joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100397a0
Capabilities:
Patch process command line

Disassembly:
sub esp, 0x4c
mov eax, dword [0x1008600c]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
push edx
mov esi, ecx
push 0
mov dword [esp + 0x20], esi
push 0x410
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10039975
mov eax, dword [0x10089584]
xorps xmm0, xmm0
movq qword [esp + 0x34], xmm0
movups xmmword [esp + 0x24], xmm0
test eax, eax
jne 0x10039807
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.NtQueryInformationProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10089584], eax
push 0
push 0x18
lea ecx, [esp + 0x2c]
push ecx
push 0
push edi
call eax
test eax, eax
js 0x1003996e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x1003996e
mov ebp, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [esp + 0x14]
push ecx
push 4
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 0
push ecx
add eax, 0x10
push eax
push edi
call ebp
test eax, eax
je 0x1003996e
cmp dword [esp + 0x14], 4
jne 0x1003996e
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push 8
lea ecx, [esp + 0x24]
add eax, 0x40
push ecx
push eax
push edi
call ebp
test eax, eax
je 0x1003996e
cmp dword [esp + 0x14], 8
jne 0x1003996e
movzx eax, word [esp + 0x1e]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10041b08
add esp, 4
mov ebx, eax
movzx eax, word [esp + 0x1e]
push eax
push 0
push ebx
call fcn.100472b0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
movzx eax, word [esp + 0x20]
push eax
push ebx
push dword [esp + 0x2c]
push edi
call ebp
test eax, eax
je 0x10039965
movzx eax, word [esp + 0x1c]
cmp dword [esp + 0x14], eax
jne 0x10039965
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 7
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10039906
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [esp + 0x44]
call fcn.10003e30
push ebx
call fcn.10041af5
movups xmm0, xmmword [esp + 0x40]
mov dword [esi], 0
add esp, 4
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [esp + 0x4c]
movq qword [esi + 0x10], xmm0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.1004144e
add esp, 0x4c
ret
push ebx
call fcn.10041af5
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [esi], 0
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 7
push 0x1007aae4
mov word [esi], ax
call fcn.10003e30
mov ecx, dword [esp + 0x54]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004144e
add esp, 0x4c
ret
Function at 0x100399b0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, dword [0x10086b48]
sub esp, 0x24
push ebx
push esi
push edi
cmp eax, 0xffffffff
jne 0x10039a47
push 0
push 0
push 2
push 2
push 1
push 0
push 3
push str..pipegpipe
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10039a42
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.10039410
mov ebx, eax
test ebx, ebx
je 0x10039a3b
mov esi, dword [ebx]
xor edx, edx
test esi, esi
je 0x10039a32
lea ecx, [ebx + 8]
nop dword [eax + eax]
movq xmm0, qword [ecx + 0x10]
movq qword [esp + 0x20], xmm0
cmp edi, dword [ecx]
je 0x10039a29
inc edx
add ecx, 0x1c
cmp edx, esi
jb 0x10039a10
jmp 0x10039a32
mov eax, dword [esp + 0x20]
mov dword [0x10086b48], eax
push ebx
call fcn.1004eb4e
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10086b48]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10039a50
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x1008600c]
xor eax, esp
mov dword [esp + 0x14], eax
lea eax, [esp]
mov dword [esp], 0
push eax
xorps xmm0, xmm0
push 0x28
movlpd qword [esp + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10039a9c
xor al, al
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1004144e
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
mov dword [esp + 4], 1
push eax
push str.SeDebugPrivilege
push 0
mov dword [esp + 0x1c], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x10039ad9
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
mov al, 1
xor ecx, esp
call fcn.1004144e
mov esp, ebp
pop ebp
ret
Function at 0x1003f540
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006aabc
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1008600c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0x40
push 4
push dword [esi]
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1003f591
xor edi, edi
jmp 0x1003f5c8
mov eax, dword [esi]
push 0x28
mov esi, dword [eax + edi*4]
call fcn.10041665
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 4]
mov dword [edi], 0
call fcn.10003d70
mov eax, dword [ebp + 0x20]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x20], eax
mov byte [edi + 0x24], 0
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x1003f5f8
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003f5ee
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003f60b
push edx
push ecx
call fcn.10041ac4
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1004a021
int3
Function at 0x10040010
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
sub esp, 0x24
mov eax, dword [0x1008600c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1004011b
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10040114
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop dword [eax]
cmp dword [esp + 0x14], 0x10
jb 0x100400f8
call ebx
cmp dword [esp + 0x20], eax
jne 0x100400f8
call ebp
cmp dword [esp + 0x1c], eax
je 0x100400f8
mov edx, dword [esi]
test edx, edx
jne 0x100400c0
push 0x200
push edx
push dword [0x10089368]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10040114
jmp 0x100400eb
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x100400eb
shl eax, 3
push eax
push edx
push 0
push dword [0x10089368]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10040114
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10040080
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x10040168
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10040168
mov ebp, dword [esp + 0x38]
nop dword [eax + eax]
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10040162
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esp + 0x10]
mov ecx, ebx
push ebp
call fcn.1003fea0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10040130
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004144e
add esp, 0x24
ret

Function at 0x10040180
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx]
test eax, eax
je 0x100401d9
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x100401c9
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
nop dword [eax]
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x100401bf
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x100401a0
mov eax, dword [ebx]
pop edi
pop ebp
push eax
push 0
push dword [0x10089368]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x100401e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x10089820]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebp, [eax*2 + 5]
lea eax, [esp + 0x10]
push eax
push 0x40
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10040226
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
pop ecx
ret
test ebx, ebx
je 0x10040247
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10040268
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10040268
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10040262
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10040268
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [esi + 0x14]
and bl, 1
mov cl, bl
and al, 0xfd
add cl, cl
shl bl, 2
or cl, al
and cl, 0xfb
or cl, bl
xor eax, eax
pop edi
mov byte [esi + 0x14], cl
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10040660
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.10040350
cmp dword [0x10089368], edi
je 0x100407f1
mov edx, dword [0x10089828]
xor esi, esi
test edx, edx
je 0x1004069c
mov ecx, dword [0x10089820]
mov eax, ecx
cmp ebx, dword [eax]
je 0x100406a6
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x10040690
mov edi, 4
jmp 0x100407f6
cmp esi, 0xffffffff
je 0x1004069c
imul ebp, esi, 0x2c
test byte [ecx + ebp + 0x14], 2
je 0x1004076d
push 0
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.10040010
mov edi, dword [0x10089820]
add esp, 4
add edi, ebp
mov eax, dword [edi]
mov cl, byte [edi + 0x14]
and cl, 1
lea ebx, [eax - 5]
cmove ebx, eax
movzx eax, cl
lea ecx, [esp + 0x10]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10040711
lea ecx, [esp + 0x18]
lea edi, [eax + 0xa]
call fcn.10040180
jmp 0x100407f6
mov eax, dword [edi + 0xc]
test byte [edi + 0x14], 1
mov dword [ebx], eax
je 0x1004072c
mov ax, word [edi + 0x10]
mov word [ebx + 4], ax
mov al, byte [edi + 0x12]
mov byte [ebx + 6], al
jmp 0x10040732
mov al, byte [edi + 0x10]
mov byte [ebx + 4], al
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [edi + 0x14], 0xf9
lea ecx, [esp + 0x18]
xor edi, edi
call fcn.10040180
mov ecx, dword [0x10089820]
mov ecx, dword [ecx + ebp + 8]
call fcn.10040c40
mov eax, dword [0x10089828]
lea edx, [eax - 1]
cmp esi, edx
jae 0x100407b2
mov ecx, dword [0x10089820]
imul eax, eax, 0x2c
movups xmm0, xmmword [eax + ecx - 0x2c]
movups xmmword [ecx + ebp], xmm0
movups xmm0, xmmword [eax + ecx - 0x1c]
movups xmmword [ecx + ebp + 0x10], xmm0
movq xmm0, qword [eax + ecx - 0xc]
movq qword [ecx + ebp + 0x20], xmm0
mov eax, dword [eax + ecx - 4]
mov dword [ecx + ebp + 0x28], eax
mov eax, dword [0x10089824]
shr eax, 1
mov dword [0x10089828], edx
cmp eax, 0x20
jb 0x100407f6
cmp eax, edx
jb 0x100407f6
imul eax, eax, 0x2c
push eax
push dword [0x10089820]
push 0
push dword [0x10089368]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x100407f6
shr dword [0x10089824], 1
mov dword [0x10089820], eax
jmp 0x100407f6
mov edi, 2
xor ecx, ecx
mov eax, 0x10089364
xchg dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x10056227
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10071c8c
push 0x10071c84
push str.FlsAlloc
push 0x1e
call fcn.10056031
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005625b
push dword [ebp + 8]
mov ecx, esi
call dword [0x1006d354]
call esi
jmp 0x10056261
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100562a5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10071c9c
push 0x10071c94
push str.FlsGetValue
push 0x20
call fcn.10056031
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100562dc
push dword [ebp + 8]
mov ecx, esi
call dword [0x1006d354]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100589bf
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10058941
Function at 0x10059a8c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10059b29
push ebx
push esi
call fcn.10059a55
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1005999e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10059ad6
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10059b28
push edi
push eax
call fcn.10055c77
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10059af6
call fcn.10055d22
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10059b27
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1005999e
add esp, 0x20
test eax, eax
jne 0x10059b15
push edi
call fcn.10055d22
jmp 0x10059b1d
push ebx
call fcn.10055d22
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1005ade8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005aa8a

Function at 0x1005adf3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005ac19

Function at 0x1005b1ed
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10064e80
mov eax, dword [0x1008600c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1005787b
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1005b22f
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x1005b38b
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10064eb0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10088fa0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.1005c3bd
mov ecx, dword [esi*4 + 0x10088fa0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x1005b384
cmp eax, dword [edi + ecx + 0x24]
jne 0x1005b384
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005b384
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1005c3bd
add esp, 0x14
test edx, edx
jl 0x1005b384
jg 0x1005b2fa
test eax, eax
jb 0x1005b384
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1005b384
jl 0x1005b314
cmp dword [ebp - 0x1008], eax
ja 0x1005b384
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1005b332
test ebx, ebx
je 0x1005b36b
cmp ecx, edi
jae 0x1005b36b
mov al, byte [ecx]
cmp al, 0xd
jne 0x1005b34c
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1005b358
cmp byte [ecx + 1], 0xa
jne 0x1005b358
inc ecx
jmp 0x1005b358
movzx eax, al
movsx eax, byte [eax + 0x10086870]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1005b332
cmp edx, ebx
jne 0x1005b332
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1005b389
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1004144e
leave
ret
Function at 0x1005b85b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10088fa0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1005b89b
cmp byte [ebx], 0xa
jne 0x1005b89b
or byte [eax + edi + 0x28], 4
jmp 0x1005b8a0
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x1005b99e
mov al, byte [edx]
cmp al, 0x1a
je 0x1005b980
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x1005b8cf
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x1005b8f4
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x1005b8fe
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x1005b8b1
jmp 0x1005b99e
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005b97b
cmp dword [ebp - 0xc], 0
je 0x1005b97b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x10088fa0]
test byte [eax + edi + 0x28], 0x48
je 0x1005b955
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1005b940
mov byte [esi], dl
jmp 0x1005b951
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10088fa0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1005b99e
cmp byte [ebp - 1], 0xa
jne 0x1005b964
cmp esi, ebx
jne 0x1005b964
mov byte [esi], 0xa
jmp 0x1005b99d
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1005c3db
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1005b99e
mov byte [esi], 0xd
jmp 0x1005b99d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x10088fa0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1005b99a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1005b99e
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1005b9a7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x10088fa0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1005b9ea
cmp word [esi], dx
jne 0x1005b9ea
or byte [edi + eax + 0x28], 4
jmp 0x1005b9ef
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x1005bb42
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x1005bb22
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x1005ba31
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1005ba67
cmp eax, edx
jae 0x1005ba73
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x1005ba09
jmp 0x1005bb42
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005bb1e
cmp dword [ebp - 0x14], 0
je 0x1005bb1e
mov eax, dword [ebx*4 + 0x10088fa0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x1005baf6
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x1005babf
mov word [esi], cx
jmp 0x1005baf2
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x10088fa0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x10088fa0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x10088fa0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x1005bb42
pop ebx
cmp word [ebp - 4], bx
jne 0x1005bb07
cmp esi, dword [ebp + 0xc]
jne 0x1005bb07
mov word [esi], bx
jmp 0x1005bb3f
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1005c3db
add esp, 0x10
cmp word [ebp - 4], bx
je 0x1005bb42
push 0xd
jmp 0x1005bb3b
mov ecx, dword [ebx*4 + 0x10088fa0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1005bb39
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1005bb42
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret