joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c3110
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5c3122
add esp, 0xfffffff0
call fcn.00407cc0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c8e34
mov eax, dword [0x681598]
mov dword [eax + 4], ebx
mov dword [eax], 0x5c35d8
mov eax, dword [0x6815a8]
mov dword [eax + 4], ebx
mov dword [eax], 0x5c35e4
mov eax, ebx
call fcn.005c35f0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x48c0f8]
call fcn.0040768c
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x48c0f8]
call fcn.0040768c
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x48c0f8]
call fcn.0040768c
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x48c0f8]
call fcn.0040768c
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x48c0f8]
call fcn.0040768c
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5bde70
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x505e68]
call fcn.0050c15c
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x505e68]
call fcn.0050c15c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x505e68]
call fcn.0050c15c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x505e68]
call fcn.0050c15c
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x505e68]
call fcn.0050c15c
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.005c3be0
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c39fc
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c39fc
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c39fc
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c39fc
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5c39fc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c32a2
call fcn.00407d18
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5c379c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c3947
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5c3928
mov dl, 1
mov eax, dword [0x48f8b4]
call fcn.004b3ae8
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.004093e4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5c3917
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00542908
test al, al
je 0x5c390a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5c3958
lea eax, [ebp - 0x394]
call fcn.004236ac
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5c390a
xor eax, eax
push ebp
push 0x5c3903
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5c39c8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5c38ec
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, 0x100
call fcn.0040a0d8
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5c38ec
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, 0x100
call fcn.0040a0d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c390a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5c380d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.004b3a24
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c394e
lea eax, [ebp - 0x3a0]
call fcn.004093e4
ret

Function at 0x5c4508
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x687318]
cmp byte [eax + 0xc1], 0
jne 0x5c457a
cmp dword [0x687338], 0
jne 0x5c453a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x6802c4]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x687338], eax
cmp dword [0x687334], 0
jne 0x5c4555
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x687334], eax
cmp dword [0x68733c], 0
jne 0x5c457a
push esp
push 0
push 0
mov eax, dword [0x6802c0]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x68733c], eax
pop edx
ret
Function at 0x5c4b68
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5c4b7f
add esp, 0xfffffff0
call fcn.00407cc0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c8e34
mov eax, dword [0x681428]
cmp byte [eax], 0
jne 0x5c4bac
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x6817bc]
cmp word [eax + 2], 0
jne 0x5c4bc6
mov eax, dword [0x6817bc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005c6e80
mov eax, dword [0x681904]
cmp word [eax + 2], 0
jne 0x5c4be0
mov eax, dword [0x681904]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005c7084
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x505e68]
call fcn.0050c15c
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5c75fc
mov dl, 1
mov eax, dword [0x48c0f8]
call fcn.0040768c
mov dword [ebx + 0xa4], eax
mov dl, 1
mov eax, dword [0x48c0f8]
call fcn.0040768c
mov dword [ebx + 0xc4], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xb9], 1
mov byte [ebx + 0xd0], 1
mov dl, 1
mov eax, dword [0x50a890]
call fcn.005158cc
mov esi, eax
mov dword [ebx + 0xb4], esi
push 0x5c4dc8
mov eax, dword [0x681650]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00515d5c
mov eax, dword [ebx + 0xb4]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5c78e4
mov dl, 1
mov eax, dword [0x48c0f8]
call fcn.0040768c
mov dword [ebx + 0xac], eax
push 0x100
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x681650]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.004234ac
test eax, eax
je 0x5c4cfa
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.004232e8
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00423490
test eax, eax
je 0x5c4d12
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa0]
lea edx, [ebp - 0x202]
mov ecx, 0x100
call fcn.0040a0d8
push ebx
push 0x5c685c
call fcn.005ba310
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe4], 0
mov eax, dword [0x681428]
cmp byte [eax], 0
jne 0x5c4d63
mov eax, ebx
call fcn.005c4f90
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xba], 1
mov byte [ebx + 0xe5], 0
mov byte [ebx + 0xf0], 0
xor eax, eax
mov dword [ebx + 0xe8], eax
mov byte [ebx + 0xe7], 0
xor eax, eax
mov dword [ebx + 0xbc], eax
mov eax, ebx
call fcn.005c7b2c
mov eax, ebx
call fcn.005c8784
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c4dc0
call fcn.00407d18
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c52d0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5c537c
cmp dword [ebx + 0xa8], 0
jne 0x5c5376
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5c5208
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa4]
cmp dword [eax + 8], 0
je 0x5c5376
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5c533c
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa4]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5c5376
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa4]
call fcn.004af410
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5c534b
inc dword [ebx + 0xa8]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5c559c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x687318]
cmp dword [eax + 0x188], 0
je 0x5c5701
test bl, bl
jne 0x5c564f
cmp dword [esi + 0xb0], 0
jne 0x5c5644
mov eax, esi
call fcn.005c85d4
push eax
push 0x5c54a8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5c5615
mov eax, dword [0x687318]
cmp byte [eax + 0xe7], 0
je 0x5c5615
mov eax, dword [esi + 0xec]
call fcn.0040b2a0
mov edi, eax
cmp edi, 0
jl 0x5c5615
push 0
mov eax, dword [esi + 0xec]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c55fe
mov eax, dword [esi + 0xac]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c5644
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xac]
call fcn.004af410
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c5624
inc dword [esi + 0xb0]
jmp 0x5c5701
cmp dword [esi + 0xb0], 0
jle 0x5c5701
dec dword [esi + 0xb0]
cmp dword [esi + 0xb0], 0
jne 0x5c5701
cmp dword [esi + 0x58], 0
je 0x5c56ac
mov eax, dword [0x687318]
cmp byte [eax + 0xe7], 0
je 0x5c56ac
mov eax, dword [esi + 0xec]
call fcn.0040b2a0
mov edi, eax
cmp edi, 0
jl 0x5c56ac
push 5
mov eax, dword [esi + 0xec]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c5695
mov eax, dword [esi + 0xac]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c56db
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xac]
call fcn.004af410
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c56bb
mov eax, dword [esi + 0xac]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xec]
mov ecx, 1
mov edx, dword [0x5b6bb4]
call fcn.0040b4b4
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x5c635c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc0], 0
je 0x5c63b9
cmp byte [ebx + 0xe7], 0
jne 0x5c63b9
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040956c
mov eax, dword [esi]
test eax, eax
je 0x5c63a6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5c63c6
mov eax, esi
mov edx, dword [ebx + 0xa0]
call fcn.004097c4
jmp 0x5c63c6
mov eax, esi
mov edx, dword [ebx + 0xa0]
call fcn.004097c4
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5c7d18
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5c7d89
mov eax, esi
call fcn.0053c684
test al, al
je 0x5c7d89
mov eax, dword [ebx + 0x98]
call fcn.0053c2ac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5c7d89
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x110]
test al, al
je 0x5c7d7a
push 0
mov eax, dword [ebx + 0x98]
call fcn.0053c2ac
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.00532f80
jmp 0x5c7d89
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.005c7b4c
pop esi
pop ebx
ret
Function at 0x5d1644
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 0x1008], ecx
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004094e8
xor eax, eax
push ebp
push 0x5d1711
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x804]
xor ecx, ecx
mov edx, 0x800
call fcn.00407048
lea eax, [ebp - 0x1004]
xor ecx, ecx
mov edx, 0x800
call fcn.00407048
lea eax, [ebp - 0x1004]
push eax
push 0x3ff
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 0x804]
push eax
push 0
lea eax, [ebp - 0x1008]
mov ecx, dword [ebp - 4]
mov edx, 0x5d1724
call fcn.00409e38
mov eax, dword [ebp - 0x1008]
call fcn.00409db0
push eax
lea eax, [ebp - 0x1004]
push eax
call sub.kernel32.dll_GetTempFileNameW
mov eax, ebx
lea edx, [ebp - 0x804]
mov ecx, 0x400
call fcn.00409d74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d1718
lea eax, [ebp - 0x1008]
call fcn.0040942c
lea eax, [ebp - 4]
call fcn.0040942c
ret

Function at 0x5d172c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004094e8
xor eax, eax
push ebp
push 0x5d17ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005d1644
mov eax, dword [ebp - 8]
call fcn.00409db0
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040a114
mov eax, dword [ebp - 0xc]
call fcn.004232a0
test al, al
je 0x5d178b
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00409838
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d17b5
lea eax, [ebp - 0xc]
call fcn.004093e4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004094a4
ret
Function at 0x5d17bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb9c
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004094c8
xor eax, eax
push ebp
push 0x5d18cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
xor eax, eax
push ebp
push 0x5d18ae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40e]
mov edx, dword [ebp - 4]
call fcn.0042335c
lea eax, [ebp - 0x454]
xor ecx, ecx
mov edx, 0x44
call fcn.00407048
mov dword [ebp - 0x454], 0x44
mov dword [ebp - 0x428], 1
mov word [ebp - 0x424], bx
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x454]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x40e]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x5d1864
call fcn.00408b28
jmp 0x5d18b5
push 0xffffffffffffffff
mov eax, dword [ebp - 0x464]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x464]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x5d188d
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x5d1894
mov dword [ebp - 8], 0xfffffffe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d18b5
mov eax, dword [ebp - 0x464]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d18d2
lea eax, [ebp - 4]
call fcn.004093e4
ret
Function at 0x5d18dc
Capabilities:
Create http request
Get http content length
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7cc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x834], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004094c8
mov eax, dword [ebp - 8]
call fcn.004094c8
xor eax, eax
push ebp
push 0x5d1ad8
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
cmp dword [ebp - 0x10], 0
je 0x5d1ab2
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.004b3c10
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x400
mov eax, dword [ebp - 0x20]
call fcn.004066e0
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 0
push 0x5d1ae8
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x5d1aa9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a034
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x834]
mov eax, dword [ebp - 8]
call fcn.004218c0
cmp dword [ebp - 0x834], 0
je 0x5d19fd
mov esi, 0xfffffffd
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_HttpQueryInfoW
test eax, eax
jne 0x5d19cf
call fcn.00408b28
jmp 0x5d1ab2
mov esi, 0xfffffffc
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.00423594
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0040a608
test eax, eax
jne 0x5d19fd
call fcn.00408b28
jmp 0x5d1ab2
mov esi, 0xfffffffb
mov dword [ebp - 0x20], 4
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x20000005
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_HttpQueryInfoW
test eax, eax
jne 0x5d1a33
call fcn.00408b28
jmp 0x5d1ab2
xor ebx, ebx
lea eax, [ebp - 0x28]
push eax
push 0x802
lea eax, [ebp - 0x82e]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x5d1a6e
cmp dword [ebp - 0x28], 0
je 0x5d1a6e
lea edx, [ebp - 0x82e]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0x10]
add ebx, dword [ebp - 0x28]
jmp 0x5d1a35
mov esi, 0xfffffffa
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
je 0x5d1a81
call fcn.00408b28
jmp 0x5d1ab2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d1ab0
mov eax, dword [ebp - 0x1c]
call fcn.004066fc
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d1adf
lea eax, [ebp - 0x834]
call fcn.004093e4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409444
ret
Function at 0x5d1f48
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004094c8
mov eax, dword [ebp - 8]
call fcn.004094c8
mov eax, dword [ebp - 0xc]
call fcn.004094c8
xor eax, eax
push ebp
push 0x5d20b1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 8]
call fcn.0040a034
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x5d2096
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetFileSize
mov esi, eax
mov eax, esi
call fcn.004066e0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5d208b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x1c]
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_ReadFile
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5d1ffb
call fcn.00408b28
jmp 0x5d2096
push 0
mov eax, dword [ebp - 4]
call fcn.0040a034
push eax
call sub.kernel32.dll_BeginUpdateResourceW
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5d2065
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
mov eax, dword [ebp - 0x10]
push eax
push 0x800
mov eax, dword [ebp - 0xc]
call fcn.0040a034
push eax
push 0xa
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UpdateResourceW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x1d], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d206c
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_EndUpdateResourceW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x1d], al
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d20b8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409444
ret
Function at 0x5d33c8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004094c8
mov eax, dword [ebp - 8]
call fcn.004094c8
xor eax, eax
push ebp
push 0x5d34ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
push ebp
push 0x5d348f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0xa
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005d1db8
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040a128
mov eax, dword [ebp - 0x10]
call fcn.005d29a0
test eax, eax
je 0x5d3469
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edx, 0x5d3510
call fcn.0040a288
mov eax, dword [ebp - 0x14]
call fcn.005d2a74
mov eax, dword [ebp - 4]
call fcn.0040a034
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5d34bf
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x5d3534
call fcn.0040a288
mov eax, dword [ebp - 0x18]
call fcn.005d2a74
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5d34bf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d34f6
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00409444
lea eax, [ebp - 0x10]
call fcn.0040942c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409444
ret

Function at 0x5d39e4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004094c8
mov eax, dword [ebp - 8]
call fcn.004094c8
mov eax, dword [ebp + 8]
call fcn.004094c8
xor eax, eax
push ebp
push 0x5d3b0a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x14]
mov eax, 0x5d3b20
call fcn.005d1644
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.0040a114
mov eax, dword [ebp - 0xc]
call fcn.0040a034
push eax
call sub.kernel32.dll_DeleteFileW
mov dl, 1
mov eax, dword [0x48f8b4]
call fcn.004b3ae8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5d3ac3
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0042d46c
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0x70]
call fcn.0042e7fc
mov ecx, eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0x84]
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.0040a128
mov eax, dword [ebp - 0x18]
call fcn.005d2900
test eax, eax
je 0x5d3aad
call fcn.00408b28
jmp 0x5d3ada
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d3aca
mov eax, dword [ebp - 0x10]
call fcn.004076bc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d3b11
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004094a4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409444
lea eax, [ebp + 8]
call fcn.004093e4
ret