joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d809c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5d8132
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x668178]
cmp dword [eax], 2
jne 0x5d80dc
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
jmp 0x5d8114
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040a3b8
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040a0b0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040a248
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d8139
lea eax, [ebp - 8]
call fcn.0040993c
lea eax, [ebp - 4]
call fcn.00409918
ret

Function at 0x5d8564
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040a694
mov edx, eax
mov eax, ebx
call fcn.005d7f0c
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.005d7fe4
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x5d85d6
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040a694
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x5d97e8
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x5d9800
add esp, 0xfffffff0
call fcn.004080a0
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x5d98e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 8], 0
lea eax, [ebx + 0x10]
mov edx, esi
call fcn.00409cd4
test esi, esi
jne 0x5d9852
xor eax, eax
mov dword [ebx + 0xc], eax
push 0
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5d8e9c]
call fcn.005d9680
mov dword [ebx + 4], eax
mov eax, 0x10
call fcn.00406a34
mov dword [ebx + 0x14], eax
jmp 0x5d98c0
push 0
push 0
lea eax, [ebp - 8]
mov ecx, esi
mov edx, 0x5d991c
call fcn.0040a900
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5d8e9c]
call fcn.005d9680
mov edi, eax
mov dword [ebx + 4], edi
movzx eax, byte [edi + 4]
mov byte [ebx + 8], al
lea eax, [ebp - 0xc]
mov ecx, esi
mov edx, 0x5d9944
call fcn.0040a900
mov eax, dword [ebp - 0xc]
call fcn.0040a694
push eax
push 0x10
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingW
mov edi, eax
mov dword [ebx + 0xc], edi
push 0
push 0
push 0
push 2
push edi
call sub.kernel32.dll_MapViewOfFile
mov dword [ebx + 0x14], eax
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.005d9a68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d98ec
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00409954
ret
Function at 0x5daa94
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
test dl, dl
je 0x5daaa9
add esp, 0xfffffff0
call fcn.004080a0
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 0x10]
xor edx, edx
mov eax, ebx
call fcn.00407a04
test edi, edi
jne 0x5daad7
mov ecx, dword [0x667998]
mov dl, 1
mov eax, dword [0x5da9d4]
call fcn.005d4ad8
call fcn.00408f74
mov eax, edi
mov dword [ebx + 0x10], eax
cmp byte [eax + 0x10], 1
sete dl
lea eax, [ebp + 8]
call fcn.005d5d88
push dword [ebp + 0xc]
push dword [ebp + 8]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.005d445c
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x18], eax
push esi
push eax
mov eax, dword [ebx + 0x14]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5dab3e
mov ecx, dword [0x667fe0]
mov dl, 1
mov eax, dword [0x5da9d4]
call fcn.005d4ad8
call fcn.00408f74
test esi, esi
jne 0x5dab85
mov eax, edi
mov edx, dword [0x65dc14]
call fcn.00407d04
test al, al
je 0x5dab85
push 0
mov eax, dword [edi + 0x18]
push eax
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
jne 0x5dab85
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov ecx, dword [0x667e74]
mov dl, 1
mov eax, dword [0x5da9d4]
call fcn.005d4ad8
call fcn.00408f74
mov ecx, esi
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b3e50
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x14]
mov edx, ebx
call fcn.004aca84
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5dabb5
call fcn.004080f8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5dabc0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
test dl, dl
je 0x5dabd5
add esp, 0xfffffff0
call fcn.004080a0
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 0x14]
xor edx, edx
mov eax, ebx
call fcn.00407a04
test edi, edi
jne 0x5dac03
mov ecx, dword [0x667998]
mov dl, 1
mov eax, dword [0x5da9d4]
call fcn.005d4ad8
call fcn.00408f74
mov eax, edi
mov dword [ebx + 0x10], eax
cmp byte [eax + 0x10], 1
sete dl
lea eax, [ebp + 0xc]
call fcn.005d5d88
mov eax, dword [ebx + 0x10]
cmp byte [eax + 0x10], 1
sete dl
lea eax, [ebp + 8]
call fcn.005d5e08
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.005d445c
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x18], eax
mov edx, dword [ebp + 8]
push edx
push esi
push eax
mov eax, dword [ebx + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_MapViewOfFileEx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5dac80
mov ecx, dword [0x667fe0]
mov dl, 1
mov eax, dword [0x5da9d4]
call fcn.005d4ad8
call fcn.00408f74
test esi, esi
jne 0x5dacc7
mov eax, edi
mov edx, dword [0x65dc14]
call fcn.00407d04
test al, al
je 0x5dacc7
push 0
mov eax, dword [edi + 0x18]
push eax
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
jne 0x5dacc7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov ecx, dword [0x667e74]
mov dl, 1
mov eax, dword [0x5da9d4]
call fcn.005d4ad8
call fcn.00408f74
mov ecx, esi
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b3e50
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x14]
mov edx, ebx
call fcn.004aca84
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5dacf7
call fcn.004080f8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x5db1f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5db2a6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040a694
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x5db290
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040a828
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040a694
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x5db290
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5db2b8
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x5db290
cmp dword [ebp - 0xc], 0x34
jne 0x5db290
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5db2ad
lea eax, [ebp - 4]
call fcn.004098f4
ret

Function at 0x5dc1c0
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], edx
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x5dc104
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x5dd0a8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.0040a694
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x18]
push eax
push 0x5dcfc4
call sub.user32.dll_EnumWindows
cmp eax, 1
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5e09cc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x5e09e4
add esp, 0xfffffff0
call fcn.004080a0
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x5e0afe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00406a34
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x5e0ae8
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.00513f04
xor eax, eax
push ebp
push 0x5e0ad5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00513f04
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.0040a78c
jmp 0x5e0aa6
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.0040ab18
mov eax, dword [ebx + 4]
call fcn.00409de4
dec eax
jle 0x5e0aba
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x5e0a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e0adc
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e0b05
lea eax, [ebp - 4]
call fcn.0040993c
ret

Function at 0x5f0a14
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, eax
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
mov eax, ebx
call fcn.0040a694
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5f0a83
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x18]
call fcn.0042778c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle_1
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5fb6f4
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x5fb713
call sub.wsock32.dll_WSAGetLastError
call fcn.005f7f40
add esp, 0x190
ret
Function at 0x5fb724
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5fb84d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov esi, 1
test edx, edx
je 0x5fb762
inc esi
push 0x4bf
push edi
push 0
lea eax, [ebp - 0x10]
push eax
push esi
call sub.user32.dll_MsgWaitForMultipleObjects
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5fb78a
call sub.wsock32.dll_WSAGetLastError
call fcn.005f7f40
jmp 0x5fb82b
cmp ebx, 0x102
jne 0x5fb7ac
lea edx, [ebp - 0x30]
mov eax, dword [0x667fa0]
call fcn.0040da80
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.005f7f98
jmp 0x5fb82b
cmp ebx, esi
jne 0x5fb82b
jmp 0x5fb7ed
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_DispatchMessageW
cmp edi, 0xffffffff
je 0x5fb7ed
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp edi, eax
jge 0x5fb7ed
lea edx, [ebp - 0x34]
mov eax, dword [0x667fa0]
call fcn.0040da80
mov eax, dword [ebp - 0x34]
or edx, 0xffffffff
call fcn.005f7f98
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_PeekMessageW
test eax, eax
jne 0x5fb7b2
cmp edi, 0xffffffff
je 0x5fb82b
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp edi, eax
jge 0x5fb82b
lea edx, [ebp - 0x38]
mov eax, dword [0x667fa0]
call fcn.0040da80
mov eax, dword [ebp - 0x38]
or edx, 0xffffffff
call fcn.005f7f98
test ebx, ebx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fb854
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00409954
ret
Function at 0x5fc8f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
lea edi, [ebp - 0x24]
mov eax, esi
call fcn.005fc9dc
cmp dword [eax + 0xc], 0
jle 0x5fc9d3
mov eax, esi
call fcn.005fc9dc
push dword [eax + 0xc]
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
imul eax, eax, 0x3e8
pop edx
mov ecx, edx
cdq
idiv ecx
mov ebx, eax
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x5fc9cc
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi + 8]
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
push 0x4bf
push ebx
push 0
lea eax, [ebp - 4]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
sub eax, 1
jb 0x5fc9b5
je 0x5fc996
sub eax, 0x101
jne 0x5fc95c
jmp 0x5fc9b5
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageW
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp ebx, eax
jl 0x5fc9a8
push 1
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageW
test eax, eax
jne 0x5fc97f
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp ebx, eax
jl 0x5fc9b5
jmp 0x5fc95c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fc9d3
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetLastError
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x600cdc
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
cmp dword [0x666b64], 0
jne 0x600cf7
push esp
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [esp + 0x1c]
mov dword [0x666b64], eax
mov eax, dword [0x666b64]
add esp, 0x24
ret

Function at 0x6069e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x606ab9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004098f4
push 0
push 0
push 0x20000003
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0xc]
add edx, 0x30
push edx
mov eax, dword [eax]
push eax
call fcn.005f70a8
mov esi, eax
cmp esi, 1
jl 0x606aa3
mov ecx, esi
add ecx, ecx
mov dl, 1
mov eax, dword [0x5ffd08]
call fcn.005efbb8
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x606a9c
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
push edx
push 0x20000003
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0xc]
add edx, 0x30
push edx
mov eax, dword [eax]
push eax
call fcn.005f70a8
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005f0268
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040a78c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x606aa3
mov eax, dword [ebp - 4]
call fcn.00407a34
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x606ac0
lea eax, [ebp - 8]
call fcn.0040993c
ret
Function at 0x61b7a8
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x61b8d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov eax, ebx
call fcn.0061b6cc
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x20000013
mov eax, dword [esi + 0x18]
push eax
call fcn.005ec3d4
test eax, eax
je 0x61b892
mov eax, ebx
call fcn.0061afcc
lea ecx, [ebp - 0x10]
mov edx, esi
mov eax, ebx
call fcn.0061b630
mov eax, dword [ebp - 0x10]
push eax
mov eax, ebx
call fcn.0061c3d0
mov edx, dword [ebp - 4]
pop ecx
call fcn.005f290c
mov eax, ebx
call fcn.0061c3d0
cmp dword [eax + 0x24], 0x190
jl 0x61b8ad
mov eax, ebx
call fcn.0061c3d0
mov eax, dword [eax + 0x24]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x667bac]
call fcn.0040da80
mov eax, dword [ebp - 0x18]
push eax
mov eax, ebx
call fcn.0061c3d0
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
pop eax
call fcn.00425c60
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x5f21c8]
call fcn.005f2bd0
call fcn.00408f74
jmp 0x61b8ad
push 0
lea edx, [ebp - 0x24]
mov eax, dword [0x667ab8]
call fcn.0040da80
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, ebx
call fcn.0061aef8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61b8d7
lea eax, [ebp - 0x24]
call fcn.004098f4
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00409954
ret

Function at 0x6384b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x638553
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jg 0x6384e8
mov ecx, 0x2a2
mov edx, 0x63856c
mov eax, 0x63860c
call fcn.00409740
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4046e8]
call fcn.0040bc60
add esp, 4
mov edx, dword [ebp - 4]
mov ecx, ebx
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0xc]
push ebx
push 0x63863c
lea eax, [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x5ec4d8]
call fcn.005ed620
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63855a
lea eax, [ebp - 0xc]
call fcn.004098f4
lea eax, [ebp - 4]
mov edx, dword [0x4046e8]
call fcn.0040bd84
ret
Function at 0x6386f4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x6389ca
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4046e8]
call fcn.0040bc60
add esp, 4
mov eax, dword [ebp - 4]
mov byte [eax], 0xd
mov eax, dword [ebp - 4]
mov byte [eax + 1], 0xa
mov eax, dword [ebp - 4]
mov byte [eax + 2], 0xd
mov eax, dword [ebp - 4]
mov byte [eax + 3], 0xa
push 2
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4046e8]
call fcn.0040bc60
add esp, 4
mov eax, dword [ebp - 8]
mov byte [eax], 0xa
mov eax, dword [ebp - 8]
mov byte [eax + 1], 0xa
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.004b1700
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [eax + 0xb4], edx
mov eax, dword [ebp - 0x10]
add eax, 0xb8
call fcn.004098f4
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0xa8]
mov edx, dword [ebp - 0x10]
mov byte [edx + 0xe8], al
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x40]
mov byte [eax + 0x70], 0
mov edx, dword [eax + 0x30]
mov dword [ebp - 0x30], edx
mov edx, dword [eax + 0x34]
mov dword [ebp - 0x2c], edx
push 0
push 0
push 0
push 0
call fcn.005fbb3c
mov eax, dword [ebp - 0x10]
call fcn.00629c38
cdq
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x40]
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], edx
xor eax, eax
push ebp
push 0x638829
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x638830
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0x30]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 0x34], edx
ret

Function at 0x64c0dc
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004099d8
mov eax, dword [ebp - 8]
call fcn.004099d8
xor eax, eax
push ebp
push 0x64c141
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
call fcn.0040a694
push eax
mov eax, dword [ebp - 4]
call fcn.0040a694
push eax
call sub.kernel32.dll_CopyFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64c148
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409954
ret