joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8600
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x86
call fcn.005b449a
xor edi, edi
add esp, 4
cmp eax, edi
je 0x4e866f
mov dword [eax + 0x10], edi
mov dword [eax + 0x18], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x48], edi
mov dword [eax + 0x50], edi
mov dword [eax + 0x28], edi
mov dword [eax + 0x30], edi
mov dword [eax + 0x38], edi
mov dword [eax + 0x40], edi
mov dword [eax + 8], edi
mov word [eax + 0xc], 9
mov word [eax + 0xe], di
mov dword [eax + 0x14], edi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x4c], edi
mov dword [eax + 0x54], edi
mov word [eax + 0x58], di
mov word [eax + 0x5a], di
mov word [eax + 0x5c], di
mov dword [eax + 0x2c], edi
mov dword [eax + 0x34], edi
mov dword [eax + 0x3c], edi
mov dword [eax + 0x44], edi
mov word [eax + 0x5e], di
mov edx, eax
jmp 0x4e8671
xor edx, edx
mov ecx, dword [esp + 0x10]
lea eax, [edx + 8]
mov ebx, dword [ecx]
mov dword [eax], ebx
mov bx, word [ecx + 4]
mov word [eax + 4], bx
mov ebx, dword [ecx + 8]
mov dword [eax + 8], ebx
mov ebx, dword [ecx + 0xc]
mov dword [eax + 0xc], ebx
mov ebx, dword [ecx + 0x10]
mov dword [eax + 0x10], ebx
mov ebx, dword [ecx + 0x14]
mov dword [eax + 0x14], ebx
mov ebx, dword [ecx + 0x18]
mov dword [eax + 0x18], ebx
mov ebx, dword [ecx + 0x1c]
mov dword [eax + 0x1c], ebx
mov ebx, dword [ecx + 0x20]
mov dword [eax + 0x20], ebx
mov ebx, dword [ecx + 0x24]
mov dword [eax + 0x24], ebx
mov ebx, dword [ecx + 0x28]
mov dword [eax + 0x28], ebx
mov ebx, dword [ecx + 0x2c]
mov dword [eax + 0x2c], ebx
mov ebx, dword [ecx + 0x30]
mov dword [eax + 0x30], ebx
mov ebx, dword [ecx + 0x34]
mov dword [eax + 0x34], ebx
mov ebx, dword [ecx + 0x38]
mov dword [eax + 0x38], ebx
mov ebx, dword [ecx + 0x3c]
mov dword [eax + 0x3c], ebx
mov bx, word [ecx + 0x50]
mov word [eax + 0x50], bx
mov bx, word [ecx + 0x52]
mov word [eax + 0x52], bx
mov bx, word [ecx + 6]
mov word [eax + 6], bx
mov ebx, dword [ecx + 0x48]
mov dword [eax + 0x48], ebx
mov ebx, dword [ecx + 0x4c]
mov dword [eax + 0x4c], ebx
mov ebx, dword [ecx + 0x40]
mov dword [eax + 0x40], ebx
mov ebx, dword [ecx + 0x44]
mov dword [eax + 0x44], ebx
mov cx, word [ecx + 0x54]
mov word [eax + 0x54], cx
mov ecx, dword [esi + 8]
cmp ecx, edi
jne 0x4e8740
mov ecx, dword [esi + 4]
mov dword [edx], edi
mov dword [edx + 4], ecx
mov ecx, dword [esi + 4]
cmp ecx, edi
je 0x4e8728
mov dword [ecx], edx
mov ecx, dword [esi + 8]
mov dword [esi + 4], edx
cmp ecx, edi
jne 0x4e875e
mov ecx, dword [esi]
mov dword [esi + 8], edx
inc ecx
pop edi
mov dword [esi], ecx
pop esi
pop ebx
ret 4
mov ebx, dword [ecx + 4]
mov dword [edx], ecx
mov dword [edx + 4], ebx
mov ebx, dword [ecx + 4]
cmp ebx, edi
je 0x4e8751
mov dword [ebx], edx
mov dword [ecx + 4], edx
mov edi, dword [esi + 8]
cmp ecx, edi
jne 0x4e875e
mov dword [esi + 8], edx
mov ecx, dword [esi]
pop edi
inc ecx
mov dword [esi], ecx
pop esi
pop ebx
ret 4
Function at 0x4e9a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5dc6ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0xc], ebx
mov dword [ebx], 0x5f0730
xor esi, esi
mov dword [esp + 0x18], esi
call fcn.004eeeb0
mov edi, dword [ebx + 0x74]
mov dword [esp + 0x18], 0xffffffff
cmp edi, esi
je 0x4e9aba
mov eax, edi
mov edi, dword [edi + 4]
cmp eax, esi
je 0x4e9ab6
mov dword [eax + 0x10], esi
mov dword [eax + 0x18], esi
mov dword [eax + 0x20], esi
mov dword [eax + 0x50], esi
mov dword [eax + 0x48], esi
mov dword [eax + 0x28], esi
mov dword [eax + 0x30], esi
mov dword [eax + 0x38], esi
mov dword [eax + 0x40], esi
push eax
mov dword [eax + 8], esi
mov word [eax + 0xc], 9
mov word [eax + 0xe], si
mov dword [eax + 0x14], esi
mov dword [eax + 0x1c], esi
mov dword [eax + 0x24], esi
mov dword [eax + 0x54], esi
mov dword [eax + 0x4c], esi
mov word [eax + 0x58], si
mov word [eax + 0x5a], si
mov word [eax + 0x5c], si
mov dword [eax + 0x2c], esi
mov dword [eax + 0x34], esi
mov dword [eax + 0x3c], esi
mov dword [eax + 0x44], esi
call fcn.005b44c3
add esp, 4
cmp edi, esi
jne 0x4e9a55
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x74], esi
mov dword [ebx + 0x78], esi
mov dword [ebx + 0x70], esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4eef80
Capabilities:
Create thread

Disassembly:
mov ax, word [esp + 4]
push esi
cmp ax, 3
mov esi, ecx
jne 0x4eefa9
cmp word [0x884fd2], 2
jne 0x4eefa2
cmp word [0x88506e], 0
je 0x4eefa9
xor ax, ax
pop esi
ret 4
mov ecx, dword [esi + 0x58]
test ecx, ecx
jne 0x4eefe0
mov word [0x8850d4], ax
lea eax, [esi + 0x5c]
push eax
push 0
push 0x8850d0
push 0x4eeff0
push 0
push 0
mov dword [0x8850d0], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x58], eax
xor ax, ax
pop esi
ret 4
mov ax, 1
pop esi
ret 4

Function at 0x4ef790
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x4ef7cd
mov eax, dword [esp + 8]
lea ecx, [esi + 0x4c]
push ecx
push 0
push 0x8850d0
push 0x4ef7e0
push 0
push 0
mov dword [0x8850d0], esi
mov dword [0x8850d6], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x48], eax
xor ax, ax
pop esi
ret 4
mov ax, 1
pop esi
ret 4

Function at 0x4efc30
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x4efcef
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [0x8850e6], edx
mov edx, dword [esp + 0x1c]
mov dword [0x8850de], eax
mov eax, dword [esp + 0x14]
mov dword [0x8850f2], edx
mov edx, dword [esp + 0x28]
mov dword [0x8850e2], ecx
mov ecx, dword [esp + 0x18]
mov dword [0x885102], edx
mov edx, dword [esp + 0x34]
mov dword [0x8850ea], eax
mov eax, dword [esp + 0x20]
mov dword [0x8850ee], ecx
mov ecx, dword [esp + 0x24]
mov dword [0x88510e], edx
lea edx, [esi + 0x40]
mov dword [0x8850f6], eax
mov eax, dword [esp + 0x2c]
mov dword [0x8850fa], ecx
mov ecx, dword [esp + 0x30]
push edx
push 0
push 0x8850d0
mov dword [0x885106], eax
mov eax, dword [esp + 0x44]
mov dword [0x88510a], ecx
mov ecx, dword [esp + 0x48]
push 0x4efd00
push 0
push 0
mov dword [0x8850d0], esi
mov dword [0x8850fe], eax
mov dword [0x8850da], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x3c], eax
xor ax, ax
pop esi
ret 0x38
mov ax, 1
pop esi
ret 0x38

Function at 0x4f01a0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x4f01de
mov eax, dword [esp + 8]
lea ecx, [esi + 0x30]
push ecx
push 0
push 0x8850d0
push 0x4f01f0
push 0
mov dword [esi + 0xac], eax
push 0
mov dword [0x8850d0], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2c], eax
xor ax, ax
pop esi
ret 4
mov ax, 1
pop esi
ret 4
Function at 0x4f1ad0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x4f1b62
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esi + 0xac], eax
mov eax, dword [esp + 0x14]
mov dword [0x885112], ecx
mov ecx, dword [esp + 0x18]
mov dword [0x88511a], eax
mov eax, dword [esp + 0x20]
mov dword [0x885116], edx
mov dx, word [esp + 0x1c]
mov dword [0x885124], eax
lea eax, [esi + 0x38]
mov dword [0x88511e], ecx
mov ecx, dword [esp + 0x24]
push eax
push 0
push 0x8850d0
mov word [0x885122], dx
mov edx, dword [esp + 0x34]
push 0x4f1b70
push 0
push 0
mov dword [0x8850d0], esi
mov dword [0x885128], ecx
mov dword [0x88512c], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x34], eax
xor ax, ax
pop esi
ret 0x24
mov ax, 1
pop esi
ret 0x24

Function at 0x4f3090
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x4f30fe
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [0x8850ac], eax
mov eax, dword [esp + 0x14]
mov dword [0x8850b0], ecx
mov ecx, dword [esp + 0x18]
mov dword [0x8850b8], eax
lea eax, [esi + 0x28]
mov dword [0x8850b4], edx
mov edx, dword [esp + 0x1c]
push eax
push 0
push 0x8850a8
push 0x4f3110
push 0
push 0
mov dword [0x8850a8], esi
mov dword [0x8850bc], ecx
mov dword [0x8850c0], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x24], eax
xor ax, ax
pop esi
ret 0x18
mov ax, 1
pop esi
ret 0x18
Function at 0x4f4800
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x4f4980
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov dword [0x884f74], eax
mov eax, dword [esp + 0x4c]
mov dword [0x884f78], ecx
mov ecx, dword [esp + 0x50]
mov dword [0x884f80], eax
mov eax, dword [esp + 0x58]
mov dword [0x884f7c], edx
mov edx, dword [esp + 0x54]
mov dword [0x884f8c], eax
mov eax, dword [esp + 0x64]
mov dword [0x884f84], ecx
mov ecx, dword [esp + 0x5c]
mov dword [0x884f98], eax
mov eax, dword [esp + 0x70]
mov dword [0x884f88], edx
mov edx, dword [esp + 0x60]
mov dword [0x884fa4], eax
mov eax, dword [esp + 0xc]
mov dword [0x884f90], ecx
mov ecx, dword [esp + 0x68]
mov dword [0x884f94], edx
mov edx, dword [esp + 0x6c]
mov dword [0x884f40], eax
mov eax, dword [esp + 0x18]
mov dword [0x884f9c], ecx
mov ecx, dword [esp + 0x74]
mov dword [0x884fa0], edx
mov edx, dword [esp + 8]
mov dword [0x884f4c], eax
mov eax, dword [esp + 0x24]
mov dword [0x884fa8], ecx
mov ecx, dword [esp + 0x10]
mov dword [0x884f3c], edx
mov edx, dword [esp + 0x14]
mov dword [0x884f58], eax
mov eax, dword [esp + 0x30]
mov dword [0x884f44], ecx
mov ecx, dword [esp + 0x1c]
mov dword [0x884f48], edx
mov edx, dword [esp + 0x20]
mov dword [0x884f64], eax
mov eax, dword [esp + 0x3c]
mov dword [0x884f50], ecx
mov ecx, dword [esp + 0x28]
mov dword [0x884f54], edx
mov edx, dword [esp + 0x2c]
mov dword [0x884f70], eax
mov eax, dword [esp + 0x80]
mov dword [0x884f5c], ecx
mov ecx, dword [esp + 0x34]
mov dword [0x884f60], edx
mov edx, dword [esp + 0x38]
mov dword [0x884fb4], eax
lea eax, [esi + 0x20]
mov dword [0x884f68], ecx
mov ecx, dword [esp + 0x78]
mov dword [0x884f6c], edx
mov edx, dword [esp + 0x7c]
push eax
push 0
push 0x884f38
mov dword [0x884fac], ecx
mov ecx, dword [esp + 0x90]
mov dword [0x884fb0], edx
mov edx, dword [esp + 0x94]
push 0x4f4990
push 0
push 0
mov dword [0x884f38], esi
mov dword [0x884fb8], ecx
mov dword [0x884fbc], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
xor ax, ax
pop esi
ret 0x84
mov ax, 1
pop esi
ret 0x84
Function at 0x503fc0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5de440
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push edi
xor edi, edi
push 0x20
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 2
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], edi
call fcn.00401510
push 0x100
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 3
call fcn.00401510
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push 0x100
push ecx
push 0x87f498
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebp, dword [esp + 0x10]
mov eax, ebp
mov cx, word [eax]
mov edx, ecx
and edx, 0xffff
test edx, 0xffffff00
jne 0x504065
and ecx, 0xff
mov cl, byte [ecx + 0x638474]
and ecx, 0x40
mov dword [esp + 8], ecx
je 0x504065
add eax, 2
jmp 0x504038
xor ecx, ecx
mov cx, word [eax]
sub ecx, 0x2b
je 0x504079
sub ecx, 2
jne 0x50407c
mov edi, 1
add eax, 2
fld qword [0x5e80d8]
fld qword [0x5e7c10]
mov cx, word [eax]
mov edx, ecx
and edx, 0xffff
test edx, 0xffffff00
jne 0x5040d2
mov edx, ecx
and edx, 0xff
mov dl, byte [edx + 0x638474]
and edx, 1
mov dword [esp + 8], edx
je 0x5040d2
and ecx, 0xffff
sub ecx, 0x30
add eax, 2
mov dword [esp + 8], ecx
fild dword [esp + 8]
fxch st(2)
fmul qword [0x5e89c0]
faddp st(2)
jmp 0x504088
cmp word [eax], 0x2e
jne 0x504123
mov cx, word [eax + 2]
add eax, 2
mov edx, ecx
and edx, 0xffff
test edx, 0xffffff00
jne 0x504123
mov edx, ecx
and edx, 0xff
mov dl, byte [edx + 0x638474]
and edx, 1
mov dword [esp + 8], edx
je 0x504123
fmul qword [0x5e8c50]
and ecx, 0xffff
sub ecx, 0x30
mov dword [esp + 8], ecx
fild dword [esp + 8]
fmul st(1)
faddp st(2)
jmp 0x5040d8
mov cx, word [eax]
push esi
cmp cx, 0x45
fstp st(0)
je 0x504135
cmp cx, 0x65
jne 0x5041a6
add eax, 2
xor ecx, ecx
mov cx, word [eax]
sub ecx, 0x2b
je 0x504152
sub ecx, 2
jne 0x504155
fld qword [0x5eacd8]
add eax, 2
jmp 0x50415b
add eax, 2
fld qword [0x5e89c0]
xor esi, esi
mov cx, word [eax]
mov edx, ecx
and edx, 0xffff
test edx, 0xffffff00
jne 0x504199
mov edx, ecx
and edx, 0xff
mov dl, byte [edx + 0x638474]
and edx, 1
mov dword [esp + 0xc], edx
je 0x504199
lea edx, [esi + esi*4]
and ecx, 0xffff
add eax, 2
lea esi, [ecx + edx*2 - 0x30]
jmp 0x50415d
test esi, esi
jbe 0x5041a4
fld st(0)
dec esi
fmulp st(2)
jne 0x50419d
fstp st(0)
test edi, edi
pop esi
je 0x5041ad
fchs
fstp qword [esp + 8]
push ebp
mov byte [esp + 0x28], 2
call fcn.005b44c3
add esp, 4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 1
call fcn.005b4761
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call fcn.005b4761
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], 0xffffffff
call fcn.005b4761
mov ecx, dword [esp + 0x1c]
pop edi
fld qword [esp + 4]
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x504210
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5de470
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
xor edi, edi
push 0x20
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 2
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edi
call fcn.00401510
push 0x100
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 3
call fcn.00401510
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push 0x100
push ecx
push 0x87f498
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [esp + 0x18]
mov ax, word [esi]
mov ecx, eax
and ecx, 0xffff
test ecx, 0xffffff00
jne 0x5042b4
and eax, 0xff
mov dl, byte [eax + 0x638474]
and edx, 0x40
mov dword [esp + 0x10], edx
je 0x5042b4
add esi, 2
jmp 0x504288
xor eax, eax
mov ax, word [esi]
sub eax, 0x2b
je 0x5042d1
sub eax, 2
jne 0x5042d4
mov edx, 1
add esi, 2
mov dword [esp + 0x10], edx
jmp 0x5042da
add esi, 2
xor edx, edx
mov dword [esp + 0x10], edx
cmp word [esi], 0x30
jne case.0x5042fc.68
add esi, 2
xor eax, eax
mov ax, word [esi]
add eax, 0xffffffbe
cmp eax, 0x36
ja case.0x5042fc.68
xor ecx, ecx
mov cl, byte [eax + 0x504438]
jmp dword [ecx*4 + 0x50442c]
mov ebp, 0x10
jmp 0x50430f
mov ebp, 2
add esi, 2
mov cx, word [esi]
add esi, 2
mov eax, ecx
and eax, 0xffff
test eax, 0xffffff00
jne 0x50435e
and ecx, 0xff
xor ebx, ebx
mov bl, byte [ecx + 0x638474]
mov ecx, ebx
and ebx, 2
mov dword [esp + 0x10], ebx
je 0x50435e
mov ebx, ebp
imul edi, ebx
and ecx, 1
mov dword [esp + 0x10], ecx
je 0x504354
add eax, 0xffffffd0
add edi, eax
jmp 0x504312
and eax, 7
add eax, 9
add edi, eax
jmp 0x504312
test edx, edx
je 0x5043d5
jmp 0x5043d3
xor ebp, ebp
mov cx, word [esi]
add esi, 2
mov eax, ecx
and eax, 0xffff
test eax, 0xffffff00
jne 0x5043bd
mov edx, ecx
xor ebx, ebx
and edx, 0xff
mov bl, byte [edx + 0x638474]
mov edx, ebx
and ebx, 2
mov dword [esp + 0x14], ebx
je 0x5043bd
lea ecx, [edi + edi*4]
shl ecx, 1
shl ebp, 4
and edx, 1
mov dword [esp + 0x14], edx
je 0x5043b0
lea edi, [ecx + eax - 0x30]
lea ebp, [eax + ebp - 0x30]
jmp 0x504366
and eax, 7
lea edi, [ecx + eax + 9]
lea ebp, [eax + ebp + 9]
jmp 0x504366
cmp cx, 0x68
je 0x5043c9
cmp cx, 0x48
jne 0x5043cb
mov edi, ebp
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5043d5
neg edi
mov eax, dword [esp + 0x18]
mov byte [esp + 0x2c], 2
push eax
call fcn.005b44c3
add esp, 4
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 1
call fcn.005b4761
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 0
call fcn.005b4761
lea ecx, [esp + 0x3c]
mov dword [esp + 0x2c], 0xffffffff
call fcn.005b4761
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x5202a0
Capabilities:
Connect to http server
Create http request
Create thread

Disassembly:
sub esp, 0x204
push esi
mov esi, ecx
mov eax, dword [esi + 0x5d0]
test eax, eax
je 0x5202b8
call fcn.00520430
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
mov dword [esi + 0x5d0], 0
push eax
push 0
push esi
push 0x51fd00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x885bc8], eax
call fcn.005cb95c
mov eax, dword [eax + 0x10]
lea ecx, [esi + 0x13c]
push 0
lea edx, [esi + 0xbc]
push ecx
push edx
push 1
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov dword [esi + 4], eax
pop edi
jne 0x520336
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0051fe70
add esp, 8
xor eax, eax
pop esi
add esp, 0x204
ret
push 0x51fad0
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallback]
cmp eax, 0xffffffff
jne 0x52036f
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0051fe70
mov edx, dword [esi + 4]
add esp, 8
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
pop esi
add esp, 0x204
ret
mov dx, word [esi + 0x17c]
push 0
push 0x8000000
lea eax, [esi + 0x7c]
push 1
lea ecx, [esi + 0x3c]
push eax
push ecx
mov ecx, dword [esi + 4]
lea eax, [esi + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi + 8], eax
jne 0x5203c5
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0051fe70
mov eax, dword [esi + 4]
add esp, 8
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
pop esi
add esp, 0x204
ret
push str.DATA
mov ecx, esi
mov dword [esi + 0x5d0], 1
call fcn.00520b30
test eax, eax
jne 0x52040f
push str.DATA
mov ecx, esi
call fcn.00520b10
push str.DATA
mov ecx, esi
call fcn.00520ae0
push str.DATA
mov ecx, esi
call fcn.00520b50
push str.DATA
mov ecx, esi
call fcn.00520b30
mov ecx, esi
call fcn.00520980
mov dword [esi + 0x5aa], 0x52c
mov eax, 1
pop esi
add esp, 0x204
ret
Function at 0x520470
Capabilities:
Create thread

Disassembly:
sub esp, 0x200
xor eax, eax
push ebx
mov ebx, dword [esp + 0x208]
push esi
mov esi, ecx
push edi
push ebx
lea edx, [esi + 0x186]
mov ecx, 0x41
mov edi, edx
push 0x62353c
push 0x104
push edx
rep stosd dword es:[edi], eax
call fcn.0053109c
lea edx, [esi + 0x38e]
mov ecx, 0x41
xor eax, eax
mov edi, edx
add esp, 0x10
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x214]
push eax
push 0x62353c
push 0x104
push edx
call fcn.0053109c
mov eax, dword [esp + 0x228]
add esp, 0x10
test eax, eax
mov dword [esi + 0x596], eax
mov dword [esi + 0x5b4], 0
mov dword [esi + 0x5ae], 1
jne 0x520516
push 0x2e
push ebx
call fcn.0053110c
push eax
call fcn.0051fa90
add esp, 0xc
neg eax
sbb eax, eax
add eax, 2
mov dword [esi + 0x596], eax
push 1
mov ecx, esi
call fcn.005208a0
mov edx, eax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 0x5d0]
mov dword [esi + 0x5a6], edx
test eax, eax
mov dword [esi + 0x5a2], 0
jne 0x520559
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x200
ret 0xc
mov eax, dword [esi + 0x59a]
test eax, eax
je 0x520576
mov ecx, dword [esi + 0x5aa]
push edx
push 0
push ecx
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x520591
mov eax, dword [esi + 0x59e]
test eax, eax
je 0x520591
push edx
mov edx, dword [esi + 0x5aa]
push 0
push edx
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov eax, dword [esi + 0x17e]
test eax, eax
je 0x5205ac
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x17e], 0
lea eax, [esi + 0x182]
push eax
push 0
push esi
push 0x51fda0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x17e], eax
jne 0x5205f1
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0051fe70
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x200
ret 0xc
mov eax, 1
pop edi
mov dword [esi + 0x5cc], eax
pop esi
pop ebx
add esp, 0x200
ret 0xc
Function at 0x520670
Capabilities:
Create thread

Disassembly:
sub esp, 0x200
xor eax, eax
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x41
lea edx, [esi + 0x186]
mov dword [esi + 0x5b4], ebx
mov edi, edx
mov dword [esi + 0x5ae], ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x210]
push eax
push 0x62353c
push 0x104
push edx
call fcn.0053109c
lea edx, [esi + 0x38e]
mov ecx, 0x41
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x224]
add esp, 0x10
push edi
push 0x62353c
push 0x104
push edx
call fcn.0053109c
mov eax, dword [esp + 0x228]
add esp, 0x10
cmp eax, ebx
mov dword [esi + 0x596], eax
jne 0x520710
push 0x2e
push edi
call fcn.0053110c
push eax
call fcn.0051fa90
add esp, 0xc
neg eax
sbb eax, eax
add eax, 2
mov dword [esi + 0x596], eax
mov ecx, esi
call fcn.00520940
mov edx, eax
cmp edx, 0xffffffff
mov dword [esi + 0x5a6], edx
jne 0x520738
mov dword [esi + 0x5a6], ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x200
ret 0xc
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esi + 0x5a2], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [esi + 0x5d0], ebx
jne 0x520764
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x200
ret 0xc
mov eax, dword [esi + 0x59a]
cmp eax, ebx
je 0x520780
mov ecx, dword [esi + 0x5aa]
push edx
push ebx
push ecx
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x52079a
mov eax, dword [esi + 0x59e]
cmp eax, ebx
je 0x52079a
push edx
mov edx, dword [esi + 0x5aa]
push ebx
push edx
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov eax, dword [esi + 0x17e]
cmp eax, ebx
je 0x5207b1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x17e], ebx
lea eax, [esi + 0x182]
push eax
push ebx
push esi
push 0x51fef0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x17e], eax
jne 0x5207f3
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0051fe70
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x200
ret 0xc
mov eax, 1
pop edi
mov dword [esi + 0x5cc], eax
pop esi
pop ebx
add esp, 0x200
ret 0xc

Function at 0x520940
Capabilities:
Get file size

Disassembly:
push esi
push 0
push 0x80
push 3
push 0
push 0
add ecx, 0x38e
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x520968
or eax, eax
pop esi
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret