joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5432fb
Capabilities:
Hide graphical window

Disassembly:
call fcn.005b13d0
cmp dword [0x7c1b20], 0
je 0x54331b
push 8
push dword [0x7c18c0]
call sub.USER32.dll_ShowWindow
jmp 0x54332b
push 0
push dword [0x7c18c0]
call sub.USER32.dll_ShowWindow
call fcn.00480b94
xor eax, eax
ret

Function at 0x54668b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x546691
call fcn.005b13d0
mov dword [esp], 0
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
push 0
push 0x20019
push 0
xor eax, eax
push eax
push 0
mov eax, str.SoftwareMicrosoftMSDN7.0Help
push eax
push reloc.WS2_32.dll_accept
call sub.ADVAPI32.dll_RegCreateKeyExW
mov ebx, eax
and ebx, ebx
jne 0x54689f
mov dword [esp + 0xc], 0
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
push 0x104
call fcn.005af190
lea eax, [esp + 0x14]
push eax
call fcn.005b12d0
mov dword [esp + 0x14], 0x104
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
push 0x104
call fcn.005af190
lea eax, [esp + 0x1c]
push eax
call fcn.005b12d0
mov dword [esp + 0x1c], 0x104
push 0
push 0
lea eax, [esp + 0x2c]
push eax
push 0
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push eax
push dword [esp + 0x24]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegEnumValueW
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x20]
and ebx, ebx
jne 0x54678c
mov ebx, dword [esp + 0x24]
cmp ebx, 1
jne 0x54678c
mov eax, 1
jmp 0x54678e
xor eax, eax
and eax, eax
je 0x546886
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
push 0x12
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
push dword [esp + 0x24]
call fcn.005ae080
call fcn.0054d542
add dword [esp], edx
call fcn.005adff0
call fcn.005b1360
mov edx, str.ms_help:__ms.psdk.
call fcn.0054d5b0
mov ecx, eax
call fcn.0054d570
je 0x54680e
mov edx, dword [esp + 0x10]
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1270
push 0x7c1c38
call fcn.005b12d0
mov dword [esp], 1
jmp 0x546886
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
push 0x1b
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1230
pop edx
push eax
push dword [esp + 0x24]
call fcn.005ae340
call fcn.0054d542
add dword [esp], edx
call fcn.005adff0
call fcn.005b1360
mov edx, str.MS_HELP:__MS.PSDKSVR2003SP1
call fcn.0054d5b0
mov ecx, eax
call fcn.0054d570
je 0x546886
mov edx, dword [esp + 0x10]
push edx
call fcn.005b1230
pop edx
push eax
push edx
call fcn.005b1270
push 0x7c1c38
call fcn.005b12d0
mov dword [esp], 1
jmp 0x546896
inc dword [esp + 0xc]
mov ebx, dword [esp + 0x20]
and ebx, ebx
je 0x5466ed
push dword [esp + 4]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [esp]
jmp 0x5468a6
push dword [esp + 0x18]
call fcn.005b1460
push dword [esp + 0x10]
call fcn.005b1460
add esp, 0x28
pop ebx
ret
Function at 0x54ea1d
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
push dword [esp + 0x50]
push dword [0x7c8a34]
call fcn.005b0947
mov esi, eax
test esi, esi
je 0x54ead4
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebp, ebp
push ebp
push dword [esp + 0x58]
push 0x419
push dword [esi]
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x54ead4
lea eax, [esp + 0x10]
push eax
push ebx
push 0x41d
push dword [esi]
call edi
mov dword [esp + 0x20], 0x2c
mov dword [esp + 0x24], 0x10
mov eax, dword [esi]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x20]
push eax
push ebp
push 0x433
mov dword [esp + 0x38], ebx
mov dword [esp + 0x4c], ebp
push dword [esi + 4]
call edi
lea eax, [esp + 0x20]
push eax
push ebp
push 0x432
push dword [esi + 4]
call edi
xor eax, eax
inc eax
jmp 0x54ead6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0xc

Function at 0x54ed49
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x54ede1
push edi
push 0x7c8a40
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x7c35f8]
test edi, edi
je 0x54edb5
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x54edae
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x7c35f8
call fcn.005b1111
pop ecx
pop ecx
jmp 0x54edb0
mov edi, dword [edi]
test edi, edi
jne 0x54ed85
pop ebx
mov eax, dword [0x7bbe4c]
mov esi, eax
inc eax
push 0x10
push 0x7c35f8
mov dword [0x7bbe4c], eax
call fcn.005b1151
pop ecx
pop ecx
push 0x7c8a40
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x556a68
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x556abd
push dword [esp + 0x10]
push 0x5569e7
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x7c3914]
test esi, esi
je 0x556b16
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x556ab5
cmp byte [esi + 0x10], 0
je 0x556ab5
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x556a91
jmp 0x556b16
mov esi, dword [0x7c3914]
test esi, esi
je 0x556b16
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x556b0f
cmp byte [esi + 0x11], 0
je 0x556aeb
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x556b02
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x7c3914
call fcn.005b1111
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x556aca
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x5717ca
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x7c8a78]
call fcn.005b07a8
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x5718ca
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x571820
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x571818
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x571860
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x5718a2
push 0x22
pop edx
cmp cx, dx
je 0x571852
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x571842
xor ecx, ecx
cmp word [eax], cx
je 0x5718a2
mov ecx, eax
add eax, 2
jmp 0x5718a4
test dx, dx
je 0x5718aa
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x571852
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x571898
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x5718a2
cmp cx, dx
je 0x571895
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x571885
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x57186a
jmp 0x571852
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x5718ac
xor edx, edx
cmp dword [ebp], ebx
jne 0x5718b5
test edi, edi
jne 0x5718d2
test edx, edx
je 0x5718ba
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x57180e
test edi, edi
jne 0x5718e3
mov eax, ebx
jmp 0x5718e7
test esi, esi
je 0x5718e3
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x5718e7
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x5719bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x571a21
cmp dword [ebp + 0x10], 0x18
push esi
jne 0x5719de
call fcn.006eccd0
mov esi, eax
push esi
call sub.MSVCRT.dll_strlen
jmp 0x5719f2
cmp dword [ebp + 0x10], 2
jne 0x5719eb
call fcn.006ecb60
jmp 0x5719d4
call sub.MSVCRT.dll_wcslen
add eax, eax
pop ecx
push 0
lea ecx, [ebp + 0xc]
push ecx
push eax
mov eax, dword [ebp + 8]
push esi
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 0x10], 0x18
jne 0x571a15
push esi
call fcn.006eccc0
jmp 0x571a21
cmp dword [ebp + 0x10], 2
jne 0x571a21
push esi
call fcn.006ecb50
pop esi
pop ebp
ret 0xc
Function at 0x571a26
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
cmp dword [esp + 0x24], 0x18
mov ebx, eax
je 0x571ae5
cmp dword [esp + 0x24], 2
je 0x571ae5
push 0x2000
push ebp
push dword [0x7c1878]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
jmp 0x571ab4
cmp dword [esp + 0x18], 2
jne 0x571ad0
cmp dword [esp + 0x28], 0xffffffff
je 0x571a78
cmp ebp, dword [esp + 0x28]
jae 0x571ad0
add ebp, 2
test ebx, ebx
jne 0x571a9d
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0x7c1878]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x571ad0
cmp ax, 0xd
je 0x571ab4
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x571a64
push dword [esp + 0x2c]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.006ecd60
jmp 0x571b77
push eax
push 0
push dword [0x7c1878]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp dword [esp + 0x28], 0xffffffff
je 0x571b03
cmp ebp, dword [esp + 0x28]
jae 0x571b5b
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x571b5b
cmp dword [esp + 0x18], 1
jne 0x571b5b
inc ebp
test ebx, ebx
jne 0x571b48
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0x7c1878]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x571b5b
cmp al, 0xd
je 0x571af6
mov byte [esi + edi], al
inc edi
dec ebx
jmp 0x571af6
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x2c]
mov byte [esi + edi], 0
push esi
jne 0x571b72
call fcn.006ecc50
jmp 0x571b77
call fcn.006ecbf0
push esi
push 0
push dword [0x7c1878]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x574530
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 8
cmp dword [0x7c393c], 0
jne 0x574541
call fcn.005744d0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x7c3940]
call esi
mov ecx, eax
test ecx, ecx
jne 0x574568
call fcn.005744d0
push dword [0x7c3940]
call esi
mov ecx, eax
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
cmp edx, 8
jl 0x5745ce
mov ebp, edx
shr ebp, 3
mov eax, ebp
neg eax
lea edx, [edx + eax*8]
mov dword [esp + 0x20], edx
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov edi, dword [ecx + edx*4 + 0x4c]
mov ebx, dword [ecx + edx*4 + 8]
ror edi, 0xd
add edi, dword [ecx + eax*4 + 0x4c]
ror ebx, 5
add ebx, dword [ecx + eax*4 + 8]
dec eax
mov dword [ecx + edx*4 + 8], edi
mov dword [ecx + edx*4 + 0x4c], ebx
dec edx
jns 0x5745b1
mov edx, 0x10
test eax, eax
jns 0x5745ba
mov eax, 0x10
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov dword [esi], ebx
mov dword [esi + 4], edi
add esi, 8
dec ebp
jne 0x574585
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x574623
mov edi, dword [ecx]
mov eax, dword [ecx + 4]
mov ebx, dword [ecx + edi*4 + 0x4c]
mov ebp, dword [ecx + edi*4 + 8]
ror ebx, 0xd
add ebx, dword [ecx + eax*4 + 0x4c]
ror ebp, 5
add ebp, dword [ecx + eax*4 + 8]
dec eax
mov dword [ecx + edi*4 + 8], ebx
mov dword [ecx + edi*4 + 0x4c], ebp
dec edi
jns 0x5745fe
mov edi, 0x10
test eax, eax
jns 0x574607
mov eax, 0x10
mov dword [ecx + 4], eax
lea eax, [esp + 0x10]
push edx
push eax
push esi
mov dword [ecx], edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x574630
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x7c393c], 0
jne 0x57463e
call fcn.005744d0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x7c3940]
call esi
test eax, eax
jne 0x574661
call fcn.005744d0
push dword [0x7c3940]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x574670
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x5746d0
mov ebx, 0x10
test edi, edi
jns 0x5746d9
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x5746a2
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x575abd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [0x7c8ae0]
xor edi, edi
call fcn.005b07a8
mov ebx, eax
cmp dword [ebp + 8], edi
je 0x575b74
cmp dword [ebp + 0xc], edi
je 0x575b74
push esi
push 0x60
push 8
push dword [0x7c1878]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 8]
mov esi, eax
or dword [esi + 4], 0xffffffff
mov dword [esi], edi
call sub.MSVCRT.dll__wcsdup
push dword [ebp + 0xc]
mov dword [esi + 8], eax
call sub.MSVCRT.dll__wcsdup
push dword [ebp + 0x14]
mov dword [esi + 0xc], eax
call sub.MSVCRT.dll__wcsdup
mov dword [esi + 0x40], eax
add esp, 0xc
mov eax, dword [ebx]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x24], eax
test al, 1
je 0x575b63
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x575d16
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x575b5b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, esi
jmp 0x575b73
push esi
call fcn.00575d67
jmp 0x575b72
push esi
call fcn.00575b8e
push esi
mov edi, eax
call fcn.00575d67
pop ecx
pop ecx
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x575b8e
Capabilities:
Delete file

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor ebx, ebx
mov ebp, dword [edi + 0xc]
push dword [edi + 8]
mov dword [esp + 0x18], ebp
call fcn.006eccd0
push dword [edi + 0x40]
mov dword [esp + 0x20], eax
call fcn.006eccd0
mov dword [esp + 0x10], eax
call fcn.005eada0
mov esi, eax
test esi, esi
je 0x575cec
push ebx
push pe_nt_image_headers32
push 2
push ebx
push 1
push 0xc0000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x575cd7
test byte [edi + 0x24], 2
mov dword [edi + 0x10], ebp
jne 0x575c00
push 1
push 0x34
push esi
call fcn.005edcf0
add esp, 0xc
mov eax, dword [0x7c3984]
test eax, eax
je 0x575c18
push eax
push 0x2714
push esi
call fcn.005edcf0
add esp, 0xc
mov eax, dword [0x7c3988]
test eax, eax
je 0x575c49
cmp dword [0x7c398c], ebx
je 0x575c49
push eax
push 0x27bf
push esi
call fcn.005edcf0
push dword [0x7c398c]
push 0x27c0
push esi
call fcn.005edcf0
add esp, 0x18
push dword [esp + 0x1c]
push 0x2712
push esi
call fcn.005edcf0
push dword [esp + 0x1c]
push 0x2722
push esi
call fcn.005edcf0
push 0x575d25
push 0x4e2b
push esi
call fcn.005edcf0
push edi
push 0x2711
push esi
call fcn.005edcf0
push dword [edi + 0x28]
push 0x9c
push esi
call fcn.005edcf0
push dword [edi + 0x2c]
push 0x9b
push esi
call fcn.005edcf0
add esp, 0x48
push 1
push 0x63
push esi
call fcn.005edcf0
push esi
call fcn.005eae40
add esp, 0x10
test eax, eax
jne 0x575cc2
cmp dword [edi + 4], 0xfffffffb
je 0x575cc2
xor ebx, ebx
inc ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x575cd7
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call fcn.005ead80
pop ecx
cmp ebx, 1
jne 0x575cec
mov dword [edi + 4], 0xfffffffe
jmp 0x575cfb
xor ecx, ecx
cmp dword [edi + 4], 0xfffffffb
setne cl
add ecx, 0xfffffffc
mov dword [edi + 4], ecx
push dword [esp + 0x1c]
call fcn.006eccc0
push dword [esp + 0x10]
call fcn.006eccc0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
pop ecx
ret
Function at 0x575ea9
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push 0x575df8
push 0x10
push 0x2c
call fcn.005b0a1a
push 0
push 0
push 8
mov dword [0x7c3998], eax
call fcn.005b0813
cmp word [0x7c3990], 0
mov dword [0x7c8ae8], eax
jne 0x575f8e
push edi
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x575f01
mov word [0x7c3990], di
jmp 0x575f09
xor eax, eax
mov word [0x7c3990], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x7c39ac], eax
test eax, eax
je 0x575f8d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x703a68
push eax
call esi
push 0x703a74
push dword [0x7c39ac]
mov dword [0x7c399c], eax
call esi
push str.getnameinfo
push dword [0x7c39ac]
mov dword [0x7c39a0], eax
call esi
push str.WSAStringToAddressA
push dword [0x7c39ac]
mov dword [0x7c39a4], eax
call esi
cmp dword [0x7c399c], 0
mov dword [0x7c39a8], eax
pop esi
je 0x575f8d
cmp dword [0x7c39a0], 0
je 0x575f8d
cmp dword [0x7c39a4], 0
je 0x575f8d
test eax, eax
je 0x575f8d
mov dword [0x7c3994], edi
pop edi
add esp, 0x190
ret
Function at 0x576930
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x57696c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x5769b0
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 4]
push dword [0x7c8aec]
call fcn.005b0947
test eax, eax
je case.0x5769de.3
mov ecx, dword [esp + 8]
add ecx, 0xfffffffe
cmp ecx, 0x17
ja case.0x5769de.3
movzx ecx, byte [ecx + 0x576ae8]
jmp dword [ecx*4 + 0x576ad0]
cmp dword [eax + 4], 0
je 0x5769fb
push 2
push 0x703af4
push eax
call fcn.005776a0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 2
push 0x703af4
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x576a2a
push 3
push 0x7033a0
push eax
call fcn.005776a0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 3
push 0x7033a0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x576a59
push 2
push 0x703af8
push eax
call fcn.005776a0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 2
push 0x703af8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x576a88
push 4
push 0x703afc
push eax
call fcn.005776a0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x703afc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x576ab7
push 4
push 0x703b04
push eax
call fcn.005776a0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x703b04
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
Function at 0x576b00
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x576c08
cmp word [edx], 0
je 0x576c08
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x576b2e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x576b8d
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x576b60
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x576b40
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.005776a0
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x576b60
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.005777b0
mov edi, eax
test edi, edi
je 0x576b83
cmp dword [esi + 4], 0
je 0x576bdb
push dword [esp + 0x14]
push edi
push esi
call fcn.005776a0
push edi
push 0
push dword [0x7c1878]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x7c1878]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc

Function at 0x576c10
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 4]
push dword [0x7c8aec]
call fcn.005b0947
test eax, eax
je 0x576c2c
mov dword [esp + 4], eax
jmp fcn.00576b00
xor eax, eax
ret 0xc

Function at 0x577180
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x7c8aec]
call fcn.005b0947
mov esi, eax
test esi, esi
je 0x5771ff
cmp dword [esi + 4], 0
je 0x5771d0
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.00577820
test eax, eax
je 0x5771c4
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x57720a
cmp dword [esp + 8], 0
je 0x57720a
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4