joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5dcc50
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x61d3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x6ea244]
xor eax, esp
mov dword [esp + 0x278], eax
push ebp
push esi
push edi
mov eax, dword [0x6ea244]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x2ac]
mov eax, dword [esp + 0x29c]
mov edx, dword [esp + 0x2b0]
mov edi, dword [esp + 0x2a0]
mov ebp, dword [esp + 0x2a8]
mov dword [esp + 0x14], ecx
xor ecx, ecx
push 0xffffffffffffffff
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2a8]
push ecx
mov word [esp + 0x28], cx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
call fcn.00401b58
mov eax, dword [esp + 0x30]
mov dword [esp + 0x294], 0
test eax, eax
je 0x5dcd1e
lea esi, [eax - 1]
cmp esi, eax
jbe 0x5dcd03
call fcn.005a6714
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x5dcd12
lea eax, [esp + 0x20]
cmp word [eax + esi*2], 0x5c
mov edx, 0x68a090
je 0x5dcd23
mov edx, 0x68a088
mov eax, edx
lea esi, [eax + 2]
jmp 0x5dcd30
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5dcd30
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.00401f08
mov eax, dword [esp + 0x20]
mov esi, 8
cmp dword [esp + 0x34], esi
jae 0x5dcd5d
lea eax, [esp + 0x20]
lea edx, [esp + 0x38]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x5dcdaf
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [edi], 0
call esi
cmp eax, 2
jne 0x5dcd87
xor eax, eax
jmp 0x5dcd89
call esi
cmp dword [esp + 0x34], 8
mov esi, dword [esp + 0x10]
mov dword [esi], eax
mov eax, dword [0x720d38]
mov dword [esi + 4], eax
jb 0x5dcdab
mov ecx, dword [esp + 0x20]
push ecx
call fcn.005a6104
add esp, 4
mov eax, esi
jmp 0x5dce2d
lea eax, [esp + 0x64]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5dcdb6
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x68]
push edx
mov ecx, ebp
call fcn.00401fa7
test byte [esp + 0x38], 0x10
je 0x5dcdef
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [eax], 3
mov dword [ecx], 3
jmp 0x5dce03
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [edx], 2
mov dword [eax], 2
mov ecx, dword [0x720d3c]
mov edi, dword [esp + 0x10]
mov dword [edi], ecx
mov edx, dword [0x720d40]
mov dword [edi + 4], edx
cmp dword [esp + 0x34], esi
jb 0x5dce2b
mov eax, dword [esp + 0x20]
push eax
call fcn.005a6104
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.005acc10
add esp, 0x288
ret
Function at 0x5ddd80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x61d568
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6ea244]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x720d98]
test eax, eax
jne 0x5dddb2
xor esi, esi
jmp 0x5dddbb
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.DLL_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x5dddfd
cmp dword [esi + 0x14], 0
jne 0x5dde3f
cmp dword [esi + 0x10], 0
jne 0x5dde45
push 0x5dda90
push 0x720d9c
call fcn.005ddb90
mov eax, dword [0x720d98]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x5dde2b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x5dde2b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x5dde85
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x5dde73
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x5dde45
cmp dword [esi + 0x14], 0
je 0x5dddd7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x5ddeaa
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x5ddedb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x5ddedb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x5ddedb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x5dde8f
jmp 0x5dddd1
Function at 0x5ddf90
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x61d5b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6ea244]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 8]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x5ddf00
push 0
push 0
call fcn.005af07f
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x5ddffc
lea ecx, [esp + 0x10]
call fcn.005a629c
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.0041ecae
mov eax, dword [edi + 8]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi + 8]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x5de024
cmp eax, 0xffffffff
je 0x5de024
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x5e2730
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x20
cdq
and edx, 0xf
add eax, edx
sar eax, 4
test eax, eax
jle 0x5e27e1
mov ecx, dword [esp + 0x2c]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
sub edi, ecx
mov esi, ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], eax
jmp 0x5e2766
mov edi, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
add edi, esi
mov ebp, 4
xor eax, eax
mov ebx, dword [ecx]
xor edx, edx
mov dl, byte [edi + eax]
shl ebx, 8
xor edx, ebx
inc eax
cmp eax, 4
mov dword [ecx], edx
jl 0x5e2773
add ecx, 4
add edi, 4
dec ebp
jne 0x5e2771
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.005e15a0
add esp, 0xc
lea ebp, [esp + 0x20]
mov edx, 4
mov edi, dword [ebp]
xor eax, eax
mov ecx, 0x18
mov ebx, edi
sub ecx, eax
add eax, 8
shr ebx, cl
inc esi
cmp eax, 0x20
mov byte [esi - 1], bl
jl 0x5e27b5
add ebp, 4
dec edx
jne 0x5e27b0
mov eax, dword [esp + 0x38]
dec eax
mov dword [esp + 0x38], eax
jne 0x5e2762
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x5e27f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
mov eax, dword [esp + 0x48]
mov dword [esp], 0x12345678
cdq
and edx, 0xf
mov dword [esp + 4], 0x56785678
add eax, edx
mov dword [esp + 8], 0x9abc5678
sar eax, 4
test eax, eax
mov dword [esp + 0xc], 0xdeff5678
jle 0x5e28d5
mov ecx, dword [esp + 0x4c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x50]
push edi
sub esi, ecx
mov edi, ecx
mov dword [esp + 0x5c], esi
mov dword [esp + 0x58], eax
jmp 0x5e2846
mov esi, dword [esp + 0x5c]
lea ecx, [esp + 0x20]
add esi, edi
mov ebp, 4
xor eax, eax
mov ebx, dword [ecx]
xor edx, edx
mov dl, byte [esi + eax]
shl ebx, 8
xor edx, ebx
inc eax
cmp eax, 4
mov dword [ecx], edx
jl 0x5e2853
add ecx, 4
add esi, 4
dec ebp
jne 0x5e2851
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.005e15a0
add esp, 0xc
xor esi, esi
mov eax, dword [esp + esi + 0x30]
mov ecx, dword [esp + esi + 0x10]
xor eax, ecx
mov ecx, dword [esp + esi + 0x20]
mov dword [esp + esi + 0x40], eax
mov ebp, eax
mov dword [esp + esi + 0x10], ecx
xor eax, eax
mov ecx, 0x18
mov edx, ebp
sub ecx, eax
add eax, 8
shr edx, cl
inc edi
cmp eax, 0x20
mov byte [edi - 1], dl
jl 0x5e28a3
add esi, 4
cmp esi, 0x10
jl 0x5e2889
mov eax, dword [esp + 0x58]
dec eax
mov dword [esp + 0x58], eax
jne 0x5e2842
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x5e50d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
push esi
cmp edx, 0x10
jb 0x5e525e
jmp 0x5e50f0
movsx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 1]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 2]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 3]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 4]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 5]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 6]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 7]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 8]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 9]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 0xa]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 0xb]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 0xc]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 0xd]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 0xe]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
movsx esi, byte [ecx + 0xf]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
add ecx, 0x10
sub edx, 0x10
cmp edx, 0x10
jae 0x5e50f0
test edx, edx
je 0x5e527d
movsx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6ed960]
inc ecx
sub edx, 1
jne 0x5e5262
not eax
pop esi
pop ebp
ret
Function at 0x5eb3f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
push ebx
mov bl, byte [edx + 8]
cmp bl, 3
je 0x5eb59a
mov ecx, dword [esp + 0x20]
push ebp
mov ebp, dword [edx]
push esi
xor esi, esi
push edi
mov dword [esp + 0x24], esi
test bl, 2
je 0x5eb448
movzx eax, byte [edx + 9]
movzx esi, byte [ecx]
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 1]
mov dword [esp + 0x10], edi
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 2]
sub eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov edi, 3
jmp 0x5eb45b
movzx eax, byte [ecx + 3]
movzx edi, byte [edx + 9]
sub edi, eax
mov dword [esp + 0x10], edi
mov edi, 1
test bl, 4
je 0x5eb46f
movzx ecx, byte [ecx + 4]
movzx eax, byte [edx + 9]
sub eax, ecx
mov dword [esp + edi*4 + 0x10], eax
inc edi
xor ecx, ecx
xor eax, eax
cmp edi, ecx
jle case.0x5eb4b6.3
jmp 0x5eb480
cmp dword [esp + eax*4 + 0x10], ecx
jg 0x5eb48c
mov dword [esp + eax*4 + 0x10], ecx
jmp 0x5eb491
mov esi, 1
inc eax
cmp eax, edi
jl 0x5eb480
cmp si, cx
je case.0x5eb4b6.3
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x5eb4b6.3
movzx eax, byte [eax + 0x5eb5b4]
jmp dword [eax*4 + 0x5eb5a0]
mov edx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp edx, ecx
jbe case.0x5eb4b6.3
lea esp, [esp]
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x5eb4d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [edx + 4]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov ecx, edx
mov eax, 0xf0
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x5eb4b6.3
mov edi, edi
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x5eb510
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x5eb4b6.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x10]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x5eb536
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x5eb4b6.3
mov edi, edi
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, pe_nt_image_headers32
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x10]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x5eb560
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x5feb31
Capabilities:
Delete file
Move file

Disassembly:
mov eax, 0x61e626
call fcn.0060ebd0
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x5febf1
push str.TORRENT_PATCH_ERROR
push ecx
call fcn.0040171c
pop ecx
mov esi, eax
call fcn.0060d9f6
push eax
lea ecx, [ebp - 0x10]
call fcn.00401327
mov dword [ebp - 4], ebx
cmp dword [edi + 0x3c], 8
jb 0x5feb79
mov edi, dword [edi + 0x28]
jmp 0x5feb7c
add edi, 0x28
push edi
lea ecx, [ebp + 8]
call fcn.00401327
mov byte [ebp - 4], 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x804
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0052fac0
add esp, 0x18
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.00401017
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401017
push 0x1e
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.005a90b0
mov eax, 0x614
mov word [ebp - 0x20], ax
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], str..Temp
mov dword [ebp - 0x16], str.Delete_fast_resume_data
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [0x6f9ea4]
mov eax, dword [ecx]
call dword [eax + 0xa8]
cmp eax, ebx
je 0x5fec0a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x38]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x606314
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x61dbf4
call fcn.0060ebd0
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
lea ecx, [esi + 0x40]
mov dword [esi], vtable.EL_CrcPatcher.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
call fcn.004018e0
mov dword [ebp - 4], edi
mov dword [esi + 0x5c], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x607fd9
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x61de9a
call fcn.0060ebd0
sub esp, 0x488
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x18], edi
call fcn.0040c29b
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28c]
mov byte [ebp - 0x11], 0
call fcn.0060af67
mov byte [ebp - 4], 2
push 0x104
lea eax, [ebp - 0x494]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x28c]
call fcn.0060b122
test eax, eax
je 0x608098
push dword [ebp + 0xc]
lea esi, [ebp - 0x28c]
call fcn.0060b195
mov esi, eax
cmp esi, 0xffffffff
je 0x608081
mov ecx, esi
lea eax, [ebp - 0x28c]
call fcn.0060ad87
push edi
push eax
lea ecx, [ebp - 0x38]
call fcn.00408a20
push edi
lea ecx, [ebp - 0x38]
call fcn.0045b9b1
push eax
mov eax, esi
lea ecx, [ebp - 0x28c]
call fcn.0060abfa
mov byte [ebp - 0x11], bl
lea edi, [ebp - 0x28c]
call fcn.0060af33
cmp byte [ebp - 0x11], 0
jne 0x608122
xor edi, edi
push 0x686b5c
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call fcn.005a61ec
add esp, 0xc
test eax, eax
je 0x6080c5
mov ecx, dword [ebp + 8]
push 0x6e3e14
call fcn.00408236
mov dword [ebp - 0x18], ebx
jmp 0x60819b
push 2
push edi
push dword [ebp + 0xc]
call fcn.005a9a8c
add esp, 0xc
push dword [ebp + 0xc]
call fcn.005a9994
pop ecx
push edi
push edi
push dword [ebp + 0xc]
mov esi, eax
call fcn.005a9a8c
add esp, 0xc
push edi
push esi
lea ecx, [ebp - 0x38]
call fcn.00408a20
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x40]
call fcn.00406cd3
push dword [ebp + 0xc]
push ebx
push esi
lea esi, [ebp - 0x40]
call fcn.004a72fd
push eax
call fcn.005a97da
push dword [ebp + 0xc]
call fcn.005a6aa0
add esp, 0x14
mov esi, dword [ebp - 0x28]
sub esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x40]
call fcn.00406cd3
push esi
lea esi, [ebp - 0x40]
call fcn.004a72fd
push eax
lea ecx, [ebp - 0x60]
call fcn.00507f10
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push 0x32
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x20]
call fcn.00534780
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.00531180
mov ecx, dword [ebp + 8]
test al, al
jne 0x608177
push 0x6e3e14
jmp 0x60817b
lea eax, [ebp - 0x20]
push eax
call fcn.00408236
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.00406ec5
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x60]
call fcn.00507e60
mov byte [ebp - 4], bl
lea edi, [ebp - 0x28c]
call fcn.0060af33
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00408853
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x6081c9
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x61dedc
call fcn.0060ebd0
sub esp, 0x488
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x18], edi
call fcn.0040c29b
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28c]
mov byte [ebp - 0x11], 0
call fcn.0060af67
mov byte [ebp - 4], 2
push 0x104
lea eax, [ebp - 0x494]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x28c]
call fcn.0060b122
test eax, eax
je 0x608288
push dword [ebp + 0xc]
lea esi, [ebp - 0x28c]
call fcn.0060b195
mov esi, eax
cmp esi, 0xffffffff
je 0x608271
mov ecx, esi
lea eax, [ebp - 0x28c]
call fcn.0060ad87
push edi
push eax
lea ecx, [ebp - 0x38]
call fcn.00408a20
push edi
lea ecx, [ebp - 0x38]
call fcn.0045b9b1
push eax
mov eax, esi
lea ecx, [ebp - 0x28c]
call fcn.0060abfa
mov byte [ebp - 0x11], bl
lea edi, [ebp - 0x28c]
call fcn.0060af33
cmp byte [ebp - 0x11], 0
jne 0x608314
xor edi, edi
push 0x686b5c
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call fcn.005a61ec
add esp, 0xc
test eax, eax
je 0x6082b7
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push 0x6e3e14
call fcn.00407256
mov dword [ebp - 0x18], ebx
jmp 0x60838f
push 2
push edi
push dword [ebp + 0xc]
call fcn.005a9a8c
add esp, 0xc
push dword [ebp + 0xc]
call fcn.005a9994
pop ecx
push edi
push edi
push dword [ebp + 0xc]
mov esi, eax
call fcn.005a9a8c
add esp, 0xc
push edi
push esi
lea ecx, [ebp - 0x38]
call fcn.00408a20
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x40]
call fcn.00406cd3
push dword [ebp + 0xc]
push ebx
push esi
lea esi, [ebp - 0x40]
call fcn.004a72fd
push eax
call fcn.005a97da
push dword [ebp + 0xc]
call fcn.005a6aa0
add esp, 0x14
mov esi, dword [ebp - 0x28]
sub esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x40]
call fcn.00406cd3
push esi
lea esi, [ebp - 0x40]
call fcn.004a72fd
push eax
lea ecx, [ebp - 0x60]
call fcn.00507f10
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push 0x32
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x20]
call fcn.00534780
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.00531180
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
test al, al
jne 0x60836b
push 0x6e3e14
jmp 0x60836f
lea eax, [ebp - 0x20]
push eax
call fcn.00407256
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.00406ec5
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x60]
call fcn.00507e60
mov byte [ebp - 4], bl
lea edi, [ebp - 0x28c]
call fcn.0060af33
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00408853
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x60abfa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x210], ebx
je 0x60ad7e
cmp eax, dword [esi + 0x218]
jae 0x60ad7e
mov ecx, dword [esi + 0x214]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 0x2a]
xor edi, edi
xor ecx, ecx
inc edi
add eax, dword [esi + 0x220]
push ebx
adc ecx, dword [esi + 0x224]
mov dword [ebp - 8], edi
push ecx
push eax
push dword [esi + 0x20c]
call fcn.005aa10a
push dword [esi + 0x20c]
lea eax, [ebp - 0x28]
push edi
push 0x1e
push eax
call fcn.005a97da
add esp, 0x20
cmp dword [ebp - 0x28], 0x4034b50
jne 0x60ad7e
cmp dword [ebp - 0x16], ebx
je 0x60ad7e
movzx eax, word [ebp - 0xc]
cdq
mov ecx, eax
movzx eax, word [ebp - 0xe]
mov ebx, edx
cdq
add ecx, eax
push edi
adc ebx, edx
push ebx
push ecx
push dword [esi + 0x20c]
call fcn.005aa10a
movzx eax, word [ebp - 0x20]
add esp, 0x10
test eax, eax
je 0x60ad61
jle 0x60ad7e
cmp eax, 7
jle 0x60ad7e
cmp eax, 8
jne 0x60ad7e
push dword [ebp - 0x16]
call fcn.005a51fc
mov ebx, eax
pop ecx
test ebx, ebx
je 0x60ad7e
push dword [esi + 0x20c]
push edi
push dword [ebp - 0x16]
push ebx
call fcn.005a97da
add esp, 0x10
cmp eax, edi
je 0x60acfc
and dword [ebp - 8], 0
push ebx
call fcn.005a60f9
pop ecx
mov eax, dword [ebp - 8]
jmp 0x60ad80
mov eax, dword [ebp - 0x16]
and dword [ebp - 0x40], 0
and dword [ebp - 0x3c], 0
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x12]
push 0x38
push str.1.2.3
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x60]
push 0xfffffffffffffff1
push eax
mov dword [ebp - 0x60], ebx
call fcn.005f71d0
add esp, 0x10
test eax, eax
jne 0x60ace9
lea eax, [ebp - 0x60]
push 4
push eax
call fcn.005da120
mov esi, eax
lea eax, [ebp - 0x60]
push eax
call fcn.005db630
add esp, 0xc
cmp esi, edi
jne 0x60ad51
xor esi, esi
lea eax, [ebp - 0x60]
push eax
call fcn.005db630
pop ecx
test esi, esi
je 0x60aced
jmp 0x60ace9
push dword [esi + 0x20c]
push edi
push dword [ebp - 0x16]
push dword [ebp + 8]
call fcn.005a97da
add esp, 0x10
cmp eax, edi
je 0x60acf4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4