joyce8/EMBER2024-capa huggingface dataset:
Function at 0x656e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x82d084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x656e58
mov ecx, dword [0x853a98]
test ecx, ecx
je 0x656e30
cmp byte [0x853a6a], 0
jne 0x656e3b
call fcn.00651e50
mov ecx, dword [0x853a98]
mov eax, dword [ecx]
push str.file_handler_not_initialized
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x747368]
call esi
add esp, 8
jmp 0x656f42
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x656edf
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 8]
push 0
push eax
push esi
push ebx
push dword [edi]
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ebx, eax
cmp dword [ebp - 8], esi
jb 0x656ea1
test ebx, ebx
jne 0x656f33
mov dword [edi + 0x24], 1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, dword [0x853a98]
mov dword [edi + 0x28], eax
test ebx, ebx
je 0x656ec4
cmp byte [0x853a6a], 0
jne 0x656ecf
call fcn.00651e50
mov ebx, dword [0x853a98]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.failed_to_write_data._Error_code____d
jmp 0x656f1b
mov dword [edi + 0x24], 1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, dword [0x853a98]
mov dword [edi + 0x28], eax
test ebx, ebx
je 0x656f02
cmp byte [0x853a6a], 0
jne 0x656f0d
call fcn.00651e50
mov ebx, dword [0x853a98]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.file_pointer_set_error____d
mov esi, dword [esi + 0x24]
mov ecx, esi
push 0x75b10c
push ebx
call dword [0x747368]
call esi
add esp, 0x10
xor ebx, ebx
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp ebx, 1
je 0x656f66
push 0x41
push str.Failed_to_write_the_segment_in_the_file_which_is_to_be_downloaded
lea ecx, [edi + 0x30]
call fcn.0042fe00
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067ba01
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0067ba01
mov esp, ebp
pop ebp
ret 0x10
Function at 0x656f80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x82d084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x656fd8
mov ecx, dword [0x853a98]
test ecx, ecx
je 0x656fb0
cmp byte [0x853a6a], 0
jne 0x656fbb
call fcn.00651e50
mov ecx, dword [0x853a98]
mov eax, dword [ecx]
push str.file_handler_to_read_not_initialized
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x747368]
call esi
add esp, 8
jmp 0x6570e4
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x65707d
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 8]
push 0
push eax
push esi
push ebx
push dword [edi]
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], esi
jb 0x657026
test eax, eax
jne 0x6570d3
mov dword [edi + 0x24], 1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, dword [0x853a98]
mov dword [edi + 0x28], eax
test ebx, ebx
je 0x657049
cmp byte [0x853a6a], 0
jne 0x657054
call fcn.00651e50
mov ebx, dword [0x853a98]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
push str.failed_to_read_data._Error_code____d
push 0x75b10c
push ebx
call dword [0x747368]
call esi
mov esi, dword [ebp - 0xc]
add esp, 0x10
jmp 0x6570d5
mov dword [edi + 0x24], 1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, dword [0x853a98]
mov dword [edi + 0x28], eax
test ebx, ebx
je 0x6570a0
cmp byte [0x853a6a], 0
jne 0x6570ab
call fcn.00651e50
mov ebx, dword [0x853a98]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
push str.file_pointer_set_error____d
push 0x75b10c
push ebx
call dword [0x747368]
call esi
add esp, 0x10
xor esi, esi
jmp 0x6570d5
mov esi, eax
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp esi, 1
je 0x657108
push 0x33
push str.Failed_to_read_the_segment_from_the_downloaded_file
lea ecx, [edi + 0x30]
call fcn.0042fe00
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067ba01
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0067ba01
mov esp, ebp
pop ebp
ret 0x10
Function at 0x658a70
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x82d084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov dword [ebp - 0xc], eax
mov edi, ecx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push ebx
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp ebx, 0x24
jne 0x658abe
cmp eax, 0x2f76
je 0x658acb
cmp eax, 0x7a
je 0x658ae0
push eax
mov ecx, edi
call fcn.00658050
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067ba01
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
test eax, eax
jne 0x658b36
mov ecx, dword [0x853a98]
test ecx, ecx
je 0x658af9
cmp byte [0x853a6a], al
jne 0x658b04
call fcn.00651e50
mov ecx, dword [0x853a98]
mov eax, dword [ecx]
push str.retrieveHeaderFromHttpRequest:_Zero_buffer_required....
push 0x75b10c
push ecx
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x747368]
call esi
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067ba01
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
push 0x74c8a8
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0067be3c
mov esi, eax
add esp, 8
test esi, esi
jne 0x658bd7
mov ecx, dword [0x853a98]
test ecx, ecx
je 0x658b6e
cmp byte [0x853a6a], al
jne 0x658b79
call fcn.00651e50
mov ecx, dword [0x853a98]
mov eax, dword [ecx]
push str.failed_to_allocate_memory
push 0x75b10c
push ecx
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x747368]
call esi
sub esp, 0xc
xor eax, eax
mov ecx, esp
push 0x18
push str.Memory_Allocation_Failed
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.0042fe00
push 0
push 0x14
mov ecx, edi
call fcn.00657f10
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067ba01
mov esp, ebp
pop ebp
ret 8
push 0
lea eax, [ebp - 8]
push eax
push esi
push 0
push ebx
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x658c1d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
mov ecx, edi
call fcn.00658050
push esi
call fcn.0067bcc4
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067ba01
mov esp, ebp
pop ebp
ret 8
mov edx, esi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x658c22
mov ecx, dword [ebp - 0xc]
sub edx, edi
sar edx, 1
push edx
push esi
call fcn.0042fe00
push esi
call fcn.0067bcc4
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.0067ba01
mov esp, ebp
pop ebp
ret 8
Function at 0x658c60
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x82d084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
mov esi, ecx
push 0
push 0x16
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x658d15
mov eax, dword [ebp - 8]
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0067beb9
add esp, 4
mov edi, eax
lea eax, [ebp - 8]
push 0
push eax
push edi
push 0
push 0x16
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x658d08
mov ecx, dword [0x853a98]
test ecx, ecx
je 0x658ce4
cmp byte [0x853a6a], 0
jne 0x658cef
call fcn.00651e50
mov ecx, dword [0x853a98]
mov eax, dword [ecx]
push edi
push str.Header_contents:__n_s
push ecx
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x747368]
call esi
add esp, 0xc
test edi, edi
je 0x658d15
push edi
call fcn.0067bcc4
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0067ba01
mov esp, ebp
pop ebp
ret
Function at 0x659990
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x82d084]
xor eax, esp
mov dword [esp + 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp byte [edi + 0x20], 0
je 0x659b17
cmp byte [edi + 0x28], 0
je 0x659b17
lea eax, [esp + 0x10]
mov dword [esi], 0
push eax
push dword [edi + 0xb0]
mov dword [esp + 0x18], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x659a4c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
mov ecx, edi
call fcn.00658050
mov edi, dword [0x853a98]
test edi, edi
je 0x659a07
cmp byte [0x853a6a], 0
jne 0x659a12
call fcn.00651e50
mov edi, dword [0x853a98]
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
push str.Error__d_in_WinHttpQueryDataAvailable._n
push 0x75b10c
push edi
call dword [0x747368]
call esi
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0067ba01
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x10]
cmp ecx, dword [ebp + 0x14]
cmova ecx, dword [ebp + 0x14]
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x659a76
lea eax, [ecx + 2]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0067ba01
mov esp, ebp
pop ebp
ret 0x10
push ecx
push 0
push dword [ebx]
call fcn.0068e800
add esp, 0xc
push esi
push dword [esp + 0x14]
push dword [ebx]
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x659af8
mov ecx, dword [0x853a98]
test ecx, ecx
je 0x659aac
cmp byte [0x853a6a], al
jne 0x659ab7
call fcn.00651e50
mov ecx, dword [0x853a98]
mov eax, dword [ecx]
push str.Error__u_in_WinHttpReadData._n
push 0x75b10c
push ecx
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x747368]
call esi
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
mov ecx, edi
call fcn.00658050
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0067ba01
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
add eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0067ba01
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x853a98]
test ecx, ecx
je 0x659b2a
cmp byte [0x853a6a], 0
jne 0x659b35
call fcn.00651e50
mov ecx, dword [0x853a98]
mov eax, dword [ecx]
push str.downloader_is_not_initialized
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x747368]
call esi
sub esp, 0x10
xor eax, eax
mov ecx, esp
push eax
push 0x75b10c
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.0042fe00
push 0
push 0x13
mov ecx, edi
call fcn.00657f10
mov ecx, dword [esp + 0x14]
mov eax, 3
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0067ba01
mov esp, ebp
pop ebp
ret 0x10
Function at 0x659ba0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], ecx
cmp byte [edi + 0x20], 0
je 0x659c74
cmp byte [edi + 0x28], 0
je 0x659c74
mov esi, dword [ebp + 0x18]
cmp esi, dword [ebp + 0x14]
mov dword [ebx], 0
cmova esi, dword [ebp + 0x14]
test esi, esi
jne 0x659bea
lea eax, [esi + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push esi
push 0
push dword [ecx]
call fcn.0068e800
mov eax, dword [esp + 0x18]
add esp, 0xc
push ebx
push esi
push dword [eax]
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x659c62
mov ecx, dword [0x853a98]
test ecx, ecx
je 0x659c21
cmp byte [0x853a6a], al
jne 0x659c2c
call fcn.00651e50
mov ecx, dword [0x853a98]
mov eax, dword [ecx]
push str.Error__u_in_WinHttpReadData._n
push 0x75b10c
push ecx
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x747368]
call esi
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
mov ecx, edi
call fcn.00658050
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebx]
neg eax
sbb eax, eax
add eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [0x853a98]
test ecx, ecx
je 0x659c87
cmp byte [0x853a6a], 0
jne 0x659c92
call fcn.00651e50
mov ecx, dword [0x853a98]
mov eax, dword [ecx]
push str.downloader_is_not_initialized
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x747368]
call esi
sub esp, 0x10
xor eax, eax
mov ecx, esp
push eax
push 0x75b10c
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.0042fe00
push 0
push 0x13
mov ecx, edi
call fcn.00657f10
pop edi
pop esi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x65c650
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x82d084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
cmp byte [edi + 4], 0
jne 0x65c6b7
mov ecx, dword [0x853a98]
test ecx, ecx
je 0x65c67d
cmp byte [0x853a6a], 0
jne 0x65c688
call fcn.00651e50
mov ecx, dword [0x853a98]
push str.Thread_is_not_initialized__so_it_cannot_run
mov eax, dword [ecx]
push 0x75b10c
push ecx
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x747368]
call esi
add esp, 0xc
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067ba01
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x24], 0
mov dword [edi + 0x34], 1
je 0x65c702
mov eax, dword [0x853a98]
test eax, eax
je 0x65c6d6
cmp byte [0x853a6a], 0
jne 0x65c6e0
call fcn.00651e50
mov eax, dword [0x853a98]
mov esi, dword [eax]
push dword [edi + 0x38]
push str.thread___d__is_already_running._Closing_it_first
mov esi, dword [esi + 4]
mov ecx, esi
push eax
call dword [0x747368]
call esi
add esp, 0xc
mov ecx, edi
call fcn.0065c9a0
lea eax, [ebp - 8]
push eax
push 4
push edi
push 0x65c440
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [edi + 0x24], eax
test eax, eax
jne 0x65c746
mov ecx, dword [0x853a98]
test ecx, ecx
je 0x65c731
cmp byte [0x853a6a], al
jne 0x65c73c
call fcn.00651e50
mov ecx, dword [0x853a98]
push str.failed_to_create_a_new_thread._Fatal_Error
jmp 0x65c68d
push eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
cmp eax, 0xffffffff
jne 0x65c7af
mov ecx, dword [0x853a98]
test ecx, ecx
je 0x65c765
cmp byte [0x853a6a], 0
jne 0x65c770
call fcn.00651e50
mov ecx, dword [0x853a98]
mov eax, dword [ecx]
push str.thread_failed_to_resumed._fatal_error
push 0x75b10c
push ecx
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x747368]
call esi
add esp, 0xc
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [edi + 0x24], 0
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067ba01
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [edi + 0x38], eax
xor ecx, ebp
pop edi
mov al, 1
pop esi
call fcn.0067ba01
mov esp, ebp
pop ebp
ret
Function at 0x65c9a0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx + 4], 0
je 0x65cb36
lea eax, [ebx + 0xc]
mov dword [ebx + 0x34], 2
push eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov edi, dword [ebx + 0x28]
test edi, edi
je 0x65cab7
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x747368]
mov ecx, edi
call esi
mov eax, dword [ebx + 0x28]
xor ecx, ecx
cmp dword [eax + 8], 3
je 0x65cab7
mov edx, eax
cmp dword [eax + 8], 5
je 0x65cab7
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x12c
jne 0x65ca59
mov ecx, dword [0x853a98]
test ecx, ecx
je 0x65ca1a
cmp byte [0x853a6a], 0
jne 0x65ca28
call fcn.00651e50
mov eax, dword [ebx + 0x28]
mov ecx, dword [0x853a98]
mov esi, dword [ecx]
push dword [eax + 4]
push str.forcing_the_job___d__to_terminate.
mov esi, dword [esi + 0x14]
push ecx
mov ecx, esi
call dword [0x747368]
call esi
mov edi, dword [ebx + 0x28]
add esp, 0xc
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x747368]
mov ecx, edi
call esi
jmp 0x65ca61
cmp ecx, 0x3e8
je 0x65ca7d
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebx + 0x28]
mov edx, eax
mov ecx, dword [ebp - 4]
cmp dword [eax + 8], 3
jne 0x65c9f1
jmp 0x65cab7
mov eax, dword [0x853a98]
test eax, eax
je 0x65ca8f
cmp byte [0x853a6a], 0
jne 0x65ca9c
call fcn.00651e50
mov edx, dword [ebx + 0x28]
mov eax, dword [0x853a98]
mov esi, dword [eax]
push dword [edx + 4]
push str.job___d__is_still_not_terminated._Closing_the_thread_handle_now
mov esi, dword [esi + 0x14]
mov ecx, esi
push eax
call dword [0x747368]
call esi
add esp, 0xc
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x65cb2f
push 0x61a8
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov edi, eax
test edi, edi
je 0x65cb1f
mov ecx, dword [0x853a98]
test ecx, ecx
je 0x65caed
cmp byte [0x853a6a], 0
jne 0x65caf8
call fcn.00651e50
mov ecx, dword [0x853a98]
mov esi, dword [ecx]
push edi
push dword [ebx + 0x38]
mov esi, dword [esi + 0x14]
push str.Forcing_the_thread___d__to_terminate_forcibly._Thread_seem_to_get_hanged._Error____d
push ecx
mov ecx, esi
call dword [0x747368]
call esi
add esp, 0x10
push 0
push dword [ebx + 0x24]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push dword [ebx + 0x24]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x34], 3
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x65d8b0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e1bc0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x82d084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 0x228]
mov ecx, ebx
call fcn.00657120
mov ecx, esi
call fcn.0065d200
lea edi, [esi + 0x48c]
mov ecx, edi
call fcn.0065d120
lea eax, [esi + 0x4b4]
mov byte [esi + 0x2d8], 0
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
lea eax, [esi + 0x4d0]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
lea ecx, [esi + 0x510]
call fcn.006611e0
mov eax, dword [esi + 0x508]
add esi, 0x508
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.00441e30
push 0x40
push dword [esi]
call fcn.0067bc93
add esp, 8
mov ecx, edi
call fcn.0065d120
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
mov edi, dword [ebp - 0x10]
lea ecx, [edi + 0x374]
call fcn.0065adc0
mov eax, dword [edi + 0x36c]
lea esi, [edi + 0x36c]
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.00661950
push 0x20
push dword [esi]
call fcn.0067bc93
add esp, 8
lea ecx, [edi + 0x348]
call fcn.0042fd70
lea ecx, [edi + 0x324]
call fcn.004524d0
lea ecx, [edi + 0x31c]
call fcn.004524d0
lea ecx, [edi + 0x2f8]
call fcn.0042fd70
lea ecx, [edi + 0x2e4]
call fcn.00456350
lea ecx, [edi + 0x2dc]
call fcn.0065d4a0
mov ecx, ebx
call fcn.00656c40
lea ecx, [edi + 0x218]
call fcn.00661560
lea ecx, [edi + 0x60]
call fcn.00662040
mov ecx, edi
call fcn.0065d200
lea eax, [edi + 0x48]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
lea ecx, [edi + 0x30]
call fcn.0044cf50
lea eax, [edi + 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
mov ecx, edi
call fcn.0044cf50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x665a80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7099b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x82d084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebx + 0x568]
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0x580]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp byte [ebx + 4], 0
jne 0x665ada
mov esi, 0xffffffd8
jmp 0x665c25
cmp dword [ebx + 0x564], 4
je 0x665b28
cmp dword [ebx + 0x564], 0x20
je 0x665b28
cmp dword [ebx + 0x564], 8
je 0x665b28
call fcn.00665a00
cmp dword [eax], 0
je 0x665b1e
call fcn.00665a00
push str.PDM_is_either_running_already_or_closed
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x747368]
call esi
add esp, 8
mov esi, 0x1e
jmp 0x665c25
mov eax, dword [ebx + 0x2f8]
push ebx
mov esi, dword [eax]
mov ecx, esi
call dword [0x747368]
lea ecx, [ebx + 0x2f8]
call esi
test al, al
jne 0x665b62
call fcn.00665a00
cmp dword [eax], 0
je 0x665c12
call fcn.00665a00
push str.Failed_to_generate_workflow
jmp 0x665bf8
mov ecx, ebx
call fcn.00665de0
push 8
lea edi, [ebx + 0x318]
call fcn.0067ba12
add esp, 4
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], esi
push 0
push 0
push esi
push 0x627fc0
push 0
movq qword [esi], xmm0
push 0
mov dword [esi], 0x665c70
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x665c17
push 8
push esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0067bc93
add esp, 8
call fcn.00665a00
cmp dword [eax], 0
je 0x665be4
call fcn.00665a00
push str.Could_not_make_manager_thread
push str.PackageDownloadManager
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x747368]
call esi
add esp, 0xc
call fcn.00665a00
cmp dword [eax], 0
je 0x665c12
call fcn.00665a00
push str.Failed_to_run_the_thread_for_the_workflow
mov eax, dword [eax]
push str.PackageDownloadManager
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x747368]
call esi
add esp, 0xc
or esi, 0xffffffff
jmp 0x665c25
mov dword [ebx + 0x310], eax
test edi, edi
je 0x665c23
mov dword [edi], eax
xor esi, esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x66a770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 8
mov edi, ecx
call fcn.0067ba12
add esp, 4
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 4], esi
push 0
push 0
push esi
push 0x627fc0
push 0
movq qword [esi], xmm0
push 0
mov dword [esi], 0x66b200
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x66a7c7
push 8
push esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0067bc93
add esp, 8
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x29c], eax
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret