joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45075c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x46b9bc
je 0x450818
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x450800
mov esi, dword [ebx + 4]
jmp 0x4507fa
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4507ea
cmp dword [ebp - 0xc], 4
jne 0x4507ea
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x4507e2
or dword [eax + 0x9c], ecx
jmp 0x4507ea
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x4507ae
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x450791
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x450c09
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x455531
call fcn.00435b50
sub esp, 0x220
mov eax, dword [0x46c3ac]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x228]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x450d02
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test esi, esi
jne 0x450cd6
and dword [ebp - 4], eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x224]
call fcn.00403a80
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x228]
mov byte [ebp - 4], 1
call fcn.00450c09
mov ecx, dword [ebp - 0x224]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00403260
test bl, bl
jne 0x450cd6
or dword [ebp - 4], 0xffffffff
jmp 0x450c47
cmp esi, 0x103
je 0x450ce6
cmp esi, 0x3f2
jne 0x450cf6
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.00431d98
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x451579
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x4515ae
cmp edi, dword [esi + 0xc]
jge 0x4515ae
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4515ae
cmp edi, dword [eax + 8]
jge 0x4515ae
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x4515b0
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4516b4
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4516e8
jmp fcn.00445dee
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x451759
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x451852
cmp eax, dword [edi + 0xc]
jge 0x451852
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x4517aa
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x45183b
cmp dword [ebp + 0xc], ebx
je 0x45183b
jmp 0x4517d4
push 0x10
call fcn.00451445
cmp eax, ebx
je 0x4517c0
mov ecx, eax
call fcn.004516ab
mov esi, eax
jmp 0x4517c2
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x4517eb
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x4517fb
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x45180d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00445dee
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.00435af0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x45184d
cmp ecx, dword [esi + 8]
jge 0x45184d
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x451853
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x451911
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x45193f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45195d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0045187b
jmp 0x45195d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x45195d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0045187b
test edi, edi
mov eax, edi
jne 0x451947
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x46f8f4]
test ecx, ecx
je 0x451a10
jmp 0x451910
ret 8
Function at 0x8ead30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x48d000]
push edi
jmp 0x8ead4a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8ead51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8ead40
mov eax, 1
add ebx, ebx
jne 0x8ead63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8ead74
jne 0x8ead93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8ead93
dec eax
add ebx, ebx
jne 0x8ead80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8ead58
add ebx, ebx
jne 0x8ead8f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x8eade5
xor ecx, ecx
sub eax, 3
jb 0x8eadab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8eae1a
sar eax, 1
mov ebp, eax
jmp 0x8eadb6
add ebx, ebx
jne 0x8eadb6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8ead84
inc ecx
add ebx, ebx
jne 0x8eadc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8ead84
add ebx, ebx
jne 0x8eadd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x8eadc6
jne 0x8eade2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8eadc6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8eae04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8eadf6
jmp 0x8ead46
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8eae04
add edi, ecx
jmp 0x8ead46
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8eae22
cmp byte [edi], 0x11
jne 0x8eae22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8eae27
lea edi, [esi + 0x4e3000]
mov eax, dword [edi]
or eax, eax
je 0x8eae9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8eef8c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ef108]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8eae54
mov ecx, edi
jns 0x8eae83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8ef10c]
or eax, eax
je 0x8eae99
mov dword [ebx], eax
add ebx, 4
jmp 0x8eae71
call dword [esi + 0x8ef11c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x8eaed0
cmp al, 0xef
ja 0x8eaec3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x8eaea5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x8eaeb2
mov ebp, dword [esi + 0x8ef110]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8eaf04
sub esp, 0xffffff80
jmp 0x420577
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0043378f
jae 0x43370e
xor ecx, ecx
call fcn.0043378f
jae 0x43373d
xor eax, eax
call fcn.0043378f
jae 0x43374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0043378f
adc al, al
jae 0x43372f
jne 0x433779
stosb byte es:[edi], al
jmp 0x433711
call fcn.0043379b
sub ecx, ebx
jne 0x433756
call fcn.00433799
jmp 0x433775
lodsb al, byte [esi]
shr eax, 1
je 0x433783
adc ecx, ecx
jmp 0x433772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00433799
cmp eax, 0x7d00
jae 0x433772
cmp ah, 5
jae 0x433773
cmp eax, 0x7f
ja 0x433774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x433711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x453700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0045378f
jae 0x45370e
xor ecx, ecx
call fcn.0045378f
jae 0x45373d
xor eax, eax
call fcn.0045378f
jae 0x45374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0045378f
adc al, al
jae 0x45372f
jne 0x453779
stosb byte es:[edi], al
jmp 0x453711
call fcn.0045379b
sub ecx, ebx
jne 0x453756
call fcn.00453799
jmp 0x453775
lodsb al, byte [esi]
shr eax, 1
je 0x453783
adc ecx, ecx
jmp 0x453772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00453799
cmp eax, 0x7d00
jae 0x453772
cmp ah, 5
jae 0x453773
cmp eax, 0x7f
ja 0x453774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x453711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x10018277
Capabilities:
Encode data using xor

Disassembly:
pop eax
mov edx, 0x9e8d6674
add al, 0x96
das
xchg edx, eax
or eax, dword [ecx + 0x53]
inc esi
popal
mov ah, 0x22
push esp
invalid

Function at 0x1001e627
Capabilities:
Encode data using xor

Disassembly:
pop ds
mov esi, 0x6d48066b
cmp byte [edx - 0x785d23f4], bl
cmp ch, cl
and ecx, dword [edx + 0x5f]
add ebp, esp
mov ah, 0
inc ebp
invalid
or al, 0xa3
test byte [edx], cl
mov word [ecx], fs
cwde
jmp 0xa9ef910d
xchg dword [ecx + 0x42], ecx
or eax, dword [esi - 0x1be991b]
mov ah, 0xaf
mov eax, dword [0x10309531]
loope 0x1001e59b
mov byte [0x9a9d0e2], al
sti
test dword [esi], 0xf5e9dbce
jbe 0x1001e5b6
inc edx
aaa
dec edi
adc esp, dword [ebx + 0x12]
cmpsd dword [esi], dword es:[edi]
sbb al, 0xfd
xor byte [edi], cl
mov es, ecx
or ah, byte [edi + 6]
xchg esi, eax
aaa
mov cl, bh
cmp al, 0x62
cmpsd dword [esi], dword es:[edi]
outsd dx, dword [esi]
inc ebx
in eax, dx
xor edi, dword [edi - 0x64]
sal byte [ecx - 0x58], 1
aam 0xa
jae 0x1001e5fd
sub ebx, edi
add dword [0x8eb243d8], esi
sub eax, 0xcaffc589
push ecx
std
std
std
fcom qword [edi]
add dword [edi + 0x6b], ebx
popal
jge 0x1001e5d3
cmpsd dword [esi], dword es:[edi]
xor eax, 0xa9c54d4e
ficomp dword [edi]
movsd dword es:[edi], dword [esi]
call 0xc3902c72
test bh, 0x26
xchg ecx, eax
sal byte [edx - 0x79], 1
insd dword es:[edi], dx
push esp
sub byte [ebp + 0x4498ad9b], cl
sbb dh, dh
xor eax, dword [esi + 0x20]
outsb dx, byte [esi]
or esi, ebp
inc esi
and byte [esi + 0xb], ch
cmc
mov word [eax + 0x705347ad], gs
mov ebx, 0x736219ca
jno 0x1001e682
scasb al, byte es:[edi]
push 0x8a39521f
nop
shl byte [0x5c9be4d4], 0x5e
or byte [ebx], dl
push ebx
loope 0x1001e6a8
mov ah, 0x79
push edi
xchg edi, eax
rol al, 8
sub esp, dword [eax + 3]
add byte [esi - 0x39e67c03], al
sbb dword [ecx], 0xffffffc6
mov dl, 0x1e
adc ah, 0x4a
into
sbb bl, ah
xor al, 0xe2
or al, byte [ebx + eax]
adc dword [ecx - 0x5b], esi
rcr dword [edi], 1
shl al, cl
call 0x7182844e
leave
int3
sti
jmp 0x1001e650
Function at 0x405be0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0040cb90
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x100c], 0
mov dword [ebp - 0x1010], 0
push 0x418da4
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x100c]
push ecx
call fcn.0040613c
add esp, 0xc
cmp dword [ebp - 0x100c], 0
jne 0x405c33
xor eax, eax
jmp 0x405ce8
push 0
push 4
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [0x4141d4]
cmp eax, 4
je 0x405c56
xor eax, eax
jmp 0x405ce8
mov edx, dword [ebp - 0x1010]
cmp edx, dword [ebp - 0x1008]
jae 0x405cc2
push 0
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [0x4141d4]
mov dword [ebp - 0x1014], eax
cmp dword [ebp - 0x1014], 0
jne 0x405c8f
jmp 0x405cc2
mov eax, dword [ebp - 0x100c]
push eax
mov ecx, dword [ebp - 0x1014]
push ecx
push 1
lea edx, [ebp - 0x1004]
push edx
call fcn.004066f4
add esp, 0x10
mov eax, dword [ebp - 0x1010]
add eax, dword [ebp - 0x1014]
mov dword [ebp - 0x1010], eax
jmp 0x405c56
mov ecx, dword [ebp - 0x100c]
push ecx
call fcn.00406526
add esp, 4
mov edx, dword [ebp - 0x1010]
cmp edx, dword [ebp - 0x1008]
jae 0x405ce3
xor eax, eax
jmp 0x405ce8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x409c80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d00c
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5a9464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea edi, [esi + 8]
mov dword [esi], vtable.CCurlDownloader.0
mov dword [ebp - 0x14], edi
mov dword [edi + 0x24], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x409cdd
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
lea edi, [esi + 0x30]
mov byte [ebp - 4], 2
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 8
jb 0x409cfc
mov eax, dword [edi]
jmp 0x409cfe
mov eax, edi
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x409d1f
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409d10
sub ecx, ebx
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00406770
lea ebx, [esi + 0x48]
mov byte [ebp - 4], 3
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
cmp dword [ebx + 0x14], 8
jb 0x409d47
mov eax, dword [ebx]
jmp 0x409d49
mov eax, ebx
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x409d70
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 8], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409d60
sub ecx, dword [ebp + 8]
sar ecx, 1
push ecx
push edx
mov ecx, ebx
call fcn.00406770
mov byte [ebp - 4], 4
cmp dword [edi + 0x14], 8
jb 0x409d85
mov edi, dword [edi]
cmp dword [ebx + 0x14], 8
jb 0x409d8d
mov ebx, dword [ebx]
push dword [ebp - 0x10]
push ecx
push edi
push ebx
lea ecx, [esi + 0x60]
call fcn.0041afc0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x2c]
mov ebx, dword [ebp - 0x10]
lea ecx, [esi + 0x60]
push 1
push eax
mov dword [ebx + 0xf0], 0
mov byte [ebx + 0xf4], 0
call fcn.0041b280
cmp dword [eax + 0x14], 8
jb 0x409dc9
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x409de5
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00406ed0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x409e20
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d03f
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5a9464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 0xf0]
test esi, esi
je 0x409e9b
cmp dword [esi + 4], 0
je 0x409e7f
mov eax, dword [esi + 4]
test eax, eax
je 0x409e7f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov dword [esi], 0xffffffff
mov esi, dword [edi + 0xf0]
test esi, esi
je 0x409e9b
mov ecx, esi
call fcn.0044ddb0
push 0x50
push esi
call fcn.00508d98
add esp, 8
push 0x50
call fcn.00508da6
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x50
push 0
push esi
mov dword [ebp - 4], 0
call fcn.004b3fc0
sub esp, 0x18
mov ecx, 0x409f10
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x409edd
mov dword [eax], vtable.std::_Func_impl_unsigned_long_int____cdecl___void____class_std::allocator_int___unsigned_long_int__void__.0
mov dword [eax + 4], 0x409f10
mov dword [eax + 0x24], eax
push str.ABDEF
push edi
mov ecx, esi
call fcn.0044db60
mov dword [edi + 0xf0], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x409efe
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40a5c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d14a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5a9464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.004f445a
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x40a680
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.004b35de
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x5a5e34
push eax
call fcn.004b44f0
push edi
push esi
call fcn.004f47d0
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00508d64
mov esp, ebp
pop ebp
ret 4
Function at 0x40cf50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54d256
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5a9464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00508da6
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004f46cd
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret