joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50b500
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e938
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5fae30]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 4], ebx
call fcn.00509560
cmp eax, ebx
je 0x50b63c
mov ecx, edi
call fcn.00508f10
mov esi, eax
call fcn.00505060
push 4
mov dword [ebp - 0x6c], eax
lea eax, [ebp + 8]
push eax
push 0x1002
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, dword [ebp - 0x6c]
jne 0x50b65c
push 0x21
mov esi, 0xf
push str.Failed_to_set_receive_buffer_size
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x4c], bl
call fcn.00402a36
push 0x16
push str.SetSocketReceiveBuffer
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
call fcn.00402a36
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 4]
mov eax, dword [edx + edi + 4]
mov eax, dword [eax + 0x14]
lea ecx, [edx + edi + 4]
lea edx, [ebp - 0x4c]
push edx
lea edx, [ebp - 0x30]
push edx
mov byte [ebp - 4], 2
call eax
cmp dword [ebp - 0x1c], 0x10
jb 0x50b5dd
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0053ed60
add esp, 4
cmp dword [ebp - 0x38], 0x10
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
mov byte [ebp - 4], bl
jb 0x50b5fb
mov edx, dword [ebp - 0x4c]
push edx
call fcn.0053ed60
add esp, 4
push 0x16
push str.SetSocketReceiveBuffer
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], ebx
mov byte [ebp - 0x68], bl
call fcn.00402a36
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 4]
lea eax, [ebp - 0x68]
push eax
lea ecx, [edx + edi + 4]
mov byte [ebp - 4], 3
call fcn.00505df0
cmp dword [ebp - 0x54], 0x10
jb 0x50b63c
mov eax, dword [ebp - 0x68]
push eax
call fcn.0053ed60
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053fd20
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x50b63e
Function at 0x50b670
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e978
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5fae30]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 4], ebx
call fcn.00509560
cmp eax, ebx
je 0x50b7bc
mov cx, word [ebp + 0xc]
mov ax, word [ebp + 8]
mov word [ebp - 0x6a], cx
mov ecx, edi
mov word [ebp - 0x6c], ax
call fcn.00508f10
mov esi, eax
call fcn.00505060
push 4
lea edx, [ebp - 0x6c]
push edx
push 0x80
push 0xffff
push esi
mov dword [ebp - 0x70], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, dword [ebp - 0x70]
jne 0x50b7dc
push 0x13
mov esi, 0xf
push str.Failed_to_set_nagle
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], ebx
mov byte [ebp - 0x68], bl
call fcn.00402a36
push 9
push str.SetLinger
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
call fcn.00402a36
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + edi + 4]
mov edx, dword [edx + 0x14]
lea eax, [ebp - 0x68]
lea ecx, [ecx + edi + 4]
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 2
call edx
cmp dword [ebp - 0x1c], 0x10
jb 0x50b75d
mov eax, dword [ebp - 0x30]
push eax
call fcn.0053ed60
add esp, 4
cmp dword [ebp - 0x54], 0x10
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
mov byte [ebp - 4], bl
jb 0x50b77b
mov ecx, dword [ebp - 0x68]
push ecx
call fcn.0053ed60
add esp, 4
push 9
push str.SetLinger
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x4c], bl
call fcn.00402a36
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ecx + edi + 4]
mov byte [ebp - 4], 3
call fcn.00505df0
cmp dword [ebp - 0x38], 0x10
jb 0x50b7bc
mov edx, dword [ebp - 0x4c]
push edx
call fcn.0053ed60
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053fd20
mov esp, ebp
pop ebp
ret 8
mov eax, 1
jmp 0x50b7be
Function at 0x50b7f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e9b8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5fae30]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x6c], esi
mov dword [ebp - 4], ebx
call fcn.00509560
cmp eax, ebx
je 0x50b935
xor eax, eax
cmp dword [ebp + 8], ebx
mov ecx, esi
sete al
mov dword [ebp + 8], eax
call fcn.00508f10
mov esi, eax
call fcn.00505060
push 4
lea ecx, [ebp + 8]
push ecx
push 1
push 6
push esi
mov edi, eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, edi
jne 0x50b955
push 0x13
mov esi, 0xf
push str.Failed_to_set_nagle
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x4c], bl
call fcn.00402a36
push 8
push str.SetNagle
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
call fcn.00402a36
mov edi, dword [ebp - 0x6c]
mov edx, dword [edi + 4]
mov eax, dword [edx + 4]
mov edx, dword [eax + edi + 4]
mov edx, dword [edx + 0x14]
lea ecx, [eax + edi + 4]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 2
call edx
cmp dword [ebp - 0x1c], 0x10
jb 0x50b8d6
mov eax, dword [ebp - 0x30]
push eax
call fcn.0053ed60
add esp, 4
cmp dword [ebp - 0x38], 0x10
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
mov byte [ebp - 4], bl
jb 0x50b8f4
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.0053ed60
add esp, 4
push 8
push str.SetNagle
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], ebx
mov byte [ebp - 0x68], bl
call fcn.00402a36
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x68]
push edx
lea ecx, [ecx + edi + 4]
mov byte [ebp - 4], 3
call fcn.00505df0
cmp dword [ebp - 0x54], 0x10
jb 0x50b935
mov edx, dword [ebp - 0x68]
push edx
call fcn.0053ed60
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053fd20
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x50b937
Function at 0x50dac0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ee68
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5fae30]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 4], ebx
call fcn.0050d650
cmp eax, ebx
je 0x50db63
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
mov ecx, esi
call edx
push ebx
push ebx
mov ecx, esi
mov edx, eax
call fcn.0050b9c0
push eax
push edx
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, ebx
je 0x50db81
push 0x16
push str.Block___WSAAsyncSelect
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
call fcn.00402a36
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 4]
lea eax, [ebp - 0x30]
push eax
lea ecx, [edx + esi + 4]
mov byte [ebp - 4], 1
call fcn.00505df0
cmp dword [ebp - 0x1c], 0x10
jb 0x50db63
mov eax, dword [ebp - 0x30]
push eax
call fcn.0053ed60
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053fd20
mov esp, ebp
pop ebp
ret
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
mov ecx, esi
call eax
push ebx
push ebx
push eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, ebx
je 0x50dbd6
push 0x16
push str.Block___WSAEventSelect
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
call fcn.00402a36
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [eax + esi + 4]
mov byte [ebp - 4], 2
call fcn.00505df0
cmp dword [ebp - 0x1c], 0x10
jb 0x50db63
mov ecx, dword [ebp - 0x30]
push ecx
jmp 0x50db5b
mov edx, dword [esi]
mov eax, dword [edx + 0x30]
mov ecx, esi
mov dword [ebp - 0x50], ebx
call eax
lea ecx, [ebp - 0x50]
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, ebx
je 0x50dc27
push str.Block___ioctlsocket
lea ecx, [ebp - 0x4c]
call fcn.00403dfa
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ecx + esi + 4]
mov byte [ebp - 4], 3
call fcn.00505df0
lea ecx, [ebp - 0x4c]
call fcn.0040583f
jmp 0x50db63
mov eax, 1
jmp 0x50db65
Function at 0x5172f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x180], 0
je 0x517306
mov al, 1
pop esi
pop ebp
ret 4
mov eax, dword [esi + 0x320]
test eax, eax
je 0x517328
mov edx, dword [esi + 0x344]
test edx, edx
je 0x517322
cmp edx, eax
ja 0x51732e
mov edx, eax
jmp 0x51732e
mov edx, eax
test eax, eax
jne 0x51732e
mov edx, dword [esi + 0x344]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
cmp edx, 0x5dc0
jbe 0x5173e6
sub edx, 0x5dc0
test edx, edx
je 0x517404
cmp edx, 0xfa0
jae 0x51735d
mov edx, 0xfa0
cmp byte [esi + 0x188], 0
je 0x517404
cmp dword [esi + 0x178], 0
je 0x517404
cmp dword [esi + 0x118], 0
jne 0x517404
mov eax, dword [esi + 0x184]
mov edi, dword [esi + 0x17c]
test eax, eax
je 0x517396
mov edi, eax
lea ecx, [edi + 0x194]
call fcn.00516cf0
cmp eax, edx
jb 0x5173f8
mov dword [edi + 0x324], edx
cmp dword [esi + 0x34c], 0
je 0x5173ef
cmp dword [esi + 0x33c], 0
je 0x5173ef
call ebx
sub eax, dword [esi + 0x34c]
cmp eax, 0x3e8
jb 0x5173ef
mov eax, dword [ebp + 8]
mov dword [eax], 1
call ebx
pop edi
mov dword [esi + 0x34c], eax
pop ebx
mov al, 1
pop esi
pop ebp
ret 4
test edx, edx
je 0x517404
jmp 0x517358
pop edi
pop ebx
xor al, al
pop esi
pop ebp
ret 4
call fcn.00516cf0
mov ecx, dword [ebp + 8]
sub edx, eax
mov dword [ecx], edx
call ebx
pop edi
mov dword [esi + 0x34c], eax
pop ebx
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x524d00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0950
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5fae30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x2c]
push 1
push eax
lea ecx, [ebp - 0x20]
call fcn.00530b60
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x14]
push edx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
call fcn.0051b180
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
lea edx, [ebp - 0x10]
push edx
lea ecx, [esi + 0xc]
call fcn.005207d0
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [esi + 0xc]
call fcn.0051b180
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
push edx
push eax
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [esi + 0xc]
call fcn.005207d0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.00530af0
mov edx, dword [esi + 0x64]
push 1
push edx
lea ecx, [ebp - 0x2c]
call fcn.00530b60
mov ebx, dword [esi + 0x48]
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
lea edi, [esi + 0x44]
push ecx
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.0051ef30
cmp dword [eax], ebx
jne 0x524dd9
lea edx, [ebp + 8]
push edx
mov ecx, edi
call fcn.00522b80
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx], eax
mov esi, dword [esi + 0x48]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp + 8]
push ecx
mov ecx, edi
call fcn.0051ef30
cmp dword [eax], esi
jne 0x524e04
lea edx, [ebp + 0xc]
push edx
mov ecx, edi
call fcn.00522b80
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi], eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00530af0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x534180
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a27eb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x5fae30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CThreadPoolManager.0
xor ebx, ebx
push 0x24
mov dword [esi + 0x10], ebx
call fcn.0053f7d7
add esp, 4
cmp eax, ebx
je 0x534222
mov dword [esi + 0xc], eax
mov dword [eax], eax
mov eax, dword [esi + 0xc]
mov dword [eax + 4], eax
mov eax, dword [esi + 0xc]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0xc]
mov al, 1
mov byte [ecx + 0x20], al
mov edx, dword [esi + 0xc]
mov byte [edx + 0x21], al
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov byte [esi + 0x20], bl
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
mov byte [esi + 0x38], bl
call fcn.00530ca0
mov dword [esi + 4], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
call fcn.0053eee0
push 0x5d17c8
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call fcn.0053f857
int3
Function at 0x534280
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2818
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x5fae30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x5343e0
cmp dword [ecx + 0x24], 0
jne 0x5343e0
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
push 0
mov ecx, esi
call edx
mov ecx, esi
call fcn.00530fe0
mov ebx, eax
test ebx, ebx
jne 0x5342dd
mov ebx, 0x2710
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp + 8], eax
mov ecx, esi
call fcn.005310f0
cmp byte [ebp + 0xc], 0
jne 0x534304
test eax, eax
jne 0x534309
call fcn.00531140
test al, al
je 0x534322
jmp 0x534309
cmp eax, 1
je 0x53431c
call edi
sub eax, dword [ebp + 8]
cmp eax, ebx
jae 0x53431c
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x5342e8
cmp byte [ebp + 0xc], 0
jne 0x53436c
mov ecx, esi
call fcn.005310f0
test eax, eax
je 0x534336
call fcn.00531140
test al, al
je 0x534378
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
push 1
mov ecx, esi
call edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push 1
push ecx
lea ecx, [ebp - 0x20]
call fcn.00530b60
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], ebx
call eax
test al, al
je 0x53439d
mov dword [ebp - 0x2c], esi
jmp 0x53439f
mov ecx, esi
call fcn.005310f0
cmp eax, 1
jle 0x534336
push 0
mov ecx, esi
call fcn.00530fd0
mov eax, dword [esi]
mov edx, dword [eax]
push 1
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, esi
call edi
mov ecx, esi
mov edx, eax
xor edi, edi
call fcn.005310b0
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x44]
mov dword [ebp - 0x44], eax
push edx
lea eax, [ebp - 0x14]
push eax
add ecx, 8
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x34], edi
call fcn.00533700
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.00530af0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x534e60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a29ce
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x5fae30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x534f74
push 0xa0
cmp dword [edi + 0x28], ebx
jne 0x534ec8
call fcn.0053f7d7
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x534ef6
mov ecx, dword [edi + 0x2c]
push ecx
push ebx
push ebx
push 3
push ebx
push 0x14
push esi
mov ecx, eax
call fcn.005348c0
jmp 0x534ef8
call fcn.0053f7d7
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 1
cmp eax, ebx
je 0x534ef6
mov edx, dword [edi + 0x2c]
mov ecx, dword [edi + 0x28]
push edx
push ebx
push ecx
push 3
push ebx
push 0x14
push esi
mov ecx, eax
call fcn.005348c0
jmp 0x534ef8
xor eax, eax
mov edx, dword [edi + 4]
push 1
push edx
lea ecx, [ebp - 0x28]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00530b60
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
mov ecx, esi
mov dword [ebp - 4], 2
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call edx
test al, al
je 0x534f2e
mov dword [ebp - 0x18], esi
jmp 0x534f31
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
mov edx, eax
call fcn.005310b0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], edx
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x38], eax
push edx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x34], ecx
push eax
lea ecx, [edi + 8]
mov dword [ebp - 0x2c], ebx
call fcn.00533700
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.00530af0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x538090
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3170
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5fae30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebx + 0x24]
mov dword [ebp - 4], 0
test eax, eax
je 0x5380d7
push eax
call fcn.0053fd9c
add esp, 4
cmp dword [ebx + 0x2c], 0
mov esi, dword [ebp + 8]
je 0x538128
cmp dword [esi + 0x14], 0x10
jb 0x5380ea
mov eax, dword [esi]
jmp 0x5380ec
mov eax, esi
push 0
push 0x80
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x538128
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
cmp ebx, dword [eax + 0x2c]
ja 0x538152
mov ebx, eax
cmp dword [esi + 0x14], 0x10
jb 0x538140
mov eax, dword [esi]
push 0x5c1040
push eax
call fcn.005433a7
mov dword [ebx + 0x24], eax
jmp 0x538171
mov eax, esi
push 0x5c1040
push eax
call fcn.005433a7
mov dword [ebx + 0x24], eax
jmp 0x538171
cmp dword [esi + 0x14], 0x10
jb 0x53815c
mov eax, dword [esi]
jmp 0x53815e
mov eax, esi
push 0x5c103c
push eax
call fcn.005433a7
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x24], eax
mov ebx, ecx
add esp, 8
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebx + 8]
call fcn.004077b1
xor eax, eax
cmp dword [ebx + 0x24], eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5392e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3280
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x5fae30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
push 1
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00530b60
mov eax, dword [edi + 4]
mov esi, dword [eax]
mov byte [ebp - 4], 1
cmp esi, eax
je 0x53939f
lea ebx, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebx + 4]
jb 0x539395
cmp dword [esi + 0xc], 0
je 0x539368
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0x7530
cmp eax, dword [ebx + 4]
jb 0x539368
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x2710
mov dword [ebx + 4], eax
jmp 0x539397
push ebx
lea ecx, [ebp - 0x28]
call fcn.00539250
mov ebx, dword [esi]
cmp esi, dword [edi + 4]
je 0x539391
mov eax, dword [esi + 4]
mov dword [eax], ebx
mov ecx, dword [esi]
mov edx, dword [esi + 4]
push esi
mov dword [ecx + 4], edx
call fcn.0053ed60
add esp, 4
dec dword [edi + 8]
mov esi, ebx
jmp 0x539397
mov esi, dword [esi]
cmp esi, dword [edi + 4]
jne 0x539334
mov ebx, dword [ebp - 0x24]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00530af0
mov edi, dword [ebp - 0x28]
sub ebx, edi
mov eax, 0x2aaaaaab
imul ebx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x5393d9
mov esi, edi
mov ebx, eax
mov eax, dword [esi + 8]
mov ecx, dword [esi]
push 0
push eax
call ecx
add esp, 8
add esi, 0xc
dec ebx
jne 0x5393c6
test edi, edi
je 0x5393e6
push edi
call fcn.0053ed60
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53b710
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3700
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5fae30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x48], ebx
je 0x53b77c
call fcn.0053af10
cmp eax, 1
jne 0x53b790
mov ecx, esi
call fcn.0053af60
cmp eax, ebx
je 0x53b790
mov eax, dword [esi + 0x48]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 2
mov ecx, esi
call fcn.0053af00
mov ecx, dword [esi + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x48], ebx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.0053af10
cmp eax, ebx
je 0x53b7d1
mov ecx, esi
call fcn.0053af10
cmp eax, 1
je 0x53b7d1
mov edx, dword [esi + 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
mov ecx, esi
mov dword [esi + 0x48], ebx
call fcn.0053af00
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
mov ecx, esi
mov edi, eax
mov dword [esi + 0x48], ebx
call fcn.0053af00
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53bbe0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3780
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5fae30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
call fcn.0053af10
cmp eax, 2
jne 0x53bc5c
lea ecx, [eax + 2]
mov eax, dword [esi + 0x68]
test eax, eax
je 0x53bc2d
mov ecx, 0x10004
lea edx, [ebp - 0x14]
push edx
push ecx
push esi
push 0x53bb50
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x48], eax
test eax, eax
je 0x53bc8b
mov eax, dword [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0053aec0
push 0
mov ecx, esi
call fcn.0053af00
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x5c1278]
mov eax, dword [esi + 0x48]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4