joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5131d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3870
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x164
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x48]
test eax, eax
je 0x5132b4
mov eax, dword [esi + 0x40]
lea ecx, [ebp - 0x2c]
push eax
push 0x665fac
push ecx
call fcn.005920ea
add esp, 0xc
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x2c]
push edx
mov edx, dword [esi + 0x48]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x14], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x513280
push eax
lea eax, [ebp - 0x170]
push str.Error_reading_registry__errCode___d._n
push eax
call fcn.005920ea
add esp, 0xc
lea ecx, [ebp - 0x170]
push ecx
mov ecx, esi
call fcn.00512ba0
mov eax, dword [esi + 0x38]
test eax, eax
je 0x513274
mov edx, dword [eax + 0x40]
mov dword [ebp - 0x20], edx
jmp 0x51327a
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x20], eax
mov ecx, dword [esi + 0x40]
mov dword [ebp - 0x24], ecx
mov edx, dword [esi + 0x24]
push 1
push 0
push 0
push edx
call fcn.00593f90
mov ecx, dword [esi + 0x1c]
xor edi, edi
add eax, ecx
mov ecx, dword [esi + 0x48]
adc edx, edi
push 0x10
mov dword [ebp - 0x18], edx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
push edx
push edi
lea eax, [ebp - 0x2c]
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x513c00
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d3918
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
mov ecx, 8
push 0
mov eax, dword [esi + 0x20]
sub ecx, eax
lea edx, [eax + esi + 0x18]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
call sub.WSOCK32.dll_recv
mov edi, eax
push str.recv_socks4_reply
push edi
mov ecx, esi
call fcn.00513450
test eax, eax
jne 0x513d74
mov ecx, dword [esi + 0x20]
add ecx, edi
mov eax, ecx
mov dword [esi + 0x20], ecx
cmp eax, 8
jge 0x513c73
mov eax, 0x2733
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 0x10
cmp byte [esi + 0x19], 0x5a
jne 0x513ce4
mov al, byte [esi + 0x18]
test al, al
je 0x513c84
cmp al, 4
jne 0x513ce4
push str.socks4:_reply_OK_n
mov ecx, esi
call fcn.005133a0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x513ccf
mov eax, dword [esi + 0x1c]
mov ecx, dword [esp + 0x20]
test eax, eax
mov dword [ecx], eax
jne 0x513cc4
mov edx, dword [esi + 0xd4]
push 1
push ecx
mov ecx, esi
mov eax, dword [edx + 0x130]
push eax
call fcn.00513530
test eax, eax
jne 0x513d74
mov ecx, dword [esp + 0x24]
mov ax, word [esi + 0x1a]
mov word [ecx], ax
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 0x10
mov edx, dword [0x68d01c]
mov dword [esp + 0x18], edx
mov eax, dword [esi + 0xa4]
mov dword [esp + 0x10], 0
test eax, eax
jne 0x513d06
mov eax, dword [esi + 0xa0]
mov eax, dword [eax]
mov ecx, dword [0x69207c]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.005a6a18
mov eax, dword [esp + 0x24]
add esp, 0xc
mov ecx, esi
push 1
push eax
call fcn.005132d0
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x8c]
call fcn.00518410
movsx edx, byte [esi + 0x19]
push edx
lea eax, [esp + 0x1c]
push str.Error_code___d_n
push eax
call fcn.005a6a18
mov ecx, dword [esp + 0x24]
add esp, 0xc
push ecx
mov ecx, esi
call fcn.005133a0
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.005adc4d
mov eax, 0x755d
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x10
Function at 0x513d90
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d3938
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
mov ecx, 2
push 0
mov eax, dword [esi + 0x20]
sub ecx, eax
lea edx, [eax + esi + 0x18]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
call sub.WSOCK32.dll_recv
mov edi, eax
push str.recv_socks5_init_reply
push edi
mov ecx, esi
call fcn.00513450
test eax, eax
jne 0x513eb9
mov ecx, dword [esi + 0x20]
add ecx, edi
mov eax, ecx
mov dword [esi + 0x20], ecx
cmp eax, 2
jge 0x513e03
mov eax, 0x2733
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 8
mov al, byte [esi + 0x19]
test al, al
je 0x513e0e
cmp al, 2
jne 0x513e18
cmp byte [esi + 0x18], 5
je 0x513e9d
push 0x692078
lea ecx, [esp + 0x1c]
call fcn.005ad9c2
mov ecx, dword [esp + 0x18]
push 1
push ecx
mov ecx, esi
mov dword [esp + 0x18], 0
call fcn.005132d0
mov edx, dword [esp + 0x18]
mov ecx, dword [esi + 0x8c]
push edx
call fcn.00518410
movsx eax, byte [esi + 0x19]
movsx ecx, byte [esi + 0x18]
push eax
push ecx
lea edx, [esp + 0x20]
push str.Sock_ver___d__reply___d_n
push edx
call fcn.005a6a18
mov eax, dword [esp + 0x28]
add esp, 0x10
mov ecx, esi
push eax
call fcn.005133a0
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.005adc4d
mov eax, 0x7580
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 8
push str.socks5:_init_reply_OK_n
mov ecx, esi
call fcn.005133a0
mov al, byte [esi + 0x19]
mov edx, dword [esp + 0x1c]
cmp al, 2
sete cl
mov byte [edx], cl
xor eax, eax
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 8
Function at 0x514170
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3970
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x10], esp
cmp eax, ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
je 0x5141cb
push eax
mov dword [ebp - 4], ebx
call fcn.005aa012
add esp, 4
jmp 0x5141c1
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x2c], ebx
mov eax, dword [esi + 0xa4]
mov dword [ebp - 0x14], ebx
cmp eax, ebx
je 0x5141df
mov edi, dword [eax]
mov dword [ebp - 0x18], edi
jmp 0x5141ec
mov eax, dword [esi + 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov edi, ecx
cmp dword [ebp + 0xc], ebx
je 0x5141fc
mov edx, dword [ebp + 0x10]
mov dword [esi + 0x30], ebx
mov dword [ebp - 0x14], edx
jmp 0x51420c
lea eax, [ebp - 0x14]
push ebx
push eax
push edi
mov ecx, esi
call fcn.00513530
mov dword [esi + 0x30], eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp + 0x10], ecx
lea edi, [ecx + 0xa]
push edi
call fcn.005a9fe9
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x514243
mov eax, 0x753b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [ebp + 0x18]
and ecx, 3
test edx, edx
rep stosb byte es:[edi], al
setne al
inc eax
mov byte [ebx], 5
mov byte [ebx + 1], al
mov byte [ebx + 2], 0
mov ecx, dword [esi + 0x30]
neg ecx
sbb cl, cl
and cl, 2
inc cl
mov byte [ebx + 3], cl
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x51428d
mov edx, dword [ebp - 0x14]
mov edi, 8
mov dword [ebx + 4], edx
jmp 0x5142c0
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp - 0x18]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebx + 4], dl
lea esi, [ebx + 5]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x1c]
lea edi, [edx + 5]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x5142cc
mov eax, dword [ebp + 0x14]
jmp 0x5142ea
mov eax, dword [esi + 0xa4]
test eax, eax
je 0x5142db
mov eax, dword [eax + 0xc]
jmp 0x5142e4
mov ecx, dword [esi + 0xa0]
mov eax, dword [ecx + 0x14]
push eax
call sub.WSOCK32.dll_htons
mov edx, dword [ebp + 8]
mov word [edi + ebx], ax
push str.sending_socks_CONNECT
add edi, 2
push 0
push edi
push ebx
push edx
call sub.WSOCK32.dll_send
push eax
mov ecx, esi
call fcn.00513450
push str.socks5:_sending_connect_n
mov ecx, esi
mov edi, eax
call fcn.005133a0
push ebx
call fcn.005aa012
add esp, 4
cmp edi, 0x2733
jne 0x51432e
xor edi, edi
jmp 0x514332
test edi, edi
jne 0x514339
mov dword [esi + 0x7c], 0x20
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x514350
Capabilities:
Send data
Send data on socket

Disassembly:
push 0xffffffffffffffff
push 0x5d3988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x68d01c]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xd4]
mov dword [esp + 0x1c], 0
mov ecx, dword [eax + 0x13c]
mov edx, dword [eax + 0x138]
push ecx
push edx
lea eax, [esp + 0x18]
push str.___s__s
push eax
call fcn.005a6a18
mov edx, dword [esp + 0x20]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x10
mov ebx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [edx], 1
mov ebp, ecx
mov ecx, dword [esi + 0xd4]
push str.sending_socks5_auth
mov edi, dword [ecx + 0x138]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
or ecx, 0xffffffff
mov byte [ebx + 1], dl
mov eax, dword [esi + 0xd4]
and edx, 0xff
mov edi, dword [eax + 0x13c]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push eax
mov byte [edx + ebx + 2], cl
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
push ebp
push ecx
push edx
call sub.WSOCK32.dll_send
push eax
mov ecx, esi
call fcn.00513450
push str.socks5:_sending_auth_n
mov ecx, esi
mov edi, eax
call fcn.005133a0
cmp edi, 0x2733
mov dword [esi + 0x20], 0
jne 0x514432
xor edi, edi
jmp 0x514436
test edi, edi
jne 0x51443d
mov dword [esi + 0x7c], 0x1f
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.005adc4d
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x514470
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d39a8
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
mov ecx, 2
push 0
mov eax, dword [esi + 0x20]
sub ecx, eax
lea edx, [eax + esi + 0x18]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
call sub.WSOCK32.dll_recv
mov edi, eax
push str.recv_socks5_init_reply
push edi
mov ecx, esi
call fcn.00513450
test eax, eax
jne 0x514588
mov ecx, dword [esi + 0x20]
add ecx, edi
mov eax, ecx
mov dword [esi + 0x20], ecx
cmp eax, 2
jge 0x5144e3
mov eax, 0x2733
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 4
mov al, byte [esi + 0x19]
test al, al
jne 0x514516
mov al, byte [esi + 0x18]
cmp al, 5
je 0x5144f5
cmp al, 1
jne 0x514516
push str.socks5:_auth_reply_OK_n
mov ecx, esi
call fcn.005133a0
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 4
push 0x692074
lea ecx, [esp + 0x1c]
call fcn.005ad9c2
mov ecx, dword [esp + 0x18]
push 1
push ecx
mov ecx, esi
mov dword [esp + 0x18], 0
call fcn.005132d0
mov edx, dword [esp + 0x18]
mov ecx, dword [esi + 0x8c]
push edx
call fcn.00518410
movsx eax, byte [esi + 0x19]
movsx ecx, byte [esi + 0x18]
push eax
push ecx
lea edx, [esp + 0x20]
push str.Sock_ver___d__reply___d_n
push edx
call fcn.005a6a18
mov eax, dword [esp + 0x28]
add esp, 0x10
mov ecx, esi
push eax
call fcn.005133a0
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.005adc4d
mov eax, 0x757f
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x5145a0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d39c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x498
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [esi + 0xd0]
mov ecx, 1
cmp eax, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x29c], edi
mov dword [ebp - 0x2a0], ecx
mov dword [ebp - 0x4a4], ebx
je 0x514612
mov edx, dword [eax]
mov dword [ebp - 0x2a0], 2
mov dword [ebp - 0x298], edx
mov edx, dword [eax]
mov dword [ebp - 0x4a0], edx
mov dword [ebp - 0x4a4], ecx
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x1c]
neg eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x4a4]
sbb eax, eax
push edx
and eax, ecx
lea edx, [ebp - 0x2a0]
push eax
push ebx
lea eax, [edi + 1]
push edx
push eax
mov dword [ebp - 0x18], ebx
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
jne 0x514693
call sub.WSOCK32.dll_WSAGetLastError
mov ebx, eax
push edi
push ebx
lea ecx, [ebp - 0x9c]
push str.Select_failed__err_code___d__socket___d_n
push ecx
call fcn.005920ea
add esp, 0x10
lea edx, [ebp - 0x9c]
mov ecx, esi
push edx
call fcn.005133a0
mov eax, dword [0x692c44]
mov ecx, dword [esi + 0x8c]
push eax
call fcn.00518410
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp eax, ebx
jne 0x514712
cmp dword [ebp + 0xc], ebx
je 0x5146be
mov ecx, dword [0x692c3c]
push ecx
mov ecx, dword [esi + 0x8c]
call fcn.00518410
mov edx, dword [0x692c3c]
push 1
push edx
mov ecx, esi
call fcn.005132d0
mov eax, 0x7532
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0xd0]
cmp eax, ebx
je 0x514760
mov edx, dword [eax]
lea ecx, [ebp - 0x4a4]
push ecx
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x514748
mov ecx, dword [esi + 0xd0]
lea eax, [ebp - 0x2a0]
push eax
mov edx, dword [ecx]
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x514760
mov eax, 0x7540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x516440
Capabilities:
Get disk size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d3aa8
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x54]
mov edx, eax
or edx, ecx
je 0x516486
mov ebp, dword [edi + 0x58]
mov ebx, dword [edi + 0x5c]
mov esi, dword [edi + 0x40]
mov edx, dword [edi + 0x44]
sub eax, ebp
sbb ecx, ebx
sub eax, esi
sbb ecx, edx
mov ebp, eax
mov dword [esp + 0x38], ecx
jmp 0x516493
mov ebp, 0x2da0
mov dword [esp + 0x38], 0
mov ecx, dword [edi + 0xa0]
push 0
push 0
lea eax, [esp + 0x34]
mov edx, dword [ecx + 0x30]
push 0
push eax
push edx
call fcn.0059249a
add esp, 0x14
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x5164d6
push str.GetDiskFreeSpaceExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5164da
mov ecx, 1
jmp 0x5164dc
mov eax, dword [esp + 0x1c]
xor ecx, ecx
or esi, 0xffffffff
or ebx, 0xffffffff
test ecx, ecx
je 0x51650a
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x34]
push ecx
push edx
call eax
test eax, eax
je 0x51653d
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
jmp 0x51653d
lea eax, [esp + 0x24]
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x51653d
mov esi, dword [esp + 0x10]
imul esi, dword [esp + 0x14]
imul esi, dword [esp + 0x1c]
xor ebx, ebx
mov edx, dword [esp + 0x38]
push 0
push 0xa
push edx
push ebp
call fcn.00593520
add eax, ebp
mov ebp, dword [esp + 0x38]
adc edx, ebp
cmp ebx, edx
jg 0x5165df
jl 0x516562
cmp esi, eax
ja 0x5165df
and esi, ebx
cmp esi, 0xffffffff
je 0x5165df
mov eax, dword [0x68d01c]
mov dword [esp + 0x10], eax
mov edx, dword [0x692c84]
lea ecx, [esp + 0x2c]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x50], 0
call fcn.005a6a18
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0x50030
push 0x666094
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Not_enough_disk_space_to_store_files_chunks__canceling_download._n
mov ecx, edi
call fcn.005133a0
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], 0xffffffff
call fcn.005adc4d
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x517260
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x5186e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov edi, ecx
mov dword [esp + 0x10], ebp
mov eax, dword [esi]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x18]
sub eax, 4
push ebp
push edx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [edi + 4]
sbb ecx, ebp
push eax
mov dword [esp + 0x28], ecx
call ebx
cmp eax, 0xffffffff
jne 0x51872d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test ebp, ebp
jne 0x518838
mov eax, dword [edi + 4]
lea ecx, [esp + 0x34]
push ebp
push ecx
lea edx, [esp + 0x24]
push 4
push edx
push eax
mov dword [esp + 0x48], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5188c9
cmp dword [esp + 0x34], 4
jne 0x5188c9
lea ecx, [esp + 0x1c]
push ecx
call fcn.005525b0
add esp, 4
cmp eax, ebp
jbe 0x5188c9
mov ecx, 0xfffffffc
xor edx, edx
sub ecx, eax
mov eax, 0xffffffff
sbb eax, edx
mov edx, dword [esi]
add edx, ecx
mov dword [esi], edx
mov ecx, dword [esi + 4]
adc ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, ebp
jl 0x5188c9
jg 0x5187a5
cmp ecx, ebp
jbe 0x5188c9
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 4]
push ebp
push edx
push ecx
push eax
mov dword [esp + 0x24], ecx
call ebx
cmp eax, 0xffffffff
jne 0x5187cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test ebp, ebp
jne 0x518838
mov eax, dword [edi + 4]
lea ecx, [esp + 0x34]
push ebp
push ecx
lea edx, [esp + 0x24]
push 0xc
push edx
push eax
mov dword [esp + 0x48], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5187f5
cmp dword [esp + 0x34], 0xc
jne 0x5188c9
mov al, byte [esp + 0x2c]
test al, al
mov al, byte [esp + 0x1c]
je 0x51880a
cmp al, 8
je 0x518822
jmp 0x5186f9
cmp al, 9
jne 0x5186f9
mov cl, byte [esp + 0x27]
and cl, 0xf0
cmp cl, 0x10
jne 0x5186f9
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jge 0x51884b
jmp 0x5186f9
mov ecx, edi
call fcn.00518570
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov ax, word [esp + 0x20]
mov cl, byte [esp + 0x22]
xor edx, edx
mov byte [esp + 0x2c], 0
mov word [esp + 0x2d], dx
mov word [esp + 0x2d], ax
mov byte [esp + 0x2f], dl
mov byte [esp + 0x2f], cl
mov edx, dword [esp + 0x2c]
push edx
call sub.WSOCK32.dll_ntohl
movsx ecx, byte [esp + 0x23]
mov edx, dword [esp + 0x38]
push 2
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x30], ebp
mov dword [edx], eax
mov ecx, dword [edi + 4]
lea eax, [esp + 0x30]
push eax
push ebp
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x5188bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebp
je 0x5188bd
mov ecx, edi
call fcn.00518570
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret 0x10
Function at 0x5188e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x18]
mov byte [eax], 0
mov edx, dword [esi + 4]
push 0
push ecx
push edi
push edx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
call ebp
cmp eax, 0xffffffff
jne 0x51893c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov dword [esp + 0x10], eax
je 0x51893c
mov ecx, esi
call fcn.00518570
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x20]
push 0
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x518976
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
cmp eax, ecx
jne 0x518976
mov edx, dword [esp + 0x34]
mov byte [edx], 1
mov eax, dword [esp + 0x28]
xor ecx, ecx
add eax, edi
lea edx, [esp + 0x18]
adc ecx, ebx
add eax, 4
push 0
push edx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [esi + 4]
adc ecx, 0
push eax
mov dword [esp + 0x28], ecx
call ebp
cmp eax, 0xffffffff
jne 0x5189c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x5189c0
mov ecx, esi
call fcn.00518570
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 0x18

Function at 0x5189e0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x5189ed
xor eax, eax
ret 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push ecx
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 0xc

Function at 0x518a20
Capabilities:
Get file size

Disassembly:
push ecx
mov eax, dword [ecx + 4]
push esi
cmp eax, 0xffffffff
jne 0x518a31
xor eax, eax
pop esi
pop ecx
ret 4
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], 0
cmp dword [esi], 0xffffffff
jne 0x518a70
mov eax, dword [esi + 4]
test eax, eax
jne 0x518a70
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x518a70
mov dword [esi], eax
mov dword [esi + 4], 0
xor eax, eax
pop esi
pop ecx
ret 4
mov edx, dword [esp + 4]
push 1
push 0
push 0
push edx
call fcn.00593f90
mov ecx, dword [esi]
add ecx, eax
mov dword [esi], ecx
mov eax, dword [esi + 4]
adc eax, edx
mov dword [esi + 4], eax
mov eax, 1
pop esi
pop ecx
ret 4