joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003d570
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x1004e44c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
mov ebx, ecx
call fcn.1000b010
add esp, 0xc
mov eax, 0x25
mov word [ebp - 0x20], ax
push ebx
lea eax, [ebp - 0x20]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x420]
push 0x200
push eax
mov dword [ebp - 0x16], 0x2a
mov dword [ebp - 0x1a], 0x2e002a
mov dword [ebp - 0x1e], 0x5c0073
call fcn.1000997c
add esp, 0x14
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1003d691
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test byte [ebp - 0x670], 0x10
je 0x1003d674
cmp word [ebp - 0x644], 0x2e
je 0x1003d674
cmp word [ebp - 0x642], 0x2e
je 0x1003d674
xor eax, eax
mov word [ebp - 6], ax
mov eax, 0x5c
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x644]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x420]
push 0x200
push eax
mov dword [ebp - 0x10], 0x730025
mov dword [ebp - 0xa], 0x730025
call fcn.1000997c
add esp, 0x18
lea ecx, [ebp - 0x420]
call fcn.1003d6b0
lea eax, [ebp - 0x420]
push eax
call edi
lea eax, [ebp - 0x670]
push eax
push esi
call dword [0x1006faa0]
test eax, eax
jne 0x1003d604
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100084c3
mov esp, ebp
pop ebp
ret
Function at 0x4098c4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409997
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4099b0
push ebx
push 0x4099bc
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409944
mov al, 0x62
call fcn.0040949c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409898
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40994d
call fcn.00409898
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40999e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a50
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b04
jmp 0x409af9
cmp dword [esi + 0x10], 0x1000
jne 0x409ae5
test byte [esi + 0x15], 1
jne 0x409ae5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409aa4
cmp eax, 2
je 0x409aa4
cmp eax, 0x10
je 0x409aa4
cmp eax, 0x20
jne 0x409ab9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409ab9
mov bl, 1
xor ebp, ebp
jmp 0x409aca
mov eax, dword [esi]
add eax, ebp
call fcn.00409a48
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409abd
test bl, bl
je 0x409ae5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b04
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a7c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403914
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40e008], 0x8088405
inc edx
mov dword [ebx + 0x40e008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x6c10a940
Capabilities:
Get socket status

Disassembly:
push ebp
push edi
push esi
mov esi, eax
mov eax, 0x1e
push ebx
sub esp, 0x14c
mov dword [esp + 0x2c], edx
xor edx, edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
call fcn.6c12e3b0
mov edi, eax
test byte [0x6c1450b0], 8
jne 0x6c10aa10
mov dword [esp + 0x3c], 1
xor ebx, ebx
lea eax, [esi + 1]
mov dword [esp + 0x40], esi
mov dword [esp + 0x28], eax
lea esi, [esi]
nop
lea eax, [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_select]
sub esp, 0x14
test eax, eax
jle 0x6c10aa40
lea ebp, [edi + ebx]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.6c130c10
test eax, eax
jle 0x6c10aa50
movzx eax, byte [ebp]
cmp al, 0xa
je 0x6c10aa60
cmp al, 0xd
je 0x6c10a990
add ebx, 1
cmp ebx, 0x1000
jne 0x6c10a990
xor edi, edi
add esp, 0x14c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0x6c147b7c
mov dword [esp + 8], str.FTP_GetNextLine
mov dword [esp + 4], 0x6c1450b0
mov dword [esp], 3
call fcn.6c10a080
jmp 0x6c10a973
mov dword [esp], 0x2ee2
call fcn.6c12c120
jmp 0x6c10a9fe
mov dword [esp], 0x2f4e
call fcn.6c12c120
jmp 0x6c10a9fe
mov ecx, dword [esp + 0x2c]
lea eax, [ebx - 1]
mov byte [ebp], 0
mov dword [ecx], eax
test byte [0x6c1450b0], 8
je 0x6c10aa00
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.:_d__s_n
mov dword [esp + 8], str.FTP_GetNextLine
mov dword [esp + 4], 0x6c1450b0
mov dword [esp], 3
call fcn.6c10a080
jmp 0x6c10aa00
Function at 0x6c10b1f0
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x24
mov dword [esp + 0x1c], 0x10
test byte [0x6c1450b0], 8
jne 0x6c10b330
call fcn.6c130950
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call dword [sym.imp.ws2_32.dll_socket]
sub esp, 0xc
mov dword [ebx + 0x48], eax
cmp eax, 0xffffffff
je 0x6c10b300
mov edx, dword [ebx + 0x54]
lea esi, [ebx + 0x64]
mov dword [ebx + 0x64], edx
mov edx, dword [ebx + 0x58]
mov dword [ebx + 0x68], edx
mov edx, dword [ebx + 0x5c]
mov dword [ebx + 0x6c], edx
mov edx, dword [ebx + 0x60]
mov dword [ebx + 0x70], edx
xor edx, edx
mov word [ebx + 0x66], dx
mov dword [esp + 8], 0x10
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_bind]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x6c10b2d0
mov dword [esp + 4], 5
mov eax, dword [ebx + 0x48]
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_listen]
sub esp, 8
cmp eax, 0xffffffff
je 0x6c10b390
lea eax, [esp + 0x1c]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x48]
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_getsockname]
mov edx, eax
sub esp, 0xc
mov eax, 1
cmp edx, 0xffffffff
je 0x6c10b2dd
add esp, 0x24
pop ebx
pop esi
ret
test byte [0x6c1450b0], 8
jne 0x6c10b360
mov eax, dword [ebx + 0x48]
cmp eax, 0xffffffff
je 0x6c10b2f8
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_closesocket]
mov dword [ebx + 0x48], 0xffffffff
sub esp, 4
add esp, 0x24
xor eax, eax
pop ebx
pop esi
ret
test byte [0x6c1450b0], 8
je 0x6c10b2f8
mov dword [esp + 0xc], str.Unable_to_create_listening_socket_n
mov dword [esp + 8], str.FTP_InitListenSocket
mov dword [esp + 4], 0x6c1450b0
mov dword [esp], 3
call fcn.6c10a080
jmp 0x6c10b2dd
mov dword [esp + 0xc], 0x6c147b7c
mov dword [esp + 8], str.FTP_InitListenSocket
mov dword [esp + 4], 0x6c1450b0
mov dword [esp], 3
call fcn.6c10a080
jmp 0x6c10b20c
mov dword [esp + 0xc], str.Unable_to_bind_socket_n
mov dword [esp + 8], str.FTP_InitListenSocket
mov dword [esp + 4], 0x6c1450b0
mov dword [esp], 3
call fcn.6c10a080
jmp 0x6c10b2dd
test byte [0x6c1450b0], 8
je 0x6c10b2dd
mov dword [esp + 0xc], str.listen_failed_n
mov dword [esp + 8], str.FTP_InitListenSocket
mov dword [esp + 4], 0x6c1450b0
mov dword [esp], 3
call fcn.6c10a080
jmp 0x6c10b2dd
Function at 0x6c1124c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, eax
push edi
push esi
mov esi, ecx
push ebx
mov ebx, edx
sub esp, 0x2c
cmp word [eax], 0
je 0x6c112698
mov edi, eax
lea esi, [esi]
add edi, 2
cmp word [edi], 0
jne 0x6c1124e0
sub edi, ebp
mov ecx, edi
sar ecx, 1
lea eax, [esi*4 + 8]
mov edx, 0xaaaaaaab
mul edx
shr edx, 1
lea eax, [ecx + edx + 2]
add eax, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, eax
test eax, eax
je 0x6c112637
mov dword [esp + 4], ebp
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x10], eax
call sub.ucrtbase.dll_memcpy
mov edx, dword [esp + 0x10]
mov eax, 0x20
mov word [edx + edi], ax
lea ebp, [edx + edi + 2]
test esi, esi
je 0x6c1126a1
movsx eax, byte [ebx]
mov ecx, eax
shl eax, 4
sar ecx, 2
and eax, 0x30
and ecx, 0x3f
movsx cx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ebp], cx
cmp esi, 1
je 0x6c1126a7
lea ecx, [ebp + 8]
xor edi, edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], edx
jmp 0x6c1125dd
movzx ebp, byte [ebx + 2]
add ebx, 3
mov edx, ebp
and ebp, 0x3f
shr edx, 6
and edx, 3
or edx, eax
movsx ax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movsx dx, byte [ebp + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx eax, ax
shl edx, 0x10
or edx, eax
sub esi, 3
mov dword [ecx - 4], edx
je 0x6c112648
movsx eax, byte [ebx]
add ecx, 8
mov edx, eax
shl eax, 4
sar edx, 2
and eax, 0x30
and edx, 0x3f
movsx dx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx - 8], dx
cmp esi, 1
je 0x6c112650
movsx ebp, byte [ebx + 1]
mov dword [esp + 0x14], edi
add edi, 4
mov dword [esp + 0x10], ecx
mov edx, ebp
sar edx, 4
and edx, 0xf
or edx, eax
movsx ax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx - 6], ax
lea eax, [ebp*4]
and eax, 0x3c
cmp esi, 2
jne 0x6c112580
movsx ax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, 0x3d
mov edx, dword [esp + 0x18]
mov word [ecx - 2], bx
mov word [ecx - 4], ax
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax], cx
add esp, 0x2c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x18]
jmp 0x6c11262e
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea ecx, [esi + esi + 0xa]
lea edi, [ecx + 2]
lea esi, [ecx + 4]
lea ebx, [ecx + 6]
movsx ax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ebp + ecx], ax
mov eax, 0x3d
mov word [ebp + edi], ax
mov eax, 0x3d
mov word [ebp + esi], ax
lea eax, [ebp + ebx]
mov dword [esp + 0x10], eax
jmp 0x6c11262e
xor ecx, ecx
xor edi, edi
jmp 0x6c1124ef
mov dword [esp + 0x10], ebp
jmp 0x6c11262e
mov ebx, 8
mov esi, 6
mov edi, 4
mov ecx, 2
jmp 0x6c112669
Function at 0x6c114910
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, ecx
push edi
mov edi, edx
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov eax, dword [eax + 0x20ec]
mov esi, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
mov ecx, dword [eax]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [ecx + 4]
test eax, eax
mov esi, eax
mov eax, dword [esp + 0x50]
je 0x6c114990
mov edx, dword [ebx + 0xa8]
mov dword [eax], 0
test edx, edx
je 0x6c11497d
mov eax, dword [ebx + 0x20ec]
mov edx, dword [eax]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [edx]
test eax, eax
je 0x6c11497d
mov eax, ebx
call fcn.6c1147b0
add esp, 0x3c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ebp, dword [eax]
jae 0x6c1149b1
mov dword [esp + 8], 0xa38
mov dword [esp + 4], str._Users_gcenx_Documents_GitHub_wineskincx_dlls_wininet_http.c
mov dword [esp], str.read___size
call dword [sym.imp.ucrtbase.dll__assert]
mov eax, dword [ebx + 0xa8]
test eax, eax
je 0x6c11497d
mov ecx, dword [esp + 0x50]
mov edx, dword [ecx]
test edx, edx
je 0x6c114976
lea ecx, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
jne 0x6c1149f6
test byte [0x6c145188], 1
jne 0x6c114a10
mov eax, dword [esp + 0x50]
mov eax, dword [eax]
test eax, eax
jne 0x6c114961
jmp 0x6c114976
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.WriteFile_failed:__lu_n
mov dword [esp + 8], str.read_http_stream
mov dword [esp + 4], 0x6c145188
mov dword [esp], 0
mov dword [esp + 0x10], eax
call fcn.6c112820
jmp 0x6c1149f6
Function at 0x6c1172f0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x2c
movzx eax, word [eax]
test ax, ax
je 0x6c1173e1
xor ebp, ebp
jmp 0x6c117382
cmp si, 0x80
ja 0x6c1173d8
movzx esi, byte [esi + 0x6c14b860]
mov ecx, esi
cmp cl, 0xff
je 0x6c1173d8
test edx, edx
je 0x6c11733f
sar cl, 2
shl eax, 4
mov edi, ecx
or eax, edi
mov byte [edx + ebp + 1], al
movzx eax, word [ebx + 6]
cmp ax, 0x3d
je 0x6c117498
cmp ax, 0x80
ja 0x6c117480
movzx eax, byte [eax + 0x6c14b860]
cmp al, 0xff
je 0x6c117480
test edx, edx
je 0x6c117373
shl esi, 6
or eax, esi
mov byte [edx + ebp + 2], al
movzx eax, word [ebx + 8]
add ebx, 8
add ebp, 3
test ax, ax
je 0x6c1173e3
cmp ax, 0x7f
ja 0x6c1173f0
movzx esi, byte [eax + 0x6c14b860]
mov eax, esi
cmp al, 0xff
je 0x6c1173f0
movzx eax, word [ebx + 2]
cmp ax, 0x7f
ja 0x6c1173f0
movzx eax, byte [eax + 0x6c14b860]
cmp al, 0xff
je 0x6c1173f0
test edx, edx
je 0x6c1173bf
mov ecx, eax
shl esi, 2
sar cl, 4
mov edi, ecx
or esi, edi
mov ecx, esi
mov byte [edx + ebp], cl
movzx esi, word [ebx + 4]
cmp si, 0x3d
jne 0x6c117310
cmp word [ebx + 6], 0x3d
je 0x6c1174a0
test byte [0x6c145188], 4
jne 0x6c117460
xor ebp, ebp
add esp, 0x2c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6c145188], 4
je 0x6c1173e1
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x6c11746c
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x6c148e1b
test edx, edx
jne 0x6c11742d
mov edx, 0xffffffff
mov eax, ebx
call fcn.6c111d50
mov dword [esp + 0x10], eax
xor ebp, ebp
mov dword [esp + 0xc], str.invalid_base64:__s_n
mov dword [esp + 8], str.HTTP_DecodeBase64
mov dword [esp + 4], 0x6c145188
mov dword [esp], 2
call fcn.6c112820
jmp 0x6c1173e3
add ebx, 4
mov eax, ebx
shr eax, 0x10
test eax, eax
jne 0x6c117402
mov dword [esp + 4], ebx
mov dword [esp], 0x6c148af8
call fcn.6c112360
jmp 0x6c11742d
test byte [0x6c145188], 4
je 0x6c1173e1
add ebx, 6
jmp 0x6c1173f9
add ebp, 2
jmp 0x6c1173e3
add ebp, 1
jmp 0x6c1173e3

Function at 0x6c123780
Capabilities:
Get hostname

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov esi, dword [sym.imp.kernel32.dll_GetComputerNameExA]
lea edi, [esp + 0x2c]
mov dword [esp + 0x2c], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
sub esp, 0xc
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xea
jne 0x6c123808
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebp, eax
mov dword [esp + 0x1c], eax
test eax, eax
je 0x6c123808
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call esi
sub esp, 0xc
test eax, eax
je 0x6c1237f8
mov eax, dword [esp + 0x1c]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebp
call dword [sym.imp.ucrtbase.dll_free]
lea esi, [esi]
mov dword [esp + 0x1c], 0
jmp 0x6c1237e9
Function at 0x6c123820
Capabilities:
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
test eax, eax
je 0x6c123880
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
mov dword [esp + 4], 0
lea esi, [eax + eax + 2]
mov dword [esp + 8], esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x6c123876
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
add esp, 0x14
pop ebx
pop esi
ret
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
xor eax, eax
ret

Function at 0x6c123890
Capabilities:
Get process heap flags

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
test eax, eax
je 0x6c123920
mov dword [esp], eax
mov ebx, eax
call dword [sym.imp.ucrtbase.dll_wcslen]
mov dword [esp + 4], 0
lea edi, [eax + eax*2 + 1]
mov dword [esp + 8], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x6c123913
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub esp, 0x20
add esp, 0x20
mov eax, esi
pop ebx
pop esi
pop edi
ret
add esp, 0x20
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
ret

Function at 0x6c123d60
Capabilities:
Delete file

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [eax + 0x10]
test eax, eax
je 0x6c123da0
mov eax, dword [ebx + 4]
lea edx, [eax - 1]
cmp edx, 0xfffffffd
jbe 0x6c123dba
mov eax, dword [ebx + 8]
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call esi
mov dword [esp], ebx
call esi
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
mov eax, dword [ebx + 4]
sub esp, 4
lea edx, [eax - 1]
cmp edx, 0xfffffffd
ja 0x6c123d79
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
jmp 0x6c123d79
Function at 0x6c1249c0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
mov esi, dword [ecx + 8]
test byte [0x6c1451fc], 8
jne 0x6c124a38
cmp ebx, 1
je 0x6c124a71
cmp ebx, 3
je 0x6c124a10
test ebx, ebx
je 0x6c124aa0
mov eax, 1
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov eax, dword [0x6c1451f8]
cmp eax, 0xffffffff
je 0x6c1249fb
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x6c1249fb
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str._p__lx__p_n
mov dword [esp + 8], str.DllMain
mov dword [esp + 4], 0x6c1451fc
mov dword [esp], 3
call fcn.6c123f10
cmp ebx, 1
jne 0x6c1249ee
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [0x6c1451f8], eax
cmp eax, 0xffffffff
je 0x6c124b11
call fcn.6c13e140
test eax, eax
je 0x6c124b00
mov dword [0x6c153008], edi
jmp 0x6c1249fb
test esi, esi
jne 0x6c1249fb
mov dword [esp], 2
call fcn.6c120850
call fcn.6c130b30
call fcn.6c13e1d0
call fcn.6c107e60
mov eax, dword [0x6c1451f8]
cmp eax, 0xffffffff
je 0x6c1249fb
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [0x6c1451f8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsFree]
sub esp, 4
jmp 0x6c1249fb
mov eax, dword [0x6c1451f8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsFree]
sub esp, 4
xor eax, eax
jmp 0x6c124a00
Function at 0x6c125200
Capabilities:
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [0x6c1451f8]
mov esi, dword [ecx]
mov edi, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov edx, eax
test byte [0x6c1451fc], 8
jne 0x6c1252d0
test esi, esi
je 0x6c1252b0
test ebx, ebx
je 0x6c1252b0
test edx, edx
je 0x6c125338
lea ecx, [edx + 4]
test edi, edi
je 0x6c125310
mov eax, dword [sym.imp.ucrtbase.dll_strlen]
mov dword [ebp - 0x20], edx
mov dword [esp], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x24], eax
call eax
cmp dword [ebx], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
jb 0x6c125318
mov eax, dword [edx]
mov dword [esi], eax
mov eax, dword [ebx]
test eax, eax
je 0x6c125344
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp], edi
call sub.ucrtbase.dll_memcpy
mov eax, dword [ebx]
mov byte [edi + eax - 1], 0
mov dword [esp], edi
mov eax, dword [ebp - 0x24]
call eax
mov dword [ebx], eax
jmp 0x6c125344
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x6c14baea
mov dword [esp + 8], str.InternetGetLastResponseInfoA
mov dword [esp + 4], 0x6c1451fc
mov dword [esp], 3
call fcn.6c123f10
mov edx, dword [ebp - 0x1c]
jmp 0x6c12523c
mov eax, dword [sym.imp.ucrtbase.dll_strlen]
mov dword [ebp - 0x24], eax
mov dword [esp], ecx
mov eax, dword [ebp - 0x24]
call eax
mov dword [ebx], eax
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x7a
jmp 0x6c1252bd
mov dword [esi], 0
mov dword [ebx], 0
mov eax, 1
jmp 0x6c1252bf
Function at 0x6c125350
Capabilities:
Get thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [0x6c1451f8]
mov esi, dword [ecx]
mov edi, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov edx, eax
test byte [0x6c1451fc], 8
jne 0x6c125480
test esi, esi
je 0x6c125460
test ebx, ebx
je 0x6c125460
test edx, edx
je 0x6c125440
mov eax, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
lea ecx, [edx + 4]
mov dword [ebp - 0x20], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ecx
mov dword [ebp - 0x1c], ecx
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x24], eax
call eax
sub esp, 0x18
sub eax, 1
test edi, edi
je 0x6c1254c0
cmp dword [ebx], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
jb 0x6c1254c0
mov eax, dword [edx]
mov dword [esi], eax
mov eax, dword [ebx]
test eax, eax
je 0x6c12544c
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [ebp - 0x24]
call eax
sub esp, 0x18
mov dword [ebx], eax
jmp 0x6c12544c
mov dword [esi], 0
mov dword [ebx], 0
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x6c14baea
mov dword [esp + 8], str.InternetGetLastResponseInfoW
mov dword [esp + 4], 0x6c1451fc
mov dword [esp], 3
call fcn.6c123f10
mov edx, dword [ebp - 0x1c]
jmp 0x6c12538c
mov dword [ebx], eax
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x7a
xor eax, eax
jmp 0x6c12546f