joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f92b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xff
lea eax, [ebp - 0x2cc]
push eax
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x2cc]
push 0x5c
push ecx
call fcn.00564750
lea edi, [ebp - 0x2cc]
add esp, 8
mov byte [eax + 1], 0
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4f92f8
mov ecx, 6
mov esi, str.._Ini_AdvancedSet_Cfg.ini
rep movsd dword es:[edi], dword [esi]
push 0xff
lea edx, [ebp - 0x1cc]
push edx
push 0
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x1cc]
push 0x5c
push eax
call fcn.00564750
lea edi, [ebp - 0x1cc]
add esp, 8
mov byte [eax + 1], 0
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4f9340
mov ecx, 7
mov esi, str.._Ini_AdvancedSet_Config.ini
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x1cc]
push ecx
lea edx, [ebp - 0x2cc]
push str.admin
push edx
movsb byte es:[edi], byte [esi]
call fcn.004f8940
push 0xc8
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.00564860
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [ebp - 0xcc]
push ecx
push str.Power
push str.AddPoint
call fcn.005074f0
lea edx, [ebp - 0xcc]
push edx
call fcn.0056520a
push 0xc8
mov dword [ebx + 0x24c], eax
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.00564860
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [ebp - 0xcc]
push ecx
push 0x590b78
push str.AddPoint
call fcn.005074f0
lea edx, [ebp - 0xcc]
add esp, 0x48
push edx
call fcn.0056520a
push 0xc8
mov dword [ebx + 0x250], eax
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.00564860
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [ebp - 0xcc]
push ecx
push 0x590b74
push str.AddPoint
call fcn.005074f0
lea edx, [ebp - 0xcc]
push edx
call fcn.0056520a
push 0xc8
mov dword [ebx + 0x254], eax
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.00564860
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [ebp - 0xcc]
push ecx
push 0x590b70
push str.AddPoint
call fcn.005074f0
lea edx, [ebp - 0xcc]
add esp, 0x40
push edx
call fcn.0056520a
mov dword [ebx + 0x258], eax
add esp, 4
lea eax, [ebp - 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
xor ecx, ebp
call fcn.0056411e
mov esp, ebp
pop ebp
ret
Function at 0x4f94a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xc8
lea eax, [ebp - 0xcc]
push 0
push eax
mov esi, ecx
call fcn.00564860
mov ecx, dword [esi + 0x24c]
push ecx
lea edx, [ebp - 0xcc]
push 0x584f40
push edx
call fcn.0056469f
push str.._Ini_AdvancedSet_Config.ini
lea eax, [ebp - 0xcc]
push eax
push str.Power
push str.AddPoint
call fcn.00507430
push 0xc8
lea ecx, [ebp - 0xcc]
push 0
push ecx
call fcn.00564860
mov edx, dword [esi + 0x250]
push edx
lea eax, [ebp - 0xcc]
push 0x584f40
push eax
call fcn.0056469f
add esp, 0x40
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [ebp - 0xcc]
push ecx
push 0x590b78
push str.AddPoint
call fcn.00507430
push 0xc8
lea edx, [ebp - 0xcc]
push 0
push edx
call fcn.00564860
mov eax, dword [esi + 0x254]
push eax
lea ecx, [ebp - 0xcc]
push 0x584f40
push ecx
call fcn.0056469f
push str.._Ini_AdvancedSet_Config.ini
lea edx, [ebp - 0xcc]
push edx
push 0x590b74
push str.AddPoint
call fcn.00507430
push 0xc8
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.00564860
mov ecx, dword [esi + 0x258]
add esp, 0x44
push ecx
lea edx, [ebp - 0xcc]
push 0x584f40
push edx
call fcn.0056469f
push str.._Ini_AdvancedSet_Config.ini
lea eax, [ebp - 0xcc]
push eax
push 0x590b70
push str.AddPoint
call fcn.00507430
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 0x1c
push 0xff
lea ecx, [ebp - 0x1cc]
push ecx
push 0
call ebx
lea edx, [ebp - 0x1cc]
push 0x5c
push edx
call fcn.00564750
lea edi, [ebp - 0x1cc]
add esp, 8
mov byte [eax + 1], 0
dec edi
jmp 0x4f9610
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4f9610
mov ecx, 7
mov esi, str.._Ini_AdvancedSet_Config.ini
rep movsd dword es:[edi], dword [esi]
push 0xff
lea eax, [ebp - 0x2cc]
push eax
push 0
movsb byte es:[edi], byte [esi]
call ebx
lea ecx, [ebp - 0x2cc]
push 0x5c
push ecx
call fcn.00564750
lea edi, [ebp - 0x2cc]
add esp, 8
mov byte [eax + 1], 0
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4f9651
mov ecx, 6
mov esi, str.._Ini_AdvancedSet_Cfg.ini
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x2cc]
push edx
lea eax, [ebp - 0x1cc]
push str.admin
push eax
movsw word es:[edi], word [esi]
call fcn.004f8870
add esp, 0xc
lea ecx, [ebp - 0x1cc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056411e
mov esp, ebp
pop ebp
ret
Function at 0x4fa810
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x590dac
xor bl, bl
push eax
mov esi, ecx
mov byte [ebp - 1], bl
call fcn.005644f0
mov edi, eax
add esp, 8
test edi, edi
je 0x4fa8e9
push edi
push 0x118
lea ecx, [esi + 0x14]
push 1
push ecx
call fcn.00566d6f
add esp, 0x10
cmp eax, 0x118
jne 0x4fa8b4
mov edx, dword [esi + 0x118]
mov eax, dword [esi + 0x11c]
lea ecx, [eax + edx*2]
cmp dword [esi + 0x120], ecx
jne 0x4fa8b4
mov edx, dword [esi + 0x124]
push edx
call fcn.00563a68
add esp, 4
mov dword [esi + 0x10], eax
test eax, eax
je 0x4fa8b4
mov ebx, dword [esi + 0x124]
push edi
push ebx
push 1
push eax
call fcn.00566d6f
add esp, 0x10
cmp ebx, eax
jne 0x4fa8b1
mov edx, dword [esi + 0x118]
mov eax, dword [esi + 0x11c]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov byte [ebp - 1], 1
mov bl, byte [ebp - 1]
push edi
call fcn.005642a6
add esp, 4
test bl, bl
jne 0x4fa8d8
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4fa8d8
push eax
call fcn.00564955
add esp, 4
mov dword [esi + 0x10], 0
pop edi
mov byte [esi + 0x128], bl
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4fb820
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
push 0xff
lea edx, [ebp - 0x104]
push edx
push 0
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.00564750
mov byte [eax + 1], 0
mov eax, esi
add esp, 8
mov ecx, eax
jmp 0x4fb880
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4fb880
lea edi, [ebp - 0x104]
sub eax, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4fb890
mov edx, dword [ebp - 0x10c]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x108]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x104]
push ecx
push 0xff
push edx
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056411e
mov esp, ebp
pop ebp
ret 0x10

Function at 0x503c80
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x505450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x50558a
cmp byte [edi + 0x49], bl
je 0x50558a
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
jne 0x505498
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056411e
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x20], bl
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 8
cmp ecx, 0x10
jae 0x5054ba
lea eax, [ebp - 0x20]
mov byte [eax + 8], bl
push esi
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0xc]
mov edx, eax
cmp ebx, 0x10
jae 0x5054d0
lea edx, [ebp - 0x20]
mov eax, edx
add edx, dword [ebp - 0x10]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x24]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x50550f
dec eax
je 0x505513
sub eax, 2
lea ecx, [ebp - 0x20]
je 0x505572
call fcn.0041fe40
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056411e
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov ecx, eax
cmp ebx, 0x10
jae 0x505523
lea ecx, [ebp - 0x20]
mov esi, dword [ebp - 0x24]
sub esi, ecx
je 0x50554c
cmp ebx, 0x10
jae 0x505532
lea eax, [ebp - 0x20]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.00566aab
add esp, 0x10
cmp esi, eax
jne 0x50556a
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
cmp byte [edi + 0x49], 0
je 0x50556f
test esi, esi
jne 0x5054c4
push esi
push 8
lea ecx, [ebp - 0x20]
call fcn.00505270
jmp 0x5054be
lea ecx, [ebp - 0x20]
jmp 0x5054f7
lea ecx, [ebp - 0x20]
call fcn.0041fe40
pop esi
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056411e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0056411e
mov esp, ebp
pop ebp
ret
Function at 0x5074f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
push 0xff
lea edx, [ebp - 0x104]
push edx
push 0
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.00564750
mov byte [eax + 1], 0
mov eax, esi
add esp, 8
mov ecx, eax
jmp 0x507550
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x507550
lea edi, [ebp - 0x104]
sub eax, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x507560
mov edx, dword [ebp - 0x10c]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x108]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x104]
push ecx
push 0xff
push edx
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056411e
mov esp, ebp
pop ebp
ret

Function at 0x508880
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 8]
mov dword [esi], vtable.PingManager.0
push edi
xor edi, edi
push 0x1e
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.004da7d0
push edi
push edi
push edi
push 0x508820
push edi
push edi
mov dword [esi + 0x2c], 1
mov dword [esi + 0x30], edi
call fcn.00566e51
add esp, 0x18
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
ret

Function at 0x508a00
Capabilities:
Create raw socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x18e
mov esi, ecx
push eax
lea ecx, [ebp - 0x192]
push ecx
mov word [ebp - 0x194], ax
call fcn.00564860
add esp, 0xc
lea edx, [ebp - 0x194]
push edx
push 0x102
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x508a5a
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056411e
mov esp, ebp
pop ebp
ret
push 1
push 3
push 2
call sub.WSOCK32.dll_socket
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x508a49
push 4
lea ecx, [ebp - 0x198]
push ecx
push 0x1006
push 0xffff
push eax
mov dword [ebp - 0x198], 0x7d0
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
je 0x508a49
mov eax, dword [esi + 4]
push 4
lea edx, [ebp - 0x198]
push edx
push 0x1005
push 0xffff
push eax
mov dword [ebp - 0x198], 0x7d0
call sub.WSOCK32.dll_setsockopt
mov ecx, dword [ebp - 4]
cmp eax, 0xffffffff
setne al
xor ecx, ebp
pop esi
call fcn.0056411e
mov esp, ebp
pop ebp
ret
Function at 0x508c50
Capabilities:
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, ecx
test edi, edi
je 0x508e41
mov word [ebp - 0x814], ax
mov dword [ebp - 0x812], eax
mov dword [ebp - 0x80e], eax
mov dword [ebp - 0x80a], eax
mov word [ebp - 0x806], ax
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x508ca0
push 2
sub eax, edx
push eax
push edi
call sub.WSOCK32.dll_gethostbyaddr
push edi
test eax, eax
je 0x508cd0
mov ecx, 2
mov word [ebp - 0x814], cx
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 0x810], eax
jmp 0x508d12
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x508ced
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056411e
mov esp, ebp
pop ebp
ret 8
mov dx, word [eax + 8]
mov word [ebp - 0x814], dx
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [ebp - 0x810]
push ecx
call fcn.00564960
add esp, 0xc
push 0x3ff
lea edx, [ebp - 0x403]
push 0
push edx
mov byte [ebp - 0x404], 0
call fcn.00564860
push 0x3ff
lea eax, [ebp - 0x803]
push 0
push eax
mov byte [ebp - 0x804], 0
call fcn.00564860
mov edi, dword [ebp + 0xc]
add esp, 0x18
push edi
lea ecx, [ebp - 0x404]
push ecx
mov ecx, esi
call fcn.00508ad0
xor eax, eax
xor edx, edx
xor ecx, ecx
add edi, 0xc
mov word [ebp - 0x824], dx
mov dword [ebp - 0x822], eax
mov dword [ebp - 0x81e], eax
mov dword [ebp - 0x81a], eax
mov word [ebp - 0x816], ax
mov word [ebp - 0x402], ax
mov word [ebp - 0x3fe], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
lea edx, [ebp - 0x404]
push edx
mov ecx, esi
mov dword [ebp - 0x3fc], eax
call fcn.00508b20
mov edx, dword [esi + 4]
push 0x10
mov word [ebp - 0x402], ax
lea eax, [ebp - 0x814]
push eax
push 0
push edi
lea ecx, [ebp - 0x404]
push ecx
push edx
call sub.WSOCK32.dll_sendto
cmp eax, 0xffffffff
je 0x508cd9
lea eax, [ebp - 0x828]
push eax
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x824]
push ecx
push 0
push 0x400
lea edx, [ebp - 0x804]
push edx
push eax
mov dword [ebp - 0x828], 0x10
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
je 0x508cd9
lea ecx, [ebp - 0x824]
push ecx
push eax
lea edx, [ebp - 0x804]
push edx
mov ecx, esi
call fcn.00508ba0
mov eax, dword [esi + 8]
test eax, eax
je 0x508e3b
mov ecx, 1
cmp dword [eax + 0x24], ecx
jg 0x508e3b
mov dword [eax + 0x24], ecx
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x24]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0056411e
mov esp, ebp
pop ebp
ret 8
Function at 0x510c90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x20]
push esi
call ecx
test eax, eax
je 0x510ce2
push 0x7c9
mov ecx, 0x6b28c8
call fcn.004be880
push eax
push 0x1d
push 0x6b28c8
call fcn.004bfb10
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056411e
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6dcd24]
mov dword [ebp - 0x210], 0
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
lea edx, [ebp - 0x210]
push edx
push 0x592178
push eax
mov eax, dword [ecx + 0x134]
call eax
test eax, eax
je 0x510cd1
cmp dword [esi + 0xc], 0
jne 0x510d4d
push str.bdcap32.dll
mov ecx, esi
call fcn.00511120
test eax, eax
jns 0x510d31
push 0x7ca
jmp 0x510cb7
mov ecx, dword [esi]
mov edx, dword [ecx + 0xc]
push str.e5b68af6
push str.EYA_LUNAPLUS_20100218
push esi
call edx
cmp dword [esi + 0xc], 0
je 0x510e15
mov eax, dword [esi]
mov ecx, dword [eax + 0x40]
push 0x3c
push 0x1e
push esi
call ecx
mov ecx, esi
call fcn.00510ba0
push 0
mov ecx, 0x6df7e0
call fcn.0054b290
push eax
lea edx, [ebp - 0x108]
push str._sScreenShot
push edx
call fcn.0056469f
add esp, 0xc
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x510dab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x510dab
push 0x7cc
jmp 0x510cb7
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0x592280
push str.Capture
lea edx, [ebp - 0x108]
push edx
mov ecx, esi
call fcn.00510940
lea eax, [ebp - 0x20c]
push eax
push 0x7cd
mov ecx, 0x6b28c8
call fcn.004be880
push eax
push 0x1d
push 0x6b28c8
call fcn.004bfb10
mov ecx, dword [ebp - 0x210]
add esp, 0x10
push ecx
push 4
push 0
lea edx, [ebp - 0x20c]
push edx
push esi
call fcn.005109c0
test eax, eax
js 0x510cd1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0056411e
mov esp, ebp
pop ebp
ret

Function at 0x511540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
test eax, eax
jne 0x511594
mov eax, dword [ebp + 8]
push 0x5922f4
push eax
call fcn.005644f0
mov esi, eax
add esp, 8
test esi, esi
je 0x5115c8
mov edx, dword [ebp + 0xc]
mov eax, edx
push edi
lea edi, [eax + 1]
jmp 0x511570
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x511570
push esi
sub eax, edi
push 1
push eax
push edx
call fcn.00566aab
push esi
call fcn.005642a6
add esp, 0x14
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
cmp eax, 1
jne 0x5115c8
mov ecx, dword [ebp + 8]
push 0x5922f0
push ecx
call fcn.005644f0
mov esi, eax
add esp, 8
test esi, esi
je 0x5115c8
mov edx, dword [ebp + 0xc]
push edx
push 0x5922ec
push esi
call fcn.0056412d
push esi
call fcn.005642a6
add esp, 0x10
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x5147b0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff8
push esi
mov esi, ecx
cmp eax, 0x4e
ja case.0x5147cc.10
movzx eax, byte [eax + 0x514938]
jmp dword [eax*4 + 0x514904]
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x40], 1
je case.0x5147cc.10
call fcn.00513b50
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
call fcn.00513bd0
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
call fcn.00513c50
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
call fcn.00513cc0
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x40], 1
je case.0x5147cc.10
call fcn.00513d30
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
call fcn.00513d40
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
call fcn.00513a80
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 0x38]
test ecx, ecx
je case.0x5147cc.10
push 8
call fcn.00435620
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
call fcn.00513d80
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
call fcn.00513f70
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, 0x6b0010
call fcn.00435e20
mov eax, 1
pop esi
pop ebp
ret 0x10
mov dword [esi + 0xc], 1
mov eax, 1
pop esi
pop ebp
ret 0x10
cmp dword [esi + 0xc], 0
je case.0x5147cc.10
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je case.0x5147cc.10
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.0x5147cc.10
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ecx, dword [esi + 4]
push eax
call fcn.00514680
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x516880
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x104]
mov ebx, ecx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x5168a4
movsx eax, byte [esi]
push eax
call fcn.0056765a
add esp, 4
test eax, eax
je 0x516968
lea ecx, [ebp - 0x104]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x5168fb
call sub.WSOCK32.dll_WSAGetLastError
push eax
push str.Error:__u_n
call fcn.005663d0
add esp, 8
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056411e
mov esp, ebp
pop ebp
ret 8
movsx edx, word [esi + 0xa]
movsx eax, word [esi + 8]
mov ecx, dword [esi + 4]
push edi
push edx
mov edx, dword [esi]
push eax
push ecx
push edx
push str.name_s_naliases_s_naddrtype_d_nlength_d_n
call fcn.005663d0
mov eax, dword [esi + 0xc]
xor edi, edi
add esp, 0x14
cmp dword [eax], edi
je 0x516967
movsx ecx, word [esi + 0xa]
mov edx, dword [eax]
push ecx
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00564960
mov ecx, dword [ebp - 0x110]
add esp, 0xc
push ecx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea edx, [ebp - 0x104]
push 0x58267c
push edx
call fcn.0056469f
mov eax, dword [esi + 0xc]
inc edi
lea eax, [eax + edi*4]
add esp, 0xc
cmp dword [eax], 0
jne 0x516923
pop edi
lea ecx, [ebp - 0x104]
push ecx
push 0x20
push 0x6c0a24
call fcn.005675a5
mov edx, dword [0x6c0a80]
mov esi, dword [ebp + 0xc]
imul edx, edx, 0x58
add esp, 0xc
cmp si, word [edx + 0x6dbdd8]
jne 0x5169af
cmp dword [0x6c0a48], 0
je 0x5169af
cmp dword [0x6c0a7c], 0
jne 0x5169af
mov ecx, 0x6c0a48
call fcn.005092f0
mov eax, dword [ebx + 0x114]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x104]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebx + 0x118], eax
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056411e
mov esp, ebp
pop ebp
ret 8
Function at 0x516a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x69ff0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 1], 0x52
push edi
mov edi, ecx
mov dword [ebp - 0x30], eax
jb 0x516a87
push 0
push 0xb9
push str.MHNetwork.cpp
call fcn.005186c0
add esp, 0xc
lea eax, [ebp - 0x2c]
push ebx
mov dword [ebp - 0x2c], 0x56734661
mov dword [ebp - 0x28], 0x31313561
mov dword [ebp - 0x24], 0x76465341
mov dword [ebp - 0x20], 0x534d6163
mov dword [ebp - 0x1c], 0x215e5953
mov dword [ebp - 0x18], 0x76732440
mov dword [ebp - 0x14], 0x3172415a
mov dword [ebp - 0x10], 0x21405e26
mov dword [ebp - 0xc], 0x7866732a
mov byte [ebp - 8], 0
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x516ad1
sub eax, ecx
mov ecx, eax
mov eax, dword [ebp - 0x30]
xor edx, edx
lea ebx, [ecx - 1]
div ebx
lea ebx, [ecx - 1]
mov ecx, dword [ebp - 0x30]
mov eax, ecx
movzx edx, byte [ebp + edx - 0x2c]
xor byte [esi + 1], dl
xor edx, edx
div ebx
pop ebx
mov al, byte [ebp + edx - 0x2c]
xor byte [esi + 2], al
movzx edx, byte [edi + 0x11c]
mov byte [esi], dl
mov eax, dword [edi + 0x118]
inc byte [edi + 0x11c]
test eax, eax
je 0x516b2c
mov edi, dword [edi + 0x114]
mov edx, dword [edi]
push ecx
push esi
push eax
mov eax, dword [edx + 0x14]
push edi
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0056411e
mov esp, ebp
pop ebp
ret 8