joyce8/EMBER2024-capa huggingface dataset:
Function at 0x596460
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration
Start tcp server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0x14]
push 6
push 1
push 2
mov dword [ebp - 0x28], 0x10
mov dword [ebp - 0x2c], 1
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x596631
xorps xmm0, xmm0
mov eax, 2
push 0x7f000001
movlpd qword [ebp - 0xc], xmm0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
xor eax, eax
push 4
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x2c]
push eax
push 4
push 0xffff
push esi
mov dword [edi + 4], 0xffffffff
mov dword [edi], 0xffffffff
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x59661f
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x59661f
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x59661f
cmp dword [ebp - 0x28], 0x10
jl 0x59661f
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x59661f
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x59661f
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x59661f
push 1
push esi
call fcn.0059f290
add esp, 8
test eax, eax
js 0x59661f
push 0
push 0x2710
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], esi
push 1
push eax
mov dword [ebp - 0x30], 0x300
call fcn.00592f20
add esp, 0x10
push 0
push 0
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x59661f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x59661f
cmp dword [ebp - 0x28], 0x10
jl 0x59661f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x59661f
cmp dword [ebp - 0x28], 0x10
jl 0x59661f
mov ax, word [ebp - 0x14]
cmp ax, word [ebp - 0x24]
jne 0x59661f
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
jne 0x59661f
mov ax, word [ebp - 0x12]
cmp ax, word [ebp - 0x22]
jne 0x59661f
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [edi]
call esi
push dword [edi + 4]
call esi
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.006773ff
mov esp, ebp
pop ebp
ret
Function at 0x596680
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [eax], ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 8], eax
test eax, eax
jne 0x596817
push esi
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x596803
push edi
nop dword [eax]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5966de
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5966d0
sub eax, edx
lea ecx, [eax + 1]
jmp 0x5966e0
xor ecx, ecx
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], ecx
cmp eax, 2
jne 0x5966f2
mov eax, 0x10
jmp 0x596700
cmp eax, 0x17
jne 0x5967a5
mov eax, 0x1c
cmp dword [esi + 0x18], 0
mov dword [ebp - 4], eax
je 0x5967a5
mov edx, dword [esi + 0x10]
test edx, edx
je 0x5967a5
cmp edx, eax
jb 0x5967a5
add ecx, 0x20
add eax, ecx
push eax
call dword [0x78e010]
mov edi, eax
add esp, 4
test edi, edi
je 0x5967f5
mov ecx, dword [esi]
mov dword [edi], ecx
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edi + 0xc], eax
lea eax, [edi + 0x20]
push ecx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], eax
push dword [esi + 0x18]
push eax
call fcn.00679930
mov edx, dword [ebp - 0xc]
add esp, 0xc
test edx, edx
je 0x596793
mov eax, dword [edi + 0x18]
add eax, dword [ebp - 4]
push edx
mov dword [edi + 0x14], eax
push dword [esi + 0x14]
push eax
call fcn.00679930
add esp, 0xc
mov eax, dword [ebp - 0x10]
test ebx, ebx
cmove ebx, edi
test eax, eax
je 0x5967a2
mov dword [eax + 0x1c], edi
mov dword [ebp - 0x10], edi
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x5966c0
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
pop edi
test eax, eax
je 0x5967c2
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
je 0x5967ff
test ebx, ebx
je 0x5967e6
nop word [eax + eax]
mov esi, dword [ebx + 0x1c]
push ebx
call dword [0x78e014]
add esp, 4
mov ebx, esi
test esi, esi
jne 0x5967d0
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 8
mov dword [ebp - 8], esi
jmp 0x5967b3
test ebx, ebx
jne 0x59680f
mov esi, 0x2af9
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x596a10
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push esi
mov esi, dword [ebp + 8]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x596a59
push ebx
push esi
lea eax, [ebp - 0x18]
push eax
push 2
call fcn.00596820
add esp, 0x10
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x596a8a
push ebx
push esi
lea eax, [ebp - 0x14]
push eax
push 0x17
call fcn.00596820
add esp, 0x10
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.006773ff
mov esp, ebp
pop ebp
ret

Function at 0x596c00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.0068b6e8
add esp, 0x18
test eax, eax
je 0x596c22
cmp eax, 0xffffffff
jne 0x596c24
xor eax, eax
pop ebp
ret

Function at 0x596c70
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ecx, 0x2b
test edi, edi
je 0x596d17
mov esi, dword [ebp + 0xc]
nop dword [eax]
push 4
lea eax, [ebp + 0x10]
mov ebx, 4
push eax
push dword [ebp + 8]
cmp edi, ebx
cmovb ebx, edi
call fcn.0057cf30
add esp, 0xc
cmp eax, 4
jne 0x596cd5
cmp byte [0x7a4f54], 0
jne 0x596ce0
push 2
push eax
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov ecx, eax
test eax, eax
jne 0x596d19
mov eax, dword [ebp + 0x10]
jmp 0x596cfc
imul eax, dword [0x7a4f50], 0x41c64e6d
add eax, 0x3039
mov dword [0x7a4f50], eax
rol eax, 0x10
xor ecx, ecx
mov dword [ebp + 0x10], eax
test ebx, ebx
je 0x596d0f
mov byte [esi], al
dec edi
inc esi
shr eax, 8
sub ebx, 1
jne 0x596d00
mov dword [ebp + 0x10], eax
test edi, edi
jne 0x596c90
mov eax, ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x596d20
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x8c], eax
mov eax, ebx
and eax, 0xfffffffe
mov dword [ebp - 0x90], edx
cmp eax, 0x100
jae 0x596e7f
test bl, 1
je 0x596e7f
push esi
dec ebx
lea esi, [ebp - 0x84]
push edi
mov edi, ebx
mov dword [ebp + 0x10], ebx
shr edi, 1
mov ecx, 0x2b
je 0x596e29
nop dword [eax]
push 4
lea eax, [ebp - 0x88]
mov ebx, 4
push eax
push dword [ebp - 0x8c]
cmp edi, ebx
cmovb ebx, edi
call fcn.0057cf30
add esp, 0xc
cmp eax, 4
jne 0x596dd1
cmp byte [0x7a4f54], 0
jne 0x596de3
push 2
push eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov ecx, eax
test eax, eax
jne 0x596e6e
mov eax, dword [ebp - 0x88]
jmp 0x596e02
imul eax, dword [0x7a4f50], 0x41c64e6d
add eax, 0x3039
mov dword [0x7a4f50], eax
rol eax, 0x10
xor ecx, ecx
mov dword [ebp - 0x88], eax
test ebx, ebx
je 0x596e18
mov byte [esi], al
dec edi
inc esi
shr eax, 8
sub ebx, 1
jne 0x596e06
mov dword [ebp - 0x88], eax
test edi, edi
jne 0x596d80
mov edx, dword [ebp - 0x90]
mov ebx, dword [ebp + 0x10]
mov eax, ecx
test eax, eax
jne 0x596e6e
test ebx, ebx
je 0x596e69
lea esi, [ebp - 0x84]
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
mov eax, ecx
and ecx, 0xf
shr eax, 4
movzx eax, byte [eax + str.0123456789abcdef]
mov byte [edx], al
movzx eax, byte [ecx + str.0123456789abcdef]
mov byte [edx + 1], al
add edx, 2
sub ebx, 2
jne 0x596e40
mov byte [edx], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x2b
xor ecx, ebp
pop ebx
call fcn.006773ff
mov esp, ebp
pop ebp
ret

Function at 0x596ea0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00679eb0
add esp, 0xc
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
pop ebp
ret
Function at 0x59b220
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
lea esi, [ebx + 1]
push esi
push ebx
call dword [0x78e018]
mov edi, eax
add esp, 8
test edi, edi
je 0x59b27a
nop dword [eax]
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x59b296
cmp esi, ebx
je 0x59b296
cmp esi, 0x8000
ja 0x59b296
cmp esi, ebx
jb 0x59b28d
push esi
push edi
call dword [0x78e018]
mov edi, eax
add esp, 8
test edi, edi
jne 0x59b240
mov ebx, dword [ebp - 4]
push ebx
call dword [0x78e014]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [0x78e014]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x59c8d0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov al, byte [edi]
test al, al
jne 0x59c909
pop edi
mov eax, 0xe
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
push esi
cmp al, 0x5b
jne 0x59ca9b
cmp ebx, 4
jb 0x59ca85
inc edi
sub ebx, 2
cmp byte [ebx + edi], 0x5d
lea esi, [ebx + edi]
jne 0x59ca85
push str.0123456789abcdefABCDEF:.
push edi
call fcn.006960d0
add esp, 8
cmp ebx, eax
je 0x59c9fd
mov dword [ebp - 0x50], eax
add eax, edi
mov dword [ebp - 0x54], eax
cmp byte [eax], 0x25
jne 0x59ca85
inc eax
xor ebx, ebx
push 2
mov esi, eax
mov dword [ebp - 0x4c], eax
push 0x6df30c
push esi
call fcn.006930f0
add esp, 0xc
test eax, eax
jne 0x59c97f
mov cl, byte [esi + 2]
lea eax, [esi + 2]
test cl, cl
je 0x59c97f
cmp cl, 0x5d
cmovne esi, eax
mov al, byte [esi]
test al, al
je 0x59ca6f
lea ecx, [ebp - 0x14]
sub ecx, esi
nop
cmp al, 0x5d
je 0x59c9a5
cmp ebx, 0xf
jge 0x59c9a5
mov byte [ecx + esi], al
inc ebx
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x59c990
test ebx, ebx
je 0x59ca6f
cmp byte [esi], 0x5d
jne 0x59ca6f
cmp ebx, 0x10
jae 0x59cac3
lea eax, [ebp - 0x14]
mov byte [ebp + ebx - 0x14], 0
push eax
call dword [0x78e01c]
mov ecx, dword [ebp - 0x48]
add esp, 4
mov dword [ecx + 0x14], eax
test eax, eax
jne 0x59c9f1
pop esi
pop edi
mov eax, 7
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x54]
mov byte [eax], 0
lea eax, [ebp - 0x14]
mov byte [esi], 0
push eax
push edi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x59ca85
push 0x2e
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x17
call sub.WS2_32.dll_inet_ntop
test eax, eax
je 0x59ca59
lea edx, [ebp - 0x44]
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x59ca30
sub edx, ecx
cmp edx, ebx
jae 0x59ca59
lea ecx, [ebp - 0x44]
mov esi, edi
mov eax, ecx
sub esi, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x59ca46
lea esi, [edx + edi]
mov byte [esi + 1], al
mov byte [esi], 0x5d
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
pop esi
pop edi
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
pop esi
pop edi
mov eax, 0x16
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
push str.__r_n_t_:____________
push edi
call fcn.00685b80
add esp, 8
cmp ebx, eax
je 0x59ca5c
mov ecx, dword [ebp - 4]
mov eax, 0x15
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.006773ff
mov esp, ebp
pop ebp
ret
call fcn.00677d69
int3
Function at 0x5a8750
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push dword [ebp + 0x10]
call fcn.00451ba0
mov esi, dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 4], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x78e010]
mov edi, eax
add esp, 8
test edi, edi
je 0x5a88b0
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x5a87ce
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [ebp + 0xc]
push ebx
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp + 0xc], eax
push eax
mov eax, dword [esi + 8]
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp - 4]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x5a882b
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
nop dword [eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp - 4], 1
jne 0x5a87f0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x5a8857
mov eax, dword [esi + 4]
push 1
push 0x6e117d
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x6e117e
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x5a8830
push dword [ebp + 0x18]
call fcn.00451ba0
mov ecx, dword [edi]
push eax
push dword [ebp + 0x14]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [ebp + 0x1c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x5a887f
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x78e014]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x1b
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a8980
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x5a89b5
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push dword [ebp + 0x10]
call fcn.00451ba0
add esp, 4
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [ebp - 4], 0x20
jne 0x5a8a03
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 8]
test eax, eax
je 0x5a8a11
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x5a8a21
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x5ab260
Capabilities:
Create directory

Disassembly:
sub esp, 0x14
push ebx
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x5ab280
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov eax, dword [esp + 0x28]
test eax, eax
je 0x5ab2a6
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x5ab292
mov ecx, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x5ab29a
mov eax, dword [eax]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
jmp 0x5ab2b9
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x5ab2b0
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x5ab2c6
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0x14
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x14]
xorps xmm0, xmm0
push eax
lea eax, [esp + 0x10]
movq qword [esp + 0x18], xmm0
push esi
push eax
call fcn.005abee0
add esp, 0xc
cmp dword [esp + 0xc], 3
je 0x5ab309
push str.boost::filesystem::create_directory
push edi
push esi
push ebx
call fcn.005ad4d0
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x14
ret

Function at 0x5ab7c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x5ab7d6
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [esp + 8], eax
jmp fcn.005ab7e0
Function at 0x5ab970
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov cl, al
push ebx
mov ebx, eax
shr ebx, 4
and bl, 1
and cl, 1
push esi
mov esi, dword [esp + 0x10]
mov byte [esp + 0xb], cl
je 0x5aba1d
and eax, 0xfffffffe
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x5ab99f
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x5aba1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x5abab0
cmp eax, 3
je 0x5abab0
cmp eax, 0x7b
je 0x5abab0
cmp eax, 0xf
je 0x5abab0
cmp eax, 0x15
je 0x5abab0
cmp eax, 0x57
je 0x5abab0
cmp eax, 0xa1
je 0x5abab0
cmp eax, 0x35
je 0x5abab0
cmp eax, 0x43
je 0x5abab0
push str.boost::filesystem::remove
push dword [esp + 0x1c]
push esi
push eax
call fcn.005ad4d0
add esp, 0x10
xor al, al
pop esi
pop ebx
pop ecx
ret
mov eax, esi
test bl, bl
jne 0x5aba34
cmp dword [esi + 0x14], 8
jb 0x5aba2b
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x5aba43
cmp dword [esi + 0x14], 8
jb 0x5aba3c
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x5abab6
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 2
je 0x5abaaf
cmp edi, 3
je 0x5abaaf
cmp edi, 0x7b
je 0x5abaaf
cmp edi, 0xf
je 0x5abaaf
cmp edi, 0x15
je 0x5abaaf
cmp edi, 0x57
je 0x5abaaf
cmp edi, 0xa1
je 0x5abaaf
cmp edi, 0x35
je 0x5abaaf
cmp edi, 0x43
je 0x5abaaf
cmp byte [esp + 0xf], 0
je 0x5aba9c
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x5aba91
mov eax, dword [esi]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push str.boost::filesystem::remove
push dword [esp + 0x20]
push esi
push edi
call fcn.005ad4d0
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
pop esi
mov al, 1
pop ebx
pop ecx
ret

Function at 0x5abc90
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
push edi
cmp dword [esi + 0x14], 8
jb 0x5abca0
mov eax, dword [esi]
mov edi, dword [esp + 0xc]
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x5abcae
mov ecx, dword [edi]
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x5abcdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x5abcdd
push str.boost::filesystem::rename
push dword [esp + 0x18]
push esi
push edi
push eax
call fcn.005ad460
add esp, 0x14
pop edi
pop esi
ret
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5abcf3
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
pop edi
pop esi
ret
Function at 0x5ac050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6c9a4d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x78efc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov edx, edi
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
cmp dword [edi + 0x14], 8
jb 0x5ac091
mov edx, dword [edi]
mov ecx, edx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5ac0b0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0044d800
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2200000
push 3
push 0
push 7
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x34], esi
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], 0
cmp edx, 8
jb 0x5ac133
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x5ac129
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5ac1f0
push edx
push ecx
call fcn.006779b1
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp esi, 0xffffffff
jne 0x5ac1bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
cmp eax, 5
jne 0x5ac1ad
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x5ac164
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5ac194
test esi, 0x400
jne 0x5ac1aa
push esi
push edi
call fcn.005ab440
and esi, 0x10
mov dword [ebx + 4], eax
or esi, 0x20
add esp, 8
shr esi, 4
mov dword [ebx], esi
jmp 0x5ac1d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x2c]
push edi
push eax
push ebx
call fcn.005ab6d0
add esp, 0x10
jmp 0x5ac1d2
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x2c]
push edi
push eax
push ebx
call fcn.005ab6d0
add esp, 0x10
jmp 0x5ac1d2
push dword [ebp - 0x2c]
push edi
push esi
push ebx
call fcn.005abd30
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006773ff
mov esp, ebp
pop ebp
ret
call fcn.00682da2
int3