joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a1fec3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
call fcn.05a2826a
mov eax, dword [ebx]
push 0x5b9a9f4
mov ecx, ebx
call dword [eax + 0x34]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.05a1cc5a
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x84]
call fcn.05a278ac
lea ecx, [ebp - 0x84]
call fcn.05a27980
push eax
lea ecx, [ebp - 0xc]
call fcn.05a17f0e
lea ecx, [ebp - 0xc]
call fcn.05a17c5d
test eax, eax
je 0x5a200fa
push esi
push edi
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x34]
call fcn.05a21fff
lea ecx, [ebp - 0x34]
call fcn.05a2bbf0
push eax
lea ecx, [ebp - 0x24]
call fcn.05a17f0e
lea ecx, [ebp - 0x24]
call fcn.05a17c5d
test eax, eax
jne 0x5a1ff67
lea ecx, [ebp - 0x84]
call fcn.05a278fa
push eax
lea ecx, [ebp - 0xc]
call fcn.05a17dc7
jmp 0x5a200d8
lea ecx, [ebp - 0xb0]
call fcn.05a28c87
push 0
lea ecx, [ebp - 0x68]
call fcn.05a1e482
mov esi, dword [ebx + 0x90]
lea ecx, [ebp - 0x24]
call fcn.05a17c6f
test al, al
jne 0x5a200a9
lea eax, [ebp - 0xb0]
push 0
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], eax
call fcn.05a9026e
mov dword [esp], 0x5a1f560
mov esi, eax
push 0x5a1fd93
push esi
call fcn.05a8a078
push 0x5a1f574
push esi
call fcn.05a8a08b
lea eax, [ebp - 0x68]
push eax
push esi
call fcn.05a8a058
add esp, 0x1c
push dword [0x5b27be0]
lea ecx, [ebp - 0x18]
call fcn.05a179ec
lea ecx, [ebp - 0xc]
call fcn.05a17c6f
test al, al
jne 0x5a20024
lea ecx, [ebp - 0xc]
call fcn.05a17c5d
test eax, eax
je 0x5a20024
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.05a1e5c8
mov edi, eax
add esp, 0xc
test edi, edi
jns 0x5a20030
push esi
call fcn.05a8b9f4
pop ecx
lea ecx, [ebp - 0x18]
call fcn.05a17dc2
mov eax, edi
jmp 0x5a20096
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
call fcn.05a17dc7
lea ecx, [ebp - 0x18]
call fcn.05a17c5d
cmp eax, 0x7fffffff
jbe 0x5a20050
push esi
call fcn.05a8b9f4
pop ecx
lea ecx, [ebp - 0x18]
call fcn.05a17dc2
jmp 0x5a200a9
push 1
lea ecx, [ebp - 0x18]
call fcn.05a17c5d
push eax
lea ecx, [ebp - 0x18]
call fcn.05a17c6c
push eax
push esi
call fcn.05a8bb04
add esp, 0x10
test eax, eax
je 0x5a2003f
mov ecx, dword [ebp - 0x44]
call fcn.05a28283
test eax, eax
je 0x5a2003f
mov ecx, dword [ebp - 0x44]
call fcn.05a29f75
push esi
call fcn.05a8b9f4
pop ecx
lea ecx, [ebp - 0x18]
call fcn.05a17dc2
xor eax, eax
test eax, eax
js 0x5a200a9
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xb0]
push eax
call fcn.05a2af6c
lea ecx, [ebp - 0x84]
call fcn.05a278fa
push eax
lea ecx, [ebp - 0xc]
call fcn.05a17dc7
lea ecx, [ebp - 0x5c]
call fcn.05a17dc2
lea ecx, [ebp - 0x68]
call fcn.05a17dc2
lea ecx, [ebp - 0xb0]
call fcn.05a281ed
lea ecx, [ebp - 0x24]
call fcn.05a17dc2
lea ecx, [ebp - 0x34]
call fcn.05a220d5
lea ecx, [ebp - 0xc]
call fcn.05a17c5d
test eax, eax
jne 0x5a1ff25
pop edi
pop esi
lea ecx, [ebp - 0xc]
call fcn.05a17dc2
lea ecx, [ebp - 0x84]
call fcn.05a278d5
lea ecx, [ebp - 0x40]
call fcn.05a17dc2
xor eax, eax
pop ebx
leave
ret 4
Function at 0x5a21fff
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5b920e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push dword [0x5b27be0]
mov esi, ecx
call fcn.05a179ec
push 0x5b9aa90
mov ecx, esi
call fcn.05a17dc7
and dword [esi + 0xc], 0
lea eax, [ebp - 0x34]
push eax
mov ecx, ebx
call fcn.05a17c6c
push eax
call fcn.05accc76
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x5a220c3
test dword [ebp - 0x2e], 0x4000
jne 0x5a220c3
mov eax, dword [ebp - 0x20]
push edi
mov dword [esi + 0xc], eax
inc eax
push 0x5b9c020
push eax
call fcn.05ac9c10
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x5a220b3
mov eax, dword [ebp - 0x20]
inc eax
push eax
push 0
push edi
call fcn.05acaa80
add esp, 0xc
push 0x5b27df0
mov ecx, ebx
call fcn.05a17c6c
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.05acd709
add esp, 0xc
test eax, eax
jne 0x5a220b3
push dword [ebp - 0x38]
push 1
push dword [ebp - 0x20]
push edi
call fcn.05acd619
push dword [ebp - 0x38]
call fcn.05acd13a
add esp, 0x14
push edi
mov ecx, esi
call fcn.05a17ba2
push edi
call fcn.05ac8aac
pop ecx
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.05ac7ec0
leave
ret 4
Function at 0x5a22ca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b17ac8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5b920e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x5a22dc1
cmp byte [edi + 0x49], bl
je 0x5a22dc1
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x5a22db5
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x5a22d15
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x5a22d2d
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x5a22d56
dec eax
je 0x5a22d5a
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x5a22db0
jmp 0x5a22dbc
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x5a22d6a
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x5a22d93
cmp ebx, 0x10
jae 0x5a22d79
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.05acd305
add esp, 0x10
cmp esi, eax
jne 0x5a22dad
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x5a22db9
test esi, esi
jne 0x5a22d21
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.05a07d90
jmp 0x5a22d1b
lea ecx, [ebp - 0x2c]
call fcn.05a04420
xor al, al
jmp 0x5a22dc3
lea ecx, [ebp - 0x2c]
call fcn.05a04420
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.05ac7ec0
mov esp, ebp
pop ebp
ret
Function at 0x5a233b8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5b920e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x50
call fcn.05ac9465
mov esi, eax
xor edi, edi
pop ecx
cmp esi, edi
jne 0x5a233ed
mov eax, 0x80000002
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.05ac7ec0
leave
ret
push ebx
push edi
push 0x50
push esi
call fcn.05acaa80
push edi
call fcn.05accb4b
add esp, 0x10
mov dword [esi], eax
mov dword [esi + 4], edx
call sub.KERNEL32.dll_GetCurrentProcessId
mov ebx, eax
mov dword [esi + 8], ebx
mov dword [ebp - 0x14], edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call sub.KERNEL32.dll_GetLogicalDrives
push 0x10
mov dword [esi + 0xc], eax
pop edi
test al, 3
je 0x5a23455
lea eax, [ebp - 0x14]
push eax
push 3
call fcn.05acebf3
pop ecx
pop ecx
test eax, eax
jne 0x5a23455
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x10]
add dword [esi + 0x14], eax
mov eax, dword [ebp - 0xc]
add dword [esi + 0x18], eax
mov eax, dword [ebp - 8]
add dword [esi + 0x1c], eax
push 0x20
pop edi
push 0
call fcn.05accb4b
and eax, ebx
push eax
call fcn.05acebc0
pop ecx
pop ecx
pop ebx
jmp 0x5a23475
call fcn.05acebd2
sar eax, 8
mov byte [edi + esi], al
inc edi
cmp edi, 0x50
jb 0x5a23469
push 0x50
push esi
call fcn.05a32910
pop ecx
pop ecx
call fcn.05a32a90
test eax, eax
jne 0x5a234a0
mov edi, 0x80000008
push esi
call fcn.05ac8e2e
pop ecx
mov eax, edi
jmp 0x5a233df
xor edi, edi
jmp 0x5a23492
Function at 0x5a2bd9c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
push 3
xor edx, edx
pop edi
div edi
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp + 0x10], esi
imul eax, eax, 3
mov dword [ebp + 0xc], edx
cmp eax, esi
jbe 0x5a2be3d
push ebx
movzx edx, byte [edi + esi]
shr edx, 2
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_w]
mov byte [ecx], dl
movzx edx, byte [edi + esi]
movzx ebx, byte [edi + esi + 1]
and edx, 3
add dword [ebp + 0x10], 4
add edx, edx
shr ebx, 4
mov dl, byte [ebx + edx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_w]
mov byte [ecx + 1], dl
movzx edx, byte [edi + esi + 1]
movzx ebx, byte [edi + esi + 2]
and edx, 0xf
shr ebx, 6
mov dl, byte [ebx + edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_w]
mov byte [ecx + 2], dl
movzx edx, byte [edi + esi + 2]
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_w]
mov byte [ecx + 3], dl
add ecx, 4
cmp byte [ebp + 0x14], 0
je 0x5a2be35
cmp dword [ebp + 0x10], 0x4c
jne 0x5a2be35
mov word [ecx], 0xa0d
add ecx, 2
and dword [ebp + 0x10], 0
add esi, 3
cmp esi, eax
jb 0x5a2bdc1
pop ebx
cmp dword [ebp + 0xc], 1
jne 0x5a2be6d
movzx eax, byte [esi + edi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_w]
mov byte [ecx], al
movzx eax, byte [esi + edi]
and eax, 3
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_w]
mov byte [ecx + 1], al
mov word [ecx + 2], 0x3d3d
jmp 0x5a2beb2
cmp dword [ebp + 0xc], 2
jne 0x5a2beb2
lea eax, [esi + edi]
movzx edx, byte [eax]
shr edx, 2
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_w]
mov byte [ecx], dl
movzx edx, byte [eax]
movzx esi, byte [eax + 1]
and edx, 3
add edx, edx
shr esi, 4
mov dl, byte [esi + edx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_w]
mov byte [ecx + 1], dl
movzx eax, byte [eax + 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_w]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
pop edi
pop esi
pop ebp
ret
Function at 0x5a39510
Capabilities:
Access the windows event log

Disassembly:
mov eax, pe_nt_image_headers32
call fcn.05acf3e0
mov eax, dword [0x5b920e8]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x5a39575
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x5a39575
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.05acd750
add eax, 0x40
push eax
call fcn.05acda10
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.05ac7ec0
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.05acfb78
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x5a39604
call fcn.05a39430
test eax, eax
je 0x5a39604
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.05ac7ec0
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.05ac7ec0
add esp, 0x108
ret
Function at 0x5a71310
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.05acf3e0
mov eax, dword [0x5b920e8]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
mov ebx, dword [esp + 0xa0]
push ebp
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebx, ebx
je 0x5a7135f
mov eax, 1
mov dword [esi], ebx
jmp 0x5a71361
mov ebx, dword [esi]
test ecx, ecx
je 0x5a71428
push ebx
call fcn.05a326c0
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x5a71390
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.05a39630
add esp, 0xc
mov ebp, dword [esp + 0xa8]
cmp edi, ebp
jge 0x5a713c9
mov ecx, dword [esp + 0x10]
push ecx
lea edi, [esi + 4]
push ebx
push edi
call fcn.05a31780
mov edx, dword [esp + 0x20]
push ebp
push edx
push edi
call fcn.05a31810
lea ebp, [esi + 0x34]
push ebp
lea eax, [esi + 0x38]
push eax
push edi
call fcn.05a31820
add esp, 0x24
jmp 0x5a71404
cmp ebp, 0x80
jbe 0x5a713e5
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.05a39630
add esp, 0xc
mov ecx, dword [esp + 0x14]
push ebp
push ecx
lea edx, [esi + 0x38]
push edx
call fcn.05ac9880
mov eax, dword [esp + 0xb4]
lea ebp, [esi + 0x34]
add esp, 0xc
mov dword [ebp], eax
mov ebp, dword [ebp]
cmp ebp, 0x80
je 0x5a7142c
mov ecx, 0x80
sub ecx, ebp
push ecx
lea edx, [esi + ebp + 0x38]
push 0
push edx
call fcn.05acaa80
add esp, 0xc
jmp 0x5a7142c
test eax, eax
je 0x5a714a3
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x5a71430
mov ebp, dword [esp + 0x10]
push ebp
lea edi, [esi + 0x14]
push ebx
push edi
call fcn.05a31780
push ebx
call fcn.05a326c0
push eax
lea edx, [esp + 0x2c]
push edx
push edi
call fcn.05a31810
add esp, 0x1c
xor eax, eax
lea esp, [esp]
mov cl, byte [esi + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x5a71470
push ebp
lea edi, [esi + 0x24]
push ebx
push edi
call fcn.05a31780
push ebx
call fcn.05a326c0
push eax
lea edx, [esp + 0x2c]
push edx
push edi
call fcn.05a31810
add esp, 0x1c
lea eax, [esi + 0x14]
push eax
add esi, 4
push esi
call fcn.05a31970
mov ecx, dword [esp + 0xa0]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.05ac7ec0
add esp, 0x8c
ret
Function at 0x5a76f40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
cmp ecx, dword [ebx + 4]
jge 0x5a76f59
mov edi, ebx
mov ebx, eax
jmp 0x5a76f5b
mov edi, eax
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jle 0x5a76f71
push eax
push esi
call fcn.05a4fb50
add esp, 8
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x5a76f8d
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 4]
jl 0x5a76f78
cmp eax, dword [edi + 4]
jge 0x5a76fa2
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x5a76f92
mov edi, dword [edi + 4]
mov dword [esi + 4], edi
test edi, edi
jle 0x5a76fc6
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
or ecx, 0xffffffff
mov edx, dword [eax]
sub eax, 4
test edx, edx
jne 0x5a76fc6
add dword [esi + 4], ecx
cmp dword [esi + 4], edx
jg 0x5a76fb5
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x5a87b8f
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
add esp, 0x190
ret

Function at 0x5a8860f
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x5b19696
call fcn.05ad126c
sub esp, 0xa0
push ebx
push esi
push edi
mov edi, 0x5b9b710
mov ecx, edi
mov dword [ebp - 0x18], edi
call fcn.05a1a793
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov esi, 0x5b9b728
push eax
mov ecx, esi
call fcn.05a87dda
mov ebx, dword [eax]
cmp ebx, dword [0x5b9b72c]
je 0x5a8866b
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebx + 0x28]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0x10
jb 0x5a88678
mov eax, dword [ebx]
jmp 0x5a8867a
mov eax, ebx
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x5a886f9
push eax
lea ecx, [ebp - 0xac]
call fcn.05a99754
mov ebx, eax
push dword [ebp + 8]
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.05a12cc0
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.05a99707
push 0
lea eax, [ebp - 0x70]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.05a88576
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.05a883f9
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.05a87da0
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0
call fcn.05a9952b
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x14]
add eax, 0x28
jmp 0x5a8865c
push ebx
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.05a87e5f
int3
Function at 0x5a907e9
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x5a90806
push 0x74
push str.e:myprojectslicensing_sdk_nobuilds_org_srcpoco_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.05a96fa8
add esp, 0xc
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x5a90811
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5a90844
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x5a9083b
cmp eax, 3
jbe 0x5a90837
cmp eax, 0xf
je 0x5a90837
cmp eax, 0x15
jne 0x5a9083b
xor al, al
pop esi
ret
add esi, 4
push esi
call fcn.05a90429
mov al, 1
pop esi
ret
jmp 0x5a907e9

Function at 0x5a90848
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x5a90868
push 0xb5
push str.e:myprojectslicensing_sdk_nobuilds_org_srcpoco_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.05a96fa8
add esp, 0xc
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x5a90873
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5a90888
add esi, 4
push esi
call fcn.05a90429
shr eax, 4
and eax, 1
pop esi
ret
jmp 0x5a90848

Function at 0x5a90890
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x5a90806
push 0x74
push str.e:myprojectslicensing_sdk_nobuilds_org_srcpoco_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.05a96fa8
add esp, 0xc
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x5a90811
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5a90844
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x5a9083b
cmp eax, 3
jbe 0x5a90837
cmp eax, 0xf
je 0x5a90837
cmp eax, 0x15
jne 0x5a9083b
xor al, al
pop esi
ret
add esi, 4
push esi
call fcn.05a90429
mov al, 1
pop esi
ret
jmp 0x5a907e9

Function at 0x5a90895
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x5a90868
push 0xb5
push str.e:myprojectslicensing_sdk_nobuilds_org_srcpoco_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.05a96fa8
add esp, 0xc
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x5a90873
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5a90888
add esi, 4
push esi
call fcn.05a90429
shr eax, 4
and eax, 1
pop esi
ret
jmp 0x5a90848
Function at 0x5a98e89
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5b1a1fa
call fcn.05ad126c
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.05a9884b
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
mov dword [esi], vtable.Poco::XML::Event.0
mov dword [esi + 8], eax
call fcn.05a12cc0
mov eax, dword [ebp + 0x10]
and dword [esi + 0x2c], 0
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov al, byte [ebp + 0x14]
mov byte [esi + 0x34], al
mov al, byte [ebp + 0x18]
mov byte [esi + 0x35], al
mov dword [esi + 0x30], 1
mov word [esi + 0x36], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x14
Function at 0x5a9b73b
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x30]
push edi
jmp 0x5a9b8be
cmp al, 0x5c
jne 0x5a9b787
inc esi
mov al, byte [esi]
test al, al
je 0x5a9b834
cmp al, 0x51
jne 0x5a9b8bd
inc esi
mov al, byte [esi]
test al, al
je 0x5a9b834
cmp al, 0x5c
jne 0x5a9b765
test al, al
je 0x5a9b834
inc esi
cmp byte [esi], 0x45
jne 0x5a9b765
jmp 0x5a9b8bd
cmp al, 0x5b
jne 0x5a9b817
xor edi, edi
inc esi
movzx eax, byte [esi]
cmp eax, 0x5c
jne 0x5a9b7bf
lea eax, [esi + 1]
cmp byte [eax], 0x45
jne 0x5a9b7a6
mov esi, eax
jmp 0x5a9b791
push 3
push 0x5b456a0
push eax
call fcn.05acf215
add esp, 0xc
test eax, eax
jne 0x5a9b7cb
add esi, 3
jmp 0x5a9b791
test edi, edi
jne 0x5a9b7cb
cmp eax, 0x5e
jne 0x5a9b7cb
inc edi
jmp 0x5a9b791
lea eax, [esi + 1]
cmp byte [eax], 0x5d
jne 0x5a9b80b
mov ecx, dword [ebp + 8]
test dword [ecx + 0x40], 0x2000000
jne 0x5a9b80b
mov esi, eax
jmp 0x5a9b80b
test al, al
je 0x5a9b834
cmp al, 0x5c
jne 0x5a9b80b
inc esi
mov al, byte [esi]
test al, al
je 0x5a9b834
cmp al, 0x51
jne 0x5a9b80b
inc esi
mov al, byte [esi]
test al, al
je 0x5a9b834
cmp al, 0x5c
jne 0x5a9b7f6
test al, al
je 0x5a9b834
inc esi
cmp byte [esi], 0x45
jne 0x5a9b7f6
inc esi
mov al, byte [esi]
cmp al, 0x5d
jne 0x5a9b7e3
jmp 0x5a9b8bd
cmp dword [ebp + 0x14], 0
je 0x5a9b83c
cmp al, 0x23
jne 0x5a9b83c
inc esi
mov al, byte [esi]
test al, al
je 0x5a9b834
cmp al, 0xa
jne 0x5a9b821
test al, al
jne 0x5a9b8bd
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x28
jne 0x5a9b8bd
mov al, byte [esi + 1]
cmp al, 0x3f
je 0x5a9b857
cmp al, 0x2a
je 0x5a9b857
inc ebx
cmp dword [ebp + 0xc], 0
jne 0x5a9b8bd
cmp ebx, dword [ebp + 0x10]
jmp 0x5a9b8bb
add esi, 2
cmp byte [esi], 0x50
jne 0x5a9b860
inc esi
mov cl, byte [esi]
cmp cl, 0x3c
jne 0x5a9b872
mov al, byte [esi + 1]
cmp al, 0x21
je 0x5a9b872
cmp al, 0x3d
jne 0x5a9b877
cmp cl, 0x27
jne 0x5a9b8bd
inc ebx
cmp dword [ebp + 0xc], 0
jne 0x5a9b883
cmp ebx, dword [ebp + 0x10]
je 0x5a9b8cd
movzx eax, cl
inc esi
cmp eax, 0x3c
jne 0x5a9b88f
push 0x3e
pop eax
mov ecx, esi
jmp 0x5a9b894
inc esi
movzx edx, byte [esi]
cmp edx, eax
jne 0x5a9b893
cmp dword [ebp + 0xc], 0
je 0x5a9b8bd
mov eax, esi
sub eax, ecx
cmp dword [ebp + 0x10], eax
jne 0x5a9b8bd
push dword [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
call fcn.05acf215
add esp, 0xc
test eax, eax
je 0x5a9b8cd
inc esi
mov al, byte [esi]
test al, al
jne 0x5a9b74e
jmp 0x5a9b834
mov eax, ebx
jmp 0x5a9b837