joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x5310f0
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x2c], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
cmp esi, 0x201
jae 0x5152e0
jmp 0x5152ce
jbe 0x515374
cmp esi, 0x201
jae 0x5152e0
lea ebx, [ebp - 0x448]
mov dword [ebp - 0x28], 0x200
mov edi, esi
jmp 0x51531b
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x51530c
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x38]
mov edx, edi
push esi
call fcn.005b0280
add esp, 4
mov eax, dword [ebp - 0x38]
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x51533f
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x5153d7
cmp esi, edi
jne 0x5152c0
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x5153f3
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x5152ce
jmp 0x5152e0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp esi, eax
ja 0x515410
lea eax, [ebp - 0x48]
push esi
push ebx
push eax
call fcn.0051ab60
add esp, 0xc
movsd xmm0, qword [ebp - 0x48]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x40]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x5153c1
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00452e30
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x43c
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi], 0
mov dword [esi + 4], eax
mov byte [esi + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x5153b1
jmp 0x5153c1
mov dword [ebp - 0x10], 0
push 0x60d53c
push 0x28
push 0x60afc8
call fcn.005b1730
add esp, 0xc
jmp 0x51541f
push 0x60d54c
push eax
push esi
call fcn.005b1b20
add esp, 0xc
ud2
Function at 0x51b510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
movzx ebx, byte [edx + 0x1c]
mov dword [esp + 8], ecx
xor ecx, ecx
mov eax, 0
mov edi, edx
call 0x51b52d
pop ebp
cmp bl, 1
setne dl
sbb eax, eax
or al, dl
movzx edx, al
cmp al, 0xff
je 0x51b543
test edx, edx
jne 0x51b56c
mov byte [esp + 3], bl
movzx ebx, byte [edi + 0x1e]
cmp al, 0xff
mov esi, ebx
je 0x51b555
test edx, edx
jne 0x51b55f
mov ecx, edi
call fcn.0051b420
movzx ecx, al
movzx ebx, byte [esp + 3]
xor eax, eax
test bl, bl
jne 0x51b5c8
jmp 0x51b574
xor esi, esi
xor eax, eax
test bl, bl
jne 0x51b5c8
xor eax, eax
cmp byte [edi + 8], 6
lea edx, [edi + 8]
cmove edx, eax
je 0x51b5c8
movzx ebx, byte [edx]
mov eax, 6
add ebp, dword [ebx*4 + 0x51b6d4]
jmp ebp
add ecx, eax
mov eax, esi
movzx esi, al
mov eax, dword [edi + 4]
lea ebx, [ecx + esi]
cmp eax, ebx
jb 0x51b6bb
mov ebp, dword [edi]
cmp eax, ebx
lea edx, [ebp + ebx]
jne 0x51b5f7
movzx ecx, byte [edi + 8]
mov byte [esp + 3], cl
xor ecx, ecx
sub eax, ebx
jne 0x51b672
jmp 0x51b657
mov dword [esp + 4], edx
mov dh, byte [edi + 8]
add ecx, esi
sub ecx, eax
cmp dh, 3
mov byte [esp + 3], dh
jae 0x51b62b
mov edx, dword [esp + 4]
lea esi, [eax + ebp - 1]
nop word cs:[eax + eax]
nop dword [eax]
cmp byte [esi], 0x5c
je 0x51b65b
dec esi
inc ecx
jne 0x51b620
jmp 0x51b651
mov edx, dword [esp + 4]
lea edi, [eax + ebp - 1]
nop word cs:[eax + eax]
nop dword [eax]
movzx esi, byte [edi]
cmp esi, 0x2f
je 0x51b65b
cmp esi, 0x5c
je 0x51b65b
dec edi
inc ecx
jne 0x51b640
xor ecx, ecx
sub eax, ebx
jne 0x51b672
mov bl, 0xa
jmp 0x51b6a2
not ecx
lea ebx, [ebx + ecx + 1]
cmp eax, ebx
jb 0x51b6c2
add ebp, ebx
mov ecx, 1
mov edx, ebp
sub eax, ebx
je 0x51b657
mov bl, 9
cmp eax, 2
je 0x51b693
cmp eax, 1
jne 0x51b6a2
cmp byte [edx], 0x2e
jne 0x51b6a2
xor ebx, ebx
cmp byte [esp + 3], 3
setae bl
lea ebx, [ebx + ebx*2 + 7]
jmp 0x51b6a2
cmp byte [edx], 0x2e
jne 0x51b6a2
cmp byte [edx + 1], 0x2e
sete bl
xor bl, 9
mov esi, dword [esp + 8]
add ecx, eax
mov dword [esi], ecx
mov byte [esi + 4], bl
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x60bea0
jmp 0x51b6c7
push 0x60beb0
push eax
push ebx
call fcn.005b1ab0
add esp, 0xc
ud2
Function at 0x51f480
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x103c
call fcn.00587440
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x531410
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], edx
lea esi, [ebp - 0x1048]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push esi
call fcn.00588b30
add esp, 0xc
xorps xmm0, xmm0
lea ebx, [ebp - 0x48]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], eax
push 0x527ca0
push ebx
push 0x1000
push esi
push edi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x51f5d4
mov esi, dword [sym.imp.kernel32.dll_SleepEx]
mov dword [ebp - 0x20], edi
push 1
push 0xffffffffffffffff
call esi
cmp dword [ebp - 0x34], 0
je 0x51f50a
cmp dword [ebp - 0x30], 0
jne 0x51f5e5
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x51f5e5
cmp eax, 0x1000
mov dword [ebp - 0x24], eax
ja 0x51f621
xor edi, edi
nop dword [eax + eax]
sub eax, edi
jb 0x51f607
xorps xmm0, xmm0
lea edx, [ebp - 0x34]
lea ecx, [ebp + edi - 0x1048]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], edx
push 0x527ca0
push ebx
push eax
push ecx
push dword [ebp - 0x28]
call dword [sym.imp.kernel32.dll_WriteFileEx]
test eax, eax
je 0x51f5dc
nop dword [eax + eax]
push 1
push 0xffffffffffffffff
call esi
cmp dword [ebp - 0x34], 0
je 0x51f580
cmp dword [ebp - 0x30], 0
jne 0x51f5e2
add edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
cmp edi, eax
jne 0x51f540
xorps xmm0, xmm0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], eax
push 0x527ca0
push ebx
push 0x1000
lea eax, [ebp - 0x1048]
push eax
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
jne 0x51f50a
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x51f5e5
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push edi
call esi
push dword [ebp - 0x28]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x103c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x60cef0
push dword [ebp - 0x24]
push edi
call fcn.005b1b90
add esp, 0xc
jmp 0x51f63b
mov dword [ebp - 0x10], 0
push 0x60cef0
push 0x1000
push eax
call fcn.005b1b20
add esp, 0xc
ud2
Function at 0x523ac0
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push dword [esp + 0x28]
call fcn.0052e920
add esp, 4
mov ecx, dword [esp]
mov edi, dword [esp + 4]
mov eax, dword [esp + 8]
test ecx, ecx
je 0x523b26
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
mov edx, esp
push 1
call fcn.00526a00
add esp, 4
mov ebx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
test ebx, ebx
je 0x523b22
push 0
push ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x523b32
mov byte [esi], 4
test edi, edi
jne 0x523b42
jmp 0x523b2b
mov eax, dword [esp + 0x14]
mov dword [esi], edi
mov dword [esi + 4], eax
add esp, 0x18
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test edi, edi
je 0x523b2b
add edi, edi
push 2
push edi
push ebx
call fcn.00452e30
add esp, 0x24
pop esi
pop edi
pop ebx
ret

Function at 0x523f30
Capabilities:
Delete file

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ecx, esp
push dword [esp + 0x30]
call fcn.0052e920
add esp, 4
mov ecx, dword [esp]
mov edi, dword [esp + 4]
mov eax, dword [esp + 8]
test ecx, ecx
je 0x523f9a
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
mov edx, esp
push 1
call fcn.00526a00
add esp, 4
mov ebx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
test ebx, ebx
je 0x523f96
push ebx
call dword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x523fa1
mov byte [esi], 4
test edi, edi
jne 0x523fb1
jmp 0x523fbf
mov eax, dword [esp + 0x14]
mov dword [esi], edi
mov dword [esi + 4], eax
jmp 0x523fbf
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test edi, edi
je 0x523fbf
add edi, edi
push 2
push edi
push ebx
call fcn.00452e30
add esp, 0xc
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
ret
Function at 0x523fd0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x531590
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
mov esi, dword fs:[0]
mov dword [ebp - 0x18], esi
mov dword fs:[0], ecx
lea ecx, [ebp - 0x28]
push eax
call fcn.0052e920
add esp, 4
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
test ecx, ecx
je 0x5240b5
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
lea edx, [ebp - 0x28]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x3c]
push 1
call fcn.00526a00
add esp, 4
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
test eax, eax
je 0x5240b2
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x30], edx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.0052e920
add esp, 4
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
test ecx, ecx
je 0x5240bc
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x28]
push 1
call fcn.00526a00
add esp, 4
mov edi, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x38]
mov ebx, dword [ebp + 8]
test edi, edi
je 0x5240c1
push 1
push edi
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_MoveFileExW]
test eax, eax
je 0x5240cb
mov byte [ebx], 4
test esi, esi
jne 0x5240db
jmp 0x5240e9
mov eax, dword [ebp - 0x34]
mov dword [ebx], edx
mov dword [ebx + 4], eax
jmp 0x524100
mov ebx, dword [ebp + 8]
jmp 0x5240c4
mov eax, dword [ebp - 0x34]
mov dword [ebx], esi
mov dword [ebx + 4], eax
jmp 0x5240e9
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [ebx], 0
mov dword [ebx + 4], eax
test esi, esi
je 0x5240e9
add esi, esi
push 2
push esi
push edi
call fcn.00452e30
add esp, 0xc
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x524100
add eax, eax
push 2
push eax
push dword [ebp - 0x2c]
call fcn.00452e30
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x524a80
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], esp
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x2c], 0x5315e0
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
lea ecx, [esi + 0x28]
mov eax, dword fs:[0]
mov dword [esi + 0x28], eax
mov dword fs:[0], ecx
mov ecx, esi
push ebx
call fcn.0052e920
add esp, 4
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
test ecx, ecx
je 0x524b8d
mov dword [esi], ecx
mov dword [esi + 4], edx
mov edx, esi
mov dword [esi + 8], eax
lea ecx, [esi + 0x14]
push 1
call fcn.00526a00
add esp, 4
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
test eax, eax
je 0x524b8a
mov edi, dword [ebp + 0x18]
mov dword [esi + 0x10], edx
mov edx, dword [ebp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x30], 0
mov ecx, esi
push edi
call fcn.0052e920
add esp, 4
mov ecx, dword [esi]
mov edi, dword [esi + 4]
mov eax, dword [esi + 8]
test ecx, ecx
je 0x524b9e
mov dword [esi], ecx
mov dword [esi + 4], edi
mov dword [esi + 8], eax
lea ecx, [esi + 0x14]
mov edx, esi
push 1
call fcn.00526a00
add esp, 4
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x18]
test ebx, ebx
je 0x524b9b
mov dword [esi + 4], 0
mov dword [esi], 0
push 0
push 0
mov eax, esi
push eax
push 0x524c30
push ebx
push dword [esi + 0xc]
call dword [sym.imp.kernel32.dll_CopyFileExW]
test eax, eax
je 0x524baf
mov eax, dword [esi]
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 4]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov dword [edx], 0
test edi, edi
jne 0x524bc9
jmp 0x524bd7
mov eax, dword [esi + 0x1c]
mov dword [edi + 4], edx
mov dword [edi + 8], eax
mov dword [edi], 1
jmp 0x524bf1
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [ecx + 8], eax
mov dword [ecx], 1
jmp 0x524bd7
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 1
test edi, edi
je 0x524bd7
add edi, edi
push 2
push edi
push ebx
call fcn.00452e30
add esp, 0xc
mov eax, dword [esi + 0x10]
mov edi, dword [ebp + 8]
test eax, eax
je 0x524bf1
add eax, eax
push 2
push eax
push dword [esi + 0xc]
call fcn.00452e30
add esp, 0xc
mov eax, dword [esi + 0x28]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x524f80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x524fc4
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x524fca
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x524fff
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0xc0000011
jne 0x52500f
mov dword [esi + 4], 0
jmp 0x525021
cmp eax, 0x103
je 0x52503b
test eax, eax
js 0x52502c
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov byte [esi], 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x525024
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x60cc84
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.00519c30
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.00405e80
mov ecx, 7
int 0x29
ud2
Function at 0x5250a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x5250e4
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x5250ea
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x525126
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x52514b
test eax, eax
js 0x525135
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov al, 4
jmp 0x525141
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x60cc84
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.00519c30
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.00405e80
mov ecx, 7
int 0x29
ud2

Function at 0x5251b0
Capabilities:
Create udp socket

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov ebx, 0x17
cmp word [eax], 0
mov eax, 2
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x5251f4
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x525208
cmp eax, 0x2739
jne 0x525233
push 1
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x52523b
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x52524c
mov dword [esi + 4], edi
jmp 0x5251eb
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x5251ee
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x5251ee
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
mov edx, eax
shr eax, 0x18
mov byte [esi], 0
shr ecx, 8
shl edx, 0x18
mov byte [esi + 7], al
mov dword [esi + 1], edx
mov word [esi + 5], cx
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x5251ee
Function at 0x525c30
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x531650
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x34]
add ecx, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], 0
call fcn.00513c20
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x24]
jne 0x525c97
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], 0
call fcn.00513730
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp + 8]
mov word [edi + edx*2], 0
push edi
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x525cd9
mov byte [esi], 4
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x525cc6
add eax, eax
push 2
push eax
push edi
call fcn.00452e30
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x525cb8
jmp 0x525cc6
Function at 0x528100
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx], 0
mov edi, edx
jne 0x5281d1
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx + 4]
test edx, edx
jne 0x52812a
mov eax, dword [ebx + 8]
xor edx, edx
lea ecx, [eax + 0xf]
cmp ecx, 0xf
jbe 0x52819e
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x5281ba
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx]
mov dword [esp], 0
mov ebx, esp
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x528164
mov eax, dword [esp]
mov ecx, 2
test eax, eax
jne 0x528182
jmp 0x528176
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x52817d
cmp eax, 0x6d
jne 0x528193
mov word [esi], 4
jmp 0x52818c
mov ecx, 1
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x52818c
mov edx, eax
mov ecx, ebx
push 0x10
call fcn.005b01e0
add esp, 4
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
cmp edx, eax
jne 0x528135
mov ecx, ebx
push 1
call fcn.005b01e0
add esp, 4
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
jmp 0x528135
mov edx, esp
mov ecx, edi
mov dword [esp], 0
call fcn.005b0180
ud2
Function at 0x52c370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.0052e920
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test edx, edx
je 0x52c3d5
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.005233c0
mov edi, dword [esp]
test edi, edi
je 0x52c3e4
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x52c3f9
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
jmp 0x52c3f1
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0
mov ecx, esp
call fcn.0050fc70
mov dword [esi], 0
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
mov dword [esi], 0
je 0x52c3f1
add ebx, ebx
push 2
push ebx
push edi
call fcn.00452e30
add esp, 0x30
jmp 0x52c3f4

Function at 0x52cd30
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x531700
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x52cdae
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
mov dword [esi + 0x30], 0x60d01c
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x2c], fcn.00517320
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 1
lea eax, [esi + 0x30]
push 0x60d048
push eax
call fcn.005b1670
add esp, 8
ud2