joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58c930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x63960a
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x6f7654]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6f7654]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov esi, ecx
xor ebp, ebp
mov dword [esp + 0x18], esi
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], ebp
mov byte [esp + 0x5c], bl
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x84], ebp
call fcn.0058aac0
test al, al
jne 0x58c9d4
cmp dword [esp + 0x70], 0x10
jb 0x58c9a9
mov eax, dword [esp + 0x5c]
push eax
call fcn.005ea386
add esp, 4
xor al, al
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.005ea848
add esp, 0x70
ret
mov esi, dword [esp + 0x18]
push 1
push 0x69565c
lea ecx, [esp + 0x44]
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], ebp
mov byte [esp + 0x48], 0
call fcn.00402fe0
mov edx, dword [esp + 0x40]
or ebx, 1
cmp dword [esp + 0x54], 0x10
mov byte [esp + 0x80], 1
mov dword [esp + 0x1c], ebx
jae 0x58ca13
lea edx, [esp + 0x40]
lea eax, [esi + 0x18]
mov esi, dword [eax + 0x14]
mov eax, esi
cmp eax, esi
jae 0x58ca1f
mov edi, dword [esp + 0x50]
mov ecx, esi
cmp esi, edi
jb 0x58ca2b
mov ecx, edi
mov eax, dword [esp + 0x18]
add eax, 0x18
cmp dword [eax + 0x18], 0x10
jb 0x58ca3d
mov eax, dword [eax + 4]
jmp 0x58ca40
add eax, 4
push ecx
push edx
push eax
call fcn.004049d0
add esp, 0xc
cmp eax, ebp
jne 0x58ca5e
cmp esi, edi
jb 0x58ca5e
xor eax, eax
cmp esi, edi
setne al
cmp eax, ebp
je 0x58cac6
push 1
push 0x68be48
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
call fcn.00402fe0
mov eax, dword [esp + 0x24]
or ebx, 2
mov esi, 0x10
mov dword [esp + 0x80], 2
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x38], esi
jae 0x58caa4
lea eax, [esp + 0x24]
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 0x2c]
add ecx, 0x18
push eax
push edx
push ebp
call fcn.00407030
test eax, eax
je 0x58cacb
mov byte [esp + 0x17], 1
jmp 0x58cad0
mov esi, 0x10
mov byte [esp + 0x17], 0
test bl, 2
je 0x58cafc
and ebx, 0xfffffffd
cmp dword [esp + 0x38], esi
jb 0x58caeb
mov eax, dword [esp + 0x24]
push eax
call fcn.005ea386
add esp, 4
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebp
mov byte [esp + 0x24], 0
mov dword [esp + 0x80], ebp
test bl, 1
je 0x58cb1e
and ebx, 0xfffffffe
cmp dword [esp + 0x54], esi
jb 0x58cb1e
mov ecx, dword [esp + 0x40]
push ecx
call fcn.005ea386
add esp, 4
cmp byte [esp + 0x17], 0
mov ecx, dword [esp + 0x18]
je 0x58cb4b
call fcn.0058c560
test al, al
jne 0x58c9d0
cmp dword [esp + 0x70], 0x10
jb 0x58c9a9
mov edx, dword [esp + 0x5c]
push edx
jmp 0x58c9a1
lea eax, [esp + 0x58]
push eax
call fcn.00589550
test al, al
je 0x58cb73
cmp dword [esp + 0x70], esi
jb 0x58cb6c
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.005ea386
add esp, 4
mov al, 1
jmp 0x58c9ab
cmp dword [esp + 0x70], esi
jb 0x58c9a9
mov edx, dword [esp + 0x5c]
push edx
jmp 0x58c9a1
Function at 0x5939e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x63a068
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
mov eax, dword [0x6f7654]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4c]
xor ebx, ebx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00402e40
mov eax, dword [esp + 0x50]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x48], ebx
call fcn.00592f80
cmp dword [esp + 0x2c], 0x10
mov bl, byte [eax + 8]
jb 0x593a66
mov edx, dword [esp + 0x18]
push edx
call fcn.005ea386
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x3c
ret
Function at 0x599cc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63a84d
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x6f7654]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x98], ecx
push 0x52
push 0x697bdc
push 0x697c00
lea ecx, [ebp - 0x84]
call fcn.00455c30
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x599d18
cmp dword [ebp + 0xc], 0
jne 0x599d67
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.__P_AP_ORP___Invalid_Data__08x__u
push 2
push 0x697c44
push 0x55
push 0x697c4c
push 0x697c70
call fcn.004563b0
add esp, 0x20
mov dword [ebp - 0x8c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.00455c90
mov eax, dword [ebp - 0x8c]
jmp 0x599f0c
mov dword [ebp - 0x74], 0
push 0x40
push 0
lea edx, [ebp - 0x70]
push edx
call fcn.005eb2a0
add esp, 0xc
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0059a220
add esp, 4
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x599dff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
push edx
push str.__P_AP_ORP___create_process_failed_code___u_n
push 2
push 0x697cc0
push 0x61
push 0x697cc8
push 0x697cec
call fcn.004563b0
add esp, 0x1c
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.__P_AP_ORP___name___s_old___u_new___u_n
push 2
push 0x697d64
push 0x66
push 0x697d6c
push 0x697d90
call fcn.00456680
add esp, 0x24
mov edx, dword [ebp - 0x98]
mov ecx, dword [edx]
call fcn.00556ae0
test eax, eax
jne 0x599e94
push str.__P_AP_ORP___Data_NOT_Ready
push 3
push 0x697dcc
push 0x6a
push str.CActivityProtect::_OnRestartProcess
push str..commonActivityProtect.cpp
call fcn.004563b0
add esp, 0x18
mov dword [ebp - 0x90], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.00455c90
mov eax, dword [ebp - 0x90]
jmp 0x599f0c
lea ecx, [ebp - 0x18]
call fcn.00401310
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
lea edx, [ebp - 0x18]
push edx
push 0x599240
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
call fcn.00557f10
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x98]
add ecx, 4
call fcn.0059a370
push eax
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x98]
add ecx, 4
call fcn.0059a370
mov ecx, eax
call fcn.0059a1f0
mov dword [ebp - 0x94], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.00455c90
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x59a220
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63a8a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6f7654]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1b
push str.CProcessUtil::KillProcessByPID
push str.d:_sourceosvn_src_sdologinclient_trunk_srcpublicProcessUtil.h
lea ecx, [ebp - 0x20]
call fcn.00455c30
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x59a2ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.__P_PU_KPBP___default_pid___u_code___u
push 3
push str.root
push 0x20
push str.CProcessUtil::KillProcessByPID
push str.d:_sourceosvn_src_sdologinclient_trunk_srcpublicProcessUtil.h
call fcn.004563b0
add esp, 0x20
push 1
push 0xf01ff
call fcn.005101e0
add esp, 8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x59a2db
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00455c90
mov eax, dword [ebp - 0x28]
jmp 0x59a360
mov edx, dword [ebp + 8]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x59a33b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 8]
push eax
push str.__P_PU_KPBP___pid___u_code___u
push 3
push str.root
push 0x27
push str.CProcessUtil::KillProcessByPID
push str.d:_sourceosvn_src_sdologinclient_trunk_srcpublicProcessUtil.h
call fcn.004563b0
add esp, 0x20
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00455c90
mov eax, dword [ebp - 0x2c]
jmp 0x59a360
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00455c90
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x59c340
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63a99b
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x6f7654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x8b
push str.CProcessUtil::EnumProcess
push str.d:_sourceosvn_src_sdologinclient_trunk_srcpublicProcessUtil.h
lea ecx, [ebp - 0x25c]
call fcn.00455c30
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
call fcn.00556da0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
jne 0x59c409
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
push eax
push str.__PPU_EP___CreateToolhelp32Snapshot_Failed_code___u_n
push 2
push str.root
push 0x92
push str.CProcessUtil::EnumProcess
push str.d:_sourceosvn_src_sdologinclient_trunk_srcpublicProcessUtil.h
call fcn.004563b0
add esp, 0x1c
mov dword [ebp - 0x264], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x25c]
call fcn.00455c90
mov eax, dword [ebp - 0x264]
jmp 0x59c4e4
mov dword [ebp - 0x244], 0
push 0x228
push 0
lea ecx, [ebp - 0x240]
push ecx
call fcn.005eb2a0
add esp, 0xc
mov dword [ebp - 0x244], 0x22c
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x248]
push eax
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x24c], eax
jmp 0x59c467
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x248]
push edx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
je 0x59c481
lea eax, [ebp - 0x23c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004a4fa0
jmp 0x59c44e
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x26c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004a4f50
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x274]
push eax
mov ecx, dword [ebp + 8]
call fcn.0051ca60
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.0055a9d0
add esp, 0x10
mov dword [ebp - 0x278], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x25c]
call fcn.00455c90
mov eax, dword [ebp - 0x278]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ea848
mov esp, ebp
pop ebp
ret
Function at 0x59e170
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x59e1b5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x59e1b5
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
call fcn.005f05f2
add eax, 0x40
push eax
call fcn.005f08c2
add esp, 0xc
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.005f2d36
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x59e22e
call fcn.0059e060
test eax, eax
jle 0x59e22e
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [ebp - 0x104]
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [ebp - 0x104]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5a4900
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x5a4911
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, ecx
lea edi, [eax + 1]
push edi
push esi
push 8
push 0xfde9
call ebx
mov esi, eax
test esi, esi
jle 0x5a49b1
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.005eb610
mov eax, esp
push esi
push eax
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 8
push 0xfde9
call ebx
test eax, eax
je 0x5a49d8
mov edi, dword [ebp + 0xc]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5a4967
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push edi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x5a49d8
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.005edeb1
mov esi, eax
add esp, 8
test esi, esi
jne 0x5a4a68
call fcn.005f1a6b
cmp dword [eax], 2
jne 0x5a49d0
mov ecx, dword [ebp + 8]
push edi
push ecx
jmp 0x5a49c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x5a49d8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
call fcn.005ef12a
add esp, 8
mov esi, eax
test esi, esi
jne 0x5a4a68
push 0xa3
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.0059edd0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0x6a79c0
push ecx
push 0x6a79bc
push edx
push str.fopen_
push 5
call fcn.0059eae0
add esp, 0x2c
call fcn.005f1a6b
cmp dword [eax], 2
jne 0x5a4a44
push 0xa6
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.0059edd0
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa8
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.0059edd0
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x6f6884
call fcn.005a43b0
mov edi, eax
add esp, 4
test edi, edi
jne 0x5a4a90
push esi
call fcn.005ee378
add esp, 4
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.005a3e20
push esi
push 1
push 0x6a
push edi
call fcn.005a41a0
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ea848
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6f7654]
jne 0x5ea852
repz ret
jmp fcn.005fa6cc

Function at 0x60930b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005fa00b
and dword [ebp - 4], 0
cmp dword [0x6ffd00], 0
mov ebx, eax
jne 0x6093bc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x60946d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6b95a8
push edi
call esi
test eax, eax
je 0x60946d
push eax
call fcn.005f9f99
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x6ffd00], eax
call esi
push eax
call fcn.005f9f99
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x6ffd04], eax
call esi
push eax
call fcn.005f9f99
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x6ffd08], eax
call esi
push eax
call fcn.005f9f99
pop ecx
mov dword [0x6ffd10], eax
test eax, eax
je 0x6093bc
push 0x6b9550
push edi
call esi
push eax
call fcn.005f9f99
pop ecx
mov dword [0x6ffd0c], eax
mov eax, dword [0x6ffd0c]
cmp eax, ebx
je 0x609414
cmp dword [0x6ffd10], ebx
je 0x609414
push eax
call fcn.005fa014
push dword [0x6ffd10]
mov esi, eax
call fcn.005fa014
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x609414
test edi, edi
je 0x609414
call esi
test eax, eax
je 0x60940b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x60940b
test byte [ebp - 0xc], 1
jne 0x609414
or dword [ebp + 0x10], 0x200000
jmp 0x60944d
mov eax, dword [0x6ffd04]
cmp eax, ebx
je 0x60944d
push eax
call fcn.005fa014
pop ecx
test eax, eax
je 0x60944d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x60944d
mov eax, dword [0x6ffd08]
cmp eax, ebx
je 0x60944d
push eax
call fcn.005fa014
pop ecx
test eax, eax
je 0x60944d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x6ffd00]
call fcn.005fa014
pop ecx
test eax, eax
je 0x60946d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x60946f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x614af0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63acb1
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6f7654]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
push 0x25
push 0x6bbb8c
push 0x6bbba4
lea ecx, [ebp - 0x20]
call fcn.00455c30
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x38]
cmp dword [eax], 0
je 0x614b59
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00455c90
mov eax, dword [ebp - 0x24]
jmp 0x614cb1
cmp dword [ebp + 8], 0
jne 0x614ba1
mov ecx, dword [ebp + 8]
push ecx
push str.__UT_SDB_O___Invalid_Data__08x__u
push 2
push 0x6bbbe8
push 0x29
push 0x6bbbf0
push 0x6bbc08
call fcn.004563b0
add esp, 0x1c
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00455c90
mov eax, dword [ebp - 0x28]
jmp 0x614cb1
mov edx, dword [ebp + 8]
push edx
push 1
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x38]
cmp dword [edx], 0
je 0x614bcd
mov eax, dword [ebp - 0x38]
cmp dword [eax], 0xffffffff
jne 0x614c18
mov ecx, dword [ebp - 0x38]
mov dword [ecx], 0
mov edx, dword [ebp - 0x10]
push edx
push str.__UT_SDB_O___OpenFileMapping_Failed_code___u_n
push 4
push 0x6bbc58
push 0x32
push 0x6bbc60
push 0x6bbc78
call fcn.004563b0
add esp, 0x1c
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00455c90
mov eax, dword [ebp - 0x2c]
jmp 0x614cb1
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x38]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x38]
cmp dword [eax + 4], 0
jne 0x614c98
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
push str.__UT_SDB_O___MapViewOfFile_Failed_code___u_n
push 2
push 0x6bbcc8
push 0x3a
push str.CSharedDataBase::Open
push 0x6bbce8
call fcn.004563b0
add esp, 0x1c
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00455c90
mov eax, dword [ebp - 0x30]
jmp 0x614cb1
mov dword [ebp - 0x34], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00455c90
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x6165c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0x10325476
pop ebp
ret
Function at 0x617670
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63b420
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6f7654]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
push 0x9f
push str.HttpDownload::Start
push 0x6bc350
lea ecx, [ebp - 0x1c]
call fcn.00455c30
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
cmp dword [eax + 4], 0
jne 0x61771a
push 0
push 0
mov ecx, dword [ebp - 0x28]
push ecx
push 0x617550
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x28]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x28]
cmp dword [eax + 4], 0
jne 0x61771a
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 8], 0
je 0x6176ff
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 8]
mov ecx, dword [eax]
push ecx
call fcn.006173c0
add esp, 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00455c90
mov eax, dword [ebp - 0x20]
jmp 0x617733
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00455c90
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x617750
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63b44e
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6f7654]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x18
push str.HttpDownload::Download
push 0x6bc210
lea ecx, [ebp - 0x20]
call fcn.00455c30
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x6177a8
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.006171e0
add esp, 4
test eax, eax
je 0x6177fb
cmp dword [ebp + 8], 0
je 0x6177dd
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x6177cf
push 1
mov ecx, dword [ebp - 0x24]
call fcn.00403a10
mov dword [ebp - 0x40], eax
jmp 0x6177d6
mov dword [ebp - 0x40], 0
mov dword [ebp + 8], 0
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00455c90
mov eax, dword [ebp - 0x2c]
jmp 0x6178c6
push 0x10
call fcn.005ea3fd
add esp, 4
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], 0
je 0x61781f
mov ecx, dword [ebp - 0x34]
call fcn.006169d0
mov dword [ebp - 0x44], eax
jmp 0x617826
mov dword [ebp - 0x44], 0
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x30], ecx
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x617857
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00455c90
mov eax, dword [ebp - 0x38]
jmp 0x6178c6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 8]
add edx, 0x24
push edx
call fcn.0061a850
add esp, 4
test eax, eax
je 0x617885
mov ecx, dword [ebp + 8]
add ecx, 0x24
call fcn.00402aa0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xffffffffffffffff
mov ecx, 0x6ffdfc
call fcn.004035d0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x6ffe14
call fcn.00403c00
mov ecx, 0x6ffdfc
call fcn.004035f0
mov ecx, dword [ebp - 0x10]
call fcn.00617670
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00455c90
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret