joyce8/EMBER2024-capa huggingface dataset:
Function at 0x505ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b0ca0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x63a404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
test edi, edi
je 0x5060b4
push 0xc
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], 5
call fcn.0056ea97
mov ecx, eax
mov eax, dword [ebp - 0x20]
push 0xffffffffffffffff
push str._s_s
inc eax
mov dword [ebp - 0x24], ecx
push eax
push ecx
lea eax, [ebp - 0x14]
push eax
call fcn.00584f75
mov ecx, dword [ebp - 0x20]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x20], ecx
push 0x63e098
lea eax, [ebp - 0x24]
mov dword [ebp - 4], edx
push edi
push eax
call fcn.00544d50
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
add esp, 0x24
test eax, eax
je 0x505f63
push 2
push eax
call fcn.0056ea89
add esp, 8
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0
test ebx, ebx
je 0x506039
cmp dword [ebx + 4], 2
jle 0x506016
push ebx
lea ecx, [ebp - 0x18]
call fcn.005448d0
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.00545f90
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 2
push esi
mov edi, eax
call fcn.0056ea89
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp edi, 0xffffffff
setne byte [ebp - 0xd]
test eax, eax
je 0x505fca
push 2
push eax
call fcn.0056ea89
add esp, 8
cmp byte [ebp - 0xd], 0
je 0x505fdb
mov ecx, ebx
call fcn.005475d0
mov esi, eax
jmp 0x506016
push str.The_config_file_does_not_exist.
lea ecx, [ebp - 0x18]
call fcn.005447b0
push eax
push 0x761
push str.GameManager::openIWinConfigFile
push str.d:jenkinsworkspaceclient3.exe.fgmussexe_srcgamemanager.cpp
push 0x63dc40
mov dword [ebp - 4], 2
call fcn.0054faa0
add esp, 0x14
lea ecx, [ebp - 0x18]
call fcn.004ffe40
xor esi, esi
mov eax, dword [ebx]
test eax, eax
je 0x50602d
push 2
push eax
call fcn.0056ea89
add esp, 8
mov dword [ebx], 0
push 8
mov dword [ebx + 4], 0
push ebx
jmp 0x5060ac
push 0x70
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0x37
call fcn.0056ea97
mov ecx, dword [ebp - 0x28]
push 0xffffffffffffffff
push str.The_location_of_the_config_file_could_not_be_generated.
inc ecx
mov dword [ebp - 0x2c], eax
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00584f75
mov ecx, dword [ebp - 0x28]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x28], ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 3
push eax
push 0x768
push str.GameManager::openIWinConfigFile
push str.d:jenkinsworkspaceclient3.exe.fgmussexe_srcgamemanager.cpp
push 0x63dc40
call fcn.0054faa0
mov eax, dword [ebp - 0x2c]
add esp, 0x2c
test eax, eax
je 0x5060b4
push 2
push eax
call fcn.0056ea89
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50af90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1318
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x63a404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x14], ebx
push ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 0xe], 0
call fcn.005448d0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00545f90
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 2
push esi
mov edi, eax
call fcn.0056ea89
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
cmp edi, 0xffffffff
setne byte [ebp - 0xd]
test eax, eax
je 0x50b00f
push 2
push eax
call fcn.0056ea89
add esp, 8
cmp byte [ebp - 0xd], 0
je 0x50b189
test ebx, ebx
je 0x50b06a
mov ecx, ebx
call fcn.00545d50
test al, al
je 0x50b06a
mov edi, dword [ebp + 8]
test edi, edi
je 0x50b06a
mov ecx, edi
call fcn.00545d50
test al, al
je 0x50b06a
push ecx
mov ecx, ebx
call fcn.00545e50
push ecx
mov ecx, edi
mov esi, eax
mov ebx, edx
call fcn.00545e50
cmp esi, eax
jne 0x50b06a
cmp ebx, edx
jne 0x50b06a
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x63e010
lea ecx, [ebp - 0x20]
call fcn.00544950
push 0x5c
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 1
call fcn.005454a0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
call fcn.00545810
push 0x5c
lea ecx, [ebp - 0x20]
call fcn.005454a0
push 0x63dc30
lea ecx, [ebp - 0x20]
call fcn.00545810
push ecx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x30]
call fcn.0054bb30
mov byte [ebp - 4], 2
xor bl, bl
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x50b163
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.005448d0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
call fcn.0054c540
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x50b10b
push 2
push eax
call fcn.0056ea89
add esp, 8
push 0x63dbe8
lea ecx, [ebp - 0x28]
call fcn.00546360
mov bl, al
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x50b12c
push 2
push eax
call fcn.0056ea89
add esp, 8
cmp esi, 0x80000000
je 0x50b163
cmp esi, 0x80000005
je 0x50b163
cmp esi, reloc.WS2_32.dll_accept
je 0x50b163
cmp esi, reloc.WS2_32.dll_bind
je 0x50b163
cmp esi, 0x80000004
je 0x50b163
cmp esi, reloc.WS2_32.dll_closesocket
je 0x50b163
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x50b175
push 2
push eax
call fcn.0056ea89
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50f6b0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1910
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x63a404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [0x647ac8], ebx
je 0x50f83d
test edi, edi
je 0x50f83d
cmp dword [edi], ebx
je 0x50f83d
cmp dword [edi + 4], ebx
jbe 0x50f83d
test edx, edx
je 0x50f83d
cmp dword [edx], ebx
je 0x50f83d
cmp dword [edx + 4], ebx
jbe 0x50f83d
mov ecx, edx
call fcn.004fee90
mov esi, eax
test esi, esi
je 0x50f83d
cmp dword [esi], ebx
je 0x50f83d
cmp dword [esi + 4], ebx
jbe 0x50f83d
push str.playing
lea ecx, [ebp - 0x1c]
call fcn.005447b0
push str.ready
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.005447b0
push str.SELECT__s_as_game_code_FROM_games_WHERE__s___s_AND__s_IN___s__AND___s___s_OR__s___s__ORDER_BY__s_DESC_
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.005447b0
push 0x63df20
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
push ecx
push 0x63de50
lea ecx, [ebp - 0x14]
push ecx
push 0x63de50
push esi
push 0x63dd98
push edi
push 0x63db90
push 0x63de58
push eax
call fcn.00544d50
add esp, 0x2c
lea ecx, [ebp - 0x24]
mov edi, eax
call fcn.004ffe40
lea ecx, [ebp - 0x14]
call fcn.004ffe40
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.004ffe40
mov eax, dword [esi]
test eax, eax
je 0x50f7d3
push 2
push eax
call fcn.0056ea89
add esp, 8
mov dword [esi], ebx
push 8
push esi
mov dword [esi + 4], 0
call fcn.0056ea89
add esp, 8
test edi, edi
je 0x50f83d
push str.installed
lea ecx, [ebp - 0x2c]
call fcn.005447b0
push eax
mov dword [ebp - 4], 3
mov ecx, dword [0x647ac8]
push edi
call fcn.004ff890
lea ecx, [ebp - 0x2c]
mov ebx, eax
call fcn.004ffe40
mov ecx, dword [edi]
test ecx, ecx
je 0x50f82b
push 2
push ecx
call fcn.0056ea89
add esp, 8
mov dword [edi], 0
push 8
push edi
mov dword [edi + 4], 0
call fcn.0056ea89
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x510b80
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xc
mov esi, edx
mov edi, ecx
call fcn.0056e7bf
mov edx, dword [ebp + 8]
mov ebx, eax
push 1
push 1
push 0
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
call fcn.00520b80
mov esi, eax
mov dword [ebx + 4], edi
mov dword [ebx], esi
add esp, 0x10
mov eax, dword [esi + 4]
mov byte [esi + 9], 1
test eax, eax
jne 0x510bf5
push eax
push 4
push esi
push 0x54f620
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [esi + 0xc]
mov dword [esi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 4]
test eax, eax
je 0x510bfc
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 1
push ebx
mov ecx, 0x647b2c
call fcn.005444a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x511ed0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1c7f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x63a404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor al, al
cmp dword [0x647af0], 0
jne 0x511ff9
push 0x20
call fcn.0056e7bf
mov edi, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
mov esi, 0xe
push 0x1e
mov dword [ebp - 0x10], 0
call fcn.0056ea97
push 0xffffffffffffffff
push str.OverviewThread
mov ebx, eax
lea eax, [ebp - 0x10]
push 0xf
push ebx
push eax
mov dword [ebp - 0x1c], ebx
call fcn.00584f75
xor ecx, ecx
add esp, 0x1c
test eax, eax
cmovne esi, ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x24]
call fcn.005448d0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x10]
mov dword [edi], vtable.OThread.0
call fcn.00544950
mov eax, dword [ebp - 0x24]
mov dword [edi + 4], 0
mov word [edi + 8], 0
mov dword [edi + 0xc], 0xfffffffe
test eax, eax
je 0x511f9e
push 2
push eax
call fcn.0056ea89
add esp, 8
test ebx, ebx
je 0x511fad
push 2
push ebx
call fcn.0056ea89
add esp, 8
mov dword [edi], vtable.OverviewThread.0
mov dword [edi + 0x18], 0
mov eax, dword [edi + 4]
mov dword [0x647af0], edi
mov byte [edi + 9], 1
test eax, eax
jne 0x511ff0
push eax
push 4
push edi
push 0x54f620
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [edi + 0xc]
mov dword [edi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [edi + 4]
test eax, eax
je 0x511ff7
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5133e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1ec8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x63a404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xa
mov dword [ebp - 0x14], 0
mov esi, 4
call fcn.0056ea97
push 0xffffffffffffffff
push str.data
push 5
push eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00584f75
xor ecx, ecx
add esp, 0x18
test eax, eax
cmovne esi, ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x20]
mov dword [ebp - 4], ecx
mov ecx, dword [0x647af8]
push eax
push 0x640868
call fcn.004ff890
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x513470
push 2
push eax
call fcn.0056ea89
add esp, 8
test ebx, ebx
je 0x5135fa
push 0xa
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 4
call fcn.0056ea97
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push str.data
inc ecx
mov dword [ebp - 0x20], eax
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00584f75
mov ecx, dword [ebp - 0x1c]
xor edx, edx
add esp, 0x18
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.00531970
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 0xd], al
test ecx, ecx
je 0x5134ee
push 2
push ecx
call fcn.0056ea89
mov al, byte [ebp - 0xd]
add esp, 8
test al, al
je 0x5135f2
xor edi, edi
mov ecx, ebx
push edi
mov dword [ebp - 0x14], edi
call fcn.00531ee0
test al, al
je 0x5135eb
nop dword [eax + eax]
push 0x12
mov dword [ebp - 0x18], 0
mov esi, 8
call fcn.0056ea97
push 0xffffffffffffffff
push str.LOCATION
push 9
push eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00584f75
xor ecx, ecx
add esp, 0x18
test eax, eax
cmovne esi, ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.00534640
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x51357a
push 2
push eax
call fcn.0056ea89
add esp, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test esi, esi
je 0x5135d0
mov ecx, esi
call fcn.00545f90
mov edi, eax
test edi, edi
je 0x5135a4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 2
push edi
call fcn.0056ea89
add esp, 8
mov eax, dword [esi]
test eax, eax
je 0x5135bb
push 2
push eax
call fcn.0056ea89
add esp, 8
mov dword [esi], 0
push 8
push esi
mov dword [esi + 4], 0
call fcn.0056ea89
mov edi, dword [ebp - 0x14]
add esp, 8
inc edi
mov ecx, ebx
mov dword [ebp - 0x14], edi
call fcn.00535c90
push edi
mov ecx, ebx
call fcn.00531ee0
test al, al
jne 0x513510
mov ecx, ebx
call fcn.00535c90
push ecx
mov ecx, ebx
call fcn.004feb60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51a9d0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b2cb0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x63a404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x647b54
call fcn.00545f90
mov edi, eax
test edi, edi
je 0x51aa58
call fcn.0051b9f0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0xf01ff
mov ebx, eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x51aa41
lea eax, [ebp - 0x34]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
push 2
push edi
call fcn.0056ea89
add esp, 8
mov ecx, dword [0x647afc]
test ecx, ecx
je 0x51aaa7
push 0
push 0x6419c8
call fcn.004ff490
mov esi, dword [0x647afc]
test esi, esi
je 0x51aaa7
mov dword [ebp - 4], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x51aa92
xor edx, edx
call fcn.004faeb0
mov dword [esi], 0
push 4
push esi
call fcn.0056ea89
add esp, 8
mov dword [0x647afc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e5b3
mov esp, ebp
pop ebp
ret
Function at 0x51d450
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov byte [ebp - 1], 0
push edi
mov ecx, dword [esi + 0x1008]
mov eax, ecx
mov edx, dword [esi + 0x100c]
sub eax, edx
cmp eax, 0x20
jae 0x51d57f
test eax, eax
je 0x51d4ab
push eax
lea eax, [esi + 8]
add eax, edx
push eax
lea eax, [esi + 8]
push eax
call fcn.00572a60
mov eax, dword [esi + 0x100c]
add esp, 0xc
sub dword [esi + 0x1008], eax
mov ecx, dword [esi + 0x1008]
mov dword [esi + 0x100c], 0
mov ebx, 0x1000
mov dword [ebp - 0xc], 0
sub ebx, ecx
test ebx, ebx
jle 0x51d57f
lea eax, [ebp - 8]
xor edi, edi
push eax
push 0x4004667f
push dword [esi + 4]
mov dword [ebp - 8], edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, dword [ebp - 8]
mov ecx, eax
test edx, edx
jne 0x51d542
mov eax, dword [esi + 0x1008]
sub eax, dword [esi + 0x100c]
jne 0x51d542
test ecx, ecx
jne 0x51d576
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x1011], 0
jne 0x51d527
cmp edi, 0xfa
lea eax, [edi + 0x14]
cmovae eax, edi
mov edi, eax
cmp edi, 0xfa
jb 0x51d527
cmp dword [esi + 0x1008], 0
je 0x51d589
lea eax, [ebp - 8]
push eax
push 0x4004667f
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, dword [ebp - 8]
mov ecx, eax
test edx, edx
je 0x51d4e1
test ecx, ecx
jne 0x51d576
cmp edx, ebx
cmovb ebx, edx
test ebx, ebx
jle 0x51d56f
mov eax, dword [esi + 0x1008]
push ecx
add eax, 8
push ebx
add eax, esi
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
mov dword [ebp - 0xc], eax
setg byte [ebp - 1]
mov byte [esi + 0x1011], 1
mov eax, dword [ebp - 0xc]
add dword [esi + 0x1008], eax
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov byte [esi + 0x1010], 1
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51f4f0
Capabilities:
Prepare http request
Read http header
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b33b8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x63a404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 8]
xor bl, bl
xor edi, edi
mov eax, 0x800000
cmp byte [esi + 4], bl
cmovne edi, eax
test ecx, ecx
je 0x51f6b5
call fcn.00545f90
mov dword [ebp - 0x10], eax
test eax, eax
je 0x51f6b5
mov eax, dword [esi + 0xc]
lea ecx, [eax*8 + 0x643a98]
call fcn.00545f90
mov dword [ebp - 0x14], eax
test eax, eax
je 0x51f6a8
push edi
push 0
push 0
push 0
push dword [ebp - 0x10]
push eax
push dword [esi + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ecx, eax
mov dword [esi + 0x18], ecx
test ecx, ecx
je 0x51f69b
mov eax, dword [ebp + 0xc]
push esi
push eax
push eax
push dword [ebp + 8]
push 0
push 0
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x51f655
push 0
push dword [esi + 0x18]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov bl, al
test bl, bl
je 0x51f615
push 0
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 4
push eax
lea ecx, [esi + 0x10]
push ecx
push 0
push 0x20000013
push dword [esi + 0x18]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x51f69b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.OHttpStream_Header_Request_error___s___d
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.005447b0
mov esi, eax
push edi
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.005472c0
push eax
push esi
push 0x57
push str.OHttpStream::sendRequest
push str.d:jenkinsworkspaceclient3.lib.networklib_networklib_srcohttpstream.cpp
push 0
call fcn.0054faa0
lea ecx, [ebp - 0x1c]
jmp 0x51f693
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.OHttpStream_Recieve_Response_Failure_error___s___d
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.005447b0
mov esi, eax
push edi
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.005472c0
push eax
push esi
push 0x5d
push str.OHttpStream::sendRequest
push str.d:jenkinsworkspaceclient3.lib.networklib_networklib_srcohttpstream.cpp
push 0
call fcn.0054faa0
lea ecx, [ebp - 0x1c]
jmp 0x51f693
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.OHttpStream_SendRequest_Failure_error___s___d
lea ecx, [ebp - 0x24]
mov edi, eax
call fcn.005447b0
mov esi, eax
push edi
mov ecx, edi
mov dword [ebp - 4], 2
call fcn.005472c0
push eax
push esi
push 0x63
push str.OHttpStream::sendRequest
push str.d:jenkinsworkspaceclient3.lib.networklib_networklib_srcohttpstream.cpp
push 0
call fcn.0054faa0
lea ecx, [ebp - 0x24]
add esp, 0x1c
call fcn.004ffe40
push 2
push dword [ebp - 0x14]
call fcn.0056ea89
add esp, 8
push 2
push dword [ebp - 0x10]
call fcn.0056ea89
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x520800
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b356f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x63a404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push 0x1c
mov dword [ebp - 0x10], 0
mov esi, 0xd
call fcn.0056ea97
push 0xffffffffffffffff
push str.OFileDownload
mov ebx, eax
lea eax, [ebp - 0x10]
push 0xe
push ebx
push eax
mov dword [ebp - 0x1c], ebx
call fcn.00584f75
xor ecx, ecx
add esp, 0x18
test eax, eax
cmovne esi, ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.005448d0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x10]
mov dword [edi], vtable.OThread.0
call fcn.00544950
mov dword [edi + 4], 0
mov word [edi + 8], 0
mov dword [edi + 0xc], 0xfffffffe
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x5208b0
push 2
push eax
call fcn.0056ea89
add esp, 8
test ebx, ebx
je 0x5208bf
push 2
push ebx
call fcn.0056ea89
add esp, 8
lea ecx, [edi + 0x18]
mov dword [edi], vtable.OFileDownload.0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov eax, dword [ebp + 0x14]
push dword [ebp + 0xc]
mov byte [ebp - 4], 9
mov dword [edi + 0x28], eax
mov dword [edi + 0x5c], eax
mov dword [edi + 0x70], 0
call fcn.00545420
push dword [ebp + 8]
lea ecx, [edi + 0x20]
call fcn.00545420
mov eax, dword [ebp + 0x10]
mov ecx, edi
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov byte [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x60], 0
mov word [edi + 0x58], 0
mov byte [edi + 0x40], 0
mov dword [edi + 0x44], eax
call fcn.00520ab0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x520b80
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b35bf
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x63a404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
test edi, edi
je 0x520c2a
test esi, esi
je 0x520c2a
push 0x78
call fcn.0056e7bf
add esp, 4
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
mov ecx, eax
mov dword [ebp - 4], 0
push dword [ebp + 8]
push esi
push edi
call fcn.00520800
mov esi, eax
test esi, esi
je 0x520c2c
cmp byte [ebp + 0x10], 1
jne 0x520c2c
mov eax, dword [esi + 4]
mov byte [esi + 9], 1
test eax, eax
jne 0x520c10
push eax
push 4
push esi
push 0x54f620
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [esi + 0xc]
mov dword [esi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 4]
test eax, eax
je 0x520c17
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret