joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4132a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x474bc4]
mov dword [esp], 0
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 0xffffffff
je 0x4132c8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4132cd
call fcn.00413050
mov dword [edi + 4], 0xffffffff
mov dword [edi + 8], 0
mov eax, dword [0x476bb4]
test eax, 0xfffffffe
jne 0x413312
push 0x476bb4
call fcn.0040f770
add esp, 4
test al, al
je 0x413312
push 0x7d0
push 0x476bb8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [0x476bb4], 0x476bb8
mov esi, dword [0x476bb4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x477858]
xor ecx, ecx
inc ebx
nop dword [eax + eax]
lea eax, [ebx + ecx]
movzx edx, al
lea eax, [edx + edx*2]
cmp dword [eax*4 + 0x476bd0], 0
je 0x41334e
inc ecx
cmp ecx, 0x100
jl 0x413330
jmp 0x413379
mov eax, dword [ebp + 8]
lea ecx, [edx + edx*2]
mov dword [ecx*4 + 0x476bd4], eax
mov dword [ecx*4 + 0x476bd0], 1
mov dword [edi + 4], edx
mov eax, dword [ecx*4 + 0x476bd8]
mov dword [0x477858], edx
mov dword [edi + 8], eax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi + 4], 0xffffffff
jne 0x41338d
mov byte [0], 0
cmp dword [edi + 4], 0x100
jl 0x41339d
mov byte [0], 0
mov dword [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41abb0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
mov eax, edi
test edi, edi
jle 0x41ac77
test esi, esi
je 0x41ac77
push ebx
mov ebx, edi
sar edi, 2
and ebx, 3
test edi, edi
jle 0x41abf9
movzx ecx, word [esi]
dec edi
movzx edx, word [esi + 2]
add eax, ecx
mov ecx, eax
add esi, 4
shl ecx, 5
xor edx, ecx
shl edx, 0xb
xor eax, edx
mov ecx, eax
shr ecx, 0xb
add eax, ecx
test edi, edi
jg 0x41abd5
sub ebx, 1
je 0x41ac35
sub ebx, 1
je 0x41ac22
sub ebx, 1
jne 0x41ac47
movzx ecx, word [esi]
add eax, ecx
movsx ecx, byte [esi + 2]
shl ecx, 2
xor ecx, eax
shl ecx, 0x10
xor eax, ecx
mov ecx, eax
shr ecx, 0xb
jmp 0x41ac45
movzx ecx, word [esi]
add eax, ecx
mov ecx, eax
shl ecx, 0xb
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
jmp 0x41ac45
movsx ecx, byte [esi]
add eax, ecx
mov ecx, eax
shl ecx, 0xa
xor eax, ecx
mov ecx, eax
shr ecx, 1
add eax, ecx
lea ecx, [eax*8]
xor eax, ecx
mov ecx, eax
shr ecx, 5
add eax, ecx
mov ecx, eax
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add eax, ecx
mov ecx, eax
shl ecx, 0x19
xor eax, ecx
mov ecx, eax
pop ebx
shr ecx, 6
pop edi
add eax, ecx
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x41ca80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, edi
sar ecx, 2
test ecx, ecx
je 0x41caf0
push ebx
push esi
mov ebx, ecx
mov eax, dword [edi]
lea edi, [edi + 4]
movzx esi, cl
movzx edx, al
xor esi, edx
shr ecx, 8
mov dword [ebp - 4], eax
movzx eax, ah
xor ecx, dword [esi*4 + 0x46f1d0]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 2]
xor ecx, dword [edx*4 + 0x46f1d0]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 1]
xor ecx, dword [edx*4 + 0x46f1d0]
movzx edx, cl
xor edx, eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x46f1d0]
sub ebx, 1
jne 0x41ca97
pop esi
pop ebx
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x41e530
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
test ebx, ebx
je 0x41e553
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x41e54e
mov eax, dword [ebx]
jmp 0x41e550
mov eax, ebx
mov byte [eax], 0
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00402de0
test al, al
je 0x41e569
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov ecx, esi
call fcn.0040bea0
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jne 0x41e583
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10000
call fcn.0043a63b
push edi
push 0x10000
mov esi, eax
mov dword [ebp + 0xc], 0
push 1
push esi
call fcn.0045b03c
mov edi, eax
add esp, 0x14
test edi, edi
je 0x41e5f6
mov eax, dword [ebp + 0x10]
test ebx, ebx
je 0x41e5cc
mov ecx, eax
mov eax, edi
sub ecx, dword [ebp + 0xc]
cmp ecx, edi
cmovb eax, ecx
mov ecx, ebx
push eax
push esi
call fcn.00404c90
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
sub eax, ecx
cmp eax, edi
jb 0x41e60c
push dword [ebp - 4]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp + 0xc], ecx
call fcn.0045b03c
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 0x10]
test edi, edi
jne 0x41e5b0
mov ebx, dword [ebp - 4]
push ebx
call fcn.0045ae37
add esp, 4
test eax, eax
jne 0x41e60f
mov byte [ebp + 0xf], 1
jmp 0x41e613
mov ebx, dword [ebp - 4]
mov byte [ebp + 0xf], 0
push ebx
call fcn.00449c52
add esp, 4
test esi, esi
je 0x41e629
push esi
call fcn.0043a592
add esp, 4
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41e640
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.0040bd60
Function at 0x41f030
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x47426c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x41f16b
cmp byte [edi + 0x3d], 0
je 0x41f16b
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x41f07d
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0043a597
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [esp + 0x14], 0
xorps xmm0, xmm0
mov dword [esp + 0x28], ecx
cmp ecx, 0x10
movq qword [esp + 0x14], xmm0
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 8
cmovae eax, dword [esp + 0x14]
mov byte [eax + 8], 0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov eax, dword [edi + 0x38]
lea ebx, [esp + 0x14]
cmp ecx, 0x10
lea esi, [esp + 0x14]
cmovae ebx, edx
cmovae esi, edx
mov eax, dword [eax]
mov dword [esp + 0x10], eax
cmp eax, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x41f17f
mov dword [esp + 0xc], esi
xor eax, eax
sub eax, 0
je 0x41f0f2
sub eax, 1
je 0x41f0f6
sub eax, 2
je 0x41f144
xor bl, bl
jmp 0x41f146
mov byte [edi + 0x3d], 0
cmp ecx, 0x10
lea eax, [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x41f129
push dword [edi + 0x4c]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004455e6
mov ecx, dword [esp + 0x38]
add esp, 0x10
mov edx, dword [esp + 0x14]
cmp esi, eax
jne 0x41f0ee
cmp byte [edi + 0x3d], 0
je 0x41f144
test esi, esi
jne 0x41f0b4
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.00406490
jmp 0x41f0ac
mov bl, 1
cmp ecx, 0x10
jb 0x41f157
inc ecx
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.00405160
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0043a597
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043a597
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x38]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x28]
add eax, ebx
push eax
push esi
lea eax, [edi + 0x40]
push eax
mov eax, dword [esp + 0x20]
call dword [eax + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
jmp 0x41f0df
Function at 0x41f870
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x47426c]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
xor eax, eax
mov dword [esp + 0x24], 7
push edi
mov edi, dword [ebp + 8]
lea ecx, [esp + 0x14]
xor bl, bl
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
call fcn.0040bfe0
test al, al
je 0x41f8f8
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.00402640
cmp dword [esp + 0x3c], 0
je 0x41f8e0
cmp dword [esp + 0x40], 8
lea eax, [esp + 0x2c]
cmovae eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov bl, 1
mov eax, dword [esp + 0x40]
cmp eax, 8
jb 0x41f8f8
inc eax
lea ecx, [esp + 0x2c]
push eax
push dword [esp + 0x30]
call fcn.004055e0
cmp dword [esi + 0x14], 8
jb 0x41f900
mov esi, dword [esi]
push esi
call dword [esp + 0x14]
mov esi, eax
test esi, esi
jne 0x41f917
test edi, edi
je 0x41f917
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
test bl, bl
je 0x41f930
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [esp + 0x28]
cmp eax, 8
jb 0x41f948
inc eax
lea ecx, [esp + 0x14]
push eax
push dword [esp + 0x18]
call fcn.004055e0
mov ecx, dword [esp + 0x44]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043a597
mov esp, ebp
pop ebp
ret
Function at 0x4213b3
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0xa8]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
ret

Function at 0x421671
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 0x2c]
movaps xmm0, xmmword [0x45eb50]
mov edx, eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x30], eax
push esi
lea ecx, [ebp - 8]
push edi
xor edi, edi
cmp ecx, edx
movups xmmword [ebp - 0x2c], xmm0
sbb ecx, ecx
mov dword [ebp - 0x34], edi
movaps xmm0, xmmword [0x45eb60]
and ecx, 0xfffffff7
add ecx, 9
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x3c], ecx
mov eax, dword [eax]
push eax
push dword [ebx + 4]
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4216fd
mov edi, dword [ebp - 0x38]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4216dc
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
add eax, 4
inc edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edi
cmp edi, dword [ebp - 0x3c]
jne 0x4216bd
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
lea esi, [ebx + 0x44]
push 5
push dword [esi]
call edi
push 0x64
push 0
mov ecx, esi
call fcn.004225ba
push 0
push 0
push 0x402
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x3f5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a597
mov esp, ebp
pop ebp
ret

Function at 0x421e3b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], 7
push esi
mov word [ebp - 0x1c], ax
mov esi, ecx
movzx eax, word [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0xc], edi
sub eax, 0x3fc
je 0x421e7f
sub eax, 1
jne 0x421ebd
push dword [esi + 0x24]
lea eax, [ebp - 0x34]
push eax
call fcn.00421310
jmp 0x421e8b
push dword [esi + 0x24]
lea eax, [ebp - 0x34]
push eax
call fcn.00427b63
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040dbb0
push edi
push 1
lea ecx, [ebp - 0x34]
call fcn.00404310
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push 5
cmovae eax, dword [ebp - 0x1c]
push edi
push edi
push eax
push 0x45eb2c
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esi + 0x88]
lea eax, [ebp - 0x1c]
push eax
call fcn.004261c2
push edi
push 1
lea ecx, [ebp - 0x1c]
call fcn.00404310
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0043a597
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4237a2
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20ec
call fcn.0043a5b0
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [eax + 0x10], 0
push edi
jne 0x42380f
and dword [ebp - 0x209c], 0
xor eax, eax
push 7
pop edi
mov dword [ebp - 0x2098], edi
mov word [ebp - 0x20ac], ax
mov dword [esi + 0x14], edi
and dword [esi + 0x10], 0
xor eax, eax
mov word [esi], ax
push 0
push 1
lea ecx, [ebp - 0x20ac]
call fcn.00404310
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a597
mov esp, ebp
pop ebp
ret
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x20b0], 0x824
jb 0x423821
mov eax, dword [eax]
push 0x2000000
lea ecx, [ebp - 0x20b0]
push ecx
lea ecx, [ebp - 0x104c]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
push 7
pop edi
test eax, eax
je 0x423865
cmp dword [ebp - 0x20b0], 0
je 0x423865
lea eax, [ebp - 0x104c]
push eax
lea ecx, [ebp - 0x20ac]
call fcn.00409580
mov ebx, dword [ebp - 0x209c]
jmp 0x42387c
xor ebx, ebx
mov dword [ebp - 0x2098], edi
xor eax, eax
mov dword [ebp - 0x209c], ebx
mov word [ebp - 0x20ac], ax
test ebx, ebx
je 0x4237e1
push 0x38
lea eax, [ebp - 0x20e8]
push 0
push eax
call fcn.0043d870
add esp, 0xc
mov dword [ebp - 0x20ec], 0x3c
cmp dword [ebp - 0x2098], 8
lea ecx, [ebp - 0x20ec]
lea eax, [ebp - 0x2094]
mov dword [ebp - 0x20d8], 0x824
mov dword [ebp - 0x20dc], eax
lea eax, [ebp - 0x20ac]
cmovae eax, dword [ebp - 0x20ac]
push ecx
push 0x10000000
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x4237e1
push dword [ebp - 0x20dc]
mov ecx, esi
call fcn.00409580
jmp 0x4237ed
Function at 0x4242e9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x34]
mov esi, ecx
push edi
push eax
call fcn.0040b1d0
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00426322
add esp, 0xc
lea ecx, [esi + 0x68]
push eax
call fcn.0040dbb0
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00404310
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00404a00
mov ecx, dword [esi + 0x14]
call fcn.0042b261
call fcn.00411db0
mov ebx, str.ClidsFile
test al, al
jne 0x42437f
lea eax, [esi + 0x38]
cmp dword [eax + 0x14], 8
jb 0x424356
mov eax, dword [eax]
push eax
push str.InstallerData
call fcn.0042e462
lea eax, [esi + 0x50]
cmp dword [eax + 0x14], 8
pop ecx
pop ecx
jb 0x42436e
mov eax, dword [eax]
push eax
push ebx
call fcn.0042e462
pop ecx
pop ecx
mov ecx, dword [esi + 0x14]
call fcn.0042b2ca
mov ecx, esi
call fcn.00424466
mov edi, eax
test edi, edi
je 0x42439d
push edi
mov ecx, esi
call fcn.00423667
call fcn.00411db0
test al, al
je 0x424401
push str.InstallerData
call fcn.0042e155
push ebx
call fcn.0042e155
call fcn.0042c913
push eax
call fcn.0042e155
mov ecx, dword [esi + 0x14]
add esp, 0xc
call fcn.0042a07c
mov eax, dword [esi + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [eax + 0xc0], 0
je 0x4243e5
add eax, 0xb0
cmp dword [eax + 0x14], 8
jb 0x4243e2
mov eax, dword [eax]
push eax
call ebx
mov eax, dword [esi + 0x14]
cmp dword [eax + 0xd8], 0
je 0x424401
add eax, 0xc8
cmp dword [eax + 0x14], 8
jb 0x4243fe
mov eax, dword [eax]
push eax
call ebx
cmp dword [esi + 0x10], 0
je 0x42440e
mov ecx, esi
call fcn.0042641b
test edi, edi
mov ecx, esi
sete al
movzx eax, al
push eax
call fcn.0042492b
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a597
mov esp, ebp
pop ebp
ret

Function at 0x42442f
Capabilities:
Create thread

Disassembly:
push edi
mov edi, ecx
push dword [edi + 0x88]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [edi + 0x8c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
push eax
push eax
push edi
push 0x4247af
push eax
push eax
call fcn.00442bd4
add esp, 0x18
mov dword [edi + 0x84], eax
pop edi
ret

Function at 0x424791
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0x88]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, esi
call fcn.00426210
mov ecx, esi
pop esi
jmp fcn.004242e9
Function at 0x42762a
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x42763b
mov eax, dword [eax]
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42767a
mov esi, dword [ebp + 8]
push eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x4276fa
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea ecx, [ebp - 0x10]
push edi
call fcn.00409b50
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push edi
push dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x4276d5
cmp edi, dword [ebp - 4]
jne 0x4276d5
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xf]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00426520
lea ecx, [ebp - 0x10]
call fcn.00409bd0
test esi, esi
je 0x4276d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
jmp 0x4276f9
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.00409bd0
test esi, esi
je 0x4276f7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427700
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
xor eax, eax
cmp dword [edi + 0x28], eax
jne 0x427842
push eax
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xbc]
mov dword [ebp - 0xc0], 4
push eax
push 0x20000013
push dword [edi + 0x5c]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x427765
cmp dword [ebp - 0xbc], 0xc8
jne 0x427765
mov al, 1
jmp 0x427844
push ebx
push esi
push 0xa
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xbc]
call fcn.004429b1
add esp, 0xc
lea ecx, [ebp - 0x28]
push str.final_query_info_
call fcn.004036f0
mov esi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.004011c0
pop ecx
push eax
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00404c90
mov ebx, 0x46efbc
mov esi, eax
push ebx
call fcn.004011c0
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.00404c90
cmp dword [eax + 0x14], 0x10
jb 0x4277bf
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004278d5
pop ecx
pop ecx
push eax
lea ecx, [edi + 0x18]
call fcn.0040dbb0
xor ebx, ebx
lea ecx, [ebp - 0x40]
xor esi, esi
push ebx
inc esi
push esi
call fcn.00404310
push ebx
push esi
lea ecx, [ebp - 0x28]
call fcn.00404a00
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00433b58
pop ecx
pop ecx
push eax
push 0x2cd
push str.lite_installer::Downloader::FinalizeDownload
push esi
lea ecx, [ebp - 0xb8]
call fcn.0043386f
push edi
push str.Unsuccessful_download:
lea ecx, [eax + 8]
call fcn.0041fc9c
mov ecx, eax
call fcn.0041fc44
lea ecx, [ebp - 0xb8]
call fcn.00433958
push ebx
push esi
lea ecx, [ebp - 0x28]
call fcn.00404a00
pop esi
pop ebx
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0043a597
mov esp, ebp
pop ebp
ret

Function at 0x427ca5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
jne 0x427ccb
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], edi
mov word [eax], cx
jmp 0x427d43
push 0x104
lea ecx, [ebp - 0xc]
call fcn.00409af0
cmp dword [esi + 0x14], 8
jb 0x427ce0
mov esi, dword [esi]
push dword [ebp - 0xc]
push edi
push 0x45f97c
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x427d10
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov word [esi], ax
call fcn.00409ba0
mov eax, esi
jmp 0x427d43
mov dword [ebp + 0xc], edi
lea eax, [ebp + 0xc]
push dword [ebp + 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.00426629
add esp, 0x10
lea ecx, [ebp + 0xf]
push ecx
mov ecx, dword [ebp + 8]
push eax
push dword [ebp - 0xc]
call fcn.0042654f
lea ecx, [ebp - 0xc]
call fcn.00409ba0
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x427e09
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov ecx, 0x41f
cmp eax, ecx
ja 0x427e87
je 0x427e80
sub eax, 0x404
cmp eax, 0x15
ja case.0x427e31.1030
movzx eax, byte [eax + 0x427f11]
jmp dword [eax*4 + 0x427ee9]
push 0x45f99c
jmp 0x427eda
push 0x45f9ac
jmp 0x427eda
push 0x45f9b4
jmp 0x427eda
push 0x45f9b8
jmp 0x427eda
push 0x45f9bc
jmp 0x427eda
push str.pt_BR
jmp 0x427eda
push str.zh_TW
jmp 0x427eda
push 0x45f9e4
jmp 0x427eda
push 0x45f9a8
jmp 0x427eda
push 0x45f9a0
jmp 0x427eda
sub eax, 0x422
je 0x427ed5
sub eax, 0x1d
je 0x427ece
sub eax, 0x3c5
je 0x427ec7
sub eax, 0x12
je 0x427ec0
sub eax, 0x3f4
je 0x427eb9
mov eax, dword [ebp + 8]
and dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
pop ebp
ret
push 0x45f9b0
jmp 0x427eda
push str.pt_PT
jmp 0x427eda
push str.zh_CN
jmp 0x427eda
push 0x45f9e0
jmp 0x427eda
push 0x45f9a4
mov ecx, dword [ebp + 8]
call fcn.004036f0
mov eax, dword [ebp + 8]
pop ebp
ret

Function at 0x427f68
Capabilities:
Get common file path
Get disk size
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0043d870
add esp, 0xc
lea eax, [ebp - 0x20c]
cmp byte [ebp + 8], bl
push eax
push ebx
push ebx
push 0x1c
pop eax
push 0x26
pop ecx
cmovne eax, ecx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x427fe6
push 0x311
push str.lite_installer::HasEnoughDiskSpace
push ebx
lea ecx, [ebp - 0x26c]
call fcn.004338f7
push str.SHGetFolderPath_failed
lea ecx, [eax + 8]
call fcn.0041fc9c
lea ecx, [ebp - 0x26c]
call fcn.004339b2
mov al, 1
jmp 0x428065
push ebx
push ebx
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x42801d
push 0x317
push str.lite_installer::HasEnoughDiskSpace
push ebx
lea ecx, [ebp - 0x26c]
call fcn.004338f7
push str.GetDiskFreeSpaceEx_failed
jmp 0x427fcf
cmp dword [ebp - 0x270], ebx
ja 0x428061
cmp dword [ebp - 0x274], 0x19000000
jae 0x428061
push 0x31d
push str.lite_installer::HasEnoughDiskSpace
push ebx
lea ecx, [ebp - 0x26c]
call fcn.004338f7
push str.There_is_not_enough_disk_space_to_install_browser
lea ecx, [eax + 8]
call fcn.0041fc9c
lea ecx, [ebp - 0x26c]
call fcn.004339b2
jmp 0x428063
mov bl, 1
mov al, bl
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0043a597
mov esp, ebp
pop ebp
ret
Function at 0x4282e6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [0x4755e4]
push edi
push dword [ebp + 0x10]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
movzx eax, ax
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x428340
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
test ecx, ecx
je 0x428340
xor eax, eax
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x42833a
cmp eax, edi
je 0x428357
lea ecx, [ecx + edx*2]
inc eax
cmp eax, 0x10
jl 0x428328
mov eax, dword [ebp + 8]
and dword [eax + 0x10], 0
xor ecx, ecx
mov dword [eax + 0x14], 7
mov word [eax], cx
pop edi
pop esi
pop ebp
ret
lea eax, [ebp + 0xf]
push eax
lea eax, [ecx + edx*2]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040e580
mov eax, dword [ebp + 8]
jmp 0x428353