joyce8/EMBER2024-capa huggingface dataset:
Function at 0x502770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ebf28
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x676890]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
mov esi, ecx
mov ecx, dword [esp + 8]
push ecx
push edx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.00502230
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.00502510
cmp dword [esp + 0x24], 0x10
jb 0x50280a
mov edx, dword [esp + 0x10]
push edx
call fcn.0059fc2a
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005a09eb
add esp, 0x30
ret 0x1c

Function at 0x503c10
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x676890]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, ecx
call fcn.00503bf0
mov ecx, esi
call fcn.005194a0
lea eax, [esp + 4]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x503c5e
xor al, al
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.005a09eb
add esp, 0x194
ret
mov ecx, dword [esp + 0x194]
mov al, 1
mov byte [esi + 4], al
pop esi
xor ecx, esp
call fcn.005a09eb
add esp, 0x194
ret

Function at 0x508650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f2613
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004fd3d0
xor eax, eax
mov dword [esi], vtable.CGraphicImageTexture.0
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x20], al
mov ecx, esi
mov byte [esp + 0x14], 1
call fcn.005085b0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x5086c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f2613
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CGraphicImageTexture.0
mov dword [esp + 0x14], 1
call fcn.005085e0
cmp dword [esi + 0x34], 0x10
jb 0x50870d
mov eax, dword [esi + 0x20]
push eax
call fcn.0059fc2a
add esp, 4
xor eax, eax
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], eax
mov ecx, esi
mov byte [esi + 0x20], al
mov dword [esp + 0x14], 0xffffffff
call fcn.004fd3f0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x508760
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f4eb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x20]
push eax
call fcn.004fdac0
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.CGraphicImage.0
call fcn.00508650
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x78], ecx
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8

Function at 0x5087d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f2638
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CGraphicImage.0
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.005086c0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004fda30
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x509290
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
mov esi, ecx
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x5092a7
xor al, al
pop esi
ret 4
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esi + 4], eax
mov al, 1
pop esi
ret 4

Function at 0x50a4b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f2763
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
push eax
call fcn.004fdac0
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CAttributeData.0
call fcn.0044a600
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 1
call fcn.0044a600
fldz
fstp dword [esi + 0x30]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x514260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f2638
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
push eax
call fcn.004fdac0
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CGraphicText.0
call fcn.00514020
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x5142c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f2638
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CGraphicText.0
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.00513ba0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004fda30
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x519720
Capabilities:
Create directory

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x5197c7
cmp byte [edi], 0
je 0x5197c7
mov eax, edi
lea edx, [eax + 1]
jmp 0x519740
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x519740
sub eax, edx
cmp eax, 3
jb 0x519757
cmp byte [edi + 1], 0x3a
jne 0x519757
add edi, 3
mov eax, edi
mov dword [esp + 8], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x519760
push ebp
sub eax, edx
lea ebp, [eax + 1]
push esi
push ebp
call fcn.0059ebd0
add esp, 4
cmp byte [edi], 0
mov esi, eax
je 0x5197bc
push ebx
xor ebx, ebx
mov eax, dword [esp + 0x14]
mov al, byte [eax]
cmp al, 0x2f
je 0x51978f
cmp al, 0x5c
jne 0x5197ac
push ebp
push 0
push esi
call fcn.0059fdd0
push ebx
push edi
push esi
call fcn.005a13f0
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esp + 0x14]
inc eax
inc ebx
cmp byte [eax], 0
mov dword [esp + 0x14], eax
jne 0x519781
pop ebx
push esi
call fcn.005a0be9
add esp, 4
pop esi
pop ebp
pop edi
ret
Function at 0x519c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5f3430
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x676890]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, dword [esp + 0x78]
mov eax, dword [esp + 0x74]
mov ebp, dword [esp + 0x70]
push 0xa
mov ecx, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
call fcn.0044cdf0
mov esi, dword [edi + 0x10]
cmp dword [edi + 0xc], esi
jbe 0x519cdc
call fcn.005a01dd
mov ebx, dword [edi]
mov edi, dword [edi + 0xc]
mov ecx, dword [esp + 0x14]
cmp edi, dword [ecx + 0x10]
jbe 0x519cf3
call fcn.005a01dd
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
push esi
push ebx
push edi
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.0041d380
xor ebx, ebx
mov eax, ebp
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x519d20
sub eax, edx
push eax
push ebp
lea ecx, [esp + 0x48]
call fcn.00403f00
mov dword [esp + 0x68], ebx
xor edi, edi
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov eax, ebp
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x519d50
sub eax, edx
push eax
push edi
push ebp
lea ecx, [esp + 0x4c]
call fcn.00445c70
mov esi, eax
cmp esi, ebx
jl 0x519e49
cmp esi, dword [esp + 0x54]
jbe 0x519d7a
call fcn.005a01dd
mov eax, dword [esp + 0x44]
mov edi, 0x10
cmp dword [esp + 0x58], edi
jae 0x519d8d
lea eax, [esp + 0x44]
cmp byte [eax + esi], 0x22
jne 0x519db2
push 1
inc esi
push esi
push 0x62b7e8
lea ecx, [esp + 0x4c]
call fcn.004191a0
cmp eax, ebx
jl 0x519e61
lea edi, [eax + 1]
jmp 0x519dce
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x519db7
sub eax, edx
push eax
push esi
push ebp
lea ecx, [esp + 0x4c]
call fcn.004191a0
mov edi, eax
sub eax, esi
push eax
push esi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x4c]
call fcn.004478f0
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x6c], 1
call fcn.00423670
mov esi, 0x10
mov byte [esp + 0x68], bl
cmp dword [esp + 0x3c], esi
jb 0x519e0b
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0059fc2a
add esp, 4
cmp edi, dword [esp + 0x54]
jb 0x519d40
cmp dword [esp + 0x58], esi
jb 0x519e28
mov ecx, dword [esp + 0x44]
push ecx
call fcn.0059fc2a
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.005a09eb
add esp, 0x58
ret
cmp dword [esp + 0x58], 0x10
jb 0x519e5d
mov edx, dword [esp + 0x44]
push edx
call fcn.0059fc2a
add esp, 4
xor al, al
jmp 0x519e2a
cmp dword [esp + 0x58], edi
jb 0x519e5d
mov eax, dword [esp + 0x44]
push eax
call fcn.0059fc2a
add esp, 4
xor al, al
jmp 0x519e2a
Function at 0x51a670
Capabilities:
Get system information on windows
Print debug messages
Read file via mapping

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x24
push esi
mov esi, ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x130], ecx
test eax, eax
jne 0x51a68e
mov eax, dword [esi + 0x114]
mov edx, eax
add edx, ecx
mov dword [esi + 0x134], eax
cmp edx, dword [esi + 0x114]
jbe 0x51a6a9
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
push ebx
push ebp
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esi + 0x130]
mov edi, dword [esp + 0x2c]
mov eax, ecx
xor edx, edx
div edi
push 0
imul eax, edi
mov ebx, eax
mov eax, dword [esi + 0x134]
mov edi, ecx
add ecx, eax
push ecx
mov ecx, dword [esi + 0x110]
push 0
push 2
push 0
push ecx
lea ebp, [eax + edx]
sub edi, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 0x12c], eax
test eax, eax
jne 0x51a712
push str.CMappedFile::Map__m_hFM_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
push ebp
push ebx
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x138], eax
test eax, eax
jne 0x51a749
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CMappedFile::Map__m_lpMapData__lu
call fcn.00519180
add esp, 8
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x24
ret 0xc
mov edx, dword [esp + 0x38]
add eax, edi
mov dword [esi + 0x13c], eax
mov dword [edx], eax
mov eax, dword [esi + 0x13c]
mov ecx, dword [esi + 0x134]
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x128], 0
call fcn.0051a570
mov eax, dword [esi + 0x134]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x24
ret 0xc
Function at 0x51d5d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5f3430
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x676890]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, dword [esp + 0x74]
mov eax, dword [esp + 0x78]
mov ebp, ecx
push 0xa
mov ecx, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
call fcn.0044cdf0
mov esi, dword [edi + 0x10]
cmp dword [edi + 0xc], esi
jbe 0x51d62a
call fcn.005a01dd
mov ebx, dword [edi]
mov edi, dword [edi + 0xc]
mov ecx, dword [esp + 0x14]
cmp edi, dword [ecx + 0x10]
jbe 0x51d641
call fcn.005a01dd
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
push esi
push ebx
push edi
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.0041d380
xor esi, esi
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], esi
mov byte [esp + 0x44], 0
mov eax, dword [esp + 0x70]
push eax
mov ecx, ebp
mov dword [esp + 0x6c], esi
call fcn.0051d440
mov edi, eax
xor ebp, ebp
jmp 0x51d680
mov ebx, dword [esp + 0x18]
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x51d690
sub eax, edx
push eax
push ebp
push ebx
mov ecx, edi
call fcn.00445c70
mov esi, eax
test esi, esi
jl 0x51d79d
cmp esi, dword [edi + 0x14]
jbe 0x51d6b7
call fcn.005a01dd
mov ebp, 0x10
cmp dword [edi + 0x18], ebp
jb 0x51d6c6
mov eax, dword [edi + 4]
jmp 0x51d6c9
lea eax, [edi + 4]
cmp byte [eax + esi], 0x22
jne 0x51d6ec
push 1
inc esi
push esi
push 0x62b7e8
mov ecx, edi
call fcn.004191a0
test eax, eax
jl 0x51d7b6
lea ebp, [eax + 1]
jmp 0x51d706
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x51d6f1
sub eax, edx
push eax
push esi
push ebx
mov ecx, edi
call fcn.004191a0
mov ebp, eax
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
call fcn.004478f0
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x6c], 1
call fcn.00423670
mov esi, 0x10
mov byte [esp + 0x68], 0
cmp dword [esp + 0x3c], esi
jb 0x51d742
mov edx, dword [esp + 0x28]
push edx
call fcn.0059fc2a
add esp, 4
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x51d747
sub eax, edx
push eax
push ebp
push ebx
mov ecx, edi
call fcn.00445c70
test eax, eax
jl 0x51d767
cmp ebp, dword [edi + 0x14]
jb 0x51d680
cmp dword [esp + 0x58], esi
jb 0x51d77a
mov edx, dword [esp + 0x44]
push edx
call fcn.0059fc2a
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.005a09eb
add esp, 0x58
ret 0xc
cmp dword [esp + 0x58], 0x10
jb 0x51d7b1
mov eax, dword [esp + 0x44]
push eax
call fcn.0059fc2a
add esp, 4
or eax, 0xffffffff
jmp 0x51d77c
cmp dword [esp + 0x58], ebp
jb 0x51d7c9
mov ecx, dword [esp + 0x44]
push ecx
call fcn.0059fc2a
add esp, 4
mov eax, 0xfffffffe
jmp 0x51d77c
Function at 0x51d7d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5f3430
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x676890]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x676890]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, dword [esp + 0x74]
mov eax, dword [esp + 0x78]
mov ebp, ecx
push 0xa
mov ecx, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
call fcn.0044cdf0
mov esi, dword [edi + 0x10]
cmp dword [edi + 0xc], esi
jbe 0x51d82a
call fcn.005a01dd
mov ebx, dword [edi]
mov edi, dword [edi + 0xc]
mov ecx, dword [esp + 0x14]
cmp edi, dword [ecx + 0x10]
jbe 0x51d841
call fcn.005a01dd
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
push esi
push ebx
push edi
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.0041d380
xor esi, esi
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], esi
mov byte [esp + 0x44], 0
mov eax, dword [esp + 0x70]
push eax
mov ecx, ebp
mov dword [esp + 0x6c], esi
call fcn.0051d440
mov edi, eax
xor ebp, ebp
jmp 0x51d880
mov ebx, dword [esp + 0x18]
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x51d890
sub eax, edx
push eax
push ebp
push ebx
mov ecx, edi
call fcn.00445c70
mov esi, eax
test esi, esi
jl 0x51d99d
cmp esi, dword [edi + 0x14]
jbe 0x51d8b7
call fcn.005a01dd
mov ebp, 0x10
cmp dword [edi + 0x18], ebp
jb 0x51d8c6
mov eax, dword [edi + 4]
jmp 0x51d8c9
lea eax, [edi + 4]
cmp byte [eax + esi], 0x22
jne 0x51d8ec
push 1
inc esi
push esi
push 0x62b7e8
mov ecx, edi
call fcn.004191a0
test eax, eax
jl 0x51d9b5
lea ebp, [eax + 1]
jmp 0x51d906
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x51d8f1
sub eax, edx
push eax
push esi
push ebx
mov ecx, edi
call fcn.004191a0
mov ebp, eax
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
call fcn.004478f0
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x6c], 1
call fcn.00423670
mov esi, 0x10
mov byte [esp + 0x68], 0
cmp dword [esp + 0x3c], esi
jb 0x51d942
mov edx, dword [esp + 0x28]
push edx
call fcn.0059fc2a
add esp, 4
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x51d947
sub eax, edx
push eax
push ebp
push ebx
mov ecx, edi
call fcn.00445c70
test eax, eax
jl 0x51d967
cmp ebp, dword [edi + 0x14]
jb 0x51d880
cmp dword [esp + 0x58], esi
jb 0x51d97a
mov edx, dword [esp + 0x44]
push edx
call fcn.0059fc2a
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.005a09eb
add esp, 0x58
ret 0xc
cmp dword [esp + 0x58], 0x10
jb 0x51d9b1
mov eax, dword [esp + 0x44]
push eax
call fcn.0059fc2a
add esp, 4
xor al, al
jmp 0x51d97c
cmp dword [esp + 0x58], ebp
jb 0x51d9b1
mov ecx, dword [esp + 0x44]
push ecx
call fcn.0059fc2a
add esp, 4
xor al, al
jmp 0x51d97c
Function at 0x51dfe0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor eax, eax
mov esi, 0x20
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
add ebx, edx
mov ebp, eax
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebp, eax
xor ebx, ebp
add ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
sub eax, 0x61c88647
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
dec esi
add edx, ebx
test esi, esi
ja 0x51dff7
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], edx
pop ebx
ret

Function at 0x51e050
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, 0xc6ef3720
mov esi, 0x20
lea ebx, [ebx]
mov ebx, edx
shr ebx, 5
mov ebp, edx
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebp, eax
add ebx, edx
xor ebx, ebp
sub ecx, ebx
mov ebx, ecx
shr ebx, 5
mov ebp, ecx
shl ebp, 4
xor ebx, ebp
add eax, 0x61c88647
mov ebp, eax
and ebp, 3
mov ebp, dword [edi + ebp*4]
add ebx, ecx
add ebp, eax
xor ebx, ebp
dec esi
sub edx, ebx
test esi, esi
ja 0x51e070
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
ret
Function at 0x51e1a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
push esi
cmp edx, 0x10
jb 0x51e323
movsx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 1]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 2]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 3]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 4]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 5]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 6]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 7]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 8]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 9]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 0xa]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 0xb]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 0xc]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 0xd]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 0xe]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
movsx esi, byte [ecx + 0xf]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
add ecx, 0x10
sub edx, 0x10
cmp edx, 0x10
jae 0x51e1b5
test edx, edx
je 0x51e34b
jmp 0x51e330
movsx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x662ff0]
inc ecx
sub edx, 1
jne 0x51e330
not eax
pop esi
ret
Function at 0x51e650
Capabilities:
Get file size
Get system information on windows
Read file via mapping

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
push edi
xor ebp, ebp
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esp + 0x2c]
push ebp
push esi
push ebp
push 2
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
je 0x51e6ca
xor eax, eax
xor edx, edx
div edi
imul eax, edi
add edx, esi
push edx
push eax
push ebp
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
push esi
push edi
call fcn.0051e1a0
add esp, 8
mov esi, eax
test edi, edi
je 0x51e6b9
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x24
ret

Function at 0x51e730
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x51e759
xor eax, eax
pop esi
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x51eb30
Capabilities:
Get file size

Disassembly:
push ebp
push esi
push edi
mov esi, ecx
call fcn.0051eb10
mov ebp, dword [esp + 0x10]
push 0x104
lea eax, [esi + 8]
push ebp
push eax
call fcn.005a13f0
mov edi, dword [esp + 0x20]
add esp, 0xc
mov eax, 1
cmp edi, 2
jne 0x51eb68
mov ecx, 0xc0000000
lea eax, [edi + 1]
jmp 0x51eb6d
mov ecx, closesocket
xor edx, edx
cmp edi, 1
setne dl
push 0
push 0x80
add edx, 3
push edx
push 0
push eax
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x110], eax
cmp eax, 0xffffffff
je 0x51ebb3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 4], edi
pop edi
mov dword [esi + 0x114], eax
pop esi
mov eax, 1
pop ebp
ret 8
pop edi
mov dword [esi + 0x110], 0
pop esi
xor eax, eax
pop ebp
ret 8