joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cfd80
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfe6c
push eax
mov dword fs:[0], esp
mov eax, dword [ebp + 8]
sub esp, 8
push ebx
push esi
mov dword [ecx], eax
push edi
mov esi, ecx
call fcn.004d01b0
lea eax, [esi + 4]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
push 0x504
mov dword [ebp - 0x14], eax
mov ebx, 0
call fcn.00513eb0
mov dword [ebp - 0x10], eax
add esp, 4
mov dword [ebp - 4], 0
mov edi, eax
test edi, edi
je 0x4cfdfd
lea ebx, [edi + 4]
push 0x4cfef0
push 0x4cfe90
mov dword [edi], 8
push 8
push 0xa0
push ebx
call fcn.0051cbb0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x220], ebx
test eax, eax
je 0x4cfe30
mov dword [esi + 0x214], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [esi + 0x214], 1
mov ecx, esi
call fcn.004cff50
push 0xff
call fcn.00513eb0
add esp, 4
mov edi, eax
mov ecx, esi
nop
push edi
call fcn.004d0090
push edi
mov ecx, esi
call fcn.004cff70
push edi
call fcn.00513ed0
add esp, 4
jmp 0x4cfe1b

Function at 0x4cff70
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
cmp ecx, 0xfffffe6c
push edi
push ebp
mov ebx, ecx
jne 0x4cff87
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret 4
lea eax, [ebx + 0x194]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x4cffa0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret 4
mov ecx, dword [esp + 0x14]
mov byte [ecx], 0
mov edx, dword [eax + 4]
mov dword [ebx + 0x21c], 0
cmp dword [edx], 0
je 0x4cfffc
mov edi, dword [edx]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
shr ecx, 2
mov esi, edi
mov edi, dword [ebx + 0x21c]
mov eax, dword [ebx + 0x220]
add edx, 4
lea edi, [edi + edi*4]
shl edi, 5
lea edi, [edi + eax + 0x20]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc dword [ebx + 0x21c]
cmp dword [edx], 0
jne 0x4cffb9
mov eax, dword [ebx + 0x21c]
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x4d0090
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x1c
push ebx
push esi
cmp ecx, 0xfffffe6c
push edi
push ebp
mov ebx, ecx
jne 0x4d00ad
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
lea eax, [ebx + 0x194]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x4d00c9
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
mov ecx, dword [esp + 0x30]
mov byte [ecx], 0
mov ebp, dword [eax + 0xc]
mov dword [ebx + 0x218], 0
cmp dword [ebp], 0
je 0x4d0193
mov eax, dword [ebp]
xor ecx, ecx
mov cl, byte [eax + 3]
push ecx
xor ecx, ecx
mov cl, byte [eax + 2]
push ecx
xor ecx, ecx
mov cl, byte [eax + 1]
push ecx
xor ecx, ecx
mov cl, byte [eax]
lea eax, [esp + 0x1c]
push ecx
push str._d._d._d._d_n
push eax
call fcn.00519a30
lea edi, [esp + 0x28]
add esp, 0x18
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
mov edi, dword [esp + 0x30]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
mov ecx, 0xffffffff
sub eax, eax
mov edx, dword [ebx + 0x220]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, dword [ebx + 0x218]
lea edi, [edi + edi*4]
shl edi, 5
add edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x218]
add ebp, 4
inc eax
mov dword [ebx + 0x218], eax
cmp dword [ebp], 0
jne 0x4d00e7
mov eax, dword [ebx + 0x218]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
Function at 0x4d3780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x14]
push ebp
cmp esi, edi
je 0x4d38f7
mov eax, dword [esi + 0x30]
cmp word [eax + 0x10], 0x9c
je 0x4d37b4
mov eax, dword [esi + 0x34]
mov ecx, dword [eax + 0x24]
mov eax, dword [esi]
mov edx, dword [ecx + 0x270]
mov ecx, esi
push edx
call dword [eax + 0x54]
mov eax, dword [esi + 0x30]
xor ebp, ebp
mov edx, dword [eax + 0xd4]
cmp word [edx + 8], bp
jle 0x4d3802
mov ecx, dword [edx + 4]
mov ebx, dword [ecx]
cmp word [ebx + 6], 0x6a
jne 0x4d37f2
mov eax, dword [edi + 0x30]
cmp byte [eax + 4], 0x50
jne 0x4d37e8
cmp word [ebx + 8], 0xffff
je 0x4d3806
cmp word [ebx + 8], 0
je 0x4d3806
mov ax, word [eax + 0x12]
cmp word [ebx + 8], ax
je 0x4d3806
xor ebx, ebx
add ecx, 4
movsx eax, word [edx + 8]
inc ebp
cmp eax, ebp
jg 0x4d37c8
jmp 0x4d3806
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0x184]
xor ebp, ebp
call fcn.00460c40
test eax, eax
je 0x4d3853
cmp eax, ebx
jne 0x4d3853
mov eax, dword [edi + 0x40]
mov ecx, dword [edi + 0x3c]
push eax
mov edx, dword [edi + 0x38]
push ecx
push edx
push edi
mov ecx, dword [esi + 0x184]
call fcn.00460c00
test eax, eax
je 0x4d3853
mov ecx, dword [esi + 0x184]
mov ebp, 1
call fcn.00460c30
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x18]
mov word [esp + 0x10], ax
test ebp, ebp
jne 0x4d389e
test ebx, ebx
je 0x4d3878
mov ecx, dword [esi + 0x184]
mov eax, dword [edi + 0x40]
push eax
mov edx, dword [edi + 0x3c]
push edx
mov ebp, dword [edi + 0x38]
push ebp
mov eax, dword [ecx]
push edi
push ebx
call dword [eax + 4]
mov ebx, eax
jmp 0x4d387a
xor ebx, ebx
test ebx, ebx
je 0x4d3897
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
mov word [esp + 0x10], ax
push ebx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1e4]
jmp 0x4d389e
mov word [esp + 0x10], 0
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x4d38f7
movsx eax, word [esp + 0x10]
mov ebx, 0xffffffff
cmp eax, 0x6a
mov edx, ebx
jne 0x4d38c0
mov ebx, 0x26a
mov edx, 0x2ce
push edx
call fcn.0048d2b0
push ebx
mov ecx, dword [esi + 0x78]
call fcn.0048d2e0
mov eax, dword [edi + 0x40]
mov ecx, dword [edi + 0x3c]
push eax
mov edx, dword [edi + 0x38]
push ecx
mov eax, dword [edi + 0x30]
movsx ecx, word [eax + 0x12]
push edx
push ecx
mov edx, dword [edi + 0x2c]
mov ecx, dword [esi + 0x78]
push edx
call fcn.00490800
mov ecx, dword [esi + 0x78]
call fcn.004908b0
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 4
Function at 0x4ec910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
fld dword [esp + 0xc]
fcom qword [0x539410]
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
fstp qword [esp + 0x14]
fnstsw ax
push ebp
test ah, 0x41
je 0x4ecb01
lea eax, [esp + 0x16]
push 2
mov edi, dword [esp + 0x28]
push eax
push edi
call fcn.004f0400
add esp, 0xc
cmp word [esp + 0x16], 0
jle 0x4ec985
movsx eax, word [esp + 0x16]
push 1
push eax
call fcn.00513f50
add esp, 8
mov ebx, eax
movsx eax, word [esp + 0x16]
push eax
push ebx
push edi
call fcn.004f0400
add esp, 0xc
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x4ec97c
mov dword [esi + 0x3c], ebx
jmp 0x4ec985
push ebx
call fcn.00514010
add esp, 4
push 4
lea eax, [esi + 0xdc]
push eax
push edi
call fcn.004f0400
add esp, 0xc
lea eax, [esi + 0xe0]
push 4
push eax
push edi
call fcn.004f0400
add esp, 0xc
lea eax, [esi + 0xe4]
push 2
push eax
push edi
call fcn.004f0400
add esp, 0xc
lea eax, [esi + 0xe6]
push 2
push eax
push edi
call fcn.004f0400
fld1
fcomp qword [esp + 0x24]
add esp, 0xc
fnstsw ax
test ah, 1
je 0x4ec9ec
push 1
lea eax, [esi + 0xcc]
push eax
push edi
call fcn.004f0400
add esp, 0xc
mov dword [esi + 0xc8], 0
cmp word [esi + 0x44], 0
jle 0x4eca0c
push 0x74
mov eax, dword [esi + 0x48]
push eax
push edi
call fcn.004f0400
add esp, 0xc
xor bx, bx
push 2
lea eax, [esp + 0x18]
push eax
push edi
call fcn.004f0400
add esp, 0xc
cmp word [esp + 0x14], bx
jle 0x4ecab8
lea eax, [esp + 0x13]
push 1
push eax
push edi
call fcn.004f0400
movsx ecx, bx
mov eax, dword [esp + 0x34]
add esp, 0xc
lea edx, [eax + ecx*4]
mov eax, dword [esi + 0x38]
movsx ebp, word [eax + 0x3c]
mov ecx, dword [edx]
cmp ebp, ecx
jle 0x4ecaab
test ecx, ecx
jl 0x4ecaab
mov al, byte [esp + 0x13]
mov ebp, dword [esi + 0x74]
mov byte [ebp + ecx], al
mov eax, dword [edx]
test eax, eax
jne 0x4eca70
mov dword [esi + eax*4 + 0x78], 0
jmp 0x4ecaab
cmp word [esi + 0x42], bx
jne 0x4eca80
mov dword [esi + eax*4 + 0x78], 1
jmp 0x4ecaab
mov cl, byte [esp + 0x13]
test cl, cl
jne 0x4eca92
mov dword [esi + eax*4 + 0x78], 2
jmp 0x4ecaab
mov dword [esi + eax*4 + 0x78], 3
mov cl, byte [esp + 0x13]
cmp cl, 1
je 0x4ecaab
mov dword [esi + eax*4 + 0x78], 4
inc bx
cmp bx, word [esp + 0x14]
jl 0x4eca2a
fld qword [esp + 0x18]
fcomp qword [0x539420]
fnstsw ax
test ah, 0x41
jne 0x4ecad8
push 0x24
lea eax, [esi + 0x78]
push eax
push edi
call fcn.004f0400
add esp, 0xc
mov ebx, dword [esi + 0x30]
test ebx, ebx
je 0x4ecaef
mov ecx, ebx
call fcn.004c3040
push ebx
call fcn.00513ed0
add esp, 4
mov eax, dword [esp + 0x28]
push 0
push eax
mov ebx, dword [esi]
push edi
mov ecx, esi
call dword [ebx + 0xe8]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
Function at 0x5150a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
push esi
mov si, dx
push edi
xor ax, ax
mov edx, dword [ecx + 0x10]
push ebp
mov ebx, ecx
mov edi, edx
mov ebp, dword [esp + 0x24]
mov cx, word [edx]
cmp cx, si
jae 0x515116
cmp ax, cx
jae 0x5150c8
mov ax, cx
mov edx, dword [edx + 2]
cmp edi, edx
jne 0x5150b8
test ebp, 2
je 0x515100
test ebp, 0x40
jne 0x515100
cmp dword [0x54e198], 0
je 0x515100
push 0
mov edx, esi
mov ecx, ebx
call dword [0x54e198]
cmp ax, si
jb 0x515100
mov edx, dword [ebx + 0x10]
test edx, edx
jne 0x5150b8
and ax, 0xfffc
mov ecx, dword [ebx + 4]
mov word [ecx], ax
pop ebp
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
and cx, 0xfffc
mov eax, 0x10
sub cx, si
test ebp, 0x4000
jne 0x515131
xor eax, eax
mov ax, word [ebx + 0x18]
movzx edi, cx
mov dword [esp + 0x14], edi
cmp edi, eax
jge 0x515172
lea ecx, [edx + 2]
mov dword [esp + 0x10], edx
mov edi, dword [esp + 0x10]
mov edx, dword [ecx]
mov eax, dword [edi + 6]
mov dword [eax + 2], edx
mov eax, dword [edi + 6]
mov ecx, dword [ecx]
mov dword [ecx + 6], eax
mov si, word [edi]
or si, 1
mov word [edi], si
and si, 0xfffc
movzx eax, si
or byte [eax + edi], 2
jmp 0x515200
test ebp, 6
je 0x5151da
mov ax, word [edx]
mov dword [esp + 0x10], edx
and ax, 2
or ax, si
or al, 1
mov word [edx], ax
mov edi, dword [edx + 2]
mov dword [esp + 0x18], edi
mov edi, dword [edx + 6]
mov eax, dword [esp + 0x18]
mov dword [edi + 2], eax
mov edi, dword [edx + 6]
mov dword [esp + 0x18], edi
mov edi, dword [edx + 2]
mov eax, dword [esp + 0x18]
mov dword [edi + 6], eax
mov eax, dword [esp + 0x14]
movzx edi, si
add edx, edi
mov word [eax + edx - 2], cx
or cl, 2
mov word [edx], cx
mov ecx, dword [ebx + 0x14]
mov dword [edx + 6], ecx
mov eax, dword [ecx + 2]
mov dword [edx + 2], eax
mov eax, dword [ecx + 2]
mov dword [eax + 6], edx
mov dword [ecx + 2], edx
jmp 0x515200
mov edi, dword [esp + 0x14]
add edi, edx
movzx eax, si
mov word [edi - 2], cx
mov dword [esp + 0x10], edi
or cl, 2
mov word [edx], cx
mov edx, dword [edx + 2]
or byte [eax + edi], 2
mov ax, si
or al, 1
mov word [edi], ax
test ebp, 1
mov dword [ebx + 0x10], edx
je 0x515228
mov edi, dword [esp + 0x10]
xor eax, eax
movzx esi, si
sub esi, 2
add edi, 2
mov ecx, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
test ebp, 2
je 0x515252
mov eax, dword [edx + 6]
cmp dword [edx + 2], eax
jne 0x515252
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + 2]
mov ax, word [ecx]
mov ecx, dword [ebx + 4]
and ax, 0xfffc
mov word [ecx], ax
mov ecx, dword [ebx + 4]
or byte [ecx + 3], 0x80
inc word [ebx + 0xc]
mov eax, dword [esp + 0x10]
add eax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x515800
Capabilities:
Enumerate pe sections

Disassembly:
mov ax, word [ecx]
sub esp, 0x10
add dx, 9
push ebx
and dx, 0xfff8
push esi
push edi
push ebp
mov di, ax
and di, 0x7ffc
cmp dx, 0x10
ja 0x515825
mov dx, 0x10
cmp di, dx
jb 0x5158a6
mov si, di
mov ebx, 0x10
sub si, dx
test ah, 0x80
jne 0x515847
mov eax, ecx
xor ebx, ebx
and eax, 0xffff0000
mov bx, word [eax + 0x18]
movzx eax, si
cmp eax, ebx
jl 0x51598c
movzx eax, di
lea edi, [eax + ecx]
mov ax, word [edi]
test al, 1
jne 0x51588a
and ax, 0xfffc
add si, ax
mov eax, ecx
and eax, 0xffff0000
cmp dword [eax + 0x10], edi
jne 0x515878
mov ebx, dword [edi + 2]
mov dword [eax + 0x10], ebx
mov eax, dword [edi + 2]
mov ebx, dword [edi + 6]
mov dword [ebx + 2], eax
mov ebx, dword [edi + 6]
mov eax, dword [edi + 2]
mov dword [eax + 6], ebx
mov ebx, ecx
and ebx, 0xffff0000
mov eax, dword [ebx + 4]
cmp word [eax], si
jae 0x51594f
mov word [eax], si
jmp 0x51594f
movzx esi, di
lea ebp, [esi + ecx]
mov ax, word [ebp]
test al, 1
jne 0x5159bb
xor ebx, ebx
mov bx, ax
and ebx, 0xfffc
add ebx, esi
movzx esi, dx
cmp ebx, esi
jl 0x5159bb
mov ebx, ecx
and ebx, 0xffff0000
cmp dword [ebx + 0x10], ebp
jne 0x5158e3
mov eax, dword [ebp + 2]
mov dword [ebx + 0x10], eax
lea eax, [ebp + 6]
lea esi, [ebp + 2]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov eax, dword [esi]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov esi, dword [eax]
mov eax, dword [esp + 0x18]
mov dword [esi + 2], eax
mov eax, dword [esp + 0x14]
mov esi, dword [eax]
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax + 6], esi
mov ax, word [ebp]
and ax, 0xfffc
mov si, di
sub si, dx
add si, ax
test byte [ecx + 1], 0x80
je 0x515934
mov dword [esp + 0x18], 0x10
jmp 0x51593e
xor edi, edi
mov di, word [ebx + 0x18]
mov dword [esp + 0x18], edi
movzx edi, si
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x18]
cmp dword [esp + 0x1c], edi
jl 0x515999
mov ax, word [ecx]
and ax, 0x8003
or ax, dx
movzx edx, dx
mov word [ecx], ax
add ecx, edx
mov ax, si
or al, 2
mov word [ecx], ax
mov edx, dword [ebx + 0x14]
mov dword [ecx + 6], edx
mov ebx, dword [edx + 2]
mov dword [ecx + 2], ebx
mov ebx, dword [edx + 2]
movzx eax, si
mov dword [ebx + 6], ecx
mov dword [edx + 2], ecx
add ecx, eax
mov word [ecx - 2], si
and word [ecx], 0xfffd
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
add ax, word [ecx]
mov word [ecx], ax
xor eax, eax
mov ax, word [ebp]
and eax, 0xfffc
or byte [eax + ebp], 2
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x516c90
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x14], ecx
push ebx
push esi
push edi
push ebp
mov esi, edx
xor edi, edi
mov dword [esp + 0x1c], edi
call fcn.00517c90
test eax, eax
jne 0x516cb0
mov dword [esp + 0x50], edi
inc dword [esp + 0x50]
mov ebx, dword [esp + 0x50]
shl ebx, 2
mov ecx, ebx
call fcn.00516900
mov dword [esp + 0x20], eax
test eax, eax
jne 0x516cd6
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x3c
ret 8
mov edi, dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
mov eax, dword [esp + 0x54]
lea ebp, [eax + ebx - 4]
add ebx, ecx
sub ebp, 4
sub ebx, 4
dec edi
je 0x516d15
mov eax, dword [ebp]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebx], eax
test eax, eax
jne 0x516cf0
jmp 0x516e1b
call fcn.00517c90
test eax, eax
je 0x516d37
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov dword [esp + 0x18], ecx
jmp 0x516d44
mov dword [esp + 0x18], Ordinal_4
mov edi, 0xbfffffff
cmp dword [esp + 0x24], 0
jne 0x516d7a
mov eax, edi
sub eax, dword [esp + 0x18]
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
call fcn.00519ab0
mov ebp, eax
call fcn.00519ab0
imul ebp, eax
mov eax, ebp
sub edx, edx
div ebx
mov eax, dword [esp + 0x18]
add eax, edx
add eax, ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
and eax, 0xffff0000
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], eax
mov ebp, edi
mov ebx, dword [esp + 0x20]
sub ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x50]
mov dword [esp + 0x24], eax
mov ecx, ebx
lea eax, [esp + 0x14]
add ebx, 4
push eax
mov edx, dword [esp + 0x14]
push edi
push esi
mov ecx, dword [ecx]
call fcn.00516e70
test eax, eax
je 0x516ddc
mov ecx, dword [esp + 0x10]
sub ebp, eax
add ebp, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x14]
cmp ebp, ecx
jl 0x516dce
mov ebp, ecx
test eax, eax
je 0x516de8
cmp ebp, esi
jl 0x516ddc
dec dword [esp + 0x24]
jne 0x516d9d
test eax, eax
je 0x516de8
cmp ebp, esi
jl 0x516de8
mov dword [esp + 0x1c], eax
add dword [esp + 0x10], ebp
cmp dword [esp + 0x10], edi
jb 0x516e0a
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x18]
je 0x516e0a
mov edi, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], eax
cmp dword [esp + 0x1c], 0
jne 0x516e1b
cmp dword [esp + 0x10], edi
jb 0x516d8b
cmp dword [esp + 0x20], 0
je 0x516e54
dec dword [esp + 0x50]
je 0x516e4b
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ecx + eax*4]
mov eax, dword [edi]
test eax, eax
je 0x516e4b
push eax
sub edi, 4
call esi
dec dword [esp + 0x50]
jne 0x516e39
mov ecx, dword [esp + 0x20]
call fcn.00516920
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x3c
ret 8
Function at 0x517850
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0xc]
cmp dword [edi], 0
jne 0x517870
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
mov dword [edi], 1
push 0xffffffffffffffff
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
pop edi
pop esi
ret 4

Function at 0x517890
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push ebp
call fcn.00517830
mov edi, eax
test edi, edi
je 0x5178f2
cmp dword [edi + 0xc], 0
jne 0x5178d4
lea ebp, [esi + 0x4c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, ebp
mov ecx, esi
call fcn.00517900
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0xc], eax
test eax, eax
jne 0x5178e8
call ebx
cmp eax, 0xb7
je 0x5178b0
test edi, edi
je 0x5178f2
cmp dword [edi + 0xc], 0
je 0x5178f2
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x51b500
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x418
cmp dword [0x6e57f0], edx
push ebx
push esi
push edi
push ebp
jbe 0x51b707
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x6e56f0
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ecx, dword [esp + 0x18]
shl eax, 3
mov ebx, dword [ecx]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov al, byte [ebx + ebp + 4]
test al, 1
je 0x51b707
xor esi, esi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], esi
cmp ebp, esi
jne 0x51b569
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
test al, 0x20
je 0x51b57a
push 2
push 0
push edx
call fcn.00519d90
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x51b616
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x51b64f
lea edi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x51b5dd
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x51b5cb
mov byte [edi], 0xd
inc esi
inc edi
mov byte [edi], al
inc edi
mov eax, edi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x51b5b2
lea eax, [esp + 0x24]
push 0
sub edi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push edi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x51b645
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, edi
jge 0x51b59d
jmp 0x51b64f
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x51b645
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x51b64f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x51b6f6
cmp dword [esp + 0x10], 0
je 0x51b6a8
cmp dword [esp + 0x10], 5
jne 0x51b68b
mov dword [0x54e570], 9
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [0x54e574], eax
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.005203b0
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x51b6d2
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x51b6d2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x54e570], 0x1c
mov dword [0x54e574], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, esi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x54e570], 9
mov dword [0x54e574], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x51c4c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x51c4f6
cmp byte [esp + 5], 0x3a
jne 0x51c4f6
xor eax, eax
mov al, byte [esp + 4]
push eax
call fcn.0051b730
add esp, 4
lea esi, [eax - 0x40]
mov eax, esi
pop esi
add esp, 0x104
ret

Function at 0x51c680
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
push ebx
push esi
mov ebx, dword [esp + 0x118]
push edi
test ebx, ebx
je 0x51c6f3
push ebx
call fcn.0051c7b0
add esp, 4
test eax, eax
jne 0x51c6c1
xor eax, eax
pop edi
mov dword [0x54e574], 0xf
mov dword [0x54e570], 0xd
pop esi
pop ebx
add esp, 0x10c
ret
add bl, 0x40
lea eax, [esp + 0x10]
mov byte [esp + 0xc], bl
push eax
lea ecx, [esp + 0x18]
lea ebx, [esp + 0x10]
mov byte [esp + 0x11], 0x3a
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x13], 0
push ecx
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x51c703
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x51c7a2
inc eax
cmp eax, 0x104
ja 0x51c7a2
mov edx, dword [esp + 0x120]
test edx, edx
jne 0x51c754
mov ecx, dword [esp + 0x124]
cmp ecx, eax
jg 0x51c72f
mov ecx, eax
push ecx
call fcn.00513ee0
add esp, 4
mov edx, eax
test edx, edx
jne 0x51c773
xor eax, eax
pop edi
mov dword [0x54e570], 0xc
pop esi
pop ebx
add esp, 0x10c
ret
cmp dword [esp + 0x124], eax
jge 0x51c773
xor eax, eax
pop edi
mov dword [0x54e570], 0x22
pop esi
pop ebx
add esp, 0x10c
ret
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, edx
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret

Function at 0x51c7b0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 4
test eax, eax
jne 0x51c7c4
mov eax, 1
add esp, 4
ret
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x5c
mov byte [esp + 3], 0
add al, 0x40
mov byte [esp], al
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x51c7f6
cmp eax, 1
je 0x51c7f6
mov eax, 1
add esp, 4
ret
xor eax, eax
add esp, 4
ret