joyce8/EMBER2024-capa huggingface dataset:
Function at 0x500a60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push eax
lea eax, [ebp - 0x20]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x500a9a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [ebp - 0x24]
push 0x18
push 1
call dword [sym.imp.MSVCR120.dll_calloc]
mov esi, eax
add esp, 8
test esi, esi
je 0x500ae5
push edi
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x500ae5
push edi
lea ecx, [ebp - 0x20]
push ecx
push eax
call sub.MSVCR120.dll_memcpy
add esp, 0xc
mov dword [esi + 4], edi
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.MSVCR120.dll_free]
mov ecx, dword [ebp - 4]
add esp, 4
xor esi, esi
xor ecx, ebp
mov eax, esi
pop edi
pop esi
call fcn.00553510
mov esp, ebp
pop ebp
ret

Function at 0x500e80
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [esp + 0xc], ecx
test edi, edi
je 0x500ee9
test ebx, ebx
jle 0x500ee9
cmp byte [edi], 0
je 0x500ed2
mov eax, dword [edi + 0xc]
mov esi, dword [edi + 8]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub esi, eax
add ebx, esi
jns 0x500ee5
mov ecx, 0xf
call fcn.00503530
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
mov byte [edi], 1
mov ecx, dword [esp + 0xc]
xor esi, esi
test ebx, ebx
js 0x500f27
cmp dword [0x5c6da8], esi
je 0x500efc
mov ebx, 0x64
mov eax, 0x10624dd3
lea esi, [esp + 0x10]
imul ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x10], eax
imul eax, eax, 0x3e8
sub ebx, eax
imul eax, ebx, 0x3e8
mov dword [esp + 0x14], eax
cmp byte [ecx + 6], 0
je 0x500f35
lea eax, [ecx + 0x210]
jmp 0x500f37
xor eax, eax
cmp byte [ecx + 5], 0
je 0x500f45
lea edx, [ecx + 0x10c]
jmp 0x500f47
xor edx, edx
cmp byte [ecx + 4], 0
je 0x500f52
add ecx, 8
jmp 0x500f54
xor ecx, ecx
push esi
push eax
push edx
push ecx
push 0
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
cmp esi, 0xffffffff
jne 0x500f72
or esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
js 0x500f89
jne 0x500f89
mov ecx, 0xf
call fcn.00503530
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x500fa0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
cmp esi, 0xffffffff
jne 0x500fe2
mov ecx, 0xa
call fcn.00503530
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x324]
mov dword [ebp - 0x324], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x500fcf
push dword [edi + 4]
push dword [edi]
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x501024
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00503330
cmp eax, 0x10
jne 0x500fcf
xor eax, eax
mov dword [ebp - 0x320], 0xffffffff
push esi
lea ecx, [ebp - 0x320]
mov word [ebp - 0x31c], ax
mov byte [ebp - 0x31a], al
lea edx, [eax + 1]
call fcn.00500d20
add esp, 4
lea ecx, [ebp - 0x320]
mov edx, 2
push esi
call fcn.00500d20
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x320]
add esp, 4
or edi, 0xffffffff
push 0
call fcn.00500e80
add esp, 4
test eax, eax
jle 0x5010c3
push esi
lea edx, [edi + 2]
lea ecx, [ebp - 0x320]
call fcn.00500e50
add esp, 4
test eax, eax
je 0x5010c3
mov ecx, esi
call fcn.00500490
test eax, eax
jne 0x5010c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00503330
neg eax
sbb eax, eax
and edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00553510
mov esp, ebp
pop ebp
ret
Function at 0x5010e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x334
mov eax, dword [0x5c04b4]
xor eax, esp
mov dword [esp + 0x330], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edx
cmp edi, 0xffffffff
jne 0x501130
mov ecx, 0xa
call fcn.00503530
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x330]
xor ecx, esp
call fcn.00553510
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov word [esp + 0x24], cx
or esi, 0xffffffff
mov byte [esp + 0x26], cl
mov byte [esp + 0x10], cl
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
lea ecx, [ecx]
xor eax, eax
mov dword [esp + 0x20], 0xffffffff
cmp byte [esp + 0x24], al
push edi
setne al
dec eax
and dword [esp + 0x2c], eax
xor eax, eax
cmp byte [esp + 0x29], al
setne al
dec eax
and dword [esp + 0x130], eax
xor eax, eax
test cl, cl
lea ecx, [esp + 0x24]
setne al
xor edx, edx
dec eax
and dword [esp + 0x234], eax
call fcn.00500d20
mov edx, dword [ebp + 0x10]
lea eax, [esp + 0x14]
add esp, 4
lea ecx, [esp + 0x20]
push eax
call fcn.00500e80
add esp, 4
test eax, eax
jle 0x5011fb
xor eax, eax
test bl, 1
je 0x5011b9
mov eax, 1
test bl, 2
je 0x5011c1
or eax, 2
push eax
push dword [ebp + 8]
push dword [esp + 0x14]
push edi
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5011db
or esi, eax
jmp 0x5011e0
cmp esi, 0xffffffff
jne 0x5011fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00503330
cmp eax, 0x10
jne 0x5011fb
mov cl, byte [esp + 0x26]
jmp 0x501150
mov ecx, dword [esp + 0x33c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00553510
mov esp, ebp
pop ebp
ret
Function at 0x501220
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x334
mov eax, dword [0x5c04b4]
xor eax, esp
mov dword [esp + 0x330], eax
push ebx
mov ebx, edx
mov edx, ecx
mov dword [esp + 4], edx
push esi
push edi
cmp edx, 0xffffffff
jne 0x501273
mov ecx, 0xa
call fcn.00503530
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x330]
xor ecx, esp
call fcn.00553510
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
xor ecx, ecx
mov dword [esp + 0x20], 0xffffffff
mov edi, esi
mov word [esp + 0x24], cx
mov byte [esp + 0x26], cl
mov byte [esp + 0x10], cl
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
test esi, esi
je 0x501380
nop
cmp edi, 0xffffffff
je 0x501380
xor eax, eax
mov dword [esp + 0x20], 0xffffffff
cmp byte [esp + 0x24], al
push edx
setne al
mov edx, 1
dec eax
and dword [esp + 0x2c], eax
xor eax, eax
cmp byte [esp + 0x29], al
setne al
dec eax
and dword [esp + 0x130], eax
xor eax, eax
test cl, cl
lea ecx, [esp + 0x24]
setne al
dec eax
and dword [esp + 0x234], eax
call fcn.00500d20
mov edx, dword [ebp + 0x10]
lea eax, [esp + 0x14]
add esp, 4
lea ecx, [esp + 0x20]
push eax
call fcn.00500e80
add esp, 4
test eax, eax
jle 0x50136c
cmp byte [esp + 0x25], 0
je 0x50136c
lea eax, [esp + 0x12c]
push eax
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x50136c
mov ecx, dword [ebp + 0xc]
xor eax, eax
test cl, 1
je 0x501335
mov eax, 1
test cl, 2
je 0x50133d
or eax, 2
push eax
push esi
push ebx
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x50135a
cmp eax, 0xffffffff
je 0x50135a
add ebx, eax
sub esi, eax
jmp 0x50136f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00503330
cmp eax, 0x10
je 0x50136f
or edi, 0xffffffff
test esi, esi
je 0x501380
mov cl, byte [esp + 0x26]
mov edx, dword [esp + 0xc]
jmp 0x5012a0
mov ecx, dword [esp + 0x33c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00553510
mov esp, ebp
pop ebp
ret

Function at 0x501a70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x5c6a90], 0
je 0x501a8c
push dword [ebp + 8]
call fcn.005029e0
add esp, 4
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x501aa8
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x501ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [0x5c6a90], 0
push esi
push 0
je 0x501b04
xor eax, eax
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
push edx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push ecx
call dword [0x5c0268]
mov esi, eax
push esi
call dword [0x5c00a8]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jns 0x501afc
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x501af4
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x501bb0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x5c04b4]
xor eax, esp
mov dword [esp + 0x30], eax
cmp byte [0x5c6a90], 0
push esi
je 0x501c24
push 5
push 0x18
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [0x5c023c]
mov esi, eax
push esi
call dword [0x5c00a8]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jns 0x501c0c
or eax, 0xffffffff
or edx, eax
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00553510
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00553510
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x501c47
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x501bf7
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0xc]
pop esi
xor ecx, esp
call fcn.00553510
mov esp, ebp
pop ebp
ret
Function at 0x501d80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x567a6b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5c04b4]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
push edi
mov eax, dword [0x5c04b4]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
test edx, edx
je 0x501de3
mov eax, dword [edx]
test eax, eax
je 0x501de3
lea esp, [esp]
cmp eax, 1
je 0x501e28
mov eax, dword [edx + 4]
add eax, 8
add edx, eax
mov eax, dword [edx]
test eax, eax
jne 0x501dd0
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0x104
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x240], 0
lea eax, [esp + 0x14]
push eax
movzx eax, byte [0x5c6a90]
push eax
call fcn.00501550
add esp, 8
sub eax, 0
je 0x501e60
dec eax
je 0x501e2f
or esi, 0xffffffff
jmp 0x501e6b
call fcn.00502b40
jmp 0x501e92
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
call dword [0x5c015c]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
test edi, edi
je 0x501e6b
push dword [esp + 0x10]
call dword [0x5c0160]
jmp 0x501e6b
mov ecx, dword [esp + 0x14]
call fcn.00502b40
mov esi, eax
mov dword [esp + 0x240], 0xffffffff
lea ecx, [esp + 0x20]
mov eax, dword [esp + 0x14]
cmp eax, ecx
je 0x501e90
test eax, eax
je 0x501e90
push eax
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00553510
mov esp, ebp
pop ebp
ret
Function at 0x503840
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567b3b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], 0x104
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x21c], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x228]
push eax
call dword [0x5c015c]
push 0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test esi, esi
je 0x5038c1
push dword [ebp - 0x228]
call dword [0x5c0160]
test ebx, ebx
jne 0x5039a4
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x5039a4
cmp eax, 3
je 0x5038ea
cmp eax, 2
jne 0x50399f
push 0x5c
push edi
call dword [sym.imp.MSVCR120.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x50399f
sub eax, edi
lea ecx, [ebp - 0x224]
sar eax, 1
push eax
push edi
call fcn.0044c490
test al, al
jne 0x50391b
or esi, 0xffffffff
jmp 0x5039a6
mov eax, dword [ebp - 0x21c]
lea ecx, [ebp - 0x224]
inc eax
mov dword [ebp - 0x228], 0
push eax
call fcn.0044c4e0
test al, al
je 0x50399f
mov ecx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x224]
mov dx, word [ebp - 0x228]
mov word [eax + ecx*2], dx
mov ecx, dword [ebp - 0x224]
inc dword [ebp - 0x21c]
call fcn.00503840
test eax, eax
jne 0x50399f
lea eax, [ebp - 0x228]
push eax
call dword [0x5c015c]
push 0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
test esi, esi
je 0x503992
push dword [ebp - 0x228]
call dword [0x5c0160]
test edi, edi
jne 0x5039a4
call ebx
cmp eax, 0xb7
je 0x5039a4
or esi, 0xffffffff
jmp 0x5039a6
xor esi, esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x218]
mov eax, dword [ebp - 0x224]
cmp eax, ecx
je 0x5039cb
test eax, eax
je 0x5039cb
push eax
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret
Function at 0x503ee0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5c0754]
push ebx
mov ebx, dword [0x5c03e4]
push esi
push edi
mov dword [ebp - 0x11c], edx
mov edi, ecx
mov esi, 3
mov edi, edi
cmp eax, 0xffffffff
jne 0x503f41
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call ebx
test eax, eax
jne 0x503f7d
cmp dword [ebp - 0x108], 2
mov edx, dword [ebp - 0x11c]
sete al
mov dword [0x5c0754], eax
test eax, eax
setne cl
test cl, cl
je 0x503f82
mov ecx, dword [edi]
test ecx, ecx
je 0x503f82
push 0
lea eax, [ebp - 0x120]
push eax
mov eax, dword [edi + 0x14]
imul eax, dword [ebp + 8]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x503f7d
mov eax, dword [ebp - 0x120]
xor edx, edx
div dword [edi + 0x14]
cmp eax, 0xffffffff
jne 0x503f92
mov eax, dword [0x5c0754]
dec esi
test esi, esi
jle 0x503f8f
mov edx, dword [ebp - 0x11c]
jmp 0x503f10
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00553510
mov esp, ebp
pop ebp
ret

Function at 0x503fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5c0754]
push ebx
mov ebx, dword [0x5c03e4]
push esi
push edi
mov dword [ebp - 0x11c], edx
mov edi, ecx
mov esi, 3
mov edi, edi
cmp eax, 0xffffffff
jne 0x504011
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call ebx
test eax, eax
jne 0x50404d
cmp dword [ebp - 0x108], 2
mov edx, dword [ebp - 0x11c]
sete al
mov dword [0x5c0754], eax
test eax, eax
setne cl
test cl, cl
je 0x504052
mov ecx, dword [edi]
test ecx, ecx
je 0x504052
push 0
lea eax, [ebp - 0x120]
push eax
mov eax, dword [edi + 0x14]
imul eax, dword [ebp + 8]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x50404d
mov eax, dword [ebp - 0x120]
xor edx, edx
div dword [edi + 0x14]
cmp eax, 0xffffffff
jne 0x504062
mov eax, dword [0x5c0754]
dec esi
test esi, esi
jle 0x50405f
mov edx, dword [ebp - 0x11c]
jmp 0x503fe0
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00553510
mov esp, ebp
pop ebp
ret
Function at 0x5044c0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
push esi
mov esi, 0x80
mov dword [ebp - 4], esi
test bl, 1
je 0x5044ee
mov eax, closesocket
mov dword [ebp - 8], eax
mov ecx, ebx
and ecx, 2
je 0x5044fd
or eax, 0x40000000
mov dword [ebp - 8], eax
test bl, 0x10
je 0x50450a
or eax, 0x100080
mov dword [ebp - 8], eax
test bl, 0x20
je 0x504517
or eax, 0x100100
mov dword [ebp - 8], eax
test ebx, 0x100
je 0x504534
test ecx, ecx
je 0x50452b
test ebx, 0x10000
je 0x50453b
mov dword [ebp - 0xc], 1
jmp 0x50453b
mov dword [ebp - 0xc], 7
mov eax, dword [ebp + 0xc]
dec eax
cmp eax, 4
ja case.default.0x504548
jmp dword [eax*4 + 0x504680]
mov dword [ebp + 8], 1
jmp 0x50457a
mov dword [ebp + 8], 2
jmp 0x50457a
mov dword [ebp + 8], 3
jmp 0x50457a
mov dword [ebp + 8], 4
jmp 0x50457a
mov dword [ebp + 8], 5
test ebx, 0x40000
je 0x50458a
mov esi, 0x2000080
mov dword [ebp - 4], esi
lea eax, [ebp - 0x14]
push eax
call dword [0x5c015c]
mov dword [ebp - 0x18], eax
test ebx, 0x100000
je 0x5045a8
or esi, 0x8000000
mov dword [ebp - 4], esi
test ebx, 0x400000
je 0x5045b9
or esi, 0x40000000
mov dword [ebp - 4], esi
test ebx, 0x800000
je 0x5045ca
or esi, 0x20000000
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0x10]
mov eax, 0x66666667
imul esi
push edi
sar edx, 1
mov edi, edx
shr edi, 0x1f
add edi, edx
cmp edi, 0xc8
jge 0x5045eb
mov edi, 0xc8
mov ebx, dword [ebp - 8]
push 0
push dword [ebp - 4]
push dword [ebp + 8]
push 0
push dword [ebp - 0xc]
push ebx
push dword [ebp - 0x10]
call dword [0x5c008c]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x504654
lea ecx, [ecx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x504620
cmp eax, 2
jne 0x504654
test esi, esi
jle 0x504654
mov eax, esi
cmp edi, esi
jg 0x50462c
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [ebp - 4]
sub esi, edi
push dword [ebp + 8]
push 0
push dword [ebp - 0xc]
push ebx
push dword [ebp - 0x10]
call dword [0x5c008c]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
je 0x504610
cmp dword [ebp - 0x18], 0
pop edi
je 0x504664
push dword [ebp - 0x14]
call dword [0x5c0160]
mov ecx, dword [ebp + 0xc]
pop esi
pop ebx
lea eax, [ecx + 1]
neg eax
sbb eax, eax
and eax, ecx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5047e0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 4], ecx
push eax
or esi, 0xffffffff
call dword [0x5c015c]
mov edi, dword [ebp + 8]
mov ebx, eax
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x504810
xor esi, esi
jmp 0x50483c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x50483c
test byte [ebp + 0x10], 1
je 0x50483c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
neg eax
sbb eax, eax
not eax
and esi, eax
test ebx, ebx
je 0x504849
push dword [ebp - 8]
call dword [0x5c0160]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x504860
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
test eax, eax
je 0x504893
push eax
mov edx, esi
mov ecx, edi
call fcn.0052fa00
add esp, 4
jmp 0x5048a3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x5048de
cmp eax, esi
ja 0x5048de
lea eax, [ebp - 0x20c]
push eax
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x5048de
lea eax, [ebp - 0x20c]
mov edx, esi
push eax
mov ecx, edi
call fcn.0052fa00
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00553510
mov esp, ebp
pop ebp
ret

Function at 0x504900
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
mov esi, ecx
push eax
call dword [0x5c015c]
mov edi, eax
xor edx, edx
mov eax, dword [ebp + 8]
test al, 1
je 0x504922
mov edx, 1
test al, 2
je 0x504929
or edx, 2
test al, 4
je 0x504930
or edx, 4
test al, 8
je 0x504937
or edx, 0x10
test al, 0x10
je 0x504941
or edx, 0x400
test al, 0x20
je 0x50494b
or edx, 0x80
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
test edi, edi
je 0x504968
push dword [ebp - 4]
call dword [0x5c0160]
pop edi
lea eax, [esi - 1]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x504b60
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
or ebx, 0xffffffff
mov dword [ebp - 8], edi
test edx, edx
je 0x504c44
cmp dword [ebp + 0xc], 0x20
jne 0x504c44
cmp dword [edx], 0x4957494e
jne 0x504c44
lea eax, [ebp - 0x24]
test eax, eax
je 0x504ba5
mov eax, dword [edx + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
test eax, eax
je 0x504bb8
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
test eax, eax
je 0x504bcb
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 4]
test eax, eax
je 0x504bd7
mov esi, dword [edx + 0x1c]
jmp 0x504bda
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
call dword [0x5c015c]
push 0
push 0x80
push 3
push 0
push 3
push 0x100
push edi
mov dword [ebp + 8], eax
call dword [0x5c008c]
mov edi, eax
test edi, edi
je 0x504c2c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [0x5c001c]
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x504c3b
push dword [ebp - 0xc]
call dword [0x5c0160]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret