joyce8/EMBER2024-capa huggingface dataset:
Function at 0x546a7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 0x18]
mov ecx, dword [edx]
cmp ecx, dword [ebp - 8]
jae 0x546ae1
push dword [ebp + 0x10]
push edi
mov eax, dword [ebp - 0xc]
add eax, ebx
add eax, 0x28
push eax
call fcn.005478d8
add esp, 0xc
mov edx, dword [ebp + 0x10]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 0x18]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x546bc4
cmp esi, edi
jne 0x546aef
mov eax, 0x1001
jmp 0x546bc4
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
push edx
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.005478d8
add esp, 0xc
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
add edi, eax
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
sub dword [ebp + 0x10], edx
lea ecx, [ebx + 0x18]
push ecx
push dword [ebp - 4]
call fcn.005440da
add esp, 8
mov eax, dword [ebx + 0x18]
xor eax, dword [ebx + 0x28]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
xor edx, dword [ebx + 0x2c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
xor ecx, dword [ebx + 0x30]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
xor eax, dword [ebx + 0x34]
mov dword [esi + 0xc], eax
add esi, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
jb 0x546b9b
lea ecx, [ebx + 0x18]
push ecx
push dword [ebp - 4]
call fcn.005440da
add esp, 8
mov eax, dword [edi]
xor eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [edi + 4]
xor edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [edi + 8]
xor ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [edi + 0xc]
xor eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
add edi, dword [ebp - 8]
add esi, dword [ebp - 8]
mov edx, dword [ebp - 8]
sub dword [ebp + 0x10], edx
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jae 0x546b56
push dword [ebp + 0x10]
push edi
lea eax, [ebx + 0x28]
push eax
call fcn.005478d8
add esp, 0xc
mov edx, dword [ebx + 0x38]
and edx, 0xf0000000
add edx, dword [ebp + 0x10]
mov dword [ebx + 0x38], edx
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
sub dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x546bcb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 0x18]
mov ecx, dword [edx]
cmp ecx, dword [ebp - 8]
jae 0x546c2e
push dword [ebp + 0x10]
push edi
mov eax, dword [ebp - 0xc]
add eax, ebx
add eax, 0x28
push eax
call fcn.005478d8
add esp, 0xc
mov edx, dword [ebp + 0x10]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 0x18]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x546d28
cmp esi, edi
jne 0x546c3c
mov eax, 0x1001
jmp 0x546d28
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
push edx
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.005478d8
add esp, 0xc
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
add edi, eax
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
sub dword [ebp + 0x10], edx
lea ecx, [ebx + 0x18]
push ecx
push dword [ebp - 4]
call fcn.005440da
add esp, 8
mov eax, dword [ebx + 0x28]
xor dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x2c]
xor dword [ebx + 0x1c], edx
mov ecx, dword [ebx + 0x30]
xor dword [ebx + 0x20], ecx
mov eax, dword [ebx + 0x34]
xor dword [ebx + 0x24], eax
mov edx, dword [ebx + 0x18]
mov dword [esi], edx
mov ecx, dword [ebx + 0x1c]
mov dword [esi + 4], ecx
mov eax, dword [ebx + 0x20]
mov dword [esi + 8], eax
mov edx, dword [ebx + 0x24]
mov dword [esi + 0xc], edx
add esi, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jb 0x546d00
lea eax, [ebx + 0x18]
push eax
push dword [ebp - 4]
call fcn.005440da
add esp, 8
mov edx, dword [edi]
xor dword [ebx + 0x18], edx
mov ecx, dword [edi + 4]
xor dword [ebx + 0x1c], ecx
mov eax, dword [edi + 8]
xor dword [ebx + 0x20], eax
mov edx, dword [edi + 0xc]
xor dword [ebx + 0x24], edx
mov ecx, dword [ebx + 0x18]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
mov dword [esi + 0xc], ecx
add edi, dword [ebp - 8]
add esi, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub dword [ebp + 0x10], eax
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
jae 0x546caf
push dword [ebp + 0x10]
push edi
lea ecx, [ebx + 0x28]
push ecx
call fcn.005478d8
add esp, 0xc
mov eax, dword [ebx + 0x38]
and eax, 0xf0000000
add eax, dword [ebp + 0x10]
mov dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
sub dword [edx], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x546ea9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], 0x10
mov esi, dword [ebx + 0x38]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
lea edx, [ebx + 0x18]
push edx
push eax
call fcn.005440da
add esp, 8
xor eax, eax
cmp esi, eax
jbe 0x546eee
mov cl, byte [ebx + eax + 0x28]
xor cl, byte [ebx + eax + 0x18]
mov byte [edi + eax], cl
inc eax
cmp esi, eax
ja 0x546ede
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x54732c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
ja 0x547390
push dword [ebp + 0x10]
push edi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.005478d8
add esp, 0xc
mov eax, dword [ebp + 0x10]
add dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
xor ecx, ecx
mov dword [edx], ecx
xor eax, eax
jmp 0x54747d
cmp edi, esi
jne 0x54739e
mov eax, 0x1001
jmp 0x54747d
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
push eax
push edi
mov edx, dword [ebp - 0xc]
add edx, ebx
add edx, 0x28
push edx
call fcn.005478d8
add esp, 0xc
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
add edi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
sub dword [ebp + 0x10], eax
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.005440da
add esp, 8
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [esi + 0xc], ecx
add esi, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jbe 0x547455
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.005440da
add esp, 8
mov ecx, dword [edi]
xor ecx, dword [ebx + 0x18]
mov dword [esi], ecx
mov eax, dword [edi + 4]
xor eax, dword [ebx + 0x1c]
mov dword [esi + 4], eax
mov edx, dword [edi + 8]
xor edx, dword [ebx + 0x20]
mov dword [esi + 8], edx
mov ecx, dword [edi + 0xc]
xor ecx, dword [ebx + 0x24]
mov dword [esi + 0xc], ecx
add edi, dword [ebp - 8]
add esi, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub dword [ebp + 0x10], eax
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
ja 0x547410
push dword [ebp + 0x10]
push edi
lea ecx, [ebx + 0x28]
push ecx
call fcn.005478d8
add esp, 0xc
mov eax, dword [ebx + 0x38]
and eax, 0xf0000000
add eax, dword [ebp + 0x10]
mov dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
sub dword [edx], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x547484
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
ja 0x5474e8
push dword [ebp + 0x10]
push esi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.005478d8
add esp, 0xc
mov eax, dword [ebp + 0x10]
add dword [ebx + 0x38], eax
mov edx, dword [ebp + 0x18]
xor ecx, ecx
mov dword [edx], ecx
xor eax, eax
jmp 0x547605
cmp esi, edi
jne 0x5474f6
mov eax, 0x1001
jmp 0x547605
mov edx, dword [ebp - 0xc]
add edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
push eax
push esi
mov edx, dword [ebp - 0xc]
add edx, ebx
add edx, 0x28
push edx
call fcn.005478d8
add esp, 0xc
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
add esi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
sub dword [ebp + 0x10], eax
lea edx, [ebx + 0x18]
push edx
push dword [ebp - 4]
call fcn.005440da
add esp, 8
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [edi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [edi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [edi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [edi + 0xc], ecx
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x2c]
mov dword [ebx + 0x1c], edx
mov ecx, dword [ebx + 0x30]
mov dword [ebx + 0x20], ecx
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x24], eax
add edi, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 8]
jbe 0x5475dc
lea ecx, [ebx + 0x18]
push ecx
push dword [ebp - 4]
call fcn.005440da
add esp, 8
mov eax, dword [ebx + 0x18]
xor eax, dword [esi]
mov dword [edi], eax
mov edx, dword [ebx + 0x1c]
xor edx, dword [esi + 4]
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0x20]
xor ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov eax, dword [ebx + 0x24]
xor eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov edx, dword [esi]
mov dword [ebx + 0x18], edx
mov ecx, dword [esi + 4]
mov dword [ebx + 0x1c], ecx
mov eax, dword [esi + 8]
mov dword [ebx + 0x20], eax
mov edx, dword [esi + 0xc]
mov dword [ebx + 0x24], edx
add esi, dword [ebp - 8]
add edi, dword [ebp - 8]
mov ecx, dword [ebp - 8]
sub dword [ebp + 0x10], ecx
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
ja 0x547580
push dword [ebp + 0x10]
push esi
lea edx, [ebx + 0x28]
push edx
call fcn.005478d8
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp + 0x10]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5477dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov esi, dword [ebx + 0x38]
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
lea ecx, [ebx + 0x18]
push ecx
push eax
call fcn.005440da
add esp, 8
xor eax, eax
cmp esi, eax
jbe 0x547816
mov dl, byte [ebx + eax + 0x28]
xor dl, byte [ebx + eax + 0x18]
mov byte [edi + eax], dl
inc eax
cmp esi, eax
ja 0x547806
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x558b18
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebx
push esi
add esp, 0xfffffe5c
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, 0x12
mov eax, esi
call fcn.00484c40
mov eax, esp
xor ecx, ecx
mov edx, 0x14
call fcn.004836c0
push ebx
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x558b63
mov edx, esi
mov eax, esp
call fcn.0048a1bc
add esp, 0x1a4
pop esi
pop ebx
ret

Function at 0x5590e0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd38
push ebx
xor ecx, ecx
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 0x2a4], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00485100
xor eax, eax
push ebp
push 0x55924b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1a0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x55921e
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x2a4]
call fcn.00558b18
lea eax, [ebp - 0x2a0]
mov edx, dword [ebp - 4]
call fcn.0048a024
lea eax, [ebp - 0x2a0]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x559207
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x559201
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5591fb
lea eax, [ebp - 0x2a8]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
mov dword [ebp - 0x2c8], eax
mov byte [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 1]
mov dword [ebp - 0x2c0], eax
mov byte [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2b8], eax
mov byte [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 3]
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 0x2ac], 0
lea edx, [ebp - 0x2c8]
mov ecx, 3
mov eax, 0x559264
call fcn.0048a6d4
mov edx, dword [ebp - 0x2a8]
mov eax, ebx
call fcn.00484c94
mov byte [ebp - 5], 1
jmp 0x55920b
mov byte [ebp - 5], 0
jmp 0x55920b
mov byte [ebp - 5], 0
jmp 0x55920b
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x559225
call sub.wsock32.dll_WSACleanup
ret
Function at 0x55d7f0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00485100
xor eax, eax
push ebp
push 0x55d926
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.00489100
mov edx, dword [ebp - 0x30]
mov eax, 0x55d93c
call fcn.00485254
test eax, eax
jne 0x55d847
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x55d93c
call fcn.00484f5c
xor ebx, ebx
push 0
push 0
push 0
push 0
push 0x55d944
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x55d903
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00485110
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0xa
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x13
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_HttpQueryInfoA
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x18]
call fcn.00484e48
mov eax, dword [ebp - 0x34]
mov edx, 0x55d95c
call fcn.0048505c
je 0x55d8e9
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x18]
call fcn.00484e48
mov eax, dword [ebp - 0x38]
mov edx, 0x55d968
call fcn.0048505c
je 0x55d8e9
xor ebx, ebx
jmp 0x55d8eb
mov bl, 1
cmp dword [ebp - 0xc], 0
je 0x55d8fa
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d92d
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00484c64
lea eax, [ebp - 4]
call fcn.00484c40
ret

Function at 0x55e924
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x55e939
or edx, 0x200
test eax, 0x20000000
je 0x55e96c
test eax, 0x40000000
je 0x55e958
test eax, 0x80000000
je 0x55e953
or edx, 0x40
jmp 0x55e993
or edx, 0x20
jmp 0x55e993
test eax, 0x80000000
je 0x55e967
or edx, 0x80
jmp 0x55e993
or edx, 0x10
jmp 0x55e993
test eax, 0x40000000
je 0x55e984
test eax, 0x80000000
je 0x55e97f
or edx, 4
jmp 0x55e993
or edx, 2
jmp 0x55e993
test eax, 0x80000000
je 0x55e990
or edx, 8
jmp 0x55e993
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x560638
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004854dc
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x560651
test al, 0x10
jne 0x560655
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x560980
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004856c0
xor eax, eax
push ebp
push 0x560aa9
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004855a8
je 0x560a79
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005605cc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004853bc
mov eax, dword [ebp - 4]
call fcn.00560638
test al, al
jne 0x560a79
mov eax, dword [ebp - 4]
call fcn.004854ec
cmp eax, 3
jl 0x560a79
mov eax, dword [ebp - 4]
call fcn.00560638
test al, al
jne 0x560a79
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00484ed8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00489d04
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.004854cc
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004855a8
je 0x560a79
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00560550
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.00560980
test al, al
je 0x560a58
push 0
mov eax, dword [ebp - 4]
call fcn.004854dc
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x560a5c
xor ebx, ebx
jmp 0x560a5e
mov bl, 1
test bl, bl
je 0x560a79
test si, si
jbe 0x560a79
movzx eax, si
push eax
mov eax, dword [ebp - 4]
call fcn.004854dc
push eax
call sub.kernel32.dll_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x560ab0
lea eax, [ebp - 0x18]
call fcn.0048535c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00484c64
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00485374
ret
Function at 0x5631a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x14
add esp, 0xfffff004
push eax
dec eax
jne 0x5631a9
mov eax, dword [ebp - 4]
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14018], ecx
mov dword [ebp - 0x1401c], ecx
mov dword [ebp - 0x14008], edx
mov ebx, eax
lea eax, [ebp - 0x14008]
call fcn.004856c0
xor eax, eax
push ebp
push 0x5633c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x14009], 0
lea edx, [ebp - 0x1401c]
mov eax, dword [ebp - 0x14008]
call fcn.005607c4
mov eax, dword [ebp - 0x1401c]
lea edx, [ebp - 0x14018]
call fcn.00560ab8
mov eax, dword [ebp - 0x14018]
mov edx, 0x5633dc
call fcn.004855a8
jne 0x563398
mov dword [ebx + 0x9f], 0
mov dword [ebx + 0xa3], 0
mov byte [ebx + 0x9e], 0
push 0
push 3
push 0
push 0
mov eax, dword [ebp - 0x14008]
call fcn.004854dc
mov ecx, 1
mov edx, 0x80000000
call fcn.00560b7c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x563391
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00560c10
mov dword [ebp - 0x14010], eax
push 0
push 0x10000
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00560c10
push 0
lea eax, [ebp - 0x14014]
push eax
push 0x14000
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
mov edi, dword [ebp - 0x14014]
sub edi, 6
test edi, edi
jb 0x563307
inc edi
xor esi, esi
push ebp
mov eax, esi
call fcn.00563168
pop ecx
mov byte [ebx + 0x9e], al
cmp byte [ebx + 0x9e], 0
je 0x563303
lea eax, [esi + 0x10000]
xor edx, edx
mov dword [ebx + 0x9f], eax
mov dword [ebx + 0xa3], edx
mov byte [ebp - 0x14009], 1
jmp 0x563307
inc esi
dec edi
jne 0x5632ce
cmp byte [ebx + 0x9e], 0
jne 0x56337b
push ebp
call fcn.00563078
pop ecx
mov esi, eax
cmp esi, dword [ebp - 0x14010]
je 0x56337b
mov eax, esi
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00560c10
push 0
lea eax, [ebp - 0x14014]
push eax
push 6
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
push ebp
xor eax, eax
call fcn.00563168
pop ecx
mov byte [ebx + 0x9e], al
cmp byte [ebx + 0x9e], 0
je 0x56337b
mov eax, esi
xor edx, edx
mov dword [ebx + 0x9f], eax
mov dword [ebx + 0xa3], edx
mov byte [ebp - 0x14009], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x563398
mov eax, dword [ebp - 4]
call fcn.004898cc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5633c8
lea eax, [ebp - 0x1401c]
mov edx, 2
call fcn.00485374
lea eax, [ebp - 0x14008]
call fcn.0048535c
ret