joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bf620
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push ebx
push esi
mov esi, ecx
push eax
call fcn.005e8b67
lea ecx, [esp + 0xc]
push ecx
call fcn.005ea193
add esp, 8
lea edx, [eax + 0x14]
add eax, 4
lea ebx, [esi + 0x44]
push edx
push eax
push str._.15s__.4s
push ebx
call fcn.005e7bd3
mov eax, dword [esi + 0xa8]
add esp, 0x10
test eax, eax
je 0x5bf674
push eax
call fcn.005ffe68
add esp, 4
mov dword [esi + 0xa8], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x5bf6c8
mov ecx, dword [esi + 0x420]
test ecx, ecx
jne 0x5bf692
push eax
mov ecx, esi
call fcn.005c5d70
test al, al
je 0x5bf6c8
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push ebx
push 1
push eax
mov eax, dword [esi + 0x420]
push str.lastTryDate
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esi + 0x420]
push str.lastResult
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x5bf6d0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push ebx
push esi
mov esi, ecx
push eax
call fcn.005e8b67
lea ecx, [esp + 0xc]
push ecx
call fcn.005ea193
add esp, 8
lea edx, [eax + 0x14]
add eax, 4
lea ebx, [esi + 0x74]
push edx
push eax
push str._.15s__.4s
push ebx
call fcn.005e7bd3
mov eax, dword [esp + 0x28]
add esp, 0x10
test eax, eax
je 0x5bf749
mov ecx, dword [esi + 0x420]
test ecx, ecx
jne 0x5bf725
push eax
mov ecx, esi
call fcn.005c5d70
test al, al
je 0x5bf749
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push ebx
push 1
push eax
mov eax, dword [esi + 0x420]
push str.dateAdded
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x5bf760
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62f700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x83c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
test ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
je 0x5bf814
mov eax, dword [esi + 0xa8]
cmp ebx, eax
je 0x5bf814
test eax, eax
je 0x5bf7ae
push eax
call fcn.005ffe68
add esp, 4
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.005ffe3f
mov edx, eax
add esp, 4
test edx, edx
mov dword [esi + 0xa8], edx
jne 0x5bf7f2
push str.URL::set_lastResult__:_Not_enough_memory__n
mov ecx, esi
call fcn.005bf600
mov eax, 0x753b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x5bf94a
push eax
lea edx, [ebp - 0x48]
push str.SoftwareDownloadManager_ld
push edx
call fcn.005e7bd3
mov eax, dword [ebp + 0x14]
add esp, 0xc
test eax, eax
je 0x5bf883
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x48]
push eax
push 0xf003f
push 0
push ecx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x5bf8aa
lea edx, [ebp - 0x18]
lea eax, [ebp + 0xc]
push edx
push eax
push 0
push 0xf003f
push 0
push 0x6d1c98
lea ecx, [ebp - 0x48]
push 0
push ecx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x5bf94a
test ebx, ebx
je 0x5bf921
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x7ff
jbe 0x5bf8fc
push 0x7ff
lea edx, [ebp - 0x848]
push ebx
push edx
call fcn.005e7540
mov ecx, dword [ebp + 0xc]
add esp, 0xc
lea eax, [ebp - 0x848]
mov byte [ebp - 0x49], 0
push 0x801
push eax
push 1
push 0
push str.lastResult
push ecx
jmp 0x5bf91b
mov edx, dword [esi + 0xa8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp + 0xc]
push 1
push eax
push str.lastResult
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0x10]
push 4
push ecx
push 4
push 0
push str.dwnlrs
push edx
mov dword [ebp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5c1ed0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
push edi
mov esi, ecx
je 0x5c1f81
mov ecx, dword [esi + 0x420]
test ecx, ecx
jne 0x5c1efa
push eax
mov ecx, esi
call fcn.005c5d70
test al, al
je 0x5c1f81
mov al, byte [esi + 0x30c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test al, al
je 0x5c1f2b
mov ecx, dword [esi + 0x420]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push str.bPHSBU
push ecx
mov dword [esp + 0x24], 1
call edi
mov al, byte [esi + 0x30d]
test al, al
je 0x5c1f56
mov eax, dword [esi + 0x420]
lea edx, [esp + 0xc]
push 4
push edx
push 4
push 0
push str.bFLSBU
push eax
mov dword [esp + 0x24], 1
call edi
mov al, byte [esi + 0x16e]
test al, al
je 0x5c1f81
mov edx, dword [esi + 0x420]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push 0
push str.bRPCHK
push edx
mov dword [esp + 0x24], 1
call edi
pop edi
pop esi
ret 4

Function at 0x5c2010
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x420]
test eax, eax
je 0x5c208e
mov eax, dword [esi + 0x34]
lea ecx, [esp + 4]
push eax
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0
mov word [esp + 0xc], 0
call fcn.00402410
mov eax, dword [esp + 4]
test eax, eax
jne 0x5c2050
lea eax, [esp + 8]
push eax
call fcn.005beb30
mov eax, dword [esp + 8]
add esp, 4
test eax, eax
jne 0x5c2065
lea eax, [esp + 8]
mov ecx, dword [esp + 0xc]
lea edx, [ecx + ecx + 2]
push edx
push eax
mov eax, dword [esi + 0x420]
push 0
push 0
push str.EncLNFSW
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 4]
call fcn.00401070
pop esi
add esp, 0xc
ret
Function at 0x5c32f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62f8f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x20]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], edi
je 0x5c332b
push eax
call fcn.005ffe68
add esp, 4
mov esi, dword [ebp + 8]
cmp esi, edi
jne 0x5c334a
mov dword [ebx + 0x20], edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x5c336e
mov dword [ebx + 0x20], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.005ffe3f
mov edx, eax
add esp, 4
test edx, edx
mov dword [ebx + 0x20], edx
jne 0x5c33af
push str.URL::set_LastModified__:_Not_enough_memory__n
mov ecx, ebx
call fcn.005bf600
mov eax, 0x753b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 0xc]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jne 0x5c33e8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 0x420]
test ecx, ecx
jne 0x5c3416
push eax
mov ecx, ebx
call fcn.005c5d70
test al, al
jne 0x5c3416
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebx + 0x20]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebx + 0x420]
push edx
push 1
push eax
push str.LastModified
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5c3920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62f920
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
mov eax, dword [esi + 0x420]
mov dword [ebp - 4], 0
test eax, eax
jne 0x5c397f
mov eax, dword [ebp + 8]
push eax
call fcn.005c5d70
test al, al
jne 0x5c397f
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x420]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp + 8]
lea edx, [ebp - 0x21c]
push ecx
push edx
push 0
push 0
mov ebx, 0x208
push str.LocalPath
push eax
mov dword [ebp + 8], ebx
call edi
test eax, eax
je 0x5c39c6
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x21c]
push ecx
call fcn.005e88a4
add esp, 4
test eax, eax
je 0x5c39f1
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x5c3a01
push eax
call fcn.005ffe68
add esp, 4
lea edx, [ebp - 0x21c]
push edx
call fcn.005e71bf
lea eax, [eax + eax + 2]
push eax
call fcn.005ffe3f
add esp, 8
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x5c3a45
push str.URL::set_localPath__:_Not_enough_memory__n
mov ecx, esi
call fcn.005bf600
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x21c]
push ecx
push eax
call fcn.005e7389
mov ecx, dword [esi + 0x420]
add esp, 8
lea edx, [ebp + 8]
lea eax, [ebp - 0x21c]
push edx
push eax
push 0
push 0
push str.LocalFileName
push ecx
mov dword [ebp + 8], ebx
call edi
test eax, eax
je 0x5c3a91
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x21c]
mov ecx, esi
push edx
call fcn.005c4170
test eax, eax
je 0x5c3abb
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 0x420]
lea eax, [ebp + 8]
lea ecx, [ebp - 0x21c]
push eax
push ecx
push 0
push 0
push str.LogFileName
push edx
mov dword [ebp + 8], ebx
call edi
test eax, eax
je 0x5c3af7
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x418]
lea eax, [ebp - 0x21c]
add ecx, 4
push eax
push ecx
call fcn.005e7389
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5c3b60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62f938
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
mov eax, dword [0x6cd768]
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
lea eax, [ebp - 0x14]
push str.SoftwareDownloadManagerGrabberStsProjects_ld_ld_
push eax
mov byte [ebp - 4], 1
call fcn.005fc86b
add esp, 0x10
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
lea edx, [ebp + 0xc]
push ecx
push edx
push ebx
push 0xf003f
push ebx
push 0x6d1c98
push ebx
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x5c3d0c
mov eax, dword [ebp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp + 8]
lea edx, [ebp - 0x224]
push ecx
push edx
push ebx
push ebx
push str.LocalPath
push eax
mov dword [ebp + 8], 0x208
call edi
test eax, eax
je 0x5c3c11
mov ecx, dword [ebp + 0xc]
push ecx
jmp 0x5c3d06
lea edx, [ebp - 0x224]
push edx
call fcn.005e88a4
add esp, 4
test eax, eax
jne 0x5c3d02
mov eax, dword [esi + 0x2c]
cmp eax, ebx
je 0x5c3c38
push eax
call fcn.005ffe68
add esp, 4
lea ecx, [ebp - 0x224]
push ecx
call fcn.005e71bf
lea edx, [eax + eax + 2]
push edx
call fcn.005ffe3f
add esp, 8
cmp eax, ebx
mov dword [esi + 0x2c], eax
jne 0x5c3c6d
push str.URL::set_localPath__:_Not_enough_memory__n
mov ecx, esi
call fcn.005bf600
mov edx, dword [ebp + 0xc]
push edx
jmp 0x5c3d06
lea ecx, [ebp - 0x224]
push ecx
push eax
call fcn.005e7389
mov edx, dword [ebp + 0xc]
add esp, 8
lea eax, [ebp + 8]
lea ecx, [ebp - 0x224]
push eax
push ecx
push ebx
push ebx
push str.LocalFileName
push edx
mov dword [ebp + 8], 0x208
call edi
test eax, eax
jne 0x5c3d02
lea ecx, [ebp - 0x224]
push ecx
mov ecx, esi
call fcn.005c4170
cmp eax, ebx
je 0x5c3cdf
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00603a3c
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 8]
lea ecx, [ebp - 0x224]
push eax
push ecx
push ebx
push ebx
push str.LogFileName
push edx
mov dword [ebp + 8], 0x208
call edi
test eax, eax
je 0x5c3d2f
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00603a3c
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esi + 0x418]
lea ecx, [ebp - 0x224]
add edx, 4
push ecx
push edx
call fcn.005e7389
mov eax, dword [ebp + 0xc]
add esp, 8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00603a3c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5c43b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x6d378c]
sub esp, 0x20c
test eax, eax
jne 0x5c446e
mov eax, dword [0x6d3788]
test eax, eax
jne 0x5c4446
mov edx, dword [0x6d2354]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push 0
push 0
push str.ExePath
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5c443d
lea eax, [esp + 4]
push 0x5c
push eax
call fcn.005e8180
add esp, 8
test eax, eax
je 0x5c443d
lea ecx, [esp + 4]
lea edx, [esp + 0x108]
push ecx
push str._sidmftype.dll
push edx
mov byte [eax], 0
call fcn.005e7bd3
add esp, 0xc
lea eax, [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x6d3788], eax
jmp 0x5c4442
mov eax, dword [0x6d3788]
test eax, eax
je 0x5c446e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IDMFileType
push eax
call esi
mov ecx, dword [0x6d3788]
push str.IDMExtensionForMimeType
push ecx
mov dword [0x6d378c], eax
call esi
mov dword [0x6d3790], eax
pop esi
add esp, 0x20c
ret
Function at 0x5c5ea0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi + 0x2dc], eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x5c5ef9
mov ecx, dword [esi + 0x420]
test ecx, ecx
jne 0x5c5ecb
push eax
mov ecx, esi
call fcn.005c5d70
test al, al
je 0x5c5ef9
mov edx, dword [esi + 0x2dc]
mov eax, dword [esi + 0x420]
xor ecx, ecx
push 4
test edx, edx
lea edx, [esp + 0xc]
push edx
push 4
push 0
push str.needER
setne cl
push eax
mov dword [esp + 0x20], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 8
Function at 0x5c61d0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x198
push ebx
push esi
lea eax, [esp + 8]
push edi
mov ebx, ecx
push eax
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x5c636d
mov eax, dword [esp + 0x1c]
cmp eax, 2
jne 0x5c620d
lea edx, [esp + 0xa0]
mov edi, str.security.dll
jmp 0x5c6222
cmp eax, 1
jne 0x5c636d
lea edx, [esp + 0xa0]
mov edi, str.secur32.dll
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebx + 0x198]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jne 0x5c625d
lea ecx, [esp + 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebx + 0x198], eax
mov eax, dword [ebx + 0x198]
test eax, eax
je 0x5c636d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FreeCredentialsHandle
push eax
call esi
mov edx, dword [ebx + 0x198]
push str.QuerySecurityPackageInfoA
push edx
mov dword [ebx + 0x19c], eax
call esi
mov dword [ebx + 0x1a4], eax
mov eax, dword [ebx + 0x198]
push str.AcquireCredentialsHandleA
push eax
call esi
mov ecx, dword [ebx + 0x198]
push str.FreeContextBuffer
push ecx
mov dword [ebx + 0x1a0], eax
call esi
mov edx, dword [ebx + 0x198]
push str.InitializeSecurityContextA
push edx
mov dword [ebx + 0x1a8], eax
call esi
mov dword [ebx + 0x1ac], eax
mov eax, dword [ebx + 0x198]
push str.CompleteAuthToken
push eax
call esi
mov ecx, dword [ebx + 0x198]
push str.EnumerateSecurityPackagesA
push ecx
mov dword [ebx + 0x1b0], eax
call esi
mov edx, dword [ebx + 0x198]
push str.DeleteSecurityContext
push edx
mov dword [ebx + 0x1b4], eax
call esi
mov dword [ebx + 0x1b8], eax
mov eax, dword [ebx + 0x19c]
test eax, eax
je 0x5c6356
mov eax, dword [ebx + 0x1a4]
test eax, eax
je 0x5c6356
mov eax, dword [ebx + 0x1a0]
test eax, eax
je 0x5c6356
mov eax, dword [ebx + 0x1a8]
test eax, eax
je 0x5c6356
mov eax, dword [ebx + 0x1ac]
test eax, eax
je 0x5c6356
mov eax, dword [ebx + 0x1b4]
test eax, eax
je 0x5c6356
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x198
ret
mov eax, dword [ebx + 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebx + 0x198], 0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x198
ret
Function at 0x5c6f60
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
mov eax, 0xaaaaaaab
push esi
lea ecx, [ebp + 3]
mov esi, dword [esp + 0x14]
mul ecx
shr edx, 1
lea edx, [edx + ebp + 4]
push edx
push esi
call fcn.00577420
add esp, 8
test eax, eax
jne 0x5c6f8d
pop esi
pop ebp
ret 0xc
push esi
call fcn.00577410
mov ecx, eax
add esp, 4
xor eax, eax
test ebp, ebp
jbe 0x5c7018
lea edx, [ebp + 2]
mov eax, 0xaaaaaaab
mul edx
mov esi, dword [esp + 0xc]
push ebx
push edi
mov edi, edx
shr edi, 1
lea eax, [edi + edi*2]
xor edx, edx
xor ebx, ebx
mov dl, byte [esi]
add esi, 3
shr edx, 2
inc ecx
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_http:__www.internetdownloadmanager.com_support_data_corruption.html]
mov byte [ecx - 1], dl
mov dl, byte [esi - 3]
mov bl, byte [esi - 2]
and edx, 3
shl edx, 4
shr ebx, 4
or edx, ebx
xor ebx, ebx
inc ecx
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_http:__www.internetdownloadmanager.com_support_data_corruption.html]
mov byte [ecx - 1], dl
mov dl, byte [esi - 2]
mov bl, byte [esi - 1]
and edx, 0xf
shl edx, 2
shr ebx, 6
or edx, ebx
inc ecx
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_http:__www.internetdownloadmanager.com_support_data_corruption.html]
mov byte [ecx - 1], dl
mov dl, byte [esi - 1]
and edx, 0x3f
inc ecx
dec edi
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_http:__www.internetdownloadmanager.com_support_data_corruption.html]
mov byte [ecx - 1], dl
jne 0x5c6fb5
pop edi
pop ebx
lea edx, [ebp + 1]
cmp eax, edx
jne 0x5c7030
mov byte [ecx - 1], 0x3d
pop esi
mov byte [ecx], 0
mov eax, 1
pop ebp
ret 0xc
add ebp, 2
cmp eax, ebp
jne 0x5c703f
mov al, 0x3d
mov byte [ecx - 1], al
mov byte [ecx - 2], al
pop esi
mov byte [ecx], 0
mov eax, 1
pop ebp
ret 0xc
Function at 0x5c7cd0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x62fc50
push eax
mov dword fs:[0], esp
sub esp, 0x8c
mov eax, dword [esp + 0x9c]
push ebx
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5c7d1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x5c7e00
push edi
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push esi
push ecx
lea edx, [esp + 0x18]
push 0x80
push edx
push ebx
mov dword [esp + 0x20], esi
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
pop edi
je 0x5c7df7
cmp dword [esp + 8], esi
je 0x5c7df7
lea eax, [esp + 0xc]
push eax
call fcn.005ea3dd
lea ecx, [esp + 0x10]
push str._HTML
push ecx
call fcn.005e72b0
add esp, 0xc
test eax, eax
jne 0x5c7d90
lea edx, [esp + 0xc]
push str.__HTML
push edx
call fcn.005e72b0
add esp, 8
test eax, eax
je 0x5c7d95
mov esi, 1
lea eax, [esp + 0xc]
push str._BODY
push eax
call fcn.005e72b0
add esp, 8
test eax, eax
jne 0x5c7dc1
lea ecx, [esp + 0xc]
push str.__BODY
push ecx
call fcn.005e72b0
add esp, 8
test eax, eax
je 0x5c7dc6
mov esi, 1
lea edx, [esp + 0xc]
push str._HEAD
push edx
call fcn.005e72b0
add esp, 8
test eax, eax
jne 0x5c7df2
lea eax, [esp + 0xc]
push str.__HEAD
push eax
call fcn.005e72b0
add esp, 8
test eax, eax
je 0x5c7df7
mov esi, 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [esp + 0x94]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x98
ret 4

Function at 0x5c8300
Capabilities:
Get file size

Disassembly:
push esi
push edi
mov edi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5c833b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x5c833b
push eax
push str.GetFileSize___error_in_CFormatParsing::GetFSize____errcode___ld._r_n
mov ecx, edi
call fcn.005c9900
xor eax, eax
pop edi
xor edx, edx
pop esi
ret 4
mov edx, dword [esp + 0xc]
push 1
push 0
push 0
push edx
call fcn.005e9a70
xor ecx, ecx
add eax, esi
pop edi
pop esi
adc edx, ecx
ret 4