joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54506e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 0x18]
mov ecx, dword [edx]
cmp ecx, dword [ebp - 8]
jae 0x5450d1
push dword [ebp + 0x10]
push edi
mov eax, dword [ebp - 0xc]
add eax, ebx
add eax, 0x28
push eax
call fcn.00545ec8
add esp, 0xc
mov edx, dword [ebp + 0x10]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 0x18]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x5451b4
cmp esi, edi
jne 0x5450df
mov eax, 0x1001
jmp 0x5451b4
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
push edx
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.00545ec8
add esp, 0xc
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
add edi, eax
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
sub dword [ebp + 0x10], edx
lea ecx, [ebx + 0x18]
push ecx
push dword [ebp - 4]
call fcn.005426ca
add esp, 8
mov eax, dword [ebx + 0x18]
xor eax, dword [ebx + 0x28]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
xor edx, dword [ebx + 0x2c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
xor ecx, dword [ebx + 0x30]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
xor eax, dword [ebx + 0x34]
mov dword [esi + 0xc], eax
add esi, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
jb 0x54518b
lea ecx, [ebx + 0x18]
push ecx
push dword [ebp - 4]
call fcn.005426ca
add esp, 8
mov eax, dword [edi]
xor eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [edi + 4]
xor edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [edi + 8]
xor ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [edi + 0xc]
xor eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
add edi, dword [ebp - 8]
add esi, dword [ebp - 8]
mov edx, dword [ebp - 8]
sub dword [ebp + 0x10], edx
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jae 0x545146
push dword [ebp + 0x10]
push edi
lea eax, [ebx + 0x28]
push eax
call fcn.00545ec8
add esp, 0xc
mov edx, dword [ebx + 0x38]
and edx, 0xf0000000
add edx, dword [ebp + 0x10]
mov dword [ebx + 0x38], edx
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
sub dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5451bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 0x18]
mov ecx, dword [edx]
cmp ecx, dword [ebp - 8]
jae 0x54521e
push dword [ebp + 0x10]
push edi
mov eax, dword [ebp - 0xc]
add eax, ebx
add eax, 0x28
push eax
call fcn.00545ec8
add esp, 0xc
mov edx, dword [ebp + 0x10]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 0x18]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x545318
cmp esi, edi
jne 0x54522c
mov eax, 0x1001
jmp 0x545318
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
push edx
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.00545ec8
add esp, 0xc
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
add edi, eax
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
sub dword [ebp + 0x10], edx
lea ecx, [ebx + 0x18]
push ecx
push dword [ebp - 4]
call fcn.005426ca
add esp, 8
mov eax, dword [ebx + 0x28]
xor dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x2c]
xor dword [ebx + 0x1c], edx
mov ecx, dword [ebx + 0x30]
xor dword [ebx + 0x20], ecx
mov eax, dword [ebx + 0x34]
xor dword [ebx + 0x24], eax
mov edx, dword [ebx + 0x18]
mov dword [esi], edx
mov ecx, dword [ebx + 0x1c]
mov dword [esi + 4], ecx
mov eax, dword [ebx + 0x20]
mov dword [esi + 8], eax
mov edx, dword [ebx + 0x24]
mov dword [esi + 0xc], edx
add esi, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jb 0x5452f0
lea eax, [ebx + 0x18]
push eax
push dword [ebp - 4]
call fcn.005426ca
add esp, 8
mov edx, dword [edi]
xor dword [ebx + 0x18], edx
mov ecx, dword [edi + 4]
xor dword [ebx + 0x1c], ecx
mov eax, dword [edi + 8]
xor dword [ebx + 0x20], eax
mov edx, dword [edi + 0xc]
xor dword [ebx + 0x24], edx
mov ecx, dword [ebx + 0x18]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
mov dword [esi + 0xc], ecx
add edi, dword [ebp - 8]
add esi, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub dword [ebp + 0x10], eax
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
jae 0x54529f
push dword [ebp + 0x10]
push edi
lea ecx, [ebx + 0x28]
push ecx
call fcn.00545ec8
add esp, 0xc
mov eax, dword [ebx + 0x38]
and eax, 0xf0000000
add eax, dword [ebp + 0x10]
mov dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
sub dword [edx], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x545499
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], 0x10
mov esi, dword [ebx + 0x38]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
lea edx, [ebx + 0x18]
push edx
push eax
call fcn.005426ca
add esp, 8
xor eax, eax
cmp esi, eax
jbe 0x5454de
mov cl, byte [ebx + eax + 0x28]
xor cl, byte [ebx + eax + 0x18]
mov byte [edi + eax], cl
inc eax
cmp esi, eax
ja 0x5454ce
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x54591c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
ja 0x545980
push dword [ebp + 0x10]
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.00545ec8
add esp, 0xc
mov eax, dword [ebp + 0x10]
add dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
xor ecx, ecx
mov dword [edx], ecx
xor eax, eax
jmp 0x545a6d
cmp edi, esi
jne 0x54598e
mov eax, 0x1001
jmp 0x545a6d
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
push eax
push edi
mov edx, dword [ebp - 0xc]
add edx, ebx
add edx, 0x28
push edx
call fcn.00545ec8
add esp, 0xc
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
add edi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
sub dword [ebp + 0x10], eax
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.005426ca
add esp, 8
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [esi + 0xc], ecx
add esi, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jbe 0x545a45
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.005426ca
add esp, 8
mov ecx, dword [edi]
xor ecx, dword [ebx + 0x18]
mov dword [esi], ecx
mov eax, dword [edi + 4]
xor eax, dword [ebx + 0x1c]
mov dword [esi + 4], eax
mov edx, dword [edi + 8]
xor edx, dword [ebx + 0x20]
mov dword [esi + 8], edx
mov ecx, dword [edi + 0xc]
xor ecx, dword [ebx + 0x24]
mov dword [esi + 0xc], ecx
add edi, dword [ebp - 8]
add esi, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub dword [ebp + 0x10], eax
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
ja 0x545a00
push dword [ebp + 0x10]
push edi
lea ecx, [ebx + 0x28]
push ecx
call fcn.00545ec8
add esp, 0xc
mov eax, dword [ebx + 0x38]
and eax, 0xf0000000
add eax, dword [ebp + 0x10]
mov dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
sub dword [edx], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x545a74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
ja 0x545ad8
push dword [ebp + 0x10]
push esi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.00545ec8
add esp, 0xc
mov eax, dword [ebp + 0x10]
add dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
xor ecx, ecx
mov dword [edx], ecx
xor eax, eax
jmp 0x545bf5
cmp esi, edi
jne 0x545ae6
mov eax, 0x1001
jmp 0x545bf5
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
push eax
push esi
mov edx, dword [ebp - 0xc]
add edx, ebx
add edx, 0x28
push edx
call fcn.00545ec8
add esp, 0xc
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
add esi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
sub dword [ebp + 0x10], eax
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.005426ca
add esp, 8
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [edi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [edi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [edi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [edi + 0xc], ecx
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x2c]
mov dword [ebx + 0x1c], edx
mov ecx, dword [ebx + 0x30]
mov dword [ebx + 0x20], ecx
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x24], eax
add edi, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
jbe 0x545bcc
lea ecx, [ebx + 0x18]
push ecx
push dword [ebp - 4]
call fcn.005426ca
add esp, 8
mov eax, dword [ebx + 0x18]
xor eax, dword [esi]
mov dword [edi], eax
mov edx, dword [ebx + 0x1c]
xor edx, dword [esi + 4]
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0x20]
xor ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov eax, dword [ebx + 0x24]
xor eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov edx, dword [esi]
mov dword [ebx + 0x18], edx
mov ecx, dword [esi + 4]
mov dword [ebx + 0x1c], ecx
mov eax, dword [esi + 8]
mov dword [ebx + 0x20], eax
mov edx, dword [esi + 0xc]
mov dword [ebx + 0x24], edx
add esi, dword [ebp - 8]
add edi, dword [ebp - 8]
mov ecx, dword [ebp - 8]
sub dword [ebp + 0x10], ecx
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
ja 0x545b70
push dword [ebp + 0x10]
push esi
lea edx, [ebx + 0x28]
push edx
call fcn.00545ec8
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp + 0x10]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x545dcc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov esi, dword [ebx + 0x38]
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
lea ecx, [ebx + 0x18]
push ecx
push eax
call fcn.005426ca
add esp, 8
xor eax, eax
cmp esi, eax
jbe 0x545e06
mov dl, byte [ebx + eax + 0x28]
xor dl, byte [ebx + eax + 0x18]
mov byte [edi + eax], dl
inc eax
cmp esi, eax
ja 0x545df6
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x556ab8
Capabilities:
Check for time delay via gettickcount
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x556bd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x2710
lea eax, [ebx + 1]
call fcn.00482b04
mov esi, eax
lea eax, [ebx + esi]
mov byte [eax], 0
push 0
push 0
push 0
push 0
push 0x556be4
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004850c8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 1
mov eax, edi
call fcn.00484bf8
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x11], al
cmp dword [ebp - 0x10], 0
je 0x556b78
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.0048a118
cmp ebx, dword [ebp - 0x10]
jbe 0x556b6e
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00485254
mov eax, edi
mov edx, dword [ebp - 0x18]
call fcn.00484ed0
cmp dword [ebp - 0x10], 0
je 0x556b8d
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0x1c]
cmp eax, 0x1388
jbe 0x556b36
cmp byte [ebp - 0x11], 0
je 0x556b98
cmp ebx, dword [ebp - 0x10]
jae 0x556ba6
mov ecx, dword [edi]
mov eax, edi
mov edx, 0x556bf0
call fcn.00484f14
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, esi
call fcn.00482b34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x556bdc
lea eax, [ebp - 0x18]
call fcn.00484bf8
ret

Function at 0x557008
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebx
push esi
add esp, 0xfffffe5c
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, 0x12
mov eax, esi
call fcn.00484bf8
mov eax, esp
xor ecx, ecx
mov edx, 0x14
call fcn.00483678
push ebx
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x557053
mov edx, esi
mov eax, esp
call fcn.0048a118
add esp, 0x1a4
pop esi
pop ebx
ret
Function at 0x5575d0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd38
push ebx
xor ecx, ecx
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 0x2a4], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004850b8
xor eax, eax
push ebp
push 0x55773b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1a0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x55770e
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x2a4]
call fcn.00557008
lea eax, [ebp - 0x2a0]
mov edx, dword [ebp - 4]
call fcn.00489f80
lea eax, [ebp - 0x2a0]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5576f7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x5576f1
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5576eb
lea eax, [ebp - 0x2a8]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
mov dword [ebp - 0x2c8], eax
mov byte [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 1]
mov dword [ebp - 0x2c0], eax
mov byte [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2b8], eax
mov byte [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 3]
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 0x2ac], 0
lea edx, [ebp - 0x2c8]
mov ecx, 3
mov eax, 0x557754
call fcn.0048a630
mov edx, dword [ebp - 0x2a8]
mov eax, ebx
call fcn.00484c4c
mov byte [ebp - 5], 1
jmp 0x5576fb
mov byte [ebp - 5], 0
jmp 0x5576fb
mov byte [ebp - 5], 0
jmp 0x5576fb
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x557715
call sub.wsock32.dll_WSACleanup
ret
Function at 0x55bf8c
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004850b8
xor eax, eax
push ebp
push 0x55c0c2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.0048905c
mov edx, dword [ebp - 0x30]
mov eax, 0x55c0d8
call fcn.0048520c
test eax, eax
jne 0x55bfe3
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x55c0d8
call fcn.00484f14
xor ebx, ebx
push 0
push 0
push 0
push 0
push 0x55c0e0
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x55c09f
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004850c8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0xa
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x13
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_HttpQueryInfoA
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x18]
call fcn.00484e00
mov eax, dword [ebp - 0x34]
mov edx, 0x55c0f8
call fcn.00485014
je 0x55c085
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x18]
call fcn.00484e00
mov eax, dword [ebp - 0x38]
mov edx, 0x55c104
call fcn.00485014
je 0x55c085
xor ebx, ebx
jmp 0x55c087
mov bl, 1
cmp dword [ebp - 0xc], 0
je 0x55c096
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55c0c9
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00484c1c
lea eax, [ebp - 4]
call fcn.00484bf8
ret

Function at 0x55d0c0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x55d0d5
or edx, 0x200
test eax, 0x20000000
je 0x55d108
test eax, 0x40000000
je 0x55d0f4
test eax, 0x80000000
je 0x55d0ef
or edx, 0x40
jmp 0x55d12f
or edx, 0x20
jmp 0x55d12f
test eax, 0x80000000
je 0x55d103
or edx, 0x80
jmp 0x55d12f
or edx, 0x10
jmp 0x55d12f
test eax, 0x40000000
je 0x55d120
test eax, 0x80000000
je 0x55d11b
or edx, 4
jmp 0x55d12f
or edx, 2
jmp 0x55d12f
test eax, 0x80000000
je 0x55d12c
or edx, 8
jmp 0x55d12f
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x55edd4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00485494
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x55eded
test al, 0x10
jne 0x55edf1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x55f11c
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00485678
xor eax, eax
push ebp
push 0x55f245
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00485560
je 0x55f215
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0055ed68
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00485374
mov eax, dword [ebp - 4]
call fcn.0055edd4
test al, al
jne 0x55f215
mov eax, dword [ebp - 4]
call fcn.004854a4
cmp eax, 3
jl 0x55f215
mov eax, dword [ebp - 4]
call fcn.0055edd4
test al, al
jne 0x55f215
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00484e90
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00489c60
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00485484
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00485560
je 0x55f215
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0055ecec
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.0055f11c
test al, al
je 0x55f1f4
push 0
mov eax, dword [ebp - 4]
call fcn.00485494
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x55f1f8
xor ebx, ebx
jmp 0x55f1fa
mov bl, 1
test bl, bl
je 0x55f215
test si, si
jbe 0x55f215
movzx eax, si
push eax
mov eax, dword [ebp - 4]
call fcn.00485494
push eax
call sub.kernel32.dll_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55f24c
lea eax, [ebp - 0x18]
call fcn.00485314
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00484c1c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0048532c
ret
Function at 0x56193c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x14
add esp, 0xfffff004
push eax
dec eax
jne 0x561945
mov eax, dword [ebp - 4]
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14018], ecx
mov dword [ebp - 0x1401c], ecx
mov dword [ebp - 0x14008], edx
mov ebx, eax
lea eax, [ebp - 0x14008]
call fcn.00485678
xor eax, eax
push ebp
push 0x561b5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x14009], 0
lea edx, [ebp - 0x1401c]
mov eax, dword [ebp - 0x14008]
call fcn.0055ef60
mov eax, dword [ebp - 0x1401c]
lea edx, [ebp - 0x14018]
call fcn.0055f254
mov eax, dword [ebp - 0x14018]
mov edx, 0x561b78
call fcn.00485560
jne 0x561b34
mov dword [ebx + 0x9f], 0
mov dword [ebx + 0xa3], 0
mov byte [ebx + 0x9e], 0
push 0
push 3
push 0
push 0
mov eax, dword [ebp - 0x14008]
call fcn.00485494
mov ecx, 1
mov edx, 0x80000000
call fcn.0055f318
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x561b2d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.0055f3ac
mov dword [ebp - 0x14010], eax
push 0
push 0x10000
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0055f3ac
push 0
lea eax, [ebp - 0x14014]
push eax
push 0x14000
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
mov edi, dword [ebp - 0x14014]
sub edi, 6
test edi, edi
jb 0x561aa3
inc edi
xor esi, esi
push ebp
mov eax, esi
call fcn.00561904
pop ecx
mov byte [ebx + 0x9e], al
cmp byte [ebx + 0x9e], 0
je 0x561a9f
lea eax, [esi + 0x10000]
xor edx, edx
mov dword [ebx + 0x9f], eax
mov dword [ebx + 0xa3], edx
mov byte [ebp - 0x14009], 1
jmp 0x561aa3
inc esi
dec edi
jne 0x561a6a
cmp byte [ebx + 0x9e], 0
jne 0x561b17
push ebp
call fcn.00561814
pop ecx
mov esi, eax
cmp esi, dword [ebp - 0x14010]
je 0x561b17
mov eax, esi
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0055f3ac
push 0
lea eax, [ebp - 0x14014]
push eax
push 6
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
push ebp
xor eax, eax
call fcn.00561904
pop ecx
mov byte [ebx + 0x9e], al
cmp byte [ebx + 0x9e], 0
je 0x561b17
mov eax, esi
xor edx, edx
mov dword [ebx + 0x9f], eax
mov dword [ebx + 0xa3], edx
mov byte [ebp - 0x14009], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561b34
mov eax, dword [ebp - 4]
call fcn.00489828
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561b64
lea eax, [ebp - 0x1401c]
mov edx, 2
call fcn.0048532c
lea eax, [ebp - 0x14008]
call fcn.00485314
ret