joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f3570
Capabilities:
Hash data using sha1

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
push edi
mov edi, dword [esi + 8]
and edi, 0x3f
mov byte [edi + esi + 0x40], 0x80
inc edi
cmp edi, 0x38
jbe 0x100f35bd
cmp edi, 0x40
je 0x100f35a9
mov eax, 0x40
lea ecx, [esi + 0x40]
sub eax, edi
add ecx, edi
push eax
push 0
push ecx
call fcn.100f83e0
add esp, 0xc
mov eax, dword [esi]
lea ebp, [esi + 0x40]
lea ebx, [esi + 0x20]
mov edx, ebp
push 1
mov ecx, ebx
call eax
xor edi, edi
jmp 0x100f35c3
lea ebp, [esi + 0x40]
lea ebx, [esi + 0x20]
mov eax, 0x38
sub eax, edi
push eax
lea eax, [esi + 0x40]
add eax, edi
push 0
push eax
call fcn.100f83e0
mov ecx, dword [esi + 8]
add esp, 0xc
mov eax, dword [esi + 0xc]
mov edx, ebp
shld eax, ecx, 3
shl ecx, 3
bswap eax
bswap ecx
mov dword [esi + 0x78], eax
mov eax, dword [esi]
mov dword [esi + 0x7c], ecx
mov ecx, ebx
push 1
call eax
mov eax, dword [ebx]
mov ecx, dword [esp + 0x10]
bswap eax
pop edi
mov dword [ecx], eax
mov eax, dword [esi + 0x24]
bswap eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x28]
bswap eax
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x2c]
bswap eax
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x30]
bswap eax
mov dword [ecx + 0x10], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x24], 0xefcdab89
mov dword [esi + 0x28], 0x98badcfe
mov dword [esi + 0x2c], 0x10325476
mov dword [esi + 0x30], 0xc3d2e1f0
pop esi
pop ebp
mov dword [ebx], 0x67452301
pop ebx
pop ecx
ret

Function at 0x100f36d0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [0x1013d0d8]
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x67452301
mov dword [ecx + 0x24], 0xefcdab89
mov dword [ecx + 0x28], 0x98badcfe
mov dword [ecx + 0x2c], 0x10325476
mov dword [ecx + 0x30], 0xc3d2e1f0
ret

Function at 0x100f3710
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x67452301
mov dword [ecx + 0x24], 0xefcdab89
mov dword [ecx + 0x28], 0x98badcfe
mov dword [ecx + 0x2c], 0x10325476
mov dword [ecx + 0x30], 0xc3d2e1f0
ret
Function at 0x100f3e00
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
mov edx, dword [esi + 8]
and edx, 0x3f
mov byte [edx + esi + 0x40], 0x80
inc edx
cmp edx, 0x38
jbe 0x100f3e4a
cmp edx, 0x40
je 0x100f3e36
mov eax, 0x40
lea ecx, [esi + 0x40]
sub eax, edx
add ecx, edx
push eax
push 0
push ecx
call fcn.100f83e0
add esp, 0xc
mov eax, dword [esi]
lea ebx, [esi + 0x40]
lea ebp, [esi + 0x20]
mov edx, ebx
push 1
mov ecx, ebp
call eax
xor edx, edx
jmp 0x100f3e50
lea ebx, [esi + 0x40]
lea ebp, [esi + 0x20]
mov eax, 0x38
sub eax, edx
push eax
lea eax, [esi + 0x40]
add eax, edx
push 0
push eax
call fcn.100f83e0
mov ecx, dword [esi + 8]
add esp, 0xc
mov eax, dword [esi + 0xc]
mov edx, ebx
shld eax, ecx, 3
shl ecx, 3
bswap eax
bswap ecx
mov dword [esi + 0x78], eax
mov eax, dword [esi]
mov dword [esi + 0x7c], ecx
mov ecx, ebp
push 1
call eax
mov edx, ebp
mov ebx, 4
mov ecx, dword [edx + 4]
lea edi, [edi + 8]
mov eax, dword [edx]
lea edx, [edx + 8]
bswap eax
mov dword [edi - 8], eax
bswap ecx
mov dword [edi - 4], ecx
sub ebx, 1
jne 0x100f3e90
pop edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
mov dword [ebp], 0x6a09e667
pop ebp
pop ebx
ret

Function at 0x100f3ef0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [0x1013d0dc]
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x100f3f40
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x100fbfef
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100fc02e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100fc02e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100fc02e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100fc02e
cmp dword [ecx + 0x74], 0xe
jbe 0x100fc02e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100ff507
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10122164
push 0x1012215c
push str.FlsAlloc
push 0x1f
call fcn.100ff38f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100ff53b
push dword [ebp + 8]
mov ecx, esi
call dword [0x101111f8]
call esi
jmp 0x100ff541
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x100ff585
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10122174
push 0x1012216c
push str.FlsGetValue
push 0x21
call fcn.100ff38f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100ff5bc
push dword [ebp + 8]
mov ecx, esi
call dword [0x101111f8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100ff5c4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1012217c
push 0x10122174
push str.FlsSetValue
push 0x22
call fcn.100ff38f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100ff5fe
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x101111f8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10102cf7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10102d94
push ebx
push esi
call fcn.10102cc0
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10101a3b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10102d41
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10102d93
push edi
push eax
call fcn.100fefd6
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10102d61
call fcn.100fef9c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10102d92
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10101a3b
add esp, 0x20
test eax, eax
jne 0x10102d80
push edi
call fcn.100fef9c
jmp 0x10102d88
push ebx
call fcn.100fef9c
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x101052c1
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100fd5ec
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10105330
cmp esi, dword [ebp - 4]
je 0x1010532b
cmp dword [ebp + 0xc], 0
je 0x1010532b
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10105308
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10104e13
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10105332
xor eax, eax
inc eax
jmp 0x10105332
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10105397
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1013d140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100fd5ec
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100fd5ec
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1010540e
cmp word [ecx], dx
je 0x1010540e
mov eax, dword [0x101227c4]
push edi
dec eax
push eax
push 0x101226b0
call fcn.10105336
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10105481
cmp word [eax], dx
je 0x10105481
mov eax, dword [edi]
test eax, eax
je 0x10105432
cmp word [eax], dx
je 0x10105432
lea eax, [ebp - 0x10]
push eax
call fcn.10104d19
jmp 0x1010543b
lea eax, [ebp - 0x10]
push eax
call fcn.10104db4
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x101054ab
mov eax, dword [0x101226ac]
push dword [ebp - 0x14]
dec eax
push eax
push 0x101223a0
call fcn.10105336
add esp, 0xc
test al, al
je 0x101054ab
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10105476
cmp word [eax], di
je 0x10105476
lea eax, [ebp - 0x10]
push eax
call fcn.10104d19
pop ecx
jmp 0x101054ad
lea eax, [ebp - 0x10]
push eax
call fcn.10104db4
jmp 0x10105473
mov eax, dword [edi]
test eax, eax
je 0x10105498
cmp word [eax], dx
je 0x10105498
lea eax, [ebp - 0x10]
push eax
call fcn.10104cce
pop ecx
jmp 0x101054ab
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10105576
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.101051bb
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10105576
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10105576
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10105576
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10105503
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100ff704
test ebx, ebx
je 0x10105571
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100ff704
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10105576
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10105576
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.101074a2
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10105578
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100f5a3f
leave
ret
Function at 0x101090b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x101090dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x101090dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x101096f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov eax, ecx
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
cmp edi, 0x1f
jb 0x10109890
test edx, 3
je 0x10109722
movzx esi, byte [edx]
movzx ebx, al
inc edx
shr eax, 8
xor esi, ebx
xor eax, dword [ebp + esi*4]
dec edi
jmp 0x10109707
xor eax, dword [edx]
lea edi, [edx + edi - 0x1b]
sub edx, edi
lea ebx, [ebx]
mov ecx, dword [edi + edx + 0xc]
mov ebx, dword [edi + edx + 8]
movzx esi, bl
xor ecx, dword [ebp + esi*4 + 0xc00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [ebp + esi*4 + 0x800]
movzx esi, bl
shr ebx, 8
xor ecx, dword [ebp + esi*4 + 0x400]
xor ecx, dword [ebp + ebx*4]
mov ebx, dword [edi + edx + 4]
movzx esi, bl
xor ecx, dword [ebp + esi*4 + 0x1c00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [ebp + esi*4 + 0x1800]
movzx esi, bl
shr ebx, 8
xor ecx, dword [ebp + esi*4 + 0x1400]
xor ecx, dword [ebp + ebx*4 + 0x1000]
movzx esi, al
mov ebx, eax
shr ebx, 0x18
xor ecx, dword [ebp + esi*4 + 0x2c00]
xor ecx, dword [ebp + ebx*4 + 0x2000]
ror eax, 0x10
movzx esi, al
shr eax, 0x18
xor ecx, dword [ebp + esi*4 + 0x2400]
xor ecx, dword [ebp + eax*4 + 0x2800]
mov eax, dword [edi + edx + 0x18]
mov ebx, dword [edi + edx + 0x14]
movzx esi, bl
xor eax, dword [ebp + esi*4 + 0xc00]
movzx esi, bh
shr ebx, 0x10
xor eax, dword [ebp + esi*4 + 0x800]
movzx esi, bl
shr ebx, 8
xor eax, dword [ebp + esi*4 + 0x400]
xor eax, dword [ebp + ebx*4]
mov ebx, dword [edi + edx + 0x10]
movzx esi, bl
xor eax, dword [ebp + esi*4 + 0x1c00]
movzx esi, bh
shr ebx, 0x10
xor eax, dword [ebp + esi*4 + 0x1800]
movzx esi, bl
shr ebx, 8
xor eax, dword [ebp + esi*4 + 0x1400]
xor eax, dword [ebp + ebx*4 + 0x1000]
movzx esi, cl
mov ebx, ecx
shr ebx, 0x18
xor eax, dword [ebp + esi*4 + 0x2c00]
xor eax, dword [ebp + ebx*4 + 0x2000]
ror ecx, 0x10
movzx esi, cl
shr ecx, 0x18
xor eax, dword [ebp + esi*4 + 0x2400]
xor eax, dword [ebp + ecx*4 + 0x2800]
add edx, 0x18
jae 0x10109730
add edi, 0x18
sub edx, 0x18
movzx ebx, al
movzx ecx, ah
shr eax, 0x10
movzx esi, al
shr eax, 8
mov eax, dword [ebp + eax*4]
xor eax, dword [ebp + ebx*4 + 0xc00]
xor eax, dword [ebp + ecx*4 + 0x800]
xor eax, dword [ebp + esi*4 + 0x400]
add edx, 4
jb 0x10109889
xor eax, dword [edi + edx]
jmp 0x10109857
add edx, edi
add edi, 3
sub edi, edx
test edi, edi
je 0x101098a7
movzx esi, byte [edx]
movzx ebx, al
inc edx
shr eax, 8
xor esi, ebx
xor eax, dword [ebp + esi*4]
dec edi
jne 0x10109894
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x401a09
Capabilities:
Hide graphical window

Disassembly:
mov ecx, 0xfffffffe
jmp fcn.00401641

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x404ed0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511c0c
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x55d198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea edi, [esi + 8]
mov dword [esi], vtable.CCurlDownloader.0
mov dword [ebp - 0x14], edi
mov dword [edi + 0x24], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x404f2d
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
lea edi, [esi + 0x30]
mov byte [ebp - 4], 2
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 8
jb 0x404f4c
mov eax, dword [edi]
jmp 0x404f4e
mov eax, edi
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x404f6f
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404f60
sub ecx, ebx
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00403800
lea ebx, [esi + 0x48]
mov byte [ebp - 4], 3
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
cmp dword [ebx + 0x14], 8
jb 0x404f97
mov eax, dword [ebx]
jmp 0x404f99
mov eax, ebx
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x404fc0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 8], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404fb0
sub ecx, dword [ebp + 8]
sar ecx, 1
push ecx
push edx
mov ecx, ebx
call fcn.00403800
mov byte [ebp - 4], 4
cmp dword [edi + 0x14], 8
jb 0x404fd5
mov edi, dword [edi]
cmp dword [ebx + 0x14], 8
jb 0x404fdd
mov ebx, dword [ebx]
push dword [ebp - 0x10]
push ecx
push edi
push ebx
lea ecx, [esi + 0x60]
call fcn.0040ef60
mov byte [ebp - 4], 5
lea eax, [ebp - 0x2c]
mov ebx, dword [ebp - 0x10]
lea ecx, [esi + 0x60]
push eax
mov dword [ebx + 0xf0], 0
call fcn.0040f230
cmp dword [eax + 0x14], 8
jb 0x405010
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x40502c
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00403a50
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405050
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511c3f
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x55d198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 0xf0]
test esi, esi
je 0x4050cb
cmp dword [esi + 4], 0
je 0x4050af
mov eax, dword [esi + 4]
test eax, eax
je 0x4050af
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov dword [esi], 0xffffffff
mov esi, dword [edi + 0xf0]
test esi, esi
je 0x4050cb
mov ecx, esi
call fcn.00422d50
push 0x50
push esi
call fcn.004d1b2d
add esp, 8
push 0x50
call fcn.004d1637
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x50
push 0
push esi
mov dword [ebp - 4], 0
call fcn.00444b40
sub esp, 0x18
mov ecx, 0x405140
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x40510d
mov dword [eax], vtable.std::_Func_impl_unsigned_long_int____cdecl___void____class_std::allocator_int___unsigned_long_int__void__.0
mov dword [eax + 4], 0x405140
mov dword [eax + 0x24], eax
push str.ABDEF
push edi
mov ecx, esi
call fcn.00422910
mov dword [edi + 0xf0], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x40512e
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4057c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511d65
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x55d198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x2c]
push eax
call fcn.004058d0
mov ebx, eax
lea esi, [edi + 0x28]
cmp esi, ebx
je 0x405836
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x40580f
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00403a50
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x405827
mov eax, dword [esi]
jmp 0x405829
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push ebx
call fcn.004032c0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x405852
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00403a50
push 0x50
call fcn.004d1637
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x50
push 0
push esi
mov dword [ebp - 4], 1
call fcn.00444b40
sub esp, 0x18
mov ecx, 0x406940
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x405894
mov dword [eax], vtable.std::_Func_impl_unsigned_long_int____stdcall___void____class_std::allocator_int___unsigned_long_int__void__.0
mov dword [eax + 4], 0x406940
mov dword [eax + 0x24], eax
push 0x5441e8
push edi
mov ecx, esi
call fcn.00422910
mov dword [edi + 0x74], eax
mov eax, dword [eax + 4]
test eax, eax
je 0x4058b2
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret