joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51dbf0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60d7e5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
movzx eax, byte [ebp + 0x10]
xor eax, 1
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0x8004667e
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
xor esi, esi
test ebx, ebx
jle 0x51dcb0
push dword [ebp - 0x10]
mov edi, ebx
sub edi, esi
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x51dca2
mov eax, dword [ebp - 0x14]
push 0
push edi
add eax, esi
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jle 0x51dca2
mov eax, dword [ebp + 0xc]
mov cl, byte [eax]
test cl, cl
je 0x51dca2
add esi, edi
cmp byte [ebp + 0x10], 0
je 0x51dcb0
cmp esi, ebx
jl 0x51dc47
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x51dcb0
or eax, 0xffffffff
cmp byte [ebp + 0x10], 0
cmovne esi, eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51de50
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x7f206c]
xor eax, esp
mov dword [esp + 0x194], eax
cmp byte [0x80128d], 0
jne 0x51de8b
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
sete byte [0x80128d]
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret

Function at 0x521270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60dbaf
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x7f206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x41c], esi
push 0
push 0x1a
lea eax, [ebp - 0x418]
mov dword [ebp - 0x41c], esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x521310
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x41c]
call fcn.0041d400
add esp, 4
lea edx, [ebp - 0x41c]
mov dword [ebp - 4], 2
mov ecx, esi
call fcn.00524830
mov eax, dword [ebp - 0x41c]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x52131c
or ecx, 0xffffffff
lock xadd dword [eax], ecx
test ecx, ecx
jne 0x52131c
push eax
call fcn.004a8172
add esp, 4
jmp 0x52131c
mov dword [esi], 0
mov dword [esi], 0x7a135c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret
Function at 0x521440
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60dc30
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov dword [edi], vtable.juce::FileLogger.0
mov eax, dword [esi]
mov dword [edi + 4], eax
lea ecx, [eax - 8]
cmp ecx, 0x7a1354
je 0x52149f
mov eax, 1
lock xadd dword [ecx], eax
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [edi + 4]
mov byte [ebp - 4], 2
call fcn.00501cf0
mov eax, dword [esi]
or ebx, 0xffffffff
cmp byte [eax], 0
je 0x5214dd
mov edx, esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov byte [ebp - 4], 2
cmp eax, ebx
jne 0x521509
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00523980
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x521509
mov eax, ebx
lock xadd dword [ecx], eax
test eax, eax
jne 0x521509
push ecx
call fcn.004a8172
add esp, 4
mov dword [ebp - 0x10], 0x7a135c
push 0x7acbec
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.00518bc0
push 0x79c038
lea ecx, [ebp - 0x10]
call fcn.00518bc0
push 0x7acbec
lea ecx, [ebp - 0x10]
call fcn.00518bc0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
call fcn.00529ba0
mov esi, eax
push 0x7acbec
mov ecx, esi
call fcn.00518bc0
push 0x79c028
mov ecx, esi
call fcn.00518bc0
lea ecx, [ebp - 0x24]
call fcn.00528d90
sub esp, 0x10
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.00510a70
push eax
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.00529ba0
push 0x7acbec
mov ecx, eax
call fcn.00518bc0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x5215b3
mov eax, ebx
lock xadd dword [ecx], eax
test eax, eax
jne 0x5215b3
push ecx
call fcn.004a8172
add esp, 4
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00521350
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x5215dc
lock xadd dword [eax], ebx
test ebx, ebx
jne 0x5215dc
push eax
call fcn.004a8172
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5216b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60dc66
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
cmp byte [eax], 0
je 0x5217cd
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x5217cd
mov eax, 4
lea ebx, [edi + 4]
mov dword [ebp - 0x10], eax
nop dword [eax]
mov esi, dword [ebx]
mov dword [ebp - 0x14], eax
cmp esi, dword [edi]
je 0x521794
push dword [edi]
push esi
call fcn.0041f150
add esp, 8
test eax, eax
je 0x521794
cmp byte [esi], 0
je 0x5217a8
mov edx, ebx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x5217a8
mov edx, edi
lea ecx, [ebp - 0x1c]
call fcn.00418480
mov edx, ebx
lea ecx, [ebp - 0x20]
mov esi, dword [eax]
call fcn.00418480
push 0
push 0
push 6
push 0
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
je 0x5217b4
mov ecx, edi
call fcn.00501cf0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
mov ecx, edi
call fcn.005243f0
test al, al
jne 0x521794
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10]
dec eax
cmp dword [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
jg 0x521720
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5221a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x522211
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x522200
lea ecx, [ebp + 0xc]
call fcn.00502140
mov ecx, dword [esi + 0x18]
mov edx, dword [eax]
mov dword [esi + 0x18], edx
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x522200
or eax, 0xffffffff
lock xadd dword [ecx], eax
test eax, eax
jne 0x522200
push ecx
call fcn.004a8172
add esp, 4
mov eax, dword [ebp - 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
mov esp, ebp
pop ebp
ret 8
xor eax, eax
add dword [esi + 0x10], eax
adc dword [esi + 0x14], eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x522220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60dd71
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x1c], esi
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp byte [eax], 0
je 0x5222b4
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
call ebx
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x5222b4
mov edx, edi
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
call ebx
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x522389
test eax, 0x400
je 0x522389
mov ecx, edi
call fcn.00501cf0
mov esi, dword [esi]
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.00523ef0
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 2
push ecx
mov ecx, eax
call fcn.00527e80
mov ecx, dword [ebp - 0x14]
or ebx, 0xffffffff
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x5222f8
mov eax, ebx
lock xadd dword [ecx], eax
test eax, eax
jne 0x5222f8
push ecx
call fcn.004a8172
add esp, 4
lea edx, [ebp - 0x18]
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov byte [ebp - 4], 3
test al, 0x10
je 0x522326
mov dword [ebp - 0x14], 1
cmp eax, 0xffffffff
jne 0x52232d
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.00418480
mov edx, edi
lea ecx, [ebp - 0x20]
mov esi, dword [eax]
call fcn.00418480
push dword [ebp - 0x14]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
test al, al
mov eax, dword [ebp - 0x18]
setne byte [ebp - 0xd]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x522374
lock xadd dword [eax], ebx
test ebx, ebx
jne 0x522374
push eax
call fcn.004a8172
add esp, 4
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x522f10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60deef
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
cmp byte [eax], 0
je 0x523077
mov edx, esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x523077
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.00523ef0
mov ebx, eax
push 0x2e
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00518740
push 0x5c
mov ecx, esi
mov edi, eax
call fcn.00518740
cmp edi, eax
jle 0x522fa8
push edi
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00526f80
jmp 0x522faf
mov dword [ebp - 0x14], 0x7a135c
push 0x5c
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00518740
push 0x2e
mov ecx, esi
lea edi, [eax + 1]
call fcn.00518740
mov ecx, esi
cmp eax, edi
jle 0x522fdb
push eax
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.00517540
jmp 0x522fe5
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.00526f80
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push 1
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
push edi
mov ecx, ebx
call fcn.005230b0
mov ecx, dword [ebp - 0x10]
or esi, 0xffffffff
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x523022
mov eax, esi
lock xadd dword [ecx], eax
test eax, eax
jne 0x523022
push ecx
call fcn.004a8172
add esp, 4
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x523043
mov eax, esi
lock xadd dword [ecx], eax
test eax, eax
jne 0x523043
push ecx
call fcn.004a8172
add esp, 4
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x523061
lock xadd dword [eax], esi
test esi, esi
jne 0x523061
push eax
call fcn.004a8172
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 8]
mov eax, dword [esi]
mov dword [edx], eax
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x523091
mov ecx, 1
lock xadd dword [eax], ecx
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x523980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60dff1
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
cmp byte [eax], 0
je 0x5239f1
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x5239f1
mov eax, dword [ebp + 8]
mov dword [eax], 0x7a135c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00523ef0
mov dword [ebp - 4], 1
mov ecx, dword [edi]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
je 0x523a9a
push ecx
push eax
call fcn.0041c700
add esp, 8
test eax, eax
je 0x523a9a
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.00527c40
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x523a8c
push 8
push edi
lea ecx, [ebp - 0x48]
call fcn.00521f60
mov eax, dword [ebp - 0x38]
lea ecx, [eax - 8]
cmp ecx, 0x7a1354
je 0x523a5e
mov eax, 1
lock xadd dword [ecx], eax
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x10]
xchg dword [ecx], eax
lea ecx, [eax - 8]
cmp ecx, 0x7a1354
je 0x523a81
mov eax, esi
lock xadd dword [ecx], eax
test eax, eax
jne 0x523a81
push ecx
call fcn.004a8172
add esp, 4
lea ecx, [ebp - 0x48]
call fcn.00521e80
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], 0x7a135c
mov dword [edi], eax
jmp 0x523adb
push 0x79bf90
lea ecx, [ebp - 0x18]
call fcn.0041d340
mov edi, dword [ebp + 8]
lea edx, [ebp - 0x18]
add esp, 4
mov ecx, edi
call fcn.0051ea10
mov ecx, dword [ebp - 0x18]
or esi, 0xffffffff
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x523adb
mov eax, esi
lock xadd dword [ecx], eax
test eax, eax
jne 0x523adb
push ecx
call fcn.004a8172
add esp, 4
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x523af9
lock xadd dword [eax], esi
test esi, esi
jne 0x523af9
push eax
call fcn.004a8172
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5243f0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e125
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [edi]
cmp dword [esi], ebx
je 0x5244d2
push ebx
push dword [esi]
call fcn.0041f150
add esp, 8
test eax, eax
je 0x5244d2
cmp byte [ebx], 0
je 0x5244bc
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x5244bc
mov eax, dword [esi]
cmp dword [edi], eax
je 0x524484
push eax
push dword [edi]
call fcn.0041c700
add esp, 8
test eax, eax
je 0x524484
mov ecx, esi
call fcn.00501cf0
test al, al
je 0x5244bc
mov edx, esi
lea ecx, [ebp - 0x10]
call fcn.00418480
mov edx, edi
lea ecx, [ebp - 0x14]
mov esi, dword [eax]
call fcn.00418480
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5244f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e161
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov bl, 1
mov edx, esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
test al, 0x10
je 0x52461b
cmp eax, 0xffffffff
je 0x52461b
mov ecx, esi
call fcn.00501060
test al, al
jne 0x52461b
push 0x79bf68
lea ecx, [ebp - 0x10]
call fcn.0041d340
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 2
push eax
push ecx
push 3
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
mov ecx, esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 1
call fcn.00523710
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x5245ce
or eax, 0xffffffff
lock xadd dword [ecx], eax
test eax, eax
jne 0x5245ce
push ecx
call fcn.004a8172
add esp, 4
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
lea edi, [esi + eax*4]
cmp esi, edi
je 0x5245fe
nop dword [eax + eax]
push 0
mov ecx, esi
call fcn.005244f0
test al, al
je 0x5245f5
test bl, bl
je 0x5245f5
mov bl, 1
jmp 0x5245f7
xor bl, bl
add esi, 4
cmp esi, edi
jne 0x5245e0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00403a20
push dword [ebp - 0x24]
call fcn.004c2bdc
mov esi, dword [ebp - 0x18]
add esp, 4
mov ecx, esi
call fcn.00501cf0
test al, al
je 0x524640
test bl, bl
je 0x524640
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x525350
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e273
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x3c
call fcn.004a7e6f
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
push 0
push 2
mov dword [ebp - 4], 0
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fef0
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
push dword [ebp + 0x14]
mov dword [edi], 0
push esi
mov dword [edi + 4], 0
call fcn.0041f3b0
mov dword [ebp - 4], 1
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0x7a135c
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov word [edi + 0x30], 0
mov byte [edi + 0x32], 0
mov byte [ebp - 4], 2
mov edx, dword [edi + 4]
test edx, edx
je 0x52542a
lock inc dword [edx + 8]
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [edi + 8], eax
mov ecx, dword [edi + 0xc]
mov dword [edi + 0xc], edx
test ecx, ecx
je 0x525448
or eax, 0xffffffff
lock xadd dword [ecx + 8], eax
jne 0x525448
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, edi
call fcn.005251d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x527220
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e62d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [edi], eax
je 0x5272d6
push eax
push dword [edi]
call fcn.0041c700
add esp, 8
test eax, eax
je 0x5272d6
mov eax, dword [edi]
cmp byte [eax], 0
je 0x5272c1
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x5272c1
mov ecx, esi
call fcn.00501cf0
test al, al
je 0x5272c1
mov edx, esi
lea ecx, [ebp - 0x10]
call fcn.00418480
mov edx, edi
lea ecx, [ebp - 0x14]
mov esi, dword [eax]
call fcn.00418480
push 0
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x5272d6
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x5272f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e648
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x527346
cmp eax, 0xffffffff
je 0x527346
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5274e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e691
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x34]
mov eax, 0xaaaaaaab
lea edx, [esi*4]
mul edx
shr edx, 1
add edx, 3
push edx
call fcn.0051ac70
mov dword [ebp - 4], 0
test esi, esi
je 0x5275e4
nop dword [eax]
mov al, byte [edi]
inc edi
movzx ecx, al
mov eax, ecx
and ecx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + 8], al
cmp esi, 1
jbe 0x5275b6
mov al, byte [edi]
inc edi
movzx edx, al
mov eax, edx
and edx, 0xf
shr eax, 4
or eax, ecx
shl edx, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + 9], al
cmp esi, 2
jbe 0x5275a7
mov al, byte [edi]
inc edi
movzx ecx, al
mov eax, ecx
and ecx, 0x3f
shr eax, 6
or eax, edx
sub esi, 3
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + 0xa], al
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + 0xb], al
jmp 0x5275c7
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + 0xa], al
mov byte [ebp + 0xb], 0x3d
jmp 0x5275c5
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + 9], al
mov word [ebp + 0xa], 0x3d3d
xor esi, esi
mov eax, dword [ebp - 0x34]
lea ecx, [ebp + 8]
push 4
push ecx
lea ecx, [ebp - 0x34]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x5275e4
test esi, esi
jne 0x527540
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
test eax, eax
jne 0x5275f3
mov edx, dword [ebp - 0x20]
jmp 0x527603
cmp dword [eax + 4], ecx
jbe 0x527601
mov eax, dword [eax]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
push ecx
mov ecx, ebx
call fcn.00515f00
add esp, 4
lea ecx, [ebp - 0x34]
call fcn.0051ab70
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret