joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7b5341
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, reloc.ws2_32.dll_WSASetLastError
sub esp, 0x480
mov eax, dword [0x830e54]
xor eax, ebp
mov dword [ebp + reloc.ws2_32.dll_WSASetLastError], eax
mov eax, dword [ebp + reloc.ws2_32.dll_WSASetLastError]
push ebx
push esi
push edi
mov edi, dword [ebp + reloc.ws2_32.dll_WSASetLastError]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + reloc.ws2_32.dll_WSASetLastError]
xor ebx, ebx
push edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], ebx
call fcn.007c7760
mov esi, eax
add esi, esi
push esi
call fcn.007c9be6
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
jne 0x7b53b3
push 0xfffffffffffffffe
pop eax
mov ecx, dword [ebp + reloc.ws2_32.dll_WSASetLastError]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007c1e9d
add ebp, 0x400
leave
ret
push edi
call fcn.007c7760
inc eax
push eax
call fcn.007c9be6
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 0x28], edi
cmp edi, ebx
jne 0x7b53db
push 0xfffffffffffffffe
pop ebx
push dword [ebp - 0x18]
call fcn.007c9cf8
pop ecx
mov eax, ebx
jmp 0x7b539b
push esi
push ebx
push dword [ebp - 0x18]
call fcn.007c3430
push dword [ebp - 0x1c]
mov byte [edi], bl
push edi
call fcn.007c9c00
lea eax, [ebp - 0x2c]
push eax
mov edi, 0x7ec7a8
push edi
push dword [ebp - 0x28]
call fcn.00743dfd
add esp, 0x20
jmp 0x7b544b
push esi
push 0x7f69fc
push dword [ebp - 0x18]
call fcn.007427cb
push esi
push 0x7f69f8
push dword [ebp - 0x18]
call fcn.007427cb
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.007427cb
push esi
push 0x7f69f8
push dword [ebp - 0x18]
call fcn.007427cb
lea eax, [ebp - 0x2c]
push eax
push edi
push ebx
call fcn.00743dfd
add esp, 0x3c
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jne 0x7b5407
push dword [ebp - 0x28]
call fcn.007c9cf8
lea eax, [ebp - 0x14]
mov dword [esp], reloc.ws2_32.dll_WSASetLastError
push eax
push ebx
call fcn.00748ecd
lea eax, [ebp - 0x14]
push 0x5c
push eax
call fcn.007c3bc0
add esp, 0x14
cmp eax, ebx
je 0x7b53cb
mov byte [eax + 1], bl
lea eax, [ebp - 0x14]
push 0x7f69ec
push eax
call fcn.007c9c10
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00761c68
add esp, 0x10
test eax, eax
jne 0x7b53cb
push dword [ebp - 0x20]
call fcn.007c7760
push dword [ebp - 0x24]
mov esi, eax
call fcn.007c7760
push dword [ebp - 0x18]
add esi, eax
call fcn.007c7760
add esi, eax
lea eax, [ebp - 0x14]
push eax
call fcn.007c7760
lea esi, [eax + esi + 0x19]
push 1
push esi
call fcn.007caf99
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x7b53cb
push dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push dword [ebp - 0x24]
dec esi
push dword [ebp - 0x18]
push eax
push 0x7f69d4
push esi
push edi
call fcn.007e5eb9
push 0x44
pop esi
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.007c3430
add esp, 0x28
xor eax, eax
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push 8
push 1
push ebx
push ebx
push edi
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x80], esi
call dword [sym.imp.kernel32.dll_CreateProcessA]
push edi
mov esi, eax
call fcn.007c9cf8
pop ecx
cmp esi, 1
je 0x7b53ce
jmp 0x7b53cb
Function at 0x7b9616
Capabilities:
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
lea ebp, reloc.ws2_32.dll_WSASetLastError
sub esp, 0x188
mov eax, dword [0x830e54]
xor eax, ebp
mov dword [ebp + reloc.ws2_32.dll_WSASetLastError], eax
push ebx
push esi
push edi
push 4
pop esi
xor ebx, ebx
push 0x64
lea eax, [ebp + 0xa0]
push ebx
push eax
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x68], ebx
call fcn.007c3430
push 0x7ec77c
push 0x7f6c94
call fcn.00748be9
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x7b9686
lea eax, [ebp - 0x74]
push eax
push 0x7ec91c
push edi
call fcn.007e5e1f
push edi
call fcn.007c7ab7
jmp 0x7b9699
push 0x53
push 0x107
push dword [0x82fd90]
push esi
call fcn.00742a56
add esp, 0x10
push 0x100
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.007c3430
push 0x7f6c88
lea eax, [ebp - 0x60]
push 0x7ed5a8
push eax
call fcn.007e5e9e
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push 0xf003f
push 1
push ebx
push ebx
push 0x7f6c58
push 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov edi, dword [0x7ec048]
test eax, eax
je 0x7b9717
push esi
lea eax, [ebp - 0x68]
push eax
push esi
push ebx
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x6c]
call edi
mov esi, dword [ebp - 0x68]
push 4
lea eax, [ebp - 0x68]
push eax
push 4
push ebx
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x6c]
mov dword [ebp - 0x70], esi
inc esi
mov dword [ebp - 0x68], esi
call edi
push dword [ebp - 0x6c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
push 0x7f6c54
mov edi, 0x7f6c94
push edi
call fcn.00748be9
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x74]
pop ecx
pop ecx
cmp dword [ebp - 0x70], eax
je 0x7b9761
cmp dword [ebp - 0x64], ebx
je 0x7b979b
push esi
jmp 0x7b9768
cmp dword [ebp - 0x64], ebx
je 0x7b979b
inc eax
push eax
push 0x7f6c4c
lea eax, [ebp + 0xa0]
push 0x63
push eax
call fcn.007e5eb9
lea eax, [ebp + 0xa0]
push eax
push 0x7ed5a8
push dword [ebp - 0x64]
call fcn.007c14f0
add esp, 0x1c
push dword [ebp - 0x64]
call fcn.007c7ab7
pop ecx
push 2
push edi
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
mov ecx, dword [ebp + reloc.ws2_32.dll_WSASetLastError]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007c1e9d
add ebp, 0x108
leave
ret
Function at 0x7bc63d
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, reloc.ws2_32.dll_WSASetLastError
sub esp, 0x37c
mov eax, dword [0x830e54]
xor eax, ebp
mov dword [ebp + reloc.ws2_32.dll_WSASetLastError], eax
mov eax, dword [ebp + reloc.ws2_32.dll_WSASetLastError]
mov ecx, dword [ebp + reloc.ws2_32.dll_WSASetLastError]
push esi
mov esi, dword [ebp + reloc.ws2_32.dll_WSASetLastError]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + reloc.ws2_32.dll_WSASetLastError]
push edi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x80], ecx
cmp esi, eax
jne 0x7bc6b5
test esi, esi
je 0x7bc75b
push esi
push dword [ebp + 0x308]
lea eax, reloc.ws2_32.dll_WSASetLastError
push eax
call fcn.007c2eb0
push esi
push dword [ebp + 0x304]
lea eax, [ebp + 0xf8]
push eax
call fcn.007c2eb0
add esp, 0x18
jmp 0x7bc75b
push ebx
cmp esi, eax
jbe 0x7bc70b
lea ebx, [esi - 1]
test ebx, ebx
js 0x7bc75a
mov eax, dword [ebp + reloc.ws2_32.dll_WSASetLastError]
lea edi, reloc.ws2_32.dll_WSASetLastError
lea edx, [ebp + 0xf8]
sub edi, eax
sub edx, eax
lea ecx, [ebx + eax]
mov dword [ebp - 0x78], edx
mov eax, esi
sub eax, ebx
dec eax
xor edx, edx
div dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
sub eax, edx
mov edx, dword [ebp + reloc.ws2_32.dll_WSASetLastError]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 0x78]
mov byte [edi + ecx], al
mov al, byte [ecx]
mov byte [edx + ecx], al
dec ecx
dec ebx
jns 0x7bc6e1
jmp 0x7bc75a
lea ebx, [eax - 1]
test ebx, ebx
js 0x7bc758
mov eax, dword [ebp + reloc.ws2_32.dll_WSASetLastError]
lea edi, [ebp + 0xf8]
lea edx, reloc.ws2_32.dll_WSASetLastError
sub edi, eax
sub edx, eax
lea ecx, [ebx + eax]
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0x74]
sub eax, ebx
dec eax
xor edx, edx
div esi
mov eax, esi
sub eax, edx
mov edx, dword [ebp + reloc.ws2_32.dll_WSASetLastError]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 0x78]
mov byte [ecx + edi], al
mov al, byte [ecx]
mov byte [edx + ecx], al
dec ecx
dec ebx
jns 0x7bc72e
mov eax, dword [ebp - 0x74]
mov esi, eax
pop ebx
xor eax, eax
mov byte [ebp + esi + 0xf8], 0
mov byte [ebp + esi + 0x1f8], 0
mov byte [ebp + esi - 8], 0
test esi, esi
je 0x7bc78d
mov cl, byte [ebp + eax + 0x1f8]
xor cl, byte [ebp + eax + 0xf8]
inc eax
mov byte [ebp + eax - 9], cl
cmp eax, esi
jb 0x7bc776
lea eax, [ebp - 0x70]
push eax
call fcn.007c035d
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.007c088e
lea eax, [ebp - 0x70]
push eax
call fcn.007c092c
mov eax, dword [ebp - 0x80]
mov edi, dword [ebp - 0x7c]
mov ecx, dword [ebp + reloc.ws2_32.dll_WSASetLastError]
mov dword [eax], 0x10
lea esi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0x14
movsd dword es:[edi], dword [esi]
pop edi
xor ecx, ebp
pop esi
call fcn.007c1e9d
add ebp, 0x2fc
leave
ret
Function at 0x7bc921
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x830e54]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push ebx
push esi
mov ebx, edx
je 0x7bca63
test ecx, ecx
je 0x7bca63
cmp byte [ecx], 0
je 0x7bca63
test ebx, ebx
je 0x7bca63
xor esi, esi
inc esi
push 0x10
lea eax, [ebp - 0x24]
cmp dword [ebp + 0xc], esi
jne 0x7bc978
xor esi, esi
call fcn.007bc865
push 0x10
lea eax, [ebp - 0x14]
call fcn.007bc894
jmp 0x7bc987
call fcn.007bc8c3
push 0x10
lea eax, [ebp - 0x14]
call fcn.007bc8f2
add esp, 8
push 0x7ec748
push ecx
call fcn.00748be9
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
je 0x7bca4e
push edi
push dword [ebp - 0x28]
mov eax, esi
push 0x40
pop edi
shl eax, 6
push edi
add eax, ebx
push 1
push eax
mov dword [ebp - 0x2c], eax
call fcn.007cf74d
add esp, 0x10
push edi
cmp eax, edi
jne 0x7bca22
push dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
push 0x10
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push 1
call fcn.007bd5e6
push dword [ebp - 0x28]
lea eax, [esi + 2]
shl eax, 6
push edi
add ebx, eax
push 1
push ebx
call fcn.007cf74d
add esp, 0x2c
push edi
cmp eax, edi
jne 0x7bca15
push ebx
lea eax, [ebp + esi - 0x14]
inc byte [eax]
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push 1
call fcn.007bd5e6
add esp, 0x1c
jmp 0x7bca40
push 0
push ebx
call fcn.007c3430
add esp, 0xc
jmp 0x7bca40
push 0
push dword [ebp - 0x2c]
call fcn.007c3430
add esi, 2
push edi
shl esi, 6
push 0
add esi, ebx
push esi
call fcn.007c3430
add esp, 0x18
push dword [ebp - 0x28]
call fcn.007c7ab7
pop ecx
xor eax, eax
pop edi
jmp 0x7bca68
call fcn.007cb1ce
push 0xdb2
push dword [eax]
call fcn.00786661
pop ecx
pop ecx
jmp 0x7bca68
mov eax, 0xdad
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.007c1e9d
leave
ret
Function at 0x7bcaf8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x830e54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x7c], eax
cmp esi, edi
je 0x7bccb4
cmp eax, edi
je 0x7bccb4
cmp dword [ebp + 0x14], 0x10
jb 0x7bccb4
cmp dword [ebp + 0xc], 1
jne 0x7bcb53
mov dword [ebp - 0x14], reloc.ws2_32.dll_WSASetLastError
mov dword [ebp - 0x10], 0xba31322a
mov dword [ebp - 0xc], 0x82e47653
mov dword [ebp - 8], 0xb614b86c
jmp 0x7bcb6f
mov dword [ebp - 0x14], reloc.ws2_32.dll_WSASetLastError
mov dword [ebp - 0x10], 0x804a5cee
mov dword [ebp - 0xc], 0xa8052fe3
mov dword [ebp - 8], 0x2e230cf4
push 0x10
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.007c3430
mov eax, dword [esi + 4]
add esp, 0xc
dec eax
je 0x7bcbb3
dec eax
je 0x7bcbac
dec eax
je 0x7bcba5
dec eax
je 0x7bcb9e
dec eax
je 0x7bcb97
mov eax, 0xd136f193
jmp 0x7bcbb8
mov eax, 0x9141bce4
jmp 0x7bcbb8
mov eax, 0xb4fc2264
jmp 0x7bcbb8
mov eax, 0xa542ce5
jmp 0x7bcbb8
mov eax, 0x9c41a6d3
jmp 0x7bcbb8
mov eax, 0x59d8962c
dec eax
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 8]
sub eax, edi
je 0x7bcbe8
dec eax
je 0x7bcbe1
dec eax
je 0x7bcbda
dec eax
je 0x7bcbd3
mov eax, 0xb502c1ab
jmp 0x7bcbed
mov eax, 0x75d00ed7
jmp 0x7bcbed
mov eax, 0x91d3341f
jmp 0x7bcbed
mov eax, 0xef121bda
jmp 0x7bcbed
mov eax, 0x8b80a2a
dec eax
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0xc]
push 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x34]
push edi
push eax
mov dword [ebp - 0x18], 0x5f540825
call fcn.007c3430
push 0x44
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.007c3430
mov eax, dword [0x82ce50]
add esp, 0x18
cmp eax, edi
je 0x7bcc2d
lea ecx, [ebp - 0x78]
push ecx
call eax
pop ecx
test eax, eax
je 0x7bcc31
xor eax, eax
jmp 0x7bcc34
mov eax, dword [ebp - 0x38]
mov edx, eax
and edx, 3
mov ecx, 0x8cf4bc6d
je 0x7bcc45
sub eax, edx
add eax, 4
push ebx
push 0x40
pop ebx
jmp 0x7bcc53
mov dword [ebp + eax - 0x78], ecx
inc ecx
add eax, 4
cmp eax, ebx
jb 0x7bcc4b
mov dword [ebp - 0x38], ebx
mov esi, ebx
sub esi, edi
cmp esi, 0x10
jle 0x7bcc66
push 0x10
pop esi
xor eax, eax
test esi, esi
jle 0x7bcc7c
lea ecx, [ebp + edi - 0x78]
mov dl, byte [ecx + eax]
xor byte [ebp + eax - 0x34], dl
inc eax
cmp eax, esi
jl 0x7bcc70
push 0x10
lea eax, [ebp - 0x34]
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push 1
call fcn.007bd5e6
add edi, esi
add esp, 0x1c
cmp edi, ebx
jl 0x7bcc5a
push 0x10
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x7c]
call fcn.007c2eb0
add esp, 0xc
xor eax, eax
pop ebx
jmp 0x7bccb9
mov eax, 0xdad
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.007c1e9d
leave
ret
Function at 0x7bd103
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xac
mov eax, dword [0x830e54]
xor eax, ebp
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x7c]
and dword [ebp - 0x3c], 0
cmp dword [ebp + 0x74], 0
push ebx
push esi
push edi
mov dword [ebp - 0x40], eax
mov ebx, ecx
je 0x7bd28f
test eax, eax
je 0x7bd28f
cmp byte [eax], 0
je 0x7bd28f
test ebx, ebx
je 0x7bd28f
cmp dword [ebp + 0x78], 1
push 0x10
pop edi
lea eax, [ebp + 0x48]
push edi
jne 0x7bd167
call fcn.007bc865
push edi
lea eax, [ebp + 0x58]
call fcn.007bc894
jmp 0x7bd175
call fcn.007bc8c3
push edi
lea eax, [ebp + 0x58]
call fcn.007bc8f2
add esp, 8
push 0x40
pop esi
push esi
lea eax, [ebp + 8]
push ebx
push eax
call fcn.007c2eb0
push esi
sub ebx, 0xffffff80
lea eax, [ebp - 0x38]
push ebx
push eax
call fcn.007c2eb0
push esi
lea eax, [ebp + 8]
push eax
push edi
lea eax, [ebp + 0x58]
push eax
push edi
lea eax, [ebp + 0x48]
push eax
push 1
call fcn.007bd5e6
inc byte [ebp + 0x58]
push esi
lea eax, [ebp - 0x38]
push eax
push edi
lea eax, [ebp + 0x58]
push eax
push edi
lea eax, [ebp + 0x48]
push eax
push 1
call fcn.007bd5e6
mov ebx, dword [ebp - 0x40]
add esp, 0x50
push 0
push ebx
call fcn.00748d0e
pop ecx
pop ecx
cmp eax, reloc.ws2_32.dll_WSASetLastError
jne 0x7bd219
push 0x7f6ec4
push ebx
call fcn.00748be9
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x7bd205
call fcn.007cb1ce
push 0xdb2
push dword [eax]
call fcn.00786661
pop ecx
mov dword [ebp - 0x3c], eax
jmp 0x7bd289
push ebx
call fcn.007bcf54
pop ecx
test eax, eax
jne 0x7bd241
mov dword [ebp - 0x3c], reloc.ws2_32.dll_WSASetLastError
jmp 0x7bd27f
push 0x7f1fec
push ebx
call fcn.00748be9
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x7bd241
call fcn.007cb1ce
push 0xdb0
push dword [eax]
call fcn.00786661
pop ecx
pop ecx
jmp 0x7bd294
push edi
push esi
lea eax, [ebp + 8]
push 1
push eax
call fcn.007c7ef5
add esp, 0x10
cmp eax, esi
jne 0x7bd269
push edi
push esi
lea eax, [ebp - 0x38]
push 1
push eax
call fcn.007c7ef5
add esp, 0x10
cmp eax, esi
je 0x7bd27f
call fcn.007cb1ce
push 0xdb0
push dword [eax]
call fcn.00786661
pop ecx
mov dword [ebp - 0x3c], eax
pop ecx
test edi, edi
je 0x7bd28a
push edi
call fcn.007c7ab7
pop ecx
mov eax, dword [ebp - 0x3c]
jmp 0x7bd294
mov eax, 0xdad
mov ecx, dword [ebp + 0x68]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007c1e9d
add ebp, 0x6c
leave
ret
Function at 0x7bd414
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x830e54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - reloc.ws2_32.dll_WSASetLastError], ebx
test eax, eax
je 0x7bd534
cmp dword [ebp + 0xc], 0x10
jb 0x7bd534
test ebx, ebx
je 0x7bd534
cmp dword [ebp + 0x14], 0x10
jb 0x7bd534
test edi, edi
je 0x7bd534
cmp dword [ebp + 0x1c], 1
jb 0x7bd534
push 0x80
push eax
lea eax, reloc.ws2_32.dll_WSASetLastError
push eax
call fcn.00758901
add esp, 0xc
test eax, eax
jne 0x7bd534
push 0x10
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.007c2eb0
add esp, 0xc
cmp dword [ebp + 0x1c], esi
jbe 0x7bd516
push 4
pop ebx
lea eax, [ebp - 0x24]
push eax
call fcn.007bd38e
push 0x10
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.007c2eb0
lea eax, [ebp - 0x14]
push eax
lea eax, reloc.ws2_32.dll_WSASetLastError
push eax
call fcn.00758921
mov ecx, dword [ebp + 0x1c]
mov eax, ecx
sub eax, esi
add esp, 0x18
cmp eax, 0x10
jb 0x7bd4fe
mov eax, dword [ebp - 0x14]
xor dword [edi + esi], eax
mov eax, dword [ebp - 0x10]
add esi, ebx
xor dword [edi + esi], eax
mov eax, dword [ebp - 0xc]
add esi, ebx
xor dword [edi + esi], eax
mov eax, dword [ebp - 8]
add esi, ebx
xor dword [edi + esi], eax
add esi, ebx
jmp 0x7bd512
cmp esi, ecx
jae 0x7bd516
lea eax, [ebp - 0x14]
sub eax, esi
mov dl, byte [eax + esi]
xor byte [edi + esi], dl
inc esi
cmp esi, ecx
jb 0x7bd507
cmp esi, ecx
jb 0x7bd4a5
cmp dword [ebp + 0x20], 1
jne 0x7bd530
push 0x10
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x22c]
call fcn.007c2eb0
add esp, 0xc
xor eax, eax
jmp 0x7bd537
push 0xfffffffffffffffe
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007c1e9d
leave
ret
Function at 0x7bdcce
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x830e54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x7bddc4
test ebx, ebx
je 0x7bddc4
test esi, esi
je 0x7bddc4
push 0x28
push 0
push esi
call fcn.007c3430
add esp, 0xc
cmp dword [ebp + 0x10], 1
jne 0x7bdd31
push 0
push 0
push edi
call fcn.007d0a5d
pop ecx
push eax
call fcn.007d1c1b
add esp, 0xc
test eax, eax
jns 0x7bdd37
mov eax, 0xdaf
jmp 0x7bddc9
push 2
push 0xffffffffffffffd8
jmp 0x7bdd13
push 0x28
push esi
push edi
call fcn.007d0a5d
pop ecx
push eax
call fcn.007d2b83
add esp, 0xc
cmp eax, 0x28
jne 0x7bdd27
push dword [ebp + 0xc]
mov eax, esi
push ebx
push dword [ebp + 8]
call fcn.007bd826
add esp, 0xc
test eax, eax
jne 0x7bddc9
push 8
pop ebx
push ebx
lea edi, [esi + 8]
lea eax, [ebp - 0xc]
push edi
push eax
call fcn.007c2eb0
push ebx
push 0
push edi
call fcn.007c3430
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x28
push esi
push dword [ebp + 8]
call fcn.007bd623
add esp, 0x2c
test eax, eax
je 0x7bdd9c
mov eax, 0xdb4
jmp 0x7bddc9
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.007bd72c
add esp, 0xc
cmp eax, 1
jne 0x7bdd95
push ebx
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.007c2eb0
add esp, 0xc
xor eax, eax
jmp 0x7bddc9
mov eax, 0xdad
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.007c1e9d
leave
ret

Function at 0x7bddd7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x7bdeca
mov edx, dword [esi]
test edx, edx
je 0x7bdeca
mov ecx, dword [ebp + 0xc]
test ecx, ecx
js 0x7bdeca
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x7bdeca
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x7bde12
and dword [ebp + 0x18], edi
mov eax, dword [esi + 0x34]
cmp dword [ebp + 0x18], eax
jb 0x7bdeca
cmp ecx, dword [esi + 8]
jl 0x7bde2d
mov eax, 0xdb6
jmp 0x7bdecf
add eax, 0x28
imul eax, ecx
add eax, dword [esi + 0xc]
push 0
push eax
push edx
call fcn.007d0a5d
pop ecx
push eax
call fcn.007d1c1b
add esp, 0xc
test eax, eax
jns 0x7bde54
mov eax, 0xdaf
jmp 0x7bdecf
push 0x28
push ebx
push dword [esi]
call fcn.007d0a5d
pop ecx
push eax
call fcn.007d2b83
add esp, 0xc
cmp eax, 0x28
jne 0x7bde4d
cmp dword [ebp + 0x18], 0
jbe 0x7bde8d
push dword [esi + 0x34]
push edi
push dword [esi]
call fcn.007d0a5d
pop ecx
push eax
call fcn.007d2b83
add esp, 0xc
cmp eax, dword [esi + 0x34]
jne 0x7bde4d
push dword [esi + 0x34]
lea eax, [esi + 0x20]
push edi
push ebx
push eax
push 0x10
lea eax, [esi + 0x10]
push eax
push dword [esi + 0x2c]
push 8
pop eax
call fcn.007bd8b5
add esp, 0x1c
test eax, eax
jne 0x7bdecf
push dword [esi + 0x34]
push edi
push ebx
push dword [esi + 0x2c]
call fcn.007bda5c
add esp, 0x10
dec eax
neg eax
sbb eax, eax
and eax, 0xdb7
jmp 0x7bdecf
mov eax, 0xdad
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x7bded4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x7bdf6e
mov edx, dword [esi]
test edx, edx
je 0x7bdf6e
mov ecx, dword [ebp + 0xc]
test ecx, ecx
js 0x7bdf6e
cmp dword [ebp + 0x10], 0
je 0x7bdf6e
cmp ecx, dword [esi + 8]
jl 0x7bdf06
mov eax, 0xdb6
jmp 0x7bdf73
mov eax, dword [esi + 0x34]
add eax, 0x28
imul eax, ecx
add eax, dword [esi + 0xc]
push 0
push eax
push edx
call fcn.007d0a5d
pop ecx
push eax
call fcn.007d1c1b
add esp, 0xc
test eax, eax
jns 0x7bdf30
mov eax, 0xdaf
jmp 0x7bdf73
push 0x28
push dword [ebp + 0x10]
push dword [esi]
call fcn.007d0a5d
pop ecx
push eax
call fcn.007d2b83
add esp, 0xc
cmp eax, 0x28
jne 0x7bdf29
push dword [esi + 0x34]
lea eax, [esi + 0x20]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0x10
lea eax, [esi + 0x10]
push eax
push dword [esi + 0x2c]
push 8
pop eax
call fcn.007bd8b5
add esp, 0x1c
jmp 0x7bdf73
mov eax, 0xdad
pop esi
pop ebp
ret

Function at 0x7bdf76
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x830e54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
je 0x7be07f
mov eax, dword [edi]
cmp eax, esi
je 0x7be07f
cmp dword [ebp + 0xc], esi
jl 0x7be07f
jne 0x7bdfb2
xor eax, eax
jmp 0x7be084
push 2
push 0xffffffffffffffd8
push eax
call fcn.007d0a5d
pop ecx
push eax
call fcn.007d1c1b
add esp, 0xc
test eax, eax
jns 0x7bdfd4
mov eax, 0xdaf
jmp 0x7be084
push 0x28
lea eax, [ebp - 0x2c]
push eax
push dword [edi]
call fcn.007d0a5d
pop ecx
push eax
call fcn.007d2b83
add esp, 0xc
cmp eax, 0x28
jne 0x7bdfca
push 2
push 0xffffffffffffffd8
push dword [edi]
call fcn.007d0a5d
pop ecx
push eax
call fcn.007d1c1b
add esp, 0xc
test eax, eax
jns 0x7be010
mov eax, 0xdb0
jmp 0x7be084
mov dword [ebp - 0x30], esi
cmp dword [ebp + 0xc], esi
jle 0x7be044
lea ebx, [edi + 0x20]
push dword [edi + 0x2c]
mov esi, dword [edi + 0x34]
push 8
push ebx
push 0x10
push dword [edi]
lea ecx, [edi + 0x10]
call fcn.007bdace
add esp, 0x14
test eax, eax
jne 0x7be084
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp + 0xc]
jl 0x7be01b
xor esi, esi
push 0x28
lea eax, [ebp - 0x2c]
push eax
push dword [edi]
call fcn.007d0a5d
pop ecx
push eax
call fcn.007d23e2
add esp, 0xc
cmp eax, 0x28
jne 0x7be009
push 1
push esi
push dword [edi]
call fcn.007d0a5d
pop ecx
push eax
call fcn.007d1c1b
mov eax, dword [ebp + 0xc]
add esp, 0xc
add dword [edi + 8], eax
jmp 0x7bdfab
mov eax, 0xdad
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007c1e9d
leave
ret