joyce8/EMBER2024-capa huggingface dataset:
Function at 0x500be0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp eax, dword [0x60c5b8]
ja 0x500e12
cmp byte [0x60c1a0], 0
jne 0x500d7b
push 1
push 0x23
push 0x60c3b0
push 0
mov byte [0x60c1a0], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x500d7b
push str.McAfee_
push 0x104
push 0x60c3b0
call fcn.004734a0
push 1
push 0x60c3b0
call fcn.00507a70
add esp, 8
push 0
push 0x60c3b0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x500c89
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x500d4e
push 0x60c1a8
push 0x104
push 0x60c3b0
call fcn.004734a0
push 1
push 0x60c3b0
call fcn.00507a70
add esp, 8
push 0
push 0x60c3b0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x500cce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x500d4e
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005561e0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x60c1a4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x500d67
push 0x5c
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
push eax
push 0x104
push 0x60c3b0
call fcn.004734a0
push 1
push 0x60c3b0
call fcn.00507a70
add esp, 8
push 0
push 0x60c3b0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x500d67
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x500d67
pop edi
xor eax, eax
pop esi
mov word [0x60c3b0], ax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret
push str.log.txt
push 0x104
push 0x60c3b0
call fcn.004734a0
cmp word [0x60c3b0], 0
je 0x500e12
push 0x5a3950
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push 0x60c3b0
push eax
call fcn.0056638e
mov eax, dword [ebp - 0x210]
add esp, 0xc
test eax, eax
je 0x500e12
test edi, edi
je 0x500de3
test ebx, ebx
je 0x500de3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp + 0x14]
push ebx
push edi
push eax
push str._r_n_u_tFile:_s_tFunction:_s_tLine:_d_t
push dword [ebp - 0x210]
call fcn.00500e30
mov eax, dword [ebp - 0x210]
add esp, 0x18
test esi, esi
je 0x500e09
push dword [ebp - 0x214]
push 0
push esi
push eax
call fcn.00421140
push dword [eax + 4]
push dword [eax]
call fcn.0055e5f5
mov eax, dword [ebp - 0x210]
add esp, 0x18
push eax
call fcn.0056651c
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00553d2a
mov esp, ebp
pop ebp
ret
Function at 0x501610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push str.kernel32.dll
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x20c], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x50179c
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x50179c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x50179c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
test ecx, ecx
je 0x50179c
cmp word [ecx + 4], 0
jne 0x50179c
cmp dword [ecx + 0x28], 0xfeef04bd
jne 0x50179c
movzx eax, word [ecx + 0x32]
movzx ebx, word [ecx + 0x30]
movzx esi, word [ecx + 0x34]
push edi
movzx edi, word [ecx + 0x36]
push 0x200
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.005561e0
push esi
push edi
push ebx
push dword [ebp - 0x20c]
lea eax, [ebp - 0x204]
push str._d._d._d._d
push 0x100
push eax
call fcn.004350a0
add esp, 0x28
test eax, eax
jns 0x50175b
push str.Failed_to_format_version
push 0xb0
push str.XMLUpdater::v2::CSubstitutionManager::GetOsVersion
push str.E:BT71e4c9fa_1978_4386_a3da_49ea31fa22b7WebAdvisor_XmlUpdater_srcXmlUpdaterSubstitutionManager.cpp
push 1
call fcn.00500e60
mov esi, dword [ebp - 0x208]
add esp, 0x14
mov edx, dword [str._UNKNOWN]
xor eax, eax
mov ecx, edx
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
lea edi, [ecx + 2]
mov word [esi], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x501730
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00425790
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x208]
lea ecx, [ebp - 0x204]
xor eax, eax
lea edx, [ecx + 2]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x501783
sub ecx, edx
lea eax, [ebp - 0x204]
sar ecx, 1
push ecx
push eax
jmp 0x501741
push str.Failed_to_retrieve_kernel_verison
push 0xa9
push str.XMLUpdater::v2::CSubstitutionManager::GetOsVersion
push str.E:BT71e4c9fa_1978_4386_a3da_49ea31fa22b7WebAdvisor_XmlUpdater_srcXmlUpdaterSubstitutionManager.cpp
push 1
call fcn.00500e60
mov edx, dword [str._UNKNOWN]
add esp, 0x14
mov ecx, edx
mov dword [ebx], 0
xor eax, eax
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5017e0
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, ebx
call fcn.00425790
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00553d2a
mov esp, ebp
pop ebp
ret
Function at 0x5070f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
mov ecx, esi
push edi
mov edi, dword [ebp + 0x1c]
push 0x5bb418
mov dword [ebp - 8], eax
call fcn.00424550
push 0x5bb418
mov ecx, edi
call fcn.00424550
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x50719b
test al, 0x10
je 0x50719b
lea eax, [ebp + 0x20]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x30], eax
xor esi, esi
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edi
test esi, esi
lea ecx, [ebp - 0x30]
setne al
movzx eax, al
push eax
call fcn.005064a0
test al, al
jne 0x5071bb
inc esi
cmp esi, 2
jl 0x507170
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret
push str.Destination_directory_does_not_exist
push 0xc3
push str.XMLUpdater::v2::NHttp::NDownloadFile::StoreOnDisk
push str.E:BT71e4c9fa_1978_4386_a3da_49ea31fa22b7WebAdvisor_XmlUpdater_srcXmlUpdaterHttpsDownloadFile.cpp
push 1
call fcn.00500e60
add esp, 0x14
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00553d2a
mov esp, ebp
pop ebp
ret
Function at 0x5079a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x507a52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x507a52
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005561e0
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0056036b
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00556905
add esp, 0x20
test eax, eax
je 0x507a14
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
call fcn.005079a0
add esp, 4
test al, al
jne 0x507a38
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x507a52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x507a27
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00553d2a
mov esp, ebp
pop ebp
ret
Function at 0x507a70
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59988b
mov eax, dword fs:[0]
push eax
sub esp, 0x2b0
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x288]
push eax
push esi
mov dword [ebp - 0x290], esi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x28c], eax
cmp eax, 0xffffffff
jne 0x507ae4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x507be0
cmp eax, 2
je 0x507be0
xor eax, eax
jmp 0x507be2
lea eax, [ebp - 0x28c]
mov dword [ebp - fcn.00508360], vtable.std::_Func_impl_no_alloc_class__lambda_252d799ae44bac8497403b9d9837b673___void___.0
mov dword [ebp - 0x2b8], eax
lea eax, [ebp - 0x2bc]
mov dword [ebp - 0x298], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
mov dword [ebp - 0x294], eax
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x2bc]
mov byte [ebp - 4], 1
call fcn.00508360
mov ecx, dword [ebp - 0x298]
mov edi, eax
mov dword [ebp - 0x14], edi
test ecx, ecx
je 0x507b66
mov eax, dword [ecx]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 0x2bc]
cmp ecx, eax
mov ecx, esi
setne al
push eax
call dword [0x5a0478]
mov ecx, dword [ebp - 0x298]
call esi
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x290]
test dword [ebp - 0x288], 0x400
je 0x507ba0
mov eax, dword [ebp - 0x264]
cmp eax, 0xa0000003
je 0x507b86
cmp eax, 0xa000000c
jne 0x507ba0
cmp byte [ebp + 0xc], 0
push esi
je 0x507b95
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x507b9b
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp - 0x14]
mov ebx, eax
mov dword [ebp - 4], 2
test edi, edi
je 0x507be0
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x5a0478]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x507be0
mov esi, dword [edi]
lea eax, [ebp - 0x38]
cmp edi, eax
setne al
mov esi, dword [esi + 0x10]
mov ecx, esi
movzx eax, al
push eax
call dword [0x5a0478]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret
Function at 0x5104b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
jb 0x5104be
mov eax, dword [eax]
push esi
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [str.FALSE]
test eax, eax
mov esi, dword [ebp + 8]
cmovne edx, dword [str.TRUE]
xor eax, eax
mov ecx, edx
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
lea edi, [ecx + 2]
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5104f7
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00425790
pop edi
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x51b3e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b720
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, dword [edi + 4]
mov dword [ebp - 4], 0
test esi, esi
je 0x51b473
cmp dword [esi], 0
je 0x51b468
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x51b48e
push str.CreateFileTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x51b46e
push 0
push 0
push dword [esi]
mov ecx, eax
push 0
push 0x80
push 3
push 0
push 1
push 1
push ebx
call dword [0x5a0478]
call dword [ebp - 0x14]
jmp 0x51b489
cmp dword [esi + 4], 0
jne 0x51b473
or eax, 0xffffffff
jmp 0x51b489
push 0
push 0x80
push 3
push 0
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x51b495
call fcn.0051ab50
jmp 0x51b499
mov dword [edi], eax
xor eax, eax
mov dword [ebp - 4], 0xffffffff
test eax, eax
jns 0x51b4cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5a9200
push 0x32
push str.XMLUpdater::v2::CFileMemMap::Init
push str.E:BT71e4c9fa_1978_4386_a3da_49ea31fa22b7WebAdvisor_XmlUpdater_srcXmlUpdaterFileMemMap.h
push 1
call fcn.00500e60
add esp, 0x18
xor al, al
jmp 0x51b56e
mov esi, dword [edi]
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, eax
mov dword [edi + 0x10], ecx
test ecx, ecx
jne 0x51b500
call fcn.0051ab50
mov esi, eax
jmp 0x51b549
mov eax, dword [ebp - 0x18]
push 0
push eax
push 0
push 0
push 4
push ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x20], 4
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [edi + 8], eax
test eax, eax
jne 0x51b56c
call fcn.0051ab50
push dword [edi + 0x10]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], 0
test esi, esi
jns 0x51b56c
push str.Failed_to_map_file_to_memory
push 0x38
push str.XMLUpdater::v2::CFileMemMap::Init
push str.E:BT71e4c9fa_1978_4386_a3da_49ea31fa22b7WebAdvisor_XmlUpdater_srcXmlUpdaterFileMemMap.h
push 1
call fcn.00500e60
add esp, 0x14
xor al, al
jmp 0x51b56e
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret 4
Function at 0x51dd20
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 4]
mov dword [esi], vtable.XMLUpdater::v2::CMD5Checksum.0
push eax
call fcn.005561e0
add esp, 0xc
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov eax, esi
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
pop esi
ret

Function at 0x51ece0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ecx + 8]
test edi, edi
je 0x51ed67
test esi, esi
je 0x51ed67
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.005561e0
add esp, 0xc
mov dword [ebp - 0x88], 0x7f
lea eax, [ebp - 0x88]
push 0
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push 5
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x51ed67
lea eax, [ebp - 0x84]
push eax
call fcn.0056010a
add esp, 4
mov dword [esi], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00553d2a
mov esp, ebp
pop ebp
ret 4

Function at 0x51ed80
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ecx + 8]
test esi, esi
je 0x51edf8
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.005561e0
add esp, 0xc
mov dword [ebp - 0x108], 0xff
lea eax, [ebp - 0x108]
push 0
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0x13
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x51edf8
lea eax, [ebp - 0x104]
push eax
call fcn.0056010a
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00553d2a
mov esp, ebp
pop ebp
ret
Function at 0x51f590
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x598290
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x61094c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
push 8
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.std::basic_streambuf_unsigned_char__struct_std::char_traits_unsigned_char__.0
call fcn.00553f41
mov edi, eax
add esp, 4
test edi, edi
je 0x51f5f6
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0053eefa
add esp, 4
mov dword [edi + 4], eax
jmp 0x51f5f8
xor edi, edi
mov eax, dword [ebp - 0x10]
lea ebx, [esi + 4]
mov dword [ebp - 0x18], ebx
lea edx, [esi + 8]
mov ebx, dword [ebp - 0x10]
lea ecx, [esi + 0x18]
mov dword [esi + 0x34], edi
lea edi, [esi + 0x14]
mov dword [ebp - 0x14], edx
add esi, 0x24
mov edx, dword [ebp - 0x10]
add eax, 0x28
mov dword [ebx], vtable.std::basic_filebuf_unsigned_char__struct_std::char_traits_unsigned_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x18]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x18]
mov dword [edx], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [eax + 0x4c], 0
mov ecx, dword [0x61e9e8]
mov edx, dword [0x61e9ec]
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5234a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edi
test eax, eax
jg 0x5234cc
jl 0x5234c0
test ecx, ecx
jne 0x5234cc
pop edi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
push esi
je 0x52358c
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, ebx
call fcn.00425540
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x523533
jg 0x5234f8
test esi, esi
je 0x523533
mov ecx, dword [ebp - 4]
cmp ecx, eax
jg 0x52350d
mov eax, dword [ebp - 8]
jl 0x523508
cmp eax, esi
jae 0x52350d
mov esi, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.00555c60
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
sub ecx, esi
sbb edx, dword [ebp - 0xc]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x52355c
mov eax, dword [ebx]
mov esi, dword [eax + 0x1c]
mov ecx, esi
call dword [0x5a0478]
mov ecx, ebx
call esi
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x523576
mov ecx, dword [ebp - 8]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
test edx, edx
jg 0x5234e0
jl 0x523576
test ecx, ecx
jne 0x5234e0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
pop esi
sbb ecx, edx
pop edi
mov edx, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x5235c9
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x5235c9
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00555c60
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x52363b
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x5235ef
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [ebp - 4]
mov ecx, edi
cmp edi, 0xfff
jbe 0x523624
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0056a572
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x52364f
cmp edi, eax
ja 0x523600
test ecx, ecx
je 0x52363b
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0056a572
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x525390
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c3f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
movzx eax, word [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], eax
mov dword [esi], 0
lea edi, [esi + 4]
mov dword [ebp - 4], 0
mov dword [edi], 0
push 0
push 0
push 0
push 4
push str.Simple_HttpFetcher_1.1
mov byte [ebp - 4], 1
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
lea ecx, [ebp - 0x1c]
cmp esi, ecx
je 0x52540c
mov ecx, dword [esi]
mov dword [esi], eax
test ecx, ecx
je 0x525417
push ecx
jmp 0x525411
test eax, eax
je 0x525417
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, dword [esi]
test eax, eax
je 0x5254d2
push 4
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0xaa0
push ecx
push 0x54
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x52545c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00521ea0
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.WinHttp:_Failed_to_set_secure_protocols
jmp 0x5254ee
cmp dword [ebx + 0x14], 8
jb 0x525464
mov ebx, dword [ebx]
push 0
push dword [ebp - 0x18]
push ebx
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
lea ecx, [ebp - 0x1c]
cmp edi, ecx
je 0x525484
mov ecx, dword [edi]
mov dword [edi], eax
test ecx, ecx
je 0x52548f
push ecx
jmp 0x525489
test eax, eax
je 0x52548f
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp dword [edi], 0
jne 0x5254b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00521ea0
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.WinHttp:_Failed_to_connect_to_host
jmp 0x5254ee
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00521ea0
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.WinHttp:_Failed_to_create_session
push esi
push eax
lea ecx, [ebp - 0x2c]
call fcn.0051fda0
push 0x608ef0
lea eax, [ebp - 0x2c]
push eax
call fcn.00555bec
int3