joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54ca90
Capabilities:
Check for peb beingdebugged flag
Send data
Send data on socket

Disassembly:
push 0xffffffffffffffff
push 0x62aa38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x6f175c]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x184]
mov dword [esp + 0x1c], 0
mov ecx, dword [eax + 0x14c]
mov edx, dword [eax + 0x148]
push ecx
push edx
lea eax, [esp + 0x18]
push str.___s__s
push eax
call fcn.005fa6fb
mov edx, dword [esp + 0x20]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x10
mov ebx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [edx], 1
mov ebp, ecx
mov ecx, dword [esi + 0x184]
push str.sending_socks5_auth
mov edi, dword [ecx + 0x148]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
or ecx, 0xffffffff
mov byte [ebx + 1], dl
mov eax, dword [esi + 0x184]
and edx, 0xff
mov edi, dword [eax + 0x14c]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push eax
mov byte [edx + ebx + 2], cl
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
push ebp
push ecx
push edx
call sub.WS2_32.dll_send
push eax
mov ecx, esi
call fcn.0054b1b0
push str.socks5:_sending_auth_n
mov ecx, esi
mov edi, eax
call fcn.0054b0f0
cmp edi, 0x2733
mov dword [esi + 0x30], 0
jne 0x54cb72
xor edi, edi
jmp 0x54cb76
test edi, edi
jne 0x54cb80
mov dword [esi + 0x8c], 0x1f
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.006018cc
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x54cbb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x62aa58
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
mov ecx, 2
push 0
mov eax, dword [esi + 0x30]
sub ecx, eax
lea edx, [eax + esi + 0x28]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
call sub.WS2_32.dll_recv
mov edi, eax
push str.recv_socks5_init_reply
push edi
mov ecx, esi
call fcn.0054b1b0
test eax, eax
jne 0x54ccc8
mov ecx, dword [esi + 0x30]
add ecx, edi
mov eax, ecx
mov dword [esi + 0x30], ecx
cmp eax, 2
jge 0x54cc23
mov eax, 0x2733
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 4
mov al, byte [esi + 0x29]
test al, al
jne 0x54cc56
mov al, byte [esi + 0x28]
cmp al, 5
je 0x54cc35
cmp al, 1
jne 0x54cc56
push str.socks5:_auth_reply_OK_n
mov ecx, esi
call fcn.0054b0f0
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 4
push 0x6f6abc
lea ecx, [esp + 0x1c]
call fcn.00601641
mov ecx, dword [esp + 0x18]
push 1
push ecx
mov ecx, esi
mov dword [esp + 0x18], 0
call fcn.0054b020
mov edx, dword [esp + 0x18]
mov ecx, dword [esi + 0x9c]
push edx
call fcn.00553840
movsx eax, byte [esi + 0x29]
movsx ecx, byte [esi + 0x28]
push eax
push ecx
lea edx, [esp + 0x20]
push str.Sock_ver___d__reply___d_n
push edx
call fcn.005fa6fb
mov eax, dword [esp + 0x28]
add esp, 0x10
mov ecx, esi
push eax
call fcn.0054b0f0
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.006018cc
mov eax, 0x757f
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x54cd30
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62aa70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x498
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [esi + 0xf8]
mov ecx, 1
cmp eax, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x29c], edi
mov dword [ebp - 0x2a0], ecx
mov dword [ebp - 0x4a4], ebx
je 0x54cda2
mov edx, dword [eax]
mov dword [ebp - 0x2a0], 2
mov dword [ebp - 0x298], edx
mov edx, dword [eax]
mov dword [ebp - 0x4a0], edx
mov dword [ebp - 0x4a4], ecx
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x4a4]
sbb eax, eax
push edx
and eax, ecx
lea edx, [ebp - 0x2a0]
push eax
push ebx
lea eax, [edi + 1]
push edx
push eax
mov dword [ebp - 0x18], ebx
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x54ce23
call sub.WS2_32.dll_WSAGetLastError
mov ebx, eax
push edi
push ebx
lea ecx, [ebp - 0x9c]
push str.Select_failed__err_code___d__socket___d_n
push ecx
call fcn.005e5bb8
add esp, 0x10
lea edx, [ebp - 0x9c]
mov ecx, esi
push edx
call fcn.0054b0f0
mov eax, dword [0x6f7668]
mov ecx, dword [esi + 0x9c]
push eax
call fcn.00553840
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp eax, ebx
jne 0x54cea2
cmp dword [ebp + 0xc], ebx
je 0x54ce4e
mov ecx, dword [0x6f7660]
push ecx
mov ecx, dword [esi + 0x9c]
call fcn.00553840
mov edx, dword [0x6f7660]
push 1
push edx
mov ecx, esi
call fcn.0054b020
mov eax, 0x7532
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0xf8]
cmp eax, ebx
je 0x54cef0
mov edx, dword [eax]
lea ecx, [ebp - 0x4a4]
push ecx
push edx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x54ced8
mov ecx, dword [esi + 0xf8]
lea eax, [ebp - 0x2a0]
push eax
mov edx, dword [ecx]
push edx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x54cef0
mov eax, 0x7540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x54e200
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [ecx + 0x184]
test eax, eax
je 0x54e23a
mov dl, byte [eax + 0x137]
test dl, dl
je 0x54e23a
mov ecx, dword [ecx + 0x3444]
test ecx, ecx
je 0x54e23a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
push eax
push edx
call fcn.00563b00
ret 0x10
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call sub.WS2_32.dll_recv
ret 0x10

Function at 0x54f970
Capabilities:
Get disk size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x62ab78
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x60]
mov ecx, dword [edi + 0x64]
mov edx, eax
or edx, ecx
je 0x54f9b6
mov ebp, dword [edi + 0x68]
mov ebx, dword [edi + 0x6c]
mov esi, dword [edi + 0x50]
mov edx, dword [edi + 0x54]
sub eax, ebp
sbb ecx, ebx
sub eax, esi
sbb ecx, edx
mov ebp, eax
mov dword [esp + 0x38], ecx
jmp 0x54f9c3
mov ebp, 0x2da0
mov dword [esp + 0x38], 0
mov ecx, dword [edi + 0xb0]
push 0
push 0
lea eax, [esp + 0x34]
mov edx, dword [ecx + 0x30]
push 0
push eax
push edx
call fcn.005e5f68
add esp, 0x14
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x54fa06
push str.GetDiskFreeSpaceExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x54fa0a
mov ecx, 1
jmp 0x54fa0c
mov eax, dword [esp + 0x1c]
xor ecx, ecx
or esi, 0xffffffff
or ebx, 0xffffffff
test ecx, ecx
je 0x54fa3a
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x34]
push ecx
push edx
call eax
test eax, eax
je 0x54fa6d
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
jmp 0x54fa6d
lea eax, [esp + 0x24]
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x54fa6d
mov esi, dword [esp + 0x10]
imul esi, dword [esp + 0x14]
imul esi, dword [esp + 0x1c]
xor ebx, ebx
mov edx, dword [esp + 0x38]
push 0
push 0xa
push edx
push ebp
call fcn.005e7060
add eax, ebp
mov ebp, dword [esp + 0x38]
adc edx, ebp
cmp ebx, edx
jg 0x54fb0f
jl 0x54fa92
cmp esi, eax
ja 0x54fb0f
and esi, ebx
cmp esi, 0xffffffff
je 0x54fb0f
mov eax, dword [0x6f175c]
mov dword [esp + 0x10], eax
mov edx, dword [0x6f76a8]
lea ecx, [esp + 0x2c]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x50], 0
call fcn.005fa6fb
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0x50030
push 0x6c5020
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Not_enough_disk_space_to_store_files_chunks__canceling_download._n
mov ecx, edi
call fcn.0054b0f0
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], 0xffffffff
call fcn.006018cc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x550a60
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ecx
push ebp
push esi
push edi
push str.shell32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, dword [esp + 0x14]
mov esi, eax
test esi, esi
je 0x550ab8
push ebx
push str.SHGetFolderPathW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x550aac
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push ebp
push edi
push edi
push 0x1a
push edi
call ebx
test eax, eax
jne 0x550aa6
mov edi, 1
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
pop ebx
jne 0x550b09
lea eax, [esp + 0x14]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x550b09
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push ebp
push eax
push eax
push 0x6c988c
push edx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x550afe
mov edi, 1
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x551c20
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
mov ecx, eax
and ecx, 0xff
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x551c38
jmp dword [ecx*4 + 0x551cc4]
mov al, 0x41
ret 4
mov al, 0x42
ret 4
mov al, 0x43
ret 4
mov al, 0x44
ret 4
mov al, 0x45
ret 4
mov al, 0x46
ret 4
mov al, 0x47
ret 4
mov al, 0x48
ret 4
mov al, 0x49
ret 4
mov al, 0x4a
ret 4
mov al, 0x4b
ret 4
mov al, 0x4c
ret 4
mov al, 0x4d
ret 4
mov al, 0x4e
ret 4
mov al, 0x4f
ret 4
mov al, 0x50
ret 4
mov al, 0x51
ret 4
mov al, 0x52
ret 4
mov al, 0x53
ret 4
mov al, 0x54
ret 4
mov al, 0x55
ret 4
mov al, 0x56
ret 4
mov al, 0x57
ret 4
mov al, 0x58
ret 4
mov al, 0x59
ret 4
mov al, 0x5a
ret 4
Function at 0x552460
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x553400
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
cmp word [edi + 4], 0
lea eax, [edi + 4]
je 0x553496
mov cl, byte [edi + 0x418]
test cl, cl
je 0x553496
mov ecx, dword [edi + 0x41c]
xor esi, esi
cmp ecx, 0xffffffff
jne 0x553465
push esi
push esi
push 4
push esi
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x553496
lea eax, [esp + 0xc]
push 2
push eax
push 0
push esi
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
mov ebx, esi
jne 0x55346b
mov ebx, dword [edi + 0x41c]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x553496
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 8
ret 4

Function at 0x5534a0
Capabilities:
Delete file
Get file size

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x41c], 0xffffffff
jne 0x5534cf
push 0
push 0
push 4
push 0
push 7
lea eax, [esi + 4]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x41c], eax
mov eax, dword [esi + 0x41c]
cmp eax, 0xffffffff
je 0x5535b8
push ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
push eax
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
xor ebx, ebx
cmp edi, 0xffffffff
jne 0x553505
test ebx, ebx
jne 0x553505
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x553528
mov edx, dword [esp + 0x18]
push 1
push 0
push 0
push edx
call fcn.005e7a50
add eax, edi
adc edx, ebx
mov dword [esp + 0x14], edx
js 0x55352d
jg 0x553528
cmp eax, 0x4c4b40
jbe 0x55352d
mov ebp, 1
test ebp, ebp
pop ebp
mov dword [esp + 0xc], 0
pop ebx
je 0x5535a2
mov eax, dword [esi + 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 4
push 0
push 7
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x41c], eax
je 0x5535b8
lea ecx, [esp + 8]
push 0
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 0x41c]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push str.Log_h_b_cleared_n
mov ecx, esi
call fcn.00553400
pop edi
pop esi
add esp, 0xc
ret
mov ecx, dword [esi + 0x41c]
lea eax, [esp + 8]
push 2
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop esi
add esp, 0xc
ret
Function at 0x5534a3
Capabilities:
Delete file
Get file size

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x41c], 0xffffffff
jne 0x5534cf
push 0
push 0
push 4
push 0
push 7
lea eax, [esi + 4]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x41c], eax
mov eax, dword [esi + 0x41c]
cmp eax, 0xffffffff
je 0x5535b8
push ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
push eax
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
xor ebx, ebx
cmp edi, 0xffffffff
jne 0x553505
test ebx, ebx
jne 0x553505
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x553528
mov edx, dword [esp + 0x18]
push 1
push 0
push 0
push edx
call fcn.005e7a50
add eax, edi
adc edx, ebx
mov dword [esp + 0x14], edx
js 0x55352d
jg 0x553528
cmp eax, 0x4c4b40
jbe 0x55352d
mov ebp, 1
test ebp, ebp
pop ebp
mov dword [esp + 0xc], 0
pop ebx
je 0x5535a2
mov eax, dword [esi + 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 4
push 0
push 7
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x41c], eax
je 0x5535b8
lea ecx, [esp + 8]
push 0
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 0x41c]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push str.Log_h_b_cleared_n
mov ecx, esi
call fcn.00553400
pop edi
pop esi
add esp, 0xc
ret
mov ecx, dword [esi + 0x41c]
lea eax, [esp + 8]
push 2
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop esi
add esp, 0xc
ret
Function at 0x5535c0
Capabilities:
Delete file
Get file size

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x41c], 0xffffffff
je 0x5536d4
lea eax, [esp + 0x14]
push eax
call fcn.005e6b47
mov eax, dword [esi + 0x420]
add esp, 4
test eax, eax
jne 0x5535fb
mov ecx, dword [esp + 0x14]
pop edi
mov dword [esi + 0x420], ecx
pop esi
add esp, 0x18
ret
lea edx, [eax + 5]
mov eax, dword [esp + 0x14]
cmp edx, eax
jge 0x5536d4
mov ecx, dword [esi + 0x41c]
mov dword [esi + 0x420], eax
push ebx
lea eax, [esp + 0xc]
push ebp
push eax
push ecx
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
xor ebx, ebx
cmp edi, 0xffffffff
jne 0x55363d
test ebx, ebx
jne 0x55363d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x553660
mov edx, dword [esp + 0x10]
push 1
push 0
push 0
push edx
call fcn.005e7a50
add eax, edi
adc edx, ebx
mov dword [esp + 0x18], edx
js 0x553665
jg 0x553660
cmp eax, 0x4c4b40
jbe 0x553665
mov ebp, 1
test ebp, ebp
pop ebp
mov dword [esp + 0x10], 0
pop ebx
je 0x5536d4
mov eax, dword [esi + 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 4
push 0
push 7
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x41c], eax
je 0x5536d4
lea ecx, [esp + 0xc]
push 0
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 0x41c]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push str.Log_h_b_cleared_n
mov ecx, esi
call fcn.00553400
pop edi
pop esi
add esp, 0x18
ret

Function at 0x553710
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x50
push esi
mov esi, ecx
cmp dword [esi + 0x41c], 0xffffffff
je 0x553778
lea eax, [esp + 8]
push edi
push eax
call fcn.005e6b47
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
add esp, 4
and ecx, 0xffff
lea eax, [esp + 0x18]
push ecx
push edx
push str.Time:__ld._ld_n
push eax
call fcn.005e5bb8
add esp, 0x10
lea ecx, [esp + 8]
lea edi, [esp + 0x18]
xor eax, eax
push 0
push ecx
or ecx, 0xffffffff
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
mov eax, dword [esi + 0x41c]
not ecx
dec ecx
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
add esp, 0x50
ret

Function at 0x553960
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x41c], 0xffffffff
jne 0x5539af
push esi
push esi
push 4
push esi
push 3
lea eax, [edi + 4]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5539d8
lea ecx, [esp + 8]
push 2
push ecx
push 0
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
je 0x5539af
mov edi, esi
jmp 0x5539b5
mov edi, dword [edi + 0x41c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xc]
push 0
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x5539d8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 8
ret 8
Function at 0x553aa0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.00553a30
mov eax, dword [esp + 0x24]
push 0
push 0
push 4
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [edi + 0x10], eax
jne 0x553aed
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x553c09
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret 0xc
lea esi, [edi + 8]
mov ecx, edi
push esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00554070
mov ebx, dword [esp + 0x2c]
test eax, eax
je 0x553b21
mov eax, dword [ebx]
mov ecx, dword [esi + 4]
cdq
cmp edx, ecx
jl 0x553b21
jg 0x553b1d
cmp eax, dword [esi]
jbe 0x553b21
mov ecx, dword [esi]
mov dword [ebx], ecx
mov eax, dword [ebx]
mov ecx, dword [esi]
cdq
sub ecx, eax
mov eax, dword [esi + 4]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
sbb eax, edx
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x10]
push edx
push ecx
push eax
mov dword [esp + 0x28], ecx
call ebp
cmp eax, 0xffffffff
jne 0x553b6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x553b6d
mov ecx, edi
call fcn.00553a30
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
mov eax, dword [ebx]
test eax, eax
jne 0x553b7f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push 0
push ecx
push eax
mov eax, dword [edi + 0x10]
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x553be7
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx]
cmp ecx, eax
jne 0x553be7
mov eax, dword [edi + 0x10]
lea edx, [esp + 0x14]
push 2
push edx
push 0
push eax
mov dword [esp + 0x24], 0
call ebp
cmp eax, 0xffffffff
jne 0x553b73
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x553b73
mov ecx, edi
call fcn.00553a30
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov esi, eax
call fcn.00553a30
test esi, esi
je 0x553c06
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x553d30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov edi, ecx
mov dword [esp + 0x10], ebp
mov eax, dword [esi]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x18]
sub eax, 4
push ebp
push edx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [edi + 0x10]
sbb ecx, ebp
push eax
mov dword [esp + 0x28], ecx
call ebx
cmp eax, 0xffffffff
jne 0x553d7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test ebp, ebp
jne 0x553e88
mov eax, dword [edi + 0x10]
lea ecx, [esp + 0x34]
push ebp
push ecx
lea edx, [esp + 0x24]
push 4
push edx
push eax
mov dword [esp + 0x48], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x553f19
cmp dword [esp + 0x34], 4
jne 0x553f19
lea ecx, [esp + 0x1c]
push ecx
call fcn.0059e4d0
add esp, 4
cmp eax, ebp
jbe 0x553f19
mov ecx, 0xfffffffc
xor edx, edx
sub ecx, eax
mov eax, 0xffffffff
sbb eax, edx
mov edx, dword [esi]
add edx, ecx
mov dword [esi], edx
mov ecx, dword [esi + 4]
adc ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, ebp
jl 0x553f19
jg 0x553df5
cmp ecx, ebp
jbe 0x553f19
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x10]
push ebp
push edx
push ecx
push eax
mov dword [esp + 0x24], ecx
call ebx
cmp eax, 0xffffffff
jne 0x553e1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test ebp, ebp
jne 0x553e88
mov eax, dword [edi + 0x10]
lea ecx, [esp + 0x34]
push ebp
push ecx
lea edx, [esp + 0x24]
push 0xc
push edx
push eax
mov dword [esp + 0x48], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x553e45
cmp dword [esp + 0x34], 0xc
jne 0x553f19
mov al, byte [esp + 0x2c]
test al, al
mov al, byte [esp + 0x1c]
je 0x553e5a
cmp al, 8
je 0x553e72
jmp 0x553d49
cmp al, 9
jne 0x553d49
mov cl, byte [esp + 0x27]
and cl, 0xf0
cmp cl, 0x10
jne 0x553d49
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jge 0x553e9b
jmp 0x553d49
mov ecx, edi
call fcn.00553a30
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov ax, word [esp + 0x20]
mov cl, byte [esp + 0x22]
xor edx, edx
mov byte [esp + 0x2c], 0
mov word [esp + 0x2d], dx
mov word [esp + 0x2d], ax
mov byte [esp + 0x2f], dl
mov byte [esp + 0x2f], cl
mov edx, dword [esp + 0x2c]
push edx
call sub.WS2_32.dll_ntohl
movsx ecx, byte [esp + 0x23]
mov edx, dword [esp + 0x38]
push 2
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x30], ebp
mov dword [edx], eax
mov ecx, dword [edi + 0x10]
lea eax, [esp + 0x30]
push eax
push ebp
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x553f0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebp
je 0x553f0d
mov ecx, edi
call fcn.00553a30
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret 0x10