joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4197b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
cmp byte [ecx + 0xea0c], 0
mov eax, dword [0x4a766c]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x4a7670]
mov dword [ebp - 0x48], eax
mov eax, dword [0x4a7674]
mov dword [ebp - 0x44], eax
mov eax, dword [0x4a7678]
mov dword [ebp - 0x40], eax
mov eax, dword [0x4a765c]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x4a7660]
mov dword [ebp - 0x38], eax
mov eax, dword [0x4a768c]
mov dword [ebp - 0x34], eax
mov eax, dword [0x4a7690]
mov dword [ebp - 0x30], eax
mov eax, dword [0x4a76a4]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4a76a8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4a76b4]
mov dword [ebp - 0x24], eax
mov eax, dword [0x4a76b8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x4a76cc]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x4a76d0]
mov dword [ebp - 0x18], eax
mov eax, dword [0x4a76d4]
mov dword [ebp - 0x14], eax
mov eax, dword [0x4a76d8]
mov dword [ebp - 0x10], eax
mov eax, dword [0x4a76dc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4a76e0]
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
je 0x4198b5
lea eax, [ecx + 0x585e]
push eax
push 0x104
push ebx
push 0x4a1b98
push str.Language
push str.Bundle
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x4a1b98
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4198ac
test dx, dx
je 0x4198a8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4198ac
add eax, 4
add ecx, 4
test dx, dx
jne 0x419886
xor eax, eax
jmp 0x4198b1
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4198f6
push esi
push edi
push 1
push ebx
call fcn.004137b0
add esp, 8
xor esi, esi
lea edi, [ebp - 0x4c]
push ebx
push edi
call fcn.004896c8
add esp, 8
test eax, eax
je 0x4198f4
inc esi
add edi, 8
cmp esi, 9
jl 0x4198c7
mov eax, 0x4a765c
sub ebx, eax
movzx ecx, word [eax]
mov word [ebx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x4198e5
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00487c50
mov esp, ebp
pop ebp
ret 4
Function at 0x419d10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, ecx
call fcn.004866f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.CyberLinkDownloader_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00411ff0
add esp, 0xc
cmp byte [esi + 0xea0c], 0
je 0x419db0
lea eax, [esi + 0x3b8a]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00411ff0
lea eax, [esi + 0x3d92]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00411ff0
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00411fa0
lea ecx, [ebp - 0x20c]
add esp, 8
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419dd0
mov eax, dword [ebp + 0xc]
sub ecx, edx
sar ecx, 1
cmp eax, ecx
ja 0x419dfa
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00487c50
mov esp, ebp
pop ebp
ret 8
dec eax
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00487152
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
mov eax, 1
pop esi
call fcn.00487c50
mov esp, ebp
pop ebp
ret 8
Function at 0x419ef0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push edi
mov ebx, ecx
lea eax, [ebp - 0x414]
lea edi, [ebx + 0x47ba]
push edi
push 0x104
push eax
push 0x4a8ca4
push str.CurrPosition
push str.Downloader
mov dword [ebp - 0x834], ebx
call esi
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x414]
push 0x4a805c
push eax
call fcn.00489d83
mov ecx, dword [ebx + 0x698]
mov eax, dword [ebp - 0x83c]
add esp, 0xc
mov dword [ecx + 0x3b0], eax
mov eax, dword [ebp - 0x838]
push edi
push 0x104
mov dword [ecx + 0x3b4], eax
lea eax, [ebp - 0x824]
push eax
push 0x4a8ca4
push str.CompleteBytes
push str.Downloader
call esi
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x824]
push 0x4a805c
push eax
call fcn.00489d83
mov ecx, dword [ebx + 0x698]
mov eax, dword [ebp - 0x844]
add esp, 0xc
mov dword [ecx + 0x3a8], eax
mov eax, dword [ebp - 0x840]
push edi
mov dword [ecx + 0x3ac], eax
push 0x104
lea ebx, [ebp - 0x61c]
mov eax, ebx
push eax
push 0x4a8ca4
push str.WriteOffsets
push str.Downloader
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x830], 0
call esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x4a8ca4
push str.WriteFroms
push str.Downloader
call esi
cmp dword [0x4c8068], 0
mov dword [ebp - 0x828], 0
jle 0x41a0b4
mov esi, 0x1e8
lea edi, [ebp - 0x20c]
lea esp, [esp]
lea eax, [ebp - 0x82c]
push eax
mov eax, dword [ebp - 0x834]
mov eax, dword [eax + 0x698]
add eax, 0xfffffe70
add eax, esi
push eax
push str._I64d_n
push ebx
call fcn.00489d83
lea eax, [ebp - 0x830]
push eax
mov eax, dword [ebp - 0x834]
mov eax, dword [eax + 0x698]
add eax, esi
push eax
push str._I64d_n
push edi
call fcn.00489d83
mov eax, dword [ebp - 0x82c]
add esp, 0x20
lea ebx, [ebx + eax*2]
mov eax, dword [ebp - 0x830]
add esi, 8
lea edi, [edi + eax*2]
mov eax, dword [ebp - 0x828]
inc eax
mov dword [ebp - 0x828], eax
cmp eax, dword [0x4c8068]
jl 0x41a040
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00487c50
mov esp, ebp
pop ebp
ret
Function at 0x41a0d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
test esi, esi
je 0x41a221
push esi
push str.HandleCommandLine_:___s_
call fcn.00413860
add esp, 8
lea eax, [ebp + 8]
push eax
push esi
mov dword [ebp + 8], 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x41a221
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jle 0x41a219
lea esp, [esp]
push dword [esi + edi*4]
push edi
push str.__d___s
call fcn.00413860
mov edx, dword [esi + edi*4]
add esp, 0xc
mov ecx, edx
mov eax, str._defaultFolder
jmp 0x41a140
mov si, word [eax]
cmp si, word [ecx]
jne 0x41a166
test si, si
je 0x41a162
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x41a166
add eax, 4
add ecx, 4
test si, si
jne 0x41a140
xor eax, eax
jmp 0x41a16b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41a179
push str.CMD:_Use_Default_Folder
jmp 0x41a1fd
mov ecx, edx
mov eax, str._autoInstall
mov si, word [eax]
cmp si, word [ecx]
jne 0x41a1a6
test si, si
je 0x41a1a2
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x41a1a6
add eax, 4
add ecx, 4
test si, si
jne 0x41a180
xor eax, eax
jmp 0x41a1ab
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41a1bd
mov byte [ebx + 0xea0b], 1
push str.CMD:_Auto_Install
jmp 0x41a204
mov eax, str._bundle
mov cx, word [eax]
cmp cx, word [edx]
jne 0x41a1e8
test cx, cx
je 0x41a1e4
mov cx, word [eax + 2]
cmp cx, word [edx + 2]
jne 0x41a1e8
add eax, 4
add edx, 4
test cx, cx
jne 0x41a1c2
xor eax, eax
jmp 0x41a1ed
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41a20c
mov byte [ebx + 0xea0c], 1
push str.CMD:_Bundle
mov byte [ebx + 0xea0a], 1
call fcn.00413860
add esp, 4
mov esi, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 8]
jl 0x41a120
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41ab40
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
push 7
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
movzx eax, byte [edi + 0xd532]
push eax
push 3
mov ecx, edi
call fcn.0041fe00
cmp byte [edi + 0xea0c], 0
push 5
lea eax, [edi + 0x3982]
push 0
je 0x41ab8c
push str._sp__z_EulaDlg:0_
jmp 0x41ab8e
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x41abec
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004866f0
push esi
push str._ERROR_InstallApp____ShellExecute_failed__ErrorCode___.8X
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00401690
lea eax, [ebp - 0x20c]
push eax
call fcn.004010d0
add esp, 0x20
pop esi
mov ecx, dword [edi + 0x6a4]
test ecx, ecx
je 0x41ac06
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x6a4], 0
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.00487c50
mov esp, ebp
pop ebp
ret

Function at 0x41bc20
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ecx + 0x3982]
push 0x103
push eax
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
call fcn.00487152
xor eax, eax
add esp, 0xc
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41bc87
lea eax, [esi + 1]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00487c50
mov esp, ebp
pop ebp
ret
push 1
push 0
lea eax, [ebp - 0x20c]
push eax
push str.explorer
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
mov ecx, 1
cmovl esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00487c50
mov esp, ebp
pop ebp
ret
Function at 0x41bf20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f7eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4c9890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0xd55c], 0
mov dword [ebp - 0x10], 0
jne 0x41bf89
push 0x2c
call fcn.004867f5
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x41bf7a
mov ecx, eax
call fcn.00411100
jmp 0x41bf7c
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0xd55c], eax
mov esi, dword [edi + 0xd55c]
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push 0x420690
push 0
push 0
call fcn.00487a23
mov dword [esi], eax
mov eax, dword [edi + 0xd55c]
add esp, 0x18
cmp dword [eax], 0
jne 0x41c000
push str.CLDownloaderApp::PostInitializeAsync
push str.__S___beginthreadex_failed
call fcn.00413860
mov esi, dword [edi + 0xd55c]
add esp, 8
test esi, esi
je 0x41bfea
mov ecx, esi
call fcn.00411150
push esi
call fcn.00486409
add esp, 4
mov dword [edi + 0xd55c], 0
mov eax, 0xa0070001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41c7f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f7eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4c9890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0xd560], 0
mov dword [ebp - 0x10], 0
jne 0x41c859
push 0x2c
call fcn.004867f5
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x41c84a
mov ecx, eax
call fcn.00411100
jmp 0x41c84c
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0xd560], eax
mov esi, dword [edi + 0xd560]
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push 0x4206b0
push 0
push 0
call fcn.00487a23
mov dword [esi], eax
mov eax, dword [edi + 0xd560]
add esp, 0x18
cmp dword [eax], 0
jne 0x41c8d0
push str.CLDownloaderApp::PrepareTaskAsync
push str.__S___beginthreadex_failed
call fcn.00413860
mov esi, dword [edi + 0xd560]
add esp, 8
test esi, esi
je 0x41c8ba
mov ecx, esi
call fcn.00411150
push esi
call fcn.00486409
add esp, 4
mov dword [edi + 0xd560], 0
mov eax, 0xa0070001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41e780
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1874
call fcn.00488190
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0041bcc0
cmp byte [ebp + 8], 0
je 0x41e7e7
lea eax, [esi + 0x4fda]
push eax
lea eax, [esi + 0x4dd2]
push eax
push dword [esi + 0xd548]
lea eax, [esi + 0x3b8a]
push dword [esi + 0xd544]
push dword [esi + 0xd540]
push eax
push str.https:__track.cyberlink.com_prog_tracking.jsp_acnCLacp0906uln_sPauseCount_dResumeCount_dDuration_dStartingTime_sCancelReason_s
lea eax, [ebp - 0x104c]
push 0x822
push eax
call fcn.004146d0
add esp, 0x24
jmp 0x41e820
lea eax, [esi + 0x4dd2]
push eax
push dword [esi + 0xd548]
lea eax, [esi + 0x3b8a]
push dword [esi + 0xd544]
push dword [esi + 0xd540]
push eax
push str.https:__track.cyberlink.com_prog_tracking.jsp_acnCLacp0905uln_sPauseCount_dResumeCount_dDuration_dStartingTime_s
lea eax, [ebp - 0x104c]
push 0x822
push eax
call fcn.004146d0
add esp, 0x20
cmp byte [esi + 0xd531], 0
mov ecx, 0x4a95b0
mov eax, 0x4a95a8
cmove eax, ecx
push eax
lea eax, [esi + 0x4bca]
push eax
lea eax, [esi + 0x45b2]
push eax
lea eax, [esi + 0x51e2]
push eax
lea eax, [esi + 0x43aa]
push eax
lea eax, [esi + 0x49c2]
push eax
lea eax, [ebp - 0x104c]
push eax
push str._sTokenID_sLANGUAGE_sLocale_sFormat_sUUID_splatform_s
push 0x822
push 0x823
push eax
call fcn.00486606
lea eax, [ebp - 0x104c]
push eax
push str._SendLog_Complete__szURL_:__s
call fcn.00413860
mov ecx, dword [esi + 0xd578]
add esp, 0x34
call fcn.00411290
push 0
push 0
push 0
push 0
push str.Microsoft_Internet_Explorer
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ecx, dword [esi + 0xd578]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0xd578]
mov eax, dword [eax + 4]
test eax, eax
je 0x41e92d
push 0
push SysReAllocString
push 0
push 0
lea ecx, [ebp - 0x104c]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ecx, dword [esi + 0xd578]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xd578]
cmp dword [eax + 8], 0
je 0x41e92d
lea ecx, [ebp - 0x1874]
push ecx
push 0x822
lea ecx, [ebp - 0x1870]
push ecx
mov dword [ebp - 0x1874], 0
push dword [eax + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x41e92d
mov eax, dword [ebp - 0x1874]
test eax, eax
je 0x41e92d
cmp eax, 0x823
jae 0x41e958
mov byte [ebp + eax - 0x1870], 0
mov ecx, dword [esi + 0xd578]
call fcn.00411290
mov eax, dword [esi + 0xd578]
mov ecx, dword [ebp - 4]
mov byte [eax + 0xc], 1
xor ecx, ebp
mov eax, 0x80004005
pop esi
call fcn.00487c50
mov esp, ebp
pop ebp
ret 4
call fcn.0048697a
int3
Function at 0x41e960
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f41b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c9890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [ebp - 0x10], 0
call fcn.004867f5
mov dl, byte [ebp + 8]
mov ebx, eax
add esp, 4
mov dword [ebx], edi
mov byte [ebx + 4], dl
cmp dword [edi + 0xd578], 0
jne 0x41e9dc
push 0x2c
call fcn.004867f5
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x41e9cd
mov ecx, eax
call fcn.00411100
jmp 0x41e9cf
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0xd578], eax
mov esi, dword [edi + 0xd578]
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
push 0x419700
push 0
push 0
call fcn.00487a23
mov dword [esi], eax
mov eax, dword [edi + 0xd578]
add esp, 0x18
cmp dword [eax], 0
jne 0x41ea5c
push str.CLDownloaderApp::SendLog_CompleteAsync
push str.__S___beginthreadex_failed
call fcn.00413860
push ebx
call fcn.00486409
mov esi, dword [edi + 0xd578]
add esp, 0xc
test esi, esi
je 0x41ea43
mov ecx, esi
call fcn.00411150
push esi
call fcn.00486409
add esp, 4
mov dword [edi + 0xd578], 0
mov eax, 0xa0070001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41f090
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f7eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4c9890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0xd584], 0
jne 0x41f0f2
push 0x2c
call fcn.004867f5
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x41f0e3
mov ecx, eax
call fcn.00411100
jmp 0x41f0e5
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0xd584], eax
mov eax, dword [edi + 0xd584]
mov dword [ebp - 0x10], 0
cmp dword [eax], 0
jne 0x41f189
push str._SendLog_UpdateSize2Async___fire_update_size_v2_thread
call fcn.00413860
mov esi, dword [edi + 0xd584]
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push 0x419750
push 0
push 0
call fcn.00487a23
mov dword [esi], eax
mov eax, dword [edi + 0xd584]
add esp, 0x1c
cmp dword [eax], 0
jne 0x41f189
push str.CLDownloaderApp::SendLog_UpdateSize2Async
push str.__S___beginthreadex_failed
call fcn.00413860
mov esi, dword [edi + 0xd584]
add esp, 8
test esi, esi
je 0x41f173
mov ecx, esi
call fcn.00411150
push esi
call fcn.00486409
add esp, 4
mov dword [edi + 0xd584], 0
mov eax, 0xa0070001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0xd584]
inc dword [edi + 0xd5a0]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi + 0xd584]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41f500
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f7eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4c9890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0xd580], 0
jne 0x41f562
push 0x2c
call fcn.004867f5
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x41f553
mov ecx, eax
call fcn.00411100
jmp 0x41f555
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0xd580], eax
mov eax, dword [edi + 0xd580]
mov dword [ebp - 0x10], 0
cmp dword [eax], 0
jne 0x41f5f9
push str._SendLog_UpdateSizeAsync___fire_update_size_thread
call fcn.00413860
mov esi, dword [edi + 0xd580]
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push 0x419770
push 0
push 0
call fcn.00487a23
mov dword [esi], eax
mov eax, dword [edi + 0xd580]
add esp, 0x1c
cmp dword [eax], 0
jne 0x41f5f9
push str.CLDownloaderApp::SendLog_UpdateSizeAsync
push str.__S___beginthreadex_failed
call fcn.00413860
mov esi, dword [edi + 0xd580]
add esp, 8
test esi, esi
je 0x41f5e3
mov ecx, esi
call fcn.00411150
push esi
call fcn.00486409
add esp, 4
mov dword [edi + 0xd580], 0
mov eax, 0xa0070001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0xd580]
inc dword [edi + 0xd59c]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi + 0xd580]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41fe00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f9eb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c9890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov bl, byte [ebp + 0xc]
movzx eax, bl
push eax
push dword [ebp + 8]
push str._SendLog_UpdateStatusAsync_____d___d_
call fcn.00413860
add esp, 0xc
cmp dword [edi + 0xd58c], 0
jne 0x41fe78
push 0x2c
call fcn.004867f5
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x41fe69
mov ecx, eax
call fcn.00411100
jmp 0x41fe6b
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0xd58c], eax
mov eax, dword [edi + 0xd58c]
mov dword [ebp + 0xc], 0
cmp dword [eax], 0
jne 0x41ff12
push str._SendLog_UpdateStatusAsync___fire_update_status_thread
call fcn.00413860
mov esi, dword [edi + 0xd58c]
lea eax, [ebp + 0xc]
push eax
push 0
push edi
push 0x419790
push 0
push 0
call fcn.00487a23
mov dword [esi], eax
mov eax, dword [edi + 0xd58c]
add esp, 0x1c
cmp dword [eax], 0
jne 0x41ff12
push str.CLDownloaderApp::SendLog_UpdateStatusAsync
push str.__S___beginthreadex_failed
call fcn.00413860
mov esi, dword [edi + 0xd58c]
add esp, 8
test esi, esi
je 0x41fef9
mov ecx, esi
call fcn.00411150
push esi
call fcn.00486409
add esp, 4
mov dword [edi + 0xd58c], 0
mov eax, 0xa0070001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [edi + 0xd533], 0
lea esi, [edi + 0xd7b4]
jne 0x41ff31
lea esi, [edi + 0xd5a4]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ff36
sub ecx, edx
sar ecx, 1
jne 0x41ff6a
push 0x103
lea eax, [edi + 0x49c2]
push eax
push 0x104
push esi
call fcn.00486548
add esp, 0x10
xor eax, eax
mov word [esi + 0x206], ax
mov eax, dword [ebp + 8]
mov dword [esi + 0x208], eax
mov byte [esi + 0x20c], bl
mov eax, dword [edi + 0xd58c]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi + 0xd58c]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x420750
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.Download_Complete
mov edi, ecx
call fcn.004010d0
add esp, 4
cmp byte [edi + 0xd532], 0
jne 0x4207ea
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov byte [edi + 0xd532], 1
call fcn.004866f0
push 1
push 0x4a62b0
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00401690
add esp, 0x1c
lea eax, [edi + 0x47ba]
push eax
lea eax, [ebp - 0x20c]
push eax
push str.Completed
push str.Downloader
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
movzx eax, byte [edi + 0xd532]
push eax
push 9
mov ecx, edi
call fcn.0041fe00
mov ecx, dword [edi + 0x69c]
test ecx, ecx
je 0x4207f9
call fcn.0040aa00
xor eax, eax
push 0x400
mov word [ebp - 0x414], ax
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0xd2
push dword [edi + 4]
call fcn.00412610
add esp, 0x14
lea eax, [ebp - 0x414]
push eax
lea ecx, [edi + 0xb898]
call fcn.0040d370
push 0
lea ecx, [edi + 0x9514]
call fcn.004089a0
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 0
lea ecx, [edi + 0x8e54]
call fcn.004089a0
push eax
call ebx
push 5
lea ecx, [edi + 0x9bd4]
call fcn.004089a0
push eax
call ebx
push 0
lea ecx, [edi + 0x9bd4]
call fcn.004089b0
push eax
lea ecx, [edi + 0x9bd4]
call fcn.004089a0
mov esi, dword [sym.imp.USER32.dll_InvalidateRect]
push eax
call esi
push 0
lea eax, [edi + 0x644]
push eax
push dword [edi + 0xc]
call esi
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [edi + 0x6a4]
test ecx, ecx
je 0x4208be
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x6a4], 0
push 5
push dword [edi + 0xc]
call ebx
mov ecx, dword [ebp - 4]
mov dword [edi + 0xd520], 4
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00487c50
mov esp, ebp
pop ebp
ret