joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54adae
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov ebx, edx
push edi
mov edi, ecx
cmp ebx, 0x26
je 0x54ad69
cmp ebx, 0x28
je 0x54ad69
nop
cmp ebx, 0x24
je 0x54ad69
cmp ebx, 0x23
je 0x54ad69
cmp ebx, 0x21
je 0x54ad69
cmp ebx, 0x22
je 0x54ad69
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret
mov eax, dword [edi + 0xd4]
mov ecx, dword [eax]
test ecx, ecx
je 0x54af2c
lea eax, ds:[ebx - 0x21]
cmp eax, 7
ja case.0x54ad89.36
jmp dword [eax*4 + 0x54af44]
mov eax, dword [edi + 0x6c]
test eax, eax
je case.0x54ad89.36
mov esi, dword ds:[eax + 0x20]
test esi, esi
je case.0x54ad89.36
dec esi
jmp 0x54ae2b
mov esi, dword [edi + 0x6c]
test esi, esi
je case.0x54ad89.36
mov esi, dword [esi + 0x20]
inc esi
jmp 0x54ae1e
mov esi, dword ds:[edi + 0x6c]
test esi, esi
je 0x54adc9
mov esi, dword [esi + 0x20]
jmp 0x54adcb
xor esi, esi
test byte [edi + 0x20], 8
je 0x54add6
mov edx, dword [edi + 0x54]
jmp 0x54add8
xor edx, edx
mov eax, dword [edi + 0x44]
sub eax, dword [edi + 0x48]
sub eax, edx
js 0x54af2c
cdq
idiv dword [edi + 0x4c]
sub eax, 1
js 0x54af2c
mov edx, dword [edi + 0x58]
cmp ebx, 0x21
jne 0x54ae0b
cmp esi, edx
jbe 0x54ae03
mov esi, edx
jmp 0x54ae2b
cmp esi, eax
jb case.0x54ad89.36
sub esi, eax
jmp 0x54ae2b
add edx, eax
cmp edx, ecx
jb 0x54ae14
lea edx, [ecx - 1]
cmp esi, edx
jae 0x54ae1c
mov esi, edx
jmp 0x54ae2b
add esi, eax
nop
cmp esi, ecx
jb 0x54ae2b
lea esi, [ecx - 1]
jmp 0x54ae2b
xor esi, esi
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
push 0x10
mov word [esp + 0x10], ax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword ds:[edi + 0xd4]
mov bx, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + esi*4]
mov ecx, edi
mov dword [edi + 0x6c], edx
call fcn.0054a4a0
shr bx, 0xf
test bl, bl
je 0x54ae9d
mov eax, dword [edi + 0x74]
cmp eax, 0xffffffff
je 0x54ae9d
cmp esi, eax
jbe 0x54ae8c
lea ecx, [esp + 0xc]
mov edx, eax
push ecx
lea ecx, [esp + 0x14]
mov eax, esi
push ecx
push 4
push eax
jmp 0x54aebc
lea ecx, [esp + 0xc]
mov edx, esi
push ecx
lea ecx, [esp + 0x14]
push ecx
push 4
push eax
jmp 0x54aebc
cmp byte [esp + 0xc], 0
jne 0x54aeee
mov eax, dword [edi + 0x6c]
mov edx, esi
mov eax, dword [eax + 0x20]
mov dword [edi + 0x74], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push 4
push esi
mov ecx, edi
call fcn.0054a320
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 1
push dword [esp + 0x14]
mov ecx, edi
call fcn.0054a040
test al, al
je 0x54aeee
push 0
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, esi
mov ecx, edi
call fcn.0054a680
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x54af2c
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0xf8], 0xffffffff
mov dword [edi + 0xfc], 0xffffffff
mov dword [edi + 0x11c], 0xffffffff
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret
Function at 0x54adbb
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov ebx, edx
push edi
mov edi, ecx
cmp ebx, 0x26
je 0x54ad69
cmp ebx, 0x28
je 0x54ad69
nop
cmp ebx, 0x24
je 0x54ad69
cmp ebx, 0x23
je 0x54ad69
cmp ebx, 0x21
je 0x54ad69
cmp ebx, 0x22
je 0x54ad69
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret
mov eax, dword [edi + 0xd4]
mov ecx, dword [eax]
test ecx, ecx
je 0x54af2c
lea eax, ds:[ebx - 0x21]
cmp eax, 7
ja case.0x54ad89.36
jmp dword [eax*4 + 0x54af44]
mov eax, dword [edi + 0x6c]
test eax, eax
je case.0x54ad89.36
mov esi, dword ds:[eax + 0x20]
test esi, esi
je case.0x54ad89.36
dec esi
jmp 0x54ae2b
mov esi, dword [edi + 0x6c]
test esi, esi
je case.0x54ad89.36
mov esi, dword [esi + 0x20]
inc esi
jmp 0x54ae1e
mov esi, dword ds:[edi + 0x6c]
test esi, esi
je 0x54adc9
mov esi, dword [esi + 0x20]
jmp 0x54adcb
xor esi, esi
test byte [edi + 0x20], 8
je 0x54add6
mov edx, dword [edi + 0x54]
jmp 0x54add8
xor edx, edx
mov eax, dword [edi + 0x44]
sub eax, dword [edi + 0x48]
sub eax, edx
js 0x54af2c
cdq
idiv dword [edi + 0x4c]
sub eax, 1
js 0x54af2c
mov edx, dword [edi + 0x58]
cmp ebx, 0x21
jne 0x54ae0b
cmp esi, edx
jbe 0x54ae03
mov esi, edx
jmp 0x54ae2b
cmp esi, eax
jb case.0x54ad89.36
sub esi, eax
jmp 0x54ae2b
add edx, eax
cmp edx, ecx
jb 0x54ae14
lea edx, [ecx - 1]
cmp esi, edx
jae 0x54ae1c
mov esi, edx
jmp 0x54ae2b
add esi, eax
nop
cmp esi, ecx
jb 0x54ae2b
lea esi, [ecx - 1]
jmp 0x54ae2b
xor esi, esi
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
push 0x10
mov word [esp + 0x10], ax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword ds:[edi + 0xd4]
mov bx, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + esi*4]
mov ecx, edi
mov dword [edi + 0x6c], edx
call fcn.0054a4a0
shr bx, 0xf
test bl, bl
je 0x54ae9d
mov eax, dword [edi + 0x74]
cmp eax, 0xffffffff
je 0x54ae9d
cmp esi, eax
jbe 0x54ae8c
lea ecx, [esp + 0xc]
mov edx, eax
push ecx
lea ecx, [esp + 0x14]
mov eax, esi
push ecx
push 4
push eax
jmp 0x54aebc
lea ecx, [esp + 0xc]
mov edx, esi
push ecx
lea ecx, [esp + 0x14]
push ecx
push 4
push eax
jmp 0x54aebc
cmp byte [esp + 0xc], 0
jne 0x54aeee
mov eax, dword [edi + 0x6c]
mov edx, esi
mov eax, dword [eax + 0x20]
mov dword [edi + 0x74], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push 4
push esi
mov ecx, edi
call fcn.0054a320
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 1
push dword [esp + 0x14]
mov ecx, edi
call fcn.0054a040
test al, al
je 0x54aeee
push 0
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, esi
mov ecx, edi
call fcn.0054a680
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x54af2c
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0xf8], 0xffffffff
mov dword [edi + 0xfc], 0xffffffff
mov dword [edi + 0x11c], 0xffffffff
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret
Function at 0x54f760
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
call fcn.0054f600
test eax, eax
jne 0x54f77f
mov eax, 0x8007007f
pop edi
pop esi
pop ebx
add esp, 0x10
ret
cmp dword [0x62db64], 0x3e
lea ecx, [esp + 0xc]
mov esi, dword [eax]
push 0
push 0
push 0
push ecx
push ebx
push eax
jae 0x54f79c
mov esi, dword [esi + 0x14]
jmp 0x54f79f
mov esi, dword [esi + 0x18]
mov ecx, esi
call dword [0x5a9914]
call esi
mov esi, eax
test esi, esi
jne 0x54f817
mov eax, dword fs:[0x18]
push dword [esp + 0xc]
push esi
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlSizeHeap]
cmp eax, 2
jbe 0x54f7fb
mov ecx, dword [esp + 0xc]
add eax, 0xfffffffe
push esi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push esi
push eax
mov dword [esp + 0x20], ecx
call sym.SystemInformer.exe_Ordinal_1331
mov dword [edi], eax
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
xor eax, eax
mov esi, 0x8000ffff
mov dword [edi], eax
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov dword [edi], 0
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x567e00
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
movzx eax, word [ecx]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, edx
push esi
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
nop word [eax + eax]
movzx eax, ax
xor edx, edx
movzx eax, byte [eax + 0x5f7690]
lea ecx, [ecx + eax*2]
call fcn.00563560
mov esi, eax
movzx eax, word [esi]
cmp eax, 0x8a
jne 0x567ebd
movzx eax, word [esi + 4]
add esi, 4
cmp eax, 0x76
jne 0x567e58
add esi, 8
jmp 0x567e66
mov ecx, eax
cmp eax, 0x77
jne 0x567e69
movzx eax, word [esi + 6]
lea esi, [esi + eax*2]
movzx ecx, word [esi]
movzx eax, cx
add eax, 0xffffff70
cmp eax, 0x12
ja case.0x567e80.145
movzx eax, byte [eax + 0x568020]
nop dword [eax]
jmp dword [eax*4 + 0x568018]
push 1
push ebp
push edi
mov edx, ebx
mov ecx, esi
call fcn.00567e00
test eax, eax
je case.0x567e80.144
nop dword [eax]
movzx eax, word [esi + 2]
cmp word [esi + eax*2], 0x78
lea esi, [esi + eax*2]
je 0x567ea0
lea ecx, [esi + 4]
xor edx, edx
call fcn.00563560
mov esi, eax
movzx eax, word [esi]
nop dword [eax]
cmp eax, 0x86
je 0x567fd1
cmp eax, 0x87
je 0x567fd1
nop word [eax + eax]
cmp eax, 0x8b
je 0x567fd1
cmp eax, 0x8c
je 0x567fd1
nop word [eax + eax]
cmp eax, 0x88
je 0x567fb5
cmp eax, 0x89
je 0x567fb5
nop word [eax + eax]
cmp eax, 0x8d
je 0x567fb5
cmp eax, 0x8e
je 0x567fb5
cmp eax, 0x7e
je 0x567fb1
nop dword [eax + eax]
cmp eax, 0x82
je 0x567fb1
cmp eax, 0x84
jne 0x567f5b
push dword [esp + 0x20]
lea eax, [ebp + 1]
push eax
jmp 0x567fd6
nop dword [eax + eax]
cmp eax, 0x55
je 0x567f83
cmp eax, 0x56
je 0x567f83
cmp eax, 0x5e
je 0x567f83
cmp eax, 0x1b
je 0x567fe9
cmp eax, 0x1c
je 0x567fe9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
cmp word [esi + 2], 0xc
jne case.0x567e80.144
test dword [edi + 0x8c], ebx
jne case.0x567e80.144
test ebp, ebp
jg case.0x567e80.144
cmp dword [edi + 0xb4], 0
jne case.0x567e80.144
cmp dword [esp + 0x20], 0
jne case.0x567e80.144
test dword [edi + 0x6c], 0x8000
jne case.0x567e80.144
jmp 0x567fe9
push 1
jmp 0x567fd5
movzx ecx, word [esi + 4]
mov eax, 1
push dword [esp + 0x20]
mov edx, eax
shl edx, cl
cmp ecx, 0x20
push ebp
cmovae edx, eax
or edx, ebx
jmp 0x567fd8
push dword [esp + 0x20]
push ebp
mov edx, ebx
push edi
mov ecx, esi
call fcn.00567e00
test eax, eax
je case.0x567e80.144
mov ecx, dword [esp + 0x10]
movzx eax, word [ecx + 2]
cmp word [ecx + eax*2], 0x78
lea ecx, [ecx + eax*2]
mov dword [esp + 0x10], ecx
jne 0x568009
mov eax, 0x78
jmp 0x567e20
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0xc
Function at 0x56d4e0
Capabilities:
Initialize winhttp library

Disassembly:
sub esp, 0xc
push esi
push 0xc
push 4
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
cmp dword [0x62db64], 0x3f
mov esi, eax
push 0
sbb ecx, ecx
xorps xmm0, xmm0
push 0
and ecx, 0xfffffffc
movq qword [esi], xmm0
push 0
add ecx, 4
mov dword [esi + 8], 0
push ecx
push dword [esp + 0x28]
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi], eax
test eax, eax
jne 0x56d543
push esi
push eax
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
pop esi
add esp, 0xc
ret 8
cmp dword [0x62db64], 0x3f
lea ecx, [esp + 4]
push 4
push ecx
push 0x54
push eax
jae 0x56d575
mov dword ds:[esp + 0x14], 0xa00
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [esp + 0x14]
mov dword [eax], esi
mov al, 1
pop esi
add esp, 0xc
ret 8
mov dword ds:[esp + 0x14], 0x2800
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 3
push eax
push 0x76
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x62db64]
cmp eax, 0x64
jb 0x56d5cb
push 4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0x85
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x62db64]
cmp eax, 0x72
jb 0x56d611
push 4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0xc3
ret
add byte [eax], al
add bh, bh
call dword ss:[sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x62db64], 0x72
jb 0x56d611
push 4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0x9a
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword ds:[esp + 0x14]
mov dword [eax], esi
mov al, 1
pop esi
add esp, 0xc
ret 8

Function at 0x56d750
Capabilities:
Prepare http request

Disassembly:
push ecx
mov edx, dword [esp + 0x14]
and edx, 1
shl edx, 0x17
push esi
mov esi, dword [esp + 0xc]
mov eax, edx
or eax, 0x100
test byte [esp + 0x18], 2
cmove eax, edx
push eax
push 0
push 0
push 0
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 8], eax
pop esi
test eax, eax
jne 0x56d795
xor al, al
pop ecx
ret 0x10
push 4
lea ecx, [esp + 4]
mov dword [esp + 4], 8
push ecx
push 0x3f
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov al, 1
pop ecx
ret 0x10

Function at 0x56d8a0
Capabilities:
Set http header

Disassembly:
mov eax, dword ds:[esp + 0xc]
or ecx, 0xffffffff
test eax, eax
push 0xa0000000
cmovne ecx, eax
mov eax, dword [esp + 8]
push ecx
push dword [esp + 0x10]
push dword [eax + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
setne al
ret 0xc
Function at 0x56d8e0
Capabilities:
Read http header

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 8]
push 0
push eax
push 0
push 0
push 0x16
push dword [edi + 8]
mov dword [esp + 0x20], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x56d916
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x56d965
mov eax, dword [esp + 8]
push 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x1c], 0
call sym.SystemInformer.exe_Ordinal_1331
push 0
mov esi, eax
lea eax, [esp + 0xc]
push eax
push dword [esi + 4]
push 0
push 0x16
push dword [edi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x56d96f
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x56d965
nop
call fcn.004fe1e0
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret 4
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret 4

Function at 0x56d980
Capabilities:
Read http header

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 8]
push 0
push eax
push 0
push dword [esp + 0x28]
mov dword [esp + 0x18], 0
push 0xffff
push dword [edi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x56d9bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x56da0e
mov eax, dword [esp + 8]
push 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x1c], 0
call sym.SystemInformer.exe_Ordinal_1331
push 0
mov esi, eax
lea eax, [esp + 0xc]
push eax
push dword [esi + 4]
push dword [esp + 0x28]
push 0xffff
push dword [edi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x56da18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x56da0e
call fcn.004fe1e0
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret 8
push dword ds:[esi + 4]
call sym.SystemInformer.exe_Ordinal_1322
add eax, eax
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x56daa0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x218], eax
mov edx, dword [ebp + 0xc]
lea eax, [esp]
push ebx
push esi
mov esi, dword [ebp + 8]
and dl, 1
push edi
mov edi, dword [ebp + 0x10]
push 0
push eax
movzx ecx, dl
lea eax, [esp + 0x28]
neg ecx
mov dword [esp + 0x14], 0x100
push eax
sbb ecx, ecx
and ecx, 5
mov eax, ecx
or eax, 0x13
test byte [ebp + 0xc], 2
push 0
cmove eax, ecx
push eax
push dword [esi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
nop
test eax, eax
je 0x56db8d
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x20]
xor bl, bl
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x56db44
mov dx, word [esp + 0x20]
cmp dx, 0x2d
je 0x56db2f
cmp dx, 0x2b
jne 0x56db44
add eax, 2
sub ecx, 2
cmp dx, 0x2d
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
sete bl
lea eax, [esp + 0x18]
mov edx, 0xa
push eax
lea ecx, [esp + 0x14]
call fcn.00503850
mov edx, dword ds:[esp + 0x18]
mov ecx, dword [esp + 0x1c]
test bl, bl
je 0x56db6b
neg edx
adc ecx, 0
neg ecx
test al, al
je 0x56db8d
mov dword [edi], edx
mov al, 1
mov dword [edi + 4], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword ds:[esp + 0x224]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x56dcc0
Capabilities:
Receive http response

Disassembly:
mov eax, 0x1010
call fcn.005a5430
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [esp + 0x1018]
push ebx
push ebp
mov ebp, dword [esp + 0x101c]
push esi
push edi
mov edi, 0x1000
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x102c]
push edi
push 4
push dword [0x633a54]
mov dword [esp + 0x24], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
push edi
lea eax, [esp + 0x24]
push eax
push ebp
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x56dddc
nop
mov eax, dword [esp + 0x10]
test eax, eax
je 0x56ddb7
add eax, ebx
cmp edi, eax
jae 0x56dd80
nop
add edi, edi
jne 0x56dd5a
test esi, esi
je 0x56dd56
push esi
push edi
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor esi, esi
jmp 0x56dd80
push edi
test esi, esi
je 0x56dd70
push esi
push 4
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
jmp 0x56dd7e
push 4
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
push dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
lea eax, [ebx + esi]
push eax
call fcn.00586330
add ebx, dword [esp + 0x1c]
lea eax, [esp + 0x1c]
add esp, 0xc
push eax
push 0x1000
lea eax, [esp + 0x24]
push eax
push ebp
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x56dd30
lea eax, [ebx + 1]
cmp edi, eax
jae 0x56dddc
nop
add edi, 1
jne 0x56ddf6
test esi, esi
je 0x56ddda
push esi
push edi
lfence
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor esi, esi
mov edi, dword [0x633a54]
mov byte [ebx + esi], 0
test ebx, ebx
je 0x56de37
mov eax, dword [esp + 0x14]
test eax, eax
je 0x56de1f
mov dword [eax], esi
jmp 0x56de29
lfence
push edi
mov edi, dword [0x633a54]
test esi, esi
je 0x56de12
push esi
push 4
push edi
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov esi, eax
jmp 0x56dde2
push 4
push edi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
jmp 0x56dde2
push esi
push 0
push edi
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x56de33
mov dword [eax], ebx
mov al, 1
jmp 0x56de48
push esi
push 0
push edi
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
mov ecx, dword [esp + 0x101c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x1010
ret 0xc
Function at 0x56e1c0
Capabilities:
Initialize winhttp library
Reference cloudflare dns server

Disassembly:
sub esp, 0x1c
test byte [0x6312ac], 1
push esi
push edi
mov esi, ecx
mov edi, str.1.1.1.1
jne 0x56e357
push ebx
mov ebx, 0x6312ac
lock bts dword [ebx], 0x1f
setb al
test al, al
je 0x56e20a
test byte [0x6312ac], 1
jne 0x56e356
xor edx, edx
mov ecx, ebx
call sym.SystemInformer.exe_Ordinal_1388
jmp 0x56e356
cmp dword [0x62db64], 0x3f
push 0
sbb eax, eax
push 0
and eax, 0xfffffffc
push 0
add eax, 4
push eax
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [0x635fe4], eax
test eax, eax
je 0x56e34f
cmp dword [0x62db64], 0x3f
push 4
jae 0x56e257
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0xa00
push ecx
push 0x54
push eax
jmp 0x56e301
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x2800
push ecx
push 0x54
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 3
push eax
push 0x76
push dword [0x635fe4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x62db64]
cmp eax, 0x64
jb 0x56e2b9
push 4
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 1
push eax
push 0x85
push dword [0x635fe4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x62db64]
cmp eax, 0x72
jb 0x56e307
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 1
push eax
push 0xc3
push dword [0x635fe4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x62db64], 0x72
jb 0x56e307
push 4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 1
push eax
push 0x9a
push dword [0x635fe4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 1
push eax
push 0x49
push dword [0x635fe4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x62db64], 0x64
jb 0x56e34f
push 0
test esi, esi
mov eax, edi
push 0x1bb
cmovne eax, esi
push eax
push dword [0x635fe4]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [0x635fe8], eax
mov ecx, ebx
call sym.SystemInformer.exe_Ordinal_1358
pop ebx
cmp dword [0x62db64], 0x64
nop
jae 0x56e386
push 0
test esi, esi
push 0x1bb
cmovne edi, esi
push edi
push dword [0x635fe4]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
pop edi
mov dword [0x635fe8], eax
pop esi
add esp, 0x1c
ret
mov eax, dword [0x635fe8]
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x575300
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x4c
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
mov ebp, ecx
mov ebx, edx
push edi
mov eax, 0x38
mov esi, 0x78
mov edi, dword [ebp + 0x30]
mov edx, edi
and edx, 0x3f
sub eax, edx
sub esi, edx
cmp edx, 0x38
cmovb esi, eax
lea eax, [esi - 1]
push eax
lea eax, [esp + 0x15]
push 0
push eax
call fcn.005861d0
mov eax, dword [ebp + 0x2c]
lea edx, [esp + 0x1c]
shl eax, 3
mov ecx, edi
shr ecx, 0x1d
add esp, 0xc
or ecx, eax
mov byte [esp + 0x10], 0x80
lea eax, [edi*8]
bswap eax
bswap ecx
mov dword [esp + esi + 0x14], eax
lea eax, [esi + 8]
mov dword [esp + esi + 0x10], ecx
mov ecx, ebp
push eax
call fcn.00575260
mov ecx, dword [ebp + 0x18]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebx], edx
mov ecx, dword [ebp + 0x1c]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebx + 4], edx
mov ecx, dword [ebp + 0x20]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebx + 8], edx
mov ecx, dword [ebp + 0x24]
mov edx, ecx
mov eax, ecx
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebx + 0xc], edx
mov ecx, dword [ebp + 0x28]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
and ecx, 0xff00
shl eax, 0x10
or eax, ecx
shr edx, 8
mov ecx, dword [esp + 0x58]
shl eax, 8
pop edi
or edx, eax
mov dword [ebx + 0x10], edx
pop esi
mov dword [ebp + 0x18], 0x67452301
mov dword [ebp + 0x1c], 0xefcdab89
mov dword [ebp + 0x20], 0x98badcfe
mov dword [ebp + 0x24], 0x10325476
mov dword [ebp + 0x28], 0xc3d2e1f0
mov dword [ebp + 0x2c], 0
mov dword [ebp + 0x30], 0
pop ebp
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x4c
ret
Function at 0x5766e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x5766fd
xorps xmm3, xmm3
mov eax, 6
cvtss2sd xmm3, xmm2
mov dword [esp + 4], eax
jmp fcn.005758e0
nop dword [eax]
cmp eax, 0x3b9aca00
jge 0x576717
xorps xmm3, xmm3
cvtss2sd xmm3, xmm2
mov dword [esp + 4], eax
jmp fcn.005758e0
mov ecx, 0x84
mov eax, edx
mov edx, ecx
ret 4

Function at 0x576b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x576b96
mov eax, 6
mov dword [esp + 4], eax
jmp fcn.005758e0
cmp eax, 0x3b9aca00
jge 0x576ba6
mov dword [esp + 4], eax
jmp fcn.005758e0
mov ecx, 0x84
mov eax, edx
mov edx, ecx
ret 4
Function at 0x57c420
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
push edi
test esi, esi
je 0x57c46a
push 0
push 0
push 0x2000
lea edi, [esi + 0xc]
push edi
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
js 0x57c46a
mov eax, dword [esp + 0xc]
test eax, eax
je 0x57c46a
add eax, 0xc
mov dword [esi + 4], edi
add eax, esi
mov dword [esi + 8], eax
xor eax, eax
pop edi
pop esi
add esp, 0xc
ret
pop edi
or eax, 0xffffffff
pop esi
add esp, 0xc
ret