joyce8/EMBER2024-capa huggingface dataset:
Function at 0x502710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x5febd3
call fcn.0059d590
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [ebp - 4], edi
mov dword [esi], 0x621840
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
call sub.WINMM.dll_timeGetTime
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x24], eax
mov dword [esi + 0x50], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x505499
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x5ff02a
call fcn.0059d590
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x5055da
push 0x67eea4
push esi
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
pop ecx
jne 0x5054e4
push 0x4f
push str.E:CQ2ClientRelease_18.26.83DGameMap2DMapTerrainObj.cpp
push esi
push str.ERROR:_file__s_not_found_at__s___d
call fcn.005950cb
add esp, 0x10
jmp 0x5055da
mov ecx, edi
call fcn.005055ea
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 1
push 4
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call sub.MSVCRT.dll_strlen
add esp, 0x14
add eax, esi
lea ecx, [edi + 0x48]
push eax
push esi
call fcn.004029af
and dword [ebp + 8], 0
cmp dword [ebp - 0x14], 0
jle 0x5055c3
push 0xb0
call sub.MFC42.DLL_operatornew
pop ecx
mov ecx, eax
mov dword [ebp - 0x18], ecx
xor esi, esi
cmp ecx, esi
mov dword [ebp - 4], esi
je 0x50553f
call fcn.004ff57f
mov esi, eax
or dword [ebp - 4], 0xffffffff
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], esi
call fcn.00505d0e
push esi
lea eax, [ebp - 0x1c]
push esi
push eax
mov dword [ebp - 4], 1
call fcn.00564a31
add esp, 0xc
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x50557a
push dword [ebp - 0x10]
call fcn.004ffa87
push ecx
push ecx
mov ecx, dword [ebp - 0x20]
mov eax, esp
mov dword [ebp - 0x18], esp
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x50559d
push 1
add eax, 4
pop ecx
lock xadd dword [eax], ecx
mov ecx, edi
call fcn.005053eb
mov ecx, dword [ebp - 0x1c]
or dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x5055b4
call fcn.004039fd
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jl 0x50551f
push dword [edi + 0x10]
mov eax, dword [edi]
mov ecx, edi
push dword [edi + 0xc]
call dword [eax + 0x18]
push dword [ebp - 0x10]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret 4
Function at 0x50844f
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
push 0x67eea4
mov esi, ecx
push dword [esp + 0x14]
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x508489
push 0x1f6
push str.E:CQ2ClientRelease_18.26.83DGameMapPatternRose.cpp
push dword [esp + 0x18]
push str.ERROR:_file__s_not_found_at__s___d
call fcn.005950cb
add esp, 0x10
xor eax, eax
jmp 0x5084de
mov eax, dword [esp + 0xc]
push 0
imul eax, eax, 0x15e0
push eax
push edi
call dword [sym.imp.MSVCRT.dll_fseek]
add esi, 0x34c
push 0x15e0
push 0
push esi
call sub.MSVCRT.dll_memset
push edi
call dword [sym.imp.MSVCRT.dll_feof]
add esp, 0x1c
test eax, eax
jne 0x5084d2
push edi
push 0x578
push 4
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
jmp 0x5084d4
xor esi, esi
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
mov eax, esi
pop edi
pop esi
ret 8
Function at 0x516518
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
test byte [0x691ca8], 1
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
mov dword [ebp - 4], ecx
mov ebx, str.ini_Info.ini
mov edi, str.KOImage
jne 0x516554
or byte [0x691ca8], 1
push ebx
push 0x32
push str.Alpha
push edi
call esi
mov dword [0x691c98], eax
test byte [0x691ca8], 2
jne 0x516577
or byte [0x691ca8], 2
push ebx
push 0x3b9aca00
push str.Texture
push edi
call esi
mov dword [0x691c9c], eax
lea eax, [ebp - 0x18]
mov esi, 0x6903d0
push eax
mov ecx, esi
call fcn.004e6d21
lea eax, [ebp - 8]
mov ecx, esi
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.004e76be
mov eax, dword [ebp - 4]
lea edi, [ebp - 0x28]
lea esi, [eax + 0xc78]
add eax, 0xc88
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], eax
mov esi, eax
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x28]
cmp edi, dword [ebp - 0x38]
je 0x5166e3
mov ecx, dword [edi + 0x24]
lea esi, [edi + 0x24]
xor eax, eax
cmp ecx, eax
je 0x5166d3
mov edx, dword [ecx]
push eax
push eax
push eax
push eax
push 1
push dword [edi]
call dword [edx + 8]
mov ecx, dword [esi]
push dword [edi + 4]
mov eax, dword [ecx]
push 0xa
call dword [eax + 4]
mov eax, dword [edi + 8]
mov ecx, dword [esi]
movzx ebx, al
mov dword [ebp - 4], ebx
mov ebx, eax
fild dword [ebp - 4]
sar ebx, 8
movzx ebx, bl
fmul dword [0x621ef0]
push ecx
mov dword [ebp - 4], ebx
mov ebx, eax
mov edx, dword [ecx]
fstp dword [esp]
fild dword [ebp - 4]
sar ebx, 0x10
movzx ebx, bl
fmul dword [0x6220f8]
push ecx
mov dword [ebp - 4], ebx
sar eax, 0x18
fstp dword [esp]
fild dword [ebp - 4]
movzx eax, al
fmul dword [0x621ef0]
push ecx
mov dword [ebp - 4], eax
fstp dword [esp]
fild dword [ebp - 4]
push ecx
fimul dword [0x691c98]
fmul dword [0x6220f4]
fstp dword [esp]
call dword [edx + 0x14]
mov dword [ebp - 4], 0x621fbc
lea ebx, [edi + 0x10]
mov eax, dword [ebx]
test eax, eax
jbe 0x516678
mov ecx, dword [esi]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [ecx]
push dword [eax]
call dword [edx + 4]
add dword [ebp - 4], 4
add ebx, 4
cmp dword [ebp - 4], 0x621fc8
jl 0x516665
mov eax, dword [edi + 0x1c]
test eax, eax
jbe 0x516699
mov ecx, dword [esi]
push eax
push 0x24
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, dword [edi + 0x20]
test edi, edi
jbe 0x5166aa
mov ecx, dword [esi]
push edi
push 0x25
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esi]
push 0x12
push 0x20
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esi]
push dword [0x691c9c]
mov eax, dword [ecx]
push 0x26
call dword [eax + 4]
mov esi, dword [esi]
push dword [ebp - 8]
mov ecx, esi
mov eax, dword [esi]
push dword [ebp - 0xc]
call dword [eax + 0x24]
lea ecx, [ebp - 0x28]
call fcn.0052015a
mov esi, dword [ebp - 0x10]
jmp 0x5165b6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5235c9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
and byte [ebp - 1], 0
lea eax, [ebp - 2]
push edi
push eax
push dword [ebp + 8]
mov byte [ebp - 2], 0x72
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
push 2
lea eax, [ebp - 2]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x14
test edi, edi
jne 0x5235ff
xor eax, eax
jmp 0x523641
push esi
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call sub.MSVCRT.dll_memset
push edi
push 0x40
lea eax, [ebp - 0x44]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
cmp eax, 0x40
jne 0x523634
cmp word [ebp - 0x44], 0x5a4d
jne 0x523634
mov eax, dword [ebp - 8]
lea esi, [eax + 0x58]
jmp 0x523636
xor esi, esi
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
mov eax, esi
pop esi
pop edi
leave
ret

Function at 0x523644
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and byte [ebp - 1], 0
lea eax, [ebp - 2]
push esi
push eax
push dword [ebp + 8]
mov byte [ebp - 2], 0x72
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
push 2
lea eax, [ebp - 2]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x14
test esi, esi
jne 0x523678
xor eax, eax
jmp 0x5236a4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
and dword [ebp + 8], 0
push esi
push 1
lea eax, [ebp + 8]
push 4
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [ebp + 8]
add esp, 0x20
pop esi
leave
ret

Function at 0x5236a7
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x39
mov byte [ebp - 0xf], 0x38
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xc], 0x79
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x39
mov byte [ebp - 6], 0x72
mov byte [ebp - 5], 0x6f
mov byte [ebp - 4], 0x72
mov byte [ebp - 3], 0x17
xor eax, eax
xor byte [ebp + eax - 0x10], 0x17
inc eax
cmp eax, 0xe
jb 0x5236e7
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.005235c9
mov esi, eax
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00598b8b
mov edi, eax
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00523644
mov esi, eax
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x20
xor eax, eax
cmp edi, esi
pop edi
pop esi
sete al
leave
ret
Function at 0x5237c3
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
mov eax, 0x601c90
call fcn.0059d590
sub esp, 0x2a4
push esi
mov esi, 0x691cb8
push dword [0x691cbc]
mov ecx, esi
push dword [0x691cb8]
call fcn.0040603f
lea eax, [ebp - 0x2b0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x5238ab
push ebx
push edi
lea eax, [ebp - 0x120]
push 0x104
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x5238a3
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x5238a3
xor edi, edi
mov eax, dword [ebx + 0xc]
add eax, edi
cmp dword [eax], 0
je 0x5238a3
mov eax, dword [eax]
and dword [ebp - 4], 0
lea ecx, [ebp - 0xd]
push ecx
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402bfa
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
mov byte [ebp - 4], 1
call fcn.0040deae
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 2
sub eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0
je 0x523886
push eax
push dword [ebp - 0x1c]
call fcn.00402bd5
pop ecx
pop ecx
mov eax, dword [ebx + 0xc]
or dword [ebp - 4], 0xffffffff
mov eax, dword [eax + edi]
push dword [eax]
call fcn.0051bd44
mov ecx, eax
call fcn.0051e0ec
add edi, 4
jmp 0x523837
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x525a22
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
mov eax, 0x602127
call fcn.0059d590
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
lea ecx, [esi + 0x4c]
call fcn.00402cc4
xor ebx, ebx
lea ecx, [esi + 0x58]
mov dword [ebp - 4], ebx
call fcn.00402cc4
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 1
call fcn.00402cc4
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 2
call fcn.00402cc4
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 3
call fcn.00402cc4
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 4
call fcn.00402cc4
lea ecx, [esi + 0x94]
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0xe]
push eax
call fcn.0051ffc3
mov eax, dword [ebp + 0x10]
mov edi, 0x68f370
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
push edi
mov byte [ebp - 4], 7
mov dword [esi], 0x622190
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x4c]
call fcn.004029af
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x58]
call fcn.004029af
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
add eax, dword [ebp + 0xc]
pop ecx
push eax
lea ecx, [esi + 0x64]
push dword [ebp + 0xc]
call fcn.004029af
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x70]
call fcn.004029af
push edi
lea ecx, [esi + 0x7c]
call fcn.004dd2ae
push edi
lea ecx, [esi + 0x88]
call fcn.004dd2ae
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x525a2f
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
mov eax, 0x602127
call fcn.0059d590
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
lea ecx, [esi + 0x4c]
call fcn.00402cc4
xor ebx, ebx
lea ecx, [esi + 0x58]
mov dword [ebp - 4], ebx
call fcn.00402cc4
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 1
call fcn.00402cc4
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 2
call fcn.00402cc4
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 3
call fcn.00402cc4
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 4
call fcn.00402cc4
lea ecx, [esi + 0x94]
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0xe]
push eax
call fcn.0051ffc3
mov eax, dword [ebp + 0x10]
mov edi, 0x68f370
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
push edi
mov byte [ebp - 4], 7
mov dword [esi], 0x622190
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x4c]
call fcn.004029af
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x58]
call fcn.004029af
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
add eax, dword [ebp + 0xc]
pop ecx
push eax
lea ecx, [esi + 0x64]
push dword [ebp + 0xc]
call fcn.004029af
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x70]
call fcn.004029af
push edi
lea ecx, [esi + 0x7c]
call fcn.004dd2ae
push edi
lea ecx, [esi + 0x88]
call fcn.004dd2ae
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x5267a1
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
mov eax, 0x60237d
call fcn.0059d590
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x34]
call fcn.00402cc4
xor ebx, ebx
lea ecx, [esi + 0x40]
mov dword [ebp - 4], ebx
call fcn.00402cc4
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.00402cc4
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.00402cc4
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 3
call fcn.00402cc4
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 4
call fcn.00402cc4
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 5
call fcn.00402cc4
mov eax, dword [ebp + 8]
mov edi, 0x68f370
push edi
mov byte [ebp - 4], 6
mov dword [esi], 0x6221d0
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x34]
call fcn.004029af
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x40]
call fcn.004029af
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x4c]
call fcn.004029af
push dword [ebp + 0xc]
lea ecx, [esi + 0x58]
call fcn.004dd2ae
push edi
lea ecx, [esi + 0x64]
call fcn.004dd2ae
push edi
lea ecx, [esi + 0x70]
call fcn.004dd2ae
push edi
lea ecx, [esi + 0x7c]
call fcn.004dd2ae
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x5267ad
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
mov eax, 0x60237d
call fcn.0059d590
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x34]
call fcn.00402cc4
xor ebx, ebx
lea ecx, [esi + 0x40]
mov dword [ebp - 4], ebx
call fcn.00402cc4
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.00402cc4
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.00402cc4
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 3
call fcn.00402cc4
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 4
call fcn.00402cc4
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 5
call fcn.00402cc4
mov eax, dword [ebp + 8]
mov edi, 0x68f370
push edi
mov byte [ebp - 4], 6
mov dword [esi], 0x6221d0
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x34]
call fcn.004029af
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x40]
call fcn.004029af
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x4c]
call fcn.004029af
push dword [ebp + 0xc]
lea ecx, [esi + 0x58]
call fcn.004dd2ae
push edi
lea ecx, [esi + 0x64]
call fcn.004dd2ae
push edi
lea ecx, [esi + 0x70]
call fcn.004dd2ae
push edi
lea ecx, [esi + 0x7c]
call fcn.004dd2ae
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x536992
Capabilities:
Terminate process

Disassembly:
mov eax, 0x603754
call fcn.0059d590
push ecx
mov eax, 0x2000
call fcn.0059d8e0
mov eax, dword [ebp + 8]
push ebx
push esi
xor edx, edx
push edi
cmp eax, edx
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], edx
je 0x536b93
mov edi, dword [ebp + 0xc]
cmp edi, edx
jle 0x536b93
mov ecx, 0x400
cmp edi, ecx
jg 0x536b93
cmp dword [esi + 0x2008], edx
je 0x536a4e
cmp dword [esi + 0x12428], 2
mov byte [ebp - 4], 1
jne 0x5369f8
cmp byte [esi + 0x12424], dl
je 0x5369f8
mov eax, edi
jmp 0x5369fb
movzx eax, word [eax]
cmp eax, edx
jle 0x536b74
cmp eax, ecx
jg 0x536b74
cmp eax, edi
je 0x536a1e
mov ecx, esi
call fcn.005370f1
push 5
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [esi + 0x2000]
mov ebx, 0x2000
mov dword [ebp - 4], edx
lea ecx, [eax + edi]
cmp ecx, ebx
jle 0x536a61
mov ecx, esi
call fcn.00536ffb
mov eax, dword [esi + 0x2000]
lea ecx, [eax + edi]
cmp ecx, ebx
jle 0x536a61
mov ecx, esi
call fcn.005370f1
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
push edi
add eax, esi
push dword [ebp + 8]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 0x12428]
add esp, 0xc
cmp eax, 1
je 0x536b4f
cmp eax, 2
je 0x536a98
jle 0x536b66
cmp eax, 4
jle 0x536b4f
jmp 0x536b66
cmp byte [esi + 0x12424], 0
jne 0x536b66
and byte [ebp - 0x2010], 0
mov ecx, 0x7ff
xor eax, eax
lea edi, [ebp - 0x200f]
rep stosd dword es:[edi], eax
push dword [ebp + 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x2010]
lea edi, [esi + 0x12430]
push eax
mov ecx, edi
push dword [ebp + 8]
call fcn.00588a9e
push dword [ebp + 0xc]
lea eax, [ebp - 0x2010]
push eax
mov eax, dword [esi + 0x2000]
add eax, esi
push eax
call sub.MSVCRT.dll_memcpy
push ebx
lea eax, [ebp - 0x2010]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
call fcn.00588c14
mov ebx, eax
call fcn.00588c0e
lea ecx, [ebp - 0x2010]
push ebx
push ecx
push eax
mov ecx, edi
call fcn.00588a9e
call fcn.00588c14
push eax
lea eax, [ebp - 0x2010]
push eax
mov eax, dword [esi + 0x2000]
add eax, dword [ebp + 0xc]
add eax, esi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
call fcn.00588c14
add dword [esi + 0x2000], eax
mov edi, dword [ebp + 0xc]
jmp 0x536b66
mov eax, dword [esi + 0x2000]
push 1
add eax, esi
push edi
push eax
lea ecx, [esi + 0x12014]
call fcn.005371db
add dword [esi + 0x2000], edi
push 1
pop eax
jmp 0x536a50
mov ecx, esi
call fcn.005370f1
push 5
call dword [sym.imp.MSVCRT.dll_exit]
push 5
call dword [sym.imp.MSVCRT.dll_exit]
push 5
call dword [sym.imp.MSVCRT.dll_exit]
push 5
call dword [sym.imp.MSVCRT.dll_exit]
Function at 0x536ffb
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, 0x60376c
call fcn.0059d590
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x2000]
mov dword [ebp - 0x10], esp
test eax, eax
jle 0x537052
push 0
push eax
push esi
push dword [esi + 0x2004]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jle 0x537064
mov eax, dword [esi + 0x2000]
sub eax, edi
test eax, eax
jle 0x53704c
push eax
lea eax, [edi + esi]
push eax
push esi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0x2000], edi
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x537052
mov ecx, esi
call fcn.005370f1
xor eax, eax
jmp 0x537055

Function at 0x537084
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, 0x603778
call fcn.0059d590
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x2008], 0
mov dword [ebp - 0x10], esp
je 0x5370d3
push 2
lea eax, [ebp - 0x11]
push 1
push eax
push dword [esi + 0x2004]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x5370cc
jge 0x5370ec
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x5370ec
mov ecx, esi
call fcn.005370f1
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
push 1
pop eax
jmp 0x5370d5