joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54ad00
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov ebx, edx
push edi
mov edi, ecx
cmp ebx, 0x26
je 0x54ad49
cmp ebx, 0x28
je 0x54ad49
nop
cmp ebx, 0x24
je 0x54ad49
cmp ebx, 0x23
je 0x54ad49
cmp ebx, 0x21
je 0x54ad49
cmp ebx, 0x22
je 0x54ad49
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00583f7f
add esp, 0x20
ret
mov eax, dword [edi + 0xd4]
mov ecx, dword [eax]
test ecx, ecx
je 0x54af0c
lea eax, ds:[ebx - 0x21]
cmp eax, 7
ja case.0x54ad69.36
jmp dword [eax*4 + 0x54af24]
mov eax, dword [edi + 0x6c]
test eax, eax
je case.0x54ad69.36
mov esi, dword ds:[eax + 0x20]
test esi, esi
je case.0x54ad69.36
dec esi
jmp 0x54ae0b
mov esi, dword [edi + 0x6c]
test esi, esi
je case.0x54ad69.36
mov esi, dword [esi + 0x20]
inc esi
jmp 0x54adfe
mov esi, dword ds:[edi + 0x6c]
test esi, esi
je 0x54ada9
mov esi, dword [esi + 0x20]
jmp 0x54adab
xor esi, esi
test byte [edi + 0x20], 8
je 0x54adb6
mov edx, dword [edi + 0x54]
jmp 0x54adb8
xor edx, edx
mov eax, dword [edi + 0x44]
sub eax, dword [edi + 0x48]
sub eax, edx
js 0x54af0c
cdq
idiv dword [edi + 0x4c]
sub eax, 1
js 0x54af0c
mov edx, dword [edi + 0x58]
cmp ebx, 0x21
jne 0x54adeb
cmp esi, edx
jbe 0x54ade3
mov esi, edx
jmp 0x54ae0b
cmp esi, eax
jb case.0x54ad69.36
sub esi, eax
jmp 0x54ae0b
add edx, eax
cmp edx, ecx
jb 0x54adf4
lea edx, [ecx - 1]
cmp esi, edx
jae 0x54adfc
mov esi, edx
jmp 0x54ae0b
add esi, eax
nop
cmp esi, ecx
jb 0x54ae0b
lea esi, [ecx - 1]
jmp 0x54ae0b
xor esi, esi
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
push 0x10
mov word [esp + 0x10], ax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword ds:[edi + 0xd4]
mov bx, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + esi*4]
mov ecx, edi
mov dword [edi + 0x6c], edx
call fcn.0054a480
shr bx, 0xf
test bl, bl
je 0x54ae7d
mov eax, dword [edi + 0x74]
cmp eax, 0xffffffff
je 0x54ae7d
cmp esi, eax
jbe 0x54ae6c
lea ecx, [esp + 0xc]
mov edx, eax
push ecx
lea ecx, [esp + 0x14]
mov eax, esi
push ecx
push 4
push eax
jmp 0x54ae9c
lea ecx, [esp + 0xc]
mov edx, esi
push ecx
lea ecx, [esp + 0x14]
push ecx
push 4
push eax
jmp 0x54ae9c
cmp byte [esp + 0xc], 0
jne 0x54aece
mov eax, dword [edi + 0x6c]
mov edx, esi
mov eax, dword [eax + 0x20]
mov dword [edi + 0x74], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push 4
push esi
mov ecx, edi
call fcn.0054a300
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 1
push dword [esp + 0x14]
mov ecx, edi
call fcn.0054a020
test al, al
je 0x54aece
push 0
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, esi
mov ecx, edi
call fcn.0054a660
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x54af0c
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0xf8], 0xffffffff
mov dword [edi + 0xfc], 0xffffffff
mov dword [edi + 0x11c], 0xffffffff
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
add esp, 0x20
ret
Function at 0x54ad70
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov ebx, edx
push edi
mov edi, ecx
cmp ebx, 0x26
je 0x54ad49
cmp ebx, 0x28
je 0x54ad49
nop
cmp ebx, 0x24
je 0x54ad49
cmp ebx, 0x23
je 0x54ad49
cmp ebx, 0x21
je 0x54ad49
cmp ebx, 0x22
je 0x54ad49
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00583f7f
add esp, 0x20
ret
mov eax, dword [edi + 0xd4]
mov ecx, dword [eax]
test ecx, ecx
je 0x54af0c
lea eax, ds:[ebx - 0x21]
cmp eax, 7
ja case.0x54ad69.36
jmp dword [eax*4 + 0x54af24]
mov eax, dword [edi + 0x6c]
test eax, eax
je case.0x54ad69.36
mov esi, dword ds:[eax + 0x20]
test esi, esi
je case.0x54ad69.36
dec esi
jmp 0x54ae0b
mov esi, dword [edi + 0x6c]
test esi, esi
je case.0x54ad69.36
mov esi, dword [esi + 0x20]
inc esi
jmp 0x54adfe
mov esi, dword ds:[edi + 0x6c]
test esi, esi
je 0x54ada9
mov esi, dword [esi + 0x20]
jmp 0x54adab
xor esi, esi
test byte [edi + 0x20], 8
je 0x54adb6
mov edx, dword [edi + 0x54]
jmp 0x54adb8
xor edx, edx
mov eax, dword [edi + 0x44]
sub eax, dword [edi + 0x48]
sub eax, edx
js 0x54af0c
cdq
idiv dword [edi + 0x4c]
sub eax, 1
js 0x54af0c
mov edx, dword [edi + 0x58]
cmp ebx, 0x21
jne 0x54adeb
cmp esi, edx
jbe 0x54ade3
mov esi, edx
jmp 0x54ae0b
cmp esi, eax
jb case.0x54ad69.36
sub esi, eax
jmp 0x54ae0b
add edx, eax
cmp edx, ecx
jb 0x54adf4
lea edx, [ecx - 1]
cmp esi, edx
jae 0x54adfc
mov esi, edx
jmp 0x54ae0b
add esi, eax
nop
cmp esi, ecx
jb 0x54ae0b
lea esi, [ecx - 1]
jmp 0x54ae0b
xor esi, esi
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
push 0x10
mov word [esp + 0x10], ax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword ds:[edi + 0xd4]
mov bx, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + esi*4]
mov ecx, edi
mov dword [edi + 0x6c], edx
call fcn.0054a480
shr bx, 0xf
test bl, bl
je 0x54ae7d
mov eax, dword [edi + 0x74]
cmp eax, 0xffffffff
je 0x54ae7d
cmp esi, eax
jbe 0x54ae6c
lea ecx, [esp + 0xc]
mov edx, eax
push ecx
lea ecx, [esp + 0x14]
mov eax, esi
push ecx
push 4
push eax
jmp 0x54ae9c
lea ecx, [esp + 0xc]
mov edx, esi
push ecx
lea ecx, [esp + 0x14]
push ecx
push 4
push eax
jmp 0x54ae9c
cmp byte [esp + 0xc], 0
jne 0x54aece
mov eax, dword [edi + 0x6c]
mov edx, esi
mov eax, dword [eax + 0x20]
mov dword [edi + 0x74], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push 4
push esi
mov ecx, edi
call fcn.0054a300
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 1
push dword [esp + 0x14]
mov ecx, edi
call fcn.0054a020
test al, al
je 0x54aece
push 0
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, esi
mov ecx, edi
call fcn.0054a660
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x54af0c
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0xf8], 0xffffffff
mov dword [edi + 0xfc], 0xffffffff
mov dword [edi + 0x11c], 0xffffffff
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
add esp, 0x20
ret
Function at 0x54ad8e
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov ebx, edx
push edi
mov edi, ecx
cmp ebx, 0x26
je 0x54ad49
cmp ebx, 0x28
je 0x54ad49
nop
cmp ebx, 0x24
je 0x54ad49
cmp ebx, 0x23
je 0x54ad49
cmp ebx, 0x21
je 0x54ad49
cmp ebx, 0x22
je 0x54ad49
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00583f7f
add esp, 0x20
ret
mov eax, dword [edi + 0xd4]
mov ecx, dword [eax]
test ecx, ecx
je 0x54af0c
lea eax, ds:[ebx - 0x21]
cmp eax, 7
ja case.0x54ad69.36
jmp dword [eax*4 + 0x54af24]
mov eax, dword [edi + 0x6c]
test eax, eax
je case.0x54ad69.36
mov esi, dword ds:[eax + 0x20]
test esi, esi
je case.0x54ad69.36
dec esi
jmp 0x54ae0b
mov esi, dword [edi + 0x6c]
test esi, esi
je case.0x54ad69.36
mov esi, dword [esi + 0x20]
inc esi
jmp 0x54adfe
mov esi, dword ds:[edi + 0x6c]
test esi, esi
je 0x54ada9
mov esi, dword [esi + 0x20]
jmp 0x54adab
xor esi, esi
test byte [edi + 0x20], 8
je 0x54adb6
mov edx, dword [edi + 0x54]
jmp 0x54adb8
xor edx, edx
mov eax, dword [edi + 0x44]
sub eax, dword [edi + 0x48]
sub eax, edx
js 0x54af0c
cdq
idiv dword [edi + 0x4c]
sub eax, 1
js 0x54af0c
mov edx, dword [edi + 0x58]
cmp ebx, 0x21
jne 0x54adeb
cmp esi, edx
jbe 0x54ade3
mov esi, edx
jmp 0x54ae0b
cmp esi, eax
jb case.0x54ad69.36
sub esi, eax
jmp 0x54ae0b
add edx, eax
cmp edx, ecx
jb 0x54adf4
lea edx, [ecx - 1]
cmp esi, edx
jae 0x54adfc
mov esi, edx
jmp 0x54ae0b
add esi, eax
nop
cmp esi, ecx
jb 0x54ae0b
lea esi, [ecx - 1]
jmp 0x54ae0b
xor esi, esi
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
push 0x10
mov word [esp + 0x10], ax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword ds:[edi + 0xd4]
mov bx, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + esi*4]
mov ecx, edi
mov dword [edi + 0x6c], edx
call fcn.0054a480
shr bx, 0xf
test bl, bl
je 0x54ae7d
mov eax, dword [edi + 0x74]
cmp eax, 0xffffffff
je 0x54ae7d
cmp esi, eax
jbe 0x54ae6c
lea ecx, [esp + 0xc]
mov edx, eax
push ecx
lea ecx, [esp + 0x14]
mov eax, esi
push ecx
push 4
push eax
jmp 0x54ae9c
lea ecx, [esp + 0xc]
mov edx, esi
push ecx
lea ecx, [esp + 0x14]
push ecx
push 4
push eax
jmp 0x54ae9c
cmp byte [esp + 0xc], 0
jne 0x54aece
mov eax, dword [edi + 0x6c]
mov edx, esi
mov eax, dword [eax + 0x20]
mov dword [edi + 0x74], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push 4
push esi
mov ecx, edi
call fcn.0054a300
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 1
push dword [esp + 0x14]
mov ecx, edi
call fcn.0054a020
test al, al
je 0x54aece
push 0
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, esi
mov ecx, edi
call fcn.0054a660
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x54af0c
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0xf8], 0xffffffff
mov dword [edi + 0xfc], 0xffffffff
mov dword [edi + 0x11c], 0xffffffff
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
add esp, 0x20
ret
Function at 0x54ad9b
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov ebx, edx
push edi
mov edi, ecx
cmp ebx, 0x26
je 0x54ad49
cmp ebx, 0x28
je 0x54ad49
nop
cmp ebx, 0x24
je 0x54ad49
cmp ebx, 0x23
je 0x54ad49
cmp ebx, 0x21
je 0x54ad49
cmp ebx, 0x22
je 0x54ad49
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00583f7f
add esp, 0x20
ret
mov eax, dword [edi + 0xd4]
mov ecx, dword [eax]
test ecx, ecx
je 0x54af0c
lea eax, ds:[ebx - 0x21]
cmp eax, 7
ja case.0x54ad69.36
jmp dword [eax*4 + 0x54af24]
mov eax, dword [edi + 0x6c]
test eax, eax
je case.0x54ad69.36
mov esi, dword ds:[eax + 0x20]
test esi, esi
je case.0x54ad69.36
dec esi
jmp 0x54ae0b
mov esi, dword [edi + 0x6c]
test esi, esi
je case.0x54ad69.36
mov esi, dword [esi + 0x20]
inc esi
jmp 0x54adfe
mov esi, dword ds:[edi + 0x6c]
test esi, esi
je 0x54ada9
mov esi, dword [esi + 0x20]
jmp 0x54adab
xor esi, esi
test byte [edi + 0x20], 8
je 0x54adb6
mov edx, dword [edi + 0x54]
jmp 0x54adb8
xor edx, edx
mov eax, dword [edi + 0x44]
sub eax, dword [edi + 0x48]
sub eax, edx
js 0x54af0c
cdq
idiv dword [edi + 0x4c]
sub eax, 1
js 0x54af0c
mov edx, dword [edi + 0x58]
cmp ebx, 0x21
jne 0x54adeb
cmp esi, edx
jbe 0x54ade3
mov esi, edx
jmp 0x54ae0b
cmp esi, eax
jb case.0x54ad69.36
sub esi, eax
jmp 0x54ae0b
add edx, eax
cmp edx, ecx
jb 0x54adf4
lea edx, [ecx - 1]
cmp esi, edx
jae 0x54adfc
mov esi, edx
jmp 0x54ae0b
add esi, eax
nop
cmp esi, ecx
jb 0x54ae0b
lea esi, [ecx - 1]
jmp 0x54ae0b
xor esi, esi
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
push 0x10
mov word [esp + 0x10], ax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword ds:[edi + 0xd4]
mov bx, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + esi*4]
mov ecx, edi
mov dword [edi + 0x6c], edx
call fcn.0054a480
shr bx, 0xf
test bl, bl
je 0x54ae7d
mov eax, dword [edi + 0x74]
cmp eax, 0xffffffff
je 0x54ae7d
cmp esi, eax
jbe 0x54ae6c
lea ecx, [esp + 0xc]
mov edx, eax
push ecx
lea ecx, [esp + 0x14]
mov eax, esi
push ecx
push 4
push eax
jmp 0x54ae9c
lea ecx, [esp + 0xc]
mov edx, esi
push ecx
lea ecx, [esp + 0x14]
push ecx
push 4
push eax
jmp 0x54ae9c
cmp byte [esp + 0xc], 0
jne 0x54aece
mov eax, dword [edi + 0x6c]
mov edx, esi
mov eax, dword [eax + 0x20]
mov dword [edi + 0x74], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push 4
push esi
mov ecx, edi
call fcn.0054a300
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 1
push dword [esp + 0x14]
mov ecx, edi
call fcn.0054a020
test al, al
je 0x54aece
push 0
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, esi
mov ecx, edi
call fcn.0054a660
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x54af0c
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0xf8], 0xffffffff
mov dword [edi + 0xfc], 0xffffffff
mov dword [edi + 0x11c], 0xffffffff
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
add esp, 0x20
ret
Function at 0x54f740
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
call fcn.0054f5e0
test eax, eax
jne 0x54f75f
mov eax, 0x8007007f
pop edi
pop esi
pop ebx
add esp, 0x10
ret
cmp dword [0x62db64], 0x3e
lea ecx, [esp + 0xc]
mov esi, dword [eax]
push 0
push 0
push 0
push ecx
push ebx
push eax
jae 0x54f77c
mov esi, dword [esi + 0x14]
jmp 0x54f77f
mov esi, dword [esi + 0x18]
mov ecx, esi
call dword [0x5a9914]
call esi
mov esi, eax
test esi, esi
jne 0x54f7f7
mov eax, dword fs:[0x18]
push dword [esp + 0xc]
push esi
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlSizeHeap]
cmp eax, 2
jbe 0x54f7db
mov ecx, dword [esp + 0xc]
add eax, 0xfffffffe
push esi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push esi
push eax
mov dword [esp + 0x20], ecx
call sym.SystemInformer.exe_Ordinal_1331
mov dword [edi], eax
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
xor eax, eax
mov esi, 0x8000ffff
mov dword [edi], eax
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov dword [edi], 0
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x567de0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
movzx eax, word [ecx]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, edx
push esi
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
nop word [eax + eax]
movzx eax, ax
xor edx, edx
movzx eax, byte [eax + 0x5f7690]
lea ecx, [ecx + eax*2]
call fcn.00563540
mov esi, eax
movzx eax, word [esi]
cmp eax, 0x8a
jne 0x567e9d
movzx eax, word [esi + 4]
add esi, 4
cmp eax, 0x76
jne 0x567e38
add esi, 8
jmp 0x567e46
mov ecx, eax
cmp eax, 0x77
jne 0x567e49
movzx eax, word [esi + 6]
lea esi, [esi + eax*2]
movzx ecx, word [esi]
movzx eax, cx
add eax, 0xffffff70
cmp eax, 0x12
ja case.0x567e60.145
movzx eax, byte [eax + 0x568000]
nop dword [eax]
jmp dword [eax*4 + 0x567ff8]
push 1
push ebp
push edi
mov edx, ebx
mov ecx, esi
call fcn.00567de0
test eax, eax
je case.0x567e60.144
nop dword [eax]
movzx eax, word [esi + 2]
cmp word [esi + eax*2], 0x78
lea esi, [esi + eax*2]
je 0x567e80
lea ecx, [esi + 4]
xor edx, edx
call fcn.00563540
mov esi, eax
movzx eax, word [esi]
nop dword [eax]
cmp eax, 0x86
je 0x567fb1
cmp eax, 0x87
je 0x567fb1
nop word [eax + eax]
cmp eax, 0x8b
je 0x567fb1
cmp eax, 0x8c
je 0x567fb1
nop word [eax + eax]
cmp eax, 0x88
je 0x567f95
cmp eax, 0x89
je 0x567f95
nop word [eax + eax]
cmp eax, 0x8d
je 0x567f95
cmp eax, 0x8e
je 0x567f95
cmp eax, 0x7e
je 0x567f91
nop dword [eax + eax]
cmp eax, 0x82
je 0x567f91
cmp eax, 0x84
jne 0x567f3b
push dword [esp + 0x20]
lea eax, [ebp + 1]
push eax
jmp 0x567fb6
nop dword [eax + eax]
cmp eax, 0x55
je 0x567f63
cmp eax, 0x56
je 0x567f63
cmp eax, 0x5e
je 0x567f63
cmp eax, 0x1b
je 0x567fc9
cmp eax, 0x1c
je 0x567fc9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
cmp word [esi + 2], 0xc
jne case.0x567e60.144
test dword [edi + 0x8c], ebx
jne case.0x567e60.144
test ebp, ebp
jg case.0x567e60.144
cmp dword [edi + 0xb4], 0
jne case.0x567e60.144
cmp dword [esp + 0x20], 0
jne case.0x567e60.144
test dword [edi + 0x6c], 0x8000
jne case.0x567e60.144
jmp 0x567fc9
push 1
jmp 0x567fb5
movzx ecx, word [esi + 4]
mov eax, 1
push dword [esp + 0x20]
mov edx, eax
shl edx, cl
cmp ecx, 0x20
push ebp
cmovae edx, eax
or edx, ebx
jmp 0x567fb8
push dword [esp + 0x20]
push ebp
mov edx, ebx
push edi
mov ecx, esi
call fcn.00567de0
test eax, eax
je case.0x567e60.144
mov ecx, dword [esp + 0x10]
movzx eax, word [ecx + 2]
cmp word [ecx + eax*2], 0x78
lea ecx, [ecx + eax*2]
mov dword [esp + 0x10], ecx
jne 0x567fe9
mov eax, 0x78
jmp 0x567e00
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0xc
Function at 0x56d4c0
Capabilities:
Initialize winhttp library

Disassembly:
sub esp, 0xc
push esi
push 0xc
push 4
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
cmp dword [0x62db64], 0x3f
mov esi, eax
push 0
sbb ecx, ecx
xorps xmm0, xmm0
push 0
and ecx, 0xfffffffc
movq qword [esi], xmm0
push 0
add ecx, 4
mov dword [esi + 8], 0
push ecx
push dword [esp + 0x28]
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi], eax
test eax, eax
jne 0x56d523
push esi
push eax
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
pop esi
add esp, 0xc
ret 8
cmp dword [0x62db64], 0x3f
lea ecx, [esp + 4]
push 4
push ecx
push 0x54
push eax
jae 0x56d555
mov dword ds:[esp + 0x14], 0xa00
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [esp + 0x14]
mov dword [eax], esi
mov al, 1
pop esi
add esp, 0xc
ret 8
mov dword ds:[esp + 0x14], 0x2800
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 3
push eax
push 0x76
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x62db64]
cmp eax, 0x64
jb 0x56d5ab
push 4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0x85
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x62db64]
cmp eax, 0x72
jb 0x56d5f1
push 4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0xc3
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x62db64], 0x72
jb 0x56d5f1
push 4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0x9a
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword ds:[esp + 0x14]
mov dword [eax], esi
mov al, 1
pop esi
add esp, 0xc
ret 8

Function at 0x56d730
Capabilities:
Prepare http request

Disassembly:
push ecx
mov edx, dword [esp + 0x14]
and edx, 1
shl edx, 0x17
push esi
mov esi, dword [esp + 0xc]
mov eax, edx
or eax, 0x100
test byte [esp + 0x18], 2
cmove eax, edx
push eax
push 0
push 0
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 8], eax
pop esi
test eax, eax
jne 0x56d775
xor al, al
pop ecx
ret 0x10
push 4
lea ecx, [esp + 4]
mov dword [esp + 4], 8
push ecx
push 0x3f
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov al, 1
pop ecx
ret 0x10

Function at 0x56d880
Capabilities:
Set http header

Disassembly:
mov eax, dword ds:[esp + 0xc]
or ecx, 0xffffffff
test eax, eax
push 0xa0000000
cmovne ecx, eax
mov eax, dword [esp + 8]
push ecx
push dword [esp + 0x10]
push dword [eax + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
setne al
ret 0xc
Function at 0x56d8c0
Capabilities:
Read http header

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 8]
push 0
push eax
push 0
push 0
push 0x16
push dword [edi + 8]
mov dword [esp + 0x20], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x56d8f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x56d945
mov eax, dword [esp + 8]
push 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x1c], 0
call sym.SystemInformer.exe_Ordinal_1331
push 0
mov esi, eax
lea eax, [esp + 0xc]
push eax
push dword [esi + 4]
push 0
push 0x16
push dword [edi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x56d94f
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x56d945
nop
call fcn.004fe0c0
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret 4
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret 4

Function at 0x56d960
Capabilities:
Read http header

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 8]
push 0
push eax
push 0
push dword [esp + 0x28]
mov dword [esp + 0x18], 0
push 0xffff
push dword [edi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x56d99b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x56d9ee
mov eax, dword [esp + 8]
push 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x1c], 0
call sym.SystemInformer.exe_Ordinal_1331
push 0
mov esi, eax
lea eax, [esp + 0xc]
push eax
push dword [esi + 4]
push dword [esp + 0x28]
push 0xffff
push dword [edi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x56d9f8
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x56d9ee
call fcn.004fe0c0
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret 8
push dword ds:[esi + 4]
call sym.SystemInformer.exe_Ordinal_1322
add eax, eax
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x56da80
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x218], eax
mov edx, dword [ebp + 0xc]
lea eax, [esp]
push ebx
push esi
mov esi, dword [ebp + 8]
and dl, 1
push edi
mov edi, dword [ebp + 0x10]
push 0
push eax
movzx ecx, dl
lea eax, [esp + 0x28]
neg ecx
mov dword [esp + 0x14], 0x100
push eax
sbb ecx, ecx
and ecx, 5
mov eax, ecx
or eax, 0x13
test byte [ebp + 0xc], 2
push 0
cmove eax, ecx
push eax
push dword [esi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
nop
test eax, eax
je 0x56db6d
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x20]
xor bl, bl
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x56db24
mov dx, word [esp + 0x20]
cmp dx, 0x2d
je 0x56db0f
cmp dx, 0x2b
jne 0x56db24
add eax, 2
sub ecx, 2
cmp dx, 0x2d
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
sete bl
lea eax, [esp + 0x18]
mov edx, 0xa
push eax
lea ecx, [esp + 0x14]
call fcn.00503730
mov edx, dword ds:[esp + 0x18]
mov ecx, dword [esp + 0x1c]
test bl, bl
je 0x56db4b
neg edx
adc ecx, 0
neg ecx
test al, al
je 0x56db6d
mov dword [edi], edx
mov al, 1
mov dword [edi + 4], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword ds:[esp + 0x224]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret 0xc