joyce8/EMBER2024-capa huggingface dataset:
Function at 0x512620
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab760
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov edx, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
mov eax, dword [esi + 0x30cc]
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov ecx, dword [eax + 0x70]
push ecx
mov ecx, dword [esi + 0x80]
push edx
call fcn.00548d80
mov eax, dword [esi + 0x30cc]
mov edi, 1
mov dword [eax + 0xf0], edi
mov eax, dword [esi + 0x30cc]
add eax, 0x80
mov ecx, dword [eax]
mov edx, dword [eax + 4]
or ecx, edx
je 0x512722
mov ecx, dword [0x6614e8]
lea edx, [ebp + 8]
lea eax, [ebp - 0x14]
push edx
push eax
push 0
push 0
push str.bIgnMTCh
push ecx
xor bl, bl
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5126c3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x5126c3
mov bl, 1
mov edx, dword [esi + 0x80]
mov eax, dword [edx + 8]
test eax, eax
je 0x512722
test bl, bl
jne 0x512722
push 0x3f
push eax
call fcn.0056aa70
add esp, 8
test eax, eax
jne 0x512722
mov eax, dword [esi + 0x30cc]
mov ecx, dword [eax + 0xf4]
test ecx, ecx
jne 0x512715
mov ecx, dword [esi + 0x80]
mov eax, dword [0x6623a0]
push 0x50044
mov edx, dword [ecx + 8]
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x512722
mov dword [esi + 0x3118], edi
mov byte [esi + 0x311c], 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x513570
Capabilities:
Encode data using base64

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov eax, 0xaaaaaaab
push edi
lea ecx, [esi + 3]
mov edi, dword [esp + 0x18]
mul ecx
shr edx, 1
lea edx, [edx + esi + 7]
push edx
push edi
call fcn.005131d0
add esp, 8
test eax, eax
jne 0x51359f
pop edi
pop esi
pop ecx
ret 0xc
push edi
call fcn.005131c0
mov ecx, eax
add esp, 4
xor eax, eax
test esi, esi
jbe 0x513674
lea edx, [esi + 2]
mov eax, 0xaaaaaaab
mul edx
push ebx
push ebp
mov edi, dword [esp + 0x18]
mov ebp, edx
shr ebp, 1
mov ebx, 2
lea eax, [ebp + ebp*2]
mov dword [esp + 0x10], eax
lea edx, [ebx - 1]
cmp edx, esi
jae 0x5135e5
mov al, byte [edi + 1]
mov byte [esp + 0x20], al
jmp 0x5135ea
mov byte [esp + 0x20], 0
cmp ebx, esi
jae 0x5135f7
mov dl, byte [edi + 2]
mov byte [esp + 0x18], dl
jmp 0x5135fc
mov byte [esp + 0x18], 0
xor eax, eax
add ebx, 3
mov al, byte [edi]
add edi, 3
shr eax, 2
inc ecx
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_Unknown_error_in_HTTPConnection_constructor._n]
mov eax, dword [esp + 0x20]
mov byte [ecx - 1], dl
mov dl, byte [edi - 3]
and eax, 0xff
and edx, 3
mov esi, eax
and eax, 0xf
shl edx, 4
shr esi, 4
or edx, esi
mov esi, dword [esp + 0x18]
and esi, 0xff
inc ecx
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_Unknown_error_in_HTTPConnection_constructor._n]
mov byte [ecx - 1], dl
mov edx, esi
shr edx, 6
shl eax, 2
or edx, eax
and esi, 0x3f
inc ecx
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_Unknown_error_in_HTTPConnection_constructor._n]
mov byte [ecx - 1], al
mov dl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_Unknown_error_in_HTTPConnection_constructor._n]
mov esi, dword [esp + 0x1c]
mov byte [ecx], dl
inc ecx
dec ebp
jne 0x5135d5
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
lea edx, [esi + 1]
cmp eax, edx
jne 0x51368d
mov byte [ecx - 1], 0x3d
pop edi
mov byte [ecx], 0
mov eax, 1
pop esi
pop ecx
ret 0xc
add esi, 2
cmp eax, esi
jne 0x51369c
mov al, 0x3d
mov byte [ecx - 1], al
mov byte [ecx - 2], al
pop edi
mov byte [ecx], 0
mov eax, 1
pop esi
pop ecx
ret 0xc

Function at 0x513ca0
Capabilities:
Get hostname

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x652c20
push edi
mov dword [ebx], edi
call fcn.0056c0e0
mov esi, dword [esp + 0x1c]
add esp, 8
test eax, eax
mov dword [esi], eax
jne 0x513cf9
mov al, byte [0x661954]
test al, al
jne 0x513ce6
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x10
push eax
push 0x661954
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [ebx], 0x661954
mov dword [esi], edi
pop edi
pop esi
mov eax, 1
pop ebx
ret 0xc
mov byte [eax], 0
mov edx, dword [esi]
inc edx
mov dword [esi], edx
mov esi, edx
mov al, byte [esi]
test al, al
je 0x513d1c
cmp al, 0x5c
je 0x513d1c
cmp al, 0x2f
je 0x513d1c
pop edi
pop esi
mov eax, 1
pop ebx
ret 0xc
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x514480
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
push 0
push 1
mov esi, ecx
push 2
call sub.WSOCK32.dll_socket
lea ecx, [esi + 0x7dc]
cmp eax, 0xffffffff
mov dword [ecx], eax
je 0x5144b8
xor eax, eax
mov edx, dword [esi + 0x1cc]
add eax, 0x32e8
cmp eax, 0x32e80
mov dword [edx + eax - 0x323c], ecx
jl 0x51449d
pop esi
ret
xor eax, eax
mov ecx, dword [esi + 0x1cc]
add eax, 0x32e8
cmp eax, 0x32e80
mov dword [ecx + eax - 0x323c], 0
jl 0x5144ba
pop esi
ret
Function at 0x526900
Capabilities:
Access peb ldr_data
Get local ipv4 addresses
Get socket information

Disassembly:
push 0xffffffffffffffff
push 0x5abab8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, 0xf0
push ebx
mov byte [esp + 0x1d], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
xor eax, eax
mov dword [esp + 0xc], eax
push esi
mov dword [esp + 0x14], eax
mov esi, ecx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0xc]
push edi
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x3108]
lea edx, [esp + 0x14]
push ecx
xor ebx, ebx
push edx
push eax
mov byte [esp + 0x30], 0xef
mov byte [esp + 0x34], 0xff
mov byte [esp + 0x35], 0xff
mov byte [esp + 0x36], 0xff
mov byte [esp + 0x37], 0xff
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], 0xa0
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 2
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], bl
mov dword [esp + 0x1c], 0x10
call sub.WSOCK32.dll_getsockname
cmp eax, ebx
je 0x5269c5
call sub.WSOCK32.dll_WSAGetLastError
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret 4
mov ecx, dword [0x65ca8c]
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 0x16]
mov dword [esp + 0x40], ebx
push edx
call sub.WSOCK32.dll_ntohs
mov ecx, dword [esp + 0x1b]
mov edx, dword [esp + 0x1a]
and eax, 0xffff
and ecx, 0xff
push eax
mov eax, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x21]
push ecx
mov ecx, dword [esp + 0x24]
and edx, 0xff
and eax, 0xff
push edx
and ecx, 0xff
push eax
push ecx
lea edx, [esp + 0x24]
push str._d._d._d._d_s_ld
push edx
call fcn.0057f8fb
mov eax, dword [esp + 0x2c]
add esp, 0x20
lea ecx, [esp + 0x24]
push eax
push 0x14
push ecx
push 2
mov ecx, esi
call fcn.00526320
mov edi, eax
cmp edi, ebx
je 0x526a67
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], 0xffffffff
call fcn.00586b33
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret 4
push 0x18
lea ecx, [esi + 0x30fc]
call fcn.0052dd90
mov ecx, esi
call fcn.004f80b0
lea ecx, [esp + 0xc]
mov dword [esi + 0x5c], 4
mov dword [esp + 0x40], 0xffffffff
call fcn.00586b33
mov ecx, dword [esp + 0x38]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x527ee0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [ecx + 0x30d0]
push esi
push edi
test ebx, ebx
mov dword [esp + 0x10], ecx
jne 0x527efd
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
cmp ebx, 0x186a0
jbe 0x527f0a
mov ebx, 0x186a0
mov eax, dword [ecx + 0x80]
push 0
push 0
push 3
mov ecx, dword [eax + 0x30]
push 0
push 3
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x527f4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x527fd0
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret
push ebx
call fcn.00582ecc
mov esi, eax
add esp, 4
test esi, esi
jne 0x527f6c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 0x753b
pop ebx
add esp, 0xc
ret
push ebp
lea edx, [esp + 0x10]
push 0
push edx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
pop ebp
je 0x527fba
cmp dword [esp + 0xc], ebx
jne 0x527fba
mov ecx, dword [esp + 0x10]
push ebx
push esi
call fcn.00528060
push esi
mov edi, eax
call fcn.00582ef5
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret
push esi
call fcn.00582ef5
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
jne 0x527fd0
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x52a620
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov esi, dword [ebp + 0x30d0]
cmp esi, 0x186a0
jbe 0x52a63c
mov esi, 0x186a0
mov eax, dword [ebp + 0x80]
push 0
push 0
push 3
mov ecx, dword [eax + 0x30]
push 0
push 3
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x52a67f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x52a72f
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 4
push esi
call fcn.00582ecc
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x52a6a4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 0x753b
pop ebx
add esp, 0xc
ret 4
lea edx, [esp + 0x14]
push 0
push edx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x52a719
cmp dword [esp + 0x14], esi
jne 0x52a719
mov edi, dword [ebp + 0x3154]
mov ecx, esi
mov esi, ebx
xor eax, eax
mov edx, dword [esp + 0x20]
push ebx
repe cmpsb byte [esi], byte es:[edi]
setne cl
mov byte [edx], cl
call fcn.00582ef5
mov eax, dword [ebp + 0x3154]
push eax
call fcn.00582ef5
add esp, 8
mov dword [ebp + 0x3154], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
push ebx
call fcn.00582ef5
mov eax, dword [esp + 0x1c]
add esp, 4
test eax, eax
jne 0x52a72f
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x52d6c0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5ac010
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], 0x5b2e70
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [0x65ca8c]
lea edi, [esi + 0x18]
mov dword [esp + 0x28], ebx
mov dword [edi], eax
mov ecx, dword [0x65ca8c]
mov dword [esi + 0x1c], ecx
mov edx, dword [0x65ca8c]
mov dword [esi + 0x20], edx
mov eax, dword [0x65ca8c]
mov dword [esi + 0x2c], eax
mov ecx, dword [0x65ca8c]
mov dword [esi + 0x30], ecx
lea ebp, [esi + 0x34]
lea edx, [ebp + 4]
mov dword [ebp], ebx
mov dword [ebp + 8], ebx
mov word [edx], bx
mov ecx, dword [0x65ca8c]
lea eax, [esi + 0x40]
mov dword [eax], ecx
mov edx, dword [esp + 0x30]
mov byte [esp + 0x28], 7
push edx
push 0x636fa0
push eax
mov dword [esi], 0x5d9138
call fcn.0057f8fb
mov eax, dword [esp + 0x40]
add esp, 0xc
push eax
push 0x636fa0
push edi
call fcn.0057f8fb
mov eax, dword [esp + 0x44]
add esp, 0xc
cmp eax, ebx
je 0x52d78d
push eax
lea eax, [esi + 0x1c]
push 0x636fa0
push eax
call fcn.0057f8fb
add esp, 0xc
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x52d7a7
push eax
lea eax, [esi + 0x20]
push 0x636fa0
push eax
call fcn.0057f8fb
add esp, 0xc
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
push eax
lea eax, [esi + 0x2c]
push 0x636fa0
push eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], edx
call fcn.0057f8fb
mov edx, dword [esp + 0x58]
add esp, 0xc
cmp edx, ebx
je 0x52d7f3
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x52d7f3
push edx
lea eax, [esi + 0x30]
push 0x636fa0
push eax
call fcn.0057f8fb
add esp, 0xc
mov edi, dword [esp + 0x50]
cmp edi, ebx
je 0x52d8c0
push edi
call fcn.0056aeae
add esp, 4
test eax, eax
je 0x52d8c0
cmp dword [ebp], ebx
je 0x52d87c
push edi
call fcn.0056aeae
add esp, 4
test eax, eax
je 0x52d87c
mov eax, dword [ebp]
cmp eax, edi
ja 0x52d87c
push eax
call fcn.0056aeae
mov ecx, dword [ebp]
add esp, 4
lea edx, [ecx + eax*2]
cmp edx, edi
jb 0x52d87c
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov word [esp + 0x1c], bx
call fcn.00402e20
mov eax, dword [esp + 0x14]
mov byte [esp + 0x28], 8
cmp eax, ebx
jne 0x52d864
lea eax, [esp + 0x18]
push eax
mov ecx, ebp
call fcn.00402e20
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 7
call fcn.00401070
jmp 0x52d8c0
mov ecx, ebp
call fcn.00401070
push edi
call fcn.0056aeae
add esp, 4
test eax, eax
je 0x52d8c0
push edi
call fcn.0056aeae
lea eax, [eax + eax + 2]
push eax
call fcn.00582ecc
add esp, 8
cmp eax, ebx
mov dword [ebp], eax
je 0x52d8c0
push edi
call fcn.0056aeae
mov ecx, dword [ebp]
push edi
push ecx
mov dword [ebp + 8], eax
call fcn.0056ae89
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x24
Function at 0x52d900
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5ac080
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x5d9138
mov dword [esp + 0x10], 7
call fcn.0052d9d0
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 6
call fcn.00586b33
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 5
call fcn.00401070
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 4
call fcn.00586b33
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 3
call fcn.00586b33
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 2
call fcn.00586b33
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 1
call fcn.00586b33
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 0
call fcn.00586b33
add esi, 4
mov dword [esp + 4], esi
mov dword [esi], method.CCommandLineInfo.virtual_0
mov eax, dword [esi + 4]
mov dword [esp + 0x10], 8
test eax, eax
je 0x52d9bd
mov ecx, dword [esi + 8]
push ecx
push eax
call fcn.0057f988
mov edx, dword [esi + 4]
push edx
call fcn.00582ef5
add esp, 4
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x52e990
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac110
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov eax, dword [esi]
mov edi, dword [esi + 0x5c]
mov dword [ebp - 4], ebx
call dword [eax + 0x18]
mov eax, dword [esi + 0x30c4]
cmp dword [eax + 0xec], 2
jne 0x52e9f6
cmp dword [esi + 0x24], ebx
jl 0x52e9f6
jg 0x52e9db
cmp dword [esi + 0x20], ebx
jbe 0x52e9f6
mov dword [esi + 0x5c], 7
mov dword [esi + 0x54], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 0x18
je 0x52ea00
cmp edi, 0x15
jne 0x52e9e5
cmp dword [esi + 0x98], ebx
je 0x52e9e5
cmp dword [eax + 0xf8], 0x757b
jne 0x52e9e5
mov ecx, esi
call fcn.005338e0
cmp eax, ebx
je 0x52eafb
push str.OneKeyFrameBack_failed__Erase_outfile_n
mov ecx, esi
call fcn.004f73c0
mov ecx, dword [esi + 0x60]
lea eax, [ebp - 0x20]
mov edx, dword [ecx + 0x38]
push edx
push str._dkf
push eax
call fcn.0056b4da
mov edx, dword [esi + 0x30c4]
add esp, 0xc
lea ecx, [ebp - 0x20]
mov eax, dword [edx + 0xbc]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esi + 0x60]
mov edx, dword [ecx + 0x10]
lea ecx, [esi + 0x10]
push edx
call fcn.004fa890
mov ecx, dword [esi + 0x60]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x3c], ebx
mov eax, dword [ecx + 0x1c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
fild qword [ebp - 0x18]
cmp eax, ebx
mov dword [esi + 0x98], eax
fstp qword [esi + 0x30c8]
jne 0x52eabe
mov eax, dword [esi + 0x30c4]
cmp ecx, dword [eax + 0x68]
jne 0x52eabe
push str.This_is_first_part__n
mov ecx, esi
call fcn.004f73c0
mov byte [esi + 0x30d9], 1
mov byte [esi + 0x30db], bl
jmp 0x52eac5
mov byte [esi + 0x30db], 1
mov byte [esi + 0x30dd], bl
mov byte [esi + 0x30de], bl
mov dword [esi + 0x46b8], ebx
mov dword [esi + 0x46bc], ebx
mov byte [esi + 0x30d5], bl
mov byte [esi + 0x30d4], bl
mov dword [esi + 0x310c], ebx
mov byte [esi + 0x30e1], bl
mov byte [esi + 0x30e0], bl
mov edx, dword [esi]
lea eax, [esi + 0x30c0]
push eax
mov ecx, esi
call dword [edx + 0x10]
cmp eax, ebx
je 0x52e9e5
mov ecx, dword [esi + 0x30c4]
cmp eax, 0x7569
mov dword [ecx + 0xf8], eax
jne 0x52e9e5
mov ecx, dword [esi + 0x30c4]
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52eb50
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac128
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], ebx
call fcn.0052f430
mov eax, dword [esi + 0x30ec]
mov byte [esi + 0x30d5], bl
cmp eax, ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0x4688], ebx
mov byte [esi + 0x30e1], bl
jne 0x52ebb5
push 0x601
call fcn.00582ecc
add esp, 4
mov dword [esi + 0x30ec], eax
mov eax, dword [esi + 0x30ec]
cmp eax, ebx
jne 0x52ebd5
mov eax, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [eax], 3
lea eax, [ebp - 0x24]
push eax
call fcn.0056c17c
mov ecx, dword [ebp - 0x24]
add esp, 4
push ecx
call sub.WSOCK32.dll_htonl
mov edx, dword [esi + 0x30ec]
mov edi, 9
mov dword [edx + 1], eax
mov eax, dword [esi + 0x30ec]
add eax, 5
mov dword [eax], ebx
cmp edi, 0x600
jg 0x52ec2e
call fcn.0056cfaa
and eax, 0x800000ff
jns 0x52ec21
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [esi + 0x30ec]
inc edi
mov byte [edi + ecx - 1], al
jmp 0x52ec06
mov edx, dword [esi + 0x30ec]
mov eax, dword [esi + 0x30c0]
push str.send_handshake
push ebx
push 0x601
push edx
push eax
call sub.WSOCK32.dll_send
push eax
mov ecx, esi
call fcn.004f7460
mov ecx, dword [0x65ca8c]
mov edi, eax
mov dword [ebp - 0x14], ecx
push edi
lea edx, [ebp - 0x14]
push str.sending_handshake__res___ld_n
push edx
mov byte [ebp - 4], 1
call fcn.0057f8fb
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov ecx, esi
push eax
call fcn.004f73c0
mov ecx, esi
mov dword [esi + 0x30f0], ebx
mov dword [esi + 0x30f4], ebx
mov byte [esi + 0x30d6], bl
mov byte [esi + 0x30d7], bl
call fcn.004f80b0
lea ecx, [ebp - 0x14]
mov dword [esi + 0x5c], 0x14
mov byte [ebp - 4], bl
call fcn.00586b33
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x52feb0
Capabilities:
Enumerate pe sections
Receive data
Receive data on socket

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
push 0
lea eax, [esp + 0xf]
push 1
mov ecx, dword [edi + 0x30c0]
push eax
push ecx
mov dword [edi + 0x3104], 0
call sub.WSOCK32.dll_recv
push str.recv_pheader_type
push eax
mov ecx, edi
call fcn.004f7460
mov ecx, eax
test ecx, ecx
je 0x52fef8
sub eax, 0x2733
pop edi
neg eax
sbb eax, eax
pop esi
and eax, ecx
pop ecx
ret 4
mov ecx, edi
call fcn.004f80b0
mov cl, byte [esp + 0xb]
mov esi, dword [esp + 0x10]
mov al, cl
and cl, 0x3f
sar al, 6
and al, 3
mov byte [esi + 6], cl
mov byte [esi + 4], al
and eax, 0xff
mov eax, dword [eax*4 + 0x5d913c]
cmp eax, 0xc
mov dword [edi + 0x4660], eax
jne 0x52ff32
mov byte [esi + 0x10], 1
cmp dword [edi + 0x4660], 0xc
jge 0x52ff97
mov ecx, esi
call fcn.00534380
xor eax, eax
mov al, byte [esi + 6]
lea edx, [eax + eax*4]
mov cl, byte [edi + edx*8 + 0x3140]
lea eax, [edi + edx*8 + 0x313c]
mov byte [esi + 4], cl
mov dl, byte [eax + 5]
mov byte [esi + 5], dl
mov cl, byte [eax + 6]
mov byte [esi + 6], cl
mov edx, dword [eax + 8]
mov dword [esi + 8], edx
mov ecx, dword [eax + 0xc]
mov dword [esi + 0xc], ecx
mov dl, byte [eax + 0x10]
mov byte [esi + 0x10], dl
mov ecx, dword [eax + 0x14]
mov dword [esi + 0x14], ecx
mov edx, dword [eax + 0x18]
mov dword [esi + 0x18], edx
mov ecx, dword [eax + 0x1c]
mov dword [esi + 0x1c], ecx
mov edx, dword [eax + 0x20]
mov dword [esi + 0x20], edx
mov al, byte [eax + 0x24]
mov byte [esi + 0x24], al
mov ecx, dword [edi + 0x4660]
lea edx, [edi + 0x4664]
dec ecx
mov dword [edi + 0x4660], ecx
xor ecx, ecx
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov eax, dword [edi + 0x4660]
test eax, eax
mov dword [edi + 0x5c], 0x16
mov dword [edi + 0x30f8], ecx
jle 0x52ffe6
mov eax, dword [edi + 0x30c0]
push ecx
push eax
mov ecx, edi
call fcn.004f7910
test eax, eax
je 0x52ffe6
pop edi
xor eax, eax
pop esi
pop ecx
ret 4
push esi
mov ecx, edi
call fcn.00530000
pop edi
pop esi
pop ecx
ret 4
Function at 0x530000
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x4660]
test eax, eax
jle 0x530070
mov ecx, dword [esi + 0x30f8]
push 0
sub eax, ecx
push eax
lea eax, [ecx + esi + 0x4664]
mov ecx, dword [esi + 0x30c0]
push eax
push ecx
call sub.WSOCK32.dll_recv
mov edi, eax
push str.recv_pheader
push edi
mov ecx, esi
call fcn.004f7460
mov ecx, eax
test ecx, ecx
je 0x530052
sub eax, 0x2733
pop edi
neg eax
sbb eax, eax
pop esi
and eax, ecx
ret 4
mov edx, dword [esi + 0x30f8]
mov ecx, dword [esi + 0x4660]
add edx, edi
mov eax, edx
mov dword [esi + 0x30f8], edx
cmp eax, ecx
jne 0x530180
mov ecx, esi
call fcn.004f80b0
mov eax, dword [esi + 0x4660]
mov edi, dword [esp + 0xc]
cmp eax, 3
jl 0x530098
lea edx, [esi + 0x4664]
push edx
call fcn.0052f0e0
add esp, 4
mov dword [edi + 8], eax
cmp dword [esi + 0x4660], 6
jl 0x5300d3
lea eax, [esi + 0x4667]
push eax
call fcn.0052f0e0
add esp, 4
mov ecx, edi
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], 0
call fcn.00534380
cmp dword [esi + 0x4660], 6
jle 0x5300d3
mov cl, byte [esi + 0x466a]
mov byte [edi + 5], cl
cmp dword [esi + 0x4660], 0xb
jne 0x5300ee
lea edx, [esi + 0x466b]
push edx
call fcn.005131c0
add esp, 4
mov dword [edi + 0xc], eax
xor eax, eax
xor cl, cl
mov al, byte [edi + 5]
add eax, 0xfffffff8
cmp eax, 0xe
ja case.0x530105.9
xor edx, edx
mov dl, byte [eax + 0x530190]
jmp dword [edx*4 + 0x530188]
mov cl, 1
mov dl, byte [edi + 0x10]
mov eax, dword [edi + 8]
test dl, dl
mov dword [edi + 0x14], eax
jne 0x53012c
xor edx, edx
mov dl, byte [edi + 6]
mov edx, dword [esi + edx*4 + 0x453c]
add edx, eax
mov dword [edi + 0x14], edx
test cl, cl
je 0x530158
mov eax, dword [esi + 0x30c0]
push 0
push eax
mov ecx, esi
mov dword [esi + 0x5c], 0x18
call fcn.004f7910
test eax, eax
jne 0x530180
push edi
mov ecx, esi
call fcn.005301a0
pop edi
pop esi
ret 4
mov ecx, dword [esi + 0x30c0]
push 0
push ecx
mov ecx, esi
mov dword [esi + 0x5c], 0x17
call fcn.004f7910
test eax, eax
jne 0x530180
push edi
mov ecx, esi
call fcn.00532180
pop edi
pop esi
ret 4
pop edi
xor eax, eax
pop esi
ret 4