joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eac30
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4ead72
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 0xb], eax
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0x1f
ja 0x4eac68
bt dword [ebp - 0xb], eax
jae case.0x4eacc5.0
mov ax, word [ebp - 4]
add ax, 0x41
mov word [ebp - 6], ax
lea eax, [ebp - 0x18]
mov dx, word [ebp - 6]
call fcn.0040722c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, 0x4ead8c
call fcn.00407404
lea eax, [ebp - 0x10]
mov ecx, 0x4ead9c
mov edx, dword [ebp - 0x14]
call fcn.00407404
mov eax, dword [ebp - 0x10]
call fcn.00407214
push eax
call sub.kernel32.dll_GetDriveTypeW
mov byte [ebp - 7], al
xor eax, eax
mov al, byte [ebp - 7]
cmp eax, 6
ja case.0x4eacc5.0
jmp dword [eax*4 + 0x4eaccc]
mov eax, dword [ebp + 8]
push eax
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.004eab80
pop ecx
jmp case.0x4eacc5.0
mov eax, dword [ebp + 8]
push eax
mov dl, 1
mov eax, dword [ebp - 0x14]
call fcn.004eab80
pop ecx
jmp case.0x4eacc5.0
mov eax, dword [ebp + 8]
push eax
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.004eab80
pop ecx
jmp case.0x4eacc5.0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x20]
test byte [eax + 0x28], 1
jne case.0x4eacc5.0
mov eax, dword [ebp + 8]
push eax
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.004eab80
pop ecx
jmp case.0x4eacc5.0
mov eax, dword [ebp + 8]
push eax
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.004eab80
pop ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
jne 0x4eac5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ead79
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00406670
ret
Function at 0x4fd140
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fd2e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push dword [eax + 8]
mov edx, 0x4fd300
mov eax, dword [ebp - 8]
call fcn.004435f0
call fcn.00443830
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.00409dc4
mov eax, dword [ebp - 0xc]
push eax
mov edx, 0x4fd314
mov eax, dword [ebp - 8]
call fcn.004435f0
pop edx
call fcn.00443760
mov edx, 0x4fd328
mov eax, dword [ebp - 8]
call fcn.004435f0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x14]
call fcn.004437e0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.00409dc4
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x4fd344
mov eax, dword [ebp - 8]
call fcn.004435f0
pop edx
call fcn.00443760
mov eax, dword [ebp - 4]
push dword [eax + 0x24]
push dword [eax + 0x20]
mov edx, 0x4fd364
mov eax, dword [ebp - 8]
call fcn.004435f0
call fcn.00443830
mov edx, 0x4fd394
mov eax, dword [ebp - 8]
call fcn.004435f0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
call fcn.00443760
mov edx, 0x4fd3b0
mov eax, dword [ebp - 8]
call fcn.004435f0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x2c]
call fcn.00443760
mov edx, 0x4fd3c8
mov eax, dword [ebp - 8]
call fcn.004435f0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x30]
call fcn.00443760
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00409dc4
mov eax, dword [ebp - 0x14]
push eax
mov edx, 0x4fd3f0
mov eax, dword [ebp - 8]
call fcn.004435f0
pop edx
call fcn.00443760
mov edx, 0x4fd40c
mov eax, dword [ebp - 8]
call fcn.004435f0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x38]
call fcn.00443760
mov eax, dword [ebp - 4]
push dword [eax + 0x44]
push dword [eax + 0x40]
mov edx, 0x4fd430
mov eax, dword [ebp - 8]
call fcn.004435f0
call fcn.00443830
mov eax, dword [ebp - 4]
push dword [eax + 0x4c]
push dword [eax + 0x48]
mov edx, 0x4fd464
mov eax, dword [ebp - 8]
call fcn.004435f0
call fcn.00443830
mov eax, dword [ebp - 4]
push dword [eax + 0x54]
push dword [eax + 0x50]
mov edx, 0x4fd4b8
mov eax, dword [ebp - 8]
call fcn.004435f0
call fcn.00443830
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd2ee
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00406670
ret
Function at 0x518d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004069d4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00406ae4
test eax, eax
jle 0x518dc3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
mov ax, word [eax + edx*2 - 2]
mov word [ebp - 0x16], ax
mov eax, dword [ebp - 0x10]
dec eax
shl eax, 3
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
and ecx, 0x3f
call fcn.004080cc
and ax, word [ebp - 6]
xor word [ebp - 0x16], ax
mov eax, dword [ebp - 0xc]
call fcn.00406bac
mov edx, dword [ebp - 0x10]
mov cx, word [ebp - 0x16]
mov word [eax + edx*2 - 2], cx
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x518d73
mov esp, ebp
pop ebp
ret 8

Function at 0x523890
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x5238ab
add esp, 0xfffffff0
call fcn.004052fc
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x52396f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x78], edx
mov dl, 1
mov eax, dword [0x427178]
call fcn.0042a5d0
mov edx, dword [ebp - 4]
mov dword [edx + 0xb0], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0051ee50
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0059c300
mov eax, dword [ebp - 4]
add eax, 0x24
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x2c]
call fcn.00406a70
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x30], ecx
mov ecx, dword [edx + 0x14]
mov dword [eax + 0x34], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0xb4], 1
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.005237e0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 4]
mov edx, dword [edx + 0x10]
add edx, 0xc
call fcn.005a01d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x523976
lea eax, [ebp - 0x14]
call fcn.00406610
lea eax, [ebp - 0x10]
call fcn.00406634
ret
Function at 0x556240
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
mov edx, dword [0x556168]
call fcn.004078d0
xor eax, eax
push ebp
push 0x55630e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x55611c]
call fcn.00408510
add esp, 4
lea eax, [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push 0x5561a0
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0x14]
call fcn.0040835c
test eax, eax
jne 0x5562aa
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x5562f2
mov eax, dword [ebp - 0x14]
call fcn.00408364
test eax, eax
jl 0x5562ea
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5562e2
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0xc], eax
jmp 0x5562f2
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x5562c1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x556315
lea eax, [ebp - 0x18]
mov edx, dword [0x556168]
call fcn.004079a8
ret

Function at 0x559fd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
mov edx, 0x44
call fcn.0042b0a0
mov dword [ebp - 0x50], 0x44
lea eax, [ebp - 0x60]
mov edx, 0x10
call fcn.0042b0a0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00407214
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x55a047
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x577660
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x577668
push ecx
xor eax, eax
push ebp
push 0x577852
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [eax]
call dword [edx + 0xb8]
cmp edx, 0
jne 0x57769d
cmp eax, 0x80000000
ja 0x5776a3
jmp 0x57782a
jle 0x57782a
lea edx, [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041da50
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0x57786c
call fcn.00407404
lea eax, [ebp - 8]
mov edx, 0x105
call fcn.0040732c
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
call fcn.00406ae4
push eax
mov eax, dword [ebp - 8]
call fcn.00407214
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407214
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
jne 0x57776d
push 0x57787c
lea edx, [ebp - 0x28]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
add eax, 4
call fcn.0047a260
push dword [ebp - 0x28]
push 0x5778dc
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov ecx, dword [eax]
call dword [ecx + 0x98]
push dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.0040748c
mov edx, dword [ebp - 0x24]
mov eax, dword [0x5dcb2c]
mov eax, dword [eax]
xor ecx, ecx
call fcn.0043f790
jmp 0x57782a
mov eax, dword [ebp - 8]
call fcn.00407214
mov edx, eax
lea eax, [ebp - 8]
call fcn.0040726c
mov edx, 0x57790c
mov eax, dword [ebp - 8]
call fcn.004282b0
test eax, eax
jne 0x5777a0
mov dword [ebp - 0x10], 0x80000000
mov dword [ebp - 0xc], 0
jmp 0x5777f0
mov edx, 0x577924
mov eax, dword [ebp - 8]
call fcn.004282b0
test eax, eax
jne 0x5777c1
mov dword [ebp - 0x10], 0x80000000
mov dword [ebp - 0xc], 0
jmp 0x5777f0
mov edx, 0x577938
mov eax, dword [ebp - 8]
call fcn.004282b0
test eax, eax
jne 0x5777e2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 1
jmp 0x5777f0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
jne 0x5777fe
cmp dword [ebp - 0x10], 0
jbe 0x57782a
jmp 0x577800
jle 0x57782a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [eax]
call dword [edx + 0xb8]
cmp edx, dword [ebp - 0xc]
jne 0x57781a
cmp eax, dword [ebp - 0x10]
jbe 0x57782a
jmp 0x57781c
jle 0x57782a
mov eax, dword [ebp + 8]
add eax, 0xffffffdc
mov edx, dword [ebp - 4]
call fcn.00406a1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x577859
lea eax, [ebp - 0x2c]
mov edx, 5
call fcn.00406670
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406670
ret
Function at 0x589a20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [ebp - 9], 0
test byte [ebp - 4], 1
je 0x589a69
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589a9f
push 0xa4
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589a9f
push 0xa5
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x589ba3
jmp 0x589a9f
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589ba3
push 0xa4
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589ba3
push 0xa5
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589ba3
test byte [ebp - 4], 2
je 0x589ad5
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589b0b
push 0xa2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589b0b
push 0xa3
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x589ba3
jmp 0x589b0b
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589ba3
push 0xa2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589ba3
push 0xa3
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589ba3
test byte [ebp - 4], 4
je 0x589b3d
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589b67
push 0xa0
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589b67
push 0xa1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x589ba3
jmp 0x589b67
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589ba3
push 0xa0
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589ba3
push 0xa1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589ba3
test byte [ebp - 4], 8
je 0x589b87
push 0x5b
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589b9f
push 0x5c
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x589ba3
jmp 0x589b9f
push 0x5b
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589ba3
push 0x5c
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x589ba3
mov byte [ebp - 9], 1
mov al, byte [ebp - 9]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x589da0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
call sub.user32.dll_GetShellWindow
cmp eax, dword [ebp - 4]
je 0x589dc8
push 0
push 0x589dd4
call sub.user32.dll_FindWindowW
cmp eax, dword [ebp - 4]
je 0x589dc8
xor eax, eax
jmp 0x589dca
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x5932e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov byte [ebp - 5], 0
push 0x5934d8
push 0x5934e8
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040b48c
mov dword [ebp - 4], eax
push 6
push 1
push 2
call sub.ws2_32.dll_socket
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x593327
push ebp
mov eax, 0x59350c
call fcn.005931e0
pop ecx
jmp 0x5934ce
xor eax, eax
push ebp
push 0x5934c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 1
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0xffff
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_setsockopt
mov dword [ebp - 0xc], 0x10
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
call fcn.0042b0a0
mov word [ebp - 0x28], 2
push 0x593554
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_bind
inc eax
jne 0x5933a1
push ebp
mov eax, 0x59356c
call fcn.005931e0
pop ecx
call fcn.00405dfc
jmp 0x5934ce
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_getsockname
inc eax
jne 0x5933cb
push ebp
mov eax, 0x5935a8
call fcn.005931e0
pop ecx
call fcn.00405dfc
jmp 0x5934ce
push 0x593554
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0x24], eax
push 0x7fffffff
mov eax, dword [ebp - 0x10]
push eax
call sub.ws2_32.dll_listen
inc eax
jne 0x5933ff
push ebp
mov eax, 0x5935f4
call fcn.005931e0
pop ecx
call fcn.00405dfc
jmp 0x5934ce
push 6
push 1
push 2
call sub.ws2_32.dll_socket
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x593429
push ebp
mov eax, 0x593644
call fcn.005931e0
pop ecx
call fcn.00405dfc
jmp 0x5934ce
xor eax, eax
push ebp
push 0x5934a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.ws2_32.dll_connect
inc eax
jne 0x593463
push ebp
mov eax, 0x593694
call fcn.005931e0
pop ecx
call fcn.00405dfc
call fcn.00405dfc
jmp 0x5934ce
push ebp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.005931a0
pop ecx
cmp eax, 0xffffffff
jne 0x59348e
push ebp
mov eax, 0x5936d4
call fcn.005931e0
pop ecx
call fcn.00405dfc
call fcn.00405dfc
jmp 0x5934ce
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5934b0
mov eax, dword [ebp - 0x14]
push eax
call sub.ws2_32.dll_closesocket
ret
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x593710
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x593889
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xa], 1
mov eax, dword [ebp - 8]
call fcn.0042c330
mov dl, 1
mov eax, dword [0x4272a0]
call fcn.00405008
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x59385f
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, byte [0x593898]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0042ae60
mov eax, dword [ebp - 0x14]
call fcn.0042cd40
dec eax
test eax, eax
jl 0x593849
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.0042caf0
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
call fcn.00406ae4
mov edx, eax
inc edx
mov ecx, 0x7fffffff
pop eax
call fcn.004075d4
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00407404
push 1
mov eax, dword [ebp - 0x18]
call fcn.00407214
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.0042caf0
mov eax, dword [ebp - 0x28]
call fcn.00407214
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
jne 0x59383d
mov byte [ebp - 0xa], 0
lea ecx, [ebp - 0x30]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.0042caf0
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x5938a8
call fcn.00407404
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x5dcb2c]
mov eax, dword [eax]
xor ecx, ecx
call fcn.0043f790
cmp byte [ebp - 9], 0
je 0x59383d
call fcn.00405dfc
jmp 0x593866
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x593798
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x593866
mov eax, dword [ebp - 0x14]
call fcn.00405038
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x593890
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.00406670
lea eax, [ebp - 0x18]
call fcn.00406610
ret
Function at 0x597930
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x5979e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
inc dword [eax - 4]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0042caf0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 4]
call fcn.0042c040
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0041d248
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x10]
lea eax, [ebp - 8]
call fcn.00407404
push 1
mov eax, dword [ebp - 8]
call fcn.00407214
push eax
mov eax, dword [ebp - 4]
call fcn.00407214
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x5979bc
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00407214
push eax
call sub.kernel32.dll_MoveFileExW
jmp 0x5979ce
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.00407214
push eax
call sub.kernel32.dll_MoveFileExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5979f0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00406670
ret
Function at 0x59f3b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x59f3c8
add esp, 0xfffffff0
call fcn.004052fc
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x59f475
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x24
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x18]
call fcn.00406a70
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x30], ecx
mov ecx, dword [edx + 0x14]
mov dword [eax + 0x34], ecx
mov eax, dword [ebp - 4]
add eax, 0x7c
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0xc]
call fcn.00406a70
mov eax, dword [ebp - 4]
add eax, 0x78
mov edx, dword [ebp + 8]
call fcn.00406a70
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0xc]
call fcn.0047adc0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0059c300
mov eax, dword [ebp - 4]
add eax, 0x38
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
call fcn.004072dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59f47c
lea eax, [ebp - 0x10]
call fcn.00406634
ret

Function at 0x59fa30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x59fa48
add esp, 0xfffffff0
call fcn.004052fc
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x59fb05
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x24
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x18]
call fcn.00406a70
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x30], ecx
mov ecx, dword [edx + 0x14]
mov dword [eax + 0x34], ecx
mov eax, dword [ebp - 4]
add eax, 0x80
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0xc]
call fcn.00406a70
mov eax, dword [ebp - 4]
lea edx, [eax + 0x7c]
mov eax, dword [ebp + 8]
call fcn.00409dc4
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x38]
mov eax, dword [ebp - 4]
call fcn.0059fec0
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0xc]
call fcn.0047adc0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0059c300
mov eax, dword [ebp - 4]
add eax, 0x38
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
call fcn.004072dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59fb0c
lea eax, [ebp - 0x10]
call fcn.00406634
ret