joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac98b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, eax
mov ebx, edx
lea edx, [eax + 0x2e]
mov ecx, 6
mov eax, ebx
call fcn.00427720
movzx edx, word [esi + 0x2c]
mov eax, ebx
call fcn.00426343
movzx edx, word [esi + 0x3c]
mov eax, ebx
call fcn.00426343
movzx edx, word [esi + 0x3e]
mov eax, ebx
call fcn.00426343
mov edx, dword [esi + 0x40]
mov eax, ebx
call fcn.00426392
mov edx, dword [esi + 0x44]
mov eax, ebx
call fcn.00426392
mov edx, dword [esi + 0x48]
mov eax, ebx
call fcn.00426392
movzx edx, word [esi + 0x4c]
mov eax, ebx
call fcn.00426343
movzx edx, word [esi + 0x4e]
mov eax, ebx
call fcn.00426343
mov edx, dword [esi + 0x50]
mov eax, ebx
call fcn.00426392
mov edx, dword [esi + 0x54]
mov eax, ebx
call fcn.00426392
mov edx, dword [esi + 0x58]
mov eax, ebx
call fcn.00426392
movzx edx, word [esi + 0x5c]
mov eax, ebx
call fcn.00426343
lea edx, [esi + 0x5e]
mov ecx, 0x20
mov eax, ebx
call fcn.00427720
movzx edx, word [esi + 0x80]
mov eax, ebx
call fcn.00426343
movsx edx, word [esi + 0x82]
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.00426343
Function at 0x4ae1a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], edx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
call fcn.004adc30
mov edx, eax
mov eax, dword [ebp - 0x3c]
call fcn.004adc13
test eax, eax
je 0x4ae268
mov ebx, dword [eax + 0x20]
xor edi, edi
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x1c]
lea edx, [ebp - 0x28]
mov dword [esp + 4], edx
lea edx, [ebp - 0x2c]
mov dword [esp], edx
mov edx, esi
mov ecx, edi
call fcn.00596b48
test eax, eax
jne 0x4ae26d
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x1c]
test edx, edx
jne 0x4ae22d
mov edx, dword [ebp - 0x28]
test edx, edx
jne 0x4ae22d
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x4ae21e
or eax, 0xffffffff
jmp 0x4ae26d
cmp dword [eax + 4], 0
je 0x4ae219
mov dword [ebp - 0x30], 1
jmp 0x4ae24d
lea ecx, [ebp - 0x20]
lea ebx, [ebp - 0x31]
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x30]
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x24]
mov dword [esp], ebx
call fcn.004ad42d
test eax, eax
jne 0x4ae26d
mov eax, dword [ebp - 0x44]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004adca7
mov eax, 0xffffffec
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4c56d2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xec
mov ebx, eax
mov dword [ebp - 0xdc], edx
mov esi, ecx
mov ecx, 0x54
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov edx, 0x5ed2b0
mov eax, dword [ebp - 0xdc]
call fcn.00427968
mov dword [ebx], eax
test eax, eax
jne 0x4c5746
cmp dword [0x5af144], 0
je 0x4c573c
mov dword [0x611418], 1
mov dword [0x611414], 0x17
mov eax, dword [ebp - 0xdc]
mov dword [esp + 4], eax
mov dword [esp], str._DASH__Cannot_open_input__s:_no_such_file_n
call fcn.004268ea
mov eax, 0xfffffff4
jmp 0x4c5822
call fcn.004f5018
mov dword [ebx + 4], eax
mov dword [eax + 0x847c], 0x4c4eee
mov eax, dword [ebx + 4]
mov dword [eax + 0x84bc], 1
mov eax, dword [ebx + 4]
mov dword [eax + 0x8480], ebx
mov dword [esp], 2
xor edx, edx
xor ecx, ecx
mov eax, dword [ebx]
call fcn.00425b5e
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
xor edx, edx
mov dword [esp], edx
xor edx, edx
xor ecx, ecx
mov eax, dword [ebx]
call fcn.00425b5e
test esi, esi
je 0x4c5813
mov eax, dword [ebx]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_feof
test eax, eax
jne 0x4c57fb
mov eax, dword [ebx]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xbc
mov dword [esp + 4], 1
lea edi, [ebp - 0xd4]
mov dword [esp], edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov ecx, eax
test eax, eax
jns 0x4c57e4
mov eax, 0xfffffffd
jmp 0x4c5822
mov eax, dword [ebx + 4]
cmp ecx, 0xbb
jle 0x4c57fb
mov edx, edi
call fcn.004f3840
cmp dword [ebx + 0x14], esi
jne 0x4c57a5
mov eax, dword [ebx + 4]
call fcn.004f4fbd
xor eax, eax
mov dword [esp], eax
xor edx, edx
xor ecx, ecx
mov eax, dword [ebx]
call fcn.00425b5e
mov eax, dword [ebx + 4]
mov dword [eax + 0x847c], 0x4c504c
xor eax, eax
add esp, 0xec
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4cdfd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x29], 0
xor ebx, ebx
xor edi, edi
xor esi, esi
xor edx, edx
mov byte [ebp - 0x2a], dl
mov eax, dword [ebp - 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [ebp - 0x19]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
test eax, eax
je 0x4ce0cc
movzx eax, byte [ebp - 0x19]
mov dl, byte [ebp - 0x2a]
cmp dl, 3
jne 0x4ce03b
mov edx, edi
shl edx, 0x18
shl ebx, 0x10
or ebx, edx
or eax, ebx
movzx esi, byte [ebp - 0x29]
shl esi, 8
or eax, esi
jmp 0x4ce0cc
cmp dl, 2
jne 0x4ce061
mov edx, eax
and dl, 0xf0
je 0x4ce05c
cmp dl, 0xf0
je 0x4ce05c
mov edx, eax
not edx
and dl, 0xc
je 0x4ce081
mov byte [ebp - 0x29], al
mov dl, 3
jmp 0x4cdfe8
cmp bl, 0xff
jmp 0x4ce063
dec dl
jne 0x4ce0b2
mov edx, eax
not edx
and dl, 0xe0
jne 0x4ce0c2
mov edx, eax
and edx, 0x18
cmp dl, 8
je 0x4ce0c8
test al, 6
je 0x4ce0c8
movzx ebx, al
jmp 0x4ce0ab
cmp bl, 0xff
je 0x4ce065
test esi, esi
jne 0x4ce0c2
mov edx, eax
not edx
and dl, 0xe0
jne 0x4ce0c2
mov edx, eax
and edx, 0x18
cmp dl, 8
je 0x4ce0c2
test al, 6
je 0x4ce0c2
movzx ebx, al
mov edi, 0xffffffff
xor esi, esi
mov dl, 2
jmp 0x4cdfe8
cmp al, 0xff
jne 0x4ce086
mov edi, 0xffffffff
mov dl, 1
jmp 0x4cdfe8
inc esi
jmp 0x4cdfe6
test esi, esi
jmp 0x4ce091
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4e52b9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov al, byte [ebp - 0x24]
mov byte [ebp - 0x29], al
mov esi, dword [edx + 0x28]
xor edi, edi
test esi, esi
je 0x4e52e9
mov edi, dword [esi + 4]
xor edx, edx
cmp edx, edi
je 0x4e5308
mov dword [ebp - 0x34], edx
mov eax, esi
call fcn.00425c8e
mov ebx, eax
mov al, byte [ebp - 0x29]
cmp byte [ebx], al
je 0x4e534a
mov edx, dword [ebp - 0x34]
inc edx
jmp 0x4e52eb
mov dword [esp], 8
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov ebx, eax
test eax, eax
je 0x4e53dd
lea edx, [ebx + 2]
mov ecx, 6
xor eax, eax
mov edi, edx
rep stosb byte es:[edi], al
mov byte [ebx + 1], 1
mov al, byte [ebp - 0x24]
mov byte [ebx], al
call fcn.00425c0a
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x28]
mov edx, ebx
call fcn.00425c52
mov eax, dword [ebp - 0x28]
test byte [eax + 0x12], 4
je 0x4e535c
mov byte [ebx + 1], 0
jmp 0x4e5403
mov dword [esp], 0xc
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
je 0x4e53ad
lea esi, [eax + 2]
mov dword [ebp - 0x20], eax
mov ecx, 0xa
xor eax, eax
mov edi, esi
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov edx, dword [ebp - 0x20]
mov dword [edx + 4], eax
mov esi, dword [ebp - 0x1c]
mov word [edx], si
mov edi, eax
mov esi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00425c52
cmp dword [0x5af090], 0
je 0x4e5403
mov dword [0x611418], 1
mov dword [0x611414], 8
mov dword [ebp + 8], str._HEVCParse__Failed_to_allocate_parameter_set_container_n
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004268ea
cmp dword [0x5af090], 0
je 0x4e5403
mov dword [0x611418], 1
mov dword [0x611414], 8
mov dword [ebp + 8], str._HEVCParse__Failed_to_allocate_parameter_set_array_n
jmp 0x4e53d1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4f5ab5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x2de88
call fcn.005a812c
sub esp, eax
mov eax, dword [esp + eax]
mov ebx, eax
mov dword [esp + 8], 7
mov dword [esp + 4], 0x5f4df0
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
test eax, eax
jne 0x4f5b41
lea eax, [ebp - 0x2de7c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2de80]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5f4df8
mov dword [esp], ebx
call fcn.005ae14c
cmp eax, 2
jne 0x4f5b53
mov ecx, dword [ebp - 0x2de80]
cmp ecx, 0x2de60
jbe 0x4f5b2f
mov dword [ebp - 0x2de80], 0x2de60
mov ecx, 0x2de60
lea eax, [ebp - 0x2de78]
mov esi, dword [ebp - 0x2de7c]
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4f5b8f
mov edx, 0x5f3cd3
mov eax, ebx
call fcn.00427968
mov ebx, eax
test eax, eax
jne 0x4f5b57
xor eax, eax
jmp 0x4f5bc3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2de60
mov dword [esp + 4], 1
lea eax, [ebp - 0x2de78]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov dword [ebp - 0x2de80], eax
mov eax, ebx
call fcn.00425b84
cmp dword [ebp - 0x2de80], 0
jle 0x4f5b53
call fcn.004f5018
mov ebx, eax
lea edx, [ebp - 0x2de78]
mov ecx, dword [ebp - 0x2de80]
call fcn.004f3840
mov esi, eax
cmp dword [ebx + 0x84c8], 0
jne 0x4f5bb5
or esi, 0xffffffff
mov eax, ebx
call fcn.004f50fa
xor eax, eax
test esi, esi
sete al
add esp, 0x2de8c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5048f3
Capabilities:
Contain obfuscated stackstrings
Read file on windows
Resolve function by parsing pe exports

Disassembly:
test eax, eax
je 0x504a30
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, eax
mov eax, dword [eax + 0x10]
cmp dword [ebx + 0xc], 0
jne 0x504918
bt eax, 0x1e
jae 0x504a34
test al, 1
je 0x50498b
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x50497e
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strrchr
mov esi, eax
test eax, eax
je 0x50497e
mov dword [esp + 8], 3
mov dword [esp + 4], 0x5f7e5e
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll__strnicmp
test eax, eax
jne 0x504962
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.004ffdf1
mov dword [esp + 8], 4
mov dword [esp + 4], str..m2t
mov dword [esp], esi
call sub.api_ms_win_crt_string_l1_1_0.dll__strnicmp
test eax, eax
je 0x504955
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.004fba4a
test al, 2
je 0x50499c
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.004f70f8
test al, 4
je 0x5049ad
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.004f8ea1
test al, 0x10
je 0x5049be
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.004f92b5
test al, 8
je 0x5049cf
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.004f9b54
test al, 0x20
je 0x5049e0
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.004f8828
test al, 0x40
je 0x5049f3
xor edx, edx
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.004faa4e
test al, 0x80
je 0x504a0a
bt eax, 0x1e
jae 0x504a01
xor eax, eax
jmp 0x504a3e
mov eax, ebx
call fcn.00500514
jmp 0x5049fd
bt eax, 8
jae 0x504a1d
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.004fece0
bt eax, 0xe
jae 0x504a39
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop ebp
jmp fcn.004ff87a
or eax, 0xffffffff
ret
or eax, 0xffffffff
jmp 0x504a3e
mov eax, 0xfffffffc
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x504a45
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, eax
mov esi, ecx
xor ebx, ebx
cmp ebx, esi
jae 0x504a85
mov dword [esp + 0xc], edi
mov eax, esi
sub eax, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [edx + ebx]
mov dword [ebp - 0x1c], edx
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
test eax, eax
jle 0x504a85
add ebx, eax
mov edx, dword [ebp - 0x1c]
jmp 0x504a54
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x504e93
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp], edx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp ebx, eax
sete al
movzx eax, al
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x507b89
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 5
mov dword [esp + 4], 1
lea eax, [ebp - 0xd]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
test eax, eax
jle 0x507c64
mov dl, byte [ebp - 0xd]
or eax, 0xffffffff
cmp dl, 0xff
jne 0x507bf4
cmp byte [ebp - 0xc], 0xfe
jne 0x507c67
mov dl, byte [ebp - 0xb]
or dl, byte [ebp - 0xa]
je 0x507c67
xor eax, eax
mov dword [esp], eax
mov edx, 2
xor ecx, ecx
mov eax, ebx
call fcn.00425b5e
mov eax, 3
jmp 0x507c67
cmp dl, 0xfe
jne 0x507c21
cmp byte [ebp - 0xc], 0xff
jne 0x507c67
mov dl, byte [ebp - 0xb]
or dl, byte [ebp - 0xa]
je 0x507c67
xor ecx, ecx
mov dword [esp], ecx
mov edx, 2
xor ecx, ecx
mov eax, ebx
call fcn.00425b5e
mov eax, 2
jmp 0x507c67
cmp dl, 0xef
jne 0x507c4c
cmp byte [ebp - 0xc], 0xbb
jne 0x507c67
cmp byte [ebp - 0xb], 0xbf
jne 0x507c67
xor edx, edx
mov dword [esp], edx
mov edx, 3
xor ecx, ecx
mov eax, ebx
call fcn.00425b5e
mov eax, 1
jmp 0x507c67
test dl, dl
js 0x507c67
xor eax, eax
mov dword [esp], eax
xor edx, edx
xor ecx, ecx
mov eax, ebx
call fcn.00425b5e
xor eax, eax
jmp 0x507c67
or eax, 0xffffffff
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x516432
Capabilities:
Get geographical location
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, eax
mov ebx, edx
cmp dword [eax], 2
jne 0x51645e
mov eax, dword [eax + 0xc]
test byte [eax + 0x2c], 1
jne 0x51645e
mov eax, edx
call fcn.0046934a
test eax, eax
jne 0x51647c
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.00452fd8
mov eax, ebx
call fcn.00452fd8
test eax, eax
jne 0x51647c
mov edx, dword [esi + 0xc]
test byte [edx + 0x2c], 1
jne 0x51647c
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.0046934a
pop ebx
pop esi
pop ebp
ret
Function at 0x54b36f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, eax
mov ebx, edx
shr edx, 0x10
movzx edx, dl
call fcn.0042633b
movzx edx, bh
mov eax, esi
call fcn.0042633b
movzx edx, bl
mov eax, esi
call fcn.0042633b
shr ebx, 0x18
mov edx, ebx
mov eax, esi
pop ebx
pop esi
pop ebp
jmp fcn.0042633b

Function at 0x54b3d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
mov esi, edx
movsx edx, word [edx]
call fcn.00426343
movsx edx, word [esi + 2]
mov eax, ebx
call fcn.00426343
movsx edx, word [esi + 4]
mov eax, ebx
call fcn.00426343
movsx edx, word [esi + 6]
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.00426343

Function at 0x54b530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
mov esi, edx
movzx edx, word [edx]
call fcn.00426343
movzx edx, word [esi + 2]
mov eax, ebx
call fcn.00426343
movzx edx, word [esi + 4]
mov eax, ebx
call fcn.00426343
movzx edx, byte [esi + 6]
mov eax, ebx
call fcn.0042633b
movzx edx, byte [esi + 7]
mov eax, ebx
call fcn.0042633b
mov edx, dword [esi + 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
jmp fcn.0054b36f
Function at 0x5640e7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [ebp - 0x1c], eax
mov edi, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [edx]
test eax, eax
je 0x564106
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor edx, edx
mov dword [edi], edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [eax], ecx
mov edx, 0x60209b
mov eax, dword [ebp - 0x1c]
call fcn.00427968
mov ebx, eax
test eax, eax
jne 0x56415d
cmp dword [0x5af090], 1
jbe 0x5641f9
mov dword [0x611418], 2
mov dword [0x611414], 8
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], str._ODF_Parse__cannot_open_data_file__s___skipping_n
call fcn.004268ea
jmp 0x5641f9
mov dword [esp], 2
xor edx, edx
xor ecx, ecx
call fcn.00425b5e
mov dword [esp], ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov esi, eax
xor eax, eax
mov dword [esp], eax
xor edx, edx
xor ecx, ecx
mov eax, ebx
call fcn.00425b5e
mov eax, dword [ebp - 0x20]
mov dword [eax], esi
mov dword [esp], esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov dword [edi], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp esi, eax
je 0x5641eb
cmp dword [0x5af090], 1
jbe 0x5641eb
mov dword [0x611418], 2
mov dword [0x611414], 8
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], str._ODF_Parse__readen_size_d_does_not_match_size_d_in__s_n
call fcn.004268ea
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00425b84
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x56fda7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov dword [esp], 0x58
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov ebx, eax
test eax, eax
jne 0x56fdf7
cmp dword [0x5af054], 0
je 0x56fef6
mov dword [0x611418], 1
mov dword [0x611414], 3
mov dword [esp], str._Downloader__Failed_to_allocate_downloader_n
call fcn.004268ea
jmp 0x56fef6
mov ecx, 0x16
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
call fcn.00425c0a
mov dword [ebx + 0x1c], eax
call fcn.00425c0a
mov dword [ebx + 0x4c], eax
call fcn.00425c0a
mov dword [ebx + 0x48], eax
call fcn.00425c0a
mov dword [ebx + 0x44], eax
call fcn.00425c0a
mov dword [ebx + 0x50], eax
xor edx, edx
mov dword [ebx + 0x18], edx
mov eax, str.download_manager_cache_mx
call fcn.0053ec83
mov dword [ebx], eax
call fcn.0057fbcb
lea esi, [ebp - 0x11c]
mov dword [esp + 4], esi
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push ecx
push ecx
mov dword [esp], esi
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
mov esi, eax
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp byte [esi + eax - 1], 0x5c
je 0x56fe9e
add eax, 2
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov dword [ebx + 4], eax
mov dword [esp + 0xc], 0x5c
mov dword [esp + 8], esi
mov dword [esp + 4], str._s_c
mov dword [esp], eax
call fcn.005ae188
jmp 0x56fea9
mov dword [esp], esi
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
mov dword [ebx + 4], eax
mov dword [esp], 0x60475a
mov ecx, str.MaxRate
mov edx, str.Downloader
xor eax, eax
call fcn.005a3b0b
mov eax, 0x20000
cmp dword [ebx + 0x30], 0
je 0x56fed1
mov eax, 0x400
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x10], 0x1388
mov dword [ebx + 0x14], 0x4e20
mov eax, dword [ebx]
call fcn.0053edf9
mov dword [esp], esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x591044
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1028
call fcn.005a812c
sub esp, eax
mov eax, dword [esp + eax]
mov dword [ebp - 0x101c], eax
mov esi, edx
mov edx, 0x6085e5
mov eax, esi
call fcn.00427968
test eax, eax
jne 0x5910a8
cmp dword [0x5af144], 1
jbe 0x591181
mov dword [0x611418], 2
mov dword [0x611414], 0x17
mov dword [esp + 4], esi
mov dword [esp], str._DASH__Error_opening_period_MPD_file__s_n
call fcn.004268ea
jmp 0x591181
mov ebx, eax
mov dword [esp], 2
xor edx, edx
xor ecx, ecx
call fcn.00425b5e
mov dword [esp], ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov esi, eax
xor eax, eax
mov dword [esp], eax
xor edx, edx
xor ecx, ecx
mov eax, ebx
call fcn.00425b5e
test esi, esi
je 0x591170
mov edx, 0x1000
cmp esi, edx
mov edi, edx
cmovbe edi, esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], 1
lea ecx, [ebp - 0x1018]
mov dword [esp], ecx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp edi, eax
lea ecx, [ebp - 0x1018]
je 0x59114b
cmp dword [0x5af144], 1
jbe 0x591142
mov dword [0x611418], 2
mov dword [0x611414], 0x17
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], str._DASH__Error_reading_from_period_MPD_file:_got__d_but_requested__d_bytes_n
call fcn.004268ea
mov eax, ebx
call fcn.00425b84
jmp 0x591181
mov eax, dword [ebp - 0x101c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], ecx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
sub esi, edi
jmp 0x5910d5
mov eax, ebx
add esp, 0x102c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00425b84
add esp, 0x102c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5a3a0e
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x5a3af3
mov eax, dword [eax + 4]
test eax, eax
je 0x5a3af3
mov ebx, edx
mov dword [esp + 0x10], 4
test edx, edx
lea ecx, [ebp - 0xc]
mov edx, dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [esp + 0xc], ecx
je 0x5a3a50
mov dword [esp + 8], 0x1001
jmp 0x5a3a58
mov dword [esp + 8], 0x1002
mov dword [esp + 4], 0xffff
mov dword [esp], eax
call edx
sub esp, 0x14
mov edx, dword [0x5af054]
test eax, eax
jns 0x5a3ab5
test edx, edx
je 0x5a3af3
mov dword [0x611418], 1
mov dword [0x611414], 3
mov ecx, dword [ebp - 0xc]
mov edx, str.receive
test ebx, ebx
je 0x5a3a9b
mov edx, str.send
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], str._Socket__Couldnt_set_socket__s_buffer_size_to__d:__d_n
call fcn.004268ea
jmp 0x5a3af3
cmp edx, 3
jbe 0x5a3af3
mov dword [0x611418], 4
mov dword [0x611414], 3
mov edx, dword [ebp - 0xc]
mov eax, str.receive
test ebx, ebx
je 0x5a3adf
mov eax, str.send
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str._Socket__Set_socket__s_buffer_size_to__d_n
call fcn.004268ea
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x5a3f99
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, eax
mov dword [esp], eax
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
inc eax
jne 0x5a3fe2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x5af030], 0
je 0x5a3fe2
mov dword [0x611418], 1
xor edx, edx
mov dword [0x611414], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], str.Cannot_create_directory__s:_last_error__d_n
call fcn.004268ea
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x5a7ecc
Capabilities:
Parse pe header

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
jne 0x5a7ef1
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x5a7ef1
xor edx, edx
cmp word [eax + 0x18], 0x10b
sete dl
mov eax, edx
pop ebp
ret

Function at 0x5a7ef5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
add edx, dword [edx + 0x3c]
movzx eax, word [edx + 0x14]
movzx esi, word [edx + 6]
lea eax, [edx + eax + 0x18]
cmp ebx, esi
jae 0x5a7f29
mov edx, dword [eax + 0xc]
cmp ecx, edx
jb 0x5a7f23
add edx, dword [eax + 8]
cmp ecx, edx
jb 0x5a7f2b
inc ebx
add eax, 0x28
jmp 0x5a7f11
xor eax, eax
pop ebx
pop esi
pop ebp
ret