joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51aef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
mov dword [0x5ed080], 0x5f9d48
push dword [edi]
push 1
push 4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
lea edx, [ebp + 8]
lea esi, [ebp + 0xb]
nop dword [eax + eax]
mov al, byte [esi]
mov cl, byte [edx]
mov byte [edx], al
inc edx
mov byte [esi], cl
dec esi
cmp edx, esi
jb 0x51af20
mov ecx, dword [ebp + 8]
lea eax, [ecx + 4]
add dword [edi + 0xc], eax
test ecx, ecx
jne 0x51af47
mov dword [0x8012c4], ecx
mov dword [0x8012bc], ecx
push dword [edi]
push ecx
push 1
push 0x5f9d48
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, eax
add esp, 0x10
test edx, edx
jle 0x51af94
sub dword [edi + 8], edx
mov eax, 1
mov ecx, dword [0x8012c4]
cmove ecx, eax
mov dword [0x8012c4], ecx
mov ecx, dword [0x5ed080]
pop edi
pop esi
movzx eax, byte [ecx]
inc ecx
mov dword [0x5ed080], ecx
lea ecx, [edx - 1]
mov dword [0x8012bc], ecx
pop ebp
ret
cmp edx, 0xffffffff
je 0x51afa2
cmp dword [0x8012c4], 0
je 0x51afac
mov dword [0x8012c4], 0
pop edi
or eax, 0xffffffff
mov dword [0x8012bc], 0
pop esi
pop ebp
ret
Function at 0x5228b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
jne 0x5228e3
mov eax, dword [0x801448]
test eax, eax
je 0x5228da
mov eax, dword [eax + 0x14]
test eax, eax
je 0x5228da
push str.FDLReadBuffer:_Null_FDL_file_object
call eax
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x100]
test eax, eax
jne 0x522910
mov eax, dword [0x801448]
test eax, eax
je 0x5228da
mov eax, dword [eax + 0x14]
test eax, eax
je 0x5228da
push str.FDLReadBuffer:_Given_file_not_open
call eax
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x522920
test byte [esi + 0x110], 1
jne 0x522943
mov eax, dword [0x801448]
test eax, eax
je 0x5228da
mov eax, dword [eax + 0x14]
test eax, eax
je 0x5228da
push str.FDLReadBuffer:_Given_file_not_open_for_reading
call eax
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x108]
test byte [ecx + 0x98], 4
je 0x522a64
push eax
mov eax, dword [ecx + 0x80]
imul eax, dword [ebp + 0x10]
push 1
push eax
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x5229b0
push esi
push str.FDLReadBuffer:_Error_reading_file__s
push 0x801450
call fcn.004f9620
mov eax, dword [0x801448]
add esp, 0xc
test eax, eax
je 0x5228da
mov eax, dword [eax + 0x14]
test eax, eax
je 0x5228da
push 0x801450
call eax
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x108]
mov ebx, dword [eax + 0x90]
mov edx, dword [eax + 0x84]
mov dword [ebp - 8], edx
test ebx, ebx
jne 0x5229d8
mov edx, dword [eax + 0x88]
mov ebx, dword [eax + 0x94]
mov dword [ebp - 8], edx
test edx, edx
jle 0x522a58
mov eax, dword [ebp + 0x10]
add ebx, 0x44
xor ecx, ecx
mov dword [ebp - 4], ecx
test eax, eax
jle 0x522a4d
nop dword [eax + eax]
cmp byte [ebx - 4], 0x42
je 0x522a42
xor edi, edi
cmp dword [ebx + 4], edi
jbe 0x522a42
nop dword [eax]
mov eax, dword [esi + 0x108]
mov eax, dword [eax + 0x8c]
imul eax, ecx
mov ecx, dword [ebx]
imul ecx, edi
add eax, ecx
add eax, dword [ebx + 8]
add eax, dword [ebp + 0xc]
lea esi, [eax - 1]
add esi, dword [ebx]
cmp eax, esi
jae 0x522a33
mov cl, byte [esi]
mov dl, byte [eax]
mov byte [eax], cl
inc eax
mov byte [esi], dl
dec esi
cmp eax, esi
jb 0x522a25
mov ecx, dword [ebp - 4]
inc edi
mov esi, dword [ebp + 8]
cmp edi, dword [ebx + 4]
jb 0x522a00
mov eax, dword [ebp + 0x10]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, eax
jl 0x5229f0
mov edx, dword [ebp - 8]
add ebx, 0x70
sub edx, 1
mov dword [ebp - 8], edx
jne 0x5229e2
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
jle 0x522a58
mov ebx, dword [ebp + 8]
push edx
push ebx
call sym.FLAMESLauncher.exe_FDLRead
add esp, 8
test eax, eax
je 0x5228da
mov eax, dword [ebx + 0x108]
inc esi
mov edx, dword [ebp + 0xc]
add edx, dword [eax + 0x8c]
mov dword [ebp + 0xc], edx
cmp esi, edi
jl 0x522a70
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x524ee0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], 0x10
push edi
test ecx, ecx
je 0x524fb9
mov eax, dword [ecx]
sub eax, 2
jne 0x524fb9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
cmp edi, 0xffffffff
je 0x524fb9
push esi
push 4
push 0x5aa84c
push 1
push 6
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x74
push 0x5aa854
push 0x1c
push 1
call sym.FLAMESLauncher.exe_FUtilityMemAllocateWithTag
mov esi, eax
add esp, 0x10
mov dword [esi], 2
mov dword [esi + 4], edi
mov cx, word [0x5aa86c]
mov word [esi + 8], cx
mov cl, byte [0x5aa86e]
mov byte [esi + 0xa], cl
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 0x18], eax
mov eax, dword [esi]
sub eax, 2
je 0x524f89
sub eax, 1
je 0x524f89
sub eax, 2
jne 0x524fa7
push 0x5aa850
push 0x8004667e
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x524fa7
mov dword [esi + 0xc], 1
mov eax, esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret

Function at 0x525060
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x525106
mov eax, dword [edi]
sub eax, 2
je 0x525085
sub eax, 1
je 0x525085
sub eax, 2
jne 0x525106
mov eax, dword [edi + 0x18]
lea ebx, [edi + 0x18]
test eax, eax
je 0x525106
push eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push 0x20
push dword [ebx]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
push 0
push 0
push 1
push ebx
push 1
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
push 0
push dword [ebx]
mov dword [ebp + 8], eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp dword [edi + 0xc], 0
je 0x5250f7
mov eax, dword [edi]
sub eax, 2
je 0x5250d9
sub eax, 1
je 0x5250d9
sub eax, 2
jne 0x5250f7
push 0x5aa850
push 0x8004667e
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x5250f7
mov dword [edi + 0xc], 1
cmp dword [ebp + 8], 0
je 0x525106
pop edi
mov eax, 1
pop ebx
pop ebp
ret
pop edi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x525450
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
test edi, edi
je case.0x52546b.4
mov eax, dword [edi]
dec eax
cmp eax, 4
ja case.0x52546b.4
jmp dword [eax*4 + 0x5254b4]
lea eax, [ebp - 4]
push eax
push 0x4004667f
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret
push esi
push dword [edi + 0x10]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push dword [edi + 4]
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__filelength]
add esp, 8
sub eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x5257c0
Capabilities:
Get hostname
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x170], 0x10
test edi, edi
je 0x52585b
cmp dword [edi], 3
jne 0x52585b
push edi
call sym.FLAMESLauncher.exe_FSECommDataAvailable
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x52585b
cmp ebx, 1
jne 0x525808
lea esi, [ebp - 0x169]
jmp 0x52581f
push 0x578
push 0x5aa970
push 1
push ebx
call sym.FLAMESLauncher.exe_FUtilityMemAllocateWithTag
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jg 0x52586e
lea eax, [ebp - 0x169]
cmp esi, eax
je 0x52585b
push 0x582
push 0x5aa970
push esi
call sym.FLAMESLauncher.exe_FUtilityMemFreeWithTag
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
cmp eax, 1
jbe 0x5258ba
lea eax, [ebp - 0x104]
push str.ERROR___FSEComm:_Invalid_connect_request_received._n
push eax
call fcn.004f9620
lea eax, [ebp - 0x104]
push eax
push 0
push 0
call sym.FLAMESLauncher.exe_FMHAnnounceError
push 0x593
push 0x5aa970
push esi
call sym.FLAMESLauncher.exe_FUtilityMemFreeWithTag
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
mov cl, byte [esi]
cmp cl, 0x44
je 0x525909
cmp cl, 0x43
mov edx, str.ERROR___FSEComm:_cannot_process_connect_request_from_older_interactive_client._Request_ignored_without_response._n
mov eax, str.ERROR___FSEComm:_Invalid_connect_request_received._n
cmove eax, edx
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.004f9620
lea eax, [ebp - 0x104]
push eax
push 0
push 0
call sym.FLAMESLauncher.exe_FMHAnnounceError
lea eax, [ebp - 0x169]
add esp, 0x14
cmp esi, eax
je 0x52585b
push 0x5b0
jmp 0x52584d
lea eax, [ebp - 0x169]
cmp esi, eax
je 0x525926
push 0x5b8
push 0x5aa970
push esi
call sym.FLAMESLauncher.exe_FUtilityMemFreeWithTag
add esp, 0xc
push 0x51
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
push dword [ebp - 0x170]
lea eax, [ebp - 0x114]
push eax
push 0
push 0x51
lea eax, [ebp - 0x168]
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
Function at 0x525970
Capabilities:
Get socket status
Read file on windows
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x10c], ecx
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
sub eax, 1
je 0x525a54
sub eax, 4
je 0x525a13
push 0
mov eax, edi
sub eax, esi
push eax
lea eax, [ecx + esi]
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x5259c3
add esi, eax
jmp 0x525a07
je case.0x525a3b.1
cmp eax, 0xffffffff
jne 0x525a07
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne case.0x525a3b.1
mov eax, dword [ebx + 4]
push 0
push 0
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x108]
push 0
push eax
push 0
mov dword [ebp - 0x108], 1
call dword [sym.imp.WS2_32.dll_select]
cmp esi, edi
jge 0x525a7c
mov ecx, dword [ebp - 0x10c]
jmp 0x5259a7
mov eax, edi
sub eax, esi
push eax
lea eax, [ecx + esi]
push eax
push dword [ebx + 0x14]
call fcn.0052f420
push eax
push dword [ebx + 0x14]
mov dword [ebp - 0x110], eax
call fcn.0052ec70
add esp, 0x14
cmp eax, 6
ja case.0x525a3b.1
jmp dword [eax*4 + 0x525a94]
add esi, dword [ebp - 0x110]
cmp esi, edi
jge 0x525a7c
mov ecx, dword [ebp - 0x10c]
jmp 0x525a13
push dword [ebx + 0x10]
push edi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, edi
jge 0x525a7c
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
Function at 0x525da0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 1
test esi, esi
je 0x525deb
mov eax, dword [esi]
sub eax, 2
je 0x525dc4
sub eax, 1
je 0x525dc4
sub eax, 2
jne 0x525deb
lea eax, [ebp - 4]
push eax
push 0x8004667e
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x525deb
mov dword [esi + 0xc], 0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x525e00
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x525e3d
mov eax, dword [ecx]
sub eax, 2
je 0x525e1b
sub eax, 1
je 0x525e1b
sub eax, 2
jne 0x525e3d
push 4
push 0x5aa84c
push 4
push 0xffff
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x525e3d
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x525eb0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x525ec0
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [esi]
mov ecx, eax
sub ecx, 2
je 0x525ed6
sub ecx, 3
je 0x525ed6
mov eax, 1
pop esi
pop ebp
ret
push ebx
mov ebx, dword [esi + 0xc]
push edi
test ebx, ebx
je 0x525f12
mov dword [ebp + 8], 1
sub eax, 2
je 0x525ef5
sub eax, 1
je 0x525ef5
sub eax, 2
jne 0x525f12
lea eax, [ebp + 8]
push eax
push 0x8004667e
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x525f12
mov dword [esi + 0xc], 0
mov eax, dword [esi]
sub eax, 2
je 0x525f1e
sub eax, 1
jne 0x525f42
push 2
push 0
push 0
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jns 0x525f42
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x525f42
xor edi, edi
jmp 0x525f47
mov edi, 1
test ebx, ebx
je 0x525f7a
mov eax, dword [esi]
sub eax, 2
je 0x525f5c
sub eax, 1
je 0x525f5c
sub eax, 2
jne 0x525f7a
push 0x5aa850
push 0x8004667e
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x525f7a
mov dword [esi + 0xc], 1
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x525f90
Capabilities:
Get socket status
Send data
Send data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x10c], ecx
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
dec eax
cmp eax, 4
ja case.0x525fbf.4
jmp dword [eax*4 + 0x5260d8]
push dword [ebx + 0x10]
push edi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, edi
jge 0x5260c1
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
push ebx
call sym.FLAMESLauncher.exe_FSECommCheck
add esp, 4
test eax, eax
je case.0x525fbf.4
nop
push 0
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x10c]
add eax, esi
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x526021
add esi, eax
jmp 0x52605b
cmp eax, 0xffffffff
jne 0x52605b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne case.0x525fbf.4
mov eax, dword [ebx + 4]
push 0
push 0
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0
mov dword [ebp - 0x108], 1
call dword [sym.imp.WS2_32.dll_select]
cmp esi, edi
jl 0x526000
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
push ebx
call sym.FLAMESLauncher.exe_FSECommCheck
add esp, 4
test eax, eax
je case.0x525fbf.4
push edi
push dword [ebp - 0x10c]
push dword [ebx + 0x14]
call fcn.0052f560
push eax
push dword [ebx + 0x14]
mov dword [ebp - 0x110], eax
call fcn.0052ec70
add esp, 0x14
cmp eax, 6
ja case.0x525fbf.4
jmp dword [eax*4 + 0x5260ec]
add esi, dword [ebp - 0x110]
cmp esi, edi
jl 0x526086
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret

Function at 0x5266f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x526709
mov eax, dword [eax]
test eax, eax
je 0x526709
mov dword [ebp + 8], eax
pop ebp
jmp sym.FLAMESLauncher.exe_FSECommDataAvailable
or eax, 0xffffffff
pop ebp
ret
Function at 0x528160
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x5281ce
push esi
call sym.FLAMESLauncher.exe_FOSUtilityFileExists
add esp, 4
test eax, eax
je 0x52829e
push esi
call sym.FLAMESLauncher.exe_FOSUtilityGetFileModificationTime
movsd xmm1, qword [ebp + 0x10]
add esp, 4
ucomisd xmm1, qword [0x5a4d78]
mov ebx, eax
lahf
test ah, 0x44
jnp 0x5281e1
movd xmm0, ebx
mov eax, ebx
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5a9c00]
subsd xmm1, xmm0
movsd xmm0, qword [ebp + 0x18]
comisd xmm0, xmm1
jbe 0x5281f6
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
movsd xmm0, qword [ebp + 0x18]
sub esp, 8
movsd qword [esp], xmm0
call sym.FLAMESLauncher.exe_FOSUtilityPauseProcessing
add esp, 8
push 0x59f94c
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x5281ce
push edi
lea eax, [ebp - 0x18]
push 0x11
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
add esp, 0xc
test eax, eax
je 0x52823f
lea ecx, [ebp - 0x18]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x528225
sub ecx, edx
cmp byte [ebp + ecx - 0x19], 0xa
jne 0x52823f
dec ecx
cmp ecx, 0x11
jae 0x5282b4
mov byte [ebp + ecx - 0x18], al
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea ecx, [ebp - 0x18]
mov eax, str.ADMIN
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x528271
test dl, dl
je 0x52826d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x528271
add eax, 2
add ecx, 2
test dl, dl
jne 0x528251
xor eax, eax
jmp 0x528276
sbb eax, eax
or eax, 1
test eax, eax
je 0x5281ce
push esi
call sym.FLAMESLauncher.exe_FOSUtilityGetFileModificationTime
add esp, 4
cmp ebx, eax
jne 0x52829e
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
cmp eax, 0xffffffff
je 0x5281ce
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
call fcn.0052c33d
int3
Function at 0x52a650
Capabilities:
Enumerate process modules
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1130
call fcn.0052c8c0
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 4
push 0x3000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x52a7fc
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x100
push str.No_error
push 0x400
mov ebx, eax
push ebx
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ecx, dword [0xa1c3c8]
cmp dword [ecx + 0x10], 0
je 0x52a7e9
push edi
push esi
push esi
push ebx
push str.Cannot_reserve_and_commit_memory__error__lu_:_Address__10lu___p__Size__10zu_n
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.0049cc60
add esp, 0x18
lea eax, [ebp - 0x1130]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x112c]
push str.System_page_size:__lu_n
call fcn.00453200
add esp, 8
mov dword [ebp - 0x112c], 0
lea eax, [ebp - 0x1130]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push dword [ebp - 0x112c]
push str.Native_system_page_size:__lu_n
call fcn.00453200
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
push esi
push str._nProcess_ID:__u_n
call fcn.00453200
add esp, 8
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x52a7e4
lea eax, [ebp - 0x110c]
push eax
push 0x1000
lea eax, [ebp - 0x1108]
push eax
push ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x52a7dd
mov edi, dword [ebp - 0x110c]
lea eax, [ebp - 0x1108]
push 0x52a1c0
push 4
shr edi, 2
push edi
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_qsort]
add esp, 0x10
xor esi, esi
test edi, edi
je 0x52a7dd
nop word [eax + eax]
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [ebp + esi*4 - 0x1108]
push ebx
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x52a7d8
lea eax, [ebp - 0x108]
push eax
push dword [ebp + esi*4 - 0x1108]
push str._t0x_08X____s_n
call fcn.00453200
add esp, 0xc
inc esi
cmp esi, edi
jb 0x52a7a0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0052a330
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 2
pop edi
xor ecx, ebp
pop esi
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
Function at 0x54dba0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.0052c8c0
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xbc]
xor ebp, ebp
push edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x30], eax
mov esi, dword [esi + 4]
mov dword [esp + 0x1c], esi
sub esi, edi
mov dword [esp + 0x10], esi
cmp dword [esp + 0xc8], edi
jae 0x54dc04
push str.orig_len___md_size
push 0xf8
push str.._ssl_s3_cbc.c
call fcn.00494a80
add esp, 0xc
cmp edi, 0x40
jbe 0x54dc20
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.00494a80
add esp, 0xc
mov ecx, dword [esp + 0xc8]
lea eax, [esp + 0x34]
neg eax
lea ebx, [esp + 0x34]
and eax, 0x3f
add ebx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0x20], ebx
cmp ecx, eax
jbe 0x54dc4e
mov ebp, ecx
sub ebp, edi
sub ebp, 0x100
mov eax, edi
xor edx, edx
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, esi
div edi
push edi
mov esi, edx
push 0
push ebx
mov dword [esp + 0x38], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x18], 0
cmp ebp, dword [esp + 0xc8]
jae 0x54dd2b
mov ecx, dword [esp + 0x1c]
mov esi, ebx
mov edx, dword [esp + 0x10]
mov eax, ecx
shr eax, 0x1f
sub ebp, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc0]
shr edx, 0x1f
mov dword [esp + 0x10], edx
mov eax, dword [eax + 0xc]
add eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
lea ebx, [ecx + ebp]
shr ebx, 0x1f
lea ecx, [edi + ebp]
shr ecx, 0x1f
xor cl, dl
xor dl, bl
or cl, dl
mov edx, ebp
xor cl, bl
shr edx, 0x1f
xor dl, byte [esp + 0x14]
dec cl
mov dword [esp + 0x28], ecx
mov cl, byte [eax + ebp]
mov al, bl
xor al, byte [esp + 0x14]
inc ebp
or dl, al
xor dl, bl
mov ebx, dword [esp + 0x18]
neg dl
and dl, cl
and dl, byte [esp + 0x28]
or byte [ebx + esi], dl
inc ebx
mov edx, dword [esp + 0x10]
mov ecx, ebx
sub ecx, edi
mov eax, ebx
xor ecx, edi
xor eax, edi
or ecx, eax
xor ecx, ebx
shr ecx, 0x1f
neg ecx
and ebx, ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ebx
lea eax, [ecx + ebp]
cmp eax, dword [esp + 0xc8]
jb 0x54dcb1
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x20]
xor edx, edx
test edi, edi
je 0x54dd5f
mov ebp, dword [esp + 0x30]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + ebx]
movzx eax, byte [esi + ebx]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x54dd35
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052bfb9
add esp, 0xa8
ret