joyce8/EMBER2024-capa huggingface dataset:
Function at 0x576a40
Capabilities:
Encode data using base64

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov eax, 0xaaaaaaab
push edi
lea ecx, [esi + 3]
mov edi, dword [esp + 0x18]
mul ecx
shr edx, 1
lea edx, [edx + esi + 7]
push edx
push edi
call fcn.00576670
add esp, 8
test eax, eax
jne 0x576a6f
pop edi
pop esi
pop ecx
ret 0xc
push edi
call fcn.00576660
mov ecx, eax
add esp, 4
xor eax, eax
test esi, esi
jbe 0x576b44
lea edx, [esi + 2]
mov eax, 0xaaaaaaab
mul edx
push ebx
push ebp
mov edi, dword [esp + 0x18]
mov ebp, edx
shr ebp, 1
mov ebx, 2
lea eax, [ebp + ebp*2]
mov dword [esp + 0x10], eax
lea edx, [ebx - 1]
cmp edx, esi
jae 0x576ab5
mov al, byte [edi + 1]
mov byte [esp + 0x20], al
jmp 0x576aba
mov byte [esp + 0x20], 0
cmp ebx, esi
jae 0x576ac7
mov dl, byte [edi + 2]
mov byte [esp + 0x18], dl
jmp 0x576acc
mov byte [esp + 0x18], 0
xor eax, eax
add ebx, 3
mov al, byte [edi]
add edi, 3
shr eax, 2
inc ecx
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_http:__www.internetdownloadmanager.com_support_data_corruption.html]
mov eax, dword [esp + 0x20]
mov byte [ecx - 1], dl
mov dl, byte [edi - 3]
and eax, 0xff
and edx, 3
mov esi, eax
and eax, 0xf
shl edx, 4
shr esi, 4
or edx, esi
mov esi, dword [esp + 0x18]
and esi, 0xff
inc ecx
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_http:__www.internetdownloadmanager.com_support_data_corruption.html]
mov byte [ecx - 1], dl
mov edx, esi
shr edx, 6
shl eax, 2
or edx, eax
and esi, 0x3f
inc ecx
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_http:__www.internetdownloadmanager.com_support_data_corruption.html]
mov byte [ecx - 1], al
mov dl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_http:__www.internetdownloadmanager.com_support_data_corruption.html]
mov esi, dword [esp + 0x1c]
mov byte [ecx], dl
inc ecx
dec ebp
jne 0x576aa5
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
lea edx, [esi + 1]
cmp eax, edx
jne 0x576b5d
mov byte [ecx - 1], 0x3d
pop edi
mov byte [ecx], 0
mov eax, 1
pop esi
pop ecx
ret 0xc
add esi, 2
cmp eax, esi
jne 0x576b6c
mov al, 0x3d
mov byte [ecx - 1], al
mov byte [ecx - 2], al
pop edi
mov byte [ecx], 0
mov eax, 1
pop esi
pop ecx
ret 0xc
Function at 0x578bd0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
push edi
push 0
push 1
mov esi, ecx
push 2
call sub.WS2_32.dll_socket
lea ecx, [esp + 8]
lea edi, [esi + 0x858]
push ecx
push 0x8004667e
push eax
mov dword [edi], eax
mov dword [esp + 0x14], 1
call sub.WS2_32.dll_ioctlsocket
cmp dword [edi], 0xffffffff
je 0x578c24
xor eax, eax
mov edx, dword [esi + 0x248]
add eax, 0x3448
cmp eax, 0x68900
mov dword [edx + eax - 0x3350], edi
jl 0x578c07
pop edi
pop esi
pop ecx
ret
xor eax, eax
mov ecx, dword [esi + 0x248]
add eax, 0x3448
cmp eax, 0x68900
mov dword [ecx + eax - 0x3350], 0
jl 0x578c26
pop edi
pop esi
pop ecx
ret
Function at 0x57d8b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x62bb30
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x4c]
cmp edi, 0x7d000
ja 0x57dac5
push edi
call fcn.005feedc
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
je 0x57dac5
mov eax, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x48]
lea edx, [esp + 0x18]
push ebx
push edx
push eax
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x57d926
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x57dabc
lea eax, [esp + 0x10]
push ebx
push eax
push edi
push esi
push ebp
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x57dabc
cmp dword [esp + 0x10], edi
jne 0x57dabc
lea ecx, [esp + 0x1c]
call fcn.00540c10
push ebx
push edi
push esi
lea ecx, [esp + 0x28]
mov dword [esp + 0x44], ebx
call fcn.00541060
cmp eax, ebx
jge 0x57d987
push esi
call fcn.005fef05
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00540c80
jmp 0x57dac5
push ebx
lea ecx, [esp + 0x20]
call fcn.005411d0
mov ecx, eax
call fcn.00540560
push eax
lea ecx, [esp + 0x50]
call fcn.00602b44
mov ecx, dword [esp + 0x4c]
push str.onMetaData
push ecx
mov byte [esp + 0x40], 1
call fcn.005e7b5a
add esp, 8
test eax, eax
jne 0x57da93
lea edx, [esp + 0x40]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
push str.duration
call fcn.00602b44
lea eax, [esp + 0x24]
push eax
call fcn.005a4680
add esp, 0xc
cmp al, bl
je 0x57da28
mov ecx, dword [esp + 0x40]
call fcn.00540530
mov ecx, dword [esp + 0x50]
push esi
fstp qword [ecx]
call fcn.005fef05
add esp, 4
lea ecx, [esp + 0x4c]
mov byte [esp + 0x38], bl
call fcn.00602ad6
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00540c80
mov eax, 1
jmp 0x57dac7
lea edx, [esp + 0x40]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.isLive
call fcn.00602b44
lea eax, [esp + 0x24]
push eax
call fcn.005a4680
add esp, 0xc
cmp al, bl
je 0x57da93
mov ecx, dword [esp + 0x40]
call fcn.00540540
test al, al
je 0x57da93
mov eax, dword [esp + 0x50]
push esi
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.005fef05
add esp, 4
lea ecx, [esp + 0x4c]
mov byte [esp + 0x38], bl
call fcn.00602ad6
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00540c80
mov eax, 1
jmp 0x57dac7
push esi
call fcn.005fef05
add esp, 4
lea ecx, [esp + 0x4c]
mov byte [esp + 0x38], bl
call fcn.00602ad6
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00540c80
jmp 0x57dac5
push esi
call fcn.005fef05
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 0x14
Function at 0x57dae0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
xor ebp, ebp
push edi
lea eax, [esp + 0x18]
push ebp
push eax
push ebp
mov dword [esp + 0x1c], ecx
push ebx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x57db1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x57dc1f
lea ecx, [esp + 0x2c]
push ebp
push ecx
lea edx, [esp + 0x24]
push 3
push edx
push ebx
mov dword [esp + 0x40], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x57dc1f
cmp dword [esp + 0x2c], 3
jne 0x57dc1f
mov ecx, 3
mov edi, 0x6a34d4
lea esi, [esp + 0x1c]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x57dc1f
mov esi, 0xd
xor edi, edi
lea ecx, [esp + 0x18]
push ebp
push ecx
push esi
push ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x57db8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x57dc1f
lea edx, [esp + 0x2c]
push ebp
push edx
lea eax, [esp + 0x24]
push 0xb
push eax
push ebx
mov dword [esp + 0x40], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x57dc1f
cmp dword [esp + 0x2c], 0xb
jne 0x57dc1f
lea ecx, [esp + 0x1d]
push ecx
call fcn.0059f800
add esp, 4
mov ebp, eax
mov al, byte [esp + 0x1c]
add esi, 0xb
adc edi, 0
cmp al, 0x12
jne 0x57dbe3
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x10]
push edx
push ebp
push edi
push esi
push ebx
call fcn.0057d8b0
test eax, eax
jne 0x57dc10
mov eax, dword [esp + 0x34]
add ebp, 4
add esi, ebp
adc edi, 0
cmp edi, eax
jg 0x57dc1f
jl 0x57dbfb
cmp esi, dword [esp + 0x30]
ja 0x57dc1f
test edi, edi
jg 0x57dc1f
jl 0x57dc09
cmp esi, 0x500000
ja 0x57dc1f
xor ebp, ebp
jmp 0x57db64
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
Function at 0x57dc30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x20]
mov eax, esi
lea edx, [esp + 0x28]
sub eax, 4
mov ecx, ebx
push 0
push edx
sbb ecx, 0
push eax
push edi
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
call ebp
cmp eax, 0xffffffff
jne 0x57dc79
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x57dd5a
lea eax, [esp + 0x20]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push edi
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x57dd5a
cmp dword [esp + 0x20], 4
jne 0x57dd5a
lea edx, [esp + 0x10]
push edx
call fcn.0059f830
add esp, 4
test eax, eax
jbe 0x57dd5a
mov edx, 0xfffffffc
xor ecx, ecx
sub edx, eax
mov eax, 0xffffffff
sbb eax, ecx
add esi, edx
adc ebx, eax
js 0x57dd5a
jg 0x57dcde
test esi, esi
jbe 0x57dd5a
lea ecx, [esp + 0x28]
push 0
push ecx
push esi
push edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], ebx
call ebp
cmp eax, 0xffffffff
jne 0x57dd00
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x57dd5a
lea edx, [esp + 0x20]
push 0
push edx
lea eax, [esp + 0x18]
push 0xc
push eax
push edi
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x57dd28
cmp dword [esp + 0x20], 0xc
jne 0x57dd5a
lea ecx, [esp + 0x14]
push ecx
call fcn.0059f800
movsx edx, byte [esp + 0x1b]
shl edx, 0x18
add esp, 4
or eax, edx
je 0x57dc49
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov eax, 1
pop ebx
add esp, 0xc
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 0x10
Function at 0x590ef0
Capabilities:
Access peb ldr_data
Get local ipv4 addresses
Get socket information

Disassembly:
push 0xffffffffffffffff
push 0x62bed8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, 0xf0
push ebx
mov byte [esp + 0x1d], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
xor eax, eax
mov dword [esp + 0xc], eax
push esi
mov dword [esp + 0x14], eax
mov esi, ecx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0xc]
push edi
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x3220]
lea edx, [esp + 0x14]
push ecx
xor ebx, ebx
push edx
push eax
mov byte [esp + 0x30], 0xef
mov byte [esp + 0x34], 0xff
mov byte [esp + 0x35], 0xff
mov byte [esp + 0x36], 0xff
mov byte [esp + 0x37], 0xff
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], 0xa0
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 2
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], bl
mov dword [esp + 0x1c], 0x10
call sub.WS2_32.dll_getsockname
cmp eax, ebx
je 0x590fb5
call sub.WS2_32.dll_WSAGetLastError
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret 4
mov ecx, dword [0x6cc708]
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 0x16]
mov dword [esp + 0x40], ebx
push edx
call sub.WS2_32.dll_ntohs
mov ecx, dword [esp + 0x1b]
mov edx, dword [esp + 0x1a]
and eax, 0xffff
and ecx, 0xff
push eax
mov eax, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x21]
push ecx
mov ecx, dword [esp + 0x24]
and edx, 0xff
and eax, 0xff
push edx
and ecx, 0xff
push eax
push ecx
lea edx, [esp + 0x24]
push str._d._d._d._d_s_ld
push edx
call fcn.005fb90b
mov eax, dword [esp + 0x2c]
add esp, 0x20
lea ecx, [esp + 0x24]
push eax
push 0x14
push ecx
push 2
mov ecx, esi
call fcn.00590910
mov edi, eax
cmp edi, ebx
je 0x591057
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], 0xffffffff
call fcn.00602ad6
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret 4
push 0x18
lea ecx, [esi + 0x3214]
call fcn.0059cdb0
mov ecx, esi
call fcn.0054e940
lea ecx, [esp + 0xc]
mov dword [esi + 0x8c], 4
mov dword [esp + 0x40], 0xffffffff
call fcn.00602ad6
mov ecx, dword [esp + 0x38]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x5924f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [ecx + 0x31e8]
push esi
push edi
test ebx, ebx
mov dword [esp + 0x10], ecx
jne 0x59250d
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
cmp ebx, 0x186a0
jbe 0x59251a
mov ebx, 0x186a0
mov eax, dword [ecx + 0xb0]
push 0
push 0
push 3
mov ecx, dword [eax + 0x30]
push 0
push 3
push bind
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x59255a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5925e0
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret
push ebx
call fcn.005feedc
mov esi, eax
add esp, 4
test esi, esi
jne 0x59257c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 0x753b
pop ebx
add esp, 0xc
ret
push ebp
lea edx, [esp + 0x10]
push 0
push edx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
pop ebp
je 0x5925ca
cmp dword [esp + 0xc], ebx
jne 0x5925ca
mov ecx, dword [esp + 0x10]
push ebx
push esi
call fcn.00592670
push esi
mov edi, eax
call fcn.005fef05
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret
push esi
call fcn.005fef05
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
jne 0x5925e0
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x595140
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov esi, dword [ebp + 0x31e8]
cmp esi, 0x186a0
jbe 0x59515c
mov esi, 0x186a0
mov eax, dword [ebp + 0xb0]
push 0
push 0
push 3
mov ecx, dword [eax + 0x30]
push 0
push 3
push bind
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x59519f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x59524f
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 4
push esi
call fcn.005feedc
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x5951c4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 0x753b
pop ebx
add esp, 0xc
ret 4
lea edx, [esp + 0x14]
push 0
push edx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x595239
cmp dword [esp + 0x14], esi
jne 0x595239
mov edi, dword [ebp + 0x326c]
mov ecx, esi
mov esi, ebx
xor eax, eax
mov edx, dword [esp + 0x20]
push ebx
repe cmpsb byte [esi], byte es:[edi]
setne cl
mov byte [edx], cl
call fcn.005fef05
mov eax, dword [ebp + 0x326c]
push eax
call fcn.005fef05
add esp, 8
mov dword [ebp + 0x326c], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
push ebx
call fcn.005fef05
mov eax, dword [esp + 0x1c]
add esp, 4
test eax, eax
jne 0x59524f
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x597f50
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esi + 0x100], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], 0
cmp dword [esi + 0x68], 0xffffffff
jne 0x597f90
mov eax, dword [esi + 0x6c]
test eax, eax
jne 0x597f90
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x597f90
xor eax, eax
pop esi
ret 4
mov edx, dword [esp + 8]
push 1
push 0
push 0
push edx
call fcn.005e8c50
mov ecx, dword [esi + 0x68]
add ecx, eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x6c]
adc eax, edx
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x68]
or eax, dword [esi + 0x6c]
jne 0x597fbe
xor eax, eax
pop esi
ret 4
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov eax, 1
pop esi
ret 4
Function at 0x599cb0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x599d7a
mov ecx, dword [esi + 0x38]
push ebx
push 3
lea edi, [eax + ecx - 4]
call sub.WS2_32.dll_htonl
mov dword [edi], eax
mov ebx, dword [esi + 0xf0]
push 0x3e8
mov dl, byte [ebx + 8]
neg dl
sbb edx, edx
and edx, 8
mov edi, edx
call sub.WS2_32.dll_htonl
test edi, edi
mov dword [ebx + edi + 0x14], eax
je 0x599d28
mov eax, dword [esi + 0xf0]
push ebp
lea ebp, [edi + eax + 0x18]
mov eax, dword [esp + 0x20]
push eax
call sub.WS2_32.dll_htonl
mov ebx, eax
xor eax, eax
push eax
xor edi, edi
call sub.WS2_32.dll_htonl
xor ecx, ecx
or edi, eax
or ebx, ecx
mov dword [ebp], edi
mov dword [ebp + 4], ebx
pop ebp
jmp 0x599d3d
mov edx, dword [esp + 0x1c]
mov edi, dword [esi + 0xf0]
push edx
add edi, 0x18
call sub.WS2_32.dll_htonl
mov dword [edi], eax
mov edi, dword [esi + 0x38]
mov ecx, dword [esi + 0xf0]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop ebx
je 0x599d7a
mov ecx, dword [esp + 8]
cmp edi, ecx
jne 0x599d7a
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
add edx, ecx
mov dword [eax], edx
mov ecx, dword [eax + 4]
adc ecx, 0
mov dword [eax + 4], ecx
pop edi
pop esi
pop ecx
ret 0xc

Function at 0x599d80
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push eax
call sub.WS2_32.dll_htonl
mov ecx, dword [str.moov]
lea edx, [esp + 0x10]
mov dword [esp], eax
push 0
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x10]
push edx
lea eax, [esp + 8]
push 8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x599dca
cmp dword [esp + 0x10], 8
jne 0x599dca
mov eax, 1
add esp, 8
ret 8
xor eax, eax
add esp, 8
ret 8
Function at 0x599de0
Capabilities:
Read file via mapping

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push 0
push 0
push 0
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0xc], ebx
jne 0x599e06
pop ebx
pop ecx
ret 0x14
push esi
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0xc], 1
lea ecx, [edi + 4]
push ecx
push 0
push 0
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x599ea3
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x24]
test ebx, ebx
jl 0x599e74
jg 0x599e3f
cmp ebp, 0xffffffff
jbe 0x599e74
add ebp, 8
push 1
adc ebx, 0
call sub.WS2_32.dll_htonl
mov dword [edi + esi - 8], eax
mov edx, dword [str.mdat]
mov eax, ebx
push ebx
sar eax, 0x1f
mov dword [edi + esi - 4], edx
call sub.WS2_32.dll_htonl
push ebp
mov dword [edi + esi], eax
call sub.WS2_32.dll_htonl
mov dword [edi + esi + 4], eax
jmp 0x599e7d
push ebp
call sub.WS2_32.dll_htonl
mov dword [edi + esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret 0x14

Function at 0x599ec0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push edi
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 8]
push 0x20
rep stosd dword es:[edi], eax
call sub.WS2_32.dll_htonl
mov ecx, dword [0x6c2ec8]
mov edx, dword [str.isomiso2avc1mp41]
mov dword [esp + 8], eax
mov eax, dword [str.ftypisom]
mov dword [esp + 0xc], eax
mov eax, dword [0x6c2eb4]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6c2eb8]
mov dword [esp + 0x18], edx
mov edx, dword [0x6c2ebc]
push 8
mov byte [esp + 0x1a], 2
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
call sub.WS2_32.dll_htonl
mov esi, dword [esp + 0x44]
mov ecx, dword [str.mdat]
mov dword [esp + 0x28], eax
mov eax, dword [str.free]
push 0
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x40]
push esi
lea edx, [esp + 0x10]
push 0x30
push edx
push eax
mov dword [esp + 0x48], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x599f7a
cmp dword [esi], 0x30
jne 0x599f7a
mov eax, dword [esp + 0x40]
pop edi
pop esi
mov dword [eax], 0x28
mov dword [eax + 4], 0
mov eax, 1
add esp, 0x30
ret 0xc
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret 0xc
Function at 0x599f90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push esi
mov esi, ecx
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
push 0x24
call sub.WS2_32.dll_htonl
mov dword [esp + 0xc], eax
mov eax, dword [str.edts]
push 0x1c
mov dword [esp + 0x14], eax
call sub.WS2_32.dll_htonl
mov ecx, dword [str.elst]
push 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
call sub.WS2_32.dll_htonl
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x78]
push eax
call sub.WS2_32.dll_htonl
push 1
mov dword [esp + 0x28], eax
call sub.WS2_32.dll_htonl
mov esi, dword [esi + 0xcc]
mov dword [esp + 0x2a], eax
push esi
call sub.WS2_32.dll_htonl
mov ecx, dword [esp + 0x34]
lea edx, [esp + 8]
mov dword [esp + 0x28], eax
push 0
push edx
lea eax, [esp + 0x14]
push 0x24
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
add esp, 0x28
ret 4
Function at 0x59c6e0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x62c710
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], 0x6329c0
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [0x6cc708]
lea edi, [esi + 0x18]
mov dword [esp + 0x28], ebx
mov dword [edi], eax
mov ecx, dword [0x6cc708]
mov dword [esi + 0x1c], ecx
mov edx, dword [0x6cc708]
mov dword [esi + 0x20], edx
mov eax, dword [0x6cc708]
mov dword [esi + 0x2c], eax
mov ecx, dword [0x6cc708]
mov dword [esi + 0x30], ecx
lea ebp, [esi + 0x34]
lea edx, [ebp + 4]
mov dword [ebp], ebx
mov dword [ebp + 8], ebx
mov word [edx], bx
mov ecx, dword [0x6cc708]
lea eax, [esi + 0x40]
mov dword [eax], ecx
mov edx, dword [esp + 0x30]
mov byte [esp + 0x28], 7
push edx
push 0x6a00a0
push eax
mov dword [esi], 0x63e198
call fcn.005fb90b
mov eax, dword [esp + 0x40]
add esp, 0xc
push eax
push 0x6a00a0
push edi
call fcn.005fb90b
mov eax, dword [esp + 0x44]
add esp, 0xc
cmp eax, ebx
je 0x59c7ad
push eax
lea eax, [esi + 0x1c]
push 0x6a00a0
push eax
call fcn.005fb90b
add esp, 0xc
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x59c7c7
push eax
lea eax, [esi + 0x20]
push 0x6a00a0
push eax
call fcn.005fb90b
add esp, 0xc
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
push eax
lea eax, [esi + 0x2c]
push 0x6a00a0
push eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], edx
call fcn.005fb90b
mov edx, dword [esp + 0x58]
add esp, 0xc
cmp edx, ebx
je 0x59c813
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x59c813
push edx
lea eax, [esi + 0x30]
push 0x6a00a0
push eax
call fcn.005fb90b
add esp, 0xc
mov edi, dword [esp + 0x50]
cmp edi, ebx
je 0x59c8e0
push edi
call fcn.005e639f
add esp, 4
test eax, eax
je 0x59c8e0
cmp dword [ebp], ebx
je 0x59c89c
push edi
call fcn.005e639f
add esp, 4
test eax, eax
je 0x59c89c
mov eax, dword [ebp]
cmp eax, edi
ja 0x59c89c
push eax
call fcn.005e639f
mov ecx, dword [ebp]
add esp, 4
lea edx, [ecx + eax*2]
cmp edx, edi
jb 0x59c89c
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x1c], bx
call fcn.00402410
mov eax, dword [esp + 0x14]
mov byte [esp + 0x28], 8
cmp eax, ebx
jne 0x59c884
lea eax, [esp + 0x18]
push eax
mov ecx, ebp
call fcn.00402410
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 7
call fcn.00401070
jmp 0x59c8e0
mov ecx, ebp
call fcn.00401070
push edi
call fcn.005e639f
add esp, 4
test eax, eax
je 0x59c8e0
push edi
call fcn.005e639f
lea eax, [eax + eax + 2]
push eax
call fcn.005feedc
add esp, 8
cmp eax, ebx
mov dword [ebp], eax
je 0x59c8e0
push edi
call fcn.005e639f
mov ecx, dword [ebp]
push edi
push ecx
mov dword [ebp + 8], eax
call fcn.005e6569
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x24