joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58eea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d37ee
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
push ebx
push esi
mov eax, dword [0x65b4e4]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
sub esp, 0x1c
mov ecx, esp
xor ebx, ebx
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xe8]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0x38], ebx
mov byte [ecx + 4], bl
call fcn.004080b0
mov ecx, esi
call fcn.0058e990
cmp eax, ebx
je 0x58ef33
cmp dword [esp + 0xd8], 0x10
jb 0x58ef2a
mov eax, dword [esp + 0xc4]
push eax
call fcn.00594e98
add esp, 4
mov eax, dword [esp + 0xc]
jmp 0x58f00b
push 1
push 2
lea ecx, [esp + 0x38]
call fcn.0040b160
lea ecx, [esp + 0xc0]
push ecx
lea edx, [esp + 0x34]
push 0x5ff600
push edx
mov byte [esp + 0xc4], 1
call fcn.00409c80
add esp, 8
push eax
call fcn.00409360
add esp, 8
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
call fcn.00409610
mov esi, 0x10
cmp dword [eax + 0x18], esi
mov byte [esp + 0xb8], 2
jb 0x58ef90
mov eax, dword [eax + 4]
jmp 0x58ef93
add eax, 4
push eax
push str.Sqlite3Db::CRunSqlRead::GetColindex
push 0x157
push str..commonRunSqlRead.cpp
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
cmp dword [esp + 0x2c], esi
jb 0x58efc7
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00594e98
add esp, 4
lea ecx, [esp + 0x7c]
mov byte [esp + 0xb8], bl
call fcn.00409f20
lea edx, [esp + 0x7c]
push edx
mov dword [esp + 0x80], vtable.std::ios_base.0
call fcn.005cccbe
add esp, 4
cmp dword [esp + 0xd8], esi
jb 0x58f008
mov eax, dword [esp + 0xc4]
push eax
call fcn.00594e98
add esp, 4
or eax, 0xffffffff
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xb0
ret 0x1c
Function at 0x58f740
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1074
call fcn.005b5ef0
mov eax, dword [0x65b4e4]
xor eax, esp
mov dword [esp + 0x1070], eax
push ebx
push esi
mov esi, dword [esp + 0x1080]
push edi
xor ebx, ebx
push 0xfff
lea eax, [esp + 0x81]
push ebx
xor edi, edi
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
mov byte [esp + 0x88], bl
call fcn.005b4520
add esp, 0xc
lea ecx, [esp + 0x7c]
push ecx
push 0xfff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x58f870
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edi, [esp + 0x80]
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x58f856
push 0x40
lea edx, [esp + 0x44]
push 0
push edx
call fcn.005b4520
movsx eax, byte [edi]
push eax
lea ecx, [esp + 0x50]
push 0x5f4980
push ecx
call fcn.005b0b2c
add esp, 0x18
push 0
push 0x80
push 3
push 0
push 3
push closesocket
lea edx, [esp + 0x58]
push edx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x58f856
push 0
lea eax, [esp + 0x20]
push eax
push 0x20
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0x560000
push esi
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x58f84f
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x1a4]
cmp eax, dword [esp + 0x28]
jne 0x58f84f
push edi
call fcn.004fece0
add esp, 4
add dword [esp + 0x14], eax
adc ebx, 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov cl, byte [edi]
add edi, 1
test cl, cl
jne 0x58f856
cmp byte [edi], cl
jne 0x58f7b1
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
pop ebp
mov ecx, dword [esp + 0x107c]
mov dword [esi + 0x198], edi
shrd edi, ebx, 0xa
mov dword [esi + 0x19c], ebx
shr ebx, 0xa
mov dword [esi + 0x190], edi
pop edi
mov dword [esi + 0x194], ebx
pop esi
pop ebx
xor ecx, esp
call fcn.005b0968
add esp, 0x1074
ret 4

Function at 0x58f8b0
Capabilities:
Get disk size

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push edi
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
je 0x58f986
push eax
lea eax, [esp + 0x18]
push eax
push 8
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0x7405c
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x58f966
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push 0
push 0x400
push ebx
push ebp
call fcn.005b61c0
push 0
push 0x400
push edx
push eax
call fcn.005b61c0
push 0
push 0x400
push edx
push eax
call fcn.005b61c0
mov dword [esi + 0x188], ebp
pop ebp
mov dword [esi + 0x18c], ebx
pop ebx
push edi
mov dword [esi + 0x180], eax
mov dword [esi + 0x184], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 8
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x7405c
push str.IOCTL_DISK_GET_LENGTH_INFO:_d_t_errno_d_n
call fcn.005b403f
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 8
ret 4
Function at 0x592260
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5d3ca1
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x65b4e4]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push esi
push edi
mov eax, dword [0x65b4e4]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.0058f990
xor ebx, ebx
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 0xb4], ebx
call fcn.0058f9b0
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x18]
mov ecx, edi
mov byte [esp + 0xb4], 1
call fcn.0058f9d0
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x24]
mov ecx, edi
mov byte [esp + 0xb4], 2
call fcn.00409b20
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x30]
mov ecx, edi
mov byte [esp + 0xb4], 3
call fcn.00409b20
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea ecx, [esi + 0x40]
mov edi, 1
mov dword [esi + 0x3c], edi
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x62a4a0
mov byte [esp + 0xbc], 4
mov byte [ecx + 4], bl
call fcn.004098b0
push 0x94
lea eax, [esp + 0x18]
push ebx
push eax
mov byte [esp + 0xc0], 5
call fcn.005b4520
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x24]
cmp eax, 2
jne 0x592389
mov ecx, esi
mov dword [esi + 0x3c], edi
call fcn.00591770
mov edx, dword [esp + 0xbc]
push edx
mov ecx, esi
call fcn.005910f0
jmp 0x592390
cmp eax, edi
jne 0x592390
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.005b0968
add esp, 0xa8
ret 4
Function at 0x5926c0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0xffffffffffffffff
push 0x5cfb86
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
push ebx
push esi
mov eax, dword [0x65b4e4]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
push 0x5f2cec
push 1
xor ebx, ebx
push ebx
push 0x5f2dbc
mov dword [esp + 0x20], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, ebx
jge 0x5927ed
push 1
push 2
lea ecx, [esp + 0x34]
call fcn.0040b160
push esi
lea ecx, [esp + 0x30]
push str.CoCreateInstance:
push ecx
mov dword [esp + 0xc0], ebx
call fcn.00409c80
add esp, 8
mov ecx, eax
call fcn.00419340
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x30]
call fcn.00409610
mov esi, 0x10
cmp dword [eax + 0x18], esi
mov byte [esp + 0xb4], 1
jb 0x592766
mov eax, dword [eax + 4]
jmp 0x592769
add eax, 4
push eax
push str.BaseLib::CWMILocator::WbemLocator
push 0x13
push str..commonWMIInterface.cpp
push 0xf0000000
call fcn.00409980
mov ecx, eax
call fcn.004fa910
cmp dword [esp + 0x28], esi
jb 0x59279a
mov eax, dword [esp + 0x14]
push eax
call fcn.00594e98
add esp, 4
lea ecx, [esp + 0x78]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov dword [esp + 0xb4], 0xffffffff
call fcn.00409f20
lea ecx, [esp + 0x78]
push ecx
mov dword [esp + 0x7c], vtable.std::ios_base.0
call fcn.005cccbe
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xac
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xac
ret
Function at 0x594100
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4

Function at 0x594960
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
xor eax, eax
push edi
mov edi, dword [esp + 0x18]
cmp edi, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
jle 0x5949b6
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov eax, dword [esp + 0x14]
push ebx
push ebp
push eax
push esi
mov ecx, esi
call fcn.005947e0
sub edi, 1
jne 0x5949a0
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
push esi
push ecx
mov ecx, esi
call fcn.005948c0
pop edi
pop esi
ret 0x14
Function at 0x5953de
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x65b4e4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x59541e
push 0x600460
push 4
push eax
call fcn.005b1515
push eax
call fcn.00420f40
add esp, 0x10
jmp 0x595430
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x59549e
push edi
call fcn.005b2629
mov edi, dword [eax]
call fcn.005b2629
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.005b0bc3
add esp, 0x18
mov ebx, eax
call fcn.005b2629
cmp dword [eax], 0
je 0x59547e
call fcn.005b2629
push dword [eax]
call fcn.0059535f
pop ecx
jmp 0x595485
call fcn.005b2629
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x59549e
cmp ebx, esi
jae 0x59549e
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x5954a0
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005b0968
leave
ret
Function at 0x5965c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x5d4087
call fcn.005b8673
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.0059e80f
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x59660f
call fcn.0059e80f
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x596620
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x59662d
or eax, 0xffffffff
jmp 0x596789
mov ecx, esi
call fcn.005960f4
mov dword [ebp - 0x14], eax
call fcn.0059b449
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x5966ab
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x5966ab
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x5966ab
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.005953af
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x5966ab
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x5966ab
mov ecx, ebx
call fcn.0059ea10
test eax, eax
je 0x5966ab
push 0
mov ecx, ebx
call fcn.0059ea2b
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0059ce03
push dword [ebp - 0x14]
call fcn.0059b3a1
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.005963cc
xor edi, edi
cmp eax, edi
je 0x596708
test byte [esi + 0x3c], 0x10
je 0x5966f2
push 4
pop edi
mov ecx, esi
call fcn.0059e921
test ax, 0x100
je 0x5966e8
push 5
pop edi
push edi
mov ecx, esi
call fcn.0059af37
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x596708
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0059ebd9
or dword [ebp - 4], 0xffffffff
jmp 0x596733
cmp dword [ebp - 0x28], edi
je 0x596741
push 1
mov ecx, ebx
call fcn.0059ea2b
cmp dword [ebp - 0x2c], edi
je 0x596751
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x59676a
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x59676a
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.0059612e
cmp dword [esi + 0x58], edi
je 0x596786
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.005b8718
ret
Function at 0x5967f3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x596813
cmp dword [edi + 0x54], 0
jne 0x596813
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0059e80f
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.005967ba
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x5983ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x5983f2
call fcn.0059e80f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x5983f2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x598435
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x59841e
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x59841e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x598432
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x59df20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x59df63
call fcn.0059e80f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x59df63
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x59df7e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0059dad7
test ebx, ebx
mov esi, eax
je 0x59df7c
test edi, edi
je 0x59df7c
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x5a11a4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5a11d2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5a11f0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005a110e
jmp 0x5a11f0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5a11f0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.005a110e
test edi, edi
mov eax, edi
jne 0x5a11da
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x660b80]
test ecx, ecx
je 0x5a12b3
jmp 0x5a11a3
ret 8

Function at 0x5b0968
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x65b4e4]
jne 0x5b0972
repz ret
jmp fcn.005bb7b8
Function at 0x5b157a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x5b15b7
cmp dword [ebp + 0x14], edi
je 0x5b15b7
cmp ecx, edi
jne 0x5b15be
call fcn.005b2629
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.005b08ef
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x5b15d2
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x5b15f3
cmp ebx, 0xffffffff
je 0x5b15e2
push ebx
push edi
push ecx
call fcn.005b4520
add esp, 0xc
cmp esi, edi
je 0x5b159f
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x5b159f
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x5b160f
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x5b1616
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x5b1707
test word [esi + 0xc], 0x10c
je 0x5b166a
mov eax, dword [esi + 4]
test eax, eax
je 0x5b166a
jl 0x5b1768
cmp ebx, eax
mov edi, ebx
jb 0x5b163b
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x5b170f
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.005b12c0
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x5b16ff
cmp ebx, dword [ebp - 0xc]
jb 0x5b16d7
cmp dword [ebp - 0xc], 0
je 0x5b1694
mov ecx, closesocket
xor edx, edx
cmp ebx, ecx
jbe 0x5b1689
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x5b1690
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x5b169f
mov eax, closesocket
cmp ebx, eax
ja 0x5b169f
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x5b173b
push eax
push dword [ebp - 8]
push esi
call fcn.005bdd28
pop ecx
push eax
call fcn.005bf56c
add esp, 0xc
test eax, eax
je 0x5b177a
cmp eax, 0xffffffff
je 0x5b1768
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x5b16ff
push esi
call fcn.005bee8b
cmp eax, 0xffffffff
pop ecx
je 0x5b176c
cmp dword [ebp - 4], 0
je 0x5b173b
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x5b161e
mov eax, dword [ebp + 0x14]
jmp 0x5b15b9
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x5b1726
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.005b4520
add esp, 0xc
call fcn.005b2629
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x5b15af
cmp dword [ebp + 0xc], 0xffffffff
je 0x5b1751
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.005b4520
add esp, 0xc
call fcn.005b2629
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x5b15af
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x5b15b9
or dword [esi + 0xc], 0x10
jmp 0x5b176c
Function at 0x5b3164
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x5b3191
call fcn.005b263c
mov dword [eax], esi
call fcn.005b2629
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005b08ef
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x5b316d
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5b31c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005b264f
pop ecx
call fcn.005b2629
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x5b31e7
test al, 1
je 0x5b31e7
test byte [esp + 0xc], 2
je 0x5b31e7
call fcn.005b263c
mov dword [eax], 5
call fcn.005b2629
mov dword [eax], 0xd
jmp 0x5b31b7
xor eax, eax
pop esi
ret
Function at 0x5be491
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x65b848]
je 0x5be4ac
inc edi
cmp edi, 0x17
jb 0x5be49d
cmp edi, 0x17
jae 0x5be62c
push ebp
push 3
call fcn.005c97d9
cmp eax, 1
pop ecx
je 0x5be5f8
push 3
call fcn.005c97d9
test eax, eax
pop ecx
jne 0x5be4e0
cmp dword [0x65b4e0], 1
je 0x5be5f8
cmp ebx, 0xfc
je 0x5be62b
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x6613b8
push ebp
call fcn.005b1515
add esp, 0xc
test eax, eax
je 0x5be516
push esi
push esi
push esi
push esi
push esi
call fcn.005b07f3
add esp, 0x14
push 0x104
mov esi, 0x6613d1
push esi
push 0
mov byte [0x6614d5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5be55a
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.005b1515
add esp, 0xc
test eax, eax
je 0x5be55a
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.005b07f3
add esp, 0x14
push esi
call fcn.005b8ae0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x5be59f
push esi
call fcn.005b8ae0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x6616cc
push 0x6036f4
sub ecx, eax
push ecx
push eax
call fcn.005ba435
add esp, 0x14
test eax, eax
je 0x5be59f
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.005b07f3
add esp, 0x14
jmp 0x5be5a1
xor esi, esi
push 0x6036f0
push ebx
push ebp
call fcn.005b8b6b
add esp, 0xc
test eax, eax
je 0x5be5c1
push esi
push esi
push esi
push esi
push esi
call fcn.005b07f3
add esp, 0x14
push dword [edi*8 + 0x65b84c]
push ebx
push ebp
call fcn.005b8b6b
add esp, 0xc
test eax, eax
je 0x5be5e3
push esi
push esi
push esi
push esi
push esi
call fcn.005b07f3
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.005c961c
add esp, 0xc
jmp 0x5be62b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x5be62b
cmp ebp, 0xffffffff
je 0x5be62b
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x65b84c]
push dword [esi]
call fcn.005b8ae0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret