joyce8/EMBER2024-capa huggingface dataset:
Function at 0x676b70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7c79b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x48]
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov eax, dword [esi]
mov edx, dword [eax + 8]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x44], ebx
call edx
mov eax, dword [eax]
lea ecx, [esp + 0x18]
push ecx
push eax
mov byte [esp + 0x48], 1
call fcn.0067f120
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 8
mov byte [esp + 0x40], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x676c05
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x2c], ebx
jne 0x676c26
cmp dword [esp + 0x30], 0x10
jb 0x676c1f
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00704960
add esp, 4
xor eax, eax
jmp 0x676cea
cmp dword [esp + 0x30], 0x10
mov eax, dword [esp + 0x1c]
jae 0x676c35
lea eax, [esp + 0x1c]
push eax
call fcn.00623a40
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x40], 2
cmp edi, ebx
jne 0x676c68
cmp dword [esp + 0x30], 0x10
jb 0x676c1f
mov edx, dword [esp + 0x1c]
push edx
call fcn.00704960
add esp, 4
xor eax, eax
jmp 0x676cea
push str.roots
push edi
call fcn.00622b50
add esp, 8
cmp eax, ebx
jne 0x676c9b
push edi
call fcn.006222c0
add esp, 4
cmp dword [esp + 0x30], 0x10
jb 0x676c1f
mov eax, dword [esp + 0x1c]
push eax
call fcn.00704960
add esp, 4
xor eax, eax
jmp 0x676cea
push str.bookmark_bar
push eax
call fcn.00622b50
add esp, 8
cmp eax, ebx
jne 0x676cc3
push edi
call fcn.006222c0
add esp, 4
lea ecx, [esp + 0x18]
call fcn.00407400
xor eax, eax
jmp 0x676cea
push eax
push ebp
mov ecx, esi
call fcn.006766f0
xor ecx, ecx
cmp dword [ebp + 0x18], ebx
push edi
setne cl
mov esi, ecx
call fcn.006222c0
add esp, 4
lea ecx, [esp + 0x18]
call fcn.00407400
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0071fe0b
add esp, 0x30
ret 4
Function at 0x677890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7c7b90
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 8]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0
call fcn.00648b30
mov eax, dword [esp + 0x40]
cmp dword [eax], 0
mov byte [esp + 0x38], 1
mov dword [esp + 0xc], 0
je 0x677912
lea ecx, [esp + 0xc]
push ecx
push 1
lea edx, [esp + 0x18]
push edx
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.006773c0
test eax, eax
jne 0x67799b
cmp dword [esp + 0xc], eax
jne 0x677923
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.00676450
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x18]
push eax
push ecx
inc edx
push edx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00677560
test eax, eax
je 0x67799b
lea ecx, [esp + 0x10]
call fcn.00675d50
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x38], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x677983
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 0x18
lea ecx, [esp + 0x10]
call fcn.00675d50
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x38], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x6779cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret 0x18
Function at 0x678530
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7c7cc0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x89b044]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x678614
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.00604620
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00607360
push str.select_id_from_tb_fav
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x20]
call fcn.006069b0
mov esi, dword [ebp + 0xc]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call fcn.00605910
lea ecx, [ebp - 0x38]
cmp al, bl
jne 0x6785cd
push ebx
push 0x830958
call fcn.00606c70
cmp dword [esi], eax
jge 0x6785c3
mov dword [esi], eax
lea ecx, [ebp - 0x38]
call fcn.00605960
jmp 0x6785a3
mov byte [ebp - 4], 1
call fcn.00605360
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.006067f0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x678930
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x7c7d88
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x22c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x23c]
xor edi, edi
mov dword [esp + 0x14], edi
mov eax, dword [0x8a14f8]
mov edx, dword [eax + 0xc]
mov ecx, 0x8a14f8
mov dword [esp + 0x234], edi
mov dword [esp + 0x18], esi
call edx
add eax, 0x10
mov dword [esi], eax
push 0x208
lea ecx, [esp + 0x22]
xor eax, eax
push edi
push ecx
mov dword [esp + 0x240], edi
mov dword [esp + 0x20], 1
mov word [esp + 0x28], ax
call fcn.007202b0
add esp, 0xc
push edi
push 0x1a
lea edx, [esp + 0x24]
push edx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x6789d5
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00406740
push 0x17
push str.360se6_appsdatausers
mov ecx, esi
call fcn.00404bd0
push str.default360sefav.db
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.00403a70
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [esp + 0x10]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x678a40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x678b17
push 0x830150
push str.InstallLocation
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall360se6
lea ecx, [esp + 0x1c]
push reloc.gdiplus.dll_Ordinal_1
push ecx
call fcn.00618c30
add esp, 0x14
push eax
mov ecx, esi
mov dword [esp + 0x238], 1
call fcn.00404210
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x234], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x678aa4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
cmp dword [eax - 0xc], edi
je 0x678b17
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x14], esp
mov edi, esp
push eax
call fcn.00405cc0
lea ecx, [esp + 0x18]
add esp, 4
add eax, 0x10
push ecx
mov dword [edi], eax
call fcn.0060d920
add esp, 8
push eax
mov ecx, esi
mov dword [esp + 0x238], 2
call fcn.00404210
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x234], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x678b0b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.appsdatausers
mov ecx, esi
call fcn.004036b0
mov eax, esi
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.0071fe0b
add esp, 0x228
ret 4
Function at 0x678d00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
push 0x208
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.007202b0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xc]
push eax
push str.InstallLocation
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall360se6
push reloc.gdiplus.dll_Ordinal_1
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x678d8b
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.User_DataDefault
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.004068d0
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0071fe0b
add esp, 0x214
ret 4
Function at 0x679860
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x7c7f60
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
call fcn.00678790
mov eax, dword [esi]
mov edx, dword [eax + 8]
lea ecx, [esp + 0xc]
push ecx
xor ebx, ebx
mov ecx, esi
mov dword [esp + 0x3c], ebx
call edx
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
lea eax, [esp + 0x10]
push eax
push ecx
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, esi
mov byte [esp + 0x48], 1
mov dword [esp + 0x20], ebx
call fcn.00679280
mov esi, eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x38], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x6798ee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
call fcn.00678b50
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00704960
mov edx, dword [esp + 0x18]
push edx
mov dword [esp + 0x30], ebx
call fcn.00704960
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret 0xc
Function at 0x67a020
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x7c804d
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push esi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov esi, dword [esp + 0x238]
xor ebx, ebx
lea ecx, [esp + 0xf]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
call fcn.0064a350
lea eax, [esp + 0x10]
push eax
push 6
push ebx
mov dword [esp + 0x23c], 1
mov dword [esp + 0x1c], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, ebx
jge 0x67a0a2
push 0x830150
mov ecx, esi
call fcn.004068d0
jmp 0x67a0e3
push 0x206
lea edx, [esp + 0x22]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x28], cx
call fcn.007202b0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.004068d0
lea ecx, [esp + 0xf]
mov dword [esp + 0x14], 1
mov byte [esp + 0x230], bl
call sub.ole32.dll_CoUninitialize
mov eax, esi
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.0071fe0b
add esp, 0x228
ret 4
Function at 0x67b6b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.007202b0
add esp, 0xc
push 0
push 0x1c
lea ecx, [esp + 0x10]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.2345ExplorerUser_DataDefault
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.004068d0
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0071fe0b
add esp, 0x210
ret 4

Function at 0x67b760
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.007202b0
add esp, 0xc
push 0
push 0x1c
lea ecx, [esp + 0x10]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.liebaoUser_DataDefault_
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.004068d0
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0071fe0b
add esp, 0x210
ret 4

Function at 0x67b830
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
push 0x208
lea eax, [esp + 0x10]
push 0
mov dword [esp + 0xc], 0
push eax
mov dword [esp + 0x10], 1
call fcn.007202b0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xc]
push eax
push str.InstallLocation
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallTheWorld6
push reloc.gdiplus.dll_Ordinal_1
mov dword [esp + 0x20], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x67b8bb
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.User_DataDefault
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.004068d0
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0071fe0b
add esp, 0x214
ret 4
Function at 0x67b950
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
push 0x208
lea eax, [esp + 0x10]
push 0
mov dword [esp + 0xc], 0
push eax
mov dword [esp + 0x10], 1
call fcn.007202b0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xc]
push eax
push str.InstallLocation
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall360Chrome
push reloc.gdiplus.dll_Ordinal_1
mov dword [esp + 0x20], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x67b9db
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.User_DataDefault
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.004068d0
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0071fe0b
add esp, 0x214
ret 4
Function at 0x67bd60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.007202b0
add esp, 0xc
push 0
push 0x1c
lea ecx, [esp + 0x10]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.TencentQQBrowserUser_DataDefault
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.004068d0
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0071fe0b
add esp, 0x210
ret 4
Function at 0x67d2a0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x14], 0
jne 0x67d2af
xor eax, eax
pop edi
ret
mov eax, dword [esp + 8]
push esi
xor esi, esi
push esi
push 0x80
push 2
push esi
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x67d2e9
call fcn.00452ec0
test eax, eax
jl 0x67d33a
cmp dword [edi + 0x18], 0x10
mov ecx, dword [edi + 0x14]
jb 0x67d2ed
mov eax, dword [edi + 4]
jmp 0x67d2f0
mov esi, eax
jmp 0x67d2db
lea eax, [edi + 4]
push 0
lea edx, [esp + 0x14]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x67d30d
call fcn.00452ec0
test eax, eax
jl 0x67d321
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x67d31f
call fcn.00452ec0
jmp 0x67d321
xor eax, eax
xor ecx, ecx
test eax, eax
setge cl
mov edi, ecx
test esi, esi
je 0x67d335
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
ret
pop esi
xor eax, eax
pop edi
ret
Function at 0x67f120
Capabilities:
Check if file exists
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x7c8758
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x67f22b
xor edi, edi
mov dword [esp + 0xc], edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push esi
mov dword [esp + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x67f215
call fcn.00452ec0
test eax, eax
jl 0x67f22b
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
jne 0x67f1b3
call fcn.00452ec0
test eax, eax
jl 0x67f220
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
test eax, eax
jb 0x67f220
ja 0x67f1c1
test esi, esi
jbe 0x67f220
test eax, eax
ja 0x67f220
jb 0x67f1cf
cmp esi, 0x500000
jae 0x67f220
mov edi, dword [esp + 0x2c]
push esi
mov ecx, edi
call fcn.0045fb90
push esi
push 0
mov ecx, edi
call fcn.004a9dd0
push eax
lea ecx, [esp + 0x14]
call fcn.0060ed00
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.00610900
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
mov edi, eax
mov dword [esp + 0xc], edi
jmp 0x67f18f
test edi, edi
je 0x67f22b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x67ffb0
Capabilities:
Parse url

Disassembly:
push 0xffffffffffffffff
push 0x7c894b
mov eax, dword fs:[0]
push eax
mov eax, 0x6044
call fcn.00725f60
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x6040], eax
push ebx
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x6054]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x6064]
mov esi, dword [esp + 0x6068]
push 0x38
lea eax, [esp + 0x1c]
push 0
push eax
mov dword [esp + 0x1c], 0
call fcn.007202b0
push 0x2000
lea ecx, [esp + 0x60]
push 0
push ecx
mov dword [esp + 0x2c], 0x3c
call fcn.007202b0
push 0x2000
lea eax, [esp + 0x206c]
lea edx, [esp + 0x6c]
push 0
mov edi, 0x1000
push eax
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], edi
call fcn.007202b0
push 0x2000
lea edx, [esp + 0x4078]
lea ecx, [esp + 0x2078]
push 0
push edx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], edi
call fcn.007202b0
lea eax, [esp + 0x4080]
mov dword [esp + 0x78], eax
mov eax, dword [esi]
mov dword [esp + 0x7c], edi
mov ecx, dword [eax - 0xc]
add esp, 0x30
or edi, 0xffffffff
test ecx, ecx
jg 0x680095
mov eax, edi
jmp 0x6800ac
push 0x3f
push eax
call fcn.00729157
add esp, 8
test eax, eax
jne 0x6800a8
mov eax, edi
jmp 0x6800ac
sub eax, dword [esi]
sar eax, 1
mov ecx, dword [esi]
cmp dword [ecx - 0xc], 0x400
jl 0x680178
test eax, eax
jle 0x680178
push eax
push 0
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.0049fed0
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0
push 0
push esi
mov dword [esp + 0x606c], 0
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x680123
push 0x830150
mov ecx, ebx
call fcn.004068d0
lea eax, [esi - 0x10]
mov dword [esp + 0x605c], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x68014f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x68014f
lea eax, [esi - 0x10]
mov dword [esp + 0x605c], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x680143
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x50]
push eax
mov ecx, ebx
call fcn.004068d0
mov eax, ebx
mov ecx, dword [esp + 0x6054]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6040]
xor ecx, esp
call fcn.0071fe0b
add esp, 0x6050
ret
lea edx, [esp + 0x14]
push edx
push 0
push 0
push ecx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x680143
push 0x830150
jmp 0x680148
Function at 0x687c30
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x20], 0
je 0x687c8e
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
cdq
mov ecx, eax
add ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
adc esi, edx
sub ecx, 1
sbb esi, 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
cdq
push edx
push eax
push esi
push ecx
call fcn.00725cd0
mov ecx, eax
mov esi, edx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
cdq
push edx
push eax
push esi
push ecx
call fcn.00729750
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00687b10
add esp, 0xc
test eax, eax
je 0x687caf
mov dword [ebp - 4], 0x60a
jmp 0x687cd3
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x687cd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0x60a
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x687d20
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x687d66
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x687d66
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 0x10], edx
mov eax, 0x70a
jmp 0x687d85
mov eax, dword [ebp - 4]
xor edx, edx
mov cl, 0x20
call fcn.00733330
mov ecx, dword [ebp - 0x10]
xor esi, esi
add eax, ecx
adc edx, esi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret