joyce8/EMBER2024-capa huggingface dataset:
Function at 0x501cf0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c321
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
cmp byte [eax], 0
je 0x501dc1
mov edx, esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x501dc1
mov edx, esi
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
test al, 0x10
je 0x501d99
cmp eax, 0xffffffff
je 0x501d99
mov edx, esi
lea ecx, [ebp - 0x10]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov edx, esi
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x501df0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c344
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp byte [eax], 0
je 0x501e98
mov edx, esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
call edi
cmp eax, 0xffffffff
je 0x501e98
mov edx, esi
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
call edi
mov edx, 0x40000000
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
mov ebx, eax
call fcn.00501fd0
test al, al
je 0x501f24
cmp ebx, 0xffffffff
je 0x501e84
and bl, 0x11
cmp bl, 1
je 0x501f24
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, esi
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
call edi
mov dword [ebp - 4], 0xffffffff
test al, 0x10
je 0x501ebd
cmp eax, 0xffffffff
jne 0x501f24
push dword [esi]
mov ecx, 0x5c
call fcn.0041c820
shr eax, 0x1f
add esp, 4
xor al, 1
je 0x501f24
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00523ef0
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.00501df0
mov edx, dword [ebp - 0x10]
mov bl, al
add edx, 0xfffffff8
cmp edx, 0x7a1354
je 0x501f10
or ecx, 0xffffffff
lock xadd dword [edx], ecx
test ecx, ecx
jne 0x501f10
push edx
call fcn.004a8172
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x501f40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c35f
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
cmp byte [eax], 0
je 0x501f99
mov edx, ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x501f99
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x502390
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c415
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
mov ecx, dword [ecx]
mov eax, esp
mov dword [eax], ecx
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x5023d1
mov eax, 1
lock xadd dword [ecx], eax
lea ecx, [ebp - 0x10]
call fcn.00502430
add esp, 4
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00418480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x502418
or ecx, 0xffffffff
lock xadd dword [eax], ecx
test ecx, ecx
jne 0x502418
push eax
call fcn.004a8172
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5033a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c5f3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
cmp edi, dword [esi + 8]
jae 0x503528
mov eax, dword [esi]
mov edi, dword [eax + edi*4]
test edi, edi
je 0x503528
push 0x58
call fcn.004a7e6f
add esp, 4
mov dword [ebp + 8], eax
push edi
push esi
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00415080
mov dword [ebp - 4], 0xffffffff
mov esi, eax
cmp byte [edi + 0x30], 0
je 0x50352a
push 0x40
call fcn.004a7e6f
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
mov dword [ebx], vtable.juce::GZIPDecompressorInputStream.0
mov dword [ebx + 4], esi
mov byte [ebx + 8], 1
mov byte [ebp - 4], 2
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], 1
mov byte [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov eax, dword [esi]
mov edx, dword [eax + 0x54]
cmp eax, vtable.juce::ZipFile::ZipInputStream.0
jne 0x50353e
mov eax, dword [esi + 0x40]
mov edx, dword [esi + 0x44]
push 0x8000
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
call fcn.004c2f64
mov dword [ebx + 0x38], eax
push 0x44
mov byte [ebp - 4], 3
call fcn.004a7e6f
mov edi, eax
mov dword [ebp - 0x10], edi
push 0x38
mov byte [ebp - 4], 4
lea esi, [edi + 4]
push 0
push esi
mov dword [edi], 0x10001
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
call fcn.004c0240
push str.1.2.3
mov edx, 0xfffffff1
mov ecx, esi
call fcn.00507f30
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
push 0x48
sete al
test ecx, ecx
mov byte [edi + 3], al
setne al
mov byte [edi + 2], al
mov byte [edi], al
mov dword [ebx + 0x3c], edi
call fcn.004a7e6f
add esp, 0x1c
mov dword [ebp + 8], eax
push 1
push 0x8000
push ebx
mov ecx, eax
mov dword [ebp - 4], 5
call fcn.0051bef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call edx
jmp 0x50346c
Function at 0x5042d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c756
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [ebx], vtable.juce::GZIPDecompressorInputStream.0
mov dword [ebx + 4], esi
mov byte [ebx + 8], 0
mov dword [ebp - 4], 0
mov dword [ebx + 0x10], 0xffffffff
mov dword [ebx + 0x14], 0xffffffff
mov dword [ebx + 0x18], 0
mov byte [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov eax, dword [esi]
mov edx, dword [eax + 0x54]
cmp eax, vtable.juce::SubregionStream.0
jne 0x5043e7
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x54]
call eax
sub eax, dword [esi + 0x10]
sbb edx, dword [esi + 0x14]
push 0x8000
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
call fcn.004c2f64
mov dword [ebx + 0x38], eax
push 0x44
mov byte [ebp - 4], 1
call fcn.004a7e6f
mov edi, eax
mov dword [ebp + 8], edi
push 0x38
mov byte [ebp - 4], 2
lea esi, [edi + 4]
push 0
push esi
mov dword [edi], 0x10001
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
call fcn.004c0240
push str.1.2.3
mov edx, 0xf
mov ecx, esi
call fcn.00507f30
add esp, 0x18
test eax, eax
sete cl
test eax, eax
mov byte [edi + 3], cl
setne al
mov byte [edi + 2], al
mov byte [edi], al
mov eax, ebx
mov dword [ebx + 0x3c], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call edx
jmp 0x504352
Function at 0x508f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
mov esi, dword [edi + 0x2c]
mov edx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
mov ebx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub ebx, dword [edi + 0x6c]
add eax, esi
sub ebx, edx
cmp dword [edi + 0x6c], eax
jb 0x50901a
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.004bf740
mov eax, dword [edi + 0x4c]
add esp, 0xc
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x44]
mov edi, dword [ebp - 4]
lea edx, [eax + edi*2]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub edi, 1
jne 0x508fc4
mov edi, dword [ebp - 8]
mov eax, dword [edi + 0x40]
mov edi, esi
lea edx, [eax + esi*2]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub edi, 1
jne 0x508ff2
mov edi, dword [ebp - 8]
add ebx, esi
mov ecx, dword [edi]
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 4]
test eax, eax
je 0x5090e2
mov ecx, dword [edi + 0x6c]
mov edx, dword [edi + 0x74]
add ecx, edx
add ecx, dword [edi + 0x38]
cmp eax, ebx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
cmovbe ebx, eax
test ebx, ebx
jne 0x509048
xor ebx, ebx
jmp 0x5090a1
sub eax, ebx
mov dword [ecx + 4], eax
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x509065
mov edx, dword [ecx]
mov ecx, dword [ecx + 0x30]
push ebx
call fcn.0050a800
jmp 0x50907f
cmp eax, 2
jne 0x509088
mov edx, dword [ecx]
mov eax, dword [ecx + 0x30]
test edx, edx
jne 0x509077
xor eax, eax
jmp 0x509085
push ebx
mov ecx, eax
call fcn.0050a520
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [ecx + 0x30], eax
push ebx
push dword [ecx]
push dword [ebp - 0xc]
call fcn.004bf740
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [eax], ebx
add dword [eax + 8], ebx
mov edx, dword [edi + 0x74]
add edx, ebx
mov dword [ebp - 0xc], edx
mov dword [edi + 0x74], edx
cmp edx, 3
jb 0x5090ce
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
mov edx, dword [ebp - 0xc]
cmp edx, 0x106
jae 0x5090e2
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x508f84
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x509ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
test ecx, ecx
je 0x50a024
mov esi, dword [ecx + 0x1c]
test esi, esi
je 0x50a024
cmp dword [ecx + 0x20], 0
je 0x50a024
cmp dword [ecx + 0x24], 0
je 0x50a024
mov dword [ecx + 0x14], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x2c], 2
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
test edx, edx
jns 0x509efd
neg edx
mov dword [esi + 0x18], edx
test edx, edx
mov eax, 0x71
push edi
mov edi, 0x2a
cmovne eax, edi
mov dword [esi + 4], eax
xor eax, eax
cmp edx, 2
setne al
mov dword [ecx + 0x30], eax
lea eax, [esi + 0x94]
mov dword [esi + 0xb18], eax
mov ecx, esi
lea eax, [esi + 0x988]
mov dword [esi + 0x28], 0
mov dword [esi + 0xb24], eax
lea eax, [esi + 0xa7c]
mov dword [esi + 0xb30], eax
xor eax, eax
mov dword [esi + 0xb20], 0x7f2c58
mov dword [esi + 0xb2c], 0x7f2c30
mov dword [esi + 0xb38], 0x7f2c44
mov word [esi + 0x16b8], ax
mov dword [esi + 0x16bc], eax
mov dword [esi + 0x16b4], 8
call fcn.00506110
mov eax, dword [esi + 0x2c]
xor edx, edx
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.004c0240
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x7a144a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x7a1448]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x7a144c]
mov dword [esi + 0x90], eax
movzx eax, word [ecx*4 + 0x7a144e]
mov dword [esi + 0x7c], eax
xor eax, eax
pop edi
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x50a7e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x50a7eb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0050a520
Function at 0x510040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60cd6c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x7f206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov edi, dword [ebp + 8]
push 0x14
mov dword [ebp - 0x20], 0x7ad158
call fcn.004a7e6f
mov ebx, eax
add esp, 4
mov dword [ebp - 0x28], ebx
lea esi, [ebx + 4]
mov dword [ebp - 4], 0
mov dword [esi], 0
mov byte [ebp - 4], 1
lea ecx, [ebx + 8]
push edi
mov dword [ebx], vtable.juce::var::VariantType::RefCountedArray.0
call fcn.00419070
mov eax, 1
lock xadd dword [esi], eax
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov esi, dword [edi]
mov dword [edi], eax
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], esi
mov dword [edi + 8], ebx
mov dword [edi + 0xc], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0x30]
push eax
call ecx
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret 4
Function at 0x5124e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60cf89
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebp - 4], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebx + 0x34]
mov byte [ebx + 0x30], 0
push 2
push eax
call fcn.004a575f
lea eax, [ebx + 0x64]
push eax
call fcn.004a5a2d
mov byte [ebx + 0x8c], 0
push 0x140
mov byte [ebp - 4], 3
call fcn.004a7e6f
mov edi, eax
mov dword [ebp - 0x14], edi
push str.Pool
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0041d340
add esp, 0x10
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.0052a120
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x5125ba
or eax, 0xffffffff
lock xadd dword [ecx], eax
test eax, eax
jne 0x5125ba
push ecx
call fcn.004a8172
add esp, 4
mov dword [edi], vtable.juce::ThreadPool::ThreadPoolThread.0
mov dword [edi + 0x138], 0
mov dword [edi + 0x13c], ebx
mov byte [ebp - 4], 3
mov ecx, dword [ebx + 0x14]
lea esi, [ecx + 1]
cmp esi, dword [ebx + 0x10]
jle 0x512639
mov eax, esi
add esi, 8
cdq
sub eax, edx
sar eax, 1
add esi, eax
and esi, 0xfffffff8
cmp dword [ebx + 0x10], esi
je 0x512633
test esi, esi
jle 0x512621
mov ecx, dword [ebx + 0xc]
lea eax, [esi*4]
push eax
test ecx, ecx
jne 0x512613
call fcn.004c2f64
add esp, 4
mov dword [ebx + 0xc], eax
jmp 0x512633
push ecx
call fcn.004c4395
add esp, 8
mov dword [ebx + 0xc], eax
jmp 0x512633
push dword [ebx + 0xc]
call fcn.004c2bdc
add esp, 4
mov dword [ebx + 0xc], 0
mov ecx, dword [ebx + 0x14]
mov dword [ebx + 0x10], esi
lea eax, [ecx + 1]
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 0xc]
mov dword [eax + ecx*4], edi
mov edi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x14]
lea eax, [edi + eax*4]
mov dword [ebp - 0x14], eax
cmp edi, eax
je 0x5126a4
mov ebx, dword [edi]
lea esi, [ebx + 0x20]
push esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 5
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x51267a
push eax
mov ecx, ebx
mov byte [ebx + 0x1c], al
call fcn.00512b90
push esi
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add edi, 4
cmp edi, dword [ebp - 0x14]
jne 0x512655
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x512b90
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor dl, dl
lea eax, [edi + 0x101]
xchg byte [eax], dl
lea eax, [ebp - 4]
push eax
push 4
push edi
push 0x4ffab0
push dword [edi + 0xf8]
push 0
call fcn.004c3c1b
add esp, 0x18
lea esi, [edi + 0xc]
xchg dword [esi], eax
mov eax, dword [esi]
test eax, eax
je 0x512c22
mov eax, dword [ebp - 4]
lea ebx, [edi + 0x10]
xchg dword [ebx], eax
mov edx, dword [esi]
push dword [ebp + 8]
mov cl, byte [edi + 0x1c]
call fcn.004ffa30
add esp, 4
test al, al
mov eax, dword [esi]
je 0x512c02
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [edi + 0x38]
call fcn.004fef70
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
test eax, eax
je 0x512c11
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
xchg dword [ebx], eax
xor eax, eax
xchg dword [esi], eax
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5133a0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 8], ecx
cmp byte [esi], 0
je 0x5134c2
xor ebx, ebx
nop word [eax + eax]
mov cl, byte [esi]
inc esi
movzx eax, cl
test cl, cl
jns 0x51340b
mov edx, 0x7f
xor edi, edi
lea ecx, [edx - 0x3f]
test cl, al
je 0x5133e6
cmp ecx, 8
jbe 0x5133e6
shr ecx, 1
inc edi
shr edx, 1
test eax, ecx
jne 0x5133d8
and eax, edx
sub edi, 1
js 0x51340b
nop dword [eax]
movzx edx, byte [esi]
mov ecx, edx
and cl, 0xc0
cmp cl, 0x80
jne 0x51340b
and edx, 0x3f
shl eax, 6
inc esi
or eax, edx
sub edi, 1
jns 0x5133f0
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x513417
mov eax, ecx
jmp 0x513458
lea ecx, [eax - 0x61]
cmp ecx, 0x19
ja 0x513424
sub eax, 0x47
jmp 0x513458
lea ecx, [eax - 0x30]
cmp ecx, 9
ja 0x513431
add eax, 4
jmp 0x513458
cmp eax, 0x2b
jne 0x51343d
mov eax, 0x3e
jmp 0x513458
cmp eax, 0x2f
jne 0x513449
mov eax, 0x3f
jmp 0x513458
cmp eax, 0x3d
jne 0x5134cb
mov eax, 0x40
cmp ebx, 1
jle 0x5134cb
mov byte [ebp + ebx - 4], al
inc ebx
cmp ebx, 4
jl 0x5133c0
mov eax, dword [ebp - 4]
mov cl, ah
mov edi, dword [ebp - 8]
shr cl, 4
shl al, 2
or cl, al
mov edx, dword [edi]
movzx eax, cl
mov ecx, edi
push eax
call dword [edx + 0x14]
mov bl, byte [ebp - 2]
cmp bl, 0x40
jae 0x5134b9
movzx eax, byte [ebp - 3]
mov cl, bl
mov edx, dword [edi]
shr cl, 2
shl al, 4
or cl, al
movzx eax, cl
mov ecx, edi
push eax
call dword [edx + 0x14]
mov al, byte [ebp - 1]
cmp al, 0x40
jae 0x5134b9
mov edx, dword [edi]
mov ecx, edi
shl bl, 6
or bl, al
movzx eax, bl
push eax
call dword [edx + 0x14]
cmp byte [esi], 0
jne 0x5133b8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51da40
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0
mov edi, edx
movlpd qword [ebp - 0x20], xmm0
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xc]
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x2c], 8
mov dword [ebp - 8], 0
call fcn.004fbfe0
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [edi]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
sete bl
add esi, 0xfffffff8
cmp esi, 0x7a1354
je 0x51dabe
or eax, 0xffffffff
lock xadd dword [esi], eax
test eax, eax
jne 0x51dabe
push esi
call fcn.004a8172
add esp, 4
xor eax, eax
test bl, bl
pop edi
cmovne eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51dad0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x7f206c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x51dbdb
mov ebx, dword [esi]
mov ecx, dword [ebp + 0xc]
mov eax, 0x10624dd3
imul ecx
mov dword [ebp - 0x10c], ebx
sar edx, 6
mov eax, edx
mov dword [ebp - 0x110], 1
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x228], eax
imul eax, eax, 0x3e8
mov dword [ebp - 0x218], 1
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x228]
push eax
push 0
push 0
lea eax, [ebp - 0x110]
push eax
lea eax, [ebx + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x51dbd4
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x51dbd4
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], 4
push ecx
lea ecx, [ebp - 0x220]
push ecx
push 0x1007
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x51dbd4
cmp dword [ebp - 0x220], 0
jne 0x51dbd4
lea eax, [ebp - 0x110]
push eax
push ebx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
neg eax
push edi
sbb esi, esi
neg esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret