joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a8fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, edx
mov edx, dword [ebp + 0x10]
push edi
mov dword [ebp - 0xc], esi
mov edi, ecx
cmp eax, 0xffffffff
jne 0x5a8fe7
cmp edx, 0xffffffff
je 0x5a908e
cmp byte [0x65c1e4], 0
je 0x5a9046
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
test edx, edx
jg 0x5a900f
jl 0x5a9000
test eax, eax
jae 0x5a900f
push 0x19
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
or ecx, eax
jmp 0x5a9079
push 0xe
push 8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
call fcn.0041ed62
mov esi, eax
push esi
call fcn.0041e908
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
mov esi, dword [ebp - 0xc]
jns 0x5a903e
or eax, 0xffffffff
or ecx, eax
jmp 0x5a9079
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
jmp 0x5a9079
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x5a9076
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x5a9073
or eax, 0xffffffff
or ecx, eax
jmp 0x5a9079
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp eax, 0xffffffff
jne 0x5a908e
cmp ecx, eax
jne 0x5a908e
mov eax, 0x1b60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x65c1e4], 0
push 0
je 0x5a90d3
xor eax, eax
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], eax
push esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
push edi
call fcn.0041eeb8
mov esi, eax
push esi
call fcn.0041e908
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jns 0x5a90ce
or eax, 0xffffffff
jmp 0x5a90ee
mov eax, dword [ebp - 0x1c]
jmp 0x5a90ee
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5a90eb
or eax, 0xffffffff
jmp 0x5a90ee
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
jne 0x5a90ff
mov eax, 0x1b5d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x5a9105
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5aeda0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
cmp dword [ecx + 0x1030], 1
jne 0x5aedbe
mov eax, 0x4e3b
pop ebp
ret 0xc
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.005af080

Function at 0x5af080
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov dword [edi], 0
xor eax, eax
test byte [esi + 0xc], 1
je 0x5af09d
mov eax, 1
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x5af0d7
cmp eax, 0xffffffff
je 0x5af0d7
test eax, eax
jne 0x5af0cd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
pop edi
mov eax, 0x4e34
pop esi
pop ebp
ret 0xc
mov dword [edi], eax
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.005b2bf0
cmp eax, 0x10
jne 0x5af0f4
pop edi
mov eax, 0x4e35
pop esi
pop ebp
ret 0xc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
pop edi
mov eax, 0x4e2a
pop esi
pop ebp
ret 0xc
Function at 0x5af600
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x20c], eax
test edi, edi
je 0x5af75f
test eax, eax
je 0x5af75f
push ebx
push 0x100
mov dword [eax], 0
lea eax, [ebp - 0x204]
push eax
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push esi
lea edx, [ebp - 0x204]
mov word [ebp - 6], ax
call fcn.005b07c0
mov esi, eax
add esp, 4
test esi, esi
je 0x5af749
mov ecx, esi
call fcn.005b06f0
push esi
mov ebx, eax
call dword [0x64908c]
test ebx, ebx
je 0x5af749
mov esi, ebx
lea esp, [esp]
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x5af6cd
push dword [ebp + 0xc]
mov edx, esi
mov ecx, eax
call fcn.005b09d0
add esp, 4
test eax, eax
je 0x5af6d6
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x5af6cd
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], 0xffffffff
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x5af690
jmp 0x5af6e5
mov ecx, esi
call fcn.005b0b00
mov ecx, dword [ebp - 0x20c]
mov dword [ecx], eax
mov ecx, dword [ebx + 0x14]
call fcn.005b0940
push dword [ebx]
call fcn.00541b50
push ebx
call fcn.00541b50
add esp, 8
test esi, esi
jne 0x5af717
pop ebx
pop edi
mov eax, 0x4e23
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 0x208]
push eax
push 1
push 6
push dword [edi]
mov dword [ebp - 0x208], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
mov eax, 0x4e22
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 0x4e21
pop esi
call fcn.00541b41
mov esp, ebp
pop ebp
ret

Function at 0x5b0310
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov esi, edx
xor edi, edi
test esi, esi
js 0x5b0355
cmp dword [0x65f288], edi
je 0x5b032d
mov esi, 0x64
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 8], eax
imul eax, eax, 0x3e8
sub esi, eax
imul esi, esi, 0x3e8
mov dword [ebp - 4], esi
lea edi, [ebp - 8]
cmp byte [ecx + 6], 0
je 0x5b0363
lea eax, [ecx + 0x210]
jmp 0x5b0365
xor eax, eax
cmp byte [ecx + 5], 0
je 0x5b0373
lea edx, [ecx + 0x10c]
jmp 0x5b0375
xor edx, edx
cmp byte [ecx + 4], 0
je 0x5b0380
add ecx, 8
jmp 0x5b0382
xor ecx, ecx
push edi
push eax
push edx
push ecx
push 0
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5b039d
or eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
js 0x5b03b4
jne 0x5b03b4
mov ecx, 0xf
call fcn.005b2ac0
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5b09d0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
cmp esi, 0xffffffff
jne 0x5b0a12
mov ecx, 0xa
call fcn.005b2ac0
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x31c]
push eax
push 0x8004667e
push esi
mov dword [ebp - 0x31c], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
inc eax
neg eax
sbb eax, eax
neg eax
dec eax
jne 0x5b09ff
push dword [edi + 4]
push dword [edi]
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x5b0a59
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
xor eax, eax
push esi
lea edx, [eax + 1]
lea ecx, [ebp - 0x318]
mov dword [ebp - 0x318], 0xffffffff
mov word [ebp - 0x314], ax
mov byte [ebp - 0x312], al
call fcn.005b0460
push esi
mov edx, 2
lea ecx, [ebp - 0x318]
call fcn.005b0460
mov edx, dword [ebp + 8]
add esp, 8
lea ecx, [ebp - 0x318]
or edi, 0xffffffff
call fcn.005b0310
test eax, eax
jle 0x5b0ae3
cmp byte [ebp - 0x313], 0
je 0x5b0ae3
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x5b0ae3
mov ecx, esi
call fcn.005b08c0
test eax, eax
jne 0x5b0ae3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.005b2bf0
neg eax
sbb eax, eax
and edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00541b41
mov esp, ebp
pop ebp
ret
Function at 0x5b0ba0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
mov eax, dword [0x64e0a0]
xor eax, esp
mov dword [esp + 0x320], eax
push ebx
mov ebx, edx
mov edx, ecx
push esi
push edi
mov dword [esp + 0xc], edx
cmp edx, 0xffffffff
jne 0x5b0bf3
mov ecx, 0xa
call fcn.005b2ac0
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x320]
xor ecx, esp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
xor ecx, ecx
mov dword [esp + 0x10], 0xffffffff
mov word [esp + 0x14], cx
mov byte [esp + 0x16], cl
mov edi, esi
test esi, esi
je 0x5b0ce1
cmp edi, 0xffffffff
je 0x5b0ce1
xor eax, eax
cmp byte [esp + 0x14], al
push edx
setne al
mov edx, 1
mov dword [esp + 0x14], 0xffffffff
dec eax
and dword [esp + 0x1c], eax
xor eax, eax
cmp byte [esp + 0x19], al
setne al
dec eax
and dword [esp + 0x120], eax
xor eax, eax
test cl, cl
setne al
lea ecx, [esp + 0x14]
dec eax
and dword [esp + 0x224], eax
call fcn.005b0460
mov edx, dword [ebp + 0x10]
add esp, 4
lea ecx, [esp + 0x10]
call fcn.005b0310
test eax, eax
jle 0x5b0ccd
cmp byte [esp + 0x15], 0
je 0x5b0ccd
lea eax, [esp + 0x11c]
push eax
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x5b0ccd
xor eax, eax
test byte [ebp + 0xc], 1
je 0x5b0c9e
mov eax, 1
push eax
push esi
push ebx
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x5b0cbb
cmp eax, 0xffffffff
je 0x5b0cbb
add ebx, eax
sub esi, eax
jmp 0x5b0cd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.005b2bf0
cmp eax, 0x10
je 0x5b0cd0
or edi, 0xffffffff
test esi, esi
je 0x5b0ce1
mov cl, byte [esp + 0x16]
mov edx, dword [esp + 0xc]
jmp 0x5b0c13
mov ecx, dword [esp + 0x32c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
Function at 0x5b0d00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
mov eax, dword [0x64e0a0]
xor eax, esp
mov dword [esp + 0x320], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edx
cmp edi, 0xffffffff
jne 0x5b0d50
mov ecx, 0xa
call fcn.005b2ac0
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x320]
xor ecx, esp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov word [esp + 0x14], cx
mov byte [esp + 0x16], cl
or esi, 0xffffffff
xor eax, eax
cmp byte [esp + 0x14], al
push edi
setne al
mov dword [esp + 0x14], 0xffffffff
dec eax
and dword [esp + 0x1c], eax
xor eax, eax
cmp byte [esp + 0x19], al
setne al
dec eax
and dword [esp + 0x120], eax
xor eax, eax
test cl, cl
setne al
xor edx, edx
lea ecx, [esp + 0x14]
dec eax
and dword [esp + 0x224], eax
call fcn.005b0460
mov edx, dword [ebp + 0x10]
add esp, 4
lea ecx, [esp + 0x10]
call fcn.005b0310
test eax, eax
jle 0x5b0dfc
xor eax, eax
test bl, 1
je 0x5b0dc2
mov eax, 1
push eax
push dword [ebp + 8]
push dword [esp + 0x14]
push edi
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5b0ddc
or esi, eax
jmp 0x5b0de1
cmp esi, 0xffffffff
jne 0x5b0dfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.005b2bf0
cmp eax, 0x10
jne 0x5b0dfc
mov cl, byte [esp + 0x16]
jmp 0x5b0d61
mov ecx, dword [esp + 0x32c]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
Function at 0x5b1890
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x64e0a0]
xor eax, esp
mov dword [esp + 0x220], eax
push esi
test edx, edx
je 0x5b18c8
mov eax, dword [edx]
test eax, eax
je 0x5b18c8
cmp eax, 1
je 0x5b1902
mov eax, dword [edx + 4]
add eax, 8
add edx, eax
mov eax, dword [edx]
test eax, eax
jne 0x5b18b5
lea eax, [esp + 0x14]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
movzx eax, byte [0x65c1e4]
push eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x18], 0
call fcn.005b0e80
add esp, 8
sub eax, 0
je 0x5b192f
dec eax
je 0x5b191a
or esi, 0xffffffff
jmp 0x5b193a
call fcn.005b23d0
pop esi
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
jmp 0x5b193a
mov ecx, dword [esp + 8]
call fcn.005b23d0
mov esi, eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x14]
cmp eax, ecx
je 0x5b1953
test eax, eax
je 0x5b1953
push eax
call fcn.00541b50
add esp, 4
mov ecx, dword [esp + 0x224]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00541b41
mov esp, ebp
pop ebp
ret

Function at 0x5b1a50
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x65c1e4], 0
push esi
je 0x5b1ab8
push 5
push 0x18
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
push ecx
call fcn.0041ec0e
mov esi, eax
push esi
call fcn.0041e908
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jns 0x5b1aa3
or eax, 0xffffffff
or edx, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x28], eax
cmp eax, 0xffffffff
jne 0x5b1ad8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5b1a8f
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
xor ecx, ebp
pop esi
call fcn.00541b41
mov esp, ebp
pop ebp
ret

Function at 0x5b1af0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [0x65c1e4], 0
push esi
push 0
je 0x5b1b53
xor eax, eax
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
push edx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push ecx
call fcn.0041ee4a
mov esi, eax
cmp esi, 0xc0000011
jne 0x5b1b32
mov dword [ebp - 0xc], 0
xor esi, esi
push esi
call fcn.0041e908
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jns 0x5b1b4b
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5b1b43
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5b1b90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [0x65c1e4], 0
push esi
push 0
je 0x5b1be2
xor eax, eax
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
push edx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push ecx
call fcn.0041eeb8
mov esi, eax
push esi
call fcn.0041e908
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jns 0x5b1bda
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5b1bd2
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5b30b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x65336c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
push edi
mov dword [ebp - 0x11c], edx
mov edi, ecx
mov esi, 3
mov edi, edi
cmp eax, 0xffffffff
jne 0x5b3113
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call ebx
test eax, eax
je 0x5b314f
mov edx, dword [ebp - 0x11c]
xor eax, eax
cmp dword [ebp - 0x108], 2
sete al
mov dword [0x65336c], eax
test eax, eax
setne cl
test cl, cl
je 0x5b3154
mov ecx, dword [edi]
test ecx, ecx
je 0x5b3154
push 0
lea eax, [ebp - 0x120]
push eax
mov eax, dword [edi + 0x14]
imul eax, dword [ebp + 8]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5b314f
mov eax, dword [ebp - 0x120]
xor edx, edx
div dword [edi + 0x14]
cmp eax, 0xffffffff
jne 0x5b3167
mov eax, dword [0x65336c]
dec esi
test esi, esi
jle 0x5b3164
mov edx, dword [ebp - 0x11c]
jmp 0x5b30e0
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00541b41
mov esp, ebp
pop ebp
ret

Function at 0x5b3230
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x65336c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
push edi
mov dword [ebp - 0x11c], edx
mov edi, ecx
mov esi, 3
mov edi, edi
cmp eax, 0xffffffff
jne 0x5b3293
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call ebx
test eax, eax
je 0x5b32cf
mov edx, dword [ebp - 0x11c]
xor eax, eax
cmp dword [ebp - 0x108], 2
sete al
mov dword [0x65336c], eax
test eax, eax
setne cl
test cl, cl
je 0x5b32d4
mov ecx, dword [edi]
test ecx, ecx
je 0x5b32d4
push 0
lea eax, [ebp - 0x120]
push eax
mov eax, dword [edi + 0x14]
imul eax, dword [ebp + 8]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5b32cf
mov eax, dword [ebp - 0x120]
xor edx, edx
div dword [edi + 0x14]
cmp eax, 0xffffffff
jne 0x5b32e7
mov eax, dword [0x65336c]
dec esi
test esi, esi
jle 0x5b32e4
mov edx, dword [ebp - 0x11c]
jmp 0x5b3260
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00541b41
mov esp, ebp
pop ebp
ret
Function at 0x5b3890
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x643d60
push 0x547240
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x64e0a0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x2c], edx
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
push 0
lea ecx, [ebp - 0x28]
push ecx
xor edx, edx
mov ecx, eax
call fcn.005b17a0
add esp, 8
test eax, eax
je 0x5b3904
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x24]
cmp ebx, edx
jb 0x5b392e
ja 0x5b391a
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x28]
cmp edi, ecx
jb 0x5b3934
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp + 8]
xor eax, eax
add esi, edi
adc eax, ebx
cmp eax, edx
jb 0x5b394e
ja 0x5b3947
cmp esi, ecx
jbe 0x5b394e
mov eax, ecx
sub eax, edi
mov dword [ebp + 8], eax
mov esi, dword [0x679b80]
test esi, esi
jne 0x5b396b
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0x38]
mov dword [0x679b80], esi
xor eax, eax
add esi, 0xffffffff
adc eax, 0xffffffff
not esi
not eax
and esi, edi
and eax, ebx
mov dword [ebp - 0x24], eax
sub edi, esi
or ebx, 0xffffffff
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 0x1c]
call dword [0x6490a4]
mov ecx, eax
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x5b3a0a
mov eax, dword [ebp + 8]
add eax, edi
push eax
push esi
push dword [ebp - 0x24]
push 4
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x5b3a01
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
push ebx
lea eax, [esi + edi]
push eax
push dword [ebp - 0x2c]
call fcn.005495a0
add esp, 0xc
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x5b39fa
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x1c]
call dword [0x649008]
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b3a20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x64e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, edx
push esi
push 0x104
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x5b3ae1
cmp eax, 0x104
ja 0x5b3ae1
lea eax, [ebp - 0x20c]
push eax
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x5b3ae1
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5b3a76
sub ecx, edx
sar ecx, 1
lea eax, [ebp - 0x20c]
cmp ecx, 0x104
jae 0x5b3ab4
push eax
push 0x104
push esi
call fcn.00543349
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
push 0x103
push eax
push 0x104
push esi
call fcn.00543d6d
add esp, 0x10
xor eax, eax
pop edi
mov word [esi + 0x206], ax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00541b41
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
or eax, 0xffffffff
pop esi
call fcn.00541b41
mov esp, ebp
pop ebp
ret
Function at 0x5b3b00
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, 0x80
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
test bl, 1
je 0x5b3b31
mov eax, closesocket
mov dword [ebp - 8], eax
mov ecx, ebx
and ecx, 2
je 0x5b3b40
or eax, 0x40000000
mov dword [ebp - 8], eax
test bl, 0x10
je 0x5b3b4d
or eax, 0x100080
mov dword [ebp - 8], eax
test bl, 0x20
je 0x5b3b5a
or eax, 0x100100
mov dword [ebp - 8], eax
test ebx, 0x100
je 0x5b3b77
test ecx, ecx
je 0x5b3b6e
test ebx, 0x10000
je 0x5b3b7e
mov dword [ebp - 0xc], 1
jmp 0x5b3b7e
mov dword [ebp - 0xc], 7
mov eax, dword [ebp + 0xc]
dec eax
cmp eax, 4
ja case.default.0x5b3b8b
jmp dword [eax*4 + 0x5b3cc4]
mov dword [ebp + 8], 1
jmp 0x5b3bbd
mov dword [ebp + 8], 2
jmp 0x5b3bbd
mov dword [ebp + 8], 3
jmp 0x5b3bbd
mov dword [ebp + 8], 4
jmp 0x5b3bbd
mov dword [ebp + 8], 5
test ebx, 0x40000
je 0x5b3bcd
mov esi, 0x2000080
mov dword [ebp - 4], esi
test ebx, 0x20000
je 0x5b3be2
lea eax, [ebp - 0x18]
push eax
call dword [0x649094]
mov dword [ebp - 0x14], eax
test ebx, 0x100000
je 0x5b3bf3
or esi, 0x8000000
mov dword [ebp - 4], esi
test ebx, 0x400000
je 0x5b3c04
or esi, 0x40000000
mov dword [ebp - 4], esi
test ebx, 0x800000
je 0x5b3c15
or esi, 0x20000000
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0x10]
mov eax, 0x66666667
imul esi
sar edx, 1
push edi
mov edi, edx
shr edi, 0x1f
add edi, edx
cmp edi, 0xc8
jge 0x5b3c36
mov edi, 0xc8
push 0
push dword [ebp - 4]
push dword [ebp + 8]
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 0x10]
call dword [0x649010]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5b3c9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x5b3c66
cmp eax, 2
jne 0x5b3c9b
test esi, esi
jle 0x5b3c9b
mov eax, esi
cmp edi, esi
jg 0x5b3c72
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [ebp - 4]
sub esi, edi
push dword [ebp + 8]
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 0x10]
call dword [0x649010]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5b3c56
cmp dword [ebp - 0x14], 0
pop edi
je 0x5b3cab
push dword [ebp - 0x18]
call dword [0x649098]
lea eax, [ebx + 1]
neg eax
sbb eax, eax
pop esi
and eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5b3f10
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x5b3f45
test byte [ebp + 8], 1
je 0x5b3f45
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
neg eax
sbb eax, eax
pop edi
not eax
pop esi
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret