joyce8/EMBER2024-capa huggingface dataset:
Function at 0x545640
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d4130
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
push edi
mov edi, ecx
call fcn.005453a0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0
push 0
push dword [edi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x5457af
push esi
xor esi, esi
mov dword [ebp - 0x14], 0x100
cmp dword [ebp - 0x10], esi
jbe 0x5457ae
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [eax]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x248]
push eax
push esi
push dword [edi + 0x1c]
call ebx
test eax, eax
jne 0x54579c
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], eax
mov word [ebp - 0x48], ax
cmp word [ebp - 0x248], ax
je 0x545710
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x545701
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x48]
call fcn.004bba20
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x30], 0
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0050be40
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x30]
add esp, 8
push eax
call fcn.004d8200
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x54576e
inc eax
lea ecx, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
call fcn.0040ee30
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x54579c
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.004bc930
inc esi
mov dword [ebp - 0x14], 0x100
cmp esi, dword [ebp - 0x10]
jb 0x5456c0
pop ebx
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5457c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d4150
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
call fcn.005453a0
xor eax, eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
call fcn.0050bd30
add esp, 8
lea ecx, [ebp - 0x14]
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push ecx
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x545860
push dword [ebp + 8]
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
call fcn.00545210
push 0
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.00503be0
push 0x6340e8
lea eax, [ebp - 0x70]
push eax
call fcn.005879e4
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
cmp ecx, 8
jb 0x545878
inc ecx
push ecx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.004bc930
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x545890
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d4170
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push edi
mov edi, ecx
call fcn.005453a0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [edi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x5459ef
push esi
xor esi, esi
mov dword [ebp - 0x14], 0x100
cmp dword [ebp - 0x10], esi
jbe 0x5459ee
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x244]
push eax
push esi
push dword [edi + 0x1c]
call ebx
test eax, eax
jne 0x5459dc
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], eax
mov word [ebp - 0x44], ax
cmp word [ebp - 0x244], ax
je 0x545950
lea eax, [ebp - 0x244]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x545941
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x44]
call fcn.004bba20
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0050be40
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
add esp, 8
push eax
call fcn.004d8200
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x5459ae
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.0040ee30
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x5459dc
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.004bc930
inc esi
mov dword [ebp - 0x14], 0x100
cmp esi, dword [ebp - 0x10]
jb 0x545900
pop ebx
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x5542e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d4fb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00554280
mov eax, dword [ebp + 8]
lea ecx, [esi + 0xc]
push 0xffffffffffffffff
mov dword [esi], vtable.Poco::XML::Event.0
mov dword [esi + 8], eax
push 0
push dword [ebp + 0xc]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0
mov byte [ecx], 0
call fcn.0040ea60
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0x14]
mov byte [esi + 0x30], al
mov al, byte [ebp + 0x18]
mov byte [esi + 0x31], al
mov eax, esi
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 1
mov word [esi + 0x32], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x55a260
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d3f58
push eax
mov dword fs:[0], esp
sub esp, 0x44
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x55a28e
push eax
call fcn.00563a60
add esp, 4
cmp dword [esi + 8], 0
jne 0x55a2a4
push 0x1000
call fcn.005021d8
add esp, 4
mov dword [esi + 8], eax
push 0
push 0x64e060
push 0x64e034
push 0
push dword [esi + 0x2c]
call fcn.005882ba
add esp, 0x14
test eax, eax
je 0x55a304
cmp byte [esi + 0xc], 0
je 0x55a2d4
cmp dword [esi + 0x24], 0x10
lea eax, [esi + 0x10]
jb 0x55a2d6
mov eax, dword [eax]
jmp 0x55a2d6
xor eax, eax
push 9
push eax
call fcn.00563a20
add esp, 8
mov dword [esi + 4], eax
test eax, eax
je 0x55a388
push 0x558670
push 0x559db0
push eax
call fcn.00563ca0
add esp, 0xc
jmp 0x55a388
push 0
push 0x64e094
push 0x64e034
push 0
push dword [esi + 0x2c]
call fcn.005882ba
add esp, 0x14
test eax, eax
je 0x55a367
cmp byte [esi + 0xc], 0
je 0x55a334
cmp dword [esi + 0x24], 0x10
lea eax, [esi + 0x10]
jb 0x55a336
mov eax, dword [eax]
jmp 0x55a336
xor eax, eax
push 9
push eax
call fcn.00563a20
add esp, 8
mov dword [esi + 4], eax
test eax, eax
je 0x55a388
push 1
push eax
call fcn.00563d10
push 0x558670
push 0x559db0
push dword [esi + 4]
call fcn.00563ca0
add esp, 0x14
jmp 0x55a388
cmp byte [esi + 0xc], 0
je 0x55a37a
cmp dword [esi + 0x24], 0x10
lea eax, [esi + 0x10]
jb 0x55a37c
mov eax, dword [eax]
jmp 0x55a37c
xor eax, eax
push eax
call fcn.00563a00
add esp, 4
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
test eax, eax
jne 0x55a3ce
push 0x1a
push str.Cannot_create_Expat_parser
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x24], al
call fcn.0040e960
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x50]
call fcn.00549b70
push 0x63fb98
lea eax, [ebp - 0x50]
push eax
call fcn.005879e4
push esi
push eax
call fcn.00563d80
push 0x5585f0
push 0x559d20
push dword [esi + 4]
call fcn.00563c50
push 0x558560
push dword [esi + 4]
call fcn.00563bd0
push 0x5598b0
push dword [esi + 4]
call fcn.00563d00
add esp, 0x24
cmp byte [esi + 0x28], 0
push fcn.0040e670
push dword [esi + 4]
je 0x55a419
call fcn.00563c10
jmp 0x55a41e
call fcn.00563bf0
add esp, 8
push 0x55a090
push dword [esi + 4]
call fcn.00563d70
push 0x559740
push dword [esi + 4]
call fcn.00563cc0
push 0x559170
push dword [esi + 4]
call fcn.00563c90
push 0x558580
push dword [esi + 4]
call fcn.00563be0
push 0x5585b0
push 0x559a60
push dword [esi + 4]
call fcn.00563bb0
push 0x5585d0
push 0x559a80
push dword [esi + 4]
call fcn.00563c30
push 0x558760
push dword [esi + 4]
call fcn.00563c70
add esp, 0x40
push 0x5599c0
push dword [esi + 4]
call fcn.00563d40
xor eax, eax
mov ecx, 2
cmp byte [esi + 0x2a], al
cmovne eax, ecx
push eax
push dword [esi + 4]
call fcn.00563cd0
push esi
push 0x559f50
push dword [esi + 4]
call fcn.00563d50
mov ecx, dword [ebp - 0xc]
add esp, 0x1c
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x562240
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
cmp dword [esp + 0x10], 0
jle 0x562343
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push edi
nop dword [eax + eax]
mov edi, dword [eax + 8]
add ecx, edi
mov esi, dword [eax + 0xc]
adc edx, esi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor ecx, ecx
mov edx, esi
shld esi, edi, 0xd
shr edx, 0x13
or ecx, esi
shl edi, 0xd
mov esi, dword [eax]
or edx, edi
mov edi, dword [eax + 0x18]
mov dword [eax + 8], edx
xor dword [eax + 8], esi
mov edx, dword [eax + 4]
mov dword [eax + 0xc], ecx
xor ecx, ecx
xor dword [eax + 0xc], edx
or ecx, esi
add dword [eax + 0x10], edi
mov esi, dword [eax + 0x1c]
adc dword [eax + 0x14], esi
mov ebp, dword [eax + 0x10]
mov ebx, dword [eax + 0x14]
mov dword [eax], edx
mov edx, esi
shld esi, edi, 0x10
mov dword [eax + 4], ecx
xor ecx, ecx
or ecx, esi
shr edx, 0x10
shl edi, 0x10
or edx, edi
mov dword [eax + 0x1c], ecx
xor dword [eax + 0x1c], ebx
mov esi, dword [eax + 0x1c]
mov dword [eax + 0x18], edx
mov edx, esi
xor dword [eax + 0x18], ebp
mov edi, dword [eax + 0x18]
add dword [eax], edi
adc dword [eax + 4], esi
xor ecx, ecx
shld esi, edi, 0x15
shr edx, 0xb
or ecx, esi
shl edi, 0x15
mov esi, dword [eax + 0xc]
or edx, edi
mov edi, dword [eax + 8]
mov dword [eax + 0x18], edx
mov edx, dword [eax + 4]
mov dword [eax + 0x1c], ecx
xor dword [eax + 0x1c], edx
mov edx, esi
mov ecx, dword [eax]
xor dword [eax + 0x18], ecx
add ebp, edi
adc ebx, esi
xor ecx, ecx
shld esi, edi, 0x11
shr edx, 0xf
or ecx, esi
shl edi, 0x11
or edx, edi
mov dword [eax + 0xc], ecx
xor ecx, ecx
mov dword [eax + 8], edx
mov esi, ebp
mov edx, ebx
xor dword [eax + 0xc], edx
or ecx, esi
xor dword [eax + 8], esi
sub dword [esp + 0x20], 1
mov dword [eax + 0x10], edx
mov edx, dword [eax + 4]
mov dword [eax + 0x14], ecx
mov ecx, dword [eax]
jne 0x562260
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x57114f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x59dbdf
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0059daa2

Function at 0x5a74d3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005a7352

Function at 0x5ab0d9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005aad99
Function at 0x5b3170
Capabilities:
Terminate process

Disassembly:
call fcn.005b3000
push eax
push dword [esp + 8]
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_acm.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__30_December_2001._n_n
push 2
call fcn.005a2f5d
add esp, 4
push eax
call fcn.0040e130
add esp, 0x10
cmp dword [esp + 4], 0x3ef
jne 0x5b31b4
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
push 2
call fcn.005a2f5d
add esp, 4
push eax
call fcn.0040e130
add esp, 8
push 3
call fcn.005a014a
int3
Function at 0x5b3240
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [eax + 0x38]
mov bl, byte [eax + 0x34]
test esi, esi
jle 0x5b327d
mov edx, dword [eax + 0x260]
push edi
movzx edi, bl
nop word [eax + eax]
mov ecx, edx
shl edx, 8
shr ecx, 0x18
xor ecx, edi
xor edx, dword [ecx*4 + 0x648670]
mov dword [eax + 0x260], edx
sub esi, 1
jne 0x5b3260
pop edi
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], 1
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, 1
je 0x5b32d4
sub ecx, 1
je 0x5b330a
sub ecx, 1
je 0x5b32e3
mov byte [edx + eax + 0x54], 1
mov edx, dword [eax + 0x24]
mov ecx, dword [eax + 0x44]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov bl, byte [eax + 0x38]
sub bl, 4
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
Function at 0x5ba340
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esi + 0x44]
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x20]
mov ebp, dword [esi + 0x268]
mov ecx, dword [esi + 0x30]
mov dword [esp + 0x10], eax
cmp edi, 0x2710
jge 0x5ba371
push ebp
push edi
push eax
jmp 0x5ba44b
lea eax, [edi + 0x22]
test al, 1
lea edx, [eax + 1]
cmove edx, eax
add edx, dword [esi + 0x24]
mov dword [esp + 0x14], edx
cmp ecx, 1
jge 0x5ba38f
mov ecx, 1
jmp 0x5ba399
mov eax, 0x64
cmp ecx, eax
cmovg ecx, eax
dec ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push ebp
push edi
push dword [esp + 0x1c]
push dword [esp + 0x24]
push dword [esi + 0x24]
push ebx
call fcn.005bb470
mov eax, dword [esp + 0x3c]
add esp, 0x1c
cmp ebp, 3
jl 0x5ba424
mov ecx, dword [esp + 0x18]
mov edx, 1
sub ecx, eax
test edi, edi
mov eax, edi
cmove eax, edx
sub esp, 8
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
push edi
push ecx
push str._______d_work___d_block__ratio__5.2f_n
push 2
call fcn.005a2f5d
add esp, 4
push eax
call fcn.0040e130
mov eax, dword [esp + 0x38]
add esp, 0x18
test eax, eax
jns 0x5ba459
cmp ebp, 2
jl 0x5ba445
push str.____too_repetitive__using_fallback_sorting_algorithm_n
push 2
call fcn.005a2f5d
add esp, 4
push eax
call fcn.0040e130
add esp, 8
push ebp
push edi
push dword [esp + 0x18]
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.005ba7d0
add esp, 0x14
mov ecx, dword [esi + 0x44]
xor eax, eax
mov dword [esi + 0x1c], 0xffffffff
test ecx, ecx
jle 0x5ba480
nop dword [eax]
cmp dword [ebx + eax*4], 0
je 0x5ba47d
inc eax
cmp eax, ecx
jl 0x5ba470
jmp 0x5ba480
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x1c], 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
jne 0x5ba49a
add esp, 0xc
mov dword [esp + 4], 0x3eb
jmp fcn.005b3170
add esp, 0xc
ret
Function at 0x5c0320
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d69ce
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x647138]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x649bf8]
cmp eax, 0xffffffff
jne 0x5c0356
xor ebx, ebx
jmp 0x5c035f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x5c03a1
nop dword [eax]
cmp dword [ebx + 0x18], 0
mov esi, dword [ebx + 0xc]
jne 0x5c03e0
test esi, esi
jne 0x5c03e4
push 0x5bf2c0
push 0x655fe8
call fcn.005befb0
mov eax, dword [0x649bf8]
add esp, 8
cmp eax, 0xffffffff
je 0x5c03a1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x5c03ce
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x5c03ce
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x5c0426
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x5c040f
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x5c03e4
cmp dword [ebx + 0x18], 0
je 0x5c0370
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x5c0449
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x5c0449
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.0041fd50
cmp dword [ebx + 0x18], 0
jne 0x5c0430
jmp 0x5c0370

Function at 0x5c0470
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, ecx
mov edx, dword [edi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x5c04d0
push 0
push 0
call fcn.0059ddfe
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x5c0499
pop edi
xor al, al
pop ebx
ret
mov eax, dword [edi]
push esi
add eax, 4
lock inc dword [eax]
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x5c04b7
cmp eax, 0xffffffff
je 0x5c04b7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov eax, dword [edi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
mov al, 1
pop ebx
ret
Function at 0x5c09c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6a18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004147e0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push edx
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedBidirectionalStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], eax
call fcn.005021d8
push dword [esi + 0x38]
mov dword [esi + 0x40], eax
call fcn.005021d8
mov ecx, dword [esi + 0x40]
add esp, 8
mov dword [esi + 0x44], eax
add ecx, 4
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
sub ecx, ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x38]
add edx, ecx
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5c11b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x68], 0xffffffff
je 0x5c120a
mov eax, dword [esi + 0x48]
test al, 1
je 0x5c120a
test al, 2
je 0x5c11ca
mov eax, dword [esi]
call dword [eax + 0x34]
push 0
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x68]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5c11fa
lea eax, [esi + 0x50]
push eax
call fcn.005c5c70
add esp, 4
mov eax, dword [esp + 4]
add dword [esi + 0x70], eax
adc dword [esi + 0x74], 0
pop esi
pop ecx
ret 0xc
or eax, 0xffffffff
pop esi
pop ecx
ret 0xc

Function at 0x5c14f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
mov ecx, dword [esi + 0x68]
cmp ecx, 0xffffffff
je 0x5c1599
mov eax, dword [esi + 0x48]
test al, 2
je 0x5c1599
test al, 8
je 0x5c1557
push 2
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
push 0
push ecx
movlpd qword [esp + 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x5c154d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x5c1549
lea eax, [esi + 0x50]
push eax
call fcn.005c5c70
add esp, 4
mov eax, dword [esp + 8]
mov dword [esi + 0x70], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x74], eax
push 0
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esi + 0x68]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5c1587
lea eax, [esi + 0x50]
push eax
call fcn.005c5c70
add esp, 4
mov eax, dword [esp + 4]
add dword [esi + 0x70], eax
adc dword [esi + 0x74], 0
pop esi
add esp, 0xc
ret 0xc
or eax, 0xffffffff
pop esi
add esp, 0xc
ret 0xc