joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50aef0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x50af7b
test esi, esi
je 0x50af7b
push esi
call sym.FLAMESLauncher.exe_FOSUtilityFileExists
add esp, 4
test eax, eax
je 0x50af2c
cmp dword [ebp + 0x10], 0
je 0x50af7b
push esi
call sym.FLAMESLauncher.exe_FOSUtilityMakeFileWritable
add esp, 4
xor eax, eax
cmp dword [ebp + 0x10], eax
sete al
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x50af7b
lea eax, [ebp - 0x3c]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64]
add esp, 8
cmp eax, 0xffffffff
movzx eax, word [ebp - 0x36]
jne 0x50af5b
mov eax, dword [ebp - 0x40]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__chmod]
add esp, 8
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret

Function at 0x50af90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x50afac
test al, 0x10
je 0x50afac
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x50afb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
xor edx, edx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov ecx, dword [ebx]
test ecx, ecx
je 0x50b169
nop word [eax + eax]
lea edx, [edx + 1]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x50afd6
sub ecx, edi
add ecx, 3
add esi, ecx
mov ecx, dword [ebx + edx*4]
test ecx, ecx
jne 0x50afd0
test esi, esi
je 0x50b169
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x50b169
mov eax, dword [ebp + 8]
mov byte [ebx], 0
mov dword [ebp - 4], 0
mov edx, dword [eax]
test edx, edx
je 0x50b0eb
mov ecx, eax
cmp byte [edx], 0x22
je 0x50b08d
lea edi, [ebx - 1]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x50b028
mov ax, word [0x5c5924]
mov word [edi], ax
mov edx, dword [ecx]
mov esi, edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x50b040
sub edx, esi
lea edi, [ebx - 1]
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x50b050
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx - 1]
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x50b070
mov ax, word [0x5a4c2c]
mov word [ecx], ax
mov al, byte [0x5a4c2e]
mov byte [ecx + 2], al
jmp 0x50b0d3
mov esi, edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x50b090
sub edx, esi
lea edi, [ebx - 1]
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x50b0a0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x50b0c0
mov ax, word [0x5bbf68]
mov word [edi], ax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
inc eax
mov edx, dword [ecx + eax*4]
lea ecx, [ecx + eax*4]
mov dword [ebp - 4], eax
test edx, edx
jne 0x50b020
lea eax, [ebp - 0x14]
mov dword [ebp - 0x58], 0x44
push eax
lea eax, [ebp - 0x58]
xorps xmm0, xmm0
push eax
mov eax, dword [ebp + 0xc]
push 0
neg eax
movlpd qword [ebp - 0x54], xmm0
push 0
sbb eax, eax
movlpd qword [ebp - 0x4c], xmm0
and eax, 0x8000008
movlpd qword [ebp - 0x44], xmm0
push eax
push 0
push 0
push 0
push ebx
push 0
movups xmmword [ebp - 0x14], xmm0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x50b169
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50b180
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x54
test eax, eax
je 0x50b21f
cmp byte [eax], 0
je 0x50b21f
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push ecx
lea ecx, [ebp - 0x54]
xorps xmm0, xmm0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
movups xmmword [ebp - 0x10], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x50b21f
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x50b20d
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x50b2e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
test eax, eax
je 0x50b3d0
cmp byte [eax], 0
je 0x50b3d0
push eax
lea eax, [ebp - 0x108]
push str._s.
push eax
call fcn.004f9620
add esp, 0xc
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x50b3d0
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x248]
inc esi
push eax
push edi
call ebx
test eax, eax
jne 0x50b346
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
je 0x50b3d0
push 0x3db
push 0x5a4c38
call sym.FLAMESLauncher.exe_FObjectArrayCreateWithTag
movd xmm0, esi
mov edi, eax
cvtdq2pd xmm0, xmm0
push 0x3dc
push 0x5a4c38
mulsd xmm0, qword [0x5a4d80]
cvttsd2si ecx, xmm0
push ecx
push esi
push edi
call sym.FLAMESLauncher.exe_FObjectArraySetSizeWithTag
add esp, 0x1c
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [ebp - 0x24c], esi
cmp esi, 0xffffffff
jne 0x50b3e3
push 0x3e6
push 0x5a4c38
push 0
push edi
call sym.FLAMESLauncher.exe_FObjectArrayDestroyWithTag
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x50b3f0
sub ecx, edx
push 0x3ee
push 0x5a4c38
lea eax, [ecx + 1]
push eax
push 1
call sym.FLAMESLauncher.exe_FUtilityMemAllocateWithTag
lea edx, [ebp - 0x21c]
mov esi, eax
mov ecx, edx
add esp, 0x10
sub esi, ecx
nop dword [eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], cl
test cl, cl
jne 0x50b420
push 0x3f0
push 0x5a4c38
push eax
push edi
call sym.FLAMESLauncher.exe_FObjectArrayAddObjectWithTag
mov esi, dword [ebp - 0x24c]
lea eax, [ebp - 0x248]
add esp, 0x10
push eax
push esi
call ebx
test eax, eax
jne 0x50b3e3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
Function at 0x50b470
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
test eax, eax
je 0x50b576
cmp byte [eax], 0
je 0x50b576
push eax
push str._s.
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0050cac0
add esp, 0x10
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x50b576
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
nop dword [eax + eax]
mov ecx, 0x5bd430
lea eax, [ebp - 0x21c]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x50b510
test dl, dl
je 0x50b50c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x50b510
add eax, 2
add ecx, 2
test dl, dl
jne 0x50b4f0
xor eax, eax
jmp 0x50b515
sbb eax, eax
or eax, 1
test eax, eax
je 0x50b54e
mov eax, 0x5a4c58
lea ecx, [ebp - 0x21c]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x50b544
test dl, dl
je 0x50b540
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x50b544
add ecx, 2
add eax, 2
test dl, dl
jne 0x50b524
xor eax, eax
jmp 0x50b549
sbb eax, eax
or eax, 1
test eax, eax
je 0x50b54e
inc esi
lea eax, [ebp - 0x248]
push eax
push edi
call ebx
test eax, eax
jne 0x50b4e0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret

Function at 0x50b600
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x108]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x104
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
add esp, 0xc
movlpd qword [ebp - 0x110], xmm0
movlpd qword [ebp - 0x118], xmm0
test esi, esi
je 0x50b6c3
push esi
push 0x5a4c5c
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0050ca80
add esp, 0x14
lea eax, [ebp - 0x118]
push 0
push eax
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x50b6c3
mov edx, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x110]
call fcn.0052cbc0
mov edx, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x118]
movsd qword [edi], xmm0
call fcn.0052cbc0
pop edi
pop esi
movsd qword [ebx], xmm0
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
Function at 0x50b9b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x50ba2a
push esi
mov esi, dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
push str.HOMEDRIVE
call esi
add esp, 4
test eax, eax
je 0x50b9e3
mov edx, ebx
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x50b9d4
jmp 0x50b9e6
mov byte [ebx], 0
push str.HOMEPATH
call esi
mov edx, eax
add esp, 4
test edx, edx
je 0x50ba1c
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x50b9f8
push edi
sub edx, esi
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x50ba05
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
cmp byte [ebx], 0
pop esi
je 0x50ba2a
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x50c1b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x50c1e4
push 3
push eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
mov byte [ebp + 0xb], 0
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x50c1e4
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x50c290
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x50c2c1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x50c2ab
test al, 0x10
jne 0x50c2b9
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 1
jne 0x50c2c1
mov eax, 1
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x50c330
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, edi
test edi, edi
je 0x50c41b
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x50c348
sub ecx, esi
cmp ecx, 2
jle 0x50c38b
mov cl, byte [edi + 1]
lea eax, [edi + 2]
cmp cl, 0x3a
jne 0x50c36b
cmp byte [eax], 0x5c
jne 0x50c36b
lea edx, [edi + 3]
jmp 0x50c38b
cmp byte [edi], 0x5c
jne 0x50c38b
cmp cl, 0x5c
jne 0x50c38b
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strchr
add esp, 8
test eax, eax
je 0x50c41b
lea edx, [eax + 1]
push 0x5c
push edx
call sub.VCRUNTIME140.dll_strchr
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
add esp, 8
test esi, esi
je 0x50c3f4
push edi
mov byte [esi], 0
call ebx
cmp eax, 0xffffffff
je 0x50c3b1
test al, 0x10
jne 0x50c3dd
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x50c3b6
sub ecx, edx
test ecx, ecx
jle 0x50c3dd
push edi
call ebx
cmp eax, 0xffffffff
je 0x50c3cf
test al, 0x10
jne 0x50c3dd
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 1
jne 0x50c418
lea eax, [esi + 1]
mov byte [esi], 0x5c
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strchr
mov esi, eax
add esp, 8
test esi, esi
jne 0x50c3a2
push edi
call ebx
cmp eax, 0xffffffff
je 0x50c400
test al, 0x10
jne 0x50c40e
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 1
jne 0x50c41b
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov byte [esi], 0x5c
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x50c430
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.FLAMESLauncher.exe_FOSUtilityCopyFile
add esp, 0xc
cmp eax, 1
jne 0x50c45c
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x50c4a0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b4
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14c]
push 0x105
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
test esi, esi
je 0x50c6d3
cmp byte [esi], 0
je 0x50c6d3
lea eax, [ebp - 0x360]
mov dword [ebp - 0x360], 0x40
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 2
push str.ProgId
push str.SOFTWAREMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x50c6d3
lea eax, [ebp - 0x44]
push eax
push 0xca7
push 0x5a4d00
push str._s_shellopencommand
lea eax, [ebp - 0x35c]
push 0x105
push eax
call sym.FLAMESLauncher.exe_FStringFormatWithTag
add esp, 0x18
mov dword [ebp - 0x360], 0x105
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x14c]
push eax
push 0
push 2
push 0
lea eax, [ebp - 0x35c]
push eax
push bind
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x50c6d3
lea eax, [ebp - 0x14c]
push 0x5a4d2c
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x50c5c4
push esi
push 0xcb7
mov byte [eax + 1], 0x73
lea eax, [ebp - 0x14c]
push 0x5a4d00
push eax
lea eax, [ebp - 0x254]
push 0x105
push eax
call sym.FLAMESLauncher.exe_FStringFormatWithTag
add esp, 0x18
jmp 0x50c625
push 0xcbe
push 0x5a4d00
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x254]
push 0x105
push eax
call sym.FLAMESLauncher.exe_FStringCopyWithTag
push 0xcbf
push 0x5a4d00
push 0x5bbf68
lea eax, [ebp - 0x254]
push 0x105
push eax
call sym.FLAMESLauncher.exe_FStringCatWithTag
push 0xcc0
push 0x5a4d00
push esi
lea eax, [ebp - 0x254]
push 0x105
push eax
call sym.FLAMESLauncher.exe_FStringCatWithTag
add esp, 0x3c
lea eax, [ebp - 0x370]
mov dword [ebp - 0x3b4], 0x44
push eax
lea eax, [ebp - 0x3b4]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0x8000008
push 0
push 0
push 0
lea eax, [ebp - 0x254]
movlpd qword [ebp - 0x3b0], xmm0
push eax
push 0
movups xmmword [ebp - 0x370], xmm0
movlpd qword [ebp - 0x3a8], xmm0
movlpd qword [ebp - 0x3a0], xmm0
movlpd qword [ebp - 0x398], xmm0
movlpd qword [ebp - 0x390], xmm0
movlpd qword [ebp - 0x388], xmm0
movlpd qword [ebp - 0x380], xmm0
movlpd qword [ebp - 0x378], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x50c6d3
push dword [ebp - 0x370]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x36c]
call esi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
Function at 0x50c790
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x50c8fd
test al, 0x10
je 0x50c8fd
push 0x2f
push esi
call sub.VCRUNTIME140.dll_strchr
add esp, 8
test eax, eax
je 0x50c810
lea ecx, [ebp - 0x10c]
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x50c7d6
lea eax, [ebp - 0x10c]
push 0x2f
push eax
call sub.VCRUNTIME140.dll_strchr
add esp, 8
test eax, eax
je 0x50c80a
push 0x2f
push eax
mov byte [eax], 0x5c
call sub.VCRUNTIME140.dll_strchr
add esp, 8
test eax, eax
jne 0x50c7f8
lea esi, [ebp - 0x10c]
push esi
lea eax, [ebp - 0x274]
push str.cmd__c_rmdir__s__q___s_
push eax
call fcn.004f9620
add esp, 0xc
cmp byte [ebp - 0x274], 0
je 0x50c8fd
lea eax, [ebp - 0x288]
mov dword [ebp - 0x2cc], 0x44
push eax
lea eax, [ebp - 0x2cc]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x274]
movlpd qword [ebp - 0x2c8], xmm0
push eax
push 0
movups xmmword [ebp - 0x288], xmm0
movlpd qword [ebp - 0x2c0], xmm0
movlpd qword [ebp - 0x2b8], xmm0
movlpd qword [ebp - 0x2b0], xmm0
movlpd qword [ebp - 0x2a8], xmm0
movlpd qword [ebp - 0x2a0], xmm0
movlpd qword [ebp - 0x298], xmm0
movlpd qword [ebp - 0x290], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x50c8fd
push 0xffffffffffffffff
push dword [ebp - 0x288]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x288]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x284]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x278], 0
jne 0x50c8fd
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret

Function at 0x50c910
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
neg eax
sbb eax, eax
inc eax
pop ebp
ret

Function at 0x50c930
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x50c95c
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x50c95c
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x516ed0
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0x100
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test esi, esi
je 0x516f76
cmp dword [0x5ed044], 0
je 0x516f37
lea eax, [ebp - 0x294]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x516f76
push 0x515290
call fcn.0052c654
add esp, 4
mov dword [0x5ed044], 0
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x516f76
lea eax, [ebp - 0x104]
push eax
push str.HOSTNAME_s
push esi
call fcn.004f9620
add esp, 0xc
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
Function at 0x5170a0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x1f8]
push esi
push edi
push 0x1f4
push 0
push eax
mov dword [ebp - 0x200], edx
mov dword [ebp - 0x1fc], 0
call sub.VCRUNTIME140.dll_memset
push 0x39c
push str.GetMACAddress
push dword [0x5ed048]
push 1
call sym.FLAMESLauncher.exe_FUtilityMemAllocateWithTag
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
add esp, 0x1c
mov edi, eax
mov dword [ebp - 0x204], edi
push 0x5ed048
push edi
call esi
xor ecx, ecx
cmp eax, 0x6f
sete cl
jne 0x517142
push 0x3a4
push str.GetMACAddress
push dword [0x5ed048]
push 1
push edi
call sym.FLAMESLauncher.exe_FUtilityMemResizeWithTag
add esp, 0x14
mov dword [ebp - 0x204], eax
mov edi, eax
push 0x5ed048
push edi
call esi
mov ecx, eax
test ecx, ecx
jne 0x51729e
mov edx, dword [ebp - 0x200]
push ebx
mov ebx, edi
mov word [edx], 0x22
test edi, edi
je 0x517219
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x517209
xor esi, esi
test eax, eax
jle 0x5171ab
lea edi, [ebp - 0x1f8]
nop word [eax + eax]
movzx eax, byte [ebx + esi + 0x194]
push eax
push str._02X
push edi
call fcn.004f9620
mov eax, dword [ebx + 0x190]
inc esi
add esp, 0xc
add edi, 2
cmp esi, eax
jl 0x517180
mov edx, dword [ebp - 0x200]
add eax, eax
cmp eax, 0x1f4
jae 0x5172c8
mov byte [ebp + eax - 0x1f8], 0
lea eax, [ebp - 0x1f8]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5171c8
sub eax, esi
lea edi, [edx - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x5171d4
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [edx - 1]
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x5171f0
mov ax, word [0x5bbf68]
inc dword [ebp - 0x1fc]
mov word [edi], ax
mov ebx, dword [ebx]
test ebx, ebx
jne 0x517160
mov edi, dword [ebp - 0x204]
mov ecx, edx
pop ebx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x517220
mov eax, dword [ebp - 0x1fc]
sub ecx, esi
mov byte [ecx + edx - 1], 0x22
test eax, eax
je 0x5172b5
cmp eax, 1
jne 0x517275
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x517246
sub ecx, esi
lea eax, [edx + 1]
push ecx
push eax
push edx
call sub.VCRUNTIME140.dll_memmove
mov edx, dword [ebp - 0x200]
add esp, 0xc
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x517268
sub ecx, esi
mov byte [ecx + edx - 1], al
test edi, edi
je 0x51728c
push 0x3f4
push str.GetMACAddress
push edi
call sym.FLAMESLauncher.exe_FUtilityMemFreeWithTag
add esp, 0xc
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x5172b5
push 0x3db
push str.GetMACAddress
push edi
call sym.FLAMESLauncher.exe_FUtilityMemFreeWithTag
add esp, 0xc
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
call fcn.0052c33d
int3