joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ed350
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ad45e
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x230]
call fcn.00418f80
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str..
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea ecx, [ebp - 0x480]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0xffffffff
jne 0x4ed3ee
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00419320
jmp 0x4ed527
mov eax, 1
test eax, eax
je 0x4ed4fe
mov ecx, dword [ebp - 0x480]
and ecx, 0x10
je 0x4ed49c
push 0x6c0c9c
lea edx, [ebp - 0x454]
push edx
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
je 0x4ed436
push 0x6c0ca0
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x4ed455
lea ecx, [ebp - 0x480]
push ecx
mov edx, dword [ebp - 0x484]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4ed453
jmp 0x4ed4fe
jmp 0x4ed3ee
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x230]
call fcn.00415810
push 0x6c0ca8
lea ecx, [ebp - 0x230]
call fcn.0041a260
lea ecx, [ebp - 0x454]
push ecx
lea ecx, [ebp - 0x230]
call fcn.0041a260
lea ecx, [ebp - 0x230]
call fcn.0041b040
push eax
call fcn.004ed350
add esp, 4
jmp 0x4ed4df
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x230]
call fcn.00415810
push 0x6c0cac
lea ecx, [ebp - 0x230]
call fcn.0041a260
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x230]
call fcn.0041a260
lea ecx, [ebp - 0x230]
call fcn.0041b040
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x480]
push ecx
mov edx, dword [ebp - 0x484]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4ed4f9
jmp 0x4ed4fe
jmp 0x4ed3ee
mov eax, dword [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00419320
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x4f95a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4f95ea
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 8

Function at 0x4f9600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd0], 0xc8
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0xcc]
push ecx
lea edx, [ebp - 0xd4]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jne 0x4f966c
lea eax, [ebp - 0xcc]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004157b0
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 8

Function at 0x4f97a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00671990
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 8

Function at 0x4f9870
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4f98d2
cmp dword [ebp - 8], 1
je 0x4f98d2
cmp dword [ebp - 8], 7
je 0x4f98d2
cmp dword [ebp - 8], 2
je 0x4f98d2
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x503b50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x210]
push ecx
call fcn.00671f3d
add esp, 4
cmp eax, 0x104
jbe 0x503b89
xor eax, eax
jmp 0x503c95
mov edx, dword [ebp - 0x210]
push edx
call fcn.00671f3d
add esp, 4
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.0066eb10
add esp, 0xc
mov dword [ebp - 0x218], 0
jmp 0x503bec
mov edx, dword [ebp - 0x218]
add edx, 1
mov dword [ebp - 0x218], edx
push 0x5c
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x210]
lea edx, [ecx + eax*2]
push edx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x503c73
push 0x5c
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x210]
lea edx, [ecx + eax*2]
push edx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
push eax
call fcn.00671f3d
add esp, 4
sub eax, 1
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x21c]
sub eax, dword [ebp - 0x220]
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
push ecx
mov edx, dword [ebp - 0x210]
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0067400b
add esp, 4
jmp 0x503bdd
mov edx, dword [ebp - 0x214]
cmp edx, dword [ebp - 0x21c]
jge 0x503c90
mov eax, dword [ebp - 0x210]
push eax
call fcn.0067400b
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x504260
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6af438
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5042c8
mov ecx, dword [ebp + 0xc]
and ecx, 2
je 0x5042af
mov edx, dword [ebp + 8]
push edx
call fcn.00503cb0
add esp, 4
jmp 0x5042c8
mov ecx, dword [ebp - 0x2c]
call fcn.00503b20
mov eax, dword [ebp - 0x2c]
mov dword [eax + 8], 0xffffffff
xor eax, eax
jmp 0x5043b2
mov ecx, dword [ebp - 0x2c]
call fcn.00503b20
lea ecx, [ebp - 0x28]
call fcn.00419520
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
and ecx, 2
je 0x5042f4
push str.wrtb
lea ecx, [ebp - 0x28]
call fcn.0041a260
mov edx, dword [ebp + 0xc]
and edx, 1
je 0x504309
push 0x6dff6c
lea ecx, [ebp - 0x28]
call fcn.0041a260
mov eax, dword [ebp + 0xc]
and eax, 0x100
je 0x504322
push 0x6dff70
lea ecx, [ebp - 0x28]
call fcn.0041a260
jmp 0x50433a
mov ecx, dword [ebp + 0xc]
and ecx, 0x200
je 0x50433a
push 0x6dff74
lea ecx, [ebp - 0x28]
call fcn.0041a260
push 0x6dff78
lea edx, [ebp - 0x28]
push edx
call fcn.004292f0
add esp, 8
movzx eax, al
test eax, eax
je 0x50435f
push 0x6dff80
lea ecx, [ebp - 0x28]
call fcn.00415810
lea ecx, [ebp - 0x28]
call fcn.0041b040
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 4
push edx
call fcn.00673efc
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 4], 0
je 0x504393
mov dword [ebp - 0x30], 1
jmp 0x50439a
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00419320
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 8

Function at 0x5043d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x5043e6
cmp dword [ebp + 8], 0
jne 0x5043eb
or eax, 0xffffffff
jmp 0x504404
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.006736d9
add esp, 0x10
mov esp, ebp
pop ebp
ret 8

Function at 0x504500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x504516
cmp dword [ebp + 8], 0
jne 0x50451b
or eax, 0xffffffff
jmp 0x504534
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.00673e65
add esp, 0x10
mov esp, ebp
pop ebp
ret 8
Function at 0x5049e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6af46b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x778400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CommonCtrl.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0x25
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x30], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x34], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x38], edx
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 0x14]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x18]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.00504770
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x60
call fcn.00419520
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x78], 1
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x79], 1
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x80], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x84], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x50e8a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6afe28
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x778400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
call fcn.00513380
push 0x104
push 0
mov eax, dword [ebp - 0x10]
add eax, 0x30c4
push eax
call fcn.0066eb10
add esp, 0xc
lea ecx, [ebp + 0x10]
call fcn.0041af60
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x30c4
push ecx
call fcn.00673010
add esp, 8
mov edx, dword [0x786374]
and edx, 1
jne 0x50e92c
mov eax, dword [0x786374]
or eax, 1
mov dword [0x786374], eax
mov ecx, 0x786368
call fcn.004161e0
mov ecx, dword [ebp + 8]
mov dword [0x786368], ecx
mov edx, dword [ebp - 0x10]
mov dword [0x786370], edx
mov eax, dword [ebp + 0xc]
mov dword [0x78636c], eax
push 0
push 0
push 0x786368
push 0x513af0
push 0
push 0
call fcn.0066da1a
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x2d5c], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00419eb0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x50f350
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6aff30
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.00513380
cmp dword [ebp + 8], 0
je 0x50f392
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2c], 0
jne 0x50f39c
mov eax, 0x80004003
jmp 0x50f49a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2c]
push edx
call fcn.006712b9
add esp, 4
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0
mov dword [ebp - 0x30], 0x80004005
mov ecx, dword [ebp - 0x2c]
add ecx, 0x2fc0
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x50f46c
lea ecx, [ebp - 0x28]
call fcn.00419520
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
add edx, 0x2fc0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x50], esp
push edx
call fcn.00419d50
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x28]
push eax
call fcn.005136d0
add esp, 0x1c
mov ecx, dword [ebp - 0x2c]
add ecx, 0x30c4
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0x44], esp
push ecx
mov ecx, edx
call fcn.00419d50
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
lea edx, [ebp - 0x28]
push edx
call fcn.00417770
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00419320
cmp dword [ebp - 0x30], 0
jge 0x50f497
mov edx, dword [ebp - 0x2c]
mov byte [edx + 0x2d5c], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x2d64], 4
push 0
push 0
push 4
mov ecx, dword [ebp - 0x2c]
call fcn.00511940
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 4
Function at 0x510440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x513930
push 0
push 0
call fcn.0066da1a
add esp, 0x18
mov dword [ebp - 4], eax
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x513b70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x2d5c]
test ecx, ecx
jne 0x513b8e
xor eax, eax
jmp 0x513c76
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2d44], 0
je 0x513bde
cmp dword [ebp + 8], 0
je 0x513bde
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2d44]
push edx
call fcn.006740cb
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2d44]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00673e65
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
add ecx, dword [eax + 0x2d50]
adc edx, dword [eax + 0x2d54]
mov eax, dword [ebp - 4]
mov dword [eax + 0x2d50], ecx
mov dword [eax + 0x2d54], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0x2d54]
cmp edx, dword [ecx + 0x2d4c]
jb 0x513c55
ja 0x513c37
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0x2d50]
cmp edx, dword [ecx + 0x2d48]
jbe 0x513c55
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2d48]
mov dword [eax + 0x2d50], edx
mov ecx, dword [ecx + 0x2d4c]
mov dword [eax + 0x2d54], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2d48]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2d50]
push edx
push 3
mov ecx, dword [ebp - 4]
call fcn.00511940
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5152f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x460], ecx
cmp dword [ebp + 8], 0
jne 0x515316
xor eax, eax
jmp 0x5153a6
lea eax, [ebp - 0x45c]
push eax
mov ecx, dword [ebp - 0x460]
call fcn.00516cf0
mov ecx, dword [ebp + 8]
push ecx
push 0x400
push 1
lea edx, [ebp - 0x404]
push edx
call fcn.006736d9
add esp, 0x10
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0
je 0x515373
mov eax, dword [ebp - 0x464]
push eax
lea ecx, [ebp - 0x404]
push ecx
lea edx, [ebp - 0x45c]
push edx
mov ecx, dword [ebp - 0x460]
call fcn.00516d70
jmp 0x515328
mov eax, dword [ebp - 0x460]
push eax
lea ecx, [ebp - 0x45c]
push ecx
mov ecx, dword [ebp - 0x460]
call fcn.005154c0
push 0x10
mov edx, dword [ebp - 0x460]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0066e160
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 8
Function at 0x5153c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x5153e0
jmp 0x515417
push 0x6e170c
mov ecx, dword [ebp + 8]
push ecx
call fcn.00671539
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5153fc
jmp 0x515417
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
call fcn.005152f0
mov eax, 1
jmp 0x515432
cmp dword [ebp - 4], 0
je 0x515430
mov edx, dword [ebp - 4]
push edx
call fcn.006712b9
add esp, 4
mov dword [ebp - 4], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x516cf0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x10325476
mov esp, ebp
pop ebp
ret 4

Function at 0x516fd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.0066eb10
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.now_pos_is__d__n
lea eax, [ebp - 0x108]
push eax
call fcn.00517460
add esp, 0x10
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x10c]
add ecx, 8
call fcn.004efc80
test eax, eax
je 0x517057
push 0
mov edx, dword [ebp + 8]
push edx
push 0x64
mov ecx, dword [ebp - 0x10c]
add ecx, 8
call fcn.004efdd0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 8

Function at 0x517070
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.0066eb10
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str._n____Error_is__d__n
lea edx, [ebp - 0x108]
push edx
call fcn.00517460
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 0x10c]
add ecx, 8
call fcn.004efc80
test eax, eax
je 0x5170ff
push 0
mov eax, dword [ebp + 8]
push eax
push 0x65
mov ecx, dword [ebp - 0x10c]
add ecx, 8
call fcn.004efdd0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret 4
Function at 0x51e240
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x51e260
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x51e264
xor eax, eax
jmp 0x51e2a1
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call fcn.00545b90
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x51f1f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x51f240
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x51f23a
shr eax, 8
cmp al, 2
jne 0x51f23a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret
Function at 0x521fb0
Capabilities:
Create raw socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x778400]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x198], ecx
mov eax, dword [ebp - 0x198]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x198]
mov dword [ecx + 0x10], 0
lea edx, [ebp - 0x194]
push edx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x522012
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WSAStartup___failed:__d_n
call fcn.0066de6e
add esp, 8
jmp 0x5220c0
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov ecx, dword [ebp - 0x198]
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [ebp - 0x198]
mov word [edx + 8], ax
push 0
push 0
push 0
push 1
push 3
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov ecx, dword [ebp - 0x198]
mov dword [ecx], eax
mov edx, dword [ebp - 0x198]
cmp dword [edx], 0xffffffff
jne 0x52206c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WSASocket___failed:__d_n
call fcn.004e64c0
add esp, 8
jmp 0x5220c0
push 1
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x198]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
mov ecx, dword [ebp - 0x198]
mov dword [ecx + 0x10], 1
push 0x2c
call fcn.0066e7a4
add esp, 4
mov edx, dword [ebp - 0x198]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x198]
cmp dword [eax + 0xc], 0
jne 0x5220c0
mov ecx, dword [ebp - 0x198]
mov dword [ecx + 0x10], 0
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0066c98d
mov esp, ebp
pop ebp
ret