joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52b850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x604cb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [esp + 0x40]
mov esi, ecx
push edi
lea ecx, [esp + 0x20]
call fcn.005db91e
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 4]
mov ebx, dword [esi + 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ecx
call fcn.00546080
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x10]
push ecx
push edx
push edi
call fcn.00547c40
mov ecx, dword [esp + 0x30]
mov ebx, dword [sym.imp.USER32.dll_DrawFocusRect]
add esp, 0x10
lea eax, [esp + 0xc]
push eax
push ecx
call ebx
mov edx, dword [esp + 0x4c]
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
push edx
mov edx, dword [esp + 0x4c]
push edx
push ecx
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SetRect]
lea ecx, [esp + 0xc]
push ecx
call fcn.00546080
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x10]
push edx
push eax
push edi
call fcn.00547c40
mov edx, dword [esp + 0x30]
add esp, 0x10
lea ecx, [esp + 0xc]
push ecx
push edx
call ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.005db990
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 0x10
Function at 0x536890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x605be8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push ecx
lea eax, [esp + 0x3c]
xor edi, edi
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
mov dword [esp + 0x20], edi
call fcn.005d361e
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x30]
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [esp + 0x44]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x48]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x38]
push edx
mov ecx, esi
call fcn.00514360
lea ebx, [esi + 0x180]
mov eax, 1
mov ecx, eax
mov edx, eax
mov dword [ebx], eax
mov dword [esi + 0x194], edi
mov dword [esi + 0x17c], edi
mov dword [esi + 0x178], edi
mov dword [ebx + 4], ecx
mov edi, eax
lea ecx, [esp + 0x38]
mov dword [esi], 0x1a2ef28
mov dword [ebx + 8], edx
mov dword [esi + 0x190], 5
mov dword [esi + 0x198], 2
mov dword [esp + 0x18], 0xffffffff
mov dword [ebx + 0xc], edi
call fcn.005d38a9
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x1c

Function at 0x544b70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6069ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x20], 0
call fcn.00526040
mov ebx, 1
push 0x2c
mov byte [esp + 0x18], bl
mov dword [esi], 0x1a30fb4
mov dword [esi + 0x8c], 5
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], ebx
mov dword [esi + 0x84], ebx
call fcn.005d35ea
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x544bfb
mov ecx, eax
call fcn.00561080
jmp 0x544bfd
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x88], eax
mov byte [esp + 0x14], bl
mov edx, dword [ecx - 8]
test edx, edx
je 0x544c1a
push ecx
mov ecx, eax
call fcn.00561220
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], 0xffffffff
call fcn.005d38a9
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x545510
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x606ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.005f3301
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0
call fcn.005f361b
test eax, eax
je 0x545606
push 0
push 1
lea ecx, [esp + 0x14]
call fcn.005f35dd
test eax, eax
je 0x545606
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x54557c
push eax
push eax
push str.Could_not_open_clipboard.
jmp 0x545601
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
jne 0x545592
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x5455f8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
call fcn.005d35ea
mov esi, eax
add esp, 4
test esi, esi
jne 0x5455de
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
push esi
push str.Out_of_memory_
call fcn.005dfe23
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.005f332e
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x54562a
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call fcn.005d3613
add esp, 4
push 0
push 0
push str.Error_obtaining_text_from_Clipboard.
call fcn.005dfe23
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.005f332e
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
lea ecx, [esp + 0xc]
call fcn.005d3917
lea ecx, [esp + 8]
mov byte [esp + 0x24], 1
push ecx
mov ecx, dword [esp + 0x34]
call fcn.005d39e2
push esi
call fcn.005d3613
add esp, 4
lea ecx, [esp + 8]
mov byte [esp + 0x24], 0
call fcn.005d38a9
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.005f332e
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x5456a0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x606ae8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], esp
call fcn.005f3301
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.005f361b
test eax, eax
je 0x54584b
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.005f35dd
test eax, eax
je 0x54584b
call fcn.005d95e7
test eax, eax
je 0x545706
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x545708
xor eax, eax
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x54584b
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x545819
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [ebp - 0x20]
mov edi, eax
call fcn.005d3f6a
mov esi, dword [ebp + 8]
mov byte [ebp - 4], 2
movsx ax, byte [edi]
test ax, ax
je 0x54580d
cmp ax, 0x7f
jbe 0x545770
push eax
mov ecx, esi
call fcn.005d3cac
movsx ax, byte [edi + 1]
inc edi
push eax
mov ecx, esi
call fcn.005d3cac
inc edi
jmp 0x545744
cmp ax, 0x20
jae 0x54577c
cmp ax, 0xd
jne 0x545790
push eax
mov ecx, esi
call fcn.005d3cac
push 0
mov ecx, esi
call fcn.005d3cac
inc edi
jmp 0x545744
cmp ax, 9
jne 0x54576d
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x5457d9
push 0x1a90d8c
lea ecx, [ebp - 0x14]
call fcn.005d3917
lea ecx, [ebp - 0x14]
push 0
push ecx
mov byte [ebp - 4], 3
call fcn.00545960
add esp, 8
lea edx, [ebp - 0x14]
mov ecx, esi
push edx
call fcn.005d3cc1
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.005d38a9
inc edi
jmp 0x545744
push 9
mov ecx, esi
call fcn.005d3cac
push 0
mov ecx, esi
call fcn.005d3cac
inc edi
jmp 0x545744
mov dword [ebp - 4], 0
call fcn.005d3fa8
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.005f332e
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.005f332e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x545870
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x606b08
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.USER32.dll_OpenClipboard]
push ebx
call ebp
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [esp + 0x24]
or edi, 0xffffffff
mov eax, dword [eax - 8]
cmp eax, edi
je 0x5458ba
inc eax
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x5458dc
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], edi
call fcn.005d38a9
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0x24]
mov edi, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test edi, edi
je 0x545907
push ebx
call ebp
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call fcn.005d38a9
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x54a660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60738f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x28]
push esi
lea ecx, [esp + 4]
push eax
push ecx
mov dword [esp + 0x10], 0
call fcn.0054dec0
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x14]
push 0xa
inc eax
push edx
push eax
mov dword [esp + 0x30], 1
call fcn.004adfb5
add esp, 0x14
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 8]
call fcn.005d3c85
mov esi, dword [esp + 0x24]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.005d361e
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x1c], 0
call fcn.005d38a9
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x54aba0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6074c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
xor ebx, ebx
push 0x40
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ebx
call fcn.005d3d97
cmp eax, 0xffffffff
jne 0x54ac03
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.005d39e2
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.005d38a9
mov eax, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x20]
push ebp
push esi
xor ebp, ebp
mov eax, dword [ecx - 8]
lea esi, [eax - 1]
cmp esi, ebx
jl 0x54ad57
push edi
lea edi, [esi + 1]
mov edx, dword [esp + 0x2c]
cmp byte [esi + edx], 0x40
jne 0x54acc2
cmp ebp, ebx
jne 0x54ac5a
sub eax, esi
lea ecx, [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
push edi
push eax
call fcn.005cf637
mov ecx, dword [esp + 0x3c]
push eax
mov byte [esp + 0x28], 1
call fcn.005d39e2
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x10]
jmp 0x54acba
cmp ebp, 1
jne 0x54ac8b
sub eax, esi
lea ecx, [esp + 0x14]
dec eax
push eax
push edi
push ecx
lea ecx, [esp + 0x38]
call fcn.005cf637
mov ecx, dword [esp + 0x38]
push eax
mov byte [esp + 0x28], 2
call fcn.005d39e2
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x14]
jmp 0x54acba
cmp ebp, 2
jne 0x54acbf
sub eax, esi
lea edx, [esp + 0x18]
dec eax
lea ecx, [esp + 0x2c]
push eax
push edi
push edx
call fcn.005cf637
mov ecx, dword [esp + 0x34]
push eax
mov byte [esp + 0x28], 3
call fcn.005d39e2
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x18]
call fcn.005d38a9
mov eax, esi
inc ebp
dec esi
dec edi
cmp esi, ebx
jge 0x54ac1d
cmp ebp, 1
pop edi
jne 0x54acfa
push eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x30]
call fcn.005cf749
mov ecx, dword [esp + 0x34]
push eax
mov byte [esp + 0x24], 4
call fcn.005d39e2
mov byte [esp + 0x20], bl
lea ecx, [esp + 0x38]
jmp 0x54ad52
cmp ebp, 2
jne 0x54ad27
lea ecx, [esp + 0x38]
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.005cf749
mov ecx, dword [esp + 0x30]
push eax
mov byte [esp + 0x24], 5
call fcn.005d39e2
mov byte [esp + 0x20], bl
lea ecx, [esp + 0x38]
jmp 0x54ad52
cmp ebp, 3
jne 0x54ad57
lea edx, [esp + 0x38]
push eax
push edx
lea ecx, [esp + 0x30]
call fcn.005cf749
mov ecx, dword [esp + 0x2c]
push eax
mov byte [esp + 0x24], 6
call fcn.005d39e2
mov byte [esp + 0x20], bl
lea ecx, [esp + 0x38]
call fcn.005d38a9
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.005d38a9
mov ecx, dword [esp + 0x18]
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x54ad80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6074f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
push 0x3a
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0
call fcn.005d3d97
mov esi, eax
lea eax, [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x34]
call fcn.005cf749
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0xc]
mov byte [esp + 0x24], 1
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x2c]
sub eax, esi
dec eax
push eax
push edx
call fcn.005cf6cd
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
mov byte [esp + 0x2c], 2
call fcn.005d361e
lea ecx, [esp + 0x18]
push ecx
call fcn.0054a520
mov esi, dword [eax]
mov edi, dword [eax + 4]
add esp, 4
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.005d361e
lea eax, [esp + 0x18]
push eax
call fcn.0054a520
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add esp, 8
cmp esi, ecx
mov edx, esi
jl 0x54ae2f
mov edx, ecx
mov ebp, dword [esp + 0x30]
cmp edi, eax
mov dword [ebp], edx
mov edx, edi
jl 0x54ae3e
mov edx, eax
cmp esi, ecx
mov dword [ebp + 4], edx
jle 0x54ae47
mov ecx, esi
mov edx, dword [esp + 0x34]
cmp edi, eax
mov dword [edx], ecx
jle 0x54ae53
mov eax, edi
lea ecx, [esp + 0xc]
mov dword [edx + 4], eax
mov byte [esp + 0x24], 1
call fcn.005d38a9
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 0
call fcn.005d38a9
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.005d38a9
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x1c
ret
Function at 0x54f740
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x607bf7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x1a8db40]
push ebx
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
mov dword [esp + 0x28], ebx
call fcn.005d0a21
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.005d0a34
mov eax, dword [eax + 0x14]
add eax, 0x76c
push eax
lea eax, [esp + 0x10]
push 0x1a21dc4
push eax
call fcn.005cfb69
mov ecx, dword [esp + 0x3c]
add esp, 0xc
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.005d361e
lea eax, [esp + 0x38]
push eax
call fcn.0054a7f0
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.005d39e2
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.005d38a9
mov ecx, dword [0x1a8db40]
mov dword [esp + 8], ecx
push 0xa2ea
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.005da3a1
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.005d3ad8
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.005d39e2
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call fcn.005d38a9
mov esi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.005d361e
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x24], bl
call fcn.005d38a9
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.005d38a9
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x54f880
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x607c47
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x1a8db40]
push ebx
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
mov dword [esp + 0x28], ebx
call fcn.005d0a21
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.005d0a34
mov eax, dword [eax + 0x10]
inc eax
push eax
lea eax, [esp + 0x10]
push 0x1a21dc4
push eax
call fcn.005cfb69
mov ecx, dword [esp + 0x3c]
add esp, 0xc
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.005d361e
lea eax, [esp + 0x38]
push eax
call fcn.005485f0
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.005d39e2
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.005d38a9
mov ecx, dword [0x1a8db40]
mov dword [esp + 8], ecx
push 0xa2eb
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.005da3a1
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.005d3ad8
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.005d39e2
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call fcn.005d38a9
mov esi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.005d361e
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x24], bl
call fcn.005d38a9
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.005d38a9
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x54f9c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x607c97
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x1a8db40]
push ebx
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
mov dword [esp + 0x28], ebx
call fcn.005d0a21
mov edx, dword [eax]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
call fcn.005d0a34
mov eax, dword [eax + 0xc]
push eax
lea eax, [esp + 0x10]
push 0x1a21dc4
push eax
call fcn.005cfb69
mov ecx, dword [esp + 0x3c]
add esp, 0xc
lea edx, [esp + 0xc]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.005d361e
lea eax, [esp + 0x38]
push eax
call fcn.005485f0
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.005d39e2
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.005d38a9
mov ecx, dword [0x1a8db40]
mov dword [esp + 8], ecx
push 0xa2ec
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.005da3a1
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.005d3ad8
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
call fcn.005d39e2
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call fcn.005d38a9
mov esi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.005d361e
mov dword [esp + 0x14], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x24], bl
call fcn.005d38a9
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.005d38a9
mov ecx, dword [esp + 0x1c]
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x55bdb0
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x608dd1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x418
push ebx
push esi
push 0x1a1fa78
mov ecx, 0x1aea174
mov dword [esp + 0x1c], 0
call fcn.005d3a32
mov esi, dword [esp + 0x434]
lea ecx, [esp + 8]
push esi
call fcn.005d3917
lea eax, [esp + 0xc]
mov ebx, 1
push 7
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x430], ebx
call fcn.005cf749
lea ecx, [esp + 0xc]
mov byte [esp + 0x428], 2
call fcn.005d3df2
mov ecx, dword [esp + 0xc]
push str.HTTP:__
push ecx
call fcn.004ad860
add esp, 8
test eax, eax
je 0x55be63
push 0x1a91a80
mov ecx, 0x1aea174
call fcn.005d3a32
mov esi, dword [esp + 0x430]
push 0x1a1fa78
mov ecx, esi
call fcn.005d3917
mov dword [esp + 0x18], ebx
jmp 0x55bfd2
push 0x2f
lea ecx, [esp + 0xc]
call fcn.005cf7c1
mov edx, dword [esp + 8]
mov ecx, dword [edx - 8]
sub ecx, eax
lea eax, [esp + 0x10]
dec ecx
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.005cf6cd
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x428], 3
mov eax, dword [ecx - 8]
test eax, eax
jne 0x55bec5
push 0x1a9007c
mov ecx, 0x1aea174
call fcn.005d3a32
mov esi, dword [esp + 0x430]
push 0x1a1fa78
mov ecx, esi
call fcn.005d3917
mov dword [esp + 0x18], ebx
jmp 0x55bfc1
lea edx, [esp + 0x20]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x55bef5
mov esi, dword [esp + 0x430]
push 0x1a1fa78
mov ecx, esi
call fcn.005d3917
mov dword [esp + 0x18], ebx
jmp 0x55bfc1
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
push eax
call fcn.005d3917
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 4
push ecx
lea ecx, [esp + 0x18]
call fcn.005d3cc1
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.005ea1b0
mov ecx, dword [eax + 4]
call fcn.005d933c
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push esi
push ecx
call fcn.0055bb60
add esp, 0xc
mov byte [esp + 0x428], 5
call fcn.005ea1b0
mov ecx, dword [eax + 4]
call fcn.005d9351
mov edx, dword [esp + 0x1c]
mov eax, dword [edx - 8]
test eax, eax
je 0x55bf88
lea eax, [esp + 0x1c]
mov ecx, 0x1aea174
push eax
call fcn.005d39e2
mov esi, dword [esp + 0x430]
push 0x1a1fa78
mov ecx, esi
call fcn.005d3917
jmp 0x55bf9b
mov esi, dword [esp + 0x430]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.005d361e
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov byte [esp + 0x428], 4
call fcn.005d38a9
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 3
call fcn.005d38a9
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 2
call fcn.005d38a9
lea ecx, [esp + 0xc]
mov byte [esp + 0x428], bl
call fcn.005d38a9
lea ecx, [esp + 8]
mov byte [esp + 0x428], 0
call fcn.005d38a9
mov ecx, dword [esp + 0x420]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x424
ret