joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a4fec
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x18]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x4a6020
mov edx, dword fs:[0]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword fs:[0], edi
mov dword [ecx], edx
mov dword [ebp - 0x24], ecx
add ecx, 4
mov dword [ebp - 0x20], ecx
push eax
call fcn.004028e6
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
mov dword [edi + 8], 0
mov ecx, esi
call eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x38], eax
xor eax, eax
mov dword [ecx + 0x34], eax
mov dword [ecx + 0x30], eax
mov word [ecx + 0x3c], 0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4ab2fc
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov dword [ebp - 0x50], ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4ac590
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
lea ecx, [ebp + 0xc]
mov ecx, dword [ecx - 4]
mov dword [eax + 8], 0
lea eax, [ebp - 0x28]
push ecx
push eax
call fcn.00442942
add esp, 8
lea esi, [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.0040fd9c
lea ecx, [ebp - 0x28]
push 0xa
mov dword [ebp - 0x20], eax
push eax
push dword [esi + 0x44]
call fcn.004429e8
lea ecx, [ebp - 0x28]
call fcn.0040fd9c
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x70]
push 9
push dword [ebp - 0x20]
lea eax, [ebp + 8]
push dword [eax + 0x40]
call fcn.004429e8
lea ecx, [ebp - 0x70]
call fcn.0040fd9c
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x6c]
push 8
push dword [ebp - 0x20]
lea eax, [ebp + 8]
push dword [eax + 0x3c]
call fcn.004429e8
lea ecx, [ebp - 0x6c]
call fcn.0040fd9c
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x68]
push 7
push dword [ebp - 0x20]
lea eax, [ebp + 8]
push dword [eax + 0x38]
call fcn.004429e8
lea ecx, [ebp - 0x68]
call fcn.0040fd9c
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x64]
push 6
push dword [ebp - 0x20]
lea eax, [ebp + 8]
push dword [eax + 0x34]
call fcn.004429e8
lea ecx, [ebp - 0x64]
call fcn.0040fd9c
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x24]
push 5
push dword [ebp - 0x20]
lea eax, [ebp + 8]
push dword [eax + 0x30]
call fcn.00442956
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x24]
call fcn.004429e2
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x60]
push 4
push dword [ebp - 0x20]
lea eax, [ebp + 8]
push dword [eax + 0x2c]
call fcn.004429e8
lea ecx, [ebp - 0x60]
call fcn.0040fd9c
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x5c]
push 3
push dword [ebp - 0x20]
lea eax, [ebp + 8]
push dword [eax + 0x28]
call fcn.004429e8
lea ecx, [ebp - 0x5c]
call fcn.0040fd9c
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x58]
push 2
push dword [ebp - 0x20]
lea eax, [ebp + 8]
push dword [eax + 0x24]
call fcn.004429e8
lea ecx, [ebp - 0x58]
call fcn.0040fd9c
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x54]
push 1
push dword [ebp - 0x20]
lea eax, [ebp + 0xc]
push eax
call fcn.004429e8
lea ecx, [ebp - 0x54]
call fcn.00494c8c
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov ecx, dword [eax]
call fcn.004429ee
push dword [ebp - 0x4c]
push dword [ebp - 0x48]
push dword [ebp - 0x44]
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
push dword [ebp - 0x38]
push dword [ebp - 0x34]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
push dword [ebp - 0x20]
push eax
push dword [ebp - 0x50]
call fcn.00457b56
add esp, 0x30
mov esi, eax
lea ecx, [ebp - 0x24]
call fcn.004420e6
lea ecx, [ebp + 0xc]
call fcn.0043fda0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret 0x48
Function at 0x4b5ead
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4b61d0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov ecx, esi
call fcn.0043fd32
test edi, edi
je 0x4b5f27
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
inc eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x20], eax
push eax
push esi
call fcn.0044a5d6
lea esi, [ebp - 0x28]
mov ecx, esi
call fcn.0044a5dc
push dword [ebp - 0x20]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, esi
call fcn.0044a5e4
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4c58d4
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
lea ebx, [ebp - 0x18]
mov dword [ebx - 4], esp
mov dword [ebx + 8], 0xffffffff
mov dword [ebx + 4], 0x4c98f0
mov eax, dword fs:[0]
mov dword [ebx], eax
mov dword fs:[0], ebx
call fcn.00445ec4
mov dword [esi], 0x62aeb0
xor edi, edi
mov dword [esi + 8], edi
lea ecx, [esi + 0x10]
call fcn.00441a50
lea ecx, [esi + 0x18]
call fcn.00441a50
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0xfffffffd
lea ecx, [esi + 0x30]
call fcn.00461ee8
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x44], eax
mov dword [ebx + 8], edi
mov dword [ebp - 0x20], esi
mov ecx, esi
push dword [ebp + 8]
call fcn.004c5856
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x14

Function at 0x4c5aa4
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, ecx
lea edi, [ebp - 0x18]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x4c9900
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
call fcn.00445ec4
mov dword [ebx], 0x62aeb0
xor eax, eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
lea ecx, [ebx + 0x10]
call fcn.00441a50
lea ecx, [ebx + 0x18]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00451d04
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], 0xfffffffd
lea ecx, [ebx + 0x30]
call fcn.00461ee8
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x44], eax
lea esi, [ebp - 0x28]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00451d04
xor eax, eax
mov dword [edi + 8], eax
mov dword [ebp - 0x20], ebx
mov ecx, ebx
push esi
call fcn.004c5a00
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x4ca4c4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, ecx
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x4cd4a0
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
call fcn.00445ec4
mov dword [edi], 0x62b320
xor eax, eax
mov dword [edi + 0xc], eax
mov cl, byte [edi + 0x10]
and cl, 0xe0
or cl, 3
mov byte [edi + 0x10], cl
xorps xmm0, xmm0
movups xmmword [edi + 0x14], xmm0
mov dword [edi + 0x28], eax
mov dword [edi + 0x24], eax
movaps xmm1, xmmword [0x62b1b0]
movups xmmword [edi + 0x30], xmm1
movups xmmword [edi + 0x40], xmm1
movups xmmword [edi + 0x50], xmm1
movaps xmm1, xmmword [0x62b1c0]
movups xmmword [edi + 0x60], xmm1
movups xmmword [edi + 0x70], xmm0
movups xmmword [edi + 0x80], xmm0
movups xmmword [edi + 0x90], xmm0
mov dword [edi + 0xa0], 5
mov dword [edi + 0xa4], 0x6a
mov dword [edi + 0xa8], 1
mov dword [ebp - 0x20], edi
lea ecx, [edi + 0xac]
mov dword [esi + 8], eax
mov dword [ebp - 0x38], ecx
call fcn.004657ac
mov eax, dword [ebp - 0x20]
lea ecx, [eax + 0xb4]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x34], ecx
call fcn.004c0166
mov eax, dword [ebp - 0x20]
lea ecx, [eax + 0xbc]
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x30], ecx
call fcn.004c0166
mov dword [ebp - 0x10], 3
push 0xb
call fcn.004665c8
add esp, 4
mov ecx, dword [ebp - 0x20]
add ecx, 0xc4
mov dword [ebp - 0x2c], ecx
push eax
call fcn.00465f2a
mov dword [ebp - 0x10], 4
push 0x12
call fcn.004665c8
add esp, 4
mov ecx, dword [ebp - 0x20]
add ecx, 0xd8
mov dword [ebp - 0x28], ecx
push eax
call fcn.00465f2a
mov eax, dword [ebp - 0x20]
lea ecx, [eax + 0xec]
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x24], ecx
call fcn.0045da3a
mov eax, dword [ebp - 0x20]
lea ecx, [eax + 0xf4]
mov dword [ebp - 0x10], 6
call fcn.004657e0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x20]
mov byte [eax + 0xfc], 0
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4cd734
Capabilities:
Hide graphical window

Disassembly:
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [0x7c3824]
xor eax, esp
mov dword [esp + 0x40], eax
mov esi, esp
mov ecx, esi
call fcn.00461ee8
xor ebx, ebx
lea edi, [esp + 0x10]
mov ecx, edi
push esi
push ebx
push ebx
call fcn.004cd7e2
mov dword [edi + 4], ebx
mov ecx, dword [0x7cf088]
mov edx, 0x43b
push edi
call fcn.004cd85b
add esp, 4
test eax, eax
je 0x4cd7d0
push dword [esp + 0x18]
call fcn.0047c95c
add esp, 4
test eax, eax
je 0x4cd7d0
mov esi, eax
mov eax, dword [eax]
mov ecx, esi
call dword [eax + 0xf4]
test al, al
je 0x4cd7c2
push esi
call fcn.0046d8fd
add esp, 4
push 0x7c59d0
push eax
call fcn.0046131c
add esp, 8
test eax, eax
je 0x4cd7d0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x3b4]
test al, al
je 0x4cd7d0
push 0
push dword [0x7cf088]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.005db451
add esp, 0x44
pop esi
pop edi
pop ebx
ret
Function at 0x4cd95a
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, ecx
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x18]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x4ce120
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
call fcn.00445ec4
mov dword [ebx], 0x62b600
mov dword [ebp - 0x20], ebx
lea ecx, [ebx + 8]
mov dword [edi + 8], 0
mov dword [ebp - 0x24], ecx
push esi
call fcn.004028e6
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
movups xmm0, xmmword [eax]
mov ecx, dword [ebp - 0x20]
movups xmmword [ecx + 0x30], xmm0
mov dword [ecx + 0x40], esi
xor eax, eax
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], eax
mov dword [ebp - 0x10], 1
push edx
call fcn.004cda12
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x4d6122
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, ecx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x18]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x4d6d80
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
call fcn.00445ec4
mov dword [ebx], 0x62aeb0
lea ecx, [ebx + 0x10]
call fcn.00441a50
lea ecx, [ebx + 0x18]
call fcn.00441a50
lea ecx, [ebx + 0x30]
call fcn.00461ee8
mov dword [edi + 8], 0
mov dword [ebp - 0x20], ebx
mov ecx, ebx
push esi
call fcn.004c581c
mov ecx, dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.004c5856
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4d625c
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, ecx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x18]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x4d6d90
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
call fcn.00445ec4
mov dword [ebx], 0x62aeb0
lea ecx, [ebx + 0x10]
call fcn.00441a50
lea ecx, [ebx + 0x18]
call fcn.00441a50
lea ecx, [ebx + 0x30]
call fcn.00461ee8
mov dword [edi + 8], 0
mov dword [ebp - 0x20], ebx
mov ecx, ebx
push esi
call fcn.004c581c
mov ecx, dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.004c5982
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4f2ede
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
movzx ebx, byte [ebp + 0xc]
lea edi, [esi + 0x38]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x4f4a90
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
lea eax, [esi + 0x18]
mov dword [esp], eax
mov dword [esi + 0x14], ecx
call fcn.00472354
sub esp, 4
mov dword [edi + 8], 0
mov dword [esp + 4], ebx
lea eax, [esi + 0x20]
mov dword [esp], eax
lea ecx, [esi + 0x18]
call fcn.004ddf9a
sub esp, 8
lea ecx, [esi + 0x18]
call fcn.0044075a
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
mov eax, dword [eax + 0x4c]
mov dword [esi + 0x40], 1
call eax
fstp qword [esi + 0x28]
mov ecx, dword [ebp + 8]
movsd xmm0, qword [esi + 0x28]
movsd qword [esp + 8], xmm0
lea eax, [esi + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00472ade
sub esp, 0x10
lea ecx, [esi + 0x20]
call fcn.0044075a
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x501286
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, esp
mov dword [esi + 0x18], ebp
mov ebx, ecx
mov eax, dword [ebp + 8]
lea edi, [esi + 0x20]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x502dc0
mov ecx, dword fs:[0]
mov dword [edi], ecx
mov dword fs:[0], edi
mov ecx, ebx
push eax
call fcn.004ffd98
mov dword [ebx], 0x630400
mov dword [esi], ebx
lea ecx, [ebx + 0x18]
mov dword [edi + 8], 0
mov dword [esi + 0xc], ecx
call fcn.004fff02
mov eax, dword [esi]
lea ecx, [eax + 0x20]
mov dword [esi + 0x28], 1
mov dword [esi + 8], ecx
call fcn.004fffbe
mov eax, dword [esi]
lea ecx, [eax + 0x28]
mov dword [esi + 0x28], 2
mov dword [esi + 4], ecx
call fcn.0050007a
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [eax + 0x30], 1
mov dword [eax + 0x34], 2
mov dword [eax + 0x38], 0
mov byte [eax + 0x3c], 0
mov dword [eax + 0x40], ecx
test ecx, ecx
je 0x50134c
mov eax, dword [ecx]
mov eax, dword [eax + 0xc0]
mov dword [esi + 0x28], 3
call eax
fstp qword [esi + 0x10]
movsd xmm0, qword [esi + 0x10]
mov eax, dword [esi]
jmp 0x501354
movsd xmm0, qword [0x629af0]
movsd qword [eax + 0x48], xmm0
mov ecx, dword [esi + 0x20]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x501508
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x148
mov esi, esp
mov dword [esi + 0x130], ebp
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [esi + 0x138]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x502de0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
test al, al
je 0x5016be
mov dword [esi + 4], ebx
lea edi, [esi + 0x1c]
mov ecx, edi
call fcn.0045da4c
xor eax, eax
mov dword [esi + 0x140], eax
lea ecx, [esi + 0xb0]
push 0x64
push 0x3ff00000
push eax
push edi
call fcn.005023c2
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x50]
mov dword [esi + 0x140], 1
lea edx, [esi + 8]
push edx
call eax
mov dword [esi + 0x140], 2
lea ecx, [esi + 0xb0]
lea eax, [esi + 8]
push eax
call fcn.005024ce
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x68]
cvtsi2sd xmm0, eax
sub esp, 8
movsd qword [esp], xmm0
mov ecx, dword [esi]
call fcn.005024e6
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x58]
mov ecx, dword [esi]
push eax
call fcn.004c1bbc
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x5c]
mov ecx, dword [esi]
push eax
call fcn.005024f6
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x60]
mov ecx, dword [esi]
push eax
call fcn.00502506
lea ecx, [esi + 0x30]
push eax
call fcn.00502516
lea ecx, [esi + 8]
call fcn.0044075a
lea edi, [esi + 0xb0]
mov ecx, edi
call fcn.005025dc
lea ecx, [esi + 0x1c]
call fcn.0044075a
lea ecx, [esi + 0x30]
call fcn.004b4bb6
cmp eax, 0x69
jne 0x501662
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
mov dword [esi + 0x140], 3
push edi
call eax
test eax, eax
je 0x501662
lea ecx, [esi + 0x30]
push dword [esi + 0xb0]
push eax
call fcn.005025f8
lea edi, [esi + 0x30]
mov ecx, edi
call fcn.004b4bb6
mov dword [esi + 0x140], 3
cmp eax, 0x6e
jne 0x501696
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x54]
lea edi, [esi + 0x30]
test eax, eax
je 0x501696
lea ecx, [esi + 0x30]
push eax
call fcn.0050260e
lea edi, [esi + 0x30]
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
push edi
push dword [ebp + 8]
call dword [eax + 0xe8]
lea ecx, [esi + 0x30]
call fcn.005025dc
mov eax, dword [esi + 0x138]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x5016d3
mov ecx, edi
call fcn.004fff02
mov eax, dword [esi + 0x138]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x519650
Capabilities:
Initialize winsock library

Disassembly:
push esi
sub esp, 0x194
mov eax, dword [0x7c3824]
xor eax, esp
mov dword [esp + 0x190], eax
test byte [esp + 0x19c], 2
jne 0x5196db
call fcn.0057de60
mov esi, eax
test eax, eax
jne 0x519707
push str.iphlpapi.dll
call fcn.00519720
add esp, 4
mov dword [0x7d0ce4], eax
test eax, eax
je 0x5196a9
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5196a9
mov dword [0x7d0ce0], eax
sub esp, 0x14
movaps xmm0, xmmword [0x631bd0]
movups xmmword [esp], xmm0
mov dword [esp + 0x10], 3
call fcn.0057e0b0
add esp, 0x14
mov byte [0x7d0ce8], al
push 0x7d0cf0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor esi, esi
jmp 0x519707
mov eax, esp
push eax
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x519702
movzx eax, word [esp]
cmp eax, 0x202
je 0x51966f
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov esi, 2
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.005db451
mov eax, esi
add esp, 0x194
pop esi
ret

Function at 0x519720
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
push 0x67e768
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edi, edi
test eax, eax
je 0x51982e
mov ebx, eax
mov ebp, dword [esp + 0x14]
push 0x665f76
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x67eb56
push ebp
call fcn.005ffca1
add esp, 8
test eax, eax
je 0x519767
test esi, esi
je 0x51978a
push 8
jmp 0x519780
test esi, esi
je 0x519796
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x519796
push 0x800
push 0
push ebp
call esi
jmp 0x519830
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x519830
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x51982e
mov ebp, eax
push dword [esp + 0x14]
call fcn.005ff144
add esp, 4
add eax, ebp
add eax, eax
add eax, 2
push eax
call dword [0x7c387c]
add esp, 4
mov ebx, eax
xor edi, edi
test eax, eax
je 0x519824
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x519824
push ebx
call fcn.005ff144
add esp, 4
lea eax, [ebx + eax*2]
push 0x67b350
push eax
call fcn.005ffc02
add esp, 8
push ebx
call fcn.005ff144
add esp, 4
lea eax, [ebx + eax*2]
push dword [esp + 0x14]
push eax
call fcn.005ffc02
add esp, 8
test esi, esi
je 0x51981b
push 8
push 0
push ebx
call esi
jmp 0x519822
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0x7c3880]
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x51ae20
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x51ae41
nop dword [eax + eax]
cmp byte [ecx], 0
lea ecx, [ecx + 1]
sete al
setns dl
xor dl, al
jne 0x51ae30
ret
mov al, 1
ret
Function at 0x51ecd0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
cmp byte [edi + 0x722], 0
je 0x51ed58
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
cmp dword [edi + 0x1b0], 0
je 0x51ed25
push 1
push edi
call fcn.00522800
add esp, 8
push dword [edi + 0x14c]
push ebx
push esi
push ebp
push edi
call dword [edi + 0x1b0]
add esp, 0x14
mov esi, eax
push 0
push edi
call fcn.00522800
add esp, 8
mov eax, esi
jmp 0x51ed5a
cmp ebp, 2
ja 0x51ed58
lea eax, [ebp*2 + 0x631cd0]
add eax, ebp
push dword [edi + 0x148]
push 1
push 2
push eax
call fcn.005fd8f2
add esp, 0x10
push dword [edi + 0x148]
push 1
push ebx
push esi
call fcn.005fd8f2
add esp, 0x10
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x51eea0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push edi
push esi
sub esp, 0x104
mov ebx, dword [esp + 0x124]
mov esi, dword [esp + 0x114]
mov eax, dword [esp + 0x118]
mov ecx, dword [0x7c3824]
xor ecx, esp
mov dword [esp + 0x100], ecx
mov edx, dword [esi + 0xc]
mov edi, dword [edx + eax*4 + 0x148]
mov ecx, esi
push eax
call fcn.0051ef80
add esp, 4
test eax, eax
je 0x51eef3
mov dword [ebx], 0x1b
mov edi, 0xffffffff
jmp 0x51ef2c
push 0
push dword [esp + 0x124]
push dword [esp + 0x124]
push edi
call dword [sym.imp.WSOCK32.dll_send]
mov edi, eax
mov dword [ebx], 0
cmp eax, 0xffffffff
jne 0x51ef2c
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x51ef46
mov dword [ebx], 0x51
xor edi, edi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.005db451
mov eax, edi
add esp, 0x104
pop esi
pop edi
pop ebx
ret
mov edi, eax
mov eax, esp
push 0x100
push eax
push edi
call fcn.00589dd0
add esp, 0xc
push eax
push str.Send_failure:__s
push esi
call fcn.0051ed60
add esp, 0xc
mov dword [esi + 0x974], edi
mov dword [ebx], 0x37
jmp 0x51eeec
Function at 0x51ef80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [edx + 0x2a0]
xor esi, esi
test byte [eax + 0x44], 3
je 0x51f07c
mov edi, edx
mov ebp, dword [esp + 0x1c]
cmp dword [edx + ebp*4 + 0x160], 0x51f0f0
jne 0x51f07c
mov ebx, ecx
mov eax, dword [edi + ebp*4 + 0x148]
shl ebp, 4
mov ecx, dword [edi + ebp + 0x174]
sub ecx, dword [edi + ebp + 0x178]
jne 0x51efda
cmp dword [edi + ebp + 0x170], 0
jne 0x51f07c
mov dword [esp], ecx
sub esp, 0x14
movaps xmm0, xmmword [0x62b1d0]
movups xmmword [esp + 4], xmm0
mov dword [esp + 0x18], eax
mov dword [esp], eax
call fcn.0058a680
add esp, 0x14
cmp eax, 0xffffffff
je 0x51f07c
and eax, 1
je 0x51f07c
lea edx, [edi + ebp]
add edx, 0x178
mov eax, dword [edx - 8]
test eax, eax
je 0x51f01e
mov ecx, dword [edx]
mov ebx, edx
mov edx, dword [esp]
jmp 0x51f05f
lea ecx, [edi + ebp]
add ecx, 0x174
mov eax, dword [ebx + 0x4e8]
add eax, eax
mov dword [esp], ecx
mov dword [ecx], eax
push eax
mov ebx, edx
call dword [0x7c387c]
add esp, 4
mov dword [ebx - 8], eax
test eax, eax
je 0x51f077
mov dword [ebx], 0
mov dword [edi + ebp + 0x17c], 0
mov ecx, dword [esp]
mov edx, dword [ecx]
xor ecx, ecx
add ecx, eax
push 0
push edx
push ecx
push dword [esp + 0x10]
call dword [sym.imp.WSOCK32.dll_recv]
test eax, eax
jle 0x51f07c
add dword [ebx], eax
jmp 0x51f07c
mov esi, 0x1b
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret