joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fe4a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x66308c]
test eax, eax
je 0x4fe538
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4fe4c6
cmp dword [eax + 4], 0
je 0x4fe4c6
add eax, 8
pop esi
ret
mov eax, dword [0x66308c]
test eax, eax
je 0x4fe547
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4fe534
mov esi, eax
test eax, eax
jne 0x4fe51d
movzx eax, byte [0x666470]
mov ecx, 0x10
mov edx, 4
call fcn.00407420
test eax, eax
je 0x4fe562
mov dword [eax], 0x66308c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x66308c]
test eax, eax
je 0x4fe556
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x66308c
call fcn.005a4800
jmp 0x4fe4af
mov ecx, 0x66308c
call fcn.005a4800
jmp 0x4fe4d0
mov ecx, 0x66308c
call fcn.005a4800
jmp 0x4fe515
mov ecx, 4
mov edx, 0x10
call fcn.0059eab0
int3

Function at 0x4ff350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x523f40
lea eax, [esi + 0x30]
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4ff463
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov dword [esi], eax
call fcn.004ff6d0
mov ecx, eax
or ecx, edx
je 0x4ff44f
push edx
push eax
push ebx
push dword [esi]
mov edi, edx
mov dword [esi + 0x20], edx
mov dword [esi + 0x1c], eax
call fcn.0059d2e0
mov ecx, edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 4], edx
mov dword [esi + 0x24], eax
imul ecx, eax
mul edi
add edx, ecx
mov ecx, edi
imul ecx, dword [esi + 4]
add ecx, edx
mov edx, dword [esi]
sub edx, eax
sbb ebx, ecx
mov eax, edx
imul ecx, ebx, 0x3b9aca00
mov ebx, 0x3b9aca00
mul ebx
add edx, ecx
push dword [esi + 0x20]
push edi
push edx
push eax
call fcn.0059d2e0
mov ebx, eax
mov eax, dword [esi + 0x24]
mov ecx, edx
mov edx, 0x3b9aca00
mul edx
mov edi, eax
imul eax, dword [esi + 4], 0x3b9aca00
add eax, edx
add edi, ebx
adc eax, ecx
push 0
push 0x3b9aca00
push eax
push edi
call fcn.0059d2e0
imul ecx, eax, 0xc4653600
add ecx, edi
mov edi, dword [esi + 0x30]
mov dword fs:[0], edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.attempt_to_divide_by_zerothere_is_no_such_thing_as_a_release_load
mov edx, 0x19
push 0x62934c
call fcn.0059ef30
call sub.kernel32.dll_GetLastError
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x38], 0
lea eax, [esi + 0x14]
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
push 0x62a048
push 0x628290
push eax
call fcn.0059f1c0
add esp, 0xc
ud2
Function at 0x500e50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x523f90
mov dword [ebp - 0x28], ecx
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jae 0x500ee0
jmp 0x500ece
jbe 0x500f6a
cmp esi, 0x201
jae 0x500ee0
mov dword [ebp - 0x2c], 0x200
lea ebx, [ebp - 0x44c]
mov edi, esi
jmp 0x500f1b
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x500f0c
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov edx, edi
push esi
call fcn.005a4a80
add esp, 4
mov edi, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x500f3a
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x500fa2
cmp esi, edi
jne 0x500ec0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x500fdf
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x500ece
jmp 0x500ee0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
cmp esi, edx
ja 0x500fff
lea ecx, [ebp - 0x4c]
mov edx, ebx
push esi
call fcn.00501830
add esp, 4
movsd xmm0, qword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
movsd xmm1, qword [ebp - 0x44]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jmp 0x500fb7
call sub.kernel32.dll_GetLastError
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x500fcb
mov ecx, dword [ebp - 0x24]
mov edx, 2
call fcn.00407480
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.internal_error:_entered_unreachable_codeC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.36.0_src_runtime_blocking_schedule.rs
mov edx, 0x28
push 0x62a090
call fcn.0059ef30
add esp, 4
jmp 0x50100e
mov ecx, esi
push 0x62a080
call fcn.0059eed0
add esp, 4
ud2
Function at 0x506180
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x5061cc
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x5061dc
mov dword [esi + 4], 0
jmp 0x5061ee
cmp eax, 0x103
je 0x506206
test eax, eax
js 0x5061f7
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x5061f1
mov eax, esp
mov dword [esp + 0x1c], 0x6299cc
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.004fc750
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.004fc880
mov ecx, 7
int 0x29
ud2
Function at 0x509c60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x6630bc]
test eax, eax
je 0x509d18
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x509c8c
cmp dword [eax + 4], 0
mov edi, eax
je 0x509c8c
add edi, 8
jmp 0x509d13
mov eax, dword [0x6630bc]
test eax, eax
je 0x509d27
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x509d11
mov esi, eax
test eax, eax
jne 0x509ce7
movzx eax, byte [0x666470]
mov ecx, 0xc
mov edx, 4
call fcn.00407420
test eax, eax
je 0x509d42
mov dword [eax], 0x6630bc
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x6630bc]
test eax, eax
je 0x509d36
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x509d13
test ecx, ecx
je 0x509d13
lock dec dword [ecx]
jne 0x509d13
call fcn.00509d60
jmp 0x509d13
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x6630bc
call fcn.005a4800
jmp 0x509c70
mov ecx, 0x6630bc
call fcn.005a4800
jmp 0x509c9a
mov ecx, 0x6630bc
call fcn.005a4800
jmp 0x509cdf
mov ecx, 4
mov edx, 0xc
call fcn.0059eab0
int3
Function at 0x50a750
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1a8
mov edi, dword [edx]
mov ebp, dword [edx + 4]
movzx ebx, word [edx + 8]
mov eax, dword [0x6663bc]
mov esi, ecx
cmp eax, 3
jne 0x50a8db
cmp ebp, 0x17f
ja 0x50a8ec
lea eax, [esp + 0x28]
push ebp
push edi
mov edi, eax
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp + 1]
cmp ebp, 6
mov byte [esp + ebp + 0x28], 0
ja 0x50a7b5
xor edx, edx
nop
cmp byte [esp + edx + 0x28], 0
je 0x50a84f
inc edx
cmp eax, edx
jne 0x50a7a0
jmp 0x50a8a5
lea ecx, [esp + 0x2b]
and ecx, 0xfffffffc
sub ecx, edi
je 0x50a7e8
je 0x50a7e8
xor edx, edx
nop word cs:[eax + eax]
nop
cmp byte [esp + edx + 0x28], 0
je 0x50a84f
inc edx
cmp ecx, edx
jne 0x50a7d0
lea edx, [ebp - 7]
mov dword [esp], ebx
cmp ecx, edx
jbe 0x50a7f0
jmp 0x50a82e
mov dword [esp], ebx
lea edx, [ebp - 7]
xor ecx, ecx
movdqa xmm0, xmmword [0x5a6460]
movdqa xmm1, xmmword [0x5a6470]
movq xmm2, qword [esp + ecx + 0x28]
movdqa xmm3, xmm2
paddd xmm3, xmm0
pandn xmm2, xmm3
pand xmm2, xmm1
movd edi, xmm2
pshufd xmm2, xmm2, 0x55
movd ebx, xmm2
or ebx, edi
jne 0x50a82e
add ecx, 8
cmp ecx, edx
jbe 0x50a800
mov ebx, dword [esp]
sub eax, ecx
je 0x50a8a5
lea edi, [esp + ecx + 0x28]
xor edx, edx
nop dword [eax + eax]
cmp byte [edi + edx], 0
je 0x50a84d
inc edx
cmp eax, edx
jne 0x50a840
jmp 0x50a8a5
add edx, ecx
cmp edx, ebp
jne 0x50a8a5
pxor xmm0, xmm0
lea eax, [esp + 4]
mov dword [esp + 4], 0
lea ecx, [esp + 8]
movdqu xmmword [esp + 8], xmm0
movdqu xmmword [esp + 0x18], xmm0
mov dword [esp + 0x10], 1
push eax
push ecx
push 0
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x50a8be
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
jmp 0x50a8ce
mov eax, dword [0x629108]
mov ecx, dword [0x62910c]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x50a8d0
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
xor eax, eax
mov word [esi + 0xc], bx
mov dword [esi], eax
add esp, 0x1a8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005a4cf0
cmp ebp, 0x17f
jbe 0x50a77f
mov ecx, esi
mov edx, edi
push ebx
push ebp
call fcn.005a4d40
add esp, 0x1b0
jmp 0x50a8d6
Function at 0x50b300
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x5241e0
mov esi, edx
mov edi, ecx
mov ecx, 8
mov edx, 4
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
movzx eax, byte [0x666470]
call fcn.00407420
test eax, eax
je 0x50b3db
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
push 0
push 0x10000
push ebx
push 0x50b450
push esi
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x50b37d
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x50b3ca
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x24], eax
push eax
mov dword [ebp - 0x20], ecx
call dword [ecx]
add esp, 4
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
cmp dword [eax + 4], 0
je 0x50b3b2
mov edx, dword [eax + 8]
mov ecx, dword [ebp - 0x24]
call fcn.00407480
mov ecx, dword [ebp - 0x28]
mov edx, 4
call fcn.00407480
call sub.kernel32.dll_GetLastError
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 8
mov dword [ebp - 0x10], 0
call fcn.0059eab0
ud2

Function at 0x50b570
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x524200
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x50b5ee
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.kernel32.dll_GetLastError
lea edx, [esi + 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], 0x629b9c
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x30]
mov edx, 0x629bc8
mov dword [esi + 0x2c], fcn.00505380
mov dword [esi + 0x3c], 1
call fcn.0059ede0
ud2
Function at 0x50e2a0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x6630cc]
test eax, eax
je 0x50e385
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x50e2d1
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x50e37a
mov eax, dword [0x6630cc]
test eax, eax
je 0x50e394
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x50e357
mov esi, eax
test eax, eax
jne 0x50e337
movzx eax, byte [0x666470]
mov ecx, 0x20
mov edx, 8
call fcn.00407420
test eax, eax
je 0x50e3af
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x6630cc
mov esi, eax
mov eax, dword [0x6630cc]
test eax, eax
je 0x50e3a3
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x50e35b
movaps xmm0, xmmword [esp]
jmp 0x50e369
xor esi, esi
jmp 0x50e37d
lea ecx, [esp + 0x10]
call fcn.0050b570
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x6630cc
call fcn.005a4800
jmp 0x50e2b8
mov ecx, 0x6630cc
call fcn.005a4800
jmp 0x50e2df
mov ecx, 0x6630cc
call fcn.005a4800
jmp 0x50e32f
mov ecx, 8
mov edx, 0x20
call fcn.0059eab0
int3
Function at 0x511906
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x511908
test al, 1
je 0x51191f
test al, 2
jne 0x511931
xor eax, 3
ret
push 0x23
pop edx
mov ecx, str.assertion_failed:_prev.is_running__
push 0x62c00c
call fcn.0059ef30
push 0x25
pop edx
mov ecx, 0x62c01c
push 0x62c044
call fcn.0059ef30

Function at 0x511fed
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push eax
mov bl, byte [esp + 0x10]
mov esi, ecx
mov ecx, edx
call fcn.005117af
mov eax, dword [eax]
movzx ecx, bl
mov edx, esp
mov dword [edx], ecx
push 4
push edx
push 1
push 6
push eax
call dword [sym.imp.ws2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x51202f
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
and word [esi + 1], 0
xor ecx, ecx
mov byte [esi + 3], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 4
pop esi
pop ebx
ret
Function at 0x512283
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov dword [esp], ecx
xor ecx, ecx
mov eax, dword [esp + 0x50]
cmp dword [edx + 8], 0xffffffff
lea ebp, [edx + 8]
mov edi, 0x7fffffff
mov esi, edx
mov dword [esp + 0x24], edx
cmove ebp, ecx
cmp eax, edi
cmovb edi, eax
mov dword [esp + 0x28], edi
lea edi, [esp + 0xc]
mov edx, dword [esi + 4]
mov ecx, edi
push dword [esp + 0x48]
call fcn.00511fdf
pop eax
mov edx, dword [esp + 0xc]
cmp edx, 2
je 0x5123f4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
test edx, edx
jne 0x5123fc
mov dword [esp + 0x2c], ecx
mov ecx, ebp
mov edx, 0x62ae78
mov dword [esp + 0x30], eax
call fcn.00441e84
push 0
push dword [esp + 0x2c]
push dword [esp + 0x54]
push dword [ebp]
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x51231b
mov dword [esp + 8], eax
mov byte [esp + 4], 4
jmp 0x5123af
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
xor eax, eax
lea ecx, [esp + 4]
mov byte [esp + 4], al
and word [esp + 5], 0
mov byte [esp + 7], al
mov dword [esp + 8], esi
call fcn.0042d298
cmp al, 0xd
jne 0x5123af
mov eax, dword [ebp + 4]
test eax, eax
je 0x5123a2
mov dword [esp + 0x20], esi
mov esi, dword [eax + 4]
mov edx, dword [eax]
lock inc dword [esi]
jle 0x51241e
add edx, 8
mov ecx, edi
push dword [eax + 0xc]
push dword [eax + 8]
push esi
call fcn.0044b1e6
add esp, 0xc
push 4
pop ecx
call fcn.004fbab9
cmp byte [esp + 0xc], 4
je 0x5123af
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 0x20]
cmp bl, 4
je 0x5123af
mov esi, dword [esp + 0x10]
xor ecx, ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
call fcn.004fbab9
jmp 0x5123c4
and dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
cmp bl, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
je 0x512406
lea ecx, [esp + 0x18]
call fcn.0050ee04
cmp al, 0xd
jne 0x51240e
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x24]
lea edx, [esp + 0x2c]
mov dword [esp + 0xc], ebx
mov ecx, esi
call fcn.00511dd7
push edi
call fcn.0040276f
pop eax
jmp 0x5122b5
mov eax, dword [esp]
mov byte [eax], 5
jmp 0x512416
mov edx, dword [esp]
mov dword [edx], ecx
mov dword [edx + 4], eax
jmp 0x512416
mov eax, dword [esp]
mov byte [eax], 4
jmp 0x512413
mov eax, dword [esp]
mov dword [eax], ebx
mov dword [eax + 4], esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x531ada
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
call fcn.0058c04b
test eax, eax
jne 0x531c35
push ebx
xor ebx, ebx
push esi
cmp byte [0x6631ac], bl
jne 0x531afc
mov esi, ebx
jmp 0x531b13
push 5
call dword [0x6631f0]
mov esi, eax
pop ecx
test esi, esi
je 0x531b13
push esi
call dword [0x6631f8]
pop ecx
mov ecx, dword [esp + 0x10]
test ecx, ecx
jle 0x531c37
test ebp, ebp
je 0x531c37
push edi
cmp dword [0x666570], ebx
jne 0x531bb5
push ebx
call fcn.00525c08
push 0x10
push str.expand_32_byte_kt3S
push 0x666570
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x10
test edi, edi
jne 0x531b63
push 0x2c
push ebx
push 0x666580
call sub.VCRUNTIME140.dll_memset
jmp 0x531b96
cmp dword [0x6632bc], ebx
je 0x531b8b
push 0x2c
push ebx
mov edi, 0x666580
push edi
call sub.VCRUNTIME140.dll_memset
push 4
push 0x6632bc
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x18
jmp 0x531b99
push 0x666580
push 0x2c
push edi
call dword [edi + 0x38]
add esp, 0xc
mov eax, dword [0x6665a0]
mov ecx, dword [esp + 0x14]
mov dword [0x6665ac], eax
mov dword [0x6665a0], ebx
mov byte [0x6665f0], bl
jmp 0x531bbb
mov bl, byte [0x6665f0]
movzx eax, bl
mov edi, 0x6665b0
cmp ecx, eax
jle 0x531c0a
test bl, bl
je 0x531be6
movzx eax, bl
push eax
push edi
push ebp
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [0x6665f0]
add esp, 0xc
sub dword [esp + 0x14], eax
add ebp, eax
inc dword [0x6665a0]
push 0x666570
push edi
call fcn.00538e81
pop ecx
pop ecx
mov ecx, dword [esp + 0x14]
mov bl, 0x40
mov byte [0x6665f0], bl
cmp ecx, 0x40
jg 0x531bc7
movzx eax, bl
sub eax, ecx
push ecx
add eax, edi
push eax
push ebp
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x20]
add esp, 0xc
sub byte [0x6665f0], cl
pop edi
test esi, esi
je 0x531c33
push esi
call dword [0x663200]
pop ecx
pop esi
pop ebx
pop ebp
ret
mov dword [0x666570], ebx
jmp 0x531c27
Function at 0x537159
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
push ebx
mov ebx, dword [esp + 0x68]
xor eax, eax
push ebp
mov ebp, dword [ebx + 0x34]
mov dword [esp + 0x1c], ebp
cmp word [ebx + 0x18], ax
jne 0x537181
push 0x1308b
call fcn.0055ed8e
pop ecx
jmp 0x537333
push esi
push edi
push eax
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x28]
push eax
push ebp
call fcn.00533dd2
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x53732f
mov eax, dword [esp + 0x78]
add eax, 4
mov dword [esp + 0x28], eax
mov eax, dword [ebx + 0x24]
push eax
push ebx
mov dword [esp + 0x18], eax
call dword [ebx + 0x4c]
mov edi, dword [esp + 0x24]
movzx eax, ax
push 0xd
push edi
mov dword [esp + 0x28], eax
call fcn.0059d067
lea eax, [esp + 0x20]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], eax
xor ecx, ecx
inc ecx
mov dword [esp + 0x64], 2
lea eax, [esp + 0x28]
mov dword [esp + 0x3c], ecx
push edi
mov dword [esp + 0x4c], eax
mov eax, dword [ebx + 0x3c]
push ecx
mov dword [esp + 0x54], eax
lea eax, [esp + 0x44]
push esi
push eax
call fcn.0055269b
mov esi, eax
add esp, 0x20
mov dword [esp + 0x14], esi
test esi, esi
je 0x537226
test edi, edi
je 0x53732f
push dword [edi + 0x48]
call fcn.0056ef66
pop ecx
jmp 0x53732f
movzx eax, word [edi + 0x12]
mov ecx, dword [ebp + 0x28]
sub ecx, eax
movzx eax, word [esp + 0x18]
sub ecx, eax
sub ecx, 2
mov dword [edi + 0x14], ecx
cmp byte [ebp + 0x11], 0
mov ebp, dword [esp + 0x70]
je 0x537282
lea eax, [esp + 0x14]
push eax
push dword [ebp + 4]
push 5
push dword [esp + 0x2c]
push dword [esp + 0x34]
call fcn.00551a5a
mov ax, word [esp + 0x2c]
add esp, 0x14
cmp ax, word [edi + 0x10]
jbe 0x53727e
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push edi
push edi
call fcn.00551b2f
add esp, 0x10
mov esi, dword [esp + 0x14]
movzx ecx, word [ebx + 0x18]
mov eax, dword [ebx + 0x40]
mov ax, word [eax + ecx*2 - 2]
mov ch, al
mov cl, ah
movzx eax, word [ebx + 0x1a]
movzx ecx, cx
and ecx, eax
add ecx, dword [ebx + 0x38]
mov dword [esp + 0x10], ecx
mov edx, ecx
lea eax, [ecx + 9]
mov ebx, eax
mov al, byte [ecx]
lea ecx, [edx + 1]
mov dword [esp + 0x10], ecx
test al, al
jns 0x5372bc
mov edx, ecx
cmp ecx, ebx
jb 0x5372a9
mov ebx, dword [esp + 0x74]
lea eax, [ecx + 9]
mov edx, dword [esp + 0x28]
mov edi, ecx
mov dword [esp + 0x24], eax
mov ebp, eax
mov al, byte [ecx]
lea ecx, [edi + 1]
mov byte [edx], al
inc edx
mov dword [esp + 0x10], ecx
test al, al
jns 0x5372e5
mov edi, ecx
cmp ecx, ebp
jb 0x5372cf
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x70]
test esi, esi
jne 0x53730e
push dword [ebx + 4]
mov eax, dword [esp + 0x7c]
sub edx, eax
push 0
push edx
push eax
movzx eax, word [ebp + 0x18]
push eax
push ebp
call fcn.005453c7
add esp, 0x18
mov esi, eax
movzx edx, byte [ebp + 9]
mov ecx, dword [ebp + 0x38]
add edx, 8
push dword [esp + 0x20]
add ecx, edx
push ecx
call fcn.0057333c
push dword [edi + 0x48]
call fcn.0056ef66
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
Function at 0x553a95
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x18]
mov esi, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov byte [esi + 0x10], 1
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push esi
call fcn.0056d352
add esp, 0x1c
cmp dword [ebp + 0x10], 0
jne 0x553ada
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push esi
call fcn.0056d352
add esp, 0x14
pop esi
pop ebp
ret