joyce8/EMBER2024-capa huggingface dataset:
Function at 0x538850
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f6b18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], esp
call fcn.005e330c
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.005e3626
test eax, eax
je 0x5389fb
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.005e35e8
test eax, eax
je 0x5389fb
call fcn.005c95f5
test eax, eax
je 0x5388b6
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x5388b8
xor eax, eax
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5389fb
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x5389c9
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [ebp - 0x20]
mov edi, eax
call fcn.005c3f75
mov esi, dword [ebp + 8]
mov byte [ebp - 4], 2
movsx ax, byte [edi]
test ax, ax
je 0x5389bd
cmp ax, 0x7f
jbe 0x538920
push eax
mov ecx, esi
call fcn.005c3cb7
movsx ax, byte [edi + 1]
inc edi
push eax
mov ecx, esi
call fcn.005c3cb7
inc edi
jmp 0x5388f4
cmp ax, 0x20
jae 0x53892c
cmp ax, 0xd
jne 0x538940
push eax
mov ecx, esi
call fcn.005c3cb7
push 0
mov ecx, esi
call fcn.005c3cb7
inc edi
jmp 0x5388f4
cmp ax, 9
jne 0x53891d
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x538989
push 0x1870c94
lea ecx, [ebp - 0x14]
call fcn.005c3922
lea ecx, [ebp - 0x14]
push 0
push ecx
mov byte [ebp - 4], 3
call fcn.00538b10
add esp, 8
lea edx, [ebp - 0x14]
mov ecx, esi
push edx
call fcn.005c3ccc
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.005c38b4
inc edi
jmp 0x5388f4
push 9
mov ecx, esi
call fcn.005c3cb7
push 0
mov ecx, esi
call fcn.005c3cb7
inc edi
jmp 0x5388f4
mov dword [ebp - 4], 0
call fcn.005c3fb3
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.005e3339
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.005e3339
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x538a20
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5f6b38
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.USER32.dll_OpenClipboard]
push ebx
call ebp
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 0x24]
or edi, 0xffffffff
mov eax, dword [eax - 8]
cmp eax, edi
je 0x538a6a
inc eax
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x538a8c
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], edi
call fcn.005c38b4
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0x24]
mov edi, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test edi, edi
je 0x538ab7
push ebx
call ebp
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call fcn.005c38b4
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x53d810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f73bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x28]
push esi
lea ecx, [esp + 4]
push eax
push ecx
mov dword [esp + 0x10], 0
call fcn.00541070
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x14]
push 0xa
inc eax
push edx
push eax
mov dword [esp + 0x30], 1
call fcn.004ad445
add esp, 0x14
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 8]
call fcn.005c3c90
mov esi, dword [esp + 0x24]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.005c3629
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x1c], 0
call fcn.005c38b4
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x53dd50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f74f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
xor ebx, ebx
push 0x40
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ebx
call fcn.005c3da2
cmp eax, 0xffffffff
jne 0x53ddb3
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.005c39ed
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.005c38b4
mov eax, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x20]
push ebp
push esi
xor ebp, ebp
mov eax, dword [ecx - 8]
lea esi, [eax - 1]
cmp esi, ebx
jl 0x53df07
push edi
lea edi, [esi + 1]
mov edx, dword [esp + 0x2c]
cmp byte [esi + edx], 0x40
jne 0x53de72
cmp ebp, ebx
jne 0x53de0a
sub eax, esi
lea ecx, [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
push edi
push eax
call fcn.005bf641
mov ecx, dword [esp + 0x3c]
push eax
mov byte [esp + 0x28], 1
call fcn.005c39ed
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x10]
jmp 0x53de6a
cmp ebp, 1
jne 0x53de3b
sub eax, esi
lea ecx, [esp + 0x14]
dec eax
push eax
push edi
push ecx
lea ecx, [esp + 0x38]
call fcn.005bf641
mov ecx, dword [esp + 0x38]
push eax
mov byte [esp + 0x28], 2
call fcn.005c39ed
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x14]
jmp 0x53de6a
cmp ebp, 2
jne 0x53de6f
sub eax, esi
lea edx, [esp + 0x18]
dec eax
lea ecx, [esp + 0x2c]
push eax
push edi
push edx
call fcn.005bf641
mov ecx, dword [esp + 0x34]
push eax
mov byte [esp + 0x28], 3
call fcn.005c39ed
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x18]
call fcn.005c38b4
mov eax, esi
inc ebp
dec esi
dec edi
cmp esi, ebx
jge 0x53ddcd
cmp ebp, 1
pop edi
jne 0x53deaa
push eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x30]
call fcn.005bf753
mov ecx, dword [esp + 0x34]
push eax
mov byte [esp + 0x24], 4
call fcn.005c39ed
mov byte [esp + 0x20], bl
lea ecx, [esp + 0x38]
jmp 0x53df02
cmp ebp, 2
jne 0x53ded7
lea ecx, [esp + 0x38]
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.005bf753
mov ecx, dword [esp + 0x30]
push eax
mov byte [esp + 0x24], 5
call fcn.005c39ed
mov byte [esp + 0x20], bl
lea ecx, [esp + 0x38]
jmp 0x53df02
cmp ebp, 3
jne 0x53df07
lea edx, [esp + 0x38]
push eax
push edx
lea ecx, [esp + 0x30]
call fcn.005bf753
mov ecx, dword [esp + 0x2c]
push eax
mov byte [esp + 0x24], 6
call fcn.005c39ed
mov byte [esp + 0x20], bl
lea ecx, [esp + 0x38]
call fcn.005c38b4
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.005c38b4
mov ecx, dword [esp + 0x18]
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x53df30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5f7528
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
push 0x3a
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0
call fcn.005c3da2
mov esi, eax
lea eax, [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x34]
call fcn.005bf753
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0xc]
mov byte [esp + 0x24], 1
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x2c]
sub eax, esi
dec eax
push eax
push edx
call fcn.005bf6d7
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
mov byte [esp + 0x2c], 2
call fcn.005c3629
lea ecx, [esp + 0x18]
push ecx
call fcn.0053d6d0
mov esi, dword [eax]
mov edi, dword [eax + 4]
add esp, 4
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.005c3629
lea eax, [esp + 0x18]
push eax
call fcn.0053d6d0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add esp, 8
cmp esi, ecx
mov edx, esi
jl 0x53dfdf
mov edx, ecx
mov ebp, dword [esp + 0x30]
cmp edi, eax
mov dword [ebp], edx
mov edx, edi
jl 0x53dfee
mov edx, eax
cmp esi, ecx
mov dword [ebp + 4], edx
jle 0x53dff7
mov ecx, esi
mov edx, dword [esp + 0x34]
cmp edi, eax
mov dword [edx], ecx
jle 0x53e003
mov eax, edi
lea ecx, [esp + 0xc]
mov dword [edx + 4], eax
mov byte [esp + 0x24], 1
call fcn.005c38b4
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 0
call fcn.005c38b4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.005c38b4
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x1c
ret
Function at 0x5428f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f7c27
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x186be60]
push ebx
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
mov dword [esp + 0x28], ebx
call fcn.005c0a2c
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.005c0a3f
mov eax, dword [eax + 0x14]
add eax, 0x76c
push eax
lea eax, [esp + 0x10]
push 0x1809ee4
push eax
call fcn.005bfb73
mov ecx, dword [esp + 0x3c]
add esp, 0xc
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.005c3629
lea eax, [esp + 0x38]
push eax
call fcn.0053d9a0
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.005c39ed
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.005c38b4
mov ecx, dword [0x186be60]
mov dword [esp + 8], ecx
push 0xa2ea
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.005ca3ac
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.005c3ae3
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.005c39ed
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call fcn.005c38b4
mov esi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.005c3629
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x24], bl
call fcn.005c38b4
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.005c38b4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x542a30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f7c77
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x186be60]
push ebx
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
mov dword [esp + 0x28], ebx
call fcn.005c0a2c
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.005c0a3f
mov eax, dword [eax + 0x10]
inc eax
push eax
lea eax, [esp + 0x10]
push 0x1809ee4
push eax
call fcn.005bfb73
mov ecx, dword [esp + 0x3c]
add esp, 0xc
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.005c3629
lea eax, [esp + 0x38]
push eax
call fcn.0053b7a0
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.005c39ed
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.005c38b4
mov ecx, dword [0x186be60]
mov dword [esp + 8], ecx
push 0xa2eb
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.005ca3ac
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.005c3ae3
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.005c39ed
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call fcn.005c38b4
mov esi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.005c3629
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x24], bl
call fcn.005c38b4
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.005c38b4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x542b70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f7cc7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x186be60]
push ebx
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
mov dword [esp + 0x28], ebx
call fcn.005c0a2c
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.005c0a3f
mov eax, dword [eax + 0xc]
push eax
lea eax, [esp + 0x10]
push 0x1809ee4
push eax
call fcn.005bfb73
mov ecx, dword [esp + 0x3c]
add esp, 0xc
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.005c3629
lea eax, [esp + 0x38]
push eax
call fcn.0053b7a0
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.005c39ed
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.005c38b4
mov ecx, dword [0x186be60]
mov dword [esp + 8], ecx
push 0xa2ec
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.005ca3ac
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.005c3ae3
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.005c39ed
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call fcn.005c38b4
mov esi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.005c3629
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x24], bl
call fcn.005c38b4
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.005c38b4
mov ecx, dword [esp + 0x1c]
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x54ef40
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5f8e01
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x418
push ebx
push esi
push 0x1807b98
mov ecx, 0x18c98cc
mov dword [esp + 0x1c], 0
call fcn.005c3a3d
mov esi, dword [esp + 0x434]
lea ecx, [esp + 8]
push esi
call fcn.005c3922
lea eax, [esp + 0xc]
mov ebx, 1
push 7
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x430], ebx
call fcn.005bf753
lea ecx, [esp + 0xc]
mov byte [esp + 0x428], 2
call fcn.005c3dfd
mov ecx, dword [esp + 0xc]
push str.HTTP:__
push ecx
call fcn.004acd54
add esp, 8
test eax, eax
je 0x54eff3
push 0x1871980
mov ecx, 0x18c98cc
call fcn.005c3a3d
mov esi, dword [esp + 0x430]
push 0x1807b98
mov ecx, esi
call fcn.005c3922
mov dword [esp + 0x18], ebx
jmp 0x54f162
push 0x2f
lea ecx, [esp + 0xc]
call fcn.005bf7cb
mov edx, dword [esp + 8]
mov ecx, dword [edx - 8]
sub ecx, eax
lea eax, [esp + 0x10]
dec ecx
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.005bf6d7
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x428], 3
mov eax, dword [ecx - 8]
test eax, eax
jne 0x54f055
push 0x186ff8c
mov ecx, 0x18c98cc
call fcn.005c3a3d
mov esi, dword [esp + 0x430]
push 0x1807b98
mov ecx, esi
call fcn.005c3922
mov dword [esp + 0x18], ebx
jmp 0x54f151
lea edx, [esp + 0x20]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x54f085
mov esi, dword [esp + 0x430]
push 0x1807b98
mov ecx, esi
call fcn.005c3922
mov dword [esp + 0x18], ebx
jmp 0x54f151
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
push eax
call fcn.005c3922
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 4
push ecx
lea ecx, [esp + 0x18]
call fcn.005c3ccc
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.005da1b6
mov ecx, dword [eax + 4]
call fcn.005c934a
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push esi
push ecx
call fcn.0054ecf0
add esp, 0xc
mov byte [esp + 0x428], 5
call fcn.005da1b6
mov ecx, dword [eax + 4]
call fcn.005c935f
mov edx, dword [esp + 0x1c]
mov eax, dword [edx - 8]
test eax, eax
je 0x54f118
lea eax, [esp + 0x1c]
mov ecx, 0x18c98cc
push eax
call fcn.005c39ed
mov esi, dword [esp + 0x430]
push 0x1807b98
mov ecx, esi
call fcn.005c3922
jmp 0x54f12b
mov esi, dword [esp + 0x430]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.005c3629
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov byte [esp + 0x428], 4
call fcn.005c38b4
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 3
call fcn.005c38b4
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 2
call fcn.005c38b4
lea ecx, [esp + 0xc]
mov byte [esp + 0x428], bl
call fcn.005c38b4
lea ecx, [esp + 8]
mov byte [esp + 0x428], 0
call fcn.005c38b4
mov ecx, dword [esp + 0x420]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x424
ret
Function at 0x54f350
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5f8ef7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x424
push ebx
push esi
mov dword [esp + 0x10], 0
push 0x1807b98
mov ecx, 0x18c98cc
mov dword [esp + 0x438], 4
call fcn.005c3a3d
push 0x2f
lea ecx, [esp + 0x444]
call fcn.005bf7cb
mov ecx, dword [esp + 0x440]
lea edx, [esp + 8]
mov ecx, dword [ecx - 8]
sub ecx, eax
dec ecx
push ecx
push edx
lea ecx, [esp + 0x448]
call fcn.005bf6d7
mov eax, dword [esp + 8]
mov byte [esp + 0x434], 5
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x54f3ff
push 0x186ff8c
mov ecx, 0x18c98cc
call fcn.005c3a3d
mov esi, dword [esp + 0x43c]
push 0x1807b98
mov ecx, esi
call fcn.005c3922
mov ebx, 1
mov dword [esp + 0x10], ebx
jmp 0x54f588
lea ecx, [esp + 0x2c]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x54f434
mov esi, dword [esp + 0x43c]
push 0x1807b98
mov ecx, esi
call fcn.005c3922
mov ebx, 1
mov dword [esp + 0x10], ebx
jmp 0x54f588
lea edx, [esp + 0x2c]
lea ecx, [esp + 0xc]
push edx
call fcn.005c3922
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x438], 6
call fcn.005c3ccc
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.005da1b6
mov ecx, dword [eax + 4]
call fcn.005c934a
push ecx
lea edx, [esp + 0x450]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.005c3629
push ecx
lea eax, [esp + 0x450]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x440], 7
call fcn.005c3629
push ecx
lea edx, [esp + 0x450]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x444], 8
call fcn.005c3629
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
mov byte [esp + 0x448], 9
call fcn.005c3629
push ecx
lea edx, [esp + 0x454]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
mov byte [esp + 0x44c], 0xa
call fcn.005c3629
lea eax, [esp + 0x28]
mov byte [esp + 0x448], 6
push eax
call fcn.0054f1a0
add esp, 0x18
mov byte [esp + 0x434], 0xb
call fcn.005da1b6
mov ecx, dword [eax + 4]
call fcn.005c935f
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 8]
test eax, eax
je 0x54f54a
lea edx, [esp + 0x14]
mov ecx, 0x18c98cc
push edx
call fcn.005c39ed
mov esi, dword [esp + 0x43c]
push 0x1807b98
mov ecx, esi
call fcn.005c3922
jmp 0x54f55d
mov esi, dword [esp + 0x43c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.005c3629
mov ebx, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x434], 6
call fcn.005c38b4
lea ecx, [esp + 0xc]
mov byte [esp + 0x434], 5
call fcn.005c38b4
lea ecx, [esp + 8]
mov byte [esp + 0x434], 4
call fcn.005c38b4
lea ecx, [esp + 0x440]
mov byte [esp + 0x434], 3
call fcn.005c38b4
lea ecx, [esp + 0x444]
mov byte [esp + 0x434], 2
call fcn.005c38b4
lea ecx, [esp + 0x448]
mov byte [esp + 0x434], bl
call fcn.005c38b4
lea ecx, [esp + 0x44c]
mov byte [esp + 0x434], 0
call fcn.005c38b4
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x430
ret
Function at 0x54f610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f8f67
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [esp + 0x14], 0
lea eax, [esp + 0x3c]
mov edi, 1
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], edi
call fcn.005c3629
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 2
push ecx
lea ecx, [esp + 0x10]
call fcn.005c3629
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 3
call fcn.005c3dfd
mov esi, dword [esp + 0x40]
lea edx, [esp + 0x40]
push 7
push edx
lea ecx, [esp + 0x14]
mov dword [esi], 0
call fcn.005bf753
mov eax, dword [eax]
push str.HTTP:__
push eax
call fcn.004acd54
add esp, 8
lea ecx, [esp + 0x40]
test eax, eax
sete bl
call fcn.005c38b4
test bl, bl
je 0x54f71a
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
push eax
push ecx
call fcn.0054ef40
add esp, 8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 4
call fcn.005c39ed
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], 3
call fcn.005c38b4
mov eax, dword [0x18c98cc]
push 0x1807b98
push eax
call fcn.004acd54
add esp, 8
test eax, eax
je 0x54f80b
mov edx, dword [0x18c98cc]
push 0
push 0
push edx
call fcn.005cfe2e
mov esi, dword [esp + 0x38]
push 0x1807b98
mov ecx, esi
call fcn.005c3922
mov dword [esp + 0x14], edi
jmp 0x54f821
lea eax, [esp + 0x40]
push 4
push eax
lea ecx, [esp + 0x14]
call fcn.005bf753
mov eax, dword [eax]
push str.FTP:
push eax
call fcn.004acd54
add esp, 8
lea ecx, [esp + 0x40]
test eax, eax
sete bl
call fcn.005c38b4
test bl, bl
je 0x54f80d
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x18c98c0
call fcn.005c3629
push ecx
mov byte [esp + 0x38], 5
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x18c98c4
call fcn.005c3629
push ecx
mov byte [esp + 0x3c], 6
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x18c98c8
call fcn.005c3629
push ecx
lea edx, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x44], 7
call fcn.005c3629
lea eax, [esp + 0x50]
mov byte [esp + 0x40], 3
push eax
call fcn.0054f350
add esp, 0x14
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 8
call fcn.005c39ed
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], 3
call fcn.005c38b4
mov eax, dword [0x18c98cc]
push 0x1807b98
push eax
call fcn.004acd54
add esp, 8
test eax, eax
je 0x54f80b
mov ecx, dword [0x18c98cc]
push 0
push 0
push ecx
call fcn.005cfe2e
mov esi, dword [esp + 0x38]
push 0x1807b98
mov ecx, esi
call fcn.005c3922
jmp 0x54f81d
mov dword [esi], edi
mov esi, dword [esp + 0x38]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.005c3629
mov dword [esp + 0x14], edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call fcn.005c38b4
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.005c38b4
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 0
call fcn.005c38b4
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret