joyce8/EMBER2024-capa huggingface dataset:
Function at 0x519af0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration
Start tcp server

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0x38], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], 0x10
xor eax, eax
inc eax
mov dword [esp + 8], eax
xor esi, esi
dec esi
mov dword [esp + 4], esi
mov dword [esp], esi
push 6
push eax
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, esi
je 0x519cdf
mov edi, eax
mov ebx, dword [ebp + 0x14]
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], eax
mov word [esp + 0x28], 2
push 0x7f000001
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x2c], eax
mov word [esp + 0x2a], 0
xor esi, esi
dec esi
mov dword [ebx + 4], esi
mov dword [ebx], esi
mov eax, 4
lea ecx, [esp + 8]
push eax
push ecx
push eax
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, esi
je 0x519cc4
lea eax, [esp + 0x28]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x519cc4
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x519cc4
cmp dword [esp + 0xc], 0x10
jl 0x519cc4
push 1
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x519cc4
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x519cc4
push 0x10
lea ecx, [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x519cc4
push 1
push edi
call fcn.005127d0
add esp, 8
test eax, eax
js 0x519cc4
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], 0x300
xor ecx, ecx
push ecx
push 0x2710
push 1
push eax
call fcn.00514b60
add esp, 0x10
xor eax, eax
push eax
push eax
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x519cc4
mov dword [esp + 0xc], 0x10
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2c]
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x519cc4
cmp dword [esp + 0xc], 0x10
jl 0x519cc4
mov dword [esp + 0xc], 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x519cc4
cmp dword [esp + 0xc], 0x10
jl 0x519cc4
movzx eax, word [esp + 0x28]
cmp ax, word [esp + 0x10]
jne 0x519cc4
mov eax, dword [esp + 0x2c]
cmp eax, dword [esp + 0x14]
jne 0x519cc4
movzx eax, word [esp + 0x2a]
cmp ax, word [esp + 0x12]
jne 0x519cc4
xor esi, esi
jmp 0x519cd8
mov eax, edi
mov edi, ebx
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
push eax
call ebx
push dword [edi]
call ebx
mov edi, dword [edi + 4]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x51d880
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x194
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 8], eax
test byte [ebp + 8], 2
jne 0x51d906
call fcn.004fb5f0
mov esi, eax
test eax, eax
jne 0x51d94c
push 0x754684
call fcn.0051d970
add esp, 4
mov dword [0x7ba8d0], eax
test eax, eax
je 0x51d8d4
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51d8d4
mov dword [0x7ba8cc], eax
sub esp, 0x14
movaps xmm0, xmmword [0x74dcb0]
movups xmmword [esp], xmm0
mov dword [esp + 0x10], 3
call fcn.00529cf0
add esp, 0x14
mov byte [0x7ba8d4], al
push 0x7ba8d8
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor esi, esi
jmp 0x51d94c
lea esi, [ebp - 0x198]
push 0x190
push 0xff
push esi
call fcn.00650600
add esp, 0xc
push esi
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x51d947
movzx eax, word [ebp - 0x198]
cmp eax, 0x202
je 0x51d89a
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov esi, 2
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
add esp, 0x194
pop esi
pop ebp
ret

Function at 0x51d970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x51d9bb
mov edi, eax
mov ebx, dword [ebp + 8]
push 0x7546c0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x7546d0
push ebx
call fcn.0066bfe0
add esp, 8
test eax, eax
je 0x51d9c1
test esi, esi
je 0x51d9e9
mov ecx, esi
call dword [section..00cfg]
push 8
jmp 0x51d9e2
xor ebx, ebx
mov eax, ebx
jmp 0x51d9f0
test esi, esi
je 0x51d9f8
push str.AddDllDirectory
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51d9f8
mov ecx, esi
call dword [section..00cfg]
push 0x800
push 0
push ebx
call esi
jmp 0x51d9f0
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x51d9bd
mov edi, eax
push dword [ebp + 8]
call fcn.0066b526
add esp, 4
mov ecx, dword [fcn.005f2b30]
mov dword [ebp - 0x10], edi
add eax, edi
lea ebx, [eax + eax]
add ebx, 2
call dword [section..00cfg]
push ebx
call ecx
add esp, 4
mov edi, eax
xor ebx, ebx
test eax, eax
je 0x51da96
push dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x51da96
push edi
call fcn.0066b526
add esp, 4
lea eax, [edi + eax*2]
push 0x743c78
push eax
call fcn.0066be6a
add esp, 8
push edi
call fcn.0066b526
add esp, 4
lea eax, [edi + eax*2]
push dword [ebp + 8]
push eax
call fcn.0066be6a
add esp, 8
test esi, esi
je 0x51da8d
mov ecx, esi
call dword [section..00cfg]
push 8
push 0
push edi
call esi
jmp 0x51da94
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov ecx, dword [fcn.005f2b80]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
jmp 0x51d9bd
Function at 0x530520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00661c21

Function at 0x532230
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0x30], eax
xor eax, eax
dec eax
lea edi, [esp + 8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
call fcn.005e0370
mov esi, eax
mov ebx, str.location
push ebx
call fcn.0066b230
add esp, 4
mov ecx, esi
push eax
push ebx
push edi
call fcn.005e0510
movzx ecx, byte [edi + 0xb]
mov eax, ecx
test cl, cl
jns 0x532283
mov eax, dword [esp + 0xc]
mov esi, dword [ebp + 8]
test eax, eax
je 0x5322a2
test cl, cl
jns 0x532292
mov edi, dword [esp + 8]
push eax
push edi
push esi
call fcn.00532460
add esp, 0xc
jmp 0x532433
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov ebx, eax
xor eax, eax
lea edi, [esp + 0x20]
mov dword [edi], eax
mov word [edi + 4], 0
push eax
push 3
push edi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
cmp eax, 3
jne 0x5322e2
movzx eax, word [esp + 0x20]
movzx ecx, word [esp + 0x22]
cmp ax, 0x58
jne 0x532336
cmp cx, 0x58
jne 0x532336
cmp ebx, 0x143
jle 0x53230f
lea eax, [ebx - 0x144]
cmp eax, 0x18
ja case.default.0x5322fe
mov ebx, 0x4747
jmp dword [eax*4 + 0x757c38]
mov ebx, 0x554d
jmp case.0x5322fe.324
cmp ebx, 0x130
jg 0x532379
cmp ebx, 0x7f
je case.0x5322fe.326
cmp ebx, 0x102
je case.0x5322fe.326
cmp ebx, 0x12f
jne case.0x5322fe.325
mov ebx, 0x5348
jmp case.0x5322fe.324
cmp al, 0x59
jne 0x53233f
cmp cl, 0x55
je 0x532348
cmp al, 0x43
jne 0x53234c
cmp cl, 0x53
jne 0x53234c
mov al, 0x52
mov cl, 0x53
movsx edx, al
xor al, 0x54
shl edx, 8
movsx ebx, cl
mov dword [esp + 4], ebx
xor cl, 0x50
or cl, al
mov ebx, 0x4c
cmovne ebx, dword [esp + 4]
or ebx, edx
cmp ebx, 0xffffffff
jne case.0x5322fe.324
mov byte [esi], 0
jmp 0x532433
cmp ebx, 0x131
je case.0x5322fe.326
cmp ebx, 0x134
je 0x5323bc
cmp ebx, 0x13a
jne case.0x5322fe.325
mov ebx, 0x494f
jmp case.0x5322fe.324
mov ebx, 0x5553
jmp case.0x5322fe.324
cmp ebx, 0x3b16
je 0x5323c3
cmp ebx, 0x52fa
je case.0x5322fe.326
jmp case.0x5322fe.325
mov ebx, 0x4a45
jmp case.0x5322fe.324
mov ebx, 0x4742
jmp case.0x5322fe.324
mov ebx, 0x494d
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov eax, ebx
sar eax, 8
mov ecx, edi
push eax
call fcn.005df090
movsx eax, bl
mov ecx, edi
push eax
call fcn.005df090
movzx eax, byte [esp + 0x2b]
test al, al
jns 0x5323ff
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
lea ebx, [esp + 0x14]
push eax
push edi
push ebx
call fcn.005324d0
add esp, 0xc
mov byte [esi], 1
movsd xmm0, qword [ebx]
movsd qword [esi + 4], xmm0
mov eax, dword [ebx + 8]
mov dword [esi + 0xc], eax
cmp byte [esp + 0x2b], 0
jns 0x532433
push dword [esp + 0x20]
call fcn.0064cd6e
add esp, 4
cmp byte [esp + 0x13], 0
jns 0x532446
push dword [esp + 8]
call fcn.0064cd6e
add esp, 4
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x534810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x53a8a0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [ecx + 4], 1
jne 0x534881
movzx edi, byte [ebp + 0x18]
mov eax, dword [esi]
mov ebx, dword [eax + 0x18]
mov ecx, ebx
call dword [section..00cfg]
movsx eax, byte [ebp + 0x14]
mov ecx, esi
push edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x30]
mov ecx, dword [ebp + 0x10]
push esi
call fcn.005dd970
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x7baeec
call fcn.005de2e0
mov esi, eax
mov edi, dword [ebp - 0x30]
xor ebx, ebx
dec ebx
mov eax, ebx
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x5348d3
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0xffffffff
call dword [section..00cfg]
mov ecx, edi
call dword [ebp - 0x24]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov eax, dword [esi]
mov cl, byte [ebp + 0x18]
xor cl, 1
movzx ecx, cl
mov edi, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], ebx
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
lea eax, [ebp - 0x30]
push eax
call edi
movzx eax, byte [ebp - 0x25]
test al, al
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov esi, eax
cmovs esi, edx
test esi, esi
je 0x5349a9
test al, al
lea esi, [ebp - 0x30]
cmovs esi, ecx
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x20], 0
je 0x534979
mov eax, dword [ebp - 0x24]
mov al, byte [eax]
movzx esi, al
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 0x18]
cmp ecx, dword [edx + 0x1c]
je 0x534982
lea edx, [ecx + 1]
mov edi, dword [ebp - 0x20]
mov dword [edi + 0x18], edx
mov byte [ecx], al
xor edi, edi
cmp esi, 0xffffffff
je 0x534950
mov edi, dword [ebp - 0x20]
mov al, byte [ebp - 0x25]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edi
mov ebx, dword [ebp - 0x24]
inc ebx
test al, al
lea esi, [ebp - 0x30]
cmovs esi, ecx
movzx edi, al
cmovs edi, edx
add edi, esi
mov dword [ebp - 0x24], ebx
cmp ebx, edi
jne 0x534922
jmp 0x5349a9
mov dword [ebp - 0x20], 0
jmp 0x53495c
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov edi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov dword [ebp - 0x10], 1
mov ecx, ebx
push esi
call edi
mov esi, eax
jmp 0x534946
shr al, 7
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0x20]
mov dword [edx], esi
test al, al
je 0x5349c1
push ecx
call fcn.0064cd6e
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x534877
Function at 0x53d0f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x7bb5a8]
test ebx, ebx
jne 0x53d168
push 0x24
call fcn.0064cd3e
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax + 4], edi
mov dword [eax], edi
push 0xc
call fcn.0064cd3e
add esp, 4
mov dword [esi + 8], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x10], ecx
mov dword [eax + 8], edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [esi + 0xc], ecx
lea eax, [esi + 0x18]
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], 1
mov dword [0x7bb5a8], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x53d172
mov edi, eax
push eax
call fcn.0066b526
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0053d180
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x53db10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [0x7bb5b0]
and eax, 1
neg eax
cmp eax, 0xfffffffd
je 0x53dbf5
xor esi, esi
xor ecx, ecx
dec ecx
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov ebx, dword [esi*8 + 0x75a144]
mov eax, dword [esi*8 + 0x75a140]
mov byte [ebp - 0x11], bl
lea ecx, [ebx + ebx]
push ecx
push eax
push edi
call fcn.00650080
add esp, 0xc
mov word [ebp + ebx*2 - 0x1c], 0
movzx eax, byte [ebp - 0x11]
mov ecx, eax
test al, al
jns 0x53db82
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
cmp ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], esi
ja 0x53dbb2
mov bl, 1
test ecx, ecx
je 0x53dbf9
mov edx, edi
test al, al
jns 0x53db9b
mov edx, dword [ebp - 0x1c]
xor edi, edi
mov esi, dword [ebp - 0x2c]
movzx esi, word [esi + edi*2]
cmp si, word [edx + edi*2]
jne 0x53dbda
inc edi
cmp ecx, edi
jne 0x53db9d
mov dword [ebp - 0x20], ecx
test al, al
mov esi, dword [ebp - 0x28]
lea edi, [ebp - 0x1c]
js 0x53dc02
test bl, bl
jne 0x53dbde
inc esi
movzx eax, byte [0x7bb5b0]
xor eax, 3
cmp esi, eax
mov ecx, 0xffffffff
jb 0x53db46
jmp 0x53dbf5
xor ebx, ebx
jmp 0x53dbb2
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x53dbe1
mov dword [ebp - 0x20], 0
jmp 0x53dbb2
push dword [ebp - 0x1c]
call fcn.0064cd6e
add esp, 4
jmp 0x53dbbc

Function at 0x53ee10
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x7aa024]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movzx ecx, byte [eax + 0xb]
test cl, cl
jns 0x53ee34
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov ebx, dword [ebp + 0xc]
lea esi, [ebp - 0x1c]
push ecx
push eax
push esi
call fcn.005ee120
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x53ee4e
mov esi, dword [ebp - 0x1c]
lea edi, [ebp - 0x28]
push ebx
push dword [ebp + 8]
push edi
call fcn.005ee120
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x53ee67
mov edi, dword [ebp - 0x28]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x1d], 0
jns 0x53ee82
push dword [ebp - 0x28]
call fcn.0064cd6e
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x53ee93
push dword [ebp - 0x1c]
call fcn.0064cd6e
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x53ef20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov edi, ecx
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
push edx
push ecx
push esi
call fcn.005ee120
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x53ef4e
mov esi, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x53ef6c
push dword [ebp - 0x1c]
call fcn.0064cd6e
add esp, 4
cmp dword [ebp + 8], 0
je 0x53f004
test esi, esi
je 0x53f004
xor eax, eax
dec eax
mov ecx, esi
add ecx, esi
cmovb ecx, eax
push ecx
call fcn.0064cda3
add esp, 4
mov ecx, edi
mov edi, eax
mov eax, ebx
lea ebx, [ebp - 0x1c]
push eax
push ecx
push ebx
call fcn.005ee120
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x53efae
mov ebx, dword [ebp - 0x1c]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x53efc8
push dword [ebp - 0x1c]
call fcn.0064cd6e
add esp, 4
test edi, edi
mov ebx, dword [ebp + 8]
je 0x53f01d
push edi
call fcn.0066b526
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.005ee4b0
add esp, 0xc
cmp byte [ebx + 0xb], 0
js 0x53f020
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebx], xmm0
push edi
call fcn.0064cdac
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
int3
push dword [ebx]
call fcn.0064cd6e
add esp, 4
jmp 0x53efec

Function at 0x53f200
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.005f1730
mov dword [esi], 0
test eax, eax
je 0x53f247
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x53f279
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x53f240
mov dword [esi], ebx
mov ebx, eax
call fcn.005e42e0
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.005e1870
lea ecx, [esi + 0x10]
call fcn.00600410
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.005e42e0
push dword [esi]
call fcn.005f2830
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
jmp 0x53f22d
Function at 0x540270
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0xa8], eax
test ecx, ecx
je 0x5402a8
cmp byte [ecx + 0xb], 0
js 0x54042d
xor eax, eax
mov byte [ecx], al
mov byte [ecx + 0xb], al
xor ebx, ebx
test edx, edx
je 0x540415
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
push ebx
push ebx
push edx
call fcn.00668a00
add esp, 0xc
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x60]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x20]
push 0xeb
push str....._base_files_file_util.cc
push str.ReadStreamToStringWithMaxSize
push esi
call fcn.005e42b0
add esp, 0x10
mov ecx, edi
push ebx
push esi
call fcn.005eec20
mov dword [esi + 0x30], ebx
pxor xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
push dword [ebp + 8]
call fcn.0065fbed
add esp, 4
push eax
call fcn.0066059d
add esp, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x54043e
mov eax, dword [esp + 0x44]
xor ecx, ecx
mov edx, eax
neg edx
sbb ecx, dword [esp + 0x40]
mov esi, 0xffff
cmovl esi, eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
cmovae esi, eax
xor edi, edi
lea ebx, [esp + 0x10]
mov dword [ebx + 4], edi
mov dword [ebx], edi
mov dword [ebx + 8], edi
inc esi
mov ecx, ebx
push edi
push esi
call fcn.005df5c0
cmp byte [esp + 0x1b], 0
mov ecx, dword [ebp + 8]
jns 0x540381
mov ebx, dword [esp + 0x10]
add ebx, edi
push ecx
push esi
push 1
push ebx
call fcn.006687f0
add esp, 0x10
test eax, eax
je 0x5403ba
mov ebx, eax
mov eax, dword [ebp + 0xc]
sub eax, edi
cmp eax, ebx
jb 0x540448
add ebx, edi
push dword [ebp + 8]
call fcn.0066811e
add esp, 4
test eax, eax
je 0x54044c
mov edi, ebx
push dword [ebp + 8]
call fcn.0066814a
add esp, 4
test eax, eax
sete bl
mov dword [esp + 0xc], edi
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x540405
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
mov edx, dword [ecx + 8]
mov esi, dword [esp + 0x18]
mov dword [ecx + 8], esi
movq xmm0, qword [esp + 0x10]
movq qword [ecx], xmm0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edx
push 0
push dword [esp + 0x10]
call fcn.005df5c0
cmp byte [esp + 0x1b], 0
js 0x540470
lea ecx, [esp + 0x60]
call fcn.005eec80
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
jmp 0x5402a8
mov esi, 0xffff
jmp 0x540353
xor ebx, ebx
jmp 0x5403ce
test edi, edi
mov eax, 0x10000
cmove esi, eax
lea eax, [ebx + esi]
lea ecx, [esp + 0x10]
push 0
push eax
call fcn.005df5c0
mov edi, ebx
lea ebx, [esp + 0x10]
jmp 0x540373
push dword [esp + 0x10]
call fcn.0064cd6e
add esp, 4
jmp 0x54040c
Function at 0x541640
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.005e0380
test al, al
je 0x541697
xor esi, esi
call fcn.005e0380
test al, al
je 0x541691
call fcn.005e0370
mov edi, eax
mov ecx, eax
push 0x75c877
call fcn.005e0410
test al, al
jne 0x5416be
mov ecx, edi
push str.vmodule
call fcn.005e0410
test al, al
jne 0x5416be
mov dword [0x7bb5dc], esi
mov eax, dword [ebx]
mov dword [0x7acbf0], eax
mov esi, ebx
mov bl, 1
test al, 1
jne 0x541740
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10
call fcn.0064cd3e
add esp, 4
mov esi, eax
mov ebx, str.vmodule
push ebx
call fcn.0066b230
add esp, 4
lea edx, [ebp - 0x1c]
mov ecx, edi
push eax
push ebx
push edx
call fcn.005e0510
mov eax, 0x75c877
push eax
call fcn.0066b230
add esp, 4
lea ebx, [ebp - 0x28]
mov ecx, edi
push eax
mov eax, 0x75c877
push eax
push ebx
call fcn.005e0510
mov ecx, esi
push 0x7bb5c8
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.006c8330
cmp byte [ebx + 0xb], 0
jns 0x541727
push dword [ebp - 0x28]
call fcn.0064cd6e
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x541738
push dword [ebp - 0x1c]
call fcn.0064cd6e
add esp, 4
mov ebx, dword [ebp + 8]
jmp 0x541691
mov eax, dword [0x7bb5d8]
test eax, eax
jne 0x541755
mov ecx, dword [0x7bb5c4]
test ecx, ecx
je 0x541777
jmp 0x541793
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x7bb5d8], 0
mov ecx, dword [0x7bb5c4]
test ecx, ecx
jne 0x541793
and byte [0x7acbf0], 0xfe
push 0xc
call fcn.0064cd3e
add esp, 4
mov ecx, eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
mov dword [0x7bb5c4], ecx
push dword [esi + 4]
call fcn.0053b8e0
cmp dword [esi + 0xc], 0
jne 0x5417b5
mov eax, dword [0x7bb5c4]
cmp byte [eax + 0xb], 0
jns 0x5417ae
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.006a2d60
mov ebx, eax
jmp 0x5416aa