joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58b670
Capabilities:
Set socket configuration

Disassembly:
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 0xd0], 0x4901fb2a
je 0x58b69d
mov ecx, dword [esp + 0x10]
push str.Internal_error:_Socket_object_already_deleted.
mov eax, dword [ecx]
call dword [eax + 0x14]
push 0
call fcn.004ee350
add esp, 4
pop esi
pop ebx
ret 8
mov eax, dword [esp + 0xc]
mov ecx, dword [ebx + 0xd8]
lea esi, [ebx + 0xd8]
cmp ecx, eax
je 0x58b720
test eax, eax
je 0x58b720
cmp eax, 0x1000
jb 0x58b720
cmp eax, 0x800000
jbe 0x58b6c8
mov eax, 0x800000
shr eax, 0xc
shl eax, 0xc
mov dword [esi], eax
mov eax, dword [ebx + 0x294]
cmp eax, 0xffffffff
je 0x58b720
push edi
mov edi, dword [esp + 0x14]
mov al, byte [edi + 0x121]
test al, al
je 0x58b705
mov edx, dword [edi]
push str.Setting_SO_SNDBUF_size
mov ecx, edi
call dword [edx + 0x18]
mov eax, dword [esi]
mov ecx, edi
push eax
push str.sendBufSize
call fcn.004effe0
mov ecx, dword [ebx + 0x294]
push 4
push esi
push 0x1001
push 0xffff
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
pop edi
pop esi
pop ebx
ret 8

Function at 0x58b7f0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push esi
mov esi, ecx
cmp dword [esi + 0x294], 0xffffffff
je 0x58b85d
mov al, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
test al, al
mov al, byte [ecx + 0x121]
mov dword [esp + 4], 1
mov dword [esp + 8], 0
je 0x58b837
test al, al
je 0x58b82f
mov eax, dword [ecx]
push str.Turning_on_TCP_NODELAY.
call dword [eax + 0x18]
push 4
lea ecx, [esp + 8]
jmp 0x58b84b
test al, al
je 0x58b845
mov eax, dword [ecx]
push str.Turning_off_TCP_NODELAY.
call dword [eax + 0x18]
push 4
lea ecx, [esp + 0xc]
mov edx, dword [esi + 0x294]
push ecx
push 1
push 6
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
add esp, 8
ret 8

Function at 0x58b870
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 0x294]
cmp eax, 0xffffffff
jne 0x58b88a
xor al, al
pop esi
add esp, 0x14
ret 8
mov dl, byte [esp + 0x1c]
xor ecx, ecx
cmp dl, cl
mov dword [esp + 4], 1
mov dword [esp + 8], ecx
je 0x58b8fc
push ecx
lea edx, [esp + 0x20]
push ecx
push edx
push ecx
mov dword [esp + 0x2c], ecx
push ecx
lea ecx, [esp + 0x20]
push 0xc
push ecx
push 0x98000004
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], 0x7148
mov dword [esp + 0x34], 0x1d0d8
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov eax, dword [esi + 0x294]
lea edx, [esp + 4]
push 4
push edx
push 8
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov al, 1
pop esi
add esp, 0x14
ret 8
lea ecx, [esp + 8]
push 4
push ecx
push 8
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov al, 1
pop esi
add esp, 0x14
ret 8
Function at 0x58c9e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push 0xffffffffffffffff
push 0x651618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, ecx
push str.ck_getsockname_ipv4
push esi
lea ecx, [esp + 0x18]
call fcn.004f0370
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x34], 0
mov ecx, ebx
call fcn.004e3d50
mov ebp, dword [esp + 0x40]
mov dword [ebp], 0
mov eax, dword [edi + 0x294]
or edi, 0xffffffff
cmp eax, edi
je 0x58caad
lea ecx, [esp + 0x44]
lea edx, [esp + 0x1c]
push ecx
push edx
push eax
mov dword [esp + 0x50], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, edi
je 0x58ca94
test eax, eax
jl 0x58ca94
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
mov ecx, ebx
call fcn.004e8b00
mov ecx, dword [esp + 0x1e]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
lea ecx, [esp + 0x10]
mov dword [ebp], eax
mov dword [esp + 0x34], edi
call fcn.004f03e0
mov al, 1
jmp 0x58cac8
mov edx, dword [esi]
push str.Failed_to_getsockname
mov ecx, esi
call dword [edx + 0x14]
push esi
push 0
call fcn.0058c280
add esp, 8
jmp 0x58cab9
mov eax, dword [esi]
push str.Cannot_get_socket_name:_INVALID_SOCKET.
mov ecx, esi
call dword [eax + 0x14]
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], edi
call fcn.004f03e0
xor al, al
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc

Function at 0x58cae0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push 0xffffffffffffffff
push 0x651638
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4c]
push edi
mov edi, ecx
push str.ck_getsockname_ipv6
push esi
lea ecx, [esp + 0x18]
call fcn.004f0370
mov ebx, dword [esp + 0x48]
mov dword [esp + 0x40], 0
mov ecx, ebx
call fcn.004e3d50
mov ebp, dword [esp + 0x4c]
mov dword [ebp], 0
mov eax, dword [edi + 0x294]
or edi, 0xffffffff
cmp eax, edi
je 0x58cbb1
lea ecx, [esp + 0x50]
lea edx, [esp + 0x1c]
push ecx
push edx
push eax
mov dword [esp + 0x5c], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, edi
je 0x58cb98
test eax, eax
jl 0x58cb98
mov ecx, ebx
call fcn.004e3d50
lea eax, [esp + 0x24]
push ebx
push eax
push 0x17
call fcn.0058aa20
mov ecx, dword [esp + 0x2a]
add esp, 0xc
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
lea ecx, [esp + 0x10]
mov dword [ebp], eax
mov dword [esp + 0x40], edi
call fcn.004f03e0
mov al, 1
jmp 0x58cbcc
mov edx, dword [esi]
push str.Failed_to_getsockname_ipv6
mov ecx, esi
call dword [edx + 0x14]
push esi
push 0
call fcn.0058c280
add esp, 8
jmp 0x58cbbd
mov eax, dword [esi]
push str.Cannot_get_socket_name:_INVALID_SOCKET.
mov ecx, esi
call dword [eax + 0x14]
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], edi
call fcn.004f03e0
xor al, al
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0xc
Function at 0x58cbf0
Capabilities:
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x65166e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf4
push ebx
push ebp
push esi
mov esi, dword [esp + 0x114]
push edi
push str.ck_gethostbyname
push esi
lea ecx, [esp + 0x18]
call fcn.004f0370
mov dword [esp + 0x10c], 0
call fcn.0058afc0
test al, al
je 0x58ce69
mov edi, dword [esp + 0x114]
mov ebx, dword [sym.imp.WS2_32.dll_gethostbyname]
push edi
call ebx
mov ebp, eax
test ebp, ebp
je 0x58cc6e
lea ecx, [esp + 0x10]
mov dword [esp + 0x10c], 0xffffffff
call fcn.004f03e0
mov eax, ebp
jmp 0x58ce7f
push esi
push 0
call fcn.0058c280
mov eax, dword [esi]
add esp, 8
mov ecx, esi
push edi
push str.gethostbyname_arg
call dword [eax + 0x2c]
lea ecx, [esp + 0x90]
call fcn.004e57f0
push edi
lea ecx, [esp + 0x94]
mov byte [esp + 0x110], 1
call fcn.004e5040
lea ecx, [esp + 0x1c]
call fcn.004e57f0
push edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x110], 2
call fcn.004e5040
lea ecx, [esp + 0x1c]
call fcn.004e2b40
push 0x20
lea ecx, [esp + 0x20]
call fcn.004e8d90
push 9
lea ecx, [esp + 0x20]
call fcn.004e8d90
push 0xd
lea ecx, [esp + 0x20]
call fcn.004e8d90
push 0xa
lea ecx, [esp + 0x20]
call fcn.004e8d90
push 0x27
lea ecx, [esp + 0x20]
call fcn.004e8d90
push 0x22
lea ecx, [esp + 0x20]
call fcn.004e8d90
push 0x3c
lea ecx, [esp + 0x20]
call fcn.004e8d90
push 0x3e
lea ecx, [esp + 0x20]
call fcn.004e8d90
push 0x3a
lea ecx, [esp + 0x20]
call fcn.004e8d90
push 0x2f
lea ecx, [esp + 0x20]
call fcn.004e8d90
push 0x40
lea ecx, [esp + 0x20]
call fcn.004e8d90
push 0x3f
lea ecx, [esp + 0x20]
call fcn.004e8d90
lea ecx, [esp + 0x1c]
call fcn.004e2930
test eax, eax
je 0x58ce44
lea ecx, [esp + 0x1c]
call fcn.004e7c20
lea ecx, [esp + 0x1c]
call fcn.004e2930
lea ecx, [esp + 0x90]
mov edi, eax
call fcn.004e2930
cmp edi, eax
je 0x58cdb6
lea ecx, [esp + 0x1c]
call fcn.004dda00
push eax
call ebx
mov edi, eax
test edi, edi
jne 0x58cde6
push esi
push eax
call fcn.0058c280
mov edi, dword [esi]
add esp, 8
lea ecx, [esp + 0x1c]
call fcn.004dda00
push eax
push str.gethostbyname_arg
mov ecx, esi
call dword [edi + 0x2c]
push 0x2e
lea ecx, [esp + 0x20]
call fcn.004e93c0
cmp eax, 1
jne 0x58ce44
push str.www.
lea ecx, [esp + 0x20]
call fcn.004e4110
lea ecx, [esp + 0x1c]
call fcn.004dda00
push eax
call ebx
mov edi, eax
test edi, edi
je 0x58ce23
lea ecx, [esp + 0x1c]
mov byte [esp + 0x10c], 1
call fcn.004e58d0
lea ecx, [esp + 0x90]
mov byte [esp + 0x10c], 0
call fcn.004e58d0
lea ecx, [esp + 0x10]
mov dword [esp + 0x10c], 0xffffffff
call fcn.004f03e0
mov eax, edi
jmp 0x58ce7f
push esi
push 0
call fcn.0058c280
mov edi, dword [esi]
add esp, 8
lea ecx, [esp + 0x1c]
call fcn.004dda00
push eax
push str.gethostbyname_arg
mov ecx, esi
call dword [edi + 0x2c]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x10c], 1
call fcn.004e58d0
lea ecx, [esp + 0x90]
mov byte [esp + 0x10c], 0
call fcn.004e58d0
lea ecx, [esp + 0x10]
mov dword [esp + 0x10c], 0xffffffff
call fcn.004f03e0
xor eax, eax
mov ecx, dword [esp + 0x104]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x100
ret
Function at 0x58f160
Capabilities:
Get hostname

Disassembly:
push 0xffffffffffffffff
push 0x65183b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
push esi
mov esi, dword [esp + 0x230]
lea ecx, [esp + 0xc]
mov al, byte [esi + 0x121]
push eax
push str.getLocalHostname
push esi
call fcn.004f03a0
xor ebx, ebx
mov dword [esp + 0x224], ebx
call fcn.0058afc0
test al, al
jne 0x58f1d9
lea ecx, [esp + 0xc]
mov dword [esp + 0x224], 0xffffffff
call fcn.004f03e0
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x214]
mov dword fs:[0], ecx
add esp, 0x220
ret
lea ecx, [esp + 0x28]
push 0x1f4
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, ebx
jge 0x58f21f
lea edx, [esp + 0x28]
push esi
push edx
call fcn.0058cbf0
add esp, 8
cmp eax, ebx
je 0x58f21f
mov eax, dword [eax]
push 0x1f4
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.004f1c30
mov byte [esp + 0x227], bl
add esp, 0xc
mov bl, 1
jmp 0x58f25e
lea edx, [esp + 8]
lea eax, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x10], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
cmp eax, ebx
je 0x58f24c
lea ecx, [esp + 0x18]
push 0x1f4
lea edx, [esp + 0x2c]
push ecx
push edx
jmp 0x58f20c
lea eax, [esp + 0x28]
push str.localhost
push eax
call fcn.004f1c00
add esp, 8
mov esi, dword [esp + 0x22c]
mov ecx, esi
call fcn.004e3d50
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
call fcn.004e5040
lea ecx, [esp + 0xc]
mov dword [esp + 0x224], 0xffffffff
call fcn.004f03e0
mov ecx, dword [esp + 0x21c]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x220
ret

Function at 0x58f460
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x651858
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 0x294]
cmp eax, 0xffffffff
jne 0x58f48d
mov byte [esi + 0x290], 0
mov cl, byte [esi + 0x290]
test cl, cl
jne 0x58f4ab
xor al, al
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
mov cl, byte [esi + 0xd6]
test cl, cl
je 0x58f4c9
xor al, al
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
mov cl, byte [esi + 0xd5]
test cl, cl
jne 0x58f57f
mov cl, byte [esi + 0xd4]
test cl, cl
jne 0x58f57f
push 2
lea ecx, [esp + 8]
push 1
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x58f519
mov edx, dword [esp + 0x28]
mov ecx, esi
push edx
call fcn.0058f5b0
xor al, al
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
cmp eax, 0xffffffff
je 0x58f522
test eax, eax
jge 0x58f57f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, esi
call fcn.00590a00
test al, al
jne 0x58f57f
mov esi, dword [esp + 0x28]
push str.isConnected_recv_peek
push esi
lea ecx, [esp + 0x14]
call fcn.004f0370
push esi
push 0
mov dword [esp + 0x28], 0
call fcn.0058c280
add esp, 8
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.004f03e0
xor al, al
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
mov ecx, dword [esp + 0x18]
mov al, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x58fac0
Capabilities:
Get socket status

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6518db
push eax
mov dword fs:[0], esp
sub esp, 0x860
push ebx
mov ebx, dword [esp + 0x874]
push esi
push edi
mov edi, ecx
mov ecx, ebx
call fcn.00514cb0
mov esi, dword [esp + 0x880]
mov ecx, ebx
push esi
call fcn.00514cf0
test al, al
je 0x58fb16
mov byte [ebx + 0x15], 1
mov eax, dword [esi]
push str.Wait_for_data_on_socket_aborted_by_app
mov ecx, esi
call dword [eax + 0x14]
jmp 0x58fc11
mov eax, dword [edi + 0x294]
cmp eax, 0xffffffff
jne 0x58fb36
mov edx, dword [esi]
push str.Cannot_wait_for_socket_data:_not_connected__invalid_socket_
mov ecx, esi
call dword [edx + 0x14]
mov byte [ebx + 0x16], 1
jmp 0x58fc11
push eax
call fcn.004f04f0
add esp, 4
test al, al
je 0x58fb87
mov eax, dword [ebx + 4]
mov edx, dword [edi + 0x294]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push 0
push 1
push 0
push 0
push edx
mov dword [esp + 0x2c], 0
call fcn.005df580
add esp, 0x20
test al, al
je 0x58fc11
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x58fc11
mov al, 1
jmp 0x58fc13
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.0058b450
lea ecx, [esp + 0x18]
mov dword [esp + 0x874], 0
call fcn.0058b4b0
mov eax, dword [edi + 0x294]
push esi
push eax
lea ecx, [esp + 0x20]
call fcn.0058b500
test al, al
jne 0x58fbda
mov byte [ebx + 0x16], 1
mov dword [esp + 0x874], 0xffffffff
jmp 0x58fc08
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
push 0
push 0
push edx
push 0
call dword [sym.imp.WS2_32.dll_select]
or ecx, 0xffffffff
cmp eax, ecx
je 0x58fc01
test eax, eax
jl 0x58fc01
jne 0x58fc2d
mov byte [ebx + 0x14], 1
mov dword [esp + 0x874], ecx
lea ecx, [esp + 0x18]
call fcn.0058b490
xor al, al
mov ecx, dword [esp + 0x86c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x86c
ret 8
mov dword [esp + 0x874], ecx
lea ecx, [esp + 0x18]
call fcn.0058b490
mov al, 1
jmp 0x58fc13
Function at 0x5908e0
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x65193b
push eax
mov dword fs:[0], esp
sub esp, 0x148
push ebx
push ebp
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x294], 0xffffffff
je 0x5909da
mov ebx, dword [esp + 0x168]
test ebx, ebx
je 0x590921
cmp ebx, 0x7530
jbe 0x590926
mov ebx, 0x7530
mov eax, dword [esp + 0x16c]
lea ecx, [esp + 0x30]
push eax
call fcn.00514a70
mov dword [esp + 0x160], 0
call sub.KERNEL32.dll_GetTickCount
mov ebp, dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
mov edx, dword [edi + 0x294]
push 0
lea ecx, [esp + 0x14]
push 0x20
push ecx
push edx
call ebp
test eax, eax
je 0x590993
cmp eax, 0xffffffff
je 0x59096e
test eax, eax
jge 0x590980
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, edi
call fcn.00590a00
test al, al
je 0x5909c6
call sub.KERNEL32.dll_GetTickCount
cmp eax, esi
jae 0x59098b
mov esi, eax
sub eax, esi
cmp eax, ebx
jae 0x5909c6
jmp 0x59094f
mov ecx, dword [esp + 0x170]
mov al, byte [ecx + 0x121]
test al, al
je 0x5909ae
mov eax, dword [ecx]
push str.TCP_connection_cleanly_closed_by_peer.
call dword [eax + 0x18]
lea ecx, [esp + 0x30]
mov dword [esp + 0x160], 0xffffffff
call fcn.00514b40
mov al, 1
jmp 0x5909dc
lea ecx, [esp + 0x30]
mov dword [esp + 0x160], 0xffffffff
call fcn.00514b40
xor al, al
mov ecx, dword [esp + 0x158]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x154
ret 0xc
Function at 0x5923c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x651c10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov ecx, edi
call fcn.004e3cd0
push esi
lea ecx, [esp + 0xc]
call fcn.004eea40
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00591c50
test al, al
jne 0x59242a
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.004eea90
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 4
mov eax, dword [esi + 0x2bc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x59243c
add eax, 8
jmp 0x59243e
xor eax, eax
push eax
lea ecx, [esp + 0x18]
call fcn.004eea40
mov ecx, dword [esi + 0x2bc]
mov byte [esp + 0x28], 1
call fcn.005b1320
test al, al
jne 0x59248f
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], al
call fcn.004eea90
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.004eea90
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 4
mov ecx, dword [esi + 0x2bc]
push ebx
push edi
call fcn.005b0bb0
lea ecx, [esp + 0x18]
mov bl, al
mov byte [esp + 0x2c], 0
call fcn.004eea90
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004eea90
mov ecx, dword [esp + 0x24]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4

Function at 0x5926b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x651c70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov ecx, edi
call fcn.004d9530
push esi
lea ecx, [esp + 0xc]
call fcn.004eea40
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.00591c50
test al, al
jne 0x59271a
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.004eea90
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 4
mov eax, dword [esi + 0x2bc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x59272c
add eax, 8
jmp 0x59272e
xor eax, eax
push eax
lea ecx, [esp + 0x18]
call fcn.004eea40
mov ecx, dword [esi + 0x2bc]
mov byte [esp + 0x28], 1
call fcn.005b1320
test al, al
jne 0x59277f
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], al
call fcn.004eea90
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.004eea90
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 4
push ebx
mov ecx, edi
call fcn.004dba80
mov ecx, dword [esi + 0x2bc]
push eax
call fcn.005b0bb0
lea ecx, [esp + 0x18]
mov bl, al
mov byte [esp + 0x2c], 0
call fcn.004eea90
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004eea90
mov ecx, dword [esp + 0x24]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x592fd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x651da0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
push edi
lea ecx, [esp + 0x18]
call fcn.004eea40
mov eax, dword [edi + 0x2c]
lea esi, [edi + 0x2c]
mov ecx, esi
mov dword [esp + 0x28], 0
call dword [eax + 0x20]
push str.SaveXml
push esi
lea ecx, [esp + 0x10]
call fcn.004f0370
push esi
mov ecx, edi
mov byte [esp + 0x2c], 1
call fcn.004c6d00
push esi
mov ecx, edi
call fcn.00591be0
test al, al
jne 0x593064
lea ecx, [esp + 8]
mov byte [esp + 0x28], al
call fcn.004f03e0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.004eea90
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 4
mov ecx, dword [esp + 0x30]
push ebx
push esi
push ecx
mov ecx, edi
call fcn.00592c30
lea ecx, [esp + 0xc]
mov bl, al
mov byte [esp + 0x2c], 0
call fcn.004f03e0
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004eea90
mov ecx, dword [esp + 0x24]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4

Function at 0x594580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x651f58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
push esi
lea ecx, [esp + 0x1c]
call fcn.004eea40
mov eax, dword [esi + 0x2c]
lea edi, [esi + 0x2c]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x38], ebx
call dword [eax + 0x20]
push str.GetChild2
push edi
lea ecx, [esp + 0x14]
call fcn.004f0370
push edi
mov ecx, esi
mov byte [esp + 0x3c], 1
call fcn.004c6d00
push edi
mov ecx, esi
call fcn.00591be0
test al, al
je 0x594694
mov ecx, dword [esi + 0x2bc]
mov eax, dword [ecx + 0xc]
cmp eax, ebx
je 0x5945f6
add eax, 8
jmp 0x5945f8
xor eax, eax
push eax
lea ecx, [esp + 0x28]
call fcn.004eea40
mov edx, dword [esp + 0x40]
mov ecx, dword [esi + 0x2bc]
push edx
mov byte [esp + 0x3c], 2
call fcn.005b0790
mov edi, eax
cmp edi, ebx
je 0x594686
mov ecx, edi
call fcn.005b45f0
test al, al
je 0x594686
push ebp
mov ebp, dword [esi + 0x2bc]
mov ecx, edi
mov dword [esi + 0x2bc], edi
call fcn.005b1ef0
mov ecx, ebp
call fcn.005b1f30
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 1
call fcn.004eea90
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], bl
call fcn.004f03e0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004eea90
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 4
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 1
call fcn.004eea90
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], bl
call fcn.004f03e0
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call fcn.004eea90
mov ecx, dword [esp + 0x30]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 4
Function at 0x5954f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x652198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
push esi
lea ecx, [esp + 0x1c]
call fcn.004eea40
mov eax, dword [esi + 0x2c]
lea edi, [esi + 0x2c]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x38], ebx
call dword [eax + 0x20]
push str.GetParent2
push edi
lea ecx, [esp + 0x14]
call fcn.004f0370
push edi
mov ecx, esi
mov byte [esp + 0x3c], 1
call fcn.004c6d00
push edi
mov ecx, esi
call fcn.00591be0
test al, al
je 0x5955fd
mov ecx, dword [esi + 0x2bc]
mov eax, dword [ecx + 0xc]
cmp eax, ebx
je 0x595566
add eax, 8
jmp 0x595568
xor eax, eax
push eax
lea ecx, [esp + 0x28]
call fcn.004eea40
mov ecx, dword [esi + 0x2bc]
mov byte [esp + 0x38], 2
call fcn.005b1b50
mov edi, eax
cmp edi, ebx
je 0x5955ef
mov ecx, edi
call fcn.005b45f0
test al, al
je 0x5955ef
push ebp
mov ebp, dword [esi + 0x2bc]
mov ecx, edi
mov dword [esi + 0x2bc], edi
call fcn.005b1ef0
mov ecx, ebp
call fcn.005b1f30
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 1
call fcn.004eea90
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], bl
call fcn.004f03e0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004eea90
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 1
call fcn.004eea90
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], bl
call fcn.004f03e0
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call fcn.004eea90
mov ecx, dword [esp + 0x30]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x595730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6521e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
push esi
lea ecx, [esp + 0x1c]
call fcn.004eea40
mov eax, dword [esi + 0x2c]
lea edi, [esi + 0x2c]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x38], ebx
call dword [eax + 0x20]
push str.GetRoot2
push edi
lea ecx, [esp + 0x14]
call fcn.004f0370
push edi
mov ecx, esi
mov byte [esp + 0x3c], 1
call fcn.004c6d00
push edi
mov ecx, esi
call fcn.00591be0
test al, al
je 0x5957f4
mov ecx, dword [esi + 0x2bc]
mov eax, dword [ecx + 0xc]
cmp eax, ebx
je 0x5957a2
add eax, 8
jmp 0x5957a4
xor eax, eax
push eax
lea ecx, [esp + 0x28]
call fcn.004eea40
mov ecx, dword [esi + 0x2bc]
mov byte [esp + 0x38], 2
call fcn.005b1b70
mov edi, dword [esi + 0x2bc]
cmp eax, edi
je 0x5957e6
cmp eax, ebx
je 0x5957e6
cmp byte [eax + 0x3c], 0xce
jne 0x5957e6
mov ecx, eax
mov dword [esi + 0x2bc], eax
call fcn.005b1ef0
mov ecx, edi
call fcn.005b1f30
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 1
call fcn.004eea90
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], bl
call fcn.004f03e0
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call fcn.004eea90
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret