joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fc750
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.004b6300
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x5f81e0]
mov esi, eax
add esp, 8
test esi, esi
je 0x4fc8d2
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x4fc7d2
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4fc846
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x4fc800
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jae 0x4fc875
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x5bae26
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x5bae27
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x4fc850
push dword [esp + 0x30]
call fcn.004b6300
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x4fc8a0
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x5f81e4]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x4fc9a0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4fc9c6
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4fc9fe
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], 0
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.004b6300
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x4fca55
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x4fca64
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x4fca75
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret

Function at 0x4fca80
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x4fcacc
push ebx
mov ebx, dword [esp + 0x10]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x4fca91
pop ebx
pop edi
pop esi
ret

Function at 0x4ff1b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5992ad
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f88c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
call fcn.0054b297
add esp, 4
test eax, eax
je 0x4ff1f4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [eax], edx
mov dword [eax + 4], ecx
jmp 0x4ff1f6
xor eax, eax
mov dword [ebp + 8], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push eax
push 0x4ff560
push 0
push 0
call fcn.00561c02
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4ff233
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call fcn.00537928
int3
Function at 0x500000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599548
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5f88c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.00518600
lea ecx, [ebx + 0x30]
mov dword [ebp - 4], 0
call fcn.0051aad0
lea ecx, [ebx + 0x6c]
mov byte [ebp - 4], 1
call fcn.00517f90
lea edi, [ebx + 0x84]
mov byte [ebp - 4], 2
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.00518600
lea esi, [edi + 0x34]
mov byte [edi + 0x30], 0
push 0x2c
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0054b297
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x3c]
mov byte [ebp - 4], 4
push 0x2c
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0054b297
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea ecx, [ebx + 0xd0]
mov byte [ebp - 4], 5
mov dword [ebx + 0xc8], 0
mov dword [ebx + 0xcc], 0
call fcn.0051a680
lea ecx, [ebx + 0xd4]
mov byte [ebp - 4], 6
call fcn.0051a750
lea esi, [ebx + 0xd8]
mov byte [ebp - 4], 7
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0051c240
mov dword [esi], vtable.log4cplus::spi::FactoryRegistry_class_log4cplus::spi::AppenderFactory_.0
lea esi, [ebx + 0x118]
mov byte [ebp - 4], 8
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0051c240
mov dword [esi], vtable.log4cplus::spi::FactoryRegistry_class_log4cplus::spi::LayoutFactory_.0
lea esi, [ebx + 0x158]
mov byte [ebp - 4], 9
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0051c240
mov dword [esi], vtable.log4cplus::spi::FactoryRegistry_class_log4cplus::spi::FilterFactory_.0
lea esi, [ebx + 0x198]
mov byte [ebp - 4], 0xa
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.0051c240
mov dword [esi], vtable.log4cplus::spi::FactoryRegistry_class_log4cplus::spi::LocaleFactory_.0
lea ecx, [ebx + 0x1d8]
mov byte [ebp - 4], 0xb
call fcn.0051cc90
mov dword [ebx + 0x230], 0
mov eax, ebx
mov dword [ebx + 0x234], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x503f90
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
call fcn.0056dc3d
mov edi, dword [0x604a04]
mov ebx, dword fs:[0x2c]
test eax, eax
je 0x503fe9
mov esi, dword [ebx + edi*4]
cmp byte [esi + 0xc], 0
jne 0x503fc8
call fcn.0054c3d3
cmp byte [esi + 0xc], 0
jne 0x503fc8
call fcn.0054c3d3
mov esi, dword [esi + 4]
test esi, esi
je 0x503ff4
mov ecx, esi
call fcn.00501240
push 0x410
push esi
call fcn.0054b2c7
add esp, 8
jmp 0x503ff4
push str.log4cplus:_CRT_heap_is_already_gone_in_threadCleanup___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, dword [ebx + edi*4]
cmp byte [esi + 0xc], 0
jne 0x504005
call fcn.0054c3d3
pop edi
mov dword [esi + 4], 0
pop esi
pop ebx
ret
Function at 0x50f800
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ad55
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x5f88c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x60], esi
cmp byte [ebx + 0x34], 0
mov dword [ebp - 4], esi
je 0x50f856
cmp byte [ebp + 8], 0
jne 0x50f856
push dword [ebx + 0x30]
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 1
call fcn.0050c430
mov esi, dword [ebp - 0x60]
lea ecx, [ebx + 0xa8]
mov dword [ebp - 4], 0
call fcn.0050cc40
mov eax, dword [ebx + 0xa8]
xor edx, edx
mov ecx, dword [eax + 4]
mov eax, 4
cmp dword [ecx + ebx + 0xe0], edx
cmovne eax, edx
mov dword [ecx + ebx + 0xb4], eax
test dword [ecx + ebx + 0xb8], eax
jne 0x50fa3a
jmp 0x50f8b5
lea edi, [ebx + 0x1cc]
lea eax, [ebx + 0x158]
push edi
push eax
call fcn.00416c90
add esp, 8
test al, al
jne 0x50f9a2
call fcn.00503240
cmp dword [edi + 0x14], 7
mov ecx, edi
mov dword [ebp - 0x64], eax
jbe 0x50f8e5
mov ecx, dword [edi]
push ecx
call fcn.0056e316
add esp, 4
test eax, eax
je 0x50f8f7
call fcn.0055fbef
lea eax, [ebx + 0x158]
push eax
lea eax, [ebp - 0x5c]
push str.Renaming_file
push eax
call fcn.0046e130
push str._to
push eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 4
push eax
call fcn.00415170
push edi
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 5
push eax
call fcn.00430d00
add esp, 0x24
mov ecx, dword [ebp - 0x64]
push eax
mov byte [ebp - 4], 6
call fcn.0051ab40
lea ecx, [ebp - 0x2c]
call fcn.00403120
lea ecx, [ebp - 0x44]
call fcn.00403120
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0
call fcn.00403120
cmp dword [edi + 0x14], 7
jbe 0x50f962
mov edi, dword [edi]
cmp dword [ebx + 0x16c], 7
lea eax, [ebx + 0x158]
jbe 0x50f973
mov eax, dword [eax]
push edi
push eax
call fcn.0056e33e
add esp, 8
test eax, eax
je 0x50f988
call fcn.0055fbef
mov eax, dword [eax]
push eax
lea eax, [ebx + 0x1cc]
push eax
lea eax, [ebx + 0x158]
push eax
push dword [ebp - 0x64]
call fcn.0050ddf0
add esp, 0x10
call fcn.00536d77
push 0
push 0xa
push edx
push eax
call fcn.0054b320
push edx
push eax
mov ecx, ebx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
call fcn.0050c940
mov eax, dword [ebx]
mov ecx, ebx
push 0x12
call dword [eax + 0x28]
push dword [ebx + 0x1c8]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0050c4a0
push eax
call fcn.00510620
mov ecx, eax
mov edi, 0xf4240
mov eax, edx
add esp, 0x10
mul edi
mov edi, eax
mov eax, ecx
mov ecx, 0xf4240
mul ecx
add edi, edx
mov dword [ebx + 0x1f8], eax
mov dword [ebx + 0x1fc], edi
mov dword [ebp - 4], 7
test esi, esi
je 0x50fa1c
mov ecx, esi
call fcn.00524fe0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0054b289
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x68]
push 1
push eax
call fcn.00462200
add esp, 8
lea ecx, [ebp - 0x84]
push eax
push str.ios_base::badbit_set
call fcn.00460020
push 0x5ea274
lea eax, [ebp - 0x84]
push eax
call fcn.0054d049
int3
Function at 0x51b710
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59bcd5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x5f88c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x24], edi
xor ebx, ebx
lea eax, [edi + 0xc]
mov dword [ebp - 0x18], ebx
mov ecx, 1
mov dword [ebp - 4], ebx
lock or dword [eax], ecx
push 8
call fcn.0054b297
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], eax
test eax, eax
je 0x51b7f8
mov esi, edi
mov dword [ebp - 0x1c], esi
test edi, edi
je 0x51b784
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
add ecx, 4
add ecx, edi
call fcn.00509a80
push 8
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], 1
call fcn.0054b297
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x51b7ab
xor esi, esi
mov dword [ebx], edi
mov dword [ebp - 0x1c], esi
mov dword [ebx + 4], edi
jmp 0x51b7ad
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 3
call fcn.0051b050
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 4], 3
push eax
push 0
push ebx
push 0x51af80
push 0
push 0
call fcn.00561c02
mov ecx, dword [ebp - 0x14]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x51b86b
mov ebx, dword [ebp - 0x18]
mov eax, ecx
jmp 0x51b7fd
mov esi, dword [ebp - 0x1c]
xor eax, eax
mov ecx, dword [edi + 8]
mov dword [ebp - 4], 6
mov dword [edi + 8], eax
test ecx, ecx
je 0x51b81f
cmp dword [ecx + 4], 0
jne 0x51b879
push 8
push ecx
call fcn.0054b2c7
add esp, 8
mov dword [ebp - 4], 0
test bl, 1
je 0x51b843
mov byte [ebp - 4], 7
test esi, esi
je 0x51b843
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
add ecx, 4
add ecx, esi
call fcn.00509a90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 6
mov dword [ecx + 4], 0
call fcn.00537928
call fcn.00561a6a
int3
Function at 0x51ba50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59bda6
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5f88c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.log4cplus::spi::InternalLoggingEvent.0
xorps xmm0, xmm0
movups xmmword [edi + 8], xmm0
xor eax, eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 7
mov word [edi + 8], ax
movups xmmword [edi + 0x20], xmm0
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], 7
mov dword [ebp - 4], eax
mov word [edi + 0x20], ax
mov dword [edi + 0x38], 0xffffffff
movups xmmword [edi + 0x3c], xmm0
mov dword [edi + 0x4c], eax
mov dword [edi + 0x50], 7
mov word [edi + 0x3c], ax
lea esi, [edi + 0x54]
mov byte [ebp - 4], 2
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0054b297
xorps xmm0, xmm0
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
xor eax, eax
movups xmmword [edi + 0x5c], xmm0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 7
mov word [edi + 0x5c], ax
movups xmmword [edi + 0x74], xmm0
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], 7
mov word [edi + 0x74], ax
mov dword [edi + 0x90], eax
mov dword [edi + 0x94], eax
movups xmmword [edi + 0x98], xmm0
mov dword [edi + 0xa8], eax
mov dword [edi + 0xac], 7
mov word [edi + 0x98], ax
movups xmmword [edi + 0xb0], xmm0
mov dword [edi + 0xc0], eax
mov dword [edi + 0xc4], 7
mov word [edi + 0xb0], ax
mov dword [edi + 0xc8], eax
mov dword [edi + 0xcc], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x521c70
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ce25
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5f88c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x30], eax
xor edi, edi
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], edi
cmp byte [ebp + 0x14], 0
mov ecx, 0x17
push dword [ebp + 0xc]
mov eax, 2
mov dword [ebp - 4], edi
cmovne eax, ecx
mov esi, 6
mov dword [ebp - 0x2c], eax
mov ecx, 0x11
mov al, byte [ebp + 0x10]
movzx ebx, al
inc ebx
test al, al
lea eax, [ebp - 0x28]
push eax
cmovne esi, ecx
call fcn.00521b60
add esp, 8
mov byte [ebp - 4], 1
call fcn.00522370
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 7
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x30]
cmova ecx, dword [ebp - 0x28]
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], esi
cmp dword [eax + 0x14], 7
mov dword [ebp - 0x5c], 8
jbe 0x521d2e
mov eax, dword [eax]
lea edx, [ebp - 0x34]
push edx
lea edx, [ebp - 0x5c]
push edx
push ecx
push eax
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
mov esi, eax
test esi, esi
jne 0x521deb
mov edi, dword [ebp - 0x34]
or esi, 0xffffffff
mov ebx, edi
test ebx, ebx
je 0x521de3
nop dword [eax + eax]
push 0x80
push 0
push 0
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [ebp - 0x2c], eax
cmp esi, 0xffffffff
je 0x521da0
test esi, esi
je 0x521da0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
mov dword [ebp - 0x30], eax
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [ebp - 0x30]
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp - 0x2c]
mov esi, eax
cmp eax, 0xffffffff
je 0x521dc9
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x521dd5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
mov eax, dword [ebp - 0x2c]
je 0x521da7
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
jne 0x521d60
cmp eax, 0xffffffff
je 0x521de3
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x2c]
mov dword [eax], 0
jmp 0x521df8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.0055fbef
mov dword [eax], esi
mov esi, dword [0x5bf084]
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x521e2e
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x521e24
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x521e6b
push ecx
push edx
call fcn.0054b2c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test edi, edi
je 0x521e4d
push edi
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054b289
mov esp, ebp
pop ebp
ret
call fcn.0055fb01
int3
Function at 0x522370
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x603fa8]
nop
cmp eax, 2
je 0x522424
push esi
push edi
call fcn.0051abd0
mov esi, eax
mov ecx, 1
mov edi, 0x603fa8
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
je 0x5223e7
sub eax, 0
je 0x5223e7
sub eax, 1
je 0x5223c0
sub eax, 1
je 0x522422
push 1
push str.Unknown_WinSock_state.
mov ecx, esi
call fcn.0051aba0
pop edi
pop esi
ret
mov eax, dword [0x603fa8]
nop
sub eax, 1
je 0x5223e0
sub eax, 1
je 0x522422
push 1
push str.Unknown_WinSock_state.
mov ecx, esi
call fcn.0051aba0
jmp 0x5223c0
call fcn.0051b880
jmp 0x5223c0
push 0x603e18
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x522414
xor ecx, ecx
mov eax, 1
lock cmpxchg dword [edi], ecx
push 1
push str.Could_not_initialize_WinSock.
mov ecx, esi
call fcn.0051aba0
mov ecx, 2
mov eax, 1
lock cmpxchg dword [edi], ecx
pop edi
pop esi
ret

Function at 0x522430
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_recv]
push esi
push edi
mov edi, dword [esp + 0x18]
xor esi, esi
mov eax, dword [edi + 4]
push 0
sub eax, esi
push eax
mov eax, dword [edi + 0x10]
add eax, esi
push eax
push ebx
call ebp
cmp eax, 0xffffffff
je 0x52246c
test eax, eax
je 0x522465
add esi, eax
cmp esi, dword [edi + 4]
jl 0x522444
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.0055fbef
pop edi
mov dword [eax], esi
or eax, 0xffffffff
pop esi
pop ebp
pop ebx
ret
Function at 0x522560
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ebx, ebx
push esi
push edi
xor edi, edi
test ebp, ebp
je 0x522613
cmp ebp, 0x1fffffff
ja 0x522688
lea edi, [ebp*8]
cmp edi, 0x1000
jb 0x5225bb
lea eax, [edi + 0x23]
cmp eax, edi
jbe 0x52268d
push eax
call fcn.0054b297
add esp, 4
test eax, eax
je 0x522683
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov esi, ecx
add edi, ecx
mov dword [ecx - 4], eax
jmp 0x5225d2
test edi, edi
je 0x5225cc
push edi
call fcn.0054b297
add esp, 4
mov ecx, eax
jmp 0x5225ce
xor ecx, ecx
mov esi, ecx
add edi, esi
lea eax, [ebp*8]
push eax
push 0
push ecx
call fcn.0054d9f0
mov ebx, dword [esp + 0x2c]
add esp, 0xc
xor edx, edx
mov dword [esp + 0x10], esi
nop
xorps xmm0, xmm0
lea esi, [esi + 8]
movq qword [esi - 8], xmm0
mov ecx, dword [ebx + edx*4]
inc edx
mov eax, dword [ecx + 0x10]
mov dword [esi - 4], eax
mov eax, dword [ecx + 8]
mov dword [esi - 8], eax
cmp edx, ebp
jne 0x5225f0
mov ebx, dword [esp + 0x10]
push 0
push 0
push 0
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
push ebp
push ebx
push dword [esp + 0x30]
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x52264a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.0055fbef
mov dword [eax], esi
xor esi, esi
jmp 0x52264e
mov esi, dword [esp + 0x1c]
test ebx, ebx
je 0x52267b
sub edi, ebx
and edi, 0xfffffff8
cmp edi, 0x1000
jb 0x522671
mov ecx, dword [ebx - 4]
add edi, 0x23
sub ebx, ecx
lea eax, [ebx - 4]
cmp eax, 0x1f
ja 0x522683
mov ebx, ecx
push edi
push ebx
call fcn.0054b2c7
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
call fcn.0055fb01
call fcn.00506bf0
call fcn.00453fa0
int3
Function at 0x5234e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59d04e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x5f88c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push eax
push esi
mov dword [ebp - 4], 0
movups xmmword [esi], xmm0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x10], 0x8007
call fcn.00453090
mov edx, eax
mov dword [esi + 0x10], 0x8000
mov eax, dword [ebp - 0x10]
mov ecx, 0x4000
mov dword [esi + 0x14], eax
mov edi, edx
xor eax, eax
mov dword [esi], edx
rep stosd dword es:[edi], eax
add esp, 8
mov word [edx + 0x10000], ax
cmp dword [esi + 0x14], 7
mov dword [ebp - 4], eax
mov eax, esi
mov dword [ebp - 0x14], 1
jbe 0x52357e
mov eax, dword [esi]
push eax
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x5235b7
cmp eax, dword [esi + 0x10]
jae 0x5235b7
mov dword [esi + 0x10], eax
mov ecx, esi
cmp dword [esi + 0x14], 7
jbe 0x52359e
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.GetCurrentDirectory
lea ecx, [ebp - 0x20]
call fcn.004fd750
push 0x5ee1c4
lea eax, [ebp - 0x20]
push eax
call fcn.0054d049
int3
Function at 0x529630
Capabilities:
Access the windows event log

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xe0], 0
jne 0x529651
push str.NT_EventLog_not_opened.
call fcn.00503240
mov ecx, eax
call fcn.0051af60
pop esi
ret 4
push edi
mov edi, dword [esp + 0xc]
push edi
call fcn.00519fc0
cmp dword [eax + 0x10], 0x7c5f
jbe 0x52967f
mov dword [eax + 0x10], 0x7c5f
mov ecx, eax
cmp dword [eax + 0x14], 7
jbe 0x529676
mov ecx, dword [eax]
xor edx, edx
mov word [ecx + 0xf8be], dx
cmp dword [eax + 0x14], 7
jbe 0x529687
mov eax, dword [eax]
push 0
mov dword [esp + 0x10], eax
mov ecx, esi
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi]
push 0
push 1
push dword [esi + 0xe4]
push 0x1000
push edi
call dword [eax + 0x24]
movzx eax, ax
mov ecx, esi
push eax
mov eax, dword [esi]
push edi
call dword [eax + 0x20]
movzx eax, ax
push eax
push dword [esi + 0xe0]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
pop edi
test eax, eax
jne 0x5296dc
push eax
push str.Cannot_report_event_in_NT_EventLog.
call fcn.00503240
mov ecx, eax
call fcn.0051aba0
pop esi
ret 4