joyce8/EMBER2024-capa huggingface dataset:
Function at 0x621d60
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x7ca00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov dword [ebp - 0xc], eax
mov edi, ecx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push ebx
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp ebx, 0x24
jne 0x621dae
cmp eax, 0x2f76
je 0x621dbb
cmp eax, 0x7a
je 0x621dd0
push eax
mov ecx, edi
call fcn.00621340
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
test eax, eax
jne 0x621e26
mov ecx, dword [0x7eba0c]
test ecx, ecx
je 0x621de9
cmp byte [0x7eba08], al
jne 0x621df4
call fcn.0061b120
mov ecx, dword [0x7eba0c]
mov eax, dword [ecx]
push str.retrieveHeaderFromHttpRequest:_Zero_buffer_required....
push 0x701e7c
push ecx
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x6ef350]
call esi
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
push 0x6f34b4
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0063e2ac
mov esi, eax
add esp, 8
test esi, esi
jne 0x621ec7
mov ecx, dword [0x7eba0c]
test ecx, ecx
je 0x621e5e
cmp byte [0x7eba08], al
jne 0x621e69
call fcn.0061b120
mov ecx, dword [0x7eba0c]
mov eax, dword [ecx]
push str.failed_to_allocate_memory
push 0x701e7c
push ecx
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x6ef350]
call esi
sub esp, 0xc
xor eax, eax
mov ecx, esp
push 0x18
push str.Memory_Allocation_Failed
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.00428800
push 0
push 0x14
mov ecx, edi
call fcn.00621200
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret 8
push 0
lea eax, [ebp - 8]
push eax
push esi
push 0
push ebx
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x621f0d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
mov ecx, edi
call fcn.00621340
push esi
call fcn.0063e134
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret 8
mov edx, esi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x621f12
mov ecx, dword [ebp - 0xc]
sub edx, edi
sar edx, 1
push edx
push esi
call fcn.00428800
push esi
call fcn.0063e134
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.0063de71
mov esp, ebp
pop ebp
ret 8
Function at 0x621f50
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x7ca00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
mov esi, ecx
push 0
push 0x16
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x622005
mov eax, dword [ebp - 8]
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0063e329
add esp, 4
mov edi, eax
lea eax, [ebp - 8]
push 0
push eax
push edi
push 0
push 0x16
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x621ff8
mov ecx, dword [0x7eba0c]
test ecx, ecx
je 0x621fd4
cmp byte [0x7eba08], 0
jne 0x621fdf
call fcn.0061b120
mov ecx, dword [0x7eba0c]
mov eax, dword [ecx]
push edi
push str.Header_contents:__n_s
push ecx
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x6ef350]
call esi
add esp, 0xc
test edi, edi
je 0x622005
push edi
call fcn.0063e134
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0063de71
mov esp, ebp
pop ebp
ret
Function at 0x622c80
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x7ca00c]
xor eax, esp
mov dword [esp + 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp byte [edi + 0x20], 0
je 0x622e07
cmp byte [edi + 0x28], 0
je 0x622e07
lea eax, [esp + 0x10]
mov dword [esi], 0
push eax
push dword [edi + 0xb0]
mov dword [esp + 0x18], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x622d3c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
mov ecx, edi
call fcn.00621340
mov edi, dword [0x7eba0c]
test edi, edi
je 0x622cf7
cmp byte [0x7eba08], 0
jne 0x622d02
call fcn.0061b120
mov edi, dword [0x7eba0c]
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
push str.Error__d_in_WinHttpQueryDataAvailable._n
push 0x701e7c
push edi
call dword [0x6ef350]
call esi
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0063de71
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x10]
cmp ecx, dword [ebp + 0x14]
cmova ecx, dword [ebp + 0x14]
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x622d66
lea eax, [ecx + 2]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0063de71
mov esp, ebp
pop ebp
ret 0x10
push ecx
push 0
push dword [ebx]
call fcn.006501e0
add esp, 0xc
push esi
push dword [esp + 0x14]
push dword [ebx]
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x622de8
mov ecx, dword [0x7eba0c]
test ecx, ecx
je 0x622d9c
cmp byte [0x7eba08], al
jne 0x622da7
call fcn.0061b120
mov ecx, dword [0x7eba0c]
mov eax, dword [ecx]
push str.Error__u_in_WinHttpReadData._n
push 0x701e7c
push ecx
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x6ef350]
call esi
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
mov ecx, edi
call fcn.00621340
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0063de71
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
add eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0063de71
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x7eba0c]
test ecx, ecx
je 0x622e1a
cmp byte [0x7eba08], 0
jne 0x622e25
call fcn.0061b120
mov ecx, dword [0x7eba0c]
mov eax, dword [ecx]
push str.downloader_is_not_initialized
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x6ef350]
call esi
sub esp, 0x10
xor eax, eax
mov ecx, esp
push eax
push 0x701e7c
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.00428800
push 0
push 0x13
mov ecx, edi
call fcn.00621200
mov ecx, dword [esp + 0x14]
mov eax, 3
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0063de71
mov esp, ebp
pop ebp
ret 0x10
Function at 0x622e90
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], ecx
cmp byte [edi + 0x20], 0
je 0x622f64
cmp byte [edi + 0x28], 0
je 0x622f64
mov esi, dword [ebp + 0x18]
cmp esi, dword [ebp + 0x14]
mov dword [ebx], 0
cmova esi, dword [ebp + 0x14]
test esi, esi
jne 0x622eda
lea eax, [esi + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push esi
push 0
push dword [ecx]
call fcn.006501e0
mov eax, dword [esp + 0x18]
add esp, 0xc
push ebx
push esi
push dword [eax]
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x622f52
mov ecx, dword [0x7eba0c]
test ecx, ecx
je 0x622f11
cmp byte [0x7eba08], al
jne 0x622f1c
call fcn.0061b120
mov ecx, dword [0x7eba0c]
mov eax, dword [ecx]
push str.Error__u_in_WinHttpReadData._n
push 0x701e7c
push ecx
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x6ef350]
call esi
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
mov ecx, edi
call fcn.00621340
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebx]
neg eax
sbb eax, eax
add eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [0x7eba0c]
test ecx, ecx
je 0x622f77
cmp byte [0x7eba08], 0
jne 0x622f82
call fcn.0061b120
mov ecx, dword [0x7eba0c]
mov eax, dword [ecx]
push str.downloader_is_not_initialized
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x6ef350]
call esi
sub esp, 0x10
xor eax, eax
mov ecx, esp
push eax
push 0x701e7c
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.00428800
push 0
push 0x13
mov ecx, edi
call fcn.00621200
pop edi
pop esi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x625940
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x7ca00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
cmp byte [edi + 4], 0
jne 0x6259a7
mov ecx, dword [0x7eba0c]
test ecx, ecx
je 0x62596d
cmp byte [0x7eba08], 0
jne 0x625978
call fcn.0061b120
mov ecx, dword [0x7eba0c]
push str.Thread_is_not_initialized__so_it_cannot_run
mov eax, dword [ecx]
push 0x701e7c
push ecx
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x6ef350]
call esi
add esp, 0xc
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x24], 0
mov dword [edi + 0x34], 1
je 0x6259f2
mov eax, dword [0x7eba0c]
test eax, eax
je 0x6259c6
cmp byte [0x7eba08], 0
jne 0x6259d0
call fcn.0061b120
mov eax, dword [0x7eba0c]
mov esi, dword [eax]
push dword [edi + 0x38]
push str.thread___d__is_already_running._Closing_it_first
mov esi, dword [esi + 4]
mov ecx, esi
push eax
call dword [0x6ef350]
call esi
add esp, 0xc
mov ecx, edi
call fcn.00625c90
lea eax, [ebp - 8]
push eax
push 4
push edi
push 0x625730
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [edi + 0x24], eax
test eax, eax
jne 0x625a36
mov ecx, dword [0x7eba0c]
test ecx, ecx
je 0x625a21
cmp byte [0x7eba08], al
jne 0x625a2c
call fcn.0061b120
mov ecx, dword [0x7eba0c]
push str.failed_to_create_a_new_thread._Fatal_Error
jmp 0x62597d
push eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
cmp eax, 0xffffffff
jne 0x625a9f
mov ecx, dword [0x7eba0c]
test ecx, ecx
je 0x625a55
cmp byte [0x7eba08], 0
jne 0x625a60
call fcn.0061b120
mov ecx, dword [0x7eba0c]
mov eax, dword [ecx]
push str.thread_failed_to_resumed._fatal_error
push 0x701e7c
push ecx
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x6ef350]
call esi
add esp, 0xc
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [edi + 0x24], 0
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [edi + 0x38], eax
xor ecx, ebp
pop edi
mov al, 1
pop esi
call fcn.0063de71
mov esp, ebp
pop ebp
ret
Function at 0x625c90
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx + 4], 0
je 0x625e26
lea eax, [ebx + 0xc]
mov dword [ebx + 0x34], 2
push eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov edi, dword [ebx + 0x28]
test edi, edi
je 0x625da7
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x6ef350]
mov ecx, edi
call esi
mov eax, dword [ebx + 0x28]
xor ecx, ecx
cmp dword [eax + 8], 3
je 0x625da7
mov edx, eax
cmp dword [eax + 8], 5
je 0x625da7
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x12c
jne 0x625d49
mov ecx, dword [0x7eba0c]
test ecx, ecx
je 0x625d0a
cmp byte [0x7eba08], 0
jne 0x625d18
call fcn.0061b120
mov eax, dword [ebx + 0x28]
mov ecx, dword [0x7eba0c]
mov esi, dword [ecx]
push dword [eax + 4]
push str.forcing_the_job___d__to_terminate.
mov esi, dword [esi + 0x14]
push ecx
mov ecx, esi
call dword [0x6ef350]
call esi
mov edi, dword [ebx + 0x28]
add esp, 0xc
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x6ef350]
mov ecx, edi
call esi
jmp 0x625d51
cmp ecx, 0x3e8
je 0x625d6d
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebx + 0x28]
mov edx, eax
mov ecx, dword [ebp - 4]
cmp dword [eax + 8], 3
jne 0x625ce1
jmp 0x625da7
mov eax, dword [0x7eba0c]
test eax, eax
je 0x625d7f
cmp byte [0x7eba08], 0
jne 0x625d8c
call fcn.0061b120
mov edx, dword [ebx + 0x28]
mov eax, dword [0x7eba0c]
mov esi, dword [eax]
push dword [edx + 4]
push str.job___d__is_still_not_terminated._Closing_the_thread_handle_now
mov esi, dword [esi + 0x14]
mov ecx, esi
push eax
call dword [0x6ef350]
call esi
add esp, 0xc
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x625e1f
push 0x61a8
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov edi, eax
test edi, edi
je 0x625e0f
mov ecx, dword [0x7eba0c]
test ecx, ecx
je 0x625ddd
cmp byte [0x7eba08], 0
jne 0x625de8
call fcn.0061b120
mov ecx, dword [0x7eba0c]
mov esi, dword [ecx]
push edi
push dword [ebx + 0x38]
mov esi, dword [esi + 0x14]
push str.Forcing_the_thread___d__to_terminate_forcibly._Thread_seem_to_get_hanged._Error____d
push ecx
mov ecx, esi
call dword [0x6ef350]
call esi
add esp, 0x10
push 0
push dword [ebx + 0x24]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push dword [ebx + 0x24]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x34], 3
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x626b90
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a21f0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x7ca00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 0x228]
mov ecx, ebx
call fcn.00620400
mov ecx, esi
call fcn.006264e0
lea edi, [esi + 0x48c]
mov ecx, edi
call fcn.00626400
lea eax, [esi + 0x4b4]
mov byte [esi + 0x2d8], 0
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
lea eax, [esi + 0x4d0]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
lea ecx, [esi + 0x510]
call fcn.0062a4d0
mov eax, dword [esi + 0x508]
add esi, 0x508
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.0043a420
push 0x40
push dword [esi]
call fcn.0063e103
add esp, 8
mov ecx, edi
call fcn.00626400
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
mov edi, dword [ebp - 0x10]
lea ecx, [edi + 0x374]
call fcn.006240b0
mov eax, dword [edi + 0x36c]
lea esi, [edi + 0x36c]
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.0062ac40
push 0x20
push dword [esi]
call fcn.0063e103
add esp, 8
lea ecx, [edi + 0x348]
call fcn.00428770
lea ecx, [edi + 0x324]
call fcn.00522840
lea ecx, [edi + 0x31c]
call fcn.00522840
lea ecx, [edi + 0x2f8]
call fcn.00428770
lea ecx, [edi + 0x2e4]
call fcn.004ce050
lea ecx, [edi + 0x2dc]
call fcn.00626780
mov ecx, ebx
call fcn.0061ff20
lea ecx, [edi + 0x218]
call fcn.0062a850
lea ecx, [edi + 0x60]
call fcn.0062b330
mov ecx, edi
call fcn.006264e0
lea eax, [edi + 0x48]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
lea ecx, [edi + 0x30]
call fcn.004450a0
lea eax, [edi + 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
mov ecx, edi
call fcn.004450a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x62ed70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6c6548
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x7ca00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebx + 0x568]
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0x580]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp byte [ebx + 4], 0
jne 0x62edca
mov esi, 0xffffffd8
jmp 0x62ef15
cmp dword [ebx + 0x564], 4
je 0x62ee18
cmp dword [ebx + 0x564], 0x20
je 0x62ee18
cmp dword [ebx + 0x564], 8
je 0x62ee18
call fcn.0062ecf0
cmp dword [eax], 0
je 0x62ee0e
call fcn.0062ecf0
push str.PDM_is_either_running_already_or_closed
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x6ef350]
call esi
add esp, 8
mov esi, 0x1e
jmp 0x62ef15
mov eax, dword [ebx + 0x2f8]
push ebx
mov esi, dword [eax]
mov ecx, esi
call dword [0x6ef350]
lea ecx, [ebx + 0x2f8]
call esi
test al, al
jne 0x62ee52
call fcn.0062ecf0
cmp dword [eax], 0
je 0x62ef02
call fcn.0062ecf0
push str.Failed_to_generate_workflow
jmp 0x62eee8
mov ecx, ebx
call fcn.0062f0d0
push 8
lea edi, [ebx + 0x318]
call fcn.0063de82
add esp, 4
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], esi
push 0
push 0
push esi
push 0x5f22a0
push 0
movq qword [esi], xmm0
push 0
mov dword [esi], 0x62ef60
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x62ef07
push 8
push esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0063e103
add esp, 8
call fcn.0062ecf0
cmp dword [eax], 0
je 0x62eed4
call fcn.0062ecf0
push str.Could_not_make_manager_thread
push str.PackageDownloadManager
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x6ef350]
call esi
add esp, 0xc
call fcn.0062ecf0
cmp dword [eax], 0
je 0x62ef02
call fcn.0062ecf0
push str.Failed_to_run_the_thread_for_the_workflow
mov eax, dword [eax]
push str.PackageDownloadManager
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x6ef350]
call esi
add esp, 0xc
or esi, 0xffffffff
jmp 0x62ef15
mov dword [ebx + 0x310], eax
test edi, edi
je 0x62ef13
mov dword [edi], eax
xor esi, esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x633a60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 8
mov edi, ecx
call fcn.0063de82
add esp, 4
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 4], esi
push 0
push 0
push esi
push 0x5f22a0
push 0
movq qword [esi], xmm0
push 0
mov dword [esi], 0x6344f0
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x633ab7
push 8
push esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0063e103
add esp, 8
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x29c], eax
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x66f258
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0066ef09

Function at 0x66f263
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0066f093

Function at 0x67d50a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret
Function at 0x5625eb
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x5da958
call fcn.00562eb8
mov edi, 0x94
mov eax, edi
call fcn.0055f780
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x7e3b84], ecx
mov eax, dword [esi + 4]
mov dword [0x7e3b90], eax
mov edx, dword [esi + 8]
mov dword [0x7e3b94], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x7e3b88], esi
cmp ecx, 2
je 0x56264b
or esi, 0x8000
mov dword [0x7e3b88], esi
shl eax, 8
add eax, edx
mov dword [0x7e3b8c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x562686
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x562686
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x56269e
cmp eax, 0x20b
je 0x56268b
mov dword [ebp - 0x1c], esi
jmp 0x5626b2
cmp dword [ecx + 0x84], 0xe
jbe 0x562686
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x5626ac
cmp dword [ecx + 0x74], 0xe
jbe 0x562686
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0056396f
pop ecx
test eax, eax
jne 0x5626c6
push 0x1c
call fcn.005625c7
pop ecx
call fcn.00565204
test eax, eax
jne 0x5626d7
push 0x10
call fcn.005625c7
pop ecx
call fcn.00568011
mov dword [ebp - 4], esi
call fcn.00568d76
test eax, eax
jge 0x5626f0
push 0x1b
call fcn.005625a2
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x7e55c0], eax
call fcn.00569e57
mov dword [0x7e3bc8], eax
call fcn.00569db5
test eax, eax
jge 0x562716
push 8
call fcn.005625a2
pop ecx
call fcn.00569b82
test eax, eax
jge 0x562727
push 9
call fcn.005625a2
pop ecx
push 1
call fcn.005612c3
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x56273d
push eax
call fcn.005625a2
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00569b25
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x56275e
movzx eax, word [ebp - 0x40]
jmp 0x562761
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00571032
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x56277f
push edi
call fcn.005613f0
call fcn.00561412
jmp 0x5627b1
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00562ef3
ret
Function at 0x57dcad
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x5b6f90
call fcn.00562c0c
sub esp, 0x198
mov eax, dword [0x63c8b0]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
push 0x57bbd5
mov ecx, 0x7e3758
mov dword [ebp - 0x10], eax
call fcn.0057c842
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jne 0x57dd11
cmp esi, ebx
jne 0x57dcef
lea esi, [ebp - 0x1a0]
push esi
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
jne 0x57dd43
cmp byte [esi], 1
jne 0x57dd3d
cmp byte [esi + 1], 1
jne 0x57dd3d
mov dword [edi + 0xc], 0x57dc7a
call fcn.0057b347
mov esi, eax
cmp dword [esi + 0x30], ebx
jne 0x57dd50
push 0x1c
call fcn.005719e2
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x57dd47
push 0xa
call fcn.00571840
jmp 0x57dd49
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x57ddb3
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x30], eax
cmp dword [esi + 0x34], ebx
jne 0x57dd82
push 0x1c
call fcn.005719e2
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 1
je 0x57dd79
push 0xa
call fcn.00571840
jmp 0x57dd7b
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x34], eax
cmp dword [esi + 0x38], ebx
jne 0x57ddb0
push 0x1c
call fcn.005719e2
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 2
je 0x57ddab
push 0xa
call fcn.00571388
jmp 0x57ddad
xor eax, eax
mov dword [esi + 0x38], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.00562b6e
leave
ret 4

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3a904a56
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7b240453
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219