joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50e14c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea esi, [ebp - 0x30]
sub esp, 0x4c
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
call fcn.0062d090
mov eax, dword [ebp + 8]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0058e66f
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
push edx
push edx
jne 0x50e19a
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
jne 0x50e1ba
mov ecx, esi
call fcn.006bfc70
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004dccc9
mov dword [ebp - 0x3c], eax
call edi
mov dword [ebx], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebx + 4], eax
jmp 0x50e19a

Function at 0x50e6e7
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x60]
sub esp, 0x7c
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.0062d090
lea eax, [ebp - 0x58]
mov ecx, dword [esi]
mov dword [ebp - 0x5c], 0
mov byte [ebp - 0x58], 0
mov dword [ebp - 0x60], eax
mov eax, dword [esi + 4]
lea edx, [eax - 1]
mov al, byte [ecx + eax - 1]
cmp al, 0x2f
je 0x50e7c7
cmp al, 0x5c
je 0x50e7c7
mov dword [esp], esi
mov ecx, ebx
call fcn.006beee0
push edx
lea esi, [ebp - 0x30]
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.0058e66f
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
push edi
jne 0x50e78d
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 5
je 0x50e77c
call fcn.004dccc9
mov dword [ebp - 0x6c], eax
call edi
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, edx
mov edx, dword [ebp - 0x6c]
mov dword [eax + 4], edx
jmp 0x50e78d
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
push ecx
je 0x50e763
mov ecx, esi
call fcn.006bfc70
mov ecx, ebx
call fcn.006bcb70
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x48]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], esi
mov ecx, edi
call fcn.0064a3a0
sub esp, 0xc
mov ecx, ebx
mov dword [esp], edi
call fcn.006bf9b0
push eax
mov ecx, edi
call fcn.006bcb70
jmp 0x50e736
Function at 0x50eab6
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, ecx
sub esp, 0x50
cmp dword [ecx + 0x24], 0
jne 0x50eb6a
lea esi, [ecx + 8]
mov dword [esp + 4], 0
mov dword [esp], 0x5c
mov ecx, esi
call fcn.0064af60
push edx
push edx
inc eax
lea ecx, [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.0064b1c0
lea eax, [ebp - 0x24]
sub esp, 0xc
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x28]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea ecx, [ebp - 0x20]
sub esp, 0x14
mov esi, eax
call fcn.006bfc70
test esi, esi
je 0x50eb48
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0x24], eax
imul eax, dword [ebp - 0x30]
mov dword [ebx + 0x28], eax
jmp 0x50eb6a
mov dword [ebx + 0x24], 0x200
mov dword [ebx + 0x28], 0x1000
jmp 0x50eb6a
mov eax, dword [ebx + 0x24]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x50eb74
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x9c
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x70]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
push ecx
push ecx
je 0x50eca6
lea esi, [ebp - 0x4c]
mov ecx, esi
call fcn.005f8384
cmp dword [ebp - 0x3c], 0
je 0x50ec5f
mov eax, dword [ebp - 0x70]
cmp byte [ebp - 0x7c], 0
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x58], eax
mov eax, 0
mov dword [esp + 0x14], 0x20
cmovne eax, esi
mov dword [ebp - 0x54], edx
mov dword [esp + 0xc], 0x10
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x74]
mov dword [esp + 4], 0x940cf
mov dword [esp], edi
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x38]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x60]
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
sub esp, 0x20
test eax, eax
sete bl
and bl, byte [ebp - 0x7c]
je 0x50ec44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x50ec79
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov bl, 1
jmp 0x50ec5f
test eax, eax
je 0x50ec3a
cmp dword [ebp - 0x74], 0x10
jne 0x50ec40
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
xor edx, dword [ebp - 0x30]
xor eax, dword [ebp - 0x2c]
or edx, eax
setne bl
mov ecx, esi
call fcn.0050df7c
jmp 0x50eca6
mov dword [ebp - 0x68], 0
call fcn.004dccc9
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x68]
mov dword [esp], edi
mov ecx, esi
mov dword [esp + 4], eax
call fcn.005f82ec
cmp dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
push edx
push edx
jne 0x50ec5f
jmp 0x50ec48
lea esp, [ebp - 0xc]
mov al, bl
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x57f74d
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0x28]
mov esi, dword [esp + 0x50]
mov dword [esp], eax
call fcn.00503fb6
push eax
lea ecx, [esp + 0x28]
call fcn.0050401c
mov dword [esp + 0x2c], eax
xor eax, eax
mov dl, byte [esp + eax + 0x2c]
and dl, byte [eax + 0x73e9a4]
mov byte [esp + eax + 0x2c], dl
inc eax
cmp eax, 4
jne 0x57f778
mov al, byte [esp + 0x58]
mov dword [esp], 0xffffffff
shl eax, 5
or byte [esp + 0x2c], al
call fcn.0062d04c
cmp byte [0x7198b8], 0
mov dword [esp + 0x18], eax
jne 0x57f83b
mov dword [esp + 0x1c], 0
mov cl, byte [esp + 0x1c]
mov ebp, 8
xor eax, eax
mov dl, pe_nt_image_headers32
lea edi, [eax - 0x80000000]
test cl, dl
movzx edx, dl
cmovne eax, edi
lea edi, [eax + eax]
mov ebx, edi
xor ebx, 0x1edc6f41
test eax, eax
mov eax, ebx
cmovns eax, edi
shr edx, 1
dec ebp
jne 0x57f7c9
mov ebp, 7
xor edi, edi
movzx edx, cl
and cl, 1
je 0x57f808
mov ebx, 1
mov ecx, ebp
shl ebx, cl
or edi, ebx
dec ebp
shr edx, 1
cmp ebp, 0xffffffff
mov ecx, edx
jne 0x57f7f5
mov dword [esp], eax
call fcn.0062d04c
inc dword [esp + 0x1c]
mov ecx, edi
cmp dword [esp + 0x1c], 0x100
movzx edi, cl
mov dword [edi*4 + 0x718d60], eax
jne 0x57f7bc
mov byte [0x7198b8], 1
lea eax, [esp + 0x2c]
mov dl, byte [esp + 0x18]
xor dl, byte [eax]
lea edi, [esp + 0x30]
mov ebx, dword [esp + 0x18]
inc eax
movzx edx, dl
shr ebx, 8
xor ebx, dword [edx*4 + 0x718d60]
cmp eax, edi
mov dword [esp + 0x18], ebx
jb 0x57f83f
xor eax, eax
mov ecx, 5
mov edi, esi
rep stosd dword es:[edi], eax
not ebx
mov eax, ebx
shr eax, 0x18
mov byte [esi], al
mov eax, ebx
shr ebx, 8
shr eax, 0x10
and ebx, 0xfffffff8
mov byte [esi + 1], al
call fcn.00510b9a
and eax, 7
or ebx, eax
mov byte [esi + 2], bl
mov ebx, 3
call fcn.00510b9a
inc ebx
mov byte [ebx + esi - 1], al
cmp ebx, 0x13
jne 0x57f897
mov al, byte [esp + 0x58]
mov byte [esi + 0x13], al
add esp, 0x3c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x589778
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [0x857f30]
test eax, eax
jne 0x5897a8
sub esp, 0x4c
lea eax, [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push eax
mov eax, dword [esp + 0x20]
mov edx, 0x1000
test eax, eax
cmovle eax, edx
mov dword [0x857f30], eax
add esp, 0x4c
ret
Function at 0x58e013
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi + 4]
add ebx, dword [edi]
cmp eax, ebx
je 0x58e108
sub ebx, eax
mov edx, 3
mov byte [ebp - 0x1f], 0
cmp ebx, 3
mov byte [ebp - 0x1e], 0
mov byte [ebp - 0x1d], 0
cmovge ebx, edx
xor edx, edx
lea edi, [eax + ebx]
mov dword [ebp - 0x2c], edi
mov ecx, ebx
sub ecx, edx
test ecx, ecx
jle 0x58e077
mov cl, byte [eax + edx]
mov byte [ebp + edx - 0x1f], cl
inc edx
jmp 0x58e065
mov dl, byte [ebp - 0x1f]
xor edi, edi
mov al, dl
shl edx, 4
shr al, 2
and edx, 0x30
mov byte [ebp - 0x1c], al
mov al, byte [ebp - 0x1e]
mov cl, al
shl eax, 2
shr cl, 4
and eax, 0x3c
or edx, ecx
mov byte [ebp - 0x1b], dl
mov dl, byte [ebp - 0x1d]
mov cl, dl
and edx, 0x3f
shr cl, 6
mov byte [ebp - 0x19], dl
or eax, ecx
mov byte [ebp - 0x1a], al
cmp edi, ebx
jle 0x58e0c1
mov eax, 3
xor edi, edi
sub eax, ebx
mov ebx, eax
jmp 0x58e0eb
movzx eax, byte [edi + ebp - 0x1c]
mov ecx, esi
movsx eax, byte [eax + 0x7415a0]
mov dword [esp], eax
call fcn.006bf180
inc edi
push edx
jmp 0x58e0b0
mov dword [esp], 0x3d
mov ecx, esi
call fcn.006bf180
push eax
inc edi
cmp edi, ebx
mov eax, dword [ebp - 0x2c]
jl 0x58e0db
jmp 0x58e034
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5a288a
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea eax, [ecx + 0x4a0]
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x250]
lea edi, [ebp - 0x2ac]
sub esp, 0x31c
mov dword [esp], eax
call fcn.0062de44
lea eax, [ebp - 0x250]
push ecx
lea ecx, [ebp - 0x2f0]
mov dword [esp], eax
call fcn.005a0548
lea ecx, [ebp - 0x24c]
push esi
call fcn.005a079a
mov ecx, edi
call fcn.0058e9ce
mov eax, dword [ebp - 0x2f0]
mov eax, dword [eax + 0xa0]
add eax, 0x100
mov dword [ebp - 0x304], eax
mov eax, dword [ebx + 0x650]
add eax, 0xc0
mov dword [ebp - 0x300], eax
call fcn.00510b9a
and eax, 0x1ff
mov ecx, edi
mov dword [ebp - 0x2fc], eax
call fcn.0058ea60
mov dword [esp + 4], 4
mov dword [esp], str.req1
mov ecx, edi
call fcn.0058ea0c
mov eax, dword [ebp - 0x300]
push edx
mov ecx, edi
push edx
mov dword [esp + 4], 0x60
mov dword [esp], eax
call fcn.0058ea0c
lea esi, [ebp - 0x2e8]
push eax
push eax
mov ecx, esi
mov dword [esp], edi
call fcn.0058ea34
mov ecx, 5
push eax
lea edi, [ebp - 0x250]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x2ac]
mov ecx, esi
call fcn.0058ea60
mov dword [esp + 4], 4
mov dword [esp], str.req2
mov ecx, esi
call fcn.0058ea0c
push eax
push eax
mov ecx, esi
mov eax, dword [ebp - 0x304]
mov dword [esp + 4], 0x14
mov dword [esp], eax
call fcn.0058ea0c
push eax
push eax
lea ecx, [ebp - 0x2d4]
mov dword [esp], esi
call fcn.0058ea34
push eax
mov ecx, esi
call fcn.0058ea60
mov dword [esp + 4], 4
mov dword [esp], 0x742343
mov ecx, esi
call fcn.0058ea0c
push eax
push eax
mov ecx, esi
mov eax, dword [ebp - 0x300]
mov dword [esp + 4], 0x60
mov dword [esp], eax
call fcn.0058ea0c
push edi
push edi
lea ecx, [ebp - 0x2c0]
mov dword [esp], esi
call fcn.0058ea34
push ecx
xor eax, eax
mov dl, byte [ebp + eax - 0x2c0]
xor dl, byte [eax + ebp - 0x2d4]
lea esi, [ebp - 0x2c0]
mov byte [ebp + eax - 0x2c0], dl
inc eax
cmp eax, 0x14
jne 0x5a2a01
lea eax, [ebp - 0x23c]
mov ecx, 5
mov edi, eax
mov eax, dword [ebp - 0x304]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x300]
mov dword [esp], eax
call fcn.005a2008
push edx
push edx
lea edi, [ebp - 0x228]
mov eax, dword [ebx + 0x650]
mov dword [ebx + 0x650], 0
mov dword [esp + 4], 0x134
mov dword [esp], eax
call fcn.006eb350
mov eax, dword [ebp - 0x2fc]
mov edx, 3
mov ecx, ebx
lea esi, [eax + 0x10]
mov eax, dword [ebx + 0x108]
movzx eax, byte [eax + 0x18fe]
mov dword [esp + 4], esi
mov dword [esp], edi
test al, 3
cmove eax, edx
mov edx, dword [ebp - 0x2fc]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call fcn.005a275c
mov ecx, dword [ebx + 0x654]
sub esp, 0x10
mov eax, dword [ecx]
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [eax + 8]
push eax
push eax
mov ecx, ebx
mov eax, dword [ebp - 0x2fc]
mov edx, dword [ebx]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
add eax, 0x38
mov dword [esp + 4], eax
lea eax, [ebp - 0x250]
mov dword [esp], eax
call dword [edx + 0x34]
lea ecx, [ebp - 0x2ec]
sub esp, 0x14
call fcn.005a07a6
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5ad870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x90]
lea ecx, [esp + 0x70]
mov ebx, dword [esp + 0x84]
mov esi, dword [esp + 0x88]
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov byte [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.006e46f8
cmp ebp, eax
jne 0x5ada01
mov ebp, dword [esp + 0x70]
mov eax, dword [edi + 0x1c]
mov al, byte [eax + ebp*8 + 2]
test al, 1
je 0x5ad948
test al, 2
jne 0x5ada01
test byte [esp + 0x98], 8
jne 0x5ada01
mov ecx, edi
mov dword [esp], ebp
call fcn.005ad1f6
push ecx
mov edx, dword [esp + 0x94]
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x8c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 8], ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x80]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov ecx, edi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0xc], edx
call fcn.005ad672
sub esp, 0x28
mov ebx, eax
jmp 0x5ada01
mov dword [esp], ebp
mov ecx, edi
call fcn.005ad044
test esi, esi
push edx
jne 0x5ad986
cmp ebx, eax
lea ebp, [esp + 0x48]
cmovle eax, ebx
mov edi, eax
cmp esi, edi
jge 0x5ad982
mov ecx, dword [esp + 0x78]
mov eax, dword [esp + 0x70]
mov dword [esp], ebp
mov dword [esp + 0x4c], esi
inc esi
mov dword [esp + 0x48], eax
call fcn.006b28d4
push ecx
jmp 0x5ad962
sub ebx, edi
jmp 0x5ad9f7
mov eax, dword [esp + 0x74]
mov dword [esp + 4], esi
mov ecx, edi
mov dword [esp], ebp
mov dword [esp + 8], eax
call fcn.005ad122
sub esp, 0xc
mov esi, eax
lea ebp, [esp + 0x48]
mov dword [esp + 0x34], edx
cmp esi, dword [esp + 0x34]
jge 0x5ad9f7
mov dword [esp], esi
mov ecx, edi
call fcn.005ad044
push edx
xor edx, edx
cmp edx, eax
jge 0x5ad9e8
mov ecx, dword [esp + 0x78]
mov dword [esp], ebp
mov dword [esp + 0x3c], eax
mov dword [esp + 0x4c], edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x48], esi
call fcn.006b28d4
push eax
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
inc edx
jmp 0x5ad9bc
test eax, eax
mov edx, 0
cmovs eax, edx
inc esi
sub ebx, eax
jmp 0x5ad9a9
test ebx, ebx
mov eax, 0
cmovs ebx, eax
add esp, 0x5c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x2c
Function at 0x5b0552
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x7c
mov dword [esp], 0xffffffff
mov esi, dword [esp + 0x90]
call fcn.0062d04c
cmp byte [0x7198b8], 0
mov ebx, dword [esp + 0x94]
mov dword [esp + 0x2c], eax
jne 0x5b061d
mov dword [esp + 0x18], 0
mov cl, byte [esp + 0x18]
mov dword [esp + 0x1c], 8
xor eax, eax
mov dl, pe_nt_image_headers32
lea edi, [eax - 0x80000000]
test cl, dl
movzx edx, dl
cmovne eax, edi
lea edi, [eax + eax]
mov ebp, edi
xor ebp, 0x1edc6f41
test eax, eax
mov eax, ebp
cmovns eax, edi
shr edx, 1
dec dword [esp + 0x1c]
jne 0x5b059c
mov ebp, 7
xor edi, edi
movzx edx, cl
and cl, 1
mov dword [esp + 0x1c], edx
je 0x5b05e2
mov edx, 1
mov ecx, ebp
shl edx, cl
or edi, edx
mov edx, dword [esp + 0x1c]
dec ebp
shr edx, 1
cmp ebp, 0xffffffff
mov ecx, edx
jne 0x5b05cb
mov dword [esp], eax
call fcn.0062d04c
inc dword [esp + 0x18]
mov edx, edi
cmp dword [esp + 0x18], 0x100
movzx edi, dl
mov dword [edi*4 + 0x718d60], eax
jne 0x5b058c
mov byte [0x7198b8], 1
lea ebp, [esp + 0x54]
mov dword [esp], ebx
mov ecx, ebp
call fcn.0050482a
push edi
lea edi, [esp + 0x38]
mov dword [esp], esi
mov ecx, edi
call fcn.0050482a
push eax
mov dword [esp + 4], ebp
mov dword [esp], edi
call fcn.00504507
test al, al
je 0x5b06ac
mov ecx, esi
call fcn.005047f2
mov ecx, ebx
mov edi, eax
call fcn.005047f2
cmp ax, di
jae 0x5b066c
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.006e2dac
mov ecx, esi
call fcn.005047f2
movzx eax, ax
mov esi, dword [sym.imp.WSOCK32.DLL_htons]
mov dword [esp], eax
call esi
push edx
mov ecx, ebx
mov word [esp + 0x54], ax
call fcn.005047f2
movzx eax, ax
mov dword [esp], eax
call esi
push ecx
mov word [esp + 0x56], ax
lea eax, [esp + 0x58]
mov dword [esp], ebp
mov dword [esp + 4], eax
jmp 0x5b0794
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00504941
test al, al
je 0x5b06c8
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.006e2dac
mov ecx, ebp
mov dword [esp], esi
call fcn.0050482a
push ecx
mov ecx, edi
mov dword [esp], ebp
call fcn.00503fb6
push esi
mov ecx, edi
call fcn.0050401c
mov dword [esp], ebx
mov ecx, ebp
mov dword [esp + 0x34], eax
call fcn.0050482a
push eax
lea ecx, [esp + 0x30]
mov dword [esp], ebp
call fcn.00503fb6
push eax
lea ecx, [esp + 0x30]
lea ebx, [esp + 0x34]
call fcn.0050401c
mov dword [esp + 8], 2
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 0x38], eax
call sub.msvcrt.dll_memcmp
xor edx, edx
test eax, eax
jne 0x5b0748
mov dword [esp + 8], 3
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.msvcrt.dll_memcmp
xor edx, edx
test eax, eax
sete dl
inc edx
lea esi, [edx*4 + 0x742890]
mov dword [esp + 8], 4
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.005af84c
mov dword [esp + 8], 4
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.005af84c
lea ecx, [esp + 0x2c]
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0060b144
push edx
push edx
lea eax, [esp + 0x3c]
mov dword [esp], edi
mov dword [esp + 4], eax
lea ecx, [esp + 0x2c]
call fcn.0060b144
push eax
push eax
mov eax, dword [esp + 0x2c]
add esp, 0x7c
pop ebx
not eax
pop esi
pop edi
pop ebp
ret
Function at 0x5b6b93
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
ret
Function at 0x5c175d
Capabilities:
Hash data using sha256

Disassembly:
mov edx, dword [esp + 4]
mov eax, 1
test edx, edx
je 0x5c17f4
mov dword [edx + 0x48], 0
mov dword [edx], 0
xor eax, eax
mov dword [edx + 4], 0
mov dword [edx + 8], 0xf3bcc908
mov dword [edx + 0xc], 0x6a09e667
mov dword [edx + 0x10], 0x84caa73b
mov dword [edx + 0x14], 0xbb67ae85
mov dword [edx + 0x18], 0xfe94f82b
mov dword [edx + 0x1c], 0x3c6ef372
mov dword [edx + 0x20], 0x5f1d36f1
mov dword [edx + 0x24], 0xa54ff53a
mov dword [edx + 0x28], 0xade682d1
mov dword [edx + 0x2c], 0x510e527f
mov dword [edx + 0x30], 0x2b3e6c1f
mov dword [edx + 0x34], 0x9b05688c
mov dword [edx + 0x38], 0xfb41bd6b
mov dword [edx + 0x3c], 0x1f83d9ab
mov dword [edx + 0x40], 0x137e2179
mov dword [edx + 0x44], 0x5be0cd19
ret
Function at 0x5c9ca0
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x25c
mov eax, dword [0x85828c]
mov ebx, dword [esp + 0x270]
mov dword [esp + 0x24], 0x7435a0
mov dword [esp + 0x28], 0x5c9f30
mov dword [esp + 0x2c], str.getnameinfo
test eax, eax
mov dword [esp + 0x30], 0x5ca2e0
mov dword [esp + 0x34], str.freeaddrinfo
mov dword [esp + 0x38], fcn.005c9ee0
je 0x5c9d01
movzx ebx, bx
mov eax, dword [ebx*8 + 0x717954]
add esp, 0x25c
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea ebp, [esp + 0x3f]
mov dword [esp + 4], 0x104
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
sub esp, 8
test eax, eax
jne 0x5c9d30
mov dword [0x85828c], 1
jmp 0x5c9cea
lea eax, [esp + 0x144]
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
lea edx, [esp + 0x144]
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x5c9d4a
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
add al, al
lea eax, [esp + 0x144]
sbb edx, 3
mov dword [edx], 0x3273775c
mov dword [edx + 4], 0x32335f
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x1c], eax
call eax
sub esp, 4
test eax, eax
mov esi, eax
je 0x5c9e2c
mov dword [esp + 4], 0x7435a0
mov dword [esp], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
sub esp, 8
test eax, eax
je 0x5c9e20
lea ebp, [esp + 0x24]
mov eax, 0x7435a0
lea esi, [esi]
mov dword [esp + 4], eax
mov dword [esp], esi
call edi
sub esp, 8
test eax, eax
mov dword [ebp + 4], eax
je 0x5c9ec0
lea eax, [esp + 0x3c]
add ebp, 8
cmp ebp, eax
je 0x5c9e00
mov eax, dword [ebp]
jmp 0x5c9dd0
mov eax, dword [esp + 0x28]
mov dword [0x717954], eax
mov eax, dword [esp + 0x30]
mov dword [0x71795c], eax
mov eax, dword [esp + 0x38]
mov dword [fcn.005c9ee0], eax
jmp 0x5c9d1d
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
lea eax, [esp + 0x144]
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
lea edx, [esp + 0x144]
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x5c9e46
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
add al, al
lea eax, [esp + 0x144]
sbb edx, 3
mov dword [edx], 0x6873775c
mov dword [edx + 4], 0x367069
mov dword [esp], eax
call dword [esp + 0x1c]
sub esp, 4
test eax, eax
mov esi, eax
je 0x5c9d1d
mov dword [esp + 4], 0x7435a0
mov dword [esp], esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
sub esp, 8
test eax, eax
jne 0x5c9dc1
lea esi, [esi]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
jmp 0x5c9d1d
Function at 0x5ca850
Capabilities:
Resolve dns

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
mov esi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov dword [ebx], 0
mov byte [eax], 0
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
sub esp, 4
test eax, eax
mov dword [esp + 0x1c], eax
je 0x5ca925
cmp dword [eax + 8], 0x40002
jne 0x5ca8f0
mov eax, dword [esp + 0x1c]
mov edi, dword [eax + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x5ca8f0
movzx esi, si
jmp 0x5ca8bc
add edi, 4
lea ebx, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
je 0x5ca8f0
mov eax, dword [eax]
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call fcn.005ca5d0
sub esp, 0x10
test eax, eax
mov dword [ebx], eax
jne 0x5ca8b0
add esp, 0x2c
mov eax, 8
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0x400
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sub.msvcrt.dll_strncpy
mov eax, dword [esp + 0x50]
mov byte [eax + 0x400], 0
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
lea edx, [eax - 0x2afa]
cmp edx, 3
mov edx, 0x2af9
cmovae eax, edx
jmp 0x5ca91b

Function at 0x5d4150
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x746d28
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.005d41b0