joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52ae60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f3878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push ecx
lea eax, [esp + 0x3c]
xor edi, edi
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
mov dword [esp + 0x20], edi
call fcn.005c3604
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x30]
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x44]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x48]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x38]
push edx
mov ecx, esi
call fcn.00508a20
lea ebx, [esi + 0x180]
mov eax, 1
mov ecx, eax
mov edx, eax
mov dword [ebx], eax
mov dword [esi + 0x194], edi
mov dword [esi + 0x17c], edi
mov dword [esi + 0x178], edi
mov dword [ebx + 4], ecx
mov edi, eax
lea ecx, [esp + 0x38]
mov dword [esi], 0x1d877b8
mov dword [ebx + 8], edx
mov dword [esi + 0x190], 5
mov dword [esi + 0x198], 2
mov dword [esp + 0x18], 0xffffffff
mov dword [ebx + 0xc], edi
call fcn.005c388f
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x1c

Function at 0x5390a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f425a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x20], 0
call fcn.0051a710
mov ebx, 1
push 0x2c
mov byte [esp + 0x18], bl
mov dword [esi], 0x1d89844
mov dword [esi + 0x8c], 5
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], ebx
mov dword [esi + 0x84], ebx
call fcn.005c35d0
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x53912b
mov ecx, eax
call fcn.00555560
jmp 0x53912d
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x88], eax
mov byte [esp + 0x14], bl
mov edx, dword [ecx - 8]
test edx, edx
je 0x53914a
push ecx
mov ecx, eax
call fcn.00555700
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], 0xffffffff
call fcn.005c388f
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x539b10
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4378
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], esp
call fcn.005e32e7
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.005e3601
test eax, eax
je 0x539cbb
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.005e35c3
test eax, eax
je 0x539cbb
call fcn.005c95d0
test eax, eax
je 0x539b76
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x539b78
xor eax, eax
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x539cbb
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x539c89
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [ebp - 0x20]
mov edi, eax
call fcn.005c3f50
mov esi, dword [ebp + 8]
mov byte [ebp - 4], 2
movsx ax, byte [edi]
test ax, ax
je 0x539c7d
cmp ax, 0x7f
jbe 0x539be0
push eax
mov ecx, esi
call fcn.005c3c92
movsx ax, byte [edi + 1]
inc edi
push eax
mov ecx, esi
call fcn.005c3c92
inc edi
jmp 0x539bb4
cmp ax, 0x20
jae 0x539bec
cmp ax, 0xd
jne 0x539c00
push eax
mov ecx, esi
call fcn.005c3c92
push 0
mov ecx, esi
call fcn.005c3c92
inc edi
jmp 0x539bb4
cmp ax, 9
jne 0x539bdd
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x539c49
push 0x1de4b3c
lea ecx, [ebp - 0x14]
call fcn.005c38fd
lea ecx, [ebp - 0x14]
push 0
push ecx
mov byte [ebp - 4], 3
call fcn.00539dd0
add esp, 8
lea edx, [ebp - 0x14]
mov ecx, esi
push edx
call fcn.005c3ca7
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.005c388f
inc edi
jmp 0x539bb4
push 9
mov ecx, esi
call fcn.005c3c92
push 0
mov ecx, esi
call fcn.005c3c92
inc edi
jmp 0x539bb4
mov dword [ebp - 4], 0
call fcn.005c3f8e
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.005e3314
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.005e3314
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x543bb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f52f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x1de1e58]
push ebx
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
mov dword [esp + 0x28], ebx
call fcn.005c0a07
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.005c0a1a
mov eax, dword [eax + 0x14]
add eax, 0x76c
push eax
lea eax, [esp + 0x10]
push 0x1d7b4fc
push eax
call fcn.005bfb4f
mov ecx, dword [esp + 0x3c]
add esp, 0xc
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.005c3604
lea eax, [esp + 0x38]
push eax
call fcn.0053ec60
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.005c39c8
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.005c388f
mov ecx, dword [0x1de1e58]
mov dword [esp + 8], ecx
push 0xa2ea
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.005ca387
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.005c3abe
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.005c39c8
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call fcn.005c388f
mov esi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.005c3604
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x24], bl
call fcn.005c388f
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.005c388f
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x543cf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f52f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x1de1e58]
push ebx
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
mov dword [esp + 0x28], ebx
call fcn.005c0a07
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.005c0a1a
mov eax, dword [eax + 0x10]
inc eax
push eax
lea eax, [esp + 0x10]
push 0x1d7b4fc
push eax
call fcn.005bfb4f
mov ecx, dword [esp + 0x3c]
add esp, 0xc
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.005c3604
lea eax, [esp + 0x38]
push eax
call fcn.0053ca60
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.005c39c8
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.005c388f
mov ecx, dword [0x1de1e58]
mov dword [esp + 8], ecx
push 0xa2eb
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.005ca387
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.005c3abe
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.005c39c8
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call fcn.005c388f
mov esi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.005c3604
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x24], bl
call fcn.005c388f
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.005c388f
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x543e30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f52f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x1de1e58]
push ebx
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
mov dword [esp + 0x28], ebx
call fcn.005c0a07
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.005c0a1a
mov eax, dword [eax + 0xc]
push eax
lea eax, [esp + 0x10]
push 0x1d7b4fc
push eax
call fcn.005bfb4f
mov ecx, dword [esp + 0x3c]
add esp, 0xc
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.005c3604
lea eax, [esp + 0x38]
push eax
call fcn.0053ca60
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.005c39c8
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.005c388f
mov ecx, dword [0x1de1e58]
mov dword [esp + 8], ecx
push 0xa2ec
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.005ca387
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.005c3abe
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.005c39c8
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call fcn.005c388f
mov esi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.005c3604
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x24], bl
call fcn.005c388f
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.005c388f
mov ecx, dword [esp + 0x1c]
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x5502a0
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5f6181
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x418
push ebx
push esi
push 0x1d791b0
mov ecx, 0x1e3d5dc
mov dword [esp + 0x1c], 0
call fcn.005c3a18
mov esi, dword [esp + 0x434]
lea ecx, [esp + 8]
push esi
call fcn.005c38fd
lea eax, [esp + 0xc]
mov ebx, 1
push 7
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x430], ebx
call fcn.005bf72f
lea ecx, [esp + 0xc]
mov byte [esp + 0x428], 2
call fcn.005c3dd8
mov ecx, dword [esp + 0xc]
push str.HTTP:__
push ecx
call fcn.004ac754
add esp, 8
test eax, eax
je 0x550353
push 0x1de5830
mov ecx, 0x1e3d5dc
call fcn.005c3a18
mov esi, dword [esp + 0x430]
push 0x1d791b0
mov ecx, esi
call fcn.005c38fd
mov dword [esp + 0x18], ebx
jmp 0x5504c2
push 0x2f
lea ecx, [esp + 0xc]
call fcn.005bf7a7
mov edx, dword [esp + 8]
mov ecx, dword [edx - 8]
sub ecx, eax
lea eax, [esp + 0x10]
dec ecx
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.005bf6b3
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x428], 3
mov eax, dword [ecx - 8]
test eax, eax
jne 0x5503b5
push 0x1de3e2c
mov ecx, 0x1e3d5dc
call fcn.005c3a18
mov esi, dword [esp + 0x430]
push 0x1d791b0
mov ecx, esi
call fcn.005c38fd
mov dword [esp + 0x18], ebx
jmp 0x5504b1
lea edx, [esp + 0x20]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x5503e5
mov esi, dword [esp + 0x430]
push 0x1d791b0
mov ecx, esi
call fcn.005c38fd
mov dword [esp + 0x18], ebx
jmp 0x5504b1
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
push eax
call fcn.005c38fd
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 4
push ecx
lea ecx, [esp + 0x18]
call fcn.005c3ca7
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.005da196
mov ecx, dword [eax + 4]
call fcn.005c9325
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push esi
push ecx
call fcn.00550050
add esp, 0xc
mov byte [esp + 0x428], 5
call fcn.005da196
mov ecx, dword [eax + 4]
call fcn.005c933a
mov edx, dword [esp + 0x1c]
mov eax, dword [edx - 8]
test eax, eax
je 0x550478
lea eax, [esp + 0x1c]
mov ecx, 0x1e3d5dc
push eax
call fcn.005c39c8
mov esi, dword [esp + 0x430]
push 0x1d791b0
mov ecx, esi
call fcn.005c38fd
jmp 0x55048b
mov esi, dword [esp + 0x430]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.005c3604
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov byte [esp + 0x428], 4
call fcn.005c388f
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 3
call fcn.005c388f
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 2
call fcn.005c388f
lea ecx, [esp + 0xc]
mov byte [esp + 0x428], bl
call fcn.005c388f
lea ecx, [esp + 8]
mov byte [esp + 0x428], 0
call fcn.005c388f
mov ecx, dword [esp + 0x420]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x424
ret
Function at 0x5506b0
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5f6277
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x424
push ebx
push esi
mov dword [esp + 0x10], 0
push 0x1d791b0
mov ecx, 0x1e3d5dc
mov dword [esp + 0x438], 4
call fcn.005c3a18
push 0x2f
lea ecx, [esp + 0x444]
call fcn.005bf7a7
mov ecx, dword [esp + 0x440]
lea edx, [esp + 8]
mov ecx, dword [ecx - 8]
sub ecx, eax
dec ecx
push ecx
push edx
lea ecx, [esp + 0x448]
call fcn.005bf6b3
mov eax, dword [esp + 8]
mov byte [esp + 0x434], 5
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x55075f
push 0x1de3e2c
mov ecx, 0x1e3d5dc
call fcn.005c3a18
mov esi, dword [esp + 0x43c]
push 0x1d791b0
mov ecx, esi
call fcn.005c38fd
mov ebx, 1
mov dword [esp + 0x10], ebx
jmp 0x5508e8
lea ecx, [esp + 0x2c]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x550794
mov esi, dword [esp + 0x43c]
push 0x1d791b0
mov ecx, esi
call fcn.005c38fd
mov ebx, 1
mov dword [esp + 0x10], ebx
jmp 0x5508e8
lea edx, [esp + 0x2c]
lea ecx, [esp + 0xc]
push edx
call fcn.005c38fd
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x438], 6
call fcn.005c3ca7
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.005da196
mov ecx, dword [eax + 4]
call fcn.005c9325
push ecx
lea edx, [esp + 0x450]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.005c3604
push ecx
lea eax, [esp + 0x450]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x440], 7
call fcn.005c3604
push ecx
lea edx, [esp + 0x450]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x444], 8
call fcn.005c3604
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
mov byte [esp + 0x448], 9
call fcn.005c3604
push ecx
lea edx, [esp + 0x454]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
mov byte [esp + 0x44c], 0xa
call fcn.005c3604
lea eax, [esp + 0x28]
mov byte [esp + 0x448], 6
push eax
call fcn.00550500
add esp, 0x18
mov byte [esp + 0x434], 0xb
call fcn.005da196
mov ecx, dword [eax + 4]
call fcn.005c933a
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 8]
test eax, eax
je 0x5508aa
lea edx, [esp + 0x14]
mov ecx, 0x1e3d5dc
push edx
call fcn.005c39c8
mov esi, dword [esp + 0x43c]
push 0x1d791b0
mov ecx, esi
call fcn.005c38fd
jmp 0x5508bd
mov esi, dword [esp + 0x43c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.005c3604
mov ebx, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x434], 6
call fcn.005c388f
lea ecx, [esp + 0xc]
mov byte [esp + 0x434], 5
call fcn.005c388f
lea ecx, [esp + 8]
mov byte [esp + 0x434], 4
call fcn.005c388f
lea ecx, [esp + 0x440]
mov byte [esp + 0x434], 3
call fcn.005c388f
lea ecx, [esp + 0x444]
mov byte [esp + 0x434], 2
call fcn.005c388f
lea ecx, [esp + 0x448]
mov byte [esp + 0x434], bl
call fcn.005c388f
lea ecx, [esp + 0x44c]
mov byte [esp + 0x434], 0
call fcn.005c388f
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x430
ret
Function at 0x550970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f62e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [esp + 0x14], 0
lea eax, [esp + 0x3c]
mov edi, 1
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], edi
call fcn.005c3604
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 2
push ecx
lea ecx, [esp + 0x10]
call fcn.005c3604
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 3
call fcn.005c3dd8
mov esi, dword [esp + 0x40]
lea edx, [esp + 0x40]
push 7
push edx
lea ecx, [esp + 0x14]
mov dword [esi], 0
call fcn.005bf72f
mov eax, dword [eax]
push str.HTTP:__
push eax
call fcn.004ac754
add esp, 8
lea ecx, [esp + 0x40]
test eax, eax
sete bl
call fcn.005c388f
test bl, bl
je 0x550a7a
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
push eax
push ecx
call fcn.005502a0
add esp, 8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 4
call fcn.005c39c8
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], 3
call fcn.005c388f
mov eax, dword [0x1e3d5dc]
push 0x1d791b0
push eax
call fcn.004ac754
add esp, 8
test eax, eax
je 0x550b6b
mov edx, dword [0x1e3d5dc]
push 0
push 0
push edx
call fcn.005cfe09
mov esi, dword [esp + 0x38]
push 0x1d791b0
mov ecx, esi
call fcn.005c38fd
mov dword [esp + 0x14], edi
jmp 0x550b81
lea eax, [esp + 0x40]
push 4
push eax
lea ecx, [esp + 0x14]
call fcn.005bf72f
mov eax, dword [eax]
push str.FTP:
push eax
call fcn.004ac754
add esp, 8
lea ecx, [esp + 0x40]
test eax, eax
sete bl
call fcn.005c388f
test bl, bl
je 0x550b6d
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x1e3d5d0
call fcn.005c3604
push ecx
mov byte [esp + 0x38], 5
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x1e3d5d4
call fcn.005c3604
push ecx
mov byte [esp + 0x3c], 6
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x1e3d5d8
call fcn.005c3604
push ecx
lea edx, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x44], 7
call fcn.005c3604
lea eax, [esp + 0x50]
mov byte [esp + 0x40], 3
push eax
call fcn.005506b0
add esp, 0x14
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 8
call fcn.005c39c8
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], 3
call fcn.005c388f
mov eax, dword [0x1e3d5dc]
push 0x1d791b0
push eax
call fcn.004ac754
add esp, 8
test eax, eax
je 0x550b6b
mov ecx, dword [0x1e3d5dc]
push 0
push 0
push ecx
call fcn.005cfe09
mov esi, dword [esp + 0x38]
push 0x1d791b0
mov ecx, esi
call fcn.005c38fd
jmp 0x550b7d
mov dword [esi], edi
mov esi, dword [esp + 0x38]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.005c3604
mov dword [esp + 0x14], edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call fcn.005c388f
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.005c388f
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 0
call fcn.005c388f
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret
Function at 0x554380
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5f66d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov ebx, dword [esp + 0x20]
xor edi, edi
cmp ebx, edi
mov dword [esp + 0x18], edi
mov dword [esi], 0x1d8a89c
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 4], edi
je 0x554411
mov ecx, ebx
call fcn.004fa750
cmp eax, edi
mov dword [esi + 0x2c], eax
jbe 0x554411
push edi
mov ecx, esi
call fcn.00554d90
test eax, eax
je 0x554411
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebx + 0x28]
mov edx, dword [esi + 0x28]
push eax
push ecx
push edx
call fcn.004acab0
mov eax, dword [esi + 8]
add esp, 0xc
cmp word [eax], 0x4d42
jne 0x554411
mov ecx, dword [eax + 0xa]
mov edx, dword [esi + 0xc]
add ecx, eax
xor eax, eax
mov dword [esi + 0x1c], ecx
mov ax, word [edx + 0xe]
mov dword [esi + 0x30], eax
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x5549b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f6678
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], esp
call fcn.005c3f50
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov ecx, edi
mov byte [ebp - 4], 1
mov eax, dword [edi]
call dword [eax + 0x30]
push 0
mov ecx, esi
mov dword [esi + 0x2c], eax
call fcn.00554d90
test eax, eax
je 0x554a64
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
mov edx, dword [edi]
push eax
push ecx
mov ecx, edi
call dword [edx + 0x34]
mov ecx, dword [esi + 0x2c]
mov dword [ebp - 4], 0xffffffff
cmp eax, ecx
jne 0x554a6b
call fcn.005c3f8e
mov eax, dword [esi + 8]
cmp word [eax], 0x4d42
jne 0x554a70
mov ecx, dword [eax + 0xa]
mov edx, dword [esi + 0xc]
add ecx, eax
xor eax, eax
mov dword [esi + 0x1c], ecx
mov ax, word [edx + 0xe]
mov dword [esi + 0x30], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xffffffff
call fcn.005c3f8e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x556680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f68dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
mov dword [esp + 0x20], 0
call fcn.005c3604
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x30]
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x44]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x48]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x38]
push edx
mov ecx, esi
call fcn.0052ae60
mov eax, dword [0x1de1e58]
lea ecx, [esi + 0x19c]
mov dword [ecx], eax
mov edx, dword [0x1de1e58]
lea edi, [esi + 0x1a4]
mov dword [edi], edx
push 0x1d791b0
mov byte [esp + 0x1c], 3
mov dword [esi], 0x1d8b128
call fcn.005c3a18
push 0
call fcn.004aeafc
push eax
call fcn.004abec8
add esp, 8
call fcn.004abed5
push 0x1d791b0
mov ecx, edi
mov dword [esi + 0x1a0], eax
call fcn.005c3a18
lea ecx, [esp + 0x38]
mov dword [esp + 0x18], 0xffffffff
call fcn.005c388f
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 0x1c