joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6374b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xb], eax
lea ebx, [ebx*4]
lea esp, [esp + 0xd]
jmp 0x637497
xchg byte [esp + 0xb], bl
mov edi, dword [esp + 3]
mov al, ah
xchg word [esp + 5], cx
cpuid
sub esp, 0x1e
jmp 0x637444
sub esp, 0xa
mov bl, bh
mov edx, 0xf681f9ba
bsr si, bp
xchg byte [esp + 4], bl
cld
jmp 0x63745b
mov bh, byte [esp + 8]
xchg ah, bl
pop dword [esp]
mov byte [esp + 0x11], bh
push word [esp + 8]
jmp 0x637506
setno ch
jmp 0x637482
cld
push word [esp + 0x17]
rol dx, cl
mov si, word [esp + 0xf]
xchg byte [esp], cl
rdtsc
jmp 0x6374ef
inc bx
mov dh, byte [esp]
pop dword [esp + 0x14]
mov bl, 0xc0
cpuid
setle ch
jmp 0x6374b6
add esp, 5
mov dh, byte [esp + 0xb]
inc bp
rdtsc
shr ch, 5
cpuid
jmp 0x637520
bsf si, ax
xchg ebx, edx
xchg word [esp + 0x16], si
pop word [esp + 0xb]
add cx, 0xb8fe
sub esp, 2
jmp 0x6374dd
mov esi, 0x28e44e38
sub bl, ah
mov ax, dx
xchg byte [esp + 0xd], cl
clc
mov si, word [esp + 8]
jmp 0x637710
push word [esp + 3]
xchg di, ax
lea ebp, [ecx + 0x83]
push word [esp + 5]
mov ax, 0xb469
mov dword [esp + 3], ecx
jmp 0x637607
mov byte [esp + 1], ah
lea eax, [edx + edx]
mov bl, 0x68
lea edi, [edx*4]
push edx
jmp 0x63754a
sub esp, 0x12
mov bl, bh
mov byte [esp + 0x19], bh
sub ebp, eax
setp ch
popal
jmp 0x637576
pop word [esp + 0xa]
not ebp
mov dword [esp + 1], ebp
mov edi, ecx
xchg ch, dl
xchg byte [esp + 8], al
jmp 0x63758d
mov bl, 0x20
mov esi, 0xc7d4bce8
bsf cx, ax
mov ax, word [esp]
xchg ah, bl
jmp 0x637639
not bh
bsr ax, cx
btc edx, edi
mov edx, eax
rdtsc
inc ecx
jmp 0x6375bd
mov al, ah
neg bp
sub esp, 0x18
lea esp, [esp + 0x41]
not edx
rdtsc
jmp 0x6375d7
add bp, 0x35a6
push esp
mov dword [esp + 1], esi
mov ecx, dword [esp + 3]
sub esp, 0x1a
mov byte [esp + 0x1f], ch
jmp 0x6375ee
add esp, 1
mov word [esp + 0xc], sp
mov ecx, esi
xchg dh, al
neg cx
pop bx
jmp 0x637677
add cx, 0x5416
lea edx, [ecx*4]
setp bh
pushal
bswap eax
btc esi, edi
jmp 0x63761e
bswap edi
push word [esp + 0x15]
call fcn.00637650
push edi
iretd
mov cl, 0xc2
mov edi, 0x6c5f71ca
mov byte [esp], ah
sub esp, 0x12
lea esi, [esp + edx]
mov cx, dx
jmp 0x6375a8
lea edi, reloc.RASAPI32.dll_RasHangUpA
mov edx, dword [esp]
lea esi, [esi + 0xad]
xchg bp, di
bswap edx
add al, dh
jmp 0x637694
mov word [esp + 0xc], di
pop dword [esp + 0xa]
mov di, word [esp + 4]
lea esp, [esp + 0x11]
setge bh
mov ebx, ebp
jmp 0x6376de
Function at 0x637650
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dx
bsf si, si
xchg bx, ax
rcl ax, cl
jmp 0x6376c3
mov dl, dh
mov byte [esp + 1], ch
xchg ch, dl
lea esp, [esp + 2]
stc
xchg ch, dl
jmp 0x6376ac
xchg byte [esp], al
mov eax, 0x18b7f6a6
mov dx, 0x24e5
mov al, 0x2e
jmp 0x6376f6
push dword [esp + 0xa]
lea esp, [esp + 0x1c]
btc ecx, edi
pop word [esp + 6]
pop word [esp]
pop esi
jmp 0x63765e
mov di, 0xfd7b
ror ebp, 0x15
push esp
mov bp, 0x7271
sub esp, 0xa
mov dl, 0x34
jmp 0x637790
mov word [esp + 0xa], di
inc ax
mov bx, word [esp + 7]
lea esp, [esp + 7]
mov ah, byte [esp + 1]
mov ecx, 0x1c7a6cba
jmp 0x637765
mov word [esp + 5], bx
mov word [esp + 2], bx
mov cx, word [esp + 6]
cld
xchg di, ax
mov byte [esp + 7], ah
jmp 0x637729
mov eax, ebp
add esi, ebp
neg ax
xchg ch, dl
xchg byte [esp + 1], al
mov bx, word [esp + 2]
jmp 0x637817
neg dx
bsr bx, bp
rdtsc
xchg dword [esp + 7], esi
mov bp, word [esp + 1]
pop word [esp + 5]
jmp 0x63774d
rdtsc
bsr ax, cx
lea eax, [edi + edi]
push dword [esp + 4]
mov bl, 0xb8
pop esi
call fcn.006377c8
or ah, byte [ebp + 0x5e945d4]
inc ebp
invalid
invalid
std
invalid

Function at 0x6377c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, 0x80
mov byte [esp], ah
pop di
push dword [esp + 6]
bswap ebp
sub esp, 0x12
jmp 0x6377f2
jmp 0x6377a9
lea edx, [ebx + edi]
mov si, word [esp + 0xa]
xchg ebp, esi
mov cl, ch
push dword [esp + 0x16]
mov eax, 0xe30eb788
jmp 0x63785c
mov edi, 0x2718ce1c
bswap ecx
pop di
setl ch
cpuid
clc
jmp 0x6377ca
mov al, byte [esp]
not dh
pushal
bswap edx
mov dx, word [esp + 0x12]
bsr cx, bp
jmp 0x637968
stc
inc dx
popal
mov cx, word [esp]
lea ebx, [edx + ebx]
setne ch
jmp 0x637835
sub esp, 2
btr eax, edx
mov cx, di
lea esp, [esp + 4]
lea esi, [esi*4]
setle bh
jmp 0x637949
mov cx, dx
rdtsc
xchg byte [esp], al
stc
xchg ch, dl
neg dx
jmp 0x63786c
pop dword [esp + 0x12]
pushal
pop dword [esp + 2]
mov dword [esp + 0x2f], eax
lea esp, [esp + 0x2d]
pop word [esp]
jmp 0x637892
push edx
pop dword [esp]
inc ax
setl ch
not dx
rdtsc
jmp 0x637930
lea ebx, [edi + edi]
not esi
xchg edx, ecx
not edi
mov byte [esp + 5], bh
mov bp, 0xf96f
jmp 0x6378c6
xchg edx, eax
push word [esp + 6]
lea esp, [esp + 7]
add esp, 1
cpuid
lea ecx, reloc.RASAPI32.dll_RasHangUpA
jmp 0x6379d9
btc ecx, ebx
mov dword [esp], eax
mov cx, 0x4709
bswap esi
not si
inc bl
jmp 0x6378f8
mov ecx, dword [esp]
mov edx, esi
cmc
mov si, word [esp + 2]
add esp, 0
neg ebx
jmp 0x637918
mov dl, dh
xchg ebx, edx
xchg ch, dl
mov word [esp + 2], bx
lea edi, reloc.RASAPI32.dll_RasHangUpA
not ah
jmp 0x6378e5
mov ebp, dword [esp + 3]
mov dword [esp + 0x15], ebp
mov dl, 0xc
bsf bx, ax
mov cl, ch
inc edi
jmp 0x6378af
pushal
and cx, 0x6bc2
neg ch
rcl bp, cl
mov byte [esp + 0xf], bh
pop word [esp + 0x15]
call fcn.0063797e
add eax, eax
cmp dword [edx], 0x15
test al, bh
clc
add ax, 0xc906
push edx
push word [esp + 1]
lea esp, [esp + 4]
neg di
jmp 0x6379a1
stc
mov dx, word [esp]
mov cx, word [esp]
shl di, cl
mov si, dx
mov ch, byte [esp]
jmp 0x6379c0
Function at 0x637cc5
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr edi, edx
push word [esp + 3]
xchg dh, al
mov ebx, 0x8275b88c
jmp 0x637c9b
lea esp, [esp + 0x14]
mov ecx, 0x9d8e32da
mov ch, byte [esp + 2]
mov si, bx
mov ebx, dword [esp + 1]
inc eax
jmp 0x637bdf
mov edi, 0xd2432040
xchg ah, bl
not ah
xchg word [esp + 0x23], dx
neg eax
mov byte [esp + 0x1b], ah
jmp 0x637bf7
bswap edi
lea ebp, [edx + esi]
mov dx, di
mov edx, dword [esp + 0x1e]
ror ecx, 0x1b
mov dh, byte [esp + 0x15]
jmp 0x637c1a
bswap ebp
xchg dh, al
mov byte [esp + 3], ah
mov ch, byte [esp + 0x1b]
setl dh
jmp 0x637c84
mov ecx, 0x1434de68
sub esp, 0x10
mov si, 0xece7
mov bl, 0xf8
pop ebx
mov ebx, dword [esp + 0x1a]
jmp 0x637c57
mov cx, 0xd67b
pop dword [esp + 0x19]
bsr bp, bp
xchg di, bx
jmp 0x637f43
pop word [esp + 0x14]
mov si, sp
pop dword [esp + 2]
btr edx, esp
neg bh
inc bp
jmp 0x637c6f
jmp 0x637c42
mov dl, 0x24
mov di, 0x81d
mov cl, 0xea
push word [esp + 0x35]
not bx
jmp 0x637d8f
mov byte [esp + 3], bh
pushal
inc ecx
rdtsc
not edx
bswap esi
jmp 0x637cca
push edx
lea esp, [esp + 0x41]
sub esp, 0x16
mov bp, word [esp]
not ch
lea ebp, [edx + ebx]
jmp 0x637ce0
bswap edx
lea ebx, [edx + ebx]
xchg ah, bl
cpuid
bswap edi
sub esp, 6
jmp 0x637cfa
mov eax, 0x6bdd764
mov eax, dword [esp + 0x11]
mov dword [esp + 6], ecx
bsr bx, bp
add esp, 0xf
push word [esp + 3]
jmp 0x637d65
bswap ebx
mov ebp, 0x9df9e0ee
lea edx, [esp + edx]
bswap ebx
rdtsc
cpuid
jmp 0x637d2a
mov word [esp + 2], sp
xchg ch, dl
neg si
xchg ebp, esi
pop esi
mov word [esp], di
jmp 0x637da6
mov ebp, 0x1f52f6ec
bsf di, si
pop ebp
mov ax, 0x236d
lea ebx, [ebx + edi]
jmp 0x637f2c
mov edi, 0x528afdf2
add esp, 0x31
xchg word [esp + 2], di
not ah
sub esp, 2
sub esp, 0xc
jmp 0x637d53
push dword [esp + 2]
push dword [esp + 4]
push dword [esp + 2]
mov bp, word [esp + 4]
mov di, 0xbb09
sub esp, 2
jmp 0x637d78
mov bx, di
cld
mov ax, dx
mov ebp, esi
cmc
pop dword [esp + 0x21]
jmp 0x637d1a
add esp, 0x11
xchg dword [esp + 3], esi
mov byte [esp + 5], bh
bsr di, bp
mov bh, byte [esp + 5]
mov dl, 0xdc
jmp 0x637e6c
lea edi, [eax*4]
pop word [esp + 7]
mov dx, 0x1ead
btc edi, ebx
jmp 0x637ddc
lea ecx, [ecx - 0xbb]
cpuid
lea esi, [esi*4]
xchg ebp, esi
pop word [esp + 3]
push word [esp + 3]
jmp 0x637df9
pop dword [esp + 0xd]
sub dx, 0xf480
mov al, 0xde
call fcn.00637e2f
adc eax, dword [edi + reloc.RASAPI32.dll_RasHangUpA]
stosd dword es:[edi], eax
cmp byte [esi - 0x782ec737], ch
adc eax, 0xba1fec85
add al, 0xb7
sahf
push word [esp + 4]
setle ah
pushal
pop si
mov ecx, 0xebcee3ea
xchg di, bp
jmp 0x637e47
btc eax, edi
mov bh, byte [esp + 5]
sub esp, 0x10
pop ax
rcl si, cl
jmp 0x637e12
pop dword [esp + 3]
lea edi, [edx + edi]
pop di
pushal
cmc
lea ebp, [edx + ebx]
jmp 0x637dc9

Function at 0x6388af
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x23], eax
mov dword [esp + 1], eax
pop word [esp + 5]
pop word [esp + 0x21]
mov word [esp + 2], sp
jmp 0x638922
mov dword [esp + 3], ebp
push dword [esp + 0xa]
lea esp, [esp + 3]
mov dword [esp + 0x6c], esi
call fcn.0063888e
pushal
mov byte [esp + 0x13], dh
lea esp, [esp + 1]
push edx
push dword [esp]
jmp 0x638890
pop word [esp + 0x1e]
Function at 0x401000
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
lea edi, [ebp - 2]
xor ecx, ecx
test edi, edi
jle 0x401093
push ebx
lea esp, [esp]
movzx edx, byte [esi + ecx]
mov ebx, dword [0x4500b0]
shr edx, 2
mov dl, byte [edx + ebx]
mov byte [eax], dl
movzx ebx, byte [esi + ecx + 1]
xor edx, edx
mov dl, byte [esi + ecx]
shr ebx, 4
inc eax
add ecx, 3
and edx, 3
shl edx, 4
or edx, ebx
mov ebx, dword [0x4500b0]
mov dl, byte [edx + ebx]
mov byte [eax], dl
movzx ebx, byte [esi + ecx - 1]
xor edx, edx
mov dl, byte [esi + ecx - 2]
shr ebx, 6
inc eax
and edx, 0xf
shl edx, 2
or edx, ebx
mov ebx, dword [0x4500b0]
mov dl, byte [edx + ebx]
mov byte [eax], dl
mov ebx, dword [0x4500b0]
xor edx, edx
mov dl, byte [esi + ecx - 1]
inc eax
and edx, 0x3f
mov dl, byte [edx + ebx]
mov byte [eax], dl
inc eax
cmp ecx, edi
jl 0x401020
pop ebx
cmp ecx, ebp
jge 0x401113
movzx edx, byte [ecx + esi]
mov edi, dword [0x4500b0]
shr edx, 2
mov dl, byte [edx + edi]
mov byte [eax], dl
inc eax
dec ebp
cmp ecx, ebp
jne 0x4010db
movzx ecx, byte [ecx + esi]
mov edx, dword [0x4500b0]
and ecx, 3
shl ecx, 4
mov cl, byte [ecx + edx]
mov edx, dword [esp + 0x10]
mov byte [eax], cl
inc eax
mov byte [eax], 0x3d
inc eax
mov byte [eax], 0x3d
inc eax
pop edi
mov byte [eax], 0
sub eax, edx
pop esi
inc eax
pop ebp
ret
lea edx, [ecx + esi + 1]
movzx ecx, byte [ecx + esi]
movzx esi, byte [edx]
and ecx, 3
shl ecx, 4
shr esi, 4
or ecx, esi
mov esi, dword [0x4500b0]
mov cl, byte [ecx + esi]
mov byte [eax], cl
movzx edx, byte [edx]
mov ecx, dword [0x4500b0]
and edx, 0xf
mov dl, byte [ecx + edx*4]
inc eax
mov byte [eax], dl
inc eax
mov byte [eax], 0x3d
inc eax
mov edx, dword [esp + 0x10]
pop edi
mov byte [eax], 0
sub eax, edx
pop esi
inc eax
pop ebp
ret

Function at 0x401840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43cff8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.004017b0
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00401560
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4018d2
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x407a60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x43d66d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
mov esi, ecx
mov dword [esi], eax
mov eax, dword [edi + 4]
sub eax, 0x10
push eax
mov dword [esp + 0xc], esi
call fcn.00401560
add eax, 0x10
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
sub eax, 0x10
push eax
mov dword [esp + 0x1c], 0
call fcn.00401560
add eax, 0x10
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
sub eax, 0x10
push eax
mov byte [esp + 0x20], 1
call fcn.00401560
add eax, 0x10
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
sub eax, 0x10
push eax
mov byte [esp + 0x24], 2
call fcn.00401560
add eax, 0x10
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
sub eax, 0x10
push eax
mov byte [esp + 0x28], 3
call fcn.00401560
add eax, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
sub eax, 0x10
push eax
mov byte [esp + 0x2c], 4
call fcn.00401560
add eax, 0x10
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
sub eax, 0x10
push eax
mov byte [esp + 0x30], 5
call fcn.00401560
add eax, 0x10
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
sub eax, 0x10
push eax
mov byte [esp + 0x34], 6
call fcn.00401560
add esp, 0x20
add eax, 0x10
mov dword [esi + 0x20], eax
mov ecx, dword [edi + 0x24]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4090b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43d848
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], 0
call fcn.004336c7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 0
call fcn.004336c7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x60]
push eax
push ecx
lea edx, [esp + 0x14]
push str.rec_id:_I64d_
push edx
mov byte [esp + 0x30], 1
call fcn.00402c10
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax - 0xc]
add esp, 0x10
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00407b60
movzx eax, byte [esi + 0x5c]
push eax
lea ecx, [esp + 0x10]
push str.rec_type:_d_
push ecx
call fcn.00402c10
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00407b60
mov edx, dword [esi + 0x68]
push edx
lea eax, [esp + 0x10]
push str.rec_ad:_d_
push eax
call fcn.00402c10
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00407b60
mov ecx, dword [esi + 0x70]
push ecx
lea edx, [esp + 0x10]
push str.src_url:_s_
push edx
call fcn.00402c10
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
add esp, 0xc
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00407b60
mov eax, dword [esi + 0x74]
push eax
lea ecx, [esp + 0x10]
push str.web_id:_s_
push ecx
call fcn.00402c10
mov esi, dword [esp + 0x18]
mov eax, dword [esi - 0xc]
add esp, 0xc
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00407b60
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00410260
add esp, 8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 2
call fcn.00402080
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x20], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409219
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov edi, dword [esp + 0x10]
add edi, 0xfffffff0
push edi
call fcn.00401560
mov ebp, dword [esp + 0x2c]
add eax, 0x10
mov dword [ebp], eax
lea eax, [esi - 0x10]
add esp, 4
mov byte [esp + 0x20], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409252
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov dword [esp + 0x20], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409271
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov eax, ebp
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x40a3c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43d9a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov esi, ecx
call fcn.004336c7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x70]
push eax
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
mov dword [esp + 0x58], ebx
call fcn.00410b20
mov ecx, dword [esp + 0x60]
mov edx, dword [esi + 0x74]
mov eax, dword [eax]
push ecx
mov ecx, dword [esi + 0x6c]
push edx
mov edx, dword [esi + 0x68]
push eax
mov eax, dword [esi + 0x64]
push ecx
mov ecx, dword [esi + 0x60]
push edx
movzx edx, byte [esi + 0x5c]
push eax
mov eax, dword [esi + 0x30]
push ecx
mov ecx, dword [esi + 0x2c]
push edx
mov edx, dword [esi + 0x28]
push eax
push ecx
push str.G1.0.0
push str.downloadcomplete
push edx
lea eax, [esp + 0x48]
push str._s_s_dlver_spname_spver_scmdtype_dcmdid_I64dad_doemid_dfromurl_swebid_sdltime_d
push eax
mov byte [esp + 0x94], 1
call fcn.00402c10
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
add esp, 0x44
mov byte [esp + 0x50], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a477
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x24]
call fcn.00414d20
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x58], 3
call fcn.00415af0
cmp eax, 1
je 0x40a4b8
lea ecx, [esp + 0x14]
push ecx
push esi
lea ecx, [esp + 0x2c]
call fcn.00415af0
push ebx
call fcn.00416850
add esp, 4
test al, al
je 0x40a4f1
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
push edx
push eax
push esi
push str.Rept__s_Result___d___d__n
push 0x25f
push str..ProductInfoMgr.cpp
push ebx
call fcn.00416960
add esp, 0xc
push eax
call fcn.00416930
add esp, 0x14
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, 1
sete cl
cmp eax, ebx
mov edi, ecx
je 0x40a510
push eax
call fcn.004336c2
add esp, 4
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x50], bl
call fcn.004149b0
lea eax, [esi - 0x10]
mov dword [esp + 0x50], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a54b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x48]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 4
Function at 0x40a570
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43d9a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov esi, ecx
call fcn.004336c7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x70]
push eax
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
mov dword [esp + 0x58], ebx
call fcn.00410b20
mov edx, dword [eax]
mov ecx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
push ecx
mov ecx, dword [esi + 0x68]
push edx
mov edx, dword [esi + 0x64]
push eax
mov eax, dword [esi + 0x60]
push ecx
movzx ecx, byte [esi + 0x5c]
push edx
mov edx, dword [esi + 0x30]
push eax
mov eax, dword [esi + 0x2c]
push ecx
mov ecx, dword [esi + 0x28]
push edx
push eax
push str.G1.0.0
push str.start
push ecx
lea edx, [esp + 0x44]
push str._s_s_dlver_spname_spver_scmdtype_dcmdid_I64dad_doemid_dfromurl_swebid_s
push edx
mov byte [esp + 0x90], 1
call fcn.00402c10
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
add esp, 0x40
mov byte [esp + 0x50], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a622
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x24]
call fcn.00414d20
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x58], 3
call fcn.00415af0
cmp eax, 1
je 0x40a663
lea ecx, [esp + 0x14]
push ecx
push esi
lea ecx, [esp + 0x2c]
call fcn.00415af0
push ebx
call fcn.00416850
add esp, 4
test al, al
je 0x40a69c
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
push edx
push eax
push esi
push str.Rept__s_Result___d___d__n
push 0x280
push str..ProductInfoMgr.cpp
push ebx
call fcn.00416960
add esp, 0xc
push eax
call fcn.00416930
add esp, 0x14
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, 1
sete cl
cmp eax, ebx
mov edi, ecx
je 0x40a6bb
push eax
call fcn.004336c2
add esp, 4
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x50], bl
call fcn.004149b0
lea eax, [esi - 0x10]
mov dword [esp + 0x50], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a6f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x48]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret
Function at 0x40a710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43d9a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov esi, ecx
call fcn.004336c7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x70]
push eax
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
mov dword [esp + 0x58], ebx
call fcn.00410b20
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x60]
push ecx
mov ecx, dword [esi + 0x74]
push edx
mov edx, dword [eax]
mov eax, dword [esi + 0x6c]
push ecx
mov ecx, dword [esi + 0x68]
push edx
mov edx, dword [esi + 0x64]
push eax
mov eax, dword [esi + 0x60]
push ecx
movzx ecx, byte [esi + 0x5c]
push edx
mov edx, dword [esi + 0x30]
push eax
mov eax, dword [esi + 0x2c]
push ecx
mov ecx, dword [esi + 0x28]
push edx
push eax
push str.G1.0.0
push str.installcomplete
push ecx
lea edx, [esp + 0x4c]
push str._s_s_dlver_spname_spver_scmdtype_dcmdid_I64dad_doemid_dfromurl_swebid_sdltime_dinsttime_d
push edx
mov byte [esp + 0x98], 1
call fcn.00402c10
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
add esp, 0x48
mov byte [esp + 0x50], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a7cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x24]
call fcn.00414d20
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x58], 3
call fcn.00415af0
cmp eax, 1
je 0x40a80d
lea ecx, [esp + 0x14]
push ecx
push esi
lea ecx, [esp + 0x2c]
call fcn.00415af0
push ebx
call fcn.00416850
add esp, 4
test al, al
je 0x40a846
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
push edx
push eax
push esi
push str.Rept__s_Result___d___d__n
push 0x2a5
push str..ProductInfoMgr.cpp
push ebx
call fcn.00416960
add esp, 0xc
push eax
call fcn.00416930
add esp, 0x14
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, 1
sete cl
cmp eax, ebx
mov edi, ecx
je 0x40a865
push eax
call fcn.004336c2
add esp, 4
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x50], bl
call fcn.004149b0
lea eax, [esi - 0x10]
mov dword [esp + 0x50], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a8a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x48]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 8