joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5053d0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1840
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 2
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
call fcn.0056f8a6
mov ecx, dword [ebp - 0x20]
push 0xffffffffffffffff
push 0x610f54
inc ecx
mov dword [ebp - 0x24], eax
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00585d85
mov ecx, dword [ebp - 0x20]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], edx
push 0x20
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0xf
call fcn.0056f8a6
mov ecx, dword [ebp - 0x18]
push 0xffffffffffffffff
push str.Download_Paused
inc ecx
mov dword [ebp - 0x1c], eax
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00585d85
mov ecx, dword [ebp - 0x18]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1c]
push dword [esi + 0x24]
mov edx, 3
xor ecx, ecx
push dword [esi + 0x20]
push dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00500ba0
mov eax, dword [ebp - 0x1c]
add esp, 0x44
test eax, eax
je 0x5054b4
push 2
push eax
call fcn.0056f898
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], 0
test eax, eax
je 0x5054db
push 2
push eax
call fcn.0056f898
add esp, 8
mov dword [ebp - 0x24], 0
mov ecx, dword [esi + 0x2c]
mov dword [ebp - 0x20], 0
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [esi + 4]
test eax, eax
je 0x5054f8
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x505830
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b18c0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x54], 0
je 0x505966
cmp dword [esi + 0x50], 0
jne 0x505966
mov eax, dword [0x648bf0]
xor edi, edi
mov dword [ebp - 0x18], edi
mov eax, dword [eax + 0x98]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 0x54c4f0
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x5058b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5058b6
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x5058b6
push 4
call fcn.0056f5ce
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [edi], ebx
mov dword [esi + 0x50], edi
test edi, edi
je 0x505966
mov eax, dword [esi + 0x54]
test al, 1
je 0x505913
push str.Found_what_is_assumed_to_be_the_game_window__setting_foreground_now
lea ecx, [ebp - 0x1c]
call fcn.005455a0
push eax
push 0x5e5
push str.GameManager::PlayingGameWatcher::bringToFront
push str.d:jenkinsworkspaceclient3.exe.fgmussexe_srcgamemanager.cpp
push 0
mov dword [ebp - 4], 0
call fcn.00550890
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00500b70
mov eax, dword [esi + 0x50]
push dword [eax]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esi + 0x54]
test al, 2
je 0x505966
push str.Window_is_minimized__attempting_to_restore_it_from_iconic_mode
lea ecx, [ebp - 0x14]
call fcn.005455a0
push eax
push 0x5eb
push str.GameManager::PlayingGameWatcher::bringToFront
push str.d:jenkinsworkspaceclient3.exe.fgmussexe_srcgamemanager.cpp
push 0
mov dword [ebp - 4], 1
call fcn.00550890
add esp, 0x14
lea ecx, [ebp - 0x14]
call fcn.00500b70
mov esi, dword [esi + 0x50]
push dword [esi]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x505966
push 9
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x506480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b19a9
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], 0
xor bl, bl
call fcn.0054fbe0
comiss xmm0, dword [0x627900]
jb 0x5064d0
mov ecx, dword [esi + 0x3c]
mov edx, 0x63ec18
call fcn.00547ab0
mov bl, al
test bl, bl
sete al
mov byte [ebp - 0xe], al
test bl, bl
jne 0x506559
mov eax, dword [esi + 0x20]
test eax, eax
je 0x50652f
cmp dword [eax], 0
je 0x50652f
cmp dword [eax + 4], 0
jbe 0x50652f
push eax
lea ecx, [ebp - 0x1c]
call fcn.005456c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
mov ebx, 1
mov dword [ebp - 0x14], ebx
call fcn.00546d80
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 2
push esi
mov edi, eax
call fcn.0056f898
add esp, 8
cmp edi, 0xffffffff
je 0x506532
mov byte [ebp - 0xd], 0
jmp 0x506536
mov ebx, dword [ebp - 0x14]
mov byte [ebp - 0xd], 1
test bl, 1
je 0x50654d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x50654d
push 2
push eax
call fcn.0056f898
add esp, 8
movzx eax, byte [ebp - 0xe]
xor ecx, ecx
cmp byte [ebp - 0xd], cl
cmovne eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x506bf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1ab0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
test edi, edi
je 0x506de4
push 0xc
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], 5
call fcn.0056f8a6
mov ecx, eax
mov eax, dword [ebp - 0x20]
push 0xffffffffffffffff
push str._s_s
inc eax
mov dword [ebp - 0x24], ecx
push eax
push ecx
lea eax, [ebp - 0x14]
push eax
call fcn.00585d85
mov ecx, dword [ebp - 0x20]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x20], ecx
push 0x63f0e0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], edx
push edi
push eax
call fcn.00545b40
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
add esp, 0x24
test eax, eax
je 0x506c93
push 2
push eax
call fcn.0056f898
add esp, 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x506d69
cmp dword [ebx + 4], 2
jle 0x506d46
push ebx
lea ecx, [ebp - 0x18]
call fcn.005456c0
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.00546d80
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 2
push esi
mov edi, eax
call fcn.0056f898
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp edi, 0xffffffff
setne byte [ebp - 0xd]
test eax, eax
je 0x506cfa
push 2
push eax
call fcn.0056f898
add esp, 8
cmp byte [ebp - 0xd], 0
je 0x506d0b
mov ecx, ebx
call fcn.005483c0
mov esi, eax
jmp 0x506d46
push str.The_config_file_does_not_exist.
lea ecx, [ebp - 0x18]
call fcn.005455a0
push eax
push 0x761
push str.GameManager::openIWinConfigFile
push str.d:jenkinsworkspaceclient3.exe.fgmussexe_srcgamemanager.cpp
push 0x63ec80
mov dword [ebp - 4], 2
call fcn.00550890
add esp, 0x14
lea ecx, [ebp - 0x18]
call fcn.00500b70
xor esi, esi
mov eax, dword [ebx]
test eax, eax
je 0x506d5d
push 2
push eax
call fcn.0056f898
add esp, 8
mov dword [ebx], 0
push 8
mov dword [ebx + 4], 0
push ebx
jmp 0x506ddc
push 0x70
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0x37
call fcn.0056f8a6
mov ecx, dword [ebp - 0x28]
push 0xffffffffffffffff
push str.The_location_of_the_config_file_could_not_be_generated.
inc ecx
mov dword [ebp - 0x2c], eax
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00585d85
mov ecx, dword [ebp - 0x28]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x28], ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 3
push eax
push 0x768
push str.GameManager::openIWinConfigFile
push str.d:jenkinsworkspaceclient3.exe.fgmussexe_srcgamemanager.cpp
push 0x63ec80
call fcn.00550890
mov eax, dword [ebp - 0x2c]
add esp, 0x2c
test eax, eax
je 0x506de4
push 2
push eax
call fcn.0056f898
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50bd70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2138
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x14], ebx
push ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 0xe], 0
call fcn.005456c0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00546d80
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 2
push esi
mov edi, eax
call fcn.0056f898
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
cmp edi, 0xffffffff
setne byte [ebp - 0xd]
test eax, eax
je 0x50bdef
push 2
push eax
call fcn.0056f898
add esp, 8
cmp byte [ebp - 0xd], 0
je 0x50bf69
test ebx, ebx
je 0x50be4a
mov ecx, ebx
call fcn.00546b40
test al, al
je 0x50be4a
mov edi, dword [ebp + 8]
test edi, edi
je 0x50be4a
mov ecx, edi
call fcn.00546b40
test al, al
je 0x50be4a
push ecx
mov ecx, ebx
call fcn.00546c40
push ecx
mov ecx, edi
mov esi, eax
mov ebx, edx
call fcn.00546c40
cmp esi, eax
jne 0x50be4a
cmp ebx, edx
jne 0x50be4a
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x63f058
lea ecx, [ebp - 0x20]
call fcn.00545740
push 0x5c
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 1
call fcn.00546290
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
call fcn.00546600
push 0x5c
lea ecx, [ebp - 0x20]
call fcn.00546290
push 0x63ec70
lea ecx, [ebp - 0x20]
call fcn.00546600
push ecx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x30]
call fcn.0054c920
mov byte [ebp - 4], 2
xor bl, bl
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x50bf43
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.005456c0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
call fcn.0054d330
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x50beeb
push 2
push eax
call fcn.0056f898
add esp, 8
push 0x63ec28
lea ecx, [ebp - 0x28]
call fcn.00547150
mov bl, al
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x50bf0c
push 2
push eax
call fcn.0056f898
add esp, 8
cmp esi, 0x80000000
je 0x50bf43
cmp esi, 0x80000005
je 0x50bf43
cmp esi, reloc.WS2_32.dll_accept
je 0x50bf43
cmp esi, reloc.WS2_32.dll_bind
je 0x50bf43
cmp esi, 0x80000004
je 0x50bf43
cmp esi, reloc.WS2_32.dll_closesocket
je 0x50bf43
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x50bf55
push 2
push eax
call fcn.0056f898
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x510490
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2730
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [0x648be8], ebx
je 0x51061d
test edi, edi
je 0x51061d
cmp dword [edi], ebx
je 0x51061d
cmp dword [edi + 4], ebx
jbe 0x51061d
test edx, edx
je 0x51061d
cmp dword [edx], ebx
je 0x51061d
cmp dword [edx + 4], ebx
jbe 0x51061d
mov ecx, edx
call fcn.004ffbc0
mov esi, eax
test esi, esi
je 0x51061d
cmp dword [esi], ebx
je 0x51061d
cmp dword [esi + 4], ebx
jbe 0x51061d
push str.playing
lea ecx, [ebp - 0x1c]
call fcn.005455a0
push str.ready
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.005455a0
push str.SELECT__s_as_game_code_FROM_games_WHERE__s___s_AND__s_IN___s__AND___s___s_OR__s___s__ORDER_BY__s_DESC_
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.005455a0
push 0x63ef60
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
push ecx
push 0x63ee90
lea ecx, [ebp - 0x14]
push ecx
push 0x63ee90
push esi
push 0x63edd8
push edi
push 0x63ebd0
push 0x63ee98
push eax
call fcn.00545b40
add esp, 0x2c
lea ecx, [ebp - 0x24]
mov edi, eax
call fcn.00500b70
lea ecx, [ebp - 0x14]
call fcn.00500b70
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.00500b70
mov eax, dword [esi]
test eax, eax
je 0x5105b3
push 2
push eax
call fcn.0056f898
add esp, 8
mov dword [esi], ebx
push 8
push esi
mov dword [esi + 4], 0
call fcn.0056f898
add esp, 8
test edi, edi
je 0x51061d
push str.installed
lea ecx, [ebp - 0x2c]
call fcn.005455a0
push eax
mov dword [ebp - 4], 3
mov ecx, dword [0x648be8]
push edi
call fcn.005005c0
lea ecx, [ebp - 0x2c]
mov ebx, eax
call fcn.00500b70
mov ecx, dword [edi]
test ecx, ecx
je 0x51060b
push 2
push ecx
call fcn.0056f898
add esp, 8
mov dword [edi], 0
push 8
push edi
mov dword [edi + 4], 0
call fcn.0056f898
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x511970
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xc
mov esi, edx
mov edi, ecx
call fcn.0056f5ce
mov edx, dword [ebp + 8]
mov ebx, eax
push 1
push 1
push 0
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
call fcn.00521970
mov esi, eax
mov dword [ebx + 4], edi
mov dword [ebx], esi
add esp, 0x10
mov eax, dword [esi + 4]
mov byte [esi + 9], 1
test eax, eax
jne 0x5119e5
push eax
push 4
push esi
push 0x550410
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [esi + 0xc]
mov dword [esi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 4]
test eax, eax
je 0x5119ec
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 1
push ebx
mov ecx, 0x648c4c
call fcn.00545290
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x512cc0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2a9f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor al, al
cmp dword [0x648c10], 0
jne 0x512de9
push 0x20
call fcn.0056f5ce
mov edi, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
mov esi, 0xe
push 0x1e
mov dword [ebp - 0x10], 0
call fcn.0056f8a6
push 0xffffffffffffffff
push str.OverviewThread
mov ebx, eax
lea eax, [ebp - 0x10]
push 0xf
push ebx
push eax
mov dword [ebp - 0x1c], ebx
call fcn.00585d85
xor ecx, ecx
add esp, 0x1c
test eax, eax
cmovne esi, ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x24]
call fcn.005456c0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x10]
mov dword [edi], vtable.OThread.0
call fcn.00545740
mov eax, dword [ebp - 0x24]
mov dword [edi + 4], 0
mov word [edi + 8], 0
mov dword [edi + 0xc], 0xfffffffe
test eax, eax
je 0x512d8e
push 2
push eax
call fcn.0056f898
add esp, 8
test ebx, ebx
je 0x512d9d
push 2
push ebx
call fcn.0056f898
add esp, 8
mov dword [edi], vtable.OverviewThread.0
mov dword [edi + 0x18], 0
mov eax, dword [edi + 4]
mov dword [0x648c10], edi
mov byte [edi + 9], 1
test eax, eax
jne 0x512de0
push eax
push 4
push edi
push 0x550410
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [edi + 0xc]
mov dword [edi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [edi + 4]
test eax, eax
je 0x512de7
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5141e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xa
mov dword [ebp - 0x14], 0
mov esi, 4
call fcn.0056f8a6
push 0xffffffffffffffff
push str.data
push 5
push eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00585d85
xor ecx, ecx
add esp, 0x18
test eax, eax
cmovne esi, ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x20]
mov dword [ebp - 4], ecx
mov ecx, dword [0x648c18]
push eax
push 0x641920
call fcn.005005c0
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x514270
push 2
push eax
call fcn.0056f898
add esp, 8
test ebx, ebx
je 0x5143fa
push 0xa
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 4
call fcn.0056f8a6
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push str.data
inc ecx
mov dword [ebp - 0x20], eax
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00585d85
mov ecx, dword [ebp - 0x1c]
xor edx, edx
add esp, 0x18
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.00532760
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 0xd], al
test ecx, ecx
je 0x5142ee
push 2
push ecx
call fcn.0056f898
mov al, byte [ebp - 0xd]
add esp, 8
test al, al
je 0x5143f2
xor edi, edi
mov ecx, ebx
push edi
mov dword [ebp - 0x14], edi
call fcn.00532cd0
test al, al
je 0x5143eb
nop dword [eax + eax]
push 0x12
mov dword [ebp - 0x18], 0
mov esi, 8
call fcn.0056f8a6
push 0xffffffffffffffff
push str.LOCATION
push 9
push eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00585d85
xor ecx, ecx
add esp, 0x18
test eax, eax
cmovne esi, ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.00535430
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x51437a
push 2
push eax
call fcn.0056f898
add esp, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test esi, esi
je 0x5143d0
mov ecx, esi
call fcn.00546d80
mov edi, eax
test edi, edi
je 0x5143a4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 2
push edi
call fcn.0056f898
add esp, 8
mov eax, dword [esi]
test eax, eax
je 0x5143bb
push 2
push eax
call fcn.0056f898
add esp, 8
mov dword [esi], 0
push 8
push esi
mov dword [esi + 4], 0
call fcn.0056f898
mov edi, dword [ebp - 0x14]
add esp, 8
inc edi
mov ecx, ebx
mov dword [ebp - 0x14], edi
call fcn.00536a80
push edi
mov ecx, ebx
call fcn.00532cd0
test al, al
jne 0x514310
mov ecx, ebx
call fcn.00536a80
push ecx
mov ecx, ebx
call fcn.004ff890
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51b7c0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3ad0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x63b404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x648c74
call fcn.00546d80
mov edi, eax
test edi, edi
je 0x51b848
call fcn.0051c7e0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0xf01ff
mov ebx, eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x51b831
lea eax, [ebp - 0x34]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
push 2
push edi
call fcn.0056f898
add esp, 8
mov ecx, dword [0x648c1c]
test ecx, ecx
je 0x51b897
push 0
push 0x642ab0
call fcn.005001c0
mov esi, dword [0x648c1c]
test esi, esi
je 0x51b897
mov dword [ebp - 4], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x51b882
xor edx, edx
call fcn.004fbbe0
mov dword [esi], 0
push 4
push esi
call fcn.0056f898
add esp, 8
mov dword [0x648c1c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056f3c2
mov esp, ebp
pop ebp
ret
Function at 0x51e240
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov byte [ebp - 1], 0
push edi
mov ecx, dword [esi + 0x1008]
mov eax, ecx
mov edx, dword [esi + 0x100c]
sub eax, edx
cmp eax, 0x20
jae 0x51e36f
test eax, eax
je 0x51e29b
push eax
lea eax, [esi + 8]
add eax, edx
push eax
lea eax, [esi + 8]
push eax
call fcn.00573870
mov eax, dword [esi + 0x100c]
add esp, 0xc
sub dword [esi + 0x1008], eax
mov ecx, dword [esi + 0x1008]
mov dword [esi + 0x100c], 0
mov ebx, 0x1000
mov dword [ebp - 0xc], 0
sub ebx, ecx
test ebx, ebx
jle 0x51e36f
lea eax, [ebp - 8]
xor edi, edi
push eax
push 0x4004667f
push dword [esi + 4]
mov dword [ebp - 8], edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, dword [ebp - 8]
mov ecx, eax
test edx, edx
jne 0x51e332
mov eax, dword [esi + 0x1008]
sub eax, dword [esi + 0x100c]
jne 0x51e332
test ecx, ecx
jne 0x51e366
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x1011], 0
jne 0x51e317
cmp edi, 0xfa
lea eax, [edi + 0x14]
cmovae eax, edi
mov edi, eax
cmp edi, 0xfa
jb 0x51e317
cmp dword [esi + 0x1008], 0
je 0x51e379
lea eax, [ebp - 8]
push eax
push 0x4004667f
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, dword [ebp - 8]
mov ecx, eax
test edx, edx
je 0x51e2d1
test ecx, ecx
jne 0x51e366
cmp edx, ebx
cmovb ebx, edx
test ebx, ebx
jle 0x51e35f
mov eax, dword [esi + 0x1008]
push ecx
add eax, 8
push ebx
add eax, esi
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
mov dword [ebp - 0xc], eax
setg byte [ebp - 1]
mov byte [esi + 0x1011], 1
mov eax, dword [ebp - 0xc]
add dword [esi + 0x1008], eax
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov byte [esi + 0x1010], 1
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret