b8a0]
sub esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
sub esp, 8
mov dword [esp], 8
call fcn.00708230
mov dword [esp], ebx
mov ecx, eax
mov esi, eax
call fcn.004f1250
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov ecx, ebx
mov dword [ebx + 0x24], eax
call fcn.004cc770
mov byte [ebx + 0x42], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x28], eax
mov eax, dword [0x73cb8c]
test eax, eax
je 0x4cc8f0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1c], 0xffffffff
call esi
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
lea edx, [ebp - 0x1c]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], edi
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x2c]
mov dword [esp], eax
mov dword [esp + 8], edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [ebx + 0x24]
sub esp, 0x1c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.0046c500
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, 0x73d314
call fcn.005a0120
cmp dword [0x73b8a0], 0xffffffff
je 0x4cc902
mov ecx, 0x73d314
call fcn.005a0160
mov eax, dword [0x73b8a0]
jmp 0x4cc7ba
mov eax, dword [ebx + 0x24]
mov dword [0x73cb8c], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, 0x73d314
mov dword [0x73b8a0], eax
call fcn.005a0160
mov eax, dword [0x73b8a0]
jmp 0x4cc7ba
Function at 0x4db0e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ecx, [ebp - 0x230]
mov esi, eax
sub esp, 0x25c
mov dword [eax], 0x8b6e98
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x20019
mov dword [esp + 4], 0x37
mov dword [esp + 8], str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_Zones
mov dword [esp], 0x80000002
call fcn.00506170
mov eax, dword [ebp - 0x230]
sub esp, 0x14
test eax, eax
je 0x4db30c
lea edx, [ebp - 0x22c]
mov dword [ebp - 0x22c], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
sub esp, 0x30
test eax, eax
jne 0x4db30c
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x4db30c
xor ebx, ebx
lea edi, [ebp - 0x216]
jmp 0x4db1df
add ebx, 1
cmp dword [ebp - 0x22c], ebx
jbe 0x4db30c
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0xff
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x230]
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
sub esp, 0x20
test eax, eax
jne 0x4db1d0
lea eax, [ebp - 0x224]
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.005b01a0
lea eax, [ebp - 0x224]
mov dword [esp + 4], eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call fcn.005ab8c0
mov eax, dword [esi]
mov eax, dword [eax]
cmp eax, 1
jbe 0x4db340
mov dword [esp + 4], 1
mov dword [esp], 0x7fffffff
mov ecx, esi
call fcn.00594170
mov edx, dword [ebp - 0x220]
sub esp, 8
mov dword [eax], edx
mov eax, dword [edx]
add eax, 1
cmp eax, 1
ja 0x4db370
mov eax, dword [ebp - 0x220]
mov edx, dword [eax]
test edx, edx
je 0x4db321
cmp edx, 0xffffffff
je 0x4db2c0
lock sub dword [eax], 1
mov eax, dword [ebp - 0x220]
je 0x4db321
lea esi, [esi]
mov eax, dword [ebp - 0x224]
mov edx, dword [eax]
test edx, edx
je 0x4db2e5
cmp edx, 0xffffffff
je 0x4db1d0
lock sub dword [eax], 1
mov eax, dword [ebp - 0x224]
jne 0x4db1d0
mov dword [esp + 8], 4
mov dword [esp + 4], 2
add ebx, 1
mov dword [esp], eax
call fcn.004a4c50
cmp dword [ebp - 0x22c], ebx
ja 0x4db1df
lea ecx, [ebp - 0x230]
call fcn.005061d0
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.004a4c50
jmp 0x4db2c0
mov edx, dword [ebp - 0x220]
mov dword [ebp - 0x21c], edx
mov eax, dword [edx]
add eax, 1
cmp eax, 1
ja 0x4db380
mov ecx, esi
call fcn.005dcbf0
mov edx, dword [ebp - 0x21c]
mov dword [eax], edx
jmp 0x4db29f
lock add dword [edx], 1
jmp 0x4db29f
lock add dword [edx], 1
jmp 0x4db356
Function at 0x4e8b70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [eax], 0x8b6e98
mov eax, dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [esp], 0x8001
mov dword [ebp - 0x30], eax
call eax
sub esp, 4
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, dword [0x7459de]
mov ecx, dword [0x7459da]
and eax, 0x3ffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ecx
mov ebx, eax
je 0x4e8c75
lea esi, [ebp - 0x20]
jmp 0x4e8bd0
add word [ebp - 0x20], 1
shr ebx, 1
je 0x4e8c75
test bl, 1
je 0x4e8bc3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub esp, 4
cmp eax, 2
je 0x4e8c90
cmp eax, 5
je 0x4e8c90
lea edi, [ebp - 0x28]
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.005b01a0
lea ecx, [ebp - 0x24]
mov dword [esp], edi
call fcn.005d6140
lea eax, [ebp - 0x24]
mov ecx, dword [ebp + 8]
sub esp, 4
mov dword [esp], eax
call fcn.00598af0
lea ecx, [ebp - 0x24]
sub esp, 4
call fcn.005d6560
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
test edx, edx
je 0x4e8c50
cmp edx, 0xffffffff
je 0x4e8bc3
lock sub dword [eax], 1
mov eax, dword [ebp - 0x28]
jne 0x4e8bc3
lea esi, [esi]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.004a4c50
add word [ebp - 0x20], 1
shr ebx, 1
jne 0x4e8bd0
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
call eax
mov eax, dword [ebp + 8]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x24]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
sub esp, 0x20
cmp eax, 1
jne 0x4e8bc3
jmp 0x4e8bf3
Function at 0x515e60
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
movq xmm0, qword [0x73e1e8]
movq qword [esp + 0x18], xmm0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
sub ebx, esi
sar ebx, 2
mov ecx, edx
or ecx, eax
je 0x515f05
and eax, 0x1000
xor edx, edx
test eax, eax
jne 0x515ef5
cmp edx, ebx
jne 0x515eb0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 8
sub ebx, edx
lea esi, [esi + edx*4]
shl ebx, 2
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
sub esp, 8
test al, al
jne 0x515e9f
add ebx, esi
cmp esi, ebx
je 0x515e9f
mov edi, dword [0x7391a0]
lea ebp, [esp + 0x2c]
lea esi, [esi]
mov dword [esp], ebp
add esi, 4
call edi
mov eax, dword [esp + 0x2c]
mov dword [esi - 4], eax
cmp ebx, esi
jne 0x515ee0
jmp 0x515e9f
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.0045e030
mov edx, eax
jmp 0x515e9b
call fcn.00468900
jmp 0x515e90

Function at 0x522790
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x522800
mov eax, dword [ebx + 4]
mov edx, dword [eax + 4]
test edx, edx
jne 0x522800
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x7459f0
mov dword [esp + 4], str.Empty_filename_passed_to_function
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.0072013c
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0x16
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea ecx, [ebp - 0x1c]
mov dword [esp], ebx
call fcn.00628750
xor eax, eax
sub esp, 4
lea ecx, [ebp - 0x1c]
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov word [esp], ax
call fcn.006660c0
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
mov esi, eax
mov ecx, dword [edx]
test ecx, ecx
je 0x522850
cmp ecx, 0xffffffff
je 0x522868
lock sub dword [edx], 1
mov edx, dword [ebp - 0x1c]
jne 0x522868
nop
lea esi, [esi]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], edx
call fcn.004a4c50
cmp esi, 0xffffffff
jne 0x5228f0
lea ecx, [ebp - 0x1c]
mov dword [esp], ebx
call fcn.00628750
lea ecx, [ebp - 0x1c]
sub esp, 4
call fcn.00665e50
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x1c]
sub esp, 4
mov ebx, eax
mov ecx, dword [edx]
test ecx, ecx
je 0x5228d4
cmp ecx, 0xffffffff
je 0x5228ac
lock sub dword [edx], 1
mov edx, dword [ebp - 0x1c]
je 0x5228d4
test ebx, ebx
mov eax, 1
jne 0x5227f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], 2
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], edx
call fcn.004a4c50
jmp 0x5228ac
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x7459f0
mov dword [esp + 4], str.Broken_filename_passed_to_function
jmp 0x5227d9
Function at 0x526040
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x50]
sub esp, 0x6c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x50], 0
mov dword [esp + 8], 0x440000
mov dword [esp + 4], eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0xffffffff
mov dword [esp], ebx
mov dword [ebp - 0x44], 0xffffffff
call fcn.005238b0
mov edx, dword [ebp - 0x4c]
xor eax, eax
and edx, 0x440000
cmp edx, 0x440000
je 0x5260a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [ebp - 0x58]
mov dword [esp], ebx
lea ebx, [ebp - 0x54]
mov ecx, esi
call fcn.00629a30
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00584870
mov ecx, ebx
call fcn.00665e50
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edx, dword [ebp - 0x54]
sub esp, 4
test eax, eax
setne al
mov ecx, dword [edx]
test ecx, ecx
je 0x526130
cmp ecx, 0xffffffff
je 0x5260f0
lock sub dword [edx], 1
mov edx, dword [ebp - 0x54]
je 0x526130
nop
mov edx, dword [ebp - 0x58]
mov ecx, dword [edx]
test ecx, ecx
je 0x526107
cmp ecx, 0xffffffff
je 0x526092
lock sub dword [edx], 1
mov edx, dword [ebp - 0x58]
jne 0x526092
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], edx
mov byte [ebp - 0x59], al
call fcn.004a4c50
movzx eax, byte [ebp - 0x59]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], edx
mov byte [ebp - 0x59], al
call fcn.004a4c50
movzx eax, byte [ebp - 0x59]
jmp 0x5260f0
Function at 0x5287c0
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [ebp - 0x2c], 0
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
jmp 0x528802
test al, al
mov ebx, dword [ebp - 0x30]
jne 0x528858
mov dword [esp], ebx
call sub.NETAPI32.dll_NetApiBufferFree
sub esp, 4
cmp dword [ebp - 0x40], 0xea
jne 0x528950
mov ecx, dword [ebp + 8]
lea esi, [ebp - 0x28]
call fcn.00665e50
lea edx, [ebp - 0x24]
mov dword [esp + 0x14], esi
lea esi, [ebp - 0x30]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 1
mov dword [esp + 0x18], edx
lea edx, [ebp - 0x2c]
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 0x10], edx
call sub.NETAPI32.dll_NetShareEnum
mov ecx, eax
sub esp, 0x1c
test eax, eax
sete byte [ebp - 0x39]
cmp ecx, 0xea
mov dword [ebp - 0x40], eax
movzx eax, byte [ebp - 0x39]
jne 0x5287e3
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x30]
test eax, eax
je 0x5287ea
mov esi, 1
jmp 0x52887e
add esi, 1
add ebx, 0xc
cmp esi, eax
ja 0x528903
test edi, edi
je 0x528870
mov edx, dword [ebx + 4]
test edx, edx
jne 0x528870
mov dword [esp + 8], 0xffffffff
mov eax, dword [ebx]
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.005b01a0
mov eax, dword [edi]
mov eax, dword [eax]
cmp eax, 1
jbe 0x528930
mov dword [esp + 4], 1
mov dword [esp], 0x7fffffff
mov ecx, edi
call fcn.00596bc0
mov edx, dword [ebp - 0x20]
sub esp, 8
mov dword [eax], edx
mov eax, dword [edx]
add eax, 1
cmp eax, 1
ja 0x528960
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
test edx, edx
je 0x528910
cmp edx, 0xffffffff
je 0x5288f2
lock sub dword [eax], 1
mov eax, dword [ebp - 0x20]
je 0x528910
mov eax, dword [ebp - 0x2c]
add esi, 1
add ebx, 0xc
cmp esi, eax
jbe 0x52887e
mov ebx, dword [ebp - 0x30]
jmp 0x5287ea
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.004a4c50
jmp 0x5288f2
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
mov eax, dword [edx]
add eax, 1
cmp eax, 1
ja 0x528970
mov ecx, edi
call fcn.005dcbf0
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
jmp 0x5288db
movzx eax, byte [ebp - 0x39]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lock add dword [edx], 1
jmp 0x5288db
lock add dword [edx], 1
jmp 0x528940
Function at 0x529cd0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea ecx, [ebp - 0xc]
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00628750
lea ecx, [ebp - 0xc]
sub esp, 4
call fcn.00665e50
mov ebx, eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [esp], eax
call fcn.00628750
lea ecx, [ebp - 0x10]
sub esp, 4
call fcn.00665e50
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, dword [ebp - 0x10]
sub esp, 0xc
test eax, eax
mov ebx, eax
setne al
mov esi, eax
mov eax, dword [edx]
test eax, eax
je 0x529d80
cmp eax, 0xffffffff
je 0x529d44
lock sub dword [edx], 1
mov edx, dword [ebp - 0x10]
je 0x529d80
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
test eax, eax
je 0x529da1
cmp eax, 0xffffffff
je 0x529d5b
lock sub dword [edx], 1
mov edx, dword [ebp - 0xc]
je 0x529da1
test ebx, ebx
jne 0x529d71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebx + 4], 2
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret
mov dword [esp], edx
mov dword [esp + 8], 4
mov dword [esp + 4], 2
call fcn.004a4c50
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
test eax, eax
jne 0x529d4d
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], edx
call fcn.004a4c50
jmp 0x529d5b
Function at 0x55cfb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x5c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ecx + 0x60]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
test ecx, ecx
mov edx, eax
jne 0x55cfd3
cmp dword [ebx + 0x78], 0xffffffff
je 0x55d000
mov eax, dword [ebp - 0x34]
mov dword [esp + 8], edx
mov ecx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0055e810
sub esp, 0xc
mov esi, eax
mov edi, edx
lea esp, [ebp - 0xc]
mov eax, esi
mov edx, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebx + 0x64]
cmp eax, 0xffffffff
je 0x55d0f3
mov edi, dword [ebx + 0xc]
mov dword [ebp - 0x3c], ebx
xor esi, esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x38], edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x40], edi
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x30], edi
xor edi, edi
jmp 0x55d08e
jle 0x55d0a0
mov edx, 0x2000000
lea ecx, [ebp - 0x20]
mov dword [esp + 8], edx
lea edx, [ebx + esi]
mov dword [esp + 0x10], 0
mov dword [esp], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x55d0b0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x55cff2
xor edx, edx
add esi, eax
adc edi, edx
sub dword [ebp - 0x30], eax
sbb dword [ebp - 0x2c], edx
cmp dword [ebp - 0x38], edi
jl 0x55cff2
jg 0x55d088
cmp dword [ebp - 0x34], esi
jbe 0x55cff2
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x64]
cmp dword [ebp - 0x2c], 0
jge 0x55d030
mov edx, dword [ebp - 0x30]
jmp 0x55d037
cmp dword [ebp - 0x30], 0x1ffffff
ja 0x55d032
mov edx, dword [ebp - 0x30]
jmp 0x55d037
mov eax, edi
or eax, esi
jne 0x55cff2
lea ebx, [ebp - 0x1c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call fcn.00720b94
mov ecx, dword [ebp - 0x40]
mov dword [esp + 4], ebx
mov dword [esp], 2
call fcn.00553fe0
push eax
push eax
mov ecx, ebx
or esi, 0xffffffff
call fcn.005b1050
mov edi, esi
jmp 0x55cff2
mov esi, 0xffffffff
mov edi, 0xffffffff
jmp 0x55cff2
Function at 0x55e1a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov edi, dword [ecx + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], edi
test eax, eax
mov dword [ebp - 0x38], eax
js 0x55e39f
jne 0x55e39f
mov edx, dword [ecx + 0x60]
xor esi, esi
xor edi, edi
mov ebx, ecx
test edx, edx
je 0x55e325
lea esi, [esi]
mov dword [esp + 0xc], edx
mov eax, esi
mov edx, dword [ebp - 0x34]
add eax, dword [ebp + 8]
mov dword [esp + 4], 1
sub edx, esi
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x60]
mov dword [esp], eax
call sub.msvcrt.dll_feof
test eax, eax
je 0x55e21f
mov edx, dword [ebp - 0x30]
test edx, edx
je 0x55e2f1
mov edx, dword [ebp - 0x30]
xor ecx, ecx
add esi, edx
adc edi, ecx
test eax, eax
jne 0x55e3db
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x55e2c5
cmp dword [ebp - 0x38], edi
jg 0x55e2d4
jge 0x55e2e0
mov eax, 1
mov ebx, esi
or ebx, edi
jne 0x55e317
test al, al
je 0x55e317
lea ebx, [ebp - 0x1c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call fcn.004d8060
mov ecx, dword [ebp - 0x40]
mov dword [esp + 4], ebx
mov dword [esp], 1
call fcn.00553fe0
mov eax, dword [ebp - 0x1c]
sub esp, 8
mov edx, dword [eax]
test edx, edx
je 0x55e2a1
cmp edx, 0xffffffff
je 0x55e2b9
lock sub dword [eax], 1
mov eax, dword [ebp - 0x1c]
jne 0x55e2b9
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.004a4c50
mov esi, 0xffffffff
mov edi, 0xffffffff
jmp 0x55e317
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x55e24a
mov edx, dword [ebx + 0x60]
jmp 0x55e1e0
cmp dword [ebp - 0x34], esi
jbe 0x55e24a
mov edx, dword [ebx + 0x60]
jmp 0x55e1e0
mov eax, dword [ebx + 0x60]
mov dword [esp], eax
call fcn.0044de90
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x60]
mov dword [esp], eax
call fcn.0044d960
lea esp, [ebp - 0xc]
mov eax, esi
mov edx, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov ecx, dword [ecx + 0x78]
cmp ecx, 0xffffffff
je 0x55e261
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
sub eax, esi
sbb edx, edi
cmp edx, 0
ja 0x55e357
cmp eax, 0x7ffffffe
jbe 0x55e35c
mov eax, 0x7fffffff
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], ecx
add eax, esi
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll__read]
test eax, eax
jle 0x55e384
mov ebx, eax
sar ebx, 0x1f
add esi, eax
adc edi, ebx
cmp dword [ebp - 0x38], edi
jge 0x55e390
cmp eax, 0xffffffff
sete al
jmp 0x55e24f
jg 0x55e397
cmp dword [ebp - 0x34], esi
jbe 0x55e384
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x78]
jmp 0x55e341
lea ebx, [ebp - 0x1c]
mov dword [esp + 4], 0x16
mov dword [esp], ebx
call fcn.004d8060
mov ecx, dword [ebp - 0x40]
mov dword [esp + 4], ebx
mov dword [esp], 1
call fcn.00553fe0
jmp 0x55e287
xor eax, eax
jmp 0x55e24f