joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e5575
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push 0x40
lea eax, [ebp - 0x50]
mov dword [ebp - 4], ecx
push 0
push eax
call fcn.00544d60
mov esi, dword [ebp + 0xc]
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, esi
shrd ecx, eax, 6
mov dword [ebp + 0x10], ecx
mov ecx, dword [ebp - 4]
shr eax, 6
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0x28], 0xffffffff
jne 0x4e55c9
push 0x26
push str..._bnl_tact_sourcegameencodingCoderCrypt.cpp
push str.m_blockIndex___bnl::numeric_limits_size_t_::max__
call fcn.0054db53
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x4e56cb
mov eax, dword [ecx + 0x28]
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push 8
pop edx
mov dword [ebp + 0x14], eax
mov eax, dword [ecx + 0x10]
cmp eax, edx
cmova eax, edx
push eax
push ecx
lea eax, [ebp - 0xc]
push eax
call fcn.005447e0
mov ebx, dword [ebp + 0x14]
add esp, 0xc
xor edx, edx
xor ecx, ecx
mov eax, ebx
shr eax, cl
add ecx, 8
xor byte [ebp + edx - 0xc], al
inc edx
cmp ecx, 0x20
jb 0x4e5602
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x24]
shl eax, 3
push eax
lea eax, [ecx + 0x14]
push eax
lea ecx, [ebp - 0x50]
call fcn.004e3d99
mov eax, dword [ebp - 0xc]
and esi, 0x3f
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp + 0x14], esi
je 0x4e56a9
push esi
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.00544d60
lea eax, [esi + edi]
add esp, 0xc
mov dword [ebp + 8], eax
cmp eax, 0x40
lea eax, [ebp - 0x90]
jbe 0x4e56d4
push 0x40
pop edi
sub edi, esi
add esi, eax
push edi
push ebx
push esi
call fcn.005447e0
add esp, 0xc
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x50]
push 0x40
push eax
call fcn.004e3e01
push edi
push esi
push ebx
call fcn.005447e0
sub ebx, dword [ebp + 0x14]
add esp, 0xc
mov edi, dword [ebp + 8]
add ebx, 0x40
add edi, 0xffffffc0
test edi, edi
jne 0x4e56c1
push 0x4d
push str..._bnl_tact_sourcegameencodingCoderCrypt.cpp
push str.size___0
call fcn.0054db53
add esp, 0xc
push edi
push ebx
lea ecx, [ebp - 0x50]
call fcn.004e3e01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push edi
add esi, eax
push ebx
push esi
call fcn.005447e0
push 0x40
pop eax
sub eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x90]
sub eax, edi
push eax
mov eax, dword [ebp + 8]
add eax, ecx
push 0
push eax
call fcn.00544d60
add esp, 0x18
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x50]
push 0x40
push eax
call fcn.004e3e01
push edi
push esi
push ebx
call fcn.005447e0
add esp, 0xc
jmp 0x4e56cb
Function at 0x4f1fb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x614346
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6e7070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0052bdf0
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00517b0c
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov dword [edi], 0x6ae1bc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4f2100
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x6e7070]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0
mov dword [esp + 0x10], eax
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x114]
mov edi, edx
mov dword [esp + 0x114], 0
push ecx
cdq
push edx
push eax
push edi
mov dword [esp + 0x128], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4f2166
mov edx, str.Failed_to_seek_to_NT_header_section
jmp 0x4f2276
push 0xf8
lea eax, [esp + 0x14]
mov dword [esp + 0x110], 0
push 0
push eax
call fcn.00544d60
add esp, 0xc
lea eax, [esp + 0x10c]
push 0
push eax
push 0xf8
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f2271
cmp dword [esp + 0x10c], 0xf8
sete al
test al, al
je 0x4f2271
cmp dword [esp + 0x10], 0x4550
je 0x4f2209
mov edx, str.Header_signature_doesnt_match_expected_value__expected:_0x4550__got:
mov ecx, esi
call fcn.0040e54e
mov edx, eax
test edx, edx
jne 0x4f21de
xor ecx, ecx
jmp 0x4f21e5
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
mov eax, dword [ecx + 0x14]
and eax, 0xfffff9ff
or eax, 0x800
mov dword [ecx + 0x14], eax
mov ecx, edx
push dword [esp + 0x10]
call fcn.004f26c0
mov edx, 0x693b9c
mov ecx, eax
jmp 0x4f2278
mov eax, dword [esp + 0xa8]
test eax, eax
je 0x4f226a
cmp dword [esp + 0xac], 0
je 0x4f226a
push 0
lea ecx, [esp + 0x114]
push ecx
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4f223d
mov edx, str.Failed_to_seek_to_certificate_data_directory_in_file
jmp 0x4f2276
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xa8]
mov dword [ebx], eax
mov eax, dword [esp + 0xac]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0052c3c6
mov esp, ebp
pop ebp
ret
mov edx, str.File_does_not_contain_any_certificates
jmp 0x4f2276
mov edx, str.Failed_to_read_NT_header_from_file
mov ecx, esi
call fcn.0040e54e
push eax
call fcn.00438a52
mov ecx, dword [esp + 0x120]
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052c3c6
mov esp, ebp
pop ebp
ret
Function at 0x4f22a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x6e7070]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov eax, edx
push 0
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x1c]
push ecx
push 8
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], eax
push ecx
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f2427
mov edx, dword [esp + 0x18]
cmp edx, 8
sete al
test al, al
je 0x4f2427
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4f2369
push eax
mov eax, dword [edi]
push ecx
push edx
push ecx
sub eax, edx
mov edx, str.Certificate_data_is_present__but_invalid._Executable_contents_may_have_been_modified_after_certificates_were_embedded.
push eax
push ecx
mov ecx, ebx
call fcn.0040e54e
mov edx, 0x6a0ee0
mov ecx, eax
call fcn.0040e54e
add esp, 4
mov ecx, eax
call fcn.004f26c0
mov edx, str.__expected_header_size
mov ecx, eax
call fcn.0040e54e
add esp, 4
mov ecx, eax
call fcn.004f26c0
mov edx, str.__parsed_header_size
mov ecx, eax
call fcn.0040e54e
add esp, 4
mov ecx, eax
call fcn.004f26c0
jmp 0x4f2433
mov esi, dword [edi]
lea ebx, [eax - 8]
mov ax, word [esp + 0x22]
add esi, edx
add esi, dword [ebp + 0xc]
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], esi
mov word [esp + 0x30], ax
call fcn.0052c2c8
add esp, 4
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x18]
push 0
push ecx
push ebx
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f23dc
cmp ebx, dword [esp + 0x18]
sete al
test al, al
je 0x4f23dc
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x24]
push eax
call fcn.004f2650
mov eax, dword [esp + 0x1c]
add dword [edi], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0052c3c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x14]
mov edx, str.Failed_to_read_certificate_data_from_file_at_offset
call fcn.0040e54e
mov edx, eax
test edx, edx
jne 0x4f23f4
xor ecx, ecx
jmp 0x4f23fb
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
mov eax, dword [ecx + 0x14]
and eax, 0xfffff9ff
or eax, 0x800
mov dword [ecx + 0x14], eax
mov ecx, edx
push esi
call fcn.004f26c0
push eax
call fcn.00438a52
add esp, 4
push dword [esp + 0x30]
call fcn.0052c08b
jmp 0x4f2439
mov edx, str.Failed_to_read_certificate_header_from_file
mov ecx, ebx
call fcn.0040e54e
push eax
call fcn.00438a52
mov ecx, dword [esp + 0x38]
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052c3c6
mov esp, ebp
pop ebp
ret
Function at 0x4f24a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6143a8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x6e7070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push 0
push 0x80
push 3
push 0
push 1
push bind
push ebx
movq qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x18], edi
setne al
mov byte [ebp - 0x1c], al
mov dword [ebp - 4], 0
test al, al
jne 0x4f253f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 0xc]
mov edx, str.Failed_to_open_file_for_read._file
push eax
call fcn.0040e54e
mov edx, ebx
mov ecx, eax
call fcn.0040e54e
mov edx, str.__error
mov ecx, eax
call fcn.0040e54e
mov ecx, eax
call fcn.004f26c0
jmp 0x4f25f9
push 0x40
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.00544d60
add esp, 0xc
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push 0x40
lea eax, [ebp - 0x5c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f25ec
cmp dword [ebp - 0x14], 0x40
sete al
test al, al
je 0x4f25ec
mov eax, 0x5a4d
cmp word [ebp - 0x5c], ax
sete al
test al, al
je 0x4f25ec
mov ecx, dword [esi + 0xc]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0
push eax
push dword [ebp - 0x20]
mov edx, edi
mov dword [ebp - 0x14], 0
call fcn.004f2100
add esp, 0xc
test al, al
je 0x4f2602
mov ebx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x64], eax
nop word [eax + eax]
cmp eax, ebx
jae 0x4f25e2
mov ecx, dword [esi + 0xc]
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x60]
mov edx, edi
push esi
call fcn.004f22a0
add esp, 0xc
test al, al
je 0x4f25e2
mov eax, dword [ebp - 0x64]
jmp 0x4f25c0
mov eax, dword [esi]
cmp eax, dword [esi + 4]
setne bl
jmp 0x4f2604
mov ecx, dword [esi + 0xc]
mov edx, str.Failed_to_read_DOS_header_in_file
call fcn.0040e54e
push eax
call fcn.00438a52
add esp, 4
xor bl, bl
cmp byte [ebp - 0x1c], 0
je 0x4f2611
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052c3c6
mov esp, ebp
pop ebp
ret 4

Function at 0x4f6f80
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x612d1e
call fcn.00609528
sub esp, 0xc
and dword [ebp - 0x14], 0
push esi
push edi
push dword [ebp + 0x10]
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [edx]
lea esi, [edi + 8]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov ecx, esi
mov dword [edi + 4], eax
mov dword [ebp - 0x10], esi
call fcn.004058cd
push dword [ebp + 0xc]
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [ebp + 0x10], ecx
call fcn.004058cd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esi + 0x30], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
Function at 0x4f704d
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x612d1e
call fcn.00609528
sub esp, 0xc
and dword [ebp - 0x14], 0
push esi
push edi
push dword [ebp + 0x14]
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [edx]
lea esi, [edi + 8]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov ecx, esi
mov dword [edi + 4], eax
mov dword [ebp - 0x10], esi
call fcn.004058cd
push dword [ebp + 0x10]
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [ebp + 0x14], ecx
call fcn.004058cd
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0x34], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x502bb7
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x615dc7
call fcn.00609528
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], ebx
mov dword [ebp - 4], ebx
lea esi, [edi + 0x10]
mov dword [edi], vtable.Agent::InstallProgressInfo.0
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [ebp - 0x14], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.00414a0f
mov dword [esi], eax
xorps xmm0, xmm0
mov dword [edi + 0x28], ebx
mov eax, edi
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
movups xmmword [edi + 0x18], xmm0
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], 0xf
mov byte [edi + 0x40], bl
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x60], ebx
mov word [edi + 0x64], bx
mov byte [edi + 0x66], bl
mov dword [edi + 0x68], ebx
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x70], ebx
mov dword [edi + 0x74], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], ebx
mov dword [edi + 0x80], ebx
mov dword [edi + 0x84], ebx
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov dword [edi + 0x90], ebx
mov dword [edi + 0x94], ebx
mov dword [edi + 0x98], ebx
mov dword [edi + 0x9c], ebx
mov dword [edi + 0xa0], ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x50a732
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 8], ecx
cmp dword [ebx + 4], 0
je 0x50a753
cmp byte [ebx + 8], 0
je 0x50a753
cmp byte [ebx + 9], 0
jne 0x50a76a
push 0x179
push str.D:package_cache_boost1.60.0_mt_revision_0_noarchinclude_boost_unordered_detail_buckets.hpp
push str.node___node_constructed___value_constructed_
call fcn.0054db53
add esp, 0xc
mov edi, dword [ebx + 4]
add edi, 0xc
mov dword [ebp - 0x14], edi
cmp dword [edi + 0x14], 0x10
jb 0x50a77d
mov eax, dword [edi]
jmp 0x50a77f
mov eax, edi
mov ecx, dword [edi + 0x10]
add ecx, eax
cmp dword [edi + 0x14], 0x10
jb 0x50a78e
mov eax, dword [edi]
jmp 0x50a790
mov eax, edi
xor edx, edx
mov esi, ecx
and dword [ebp - 0xc], edx
sub esi, eax
and dword [ebp - 0x10], edx
cmp eax, ecx
mov dword [ebp - 4], edx
cmova esi, dword [ebp - 0xc]
test esi, esi
je 0x50a7d9
mov edi, dword [ebp - 0x10]
mov ebx, edx
mov edx, ebx
mov ecx, ebx
shr ecx, 2
shl edx, 6
add edx, ecx
movsx ecx, byte [eax]
add ecx, 0x9e3779b9
add ecx, edx
xor ebx, ecx
inc eax
inc edi
cmp edi, esi
jne 0x50a7ae
mov edi, dword [ebp - 0x14]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov eax, edx
xor edx, edx
div dword [ecx + 4]
cmp dword [ecx + 8], 0
mov eax, edx
mov dword [ebp + 0xc], eax
je 0x50a82d
push eax
call fcn.004330fe
mov esi, dword [eax]
test esi, esi
jne 0x50a825
jmp 0x50a827
mov eax, dword [esi + 8]
cmp dword [ebp - 4], eax
jne 0x50a815
lea eax, [esi + 0xc]
mov ecx, edi
push eax
call fcn.00405d79
test eax, eax
je 0x50a82f
jmp 0x50a822
mov ecx, dword [ebp - 8]
xor edx, edx
div dword [ecx + 4]
cmp edx, dword [ebp + 0xc]
jne 0x50a82d
mov esi, dword [esi + 4]
mov esi, dword [esi]
test esi, esi
jne 0x50a7fc
jmp 0x50a82f
xor esi, esi
mov edi, dword [ebp - 8]
mov ecx, edi
mov eax, dword [edi + 8]
inc eax
push eax
call fcn.0050a94c
push esi
push dword [ebp - 4]
mov ecx, edi
push ebx
push dword [ebp + 8]
call fcn.0050a859
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x50f9da
Capabilities:
Initialize winhttp library

Disassembly:
mov eax, 0x617560
call fcn.00609528
sub esp, 0x2c0
push ebx
mov ebx, edx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x30], ebx
push dword [ebx + 4]
mov ecx, ebx
push dword [ebx]
call fcn.00405fa3
mov eax, dword [ebx]
mov dword [ebx + 4], eax
cmp dword [esi + 0x10], 0
jne 0x50fa12
xor al, al
jmp 0x50fb5c
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x50fa0b
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
inc ecx
test eax, eax
je 0x50fa36
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x40], eax
jmp 0x50fa4a
cmp dword [ebp - 0x20], 0
je 0x50fb1f
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], 3
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x34], ecx
jb 0x50fa55
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x2cc]
call fcn.00467617
push 9
xor eax, eax
lea edi, [ebp - 0x6c]
pop ecx
push eax
push eax
push eax
mov dword [ebp - 4], eax
mov esi, 0x6b096c
mov ebx, dword [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x6c]
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov esi, eax
test esi, esi
je 0x50fafc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
push esi
setne bl
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test bl, bl
je 0x50fafc
cmp dword [ebp - 0x2c], 3
jne 0x50fac2
mov edx, dword [ebp - 0x28]
test edx, edx
je 0x50fad1
mov ecx, dword [ebp - 0x30]
call fcn.0050f8f4
cmp dword [ebp - 0x28], 0
je 0x50fad1
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x24], 0
je 0x50fae0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x2c4]
cmp dword [ebp - 0x2c8], eax
je 0x50fb2d
push dword [ebp - 0x2c8]
call fcn.0052c08b
pop ecx
jmp 0x50fb2d
lea eax, [ebp - 0x2c4]
cmp dword [ebp - 0x2c8], eax
je 0x50fa0b
push dword [ebp - 0x2c8]
call fcn.0052c08b
pop ecx
jmp 0x50fa0b
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x50fb4b
mov ecx, ebx
call fcn.0050f8f4
cmp dword [ebp - 0x1c], 0
je 0x50fb3c
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x18], 0
je 0x50fb4b
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x14], 0
je 0x50fb5a
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x513143
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3ac
lea eax, [esp]
push ebx
push esi
push edi
mov ebx, ecx
push 0x190
push 0
push eax
mov byte [ebx], 0
call fcn.00544d60
add esp, 0xc
lea eax, [esp + 0x228]
lea esi, [esp + 0xc]
lea edi, [esp + 0x228]
push 0x64
pop ecx
push eax
rep movsd dword es:[edi], dword [esi]
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x513196
mov byte [ebx], 1
jmp 0x5131e1
and dword [esp + 0xc], 0
lea eax, [esp + 0x28]
and dword [esp + 0x1c], 0
lea ecx, [esp + 0xc]
push 0x12
push 0x6b1044
mov dword [esp + 0x18], str.Failed_to_initialize_sockets_resources.
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x200
mov dword [esp + 0x28], 4
mov dword [esp + 0x2c], str.SocketResources
call fcn.00496d52
lea ecx, [esp + 0xc]
call fcn.0042bc04
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x513218
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x51323a
mov ecx, 0x2000
test ecx, eax
jne 0x51323a
or eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret
Function at 0x51323c
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
lea eax, [ebp - 0x630]
push ebx
push esi
push edi
mov ebx, 0x208
mov edi, edx
push ebx
push 0
push eax
mov esi, ecx
call fcn.00544d60
add esp, 0xc
lea eax, [ebp - 0x428]
push ebx
push 0
push eax
call fcn.00544d60
pop ecx
pop ecx
lea edx, [ebp - 0x630]
mov ecx, esi
call fcn.00513bc2
pop ecx
test eax, eax
jle 0x5133c5
push ecx
lea edx, [ebp - 0x428]
mov ecx, edi
call fcn.00513bc2
pop ecx
test eax, eax
jle 0x5133c5
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor edi, edi
jmp 0x5132dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
jb 0x5132d1
cmp esi, 3
jbe 0x51333a
cmp esi, 5
je 0x513304
cmp esi, 8
je 0x51332a
cmp esi, 0xe
je 0x51332a
cmp esi, 0x11
je 0x51331a
inc edi
cmp edi, 1
ja 0x51334a
call fcn.005131ea
push 1
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x630]
push eax
call ebx
test eax, eax
je 0x5132ab
lea ecx, [ebp - 0x428]
call fcn.00513218
xor eax, eax
jmp 0x5133d3
inc edi
cmp edi, 1
jbe 0x5132d7
call fcn.005555d1
mov dword [eax], 1
jmp 0x5133d0
call fcn.005555d1
mov dword [eax], 0x12
jmp 0x5133d0
call fcn.005555d1
mov dword [eax], 0xc
jmp 0x5133d0
call fcn.005555d1
mov dword [eax], 2
jmp 0x5133d0
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x200]
and dword [ebp - 0x20c], 0
lea ecx, [ebp - 0x21c]
push 0x13e
push str..._bnl_base_source_baseFileIO.cpp
mov dword [ebp - 0x218], str.bnl_rename_failed_with_unexpected_error_code_:__d
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], 0x200
mov dword [ebp - 0x208], 4
mov dword [ebp - 0x204], str.FileIO
call fcn.00496d52
push esi
lea ecx, [ebp - 0x21c]
call fcn.00497382
lea ecx, [ebp - 0x21c]
call fcn.0042bc04
call fcn.005555d1
mov dword [eax], 5
jmp 0x5133d0
call fcn.005555d1
mov dword [eax], 0x26
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51399a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea edx, [ebp - 0x208]
push esi
push ecx
call fcn.00513bc2
pop ecx
test eax, eax
jg 0x5139c5
call fcn.005555d1
mov dword [eax], 0x26
or eax, 0xffffffff
jmp 0x513a1d
lea eax, [ebp - 0x208]
push eax
call fcn.006094a3
mov esi, eax
pop ecx
cmp esi, 0xffffffff
jne 0x513a10
call fcn.005555d1
cmp dword [eax], 2
je 0x513a1b
call fcn.005555d1
cmp dword [eax], 0x14
je 0x513a1b
call fcn.005555d1
cmp dword [eax], 0x11
je 0x513a1b
call fcn.005131ea
lea eax, [ebp - 0x208]
push eax
call fcn.006094a3
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x513a1b
lea ecx, [ebp - 0x208]
call fcn.00513218
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret