joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5914d0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x5915ec
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x5915ec
push ebx
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push 0
push 0x80
push 3
push 0
push 1
push 1
push edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [esi + 0x14], 0
mov edi, eax
jne 0x591535
cmp edi, 0xffffffff
jne 0x591535
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [esi + 0x18], 0x791f18
xor al, al
pop esi
pop ebx
pop ebp
ret 8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 4], eax
test eax, eax
jns 0x59154e
mov dword [esi + 4], 0
xor eax, eax
cmp dword [esi + 0x14], 0
jne 0x59158e
push ebx
push eax
push 0
push 2
call fcn.005ade80
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x59158b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov dword [esi + 0x18], 0x70feec
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov byte [esi], 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0
push 0
push 0
push 4
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x5915d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi + 0x14]
mov dword [esi + 0x18], 0x70ff00
call edi
pop edi
mov dword [esi + 0x14], 0
xor al, al
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov byte [esi + 0x10], 1
mov al, 1
mov dword [esi + 8], 1
mov dword [esi + 0x18], 0
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x18], 0x70c854
xor al, al
pop esi
pop ebx
pop ebp
ret 8

Function at 0x591600
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
test eax, eax
jne 0x59161b
mov dword [esi + 0x18], 0x70c854
xor al, al
pop esi
pop ebp
ret 4
push eax
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x59163b
mov dword [esi + 0x18], 0x70ff10
xor al, al
pop esi
pop ebp
ret 4
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x591675
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi + 0x14]
mov dword [esi + 0x18], 0x70ff00
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14], 0
xor al, al
pop esi
pop ebp
ret 4
mov byte [esi + 0x10], 0
mov eax, dword [eax]
mov dword [esi + 4], eax
mov al, 1
mov dword [esi + 8], 1
mov byte [esi], 0
mov dword [esi + 0x18], 0
pop esi
pop ebp
ret 4
Function at 0x595c40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push 0x796c7c
push dword [ebp + 8]
mov byte [ebp - 1], 1
call fcn.005c4ed4
mov ebx, eax
add esp, 8
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jne 0x595c6b
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 2
push 0
push ebx
call fcn.005c5363
push ebx
call fcn.005c4cd9
mov esi, eax
add esp, 0x10
cmp esi, 8
jle 0x595dc6
push 0
lea ecx, [esi - 4]
push ecx
push ebx
call fcn.005c5363
push ebx
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push 1
push eax
call fcn.005cb2c3
mov eax, dword [ebp - 8]
add esp, 0x1c
cmp eax, dword [ebp + 0xc]
jne 0x595dc6
push edi
push 0x7d0
call fcn.005cff37
push 0
lea ecx, [esi - 8]
mov edi, eax
push ecx
push ebx
mov dword [ebp - 0x18], edi
call fcn.005c5363
push ebx
push 4
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.005cb2c3
push 0
push 0
push ebx
mov dword [ebp - 0xc], 0
call fcn.005c5363
push ebx
push 0x7d0
push 1
push edi
call fcn.005cb2c3
add esp, 0x3c
test eax, eax
je 0x595d30
nop word [eax + eax]
lea ecx, [ebp - 0xc]
push ecx
push eax
push edi
call fcn.00595b40
push ebx
push 0x7d0
push 1
push edi
call fcn.005cb2c3
add esp, 0x1c
test eax, eax
jne 0x595d10
mov eax, dword [ebp - 0x10]
lea esi, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov edi, 4
nop
mov dl, byte [esi]
dec edi
mov cl, 0x80
test eax, 0x8000
je 0x595d55
add eax, eax
xor eax, 0x1021
jmp 0x595d57
add eax, eax
test cl, dl
je 0x595d60
xor eax, 0x1021
shr cl, 1
jne 0x595d45
inc esi
test edi, edi
jne 0x595d40
mov edi, 4
lea esi, [ebp - 8]
mov bl, byte [esi]
dec edi
mov cl, 0x80
test eax, 0x8000
je 0x595d86
add eax, eax
xor eax, 0x1021
jmp 0x595d88
add eax, eax
mov edx, eax
test cl, bl
je 0x595d95
xor eax, 0x1021
mov edx, eax
shr cl, 1
jne 0x595d76
inc esi
test edi, edi
jne 0x595d71
movzx ebx, byte [ebp - 1]
xor eax, eax
cmp edx, dword [ebp - 0xc]
push dword [ebp - 0x18]
cmovne ebx, eax
call fcn.005cff1c
push dword [ebp - 0x1c]
call fcn.005c5010
add esp, 8
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.005c5010
add esp, 4
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x595de0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0x796c7c
push eax
call fcn.005c4ed4
mov esi, eax
add esp, 8
test esi, esi
jne 0x595e1c
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
push edi
push 2
push 0
push esi
call fcn.005c5363
push esi
call fcn.005c4cd9
mov edi, eax
add esp, 0x10
cmp edi, 0x14
jle 0x595fba
push 0
lea ecx, [edi - 4]
push ecx
push esi
call fcn.005c5363
push esi
push 4
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0
push 1
push eax
call fcn.005cb2c3
mov eax, dword [ebp - 0x98]
add esp, 0x1c
cmp eax, dword [ebp + 0xc]
jne 0x595fba
push ebx
push 0
lea eax, [edi - 0x14]
push eax
push esi
call fcn.005c5363
push esi
push 0x10
lea eax, [ebp - 0x24]
push 1
push eax
call fcn.005cb2c3
push 0
push 0
push esi
call fcn.005c5363
lea eax, [ebp - 0x8c]
push eax
call fcn.0059d550
push 0x800
mov dword [ebp - 0x94], 0x800
call fcn.005cff37
push esi
push 0x800
push 1
push eax
mov dword [ebp - 0x90], eax
call fcn.005cb2c3
mov ebx, eax
add esp, 0x40
test ebx, ebx
je 0x595f3d
nop word [eax + eax]
push ebx
push dword [ebp - 0x90]
lea eax, [ebp - 0x8c]
push eax
call fcn.0059d590
mov eax, dword [ebp - 0x94]
sub edi, ebx
mov ebx, dword [ebp - 0x90]
add eax, 0x14
add esp, 0xc
cmp edi, eax
jg 0x595f25
lea eax, [edi - 0x14]
push esi
push eax
push 1
push ebx
mov dword [ebp - 0x94], eax
call fcn.005cb2c3
add esp, 0x10
test eax, eax
jne 0x595f85
push esi
push dword [ebp - 0x94]
push 1
push ebx
call fcn.005cb2c3
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x595ee0
mov ebx, dword [ebp - 0x90]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.0059d3a0
push 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.005d1170
add esp, 0x14
test eax, eax
je 0x595f98
push esi
call fcn.005c5010
add esp, 4
xor al, al
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
push eax
lea eax, [ebp - 0x8c]
push ebx
push eax
call fcn.0059d590
add esp, 0xc
jmp 0x595f43
push ebx
call fcn.005cff1c
push esi
call fcn.005c5010
add esp, 8
mov al, 1
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
push esi
call fcn.005c5010
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor al, al
pop edi
pop esi
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x596110
Capabilities:
Move file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x218], esi
cmp byte [esi], 0
je 0x59625e
mov eax, dword [esi + 0x204]
test eax, eax
jle 0x59625e
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mov dword [ebp - 0x208], 0x100000
mulss xmm0, dword [0x704f38]
cvttss2si ebx, xmm0
mov dword [ebp - 0x214], ebx
cmp ebx, 0x100000
jge 0x59617e
mov dword [ebp - 0x208], ebx
test ebx, ebx
jle 0x59625e
push 0x796c7c
push esi
call fcn.0058e310
mov edi, eax
add esp, 8
test edi, edi
je 0x59625e
push 2
push 0
push edi
call fcn.005c5363
push edi
call fcn.005c4cd9
add esp, 0x10
cmp eax, dword [esi + 0x204]
jle 0x596358
cmp eax, ebx
jle 0x596358
push 0
sub eax, ebx
push eax
push edi
call fcn.005c5363
add esp, 0xc
test eax, eax
jne 0x59633c
push dword [ebp - 0x208]
call fcn.005cff37
mov esi, eax
add esp, 4
mov dword [ebp - 0x20c], esi
test esi, esi
je 0x59633c
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.005c0be0
push dword [ebp - 0x218]
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.0058e640
push str..tmp
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.0058e5c0
lea eax, [ebp - 0x204]
push 0x702d70
push eax
call fcn.0058e310
add esp, 0x2c
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x596271
push esi
call fcn.005cff1c
push edi
call fcn.005c5010
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
xor ebx, ebx
jmp 0x596286
mov esi, dword [ebp - 0x20c]
push edi
push dword [ebp - 0x208]
push 1
push esi
call fcn.005cb2c3
mov esi, eax
add esp, 0x10
test esi, esi
jle 0x5962c3
push dword [ebp - 0x210]
push esi
push 1
push dword [ebp - 0x20c]
call fcn.005d2692
add esp, 0x10
cmp eax, esi
jne 0x5962c3
add ebx, esi
cmp ebx, dword [ebp - 0x214]
jl 0x596280
push dword [ebp - 0x20c]
call fcn.005cff1c
push edi
call fcn.005c5010
add esp, 8
cmp ebx, dword [ebp - 0x214]
jge 0x5962fb
push dword [ebp - 0x210]
call fcn.005c5010
lea eax, [ebp - 0x204]
push eax
call fcn.005d4657
jmp 0x59625b
mov ebx, dword [ebp - 0x210]
push ebx
call fcn.005d4d10
push ebx
call fcn.005c5010
mov ebx, dword [ebp - 0x218]
push ebx
call fcn.005d4657
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.005d46c1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
push edi
call fcn.005c5010
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
push edi
call fcn.005c5010
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x596c10
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x418], edx
test edi, edi
je 0x596da0
mov ecx, edi
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x596c40
sub ecx, esi
cmp ecx, 0x200
jae 0x596da0
test edx, edx
je 0x596da0
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x596da0
push 0x200
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.005c0be0
push 0x200
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.005c0be0
push edi
lea eax, [ebp - 0x214]
push 0x200
push eax
call fcn.0058e640
push str..gd.tmp
lea eax, [ebp - 0x214]
push 0x200
push eax
call fcn.0058e5c0
push edi
lea eax, [ebp - 0x414]
push 0x200
push eax
call fcn.0058e640
push str..gd.bak
lea eax, [ebp - 0x414]
push 0x200
push eax
call fcn.0058e5c0
add esp, 0x48
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.005d2852
add esp, 8
test eax, eax
jne 0x596d05
lea eax, [ebp - 0x214]
push eax
call fcn.005d4657
add esp, 4
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.005d2852
add esp, 8
test eax, eax
jne 0x596d29
lea eax, [ebp - 0x414]
push eax
call fcn.005d4657
add esp, 4
lea eax, [ebp - 0x214]
push 0x702d70
push eax
call fcn.0058e310
mov esi, eax
add esp, 8
test esi, esi
je 0x596da0
push esi
push ebx
push 1
push dword [ebp - 0x418]
call fcn.005d2692
add esp, 0x10
cmp eax, ebx
jne 0x596d97
mov eax, dword [ebp + 0x14]
cmp eax, 2
jne 0x596db3
push 0x10
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push ebx
push dword [ebp - 0x418]
movups xmmword [ebp - 0x14], xmm0
call fcn.005ab9a0
add esp, 0x10
test al, al
je 0x596d97
push esi
push 1
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.005d2692
add esp, 0x10
cmp eax, 1
je 0x596deb
push esi
call fcn.005c5010
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x596deb
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0
push eax
push ebx
push dword [ebp - 0x418]
call fcn.00595b40
push esi
push 1
lea eax, [ebp - 0x41c]
push 4
push eax
call fcn.005d2692
add esp, 0x1c
jmp 0x596d92
push esi
call fcn.005c5010
push 0
push edi
call fcn.005d2852
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x596e27
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.005d46c1
add esp, 8
test eax, eax
je 0x596e27
lea eax, [ebp - 0x214]
push eax
call fcn.005d4657
jmp 0x596d9d
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.005d46c1
add esp, 8
test eax, eax
jne 0x596e61
test esi, esi
jne 0x596e4e
lea eax, [ebp - 0x414]
push eax
call fcn.005d4657
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
xor bl, bl
test esi, esi
jne 0x596e7c
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.005d46c1
add esp, 8
test eax, eax
sete bl
lea eax, [ebp - 0x214]
push eax
call fcn.005d4657
mov ecx, dword [ebp - 4]
add esp, 4
mov al, bl
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005be209
mov esp, ebp
pop ebp
ret
Function at 0x597e60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x597ea9
mov eax, dword [esi]
test eax, eax
je 0x597e8e
cmp ecx, 4
je 0x597e8e
push eax
mov dword [esi], 0
call fcn.005cff1c
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov edi, dword [ebp + 8]
test edi, edi
jne 0x597ebb
lea eax, [edi + 2]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
push edi
call fcn.005d2852
add esp, 8
test eax, eax
je 0x597ee1
call fcn.005c45dc
pop edi
mov eax, dword [eax]
mov dword [esi + 0xc], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
push 0x796c7c
push edi
call fcn.0058e310
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x597f0c
call fcn.005c45dc
mov eax, dword [eax]
mov dword [esi + 0xc], eax
lea eax, [ebx + 3]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 2
push 0
push ebx
call fcn.005c5363
add esp, 0xc
test eax, eax
jne 0x598018
push ebx
call fcn.005c4cd9
mov edi, eax
add esp, 4
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
je 0x598018
push 0
push 0
push ebx
call fcn.005c5363
add esp, 0xc
test eax, eax
jne 0x598018
test edi, edi
jg 0x597f68
push ebx
call fcn.005c5010
add esp, 4
mov eax, 9
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
call fcn.005cff37
mov ecx, eax
add esp, 4
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x597f9b
call fcn.005c45dc
push ebx
mov eax, dword [eax]
mov dword [esi + 0xc], eax
call fcn.005c5010
add esp, 4
mov eax, 7
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 4]
xor edi, edi
push ebx
mov eax, esi
sub eax, edi
push eax
lea eax, [edi + ecx]
push 1
push eax
call fcn.005cb2c3
add esp, 0x10
add edi, eax
test eax, eax
jle 0x597fc1
mov ecx, dword [ebp + 8]
cmp edi, esi
jl 0x597fa0
cmp edi, esi
mov esi, dword [ebp - 8]
je 0x597ff2
call fcn.005c45dc
mov eax, dword [eax]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 8]
push eax
call fcn.005cff1c
push ebx
call fcn.005c5010
add esp, 8
mov eax, 5
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [esi], eax
mov dword [esi + 8], 2
call fcn.005c5010
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.005c45dc
push ebx
mov eax, dword [eax]
mov dword [esi + 0xc], eax
call fcn.005c5010
add esp, 4
mov eax, 0xe
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x598040
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x598089
mov eax, dword [esi]
test eax, eax
je 0x59806e
cmp ecx, 4
je 0x59806e
push eax
mov dword [esi], 0
call fcn.005cff1c
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov edi, dword [ebp + 8]
test edi, edi
jne 0x59809b
lea eax, [edi + 2]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
push edi
call fcn.005d2852
add esp, 8
test eax, eax
je 0x5980c1
call fcn.005c45dc
pop edi
mov eax, dword [eax]
mov dword [esi + 0xc], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
push ebx
push 0x796c7c
push edi
call fcn.0058e310
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x5980ec
call fcn.005c45dc
mov eax, dword [eax]
mov dword [esi + 0xc], eax
lea eax, [ebx + 3]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 2
push 0
push ebx
call fcn.005c5363
add esp, 0xc
test eax, eax
jne 0x5981f8
push ebx
call fcn.005c4cd9
mov edi, eax
add esp, 4
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
je 0x5981f8
push 0
push 0
push ebx
call fcn.005c5363
add esp, 0xc
test eax, eax
jne 0x5981f8
test edi, edi
jg 0x598148
push ebx
call fcn.005c5010
add esp, 4
mov eax, 9
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push edi
call fcn.005cff37
mov ecx, eax
add esp, 4
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x59817b
call fcn.005c45dc
push ebx
mov eax, dword [eax]
mov dword [esi + 0xc], eax
call fcn.005c5010
add esp, 4
mov eax, 7
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp - 4]
xor edi, edi
push ebx
mov eax, esi
sub eax, edi
push eax
lea eax, [edi + ecx]
push 1
push eax
call fcn.005cb2c3
add esp, 0x10
add edi, eax
test eax, eax
jle 0x5981a1
mov ecx, dword [ebp + 8]
cmp edi, esi
jl 0x598180
cmp edi, esi
mov esi, dword [ebp - 8]
je 0x5981d2
call fcn.005c45dc
mov eax, dword [eax]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 8]
push eax
call fcn.005cff1c
push ebx
call fcn.005c5010
add esp, 8
mov eax, 5
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push ebx
call fcn.005c5010
mov eax, dword [ebp - 4]
add esp, 4
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], eax
xor eax, eax
pop ebx
pop edi
mov dword [esi + 8], 1
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.005c45dc
push ebx
mov eax, dword [eax]
mov dword [esi + 0xc], eax
call fcn.005c5010
add esp, 4
mov eax, 0xe
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x59d200
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x59d2d0
push 0
push esi
call fcn.005d2852
add esp, 8
test eax, eax
jne 0x59d2d0
push esi
call fcn.005d4657
add esp, 4
test eax, eax
je 0x59d2d0
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.005c0be0
mov ecx, dword [0x7e74f8]
push ecx
push str.._d.sg.discard
push 0x40
lea eax, [ecx + 1]
mov dword [0x7e74f8], eax
lea eax, [ebp - 0x44]
push eax
call fcn.0058e6a0
push 0x200
lea eax, [ebp - 0x244]
push 0
push eax
call fcn.005c0be0
push esi
lea eax, [ebp - 0x244]
push 0x200
push eax
call fcn.0058e5c0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x244]
push 0x200
push eax
call fcn.0058e5c0
add esp, 0x40
lea eax, [ebp - 0x244]
push eax
push esi
call fcn.005d46c1
add esp, 8
test eax, eax
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.005be209
mov esp, ebp
pop ebp
ret

Function at 0x59d550
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret
Function at 0x5a72b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push 0
mov esi, ecx
push 0
push esi
push dword [ebp + 8]
mov dword [esi + 8], eax
push 0
push 0
mov byte [esi + 4], 0
call fcn.005d03cf
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
setne al
pop esi
pop ebp
ret 8

Function at 0x5a72f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6f8ff9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x7ce4e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0x2c
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005be217
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movups xmmword [esi + 8], xmm0
xor eax, eax
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 7
mov word [esi + 8], ax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push 0xff0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0058d8a0
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 3
call fcn.0058fee0
push 0x786008
lea ecx, [esi + 8]
mov byte [ebp - 4], 4
call fcn.004a4250
push 5
push str.cs_fileconfig
lea ecx, [esi + 0x3c]
call fcn.00590000
push 0x792b9c
mov ecx, esi
mov dword [esi + 0x60], 1
call fcn.005a75f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5ab460
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
je 0x5ab4f0
cmp dword [esi + 0x10], 0
je 0x5ab47b
call fcn.005ab350
push 0x796c7c
push dword [ebp + 8]
call fcn.0058e310
add esp, 8
mov dword [esi + 0x10], eax
test eax, eax
je 0x5ab4f0
push 2
push 0
push eax
call fcn.005c5363
push dword [esi + 0x10]
call fcn.005c4cd9
push 0
push 0
push dword [esi + 0x10]
mov dword [esi + 4], eax
call fcn.005c5363
add esp, 0x1c
cmp byte [esi + 0x15], 0
jne 0x5ab4e5
push dword [esi + 4]
call fcn.005be278
push dword [esi + 4]
mov dword [esi + 0xc], eax
push 0
push eax
call fcn.005c0be0
push dword [esi + 0x10]
push dword [esi + 4]
push 1
push dword [esi + 0xc]
call fcn.005cb2c3
add esp, 0x20
mov byte [esi + 0x14], 1
mov al, 1
pop esi
pop ebp
ret 4
xor al, al
pop esi
pop ebp
ret 4

Function at 0x5ab5c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
test ecx, ecx
je 0x5ab625
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x5ab625
cmp byte [esi + 0x14], 0
je 0x5ab625
cmp byte [esi + 0x15], 0
je 0x5ab5ff
push dword [esi + 0x10]
push edi
push 1
push ecx
call fcn.005cb2c3
add esp, 0x10
cmp eax, edi
jne 0x5ab625
add dword [esi + 8], edi
mov al, 1
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esi + 8]
lea eax, [edx + edi]
cmp eax, dword [esi + 4]
jg 0x5ab625
mov eax, dword [esi + 0xc]
push edi
add eax, edx
push eax
push ecx
call fcn.005c0660
add esp, 0xc
mov al, 1
add dword [esi + 8], edi
pop edi
pop esi
pop ebp
ret 8
pop edi
xor al, al
pop esi
pop ebp
ret 8

Function at 0x5aba20
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
xor esi, 0x1505
cmp edi, 4
jl 0x5aba8f
push ebx
mov ebx, edi
shr ebx, 2
mov eax, ebx
neg eax
lea edi, [edi + eax*4]
test edx, edx
jne 0x5aba4d
xor eax, eax
jmp 0x5aba6b
movzx eax, byte [edx + 3]
movzx ecx, byte [edx + 2]
shl eax, 8
add eax, ecx
movzx ecx, byte [edx + 1]
shl eax, 8
add eax, ecx
movzx ecx, byte [edx]
shl eax, 8
add eax, ecx
imul ecx, eax, 0x5bd1e995
add edx, 4
imul esi, esi, 0x5bd1e995
mov eax, ecx
sar eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
xor esi, ecx
sub ebx, 1
jne 0x5aba45
pop ebx
sub edi, 1
je 0x5abab0
sub edi, 1
je 0x5abaa7
sub edi, 1
jne 0x5ababb
movzx eax, byte [edx + 2]
shl eax, 0x10
xor esi, eax
movzx eax, byte [edx + 1]
shl eax, 8
xor esi, eax
movzx eax, byte [edx]
xor eax, esi
imul esi, eax, 0x5bd1e995
mov eax, esi
sar eax, 0xd
xor eax, esi
imul ecx, eax, 0x5bd1e995
pop edi
pop esi
mov eax, ecx
sar eax, 0xf
xor eax, ecx
pop ebp
ret