joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5442e5
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
call fcn.006a37ec
push dword [ebp + 0x10]
mov edi, eax
mov dword [ebp - 4], edi
call fcn.006a37ec
mov ebx, dword [ebp + 8]
mov esi, eax
mov dword [ebp - 8], esi
push dword [ebx + 0x38]
call fcn.006a37ec
mov dword [ebp + 8], eax
lea edx, [eax + esi]
mov eax, dword [ebx + 0x18]
add eax, 9
add edx, edi
lea eax, [eax + edx*2]
and eax, 0xfffffffc
mov dword [ebp - 0xc], eax
lea ecx, [eax + 0xa8]
push ecx
call fcn.006a66fd
mov edi, eax
add esp, 0x10
test edi, edi
je 0x5444b2
push 0x30
push ebx
push edi
lea esi, [edi + 0xa8]
call fcn.00689000
mov eax, dword [ebp - 0xc]
add eax, 0xa8
movzx eax, ax
mov dword [edi], eax
mov eax, esi
sub eax, edi
mov word [edi + 0x38], ax
mov eax, dword [ebp + 8]
lea eax, [eax*2 + 2]
push eax
push dword [ebx + 0x38]
push esi
call fcn.00689000
mov eax, dword [ebp + 8]
lea esi, [esi + eax*2]
add esi, 2
mov eax, esi
sub eax, edi
mov word [edi + 0x3a], ax
mov eax, dword [ebp - 4]
add eax, eax
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
push esi
call fcn.00689000
mov edx, dword [ebp - 4]
add esp, 0x24
mov eax, edx
xor ecx, ecx
and eax, 0x3f
mov ax, word [eax*2 + 0x7a7df0]
mov word [esi + edx*2], ax
test edx, edx
je 0x5443d4
mov eax, ecx
and eax, 0x3f
mov ax, word [eax*2 + 0x7a7df0]
xor word [esi + ecx*2], ax
inc ecx
cmp ecx, edx
jb 0x5443be
mov eax, dword [ebp + 8]
add eax, 2
add esi, eax
mov eax, esi
sub eax, edi
mov word [edi + 0x3c], ax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
push esi
call fcn.00689000
mov edx, dword [ebp - 8]
add esp, 0xc
mov eax, edx
xor ecx, ecx
and eax, 0x3f
mov ax, word [eax*2 + 0x7a7df0]
mov word [esi + edx*2], ax
test edx, edx
je 0x544429
mov eax, ecx
and eax, 0x3f
mov ax, word [eax*2 + 0x7a7df0]
xor word [esi + ecx*2], ax
inc ecx
cmp ecx, edx
jb 0x544413
mov ecx, dword [ebp + 0xc]
add ecx, 2
add ecx, esi
mov eax, ecx
sub eax, edi
mov word [edi + 0x3e], ax
push dword [ebx + 0x18]
push dword [ebx + 0x30]
push ecx
call fcn.00689000
xor eax, eax
mov word [edi + 0x40], ax
push 0x5c
push dword [ebx + 0x34]
call fcn.0068a697
push 0x2f
push dword [ebx + 0x34]
mov esi, eax
call fcn.0068a697
add esp, 0x1c
cmp esi, eax
cmova eax, esi
test eax, eax
jne 0x544472
mov eax, dword [ebx + 0x34]
jmp 0x544475
add eax, 2
push 0x20
push eax
lea eax, [edi + 0x68]
push eax
call fcn.006af30a
add esp, 0xc
xor eax, eax
mov word [edi + 0xa6], ax
mov dword [edi + 0x30], 0x3e8
and dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0x10]
push eax
push dword [edi]
mov eax, dword [ebp - 0x14]
push edi
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call fcn.006a389b
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x544aa0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 8], edi
lea esi, [edi + 0xc]
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.00544d7f
mov dword [esi], eax
lea esi, [edi + 0x2c]
mov dword [esi], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t__
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call sym.txupd.exe_void___cdecl_Util::Misc::SplitCmdString_class_CTXStringW_const___class_std::vector_class_CTXStringW__class_std::allocator_class_CTXStringW____
pop ecx
pop ecx
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, dword [ebp - 0x10]
inc ebx
mov ecx, dword [ebp - 0x14]
sub eax, ecx
sar eax, 2
cmp eax, ebx
jbe 0x544b47
mov edi, eax
lea ecx, [ecx + ebx*4]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
mov dword [ebp - 4], eax
test eax, eax
je 0x544b3a
push 6
push str._perf:
push eax
call fcn.006af9d2
add esp, 0xc
test eax, eax
jne 0x544b3a
push esi
push dword [ebp - 4]
call sym.txupd.exe_bool___cdecl_Util::Convert::StringToDWordW_wchar_t_const___unsigned_long_int__
add dword [esi], 6
pop ecx
pop ecx
inc ebx
cmp ebx, edi
jae 0x544b44
mov ecx, dword [ebp - 0x14]
jmp 0x544b09
mov edi, dword [ebp - 8]
and dword [edi + 8], 0
mov eax, 0x100
cmp dword [esi], 0
mov dword [edi], eax
mov dword [edi + 4], eax
jbe 0x544b64
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [ebp - 0x14]
call fcn.005014ba
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54a4ea
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00689b00
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0054a54a
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00682c16
mov esp, ebp
pop ebp
ret

Function at 0x54abc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x7b088c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.00689b00
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.00682c16
mov esp, ebp
pop ebp
ret

Function at 0x54acb3
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 4
pop edi
push edi
push str.SeCreateGlobalPrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeBackupPrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeCreatePagefilePrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeCreateSymbolicLinkPrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeDebugPrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeImpersonatePrivilege
push esi
call fcn.0054b6d2
add esp, 0x48
push edi
push str.SeIncreaseBasePriorityPrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeIncreaseQuotaPrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeLoadDriverPrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeManageVolumePrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeProfileSingleProcessPrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeRemoteShutdownPrivilege
push esi
call fcn.0054b6d2
add esp, 0x48
push edi
push str.SeRestorePrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeSecurityPrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeSystemEnvironmentPrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeSystemProfilePrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeSystemtimePrivilege
push esi
call fcn.0054b6d2
push edi
push str.SeTakeOwnershipPrivilege
push esi
call fcn.0054b6d2
add esp, 0x48
xor eax, eax
pop edi
inc eax
pop esi
pop ebp
ret
Function at 0x54b068
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x5c
push edi
call fcn.0068a430
pop ecx
pop ecx
test eax, eax
jne 0x54b1cd
cmp byte [0x7b6aa0], al
jne 0x54b118
mov esi, 0x400
xor ebx, ebx
push esi
push 0x7b6aa0
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0x7b6aa0
call fcn.0068a560
pop ecx
pop ecx
test eax, eax
je 0x54b0ba
mov byte [eax + 1], bl
push esi
push 0x7b6ea0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x54b0e9
cmp byte [eax + 0x7b6e9f], 0x5c
je 0x54b0e9
mov byte [eax + 0x7b6ea0], 0x5c
inc eax
cmp eax, esi
jae 0x54b1df
mov byte [eax + 0x7b6ea0], bl
push esi
push 0x7b72a0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x54b118
cmp byte [eax + 0x7b729f], 0x5c
je 0x54b118
mov byte [eax + 0x7b72a0], 0x5c
inc eax
cmp eax, esi
jae 0x54b1df
mov byte [eax + 0x7b72a0], bl
push edi
push 0x7b6ea0
lea ecx, [ebp - 8]
call sym.txupd.exe_public:_void___thiscall_CTXStringA::constructor_char_const__
push eax
lea eax, [ebp - 4]
push eax
call sym.txupd.exe_class_CTXStringA___cdecl_operator_class_CTXStringA_const___char_const__
add esp, 0xc
mov ecx, eax
call sym.txupd.exe_public:_char_const____thiscall_CTXStringA::operator_char_const__void_const
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call ebx
lea ecx, [ebp - 4]
mov esi, eax
call sym.txupd.exe_public:_void___thiscall_CTXStringA::destructor_void_
lea ecx, [ebp - 8]
call sym.txupd.exe_public:_void___thiscall_CTXStringA::destructor_void_
test esi, esi
jne 0x54b1d6
push edi
push 0x7b72a0
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringA::constructor_char_const__
push eax
lea eax, [ebp - 8]
push eax
call sym.txupd.exe_class_CTXStringA___cdecl_operator_class_CTXStringA_const___char_const__
add esp, 0xc
mov ecx, eax
call sym.txupd.exe_public:_char_const____thiscall_CTXStringA::operator_char_const__void_const
push eax
call ebx
lea ecx, [ebp - 8]
mov esi, eax
call sym.txupd.exe_public:_void___thiscall_CTXStringA::destructor_void_
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringA::destructor_void_
test esi, esi
jne 0x54b1d6
push edi
push 0x7b6aa0
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringA::constructor_char_const__
push eax
lea eax, [ebp - 8]
push eax
call sym.txupd.exe_class_CTXStringA___cdecl_operator_class_CTXStringA_const___char_const__
add esp, 0xc
mov ecx, eax
call sym.txupd.exe_public:_char_const____thiscall_CTXStringA::operator_char_const__void_const
push eax
call ebx
lea ecx, [ebp - 8]
mov esi, eax
call sym.txupd.exe_public:_void___thiscall_CTXStringA::destructor_void_
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringA::destructor_void_
jmp 0x54b1d6
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00683380
int3
Function at 0x54b1e5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x5c
pop esi
push esi
push edi
call fcn.0068a738
pop ecx
pop ecx
test eax, eax
jne 0x54b369
cmp word [0x7b76a0], ax
jne 0x54b2b4
mov ebx, 0x400
push ebx
push 0x7b76a0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push 0x7b76a0
call fcn.0068a697
pop ecx
pop ecx
test eax, eax
je 0x54b23a
xor ecx, ecx
mov word [eax + 2], cx
push ebx
push 0x7b7ea0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x54b277
cmp word [eax*2 + 0x7b7e9e], si
je 0x54b277
mov word [eax*2 + 0x7b7ea0], si
lea eax, [eax*2 + 2]
cmp eax, 0x800
jae 0x54b37b
xor ecx, ecx
mov word [eax + 0x7b7ea0], cx
push ebx
push 0x7b86a0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x54b2b4
cmp word [eax*2 + 0x7b869e], si
je 0x54b2b4
mov word [eax*2 + 0x7b86a0], si
lea eax, [eax*2 + 2]
cmp eax, 0x800
jae 0x54b37b
xor ecx, ecx
mov word [eax + 0x7b86a0], cx
push edi
push 0x7b7ea0
lea ecx, [ebp - 8]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t__
push eax
lea eax, [ebp - 4]
push eax
call sym.txupd.exe_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__
add esp, 0xc
mov ecx, eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call ebx
lea ecx, [ebp - 4]
mov esi, eax
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [ebp - 8]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
test esi, esi
jne 0x54b372
push edi
push 0x7b86a0
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t__
push eax
lea eax, [ebp - 8]
push eax
call sym.txupd.exe_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__
add esp, 0xc
mov ecx, eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call ebx
lea ecx, [ebp - 8]
mov esi, eax
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
test esi, esi
jne 0x54b372
push edi
push 0x7b76a0
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t__
push eax
lea eax, [ebp - 8]
push eax
call sym.txupd.exe_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__
add esp, 0xc
mov ecx, eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call ebx
lea ecx, [ebp - 8]
mov esi, eax
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
jmp 0x54b372
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00683380
int3
Function at 0x54b381
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x5c
push edi
call fcn.0068a430
pop ecx
pop ecx
test eax, eax
jne 0x54b4fc
cmp byte [0x7b8ea0], al
jne 0x54b431
mov esi, 0x400
xor ebx, ebx
push esi
push 0x7b8ea0
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0x7b8ea0
call fcn.0068a560
pop ecx
pop ecx
test eax, eax
je 0x54b3d3
mov byte [eax + 1], bl
push esi
push 0x7b92a0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x54b402
cmp byte [eax + 0x7b929f], 0x5c
je 0x54b402
mov byte [eax + 0x7b92a0], 0x5c
inc eax
cmp eax, esi
jae 0x54b514
mov byte [eax + 0x7b92a0], bl
push esi
push 0x7b96a0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x54b431
cmp byte [eax + 0x7b969f], 0x5c
je 0x54b431
mov byte [eax + 0x7b96a0], 0x5c
inc eax
cmp eax, esi
jae 0x54b514
mov byte [eax + 0x7b96a0], bl
push dword [ebp + 0x10]
lea ecx, [ebp - 8]
push dword [ebp + 0xc]
push edi
push 0x7b92a0
call sym.txupd.exe_public:_void___thiscall_CTXStringA::constructor_char_const__
push eax
lea eax, [ebp - 4]
push eax
call sym.txupd.exe_class_CTXStringA___cdecl_operator_class_CTXStringA_const___char_const__
add esp, 0xc
mov ecx, eax
call sym.txupd.exe_public:_char_const____thiscall_CTXStringA::operator_char_const__void_const
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push eax
call ebx
lea ecx, [ebp - 4]
mov esi, eax
call sym.txupd.exe_public:_void___thiscall_CTXStringA::destructor_void_
lea ecx, [ebp - 8]
call sym.txupd.exe_public:_void___thiscall_CTXStringA::destructor_void_
test esi, esi
jne 0x54b50b
push dword [ebp + 0x10]
lea ecx, [ebp - 4]
push dword [ebp + 0xc]
push edi
push 0x7b96a0
call sym.txupd.exe_public:_void___thiscall_CTXStringA::constructor_char_const__
push eax
lea eax, [ebp - 8]
push eax
call sym.txupd.exe_class_CTXStringA___cdecl_operator_class_CTXStringA_const___char_const__
add esp, 0xc
mov ecx, eax
call sym.txupd.exe_public:_char_const____thiscall_CTXStringA::operator_char_const__void_const
push eax
call ebx
lea ecx, [ebp - 8]
mov esi, eax
call sym.txupd.exe_public:_void___thiscall_CTXStringA::destructor_void_
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringA::destructor_void_
test esi, esi
jne 0x54b50b
push dword [ebp + 0x10]
lea ecx, [ebp - 4]
push dword [ebp + 0xc]
push edi
push 0x7b8ea0
call sym.txupd.exe_public:_void___thiscall_CTXStringA::constructor_char_const__
push eax
lea eax, [ebp - 8]
push eax
call sym.txupd.exe_class_CTXStringA___cdecl_operator_class_CTXStringA_const___char_const__
add esp, 0xc
mov ecx, eax
call sym.txupd.exe_public:_char_const____thiscall_CTXStringA::operator_char_const__void_const
push eax
call ebx
lea ecx, [ebp - 8]
mov esi, eax
call sym.txupd.exe_public:_void___thiscall_CTXStringA::destructor_void_
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringA::destructor_void_
jmp 0x54b50b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00683380
int3
Function at 0x554176
Capabilities:
Create thread

Disassembly:
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push edi
push edi
push edi
mov dword [esi], edi
mov dword [esi + 0xc], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push esi
push 0x55496e
push edi
push edi
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov eax, esi
pop edi
pop esi
ret

Function at 0x55478a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0xc], edi
jne 0x55479e
call fcn.0055454d
cmp dword [esi + 4], edi
je 0x5547aa
xor eax, eax
jmp 0x55482e
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
push esi
push 0x55497d
push edi
push edi
mov dword [esi + 0xc], 1
call fcn.006ad77b
add esp, 0x18
push esi
push dword [ebp - 4]
push eax
push str.StartThread__result_d__TID_u__this0x_p
push str.ThreadModel
push 2
push str.func
test eax, eax
jg 0x554803
push 0x128
push str.file
call fcn.004cee9c
add esp, 0x24
mov dword [esi + 0xc], edi
jmp 0x5547a3
push 0x12f
push str.file
mov dword [esi + 4], eax
call fcn.004cee9c
add esp, 0x24
cmp dword [esi + 0x10], edi
je 0x554828
push 0xfffffffffffffff1
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov dword [esi + 0x18], edi
inc eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x554ab2
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 8]
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_int___thiscall_CTXStringW::GetLength_void_const
test eax, eax
jle 0x554b72
lea esi, [eax - 1]
push esi
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_wchar_t___thiscall_CTXStringW::GetAt_int_const
push 0x5c
pop edi
cmp ax, di
jne 0x554b06
push esi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_class_CTXStringW___thiscall_CTXStringW::Left_int_
push eax
lea ecx, [ebp - 4]
call fcn.0051b603
lea ecx, [ebp - 8]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x554b1e
test al, 0x10
jne 0x554b6d
push edi
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_int___thiscall_CTXStringW::ReverseFind_wchar_t_const
cmp eax, 0xffffffff
je 0x554b72
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_class_CTXStringW___thiscall_CTXStringW::Left_int_
lea ecx, [ebp - 8]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call fcn.00554ab2
pop ecx
xor esi, esi
lea ecx, [ebp - 4]
push esi
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 8]
test eax, eax
jne 0x554b68
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
jmp 0x554b74
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
xor esi, esi
inc esi
jmp 0x554b74
xor esi, esi
lea ecx, [ebp - 4]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x555ff4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x10], 0
je 0x55605e
push 0
push 0x10000080
push 4
push 0
push 3
push 0xc0000000
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x55605e
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp + 8], eax
mov ecx, esi
cmova eax, dword [ebp + 8]
push eax
push edi
call fcn.00556066
test eax, eax
je 0x556057
cmp dword [esi], 0xffffffff
je 0x556050
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi], 0xffffffff
xor eax, eax
mov dword [esi], edi
inc eax
jmp 0x556060
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x55ed79
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x14
and dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
push ebx
push esi
push edi
jb 0x55ed91
mov eax, dword [eax]
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
cmp dword [ebx + 0x10], ecx
je 0x55eef6
push 1
call fcn.00682bd5
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
pop ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.0055e937
push 0x18
call fcn.00682bd5
pop ecx
test eax, eax
je 0x55edd9
and dword [eax + 0x10], 0
xor ecx, ecx
mov dword [eax + 0x14], 7
mov word [eax], cx
jmp 0x55eddb
xor eax, eax
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
and dword [ebp - 8], 0
push eax
call fcn.0055e8bc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x3e8
sub esp, 0x28
mov dword [ebp + 8], eax
mov edi, esp
mov byte [ebp - 4], 0
sub esp, 0x2c
lea eax, [ebp - 0x14]
mov ecx, esp
push eax
lea eax, [ebp - 0xc]
mov dword [ecx], 0x55f1a0
push eax
push dword [ebp - 4]
lea esi, [ecx + 4]
mov ecx, esi
call fcn.0055e3b8
push ebx
lea ecx, [esi + 0x10]
call fcn.004301f8
mov ecx, edi
call fcn.0055e434
call fcn.0055ed49
mov ecx, eax
call fcn.0055ec50
test al, al
jne 0x55ee78
cmp dword [ebx + 0x14], 8
jb 0x55ee4b
mov ebx, dword [ebx]
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 8]
push eax
push str.GetProxyByURL__timeout__used_time_u__URL_s
push str.PACProxyHelper
push 2
push str.func
push 0x20
push str.file
call fcn.004ce9b9
add esp, 0x20
jmp 0x55eede
mov esi, dword [ebp - 0xc]
push 8
pop edi
cmp dword [esi + 0x14], edi
jb 0x55ee87
mov ecx, dword [esi]
jmp 0x55ee89
mov ecx, esi
mov eax, dword [esi + 0x10]
lea eax, [ecx + eax*2]
cmp dword [esi + 0x14], edi
jb 0x55ee98
mov ecx, dword [esi]
jmp 0x55ee9a
mov ecx, esi
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0055e9a2
cmp dword [esi + 0x14], edi
jb 0x55eeab
mov esi, dword [esi]
cmp dword [ebx + 0x14], edi
jb 0x55eeb2
mov ebx, dword [ebx]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 8]
push eax
push str.GetProxyByURL__success__used_time_u__URL_s__proxy_s
push str.PACProxyHelper
push 2
push str.func
push 0x24
push str.file
call fcn.004ce9b9
add esp, 0x24
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x55eeea
call fcn.004dc8b8
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x55eef6
call fcn.004dc8b8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x55f38a
Capabilities:
Create thread

Disassembly:
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push esi
push 0x55f62d
push edi
push edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], edi
pop edi
pop esi
ret