joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f6ee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [ebp + 8]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x4f708e
cmp byte [ebx], 0
je 0x4f7058
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x4f7070
test al, 0x10
je 0x4f7058
lea edi, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, edi
mov dword [esp + 8], 0x104
mov dword [esp], edi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__fullpath
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4f6f44
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
cmove ebx, edx
add al, al
sbb ebx, 3
sub ebx, edi
lea eax, [ebx + 0x233]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
mov esi, eax
je 0x4f707f
lea edx, [eax + 0x22c]
lea eax, [ebx + 1]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [ebp - 0x12c], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebp - 0x12c]
cmp byte [esi + 0x22c], 0
je 0x4f6fd3
movzx eax, byte [esi + ebx + 0x22b]
cmp al, 0x2f
je 0x4f6fd3
cmp al, 0x5c
je 0x4f6fd3
mov edi, 0x5c
mov word [edx + ebx], di
mov eax, edx
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x4f6fd5
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
add dl, dl
sbb eax, 3
mov edx, 0x2a
mov word [eax], dx
xor ecx, ecx
xor eax, eax
lea edx, [esi + 0x120]
xor ebx, ebx
mov word [esi + 0x11c], cx
mov edi, edx
mov ecx, 0x41
mov dword [esi + 0x224], 0xffffffff
mov dword [esi + 0x228], 0
mov dword [esi + 0x118], 0
mov word [esi + 0x11e], bx
rep stosd dword es:[edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0x14
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x4f7050
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x4f7050
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x4f7050
Function at 0x4fb9b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
movd xmm0, dword [esp + 0xc]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
pxor xmm0, xmm4
jb 0x4fba92
movdqa xmm5, xmmword [0x537d60]
nop dword [eax]
movdqa xmm4, xmmword [0x537d50]
movdqa xmm6, xmm0
movdqa xmm7, xmm0
movdqu xmm0, xmmword [ecx]
add eax, 0xffffffc0
pclmulqdq xmm7, xmm5, 0x11
pclmulqdq xmm6, xmm4, 0
pxor xmm0, xmm6
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
movdqa xmm4, xmm3
movdqu xmm3, xmmword [ecx + 0x10]
pxor xmm0, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm4, xmm5, 0x11
pclmulqdq xmm7, xmm5, 0x11
pxor xmm3, xmm6
movdqa xmm6, xmm2
movdqu xmm2, xmmword [ecx + 0x20]
pclmulqdq xmm6, xmmword [0x537d50], 0
pxor xmm3, xmm4
movdqa xmm4, xmm1
pclmulqdq xmm4, xmmword [0x537d50], 0
pxor xmm2, xmm6
movdqa xmm6, xmm1
movdqu xmm1, xmmword [ecx + 0x30]
add ecx, 0x40
cmp eax, 0x3f
pclmulqdq xmm6, xmm5, 0x11
pxor xmm2, xmm7
pxor xmm1, xmm4
pxor xmm1, xmm6
ja 0x4fb9f0
movdqa xmm5, xmmword [0x537d80]
movdqa xmm4, xmmword [0x537d70]
movdqa xmm6, xmm0
cmp eax, 0x10
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm6, xmm4, 0
pxor xmm0, xmm3
pxor xmm0, xmm6
movdqa xmm3, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm4, 0
pxor xmm0, xmm2
pxor xmm0, xmm3
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm2, xmm4, 0
pxor xmm0, xmm1
pxor xmm0, xmm2
jb 0x4fbb17
nop
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
add eax, 0xfffffff0
add ecx, 0x10
pclmulqdq xmm2, xmm4, 0
cmp eax, 0xf
pxor xmm0, xmm1
pxor xmm0, xmm2
ja 0x4fbaf0
movdqa xmm1, xmmword [0x537d80]
pxor xmm2, xmm2
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
movss xmm2, xmm0
psrldq xmm0, 4
pclmulqdq xmm2, xmmword [0x537d90], 0
pxor xmm2, xmm0
pxor xmm0, xmm0
movss xmm0, xmm2
pclmulqdq xmm0, xmmword [0x537da0], 0x10
movss xmm1, xmm0
pclmulqdq xmm1, xmmword [0x537db0], 0
pxor xmm1, xmm2
pshufd xmm0, xmm1, 0xe5
movd eax, xmm0
ret
Function at 0x4fc2d0
Capabilities:
Initialize winsock library

Disassembly:
push esi
sub esp, 0x190
cmp byte [0x54b520], 0
mov al, 1
jne 0x4fc30c
mov esi, esp
push 0x190
push 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push esi
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
sete al
sete byte [0x54b520]
add esp, 0x190
pop esi
ret

Function at 0x4fc3f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa0
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], pe_nt_image_headers32
lea edx, [esp + 0x10]
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x4fc460
movzx eax, word [esp + 0x12]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov esp, ebp
pop ebp
ret

Function at 0x4fc4a0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, 0xffffffff
call fcn.004fc2d0
test al, al
je 0x4fc574
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [esp + 0xc], 0
lea edi, [esp + 0x10]
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x28], eax
push ecx
push 0x537f50
push 0x10
push edi
call fcn.00421550
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x20]
push eax
push ecx
push edi
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x4fc549
test eax, eax
je 0x4fc549
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp eax, 0xffffffff
mov eax, dword [esp + 0xc]
je 0x4fc55b
push dword [eax + 0x10]
push dword [eax + 0x18]
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x4fc55e
push dword [esp + 0xc]
jmp 0x4fc553
mov esi, 0xffffffff
test eax, eax
je 0x4fc574
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x4fc574
push eax
jmp 0x4fc569
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov esi, 0xffffffff
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x4fc820
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4fc8d3
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
xor edi, edi
cmp ecx, 7
mov eax, 0
jbe 0x4fc8c0
mov edi, ecx
pxor xmm1, xmm1
xor eax, eax
pxor xmm2, xmm2
pxor xmm0, xmm0
and edi, 0xfffffff8
nop dword [eax + eax]
mov ebx, dword [edx + eax]
mov ebp, dword [edx + eax + 4]
xor ebx, dword [esi + eax]
xor ebp, dword [esi + eax + 4]
add eax, 8
cmp edi, eax
movd xmm3, ebx
movd xmm4, ebp
punpcklbw xmm3, xmm1
punpcklbw xmm4, xmm1
punpcklwd xmm3, xmm1
punpcklwd xmm4, xmm1
por xmm2, xmm3
por xmm0, xmm4
jne 0x4fc860
por xmm0, xmm2
cmp edi, ecx
pshufd xmm1, xmm0, 0x4e
por xmm1, xmm0
pshufd xmm0, xmm1, 0xe5
por xmm0, xmm1
movd eax, xmm0
je 0x4fc8d5
nop word cs:[eax + eax]
nop dword [eax]
movzx ebx, byte [edx + edi]
xor bl, byte [esi + edi]
inc edi
movzx ebx, bl
or eax, ebx
cmp ecx, edi
jne 0x4fc8c0
jmp 0x4fc8d5
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4fc8e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4fc911
mov edx, dword [esp + 8]
mov eax, 0x811c9dc5
nop word cs:[eax + eax]
nop dword [eax]
movzx esi, byte [edx]
inc edx
xor esi, eax
imul eax, esi, 0x1000193
dec ecx
jne 0x4fc900
pop esi
ret
mov eax, 0x811c9dc5
pop esi
ret

Function at 0x4fe030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4fe0ea
cmp dword [edi + 4], 0
je 0x4fe0ea
push 0
call sym.fastboot.exe_CRYPTO_get_thread_local
add esp, 4
mov esi, eax
test eax, eax
je 0x4fe0f9
cmp dword [edi + 4], 0
je 0x4fe136
xor ebx, ebx
xor ebp, ebp
mov dword [esp], edi
jmp 0x4fe0a0
mov eax, dword [edi + ebx + 8]
inc ebp
mov dword [esi + ebx + 8], eax
movzx eax, word [edi + ebx + 0xc]
mov edi, dword [esp]
mov word [esi + ebx + 0xc], ax
add ebx, 0x10
mov eax, dword [edi + 4]
cmp ebp, eax
jae 0x4fe0f6
mov edi, dword [edi]
push dword [esi + ebx + 4]
call sym.fastboot.exe_OPENSSL_free
add esp, 4
mov dword [esi + ebx + 4], 0
mov dword [esi + ebx], 0
mov dword [esi + ebx + 0xc], 0
mov dword [esi + ebx + 8], 0
mov eax, dword [edi + ebx]
mov dword [esi + ebx], eax
mov eax, dword [edi + ebx + 4]
test eax, eax
je 0x4fe080
push eax
call sym.fastboot.exe_OPENSSL_strdup
add esp, 4
mov dword [esi + ebx + 4], eax
jmp 0x4fe080
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp sym.fastboot.exe_ERR_clear_error
dec eax
jmp 0x4fe13b
push 0x10c
call sym.fastboot.exe_OPENSSL_malloc
add esp, 4
test eax, eax
je 0x4fe14b
mov esi, eax
push 0x10c
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x4fe160
push esi
push 0
call sym.fastboot.exe_CRYPTO_set_thread_local
add esp, 0xc
test eax, eax
jne 0x4fe05f
jmp 0x4fe14b
mov eax, 0xffffffff
mov dword [esi + 0x100], eax
mov dword [esi + 0x104], 0xf
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5118e8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x549488
call fcn.00511702
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x511914
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x511956
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str._buildbot_src_android_mingw_toolchain_mingw_mingw_w64_v6.x_mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call fcn.0047ef90
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x549488
call fcn.00511760
mov eax, dword [ebp + 0xc]
leave
ret
Function at 0x51c289
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ecx + 0x64]
lea ebx, [ecx + 0x54]
mov esi, ecx
xor edi, edi
mov dword [esp + 4], ebx
mov dword [esp], eax
nop dword [eax + eax]
cmp dword [esi + 0x58], 0
jne 0x51c26d
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x51c206
cmp eax, 0xfffffffb
jne 0x51c30d
cmp dword [esi + 0x34], 0
jne 0x51c29b
mov dword [esp + 8], edi
mov edi, dword [esi + 0x18]
mov ebx, dword [esi + 0x20]
xor ebp, ebp
nop dword [eax]
mov eax, edi
mov ecx, 0x40000000
sub eax, ebp
cmp eax, 0x40000000
cmovae eax, ecx
lea ecx, [ebx + ebp]
push eax
push ecx
push dword [esi + 0x10]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
test eax, eax
jle 0x51c24d
add ebp, eax
cmp ebp, edi
jb 0x51c220
jmp 0x51c25a
js 0x51c2f1
mov dword [esi + 0x34], 1
add dword [esi + 0x58], ebp
mov eax, dword [esi + 0x20]
mov edi, dword [esp + 8]
mov ebx, dword [esp + 4]
mov dword [esi + 0x54], eax
je 0x51c29b
push 0
push ebx
call fcn.0049d260
add esp, 8
mov edi, eax
add eax, 4
cmp eax, 6
ja case.0x51c282.1
jmp dword [eax*4 + 0x53c994]
mov eax, dword [esi + 0x64]
cmp edi, 1
je 0x51c2ae
test eax, eax
jne 0x51c1f0
jmp 0x51c2ae
push str.unexpected_end_of_file
push 0xfffffffffffffffb
push esi
call fcn.004f98a0
add esp, 0xc
mov eax, dword [esi + 0x64]
mov ecx, dword [esp]
sub ecx, eax
mov dword [esi], ecx
mov eax, dword [esi + 0x60]
sub eax, ecx
mov dword [esi + 4], eax
xor eax, eax
cmp edi, 1
jne 0x51c312
mov dword [esi + 0x2c], 0
jmp 0x51c312
push str.internal_error:_inflate_stream_corrupt
push 0xfffffffffffffffe
jmp 0x51c304
push str.out_of_memory
push 0xfffffffffffffffc
jmp 0x51c304
mov eax, dword [esi + 0x6c]
mov ecx, str.compressed_data_error
test eax, eax
cmovne ecx, eax
push ecx
push 0xfffffffffffffffd
jmp 0x51c304
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_strerror
add esp, 4
push eax
push 0xffffffffffffffff
push esi
call fcn.004f98a0
add esp, 0xc
mov eax, 0xffffffff
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4040c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5311fc
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5796f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea edi, [esi + 8]
mov dword [esi], vtable.CCurlDownloader.0
mov dword [ebp - 0x14], edi
mov dword [edi + 0x24], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x40411d
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
lea edi, [esi + 0x30]
mov byte [ebp - 4], 2
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 8
jb 0x40413c
mov eax, dword [edi]
jmp 0x40413e
mov eax, edi
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x40415f
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404150
sub ecx, ebx
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00403170
lea ebx, [esi + 0x48]
mov byte [ebp - 4], 3
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
cmp dword [ebx + 0x14], 8
jb 0x404187
mov eax, dword [ebx]
jmp 0x404189
mov eax, ebx
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x4041b0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 8], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4041a0
sub ecx, dword [ebp + 8]
sar ecx, 1
push ecx
push edx
mov ecx, ebx
call fcn.00403170
mov byte [ebp - 4], 4
cmp dword [edi + 0x14], 8
jb 0x4041c5
mov edi, dword [edi]
cmp dword [ebx + 0x14], 8
jb 0x4041cd
mov ebx, dword [ebx]
push dword [ebp - 0x10]
push ecx
push edi
push ebx
lea ecx, [esi + 0x60]
call fcn.00414660
mov byte [ebp - 4], 5
lea eax, [ebp - 0x2c]
mov ebx, dword [ebp - 0x10]
lea ecx, [esi + 0x60]
push 1
push eax
mov dword [ebx + 0xf0], 0
mov byte [ebx + 0xf4], 0
call fcn.00414920
cmp dword [eax + 0x14], 8
jb 0x404209
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x404225
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.004017c0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404260
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53122f
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5796f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 0xf0]
test esi, esi
je 0x4042db
cmp dword [esi + 4], 0
je 0x4042bf
mov eax, dword [esi + 4]
test eax, eax
je 0x4042bf
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov dword [esi], 0xffffffff
mov esi, dword [edi + 0xf0]
test esi, esi
je 0x4042db
mov ecx, esi
call fcn.00421900
push 0x50
push esi
call fcn.004edc4d
add esp, 8
push 0x50
call fcn.004edc7e
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x50
push 0
push esi
mov dword [ebp - 4], 0
call fcn.004d7060
sub esp, 0x18
mov ecx, 0x404350
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x40431d
mov dword [eax], vtable.std::_Func_impl_unsigned_long_int____cdecl___void____class_std::allocator_int___unsigned_long_int__void__.0
mov dword [eax + 4], 0x404350
mov dword [eax + 0x24], eax
push str.ABDEF
push edi
mov ecx, esi
call fcn.004216b0
mov dword [edi + 0xf0], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x40433e
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4050d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53135a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5796f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.004d86b7
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x405190
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.004d60de
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x575bec
push eax
call fcn.004d7590
push edi
push esi
call fcn.004d8a2d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004edc3c
mov esp, ebp
pop ebp
ret 4
Function at 0x407430
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x531466
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5796f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004edc7e
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004d892a
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408400
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53174b
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5796f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x30], esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 0
mov dword [esi], vtable.CMTCurlDownloader.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
lea edi, [esi + 0x10]
mov dword [ebp - 0x30], edi
mov dword [edi + 0x24], 0
mov byte [ebp - 4], 2
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x408481
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 3
mov dword [esi + 0x4c], 7
mov dword [esi + 0x48], 0
cmp dword [esi + 0x4c], 8
jb 0x40849e
mov eax, dword [esi + 0x38]
jmp 0x4084a1
lea eax, [esi + 0x38]
xor ecx, ecx
mov word [eax], cx
cmp word [ebx], cx
je 0x4084bf
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4084b0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [esi + 0x38]
call fcn.00403170
mov byte [ebp - 4], 4
mov dword [esi + 0x64], 7
mov dword [esi + 0x60], 0
cmp dword [esi + 0x64], 8
jb 0x4084e6
mov eax, dword [esi + 0x50]
jmp 0x4084e9
lea eax, [esi + 0x50]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x2c]
cmp word [eax], cx
je 0x408512
mov ecx, eax
lea ebx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408500
mov eax, dword [ebp - 0x2c]
sub ecx, ebx
sar ecx, 1
push ecx
push eax
lea ecx, [esi + 0x50]
call fcn.00403170
lea eax, [esi + 0x68]
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 0x10
jb 0x408535
mov eax, dword [eax]
mov byte [eax], 0
lea eax, [esi + 0x84]
mov dword [esi + 0x80], 0xffffffff
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 0x10
jb 0x40855e
mov eax, dword [eax]
mov byte [eax], 0
lea eax, [esi + 0xac]
mov dword [esi + 0xa8], 0
xorps xmm0, xmm0
push 2
push eax
movsd qword [esi + 0xa0], xmm0
call fcn.004d9697
add esp, 8
mov byte [ebp - 4], 8
xorps xmm0, xmm0
mov dword [esi + 0xec], 0
movsd qword [esi + 0xa0], xmm0
mov dword [esi + 0xa8], 0
mov dword [esi + 0xe0], 0
mov dword [esi + 0xe4], 0
mov dword [esi + 0x80], 0xffffffff
mov byte [esi + 0xe8], 0
cmp dword [esi + 0x4c], 8
jb 0x4085da
mov eax, dword [esi + 0x38]
jmp 0x4085dd
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea edx, [esi + 0x38]
lea ecx, [ebp - 0x28]
call fcn.00421380
add esp, 4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0040ab00
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x408615
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00404c20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004edc3c
mov esp, ebp
pop ebp
ret 0xc