joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468619
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x14
push edi
mov edi, ecx
cmp dword [edi + 0x70c], 0
je 0x468738
mov eax, dword [edi + 0x704]
push esi
mov esi, dword [eax]
cmp eax, esi
je 0x468737
push ebx
push ebp
mov ebp, dword [esp + 0x28]
cmp dword [esi + 8], ebp
jne 0x468727
push ebp
mov ecx, edi
call fcn.004717bc
test al, al
je 0x46867d
lea eax, [esi + 0x19c]
cmp dword [eax + 0x14], 8
jb 0x468666
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46867d
and dword [esi + 0x210], 0
jmp 0x468727
lea ecx, [esi + 8]
call fcn.00467436
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
lea ebx, [edi + 0x748]
push eax
mov ecx, ebx
call fcn.00471d3d
mov ecx, dword [ebx]
mov eax, dword [esp + 0x14]
cmp eax, ecx
je 0x4686b5
cmp ebp, dword [eax + 0x10]
jl 0x4686b5
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
jmp 0x4686bd
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x1c]
mov eax, dword [eax]
cmp eax, ecx
je 0x4686d0
push eax
lea eax, [esp + 0x24]
mov ecx, ebx
push eax
call fcn.0044da21
push 8
lea eax, [esi + 0x3c]
pop ecx
mov dword [esp + 0x10], eax
cmp dword [eax + 0x14], ecx
jb 0x4686e5
mov eax, dword [eax]
mov dword [esp + 0x10], eax
lea ebp, [esi + 0x84]
cmp dword [ebp + 0x14], ecx
jb 0x4686f3
mov ebp, dword [ebp]
lea ebx, [esi + 0x24]
cmp dword [ebx + 0x14], ecx
jb 0x4686fd
mov ebx, dword [ebx]
lea edx, [esi + 0xc]
cmp dword [edx + 0x14], ecx
jb 0x468707
mov edx, dword [edx]
mov ecx, dword [edi + 0x70c]
push 0
push dword [esp + 0x14]
mov eax, dword [ecx]
push ebp
push dword [esi + 8]
push 0x56527c
push ebx
push edx
call dword [eax + 0xc]
mov ebp, dword [esp + 0x28]
mov esi, dword [esi]
cmp dword [edi + 0x704], esi
jne 0x468643
pop ebp
pop ebx
pop esi
pop edi
add esp, 0x14
ret 4
Function at 0x46f6d6
Capabilities:
Create process on windows

Disassembly:
push 0x64
mov eax, 0x53088e
call fcn.00507864
lea ecx, [ebp - 0x40]
call fcn.0048216e
xor ebx, ebx
lea ecx, [ebp - 0x58]
push str._startmodel:floatmode
mov dword [ebp - 4], ebx
call fcn.00450d79
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x40]
push 1
cmovae ecx, dword [ebp - 0x58]
cmp dword [ebp - 0x2c], 8
push ebx
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
cmp dword [0x5952dc], ebx
je 0x46f796
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.00480cc2
mov esi, eax
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00480cc2
mov byte [ebp - 4], 3
cmp dword [esi + 0x14], 0x10
jb 0x46f755
mov esi, dword [esi]
cmp dword [eax + 0x14], 0x10
jb 0x46f75d
mov eax, dword [eax]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._INFO___d___startup_wcc_ret__d_:_n_product__s___n_arg__s_
push 3
push dword [0x5952dc]
call fcn.004801f3
add esp, 0x1c
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.0044ea77
push ebx
push 1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.0044ea77
push str.prodstarttime
lea ecx, [ebp - 0x28]
call fcn.0044ea4a
push ebx
mov byte [ebp - 4], 4
call fcn.00503b8e
pop ecx
push edx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00462aa3
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0044ea77
push str.prodstartcode
lea ecx, [ebp - 0x28]
call fcn.0044ea4a
push edi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
call fcn.00462a42
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.0044ea77
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.004510af
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.004510af
call fcn.00507813
ret
Function at 0x470255
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x530ab2
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x58e700]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58e700]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x54]
lea eax, [edi + 0x538]
xor ebx, ebx
mov ecx, esi
mov dword [esp + 0x4c], ebx
push eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
call fcn.0044f814
xor ebp, ebp
mov dword [esp + 0x4c], ebx
inc ebp
mov dword [esp + 0x14], ebp
cmp dword [esi + 0x10], ebx
jne 0x4702d0
lea eax, [edi + 0x274]
mov ecx, esi
push eax
call fcn.0045105a
cmp dword [esi + 0x10], ebx
je 0x470370
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
call fcn.0044f814
sub esp, 0x18
mov dword [esp + 0x7c], ebp
mov ecx, esp
push str._localappdata_
call fcn.00450d79
mov byte [esp + 0x7c], bl
call fcn.004829f6
add esp, 0x30
test al, al
je 0x470315
lea ecx, [esp + 0x24]
call fcn.00485776
push eax
mov ecx, esi
call fcn.00460790
jmp 0x470360
push 3
push ebx
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.004607b3
mov dword [esp + 0x4c], 2
lea eax, [esp + 0x24]
cmp dword [esp + 0x38], 8
cmovae eax, dword [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47035c
mov ebx, 0x567208
push ebx
call fcn.00450d55
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.00450ce8
xor ebx, ebx
mov byte [esp + 0x4c], bl
push ebx
push ebp
lea ecx, [esp + 0x2c]
call fcn.004510af
cmp dword [esi + 0x10], ebx
jne 0x47038f
lea eax, [esp + 0x24]
mov ecx, edi
push eax
call fcn.004703b2
push eax
mov ecx, esi
call fcn.00460790
push ebx
push ebp
lea ecx, [esp + 0x2c]
call fcn.004510af
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00502673
add esp, 0x3c
ret 4
Function at 0x4705a4
Capabilities:
Create process on windows

Disassembly:
push 0x34
mov eax, 0x530b53
call fcn.00507864
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
call fcn.00470a81
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], ebx
je 0x470622
cmp dword [esi + 0x14], 8
jb 0x4705d0
mov ecx, dword [esi]
jmp 0x4705d2
mov ecx, esi
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 4
cmovae eax, dword [ebp - 0x40]
push ebx
push ecx
push eax
push 0x56721c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
cmp dword [0x5952dc], ebx
je 0x47068b
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.00480cc2
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x470612
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._INFO___d___priority_browser_open_url__s___ret__d_.
jmp 0x47066d
cmp dword [esi + 0x14], 8
jb 0x47062c
mov eax, dword [esi]
jmp 0x47062e
mov eax, esi
push 4
push ebx
push ebx
push eax
push 0x567258
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
cmp dword [0x5952dc], ebx
je 0x47068b
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.00480cc2
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x47065f
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._INFO___d___browser_open_url__s___ret__d_.
push 3
push dword [0x5952dc]
call fcn.004801f3
add esp, 0x18
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.0044ea77
cmp byte [ebp + 0xc], 0
je 0x4706e8
push str.installpageopentime
lea ecx, [ebp - 0x28]
call fcn.0044ea4a
push ebx
mov byte [ebp - 4], 3
call fcn.00503b8e
pop ecx
push edx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00462aa3
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0044ea77
push str.installpageopencode
lea ecx, [ebp - 0x28]
call fcn.0044ea4a
push edi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
call fcn.00462a42
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.0044ea77
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.004510af
cmp edi, 0x20
setg al
call fcn.00507813
ret 8
Function at 0x470ba4
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x530c74
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x58e700]
xor eax, esp
mov dword [esp + 0x440], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58e700]
xor eax, esp
push eax
lea eax, [esp + 0x458]
mov dword fs:[0], eax
mov edi, dword [esp + 0x468]
xor ebx, ebx
mov esi, dword [esp + 0x46c]
xor eax, eax
mov dword [esp + 0x24], ebx
xor ebp, ebp
push 0x40e
mov word [esp + 0x48], ax
inc ebp
lea eax, [esp + 0x4a]
mov dword [esp + 0x2c], edi
push ebx
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], ebp
call fcn.005071f0
xor eax, eax
mov dword [esp + 0x28], 0x208
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
mov word [edi], ax
mov dword [esp + 0x46c], ebx
lea ecx, [esp + 0x38]
push esi
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
mov dword [esp + 0x34], ebp
call fcn.004651f7
add esp, 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x460], ebp
cmp dword [esp + 0x40], 8
lea eax, [esp + 0x2c]
push ecx
cmovae eax, dword [esp + 0x30]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x20019
push ebx
push ebx
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x470cc6
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x5672f4
push dword [esp + 0x28]
call ebp
test eax, eax
jne 0x470cc6
lea eax, [esp + 0x44]
push eax
call esi
test eax, eax
jne 0x470d36
cmp dword [esp + 0x14], 0
je 0x470cd8
push dword [esp + 0x14]
call ebx
and dword [esp + 0x14], 0
cmp dword [esp + 0x40], 8
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x18]
push ecx
lea eax, [esp + 0x34]
cmovae eax, dword [esp + 0x34]
xor ecx, ecx
push ecx
push 0x20219
push ecx
push ecx
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x470d4e
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x56734c
push dword [esp + 0x28]
call ebp
test eax, eax
jne 0x470d4e
lea eax, [esp + 0x44]
push eax
call esi
test eax, eax
je 0x470d4e
lea eax, [esp + 0x44]
push eax
call fcn.00450d55
pop ecx
push eax
lea eax, [esp + 0x48]
mov ecx, edi
push eax
call fcn.00450ce8
cmp dword [esp + 0x14], 0
je 0x470d60
push dword [esp + 0x14]
call ebx
and dword [esp + 0x14], 0
push 0
push 1
lea ecx, [esp + 0x34]
call fcn.004510af
mov eax, edi
mov ecx, dword [esp + 0x458]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x440]
xor ecx, esp
call fcn.00502673
add esp, 0x450
ret 8
Function at 0x470d99
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x530ccf
mov eax, dword fs:[0]
push eax
sub esp, 0x460
mov eax, dword [0x58e700]
xor eax, esp
mov dword [esp + 0x458], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58e700]
xor eax, esp
push eax
lea eax, [esp + 0x474]
mov dword fs:[0], eax
mov esi, dword [esp + 0x484]
xor ebx, ebx
mov dword [esp + 0x24], ebx
xor eax, eax
push 0x40e
mov word [esp + 0x60], ax
xor ebp, ebp
lea eax, [esp + 0x62]
mov dword [esp + 0x2c], esi
push ebx
inc ebp
mov dword [esp + 0x1c], ebx
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], ebp
call fcn.005071f0
xor eax, eax
mov dword [esp + 0x28], 0x208
mov dword [esi + 0x14], 7
add esp, 0xc
mov dword [esi + 0x10], ebx
mov word [esi], ax
mov dword [esp + 0x47c], ebx
lea ecx, [esp + 0x2c]
push 0x567448
mov dword [esp + 0x28], ebp
call fcn.00450d79
lea ecx, [esp + 0x20]
mov dword [esp + 0x47c], ebp
cmp dword [esp + 0x40], 8
lea eax, [esp + 0x2c]
push ecx
cmovae eax, dword [esp + 0x30]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x20019
push ebx
push ebx
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x470f22
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x20]
push eax
push ebx
push 0x5673d4
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x470f22
lea eax, [esp + 0x5c]
push eax
call fcn.00450d55
pop ecx
push eax
lea eax, [esp + 0x60]
mov ecx, esi
push eax
call fcn.00450ce8
mov edi, 0x567444
push edi
call fcn.00450d55
pop ecx
push eax
push ebp
push edi
mov ecx, esi
call fcn.004608d0
cmp eax, 0xffffffff
je 0x470ef6
dec eax
mov ecx, esi
push eax
push ebp
lea eax, [esp + 0x4c]
push eax
call fcn.004607b3
push eax
mov ecx, esi
call fcn.00460790
push ebx
push ebp
lea ecx, [esp + 0x4c]
call fcn.004510af
cmp dword [esi + 0x14], 8
jb 0x470f00
mov eax, dword [esi]
jmp 0x470f02
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x470f22
mov edi, 0x56749c
push edi
call fcn.00450d55
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00450ce8
cmp dword [esp + 0x14], 0
je 0x470f37
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
push ebx
push ebp
lea ecx, [esp + 0x34]
call fcn.004510af
mov eax, esi
mov ecx, dword [esp + 0x474]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x458]
xor ecx, esp
call fcn.00502673
add esp, 0x46c
ret 4
Function at 0x47119c
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x530d71
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [0x58e700]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58e700]
xor eax, esp
push eax
lea eax, [esp + 0x48c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x49c]
xor eax, eax
and dword [esp + 0x25c], 0
xor bl, bl
mov dword [esp + 0x18], ebp
mov dword [esp + 0x260], 7
mov word [esp + 0x24c], ax
and dword [esp + 0x494], eax
push ecx
push 0x567558
mov ecx, ebp
call fcn.00471851
cmp eax, 0xffffffff
je 0x47124a
push 0xffffffffffffffff
inc eax
mov ecx, ebp
push eax
lea eax, [esp + 0x26c]
push eax
call fcn.004607b3
push eax
lea ecx, [esp + 0x250]
call fcn.00460790
push 0
push 1
lea ecx, [esp + 0x26c]
call fcn.004510af
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x47131c
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x47130d
lea edx, [esp + 0x40]
lea ecx, [esp + 0x24c]
call fcn.004651d5
test al, al
je 0x471301
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x24], eax
je 0x471301
xor eax, eax
push 0x206
push eax
mov word [esp + 0x284], ax
lea eax, [esp + 0x286]
push eax
call fcn.005071f0
add esp, 0xc
push dword [esp + 0x24]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4712ed
push 0x104
lea eax, [esp + 0x280]
push eax
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
push edi
call ebp
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x27c]
call fcn.004651d5
test al, al
jne 0x471317
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x47127d
jmp 0x471319
mov bl, 1
push esi
call ebp
push 0
push 1
lea ecx, [esp + 0x254]
call fcn.004510af
mov al, bl
mov ecx, dword [esp + 0x48c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.00502673
add esp, 0x484
ret 4
Function at 0x477189
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x531b2d
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x58e700]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58e700]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov ebp, ecx
cmp dword [ebp + 0x78c], 0
je 0x477313
push ecx
lea ecx, [esp + 0x20]
call fcn.0047c7f4
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea edi, [esp + 0x2c]
mov esi, eax
lea eax, [esp + 0x1c]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call ebx
push 3
pop eax
mov word [esp + 0x1c], ax
lea esi, [esp + 0x1c]
mov dword [esp + 0x24], eax
lea edi, [esp + 0x3c]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x1c]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call ebx
mov ecx, dword [ebp + 0x78c]
call fcn.004b5ed9
push 1
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x54]
push ecx
push str.WSAppInvoke
push eax
call fcn.004b6169
add esp, 0x14
test eax, eax
jns 0x477313
xor ebx, ebx
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x98], ebx
push eax
push ebx
call dword [sym.imp.OLEAUT32.dll_SetErrorInfo]
test eax, eax
js 0x4772fd
mov eax, dword [esp + 0x14]
test eax, eax
je 0x477301
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push eax
call dword [ecx + 0x14]
test eax, eax
js 0x4772fd
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x5952dc], ebx
je 0x4772f3
push dword [esp + 0x18]
lea ecx, [esp + 0x60]
call fcn.00450d79
lea edx, [esp + 0x5c]
mov byte [esp + 0x98], 1
lea ecx, [esp + 0x74]
call fcn.00480e71
mov byte [esp + 0x98], 2
cmp dword [eax + 0x14], 0x10
jb 0x4772be
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._INFO___d___bstrDescription___s
push 3
push dword [0x5952dc]
call fcn.004801f3
add esp, 0x14
lea ecx, [esp + 0x74]
push ebx
push 1
call fcn.0044ea77
push ebx
push 1
lea ecx, [esp + 0x64]
call fcn.004510af
push dword [esp + 0x18]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x14]
or dword [esp + 0x98], 0xffffffff
test eax, eax
je 0x477313
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00502673
add esp, 0x88
ret
Function at 0x47777b
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x531c18
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x58e700]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58e700]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x888]
lea eax, [esp + 0x5c]
push eax
call fcn.0047083e
mov edx, eax
xor ebx, ebx
mov dword [esp + 0x80], ebx
cmp dword [edx + 0x14], 8
jb 0x4777d2
mov edx, dword [edx]
mov ecx, dword [esi + 0x7f4]
push edx
mov eax, dword [ecx]
call dword [eax + 0x2c]
or dword [esp + 0x80], 0xffffffff
lea ecx, [esp + 0x5c]
xor ebp, ebp
push ebx
inc ebp
push ebp
call fcn.004510af
mov ecx, dword [esi + 0x7dc]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x104]
mov ecx, dword [esi + 0x774]
push ebp
mov eax, dword [ecx]
call dword [eax + 0x104]
mov ecx, dword [esi + 0x7e0]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x104]
lea edi, [esi + 0xcb8]
mov ecx, edi
call fcn.0049f7f0
test eax, eax
je 0x47783b
push ebp
push ebx
mov ecx, edi
call fcn.0049fd1f
mov ecx, dword [esi + 0x7e4]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x104]
mov ecx, dword [esi + 0x7f0]
push ebp
mov eax, dword [ecx]
call dword [eax + 0x104]
push 0x7be
push dword [esi + 0x7c8]
lea ecx, [esi + 0x30]
call fcn.0049a615
push 0x561fce
lea ecx, [esp + 0x30]
call fcn.0044ea4a
push 0x561fcf
lea ecx, [esp + 0x18]
mov dword [esp + 0x84], ebp
call fcn.0044ea4a
push str.downloader_error_pop
lea ecx, [esp + 0x48]
mov byte [esp + 0x84], 2
call fcn.0044ea4a
lea eax, [esp + 0x2c]
mov byte [esp + 0x80], 3
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.0045ee20
mov ecx, eax
call fcn.0045f24e
push ebx
push ebp
lea ecx, [esp + 0x4c]
call fcn.0044ea77
push ebx
push ebp
lea ecx, [esp + 0x1c]
call fcn.0044ea77
push ebx
push ebp
lea ecx, [esp + 0x34]
call fcn.0044ea77
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00502673
add esp, 0x70
ret
Function at 0x4790f8
Capabilities:
Delete file

Disassembly:
push 0x1c
mov eax, 0x531f3b
call fcn.0050789a
mov edi, ecx
mov dword [ebp - 0x14], edi
xor ebx, ebx
cmp dword [edi + 0x89c], ebx
jne 0x47912c
mov dword [ebp - 4], ebx
mov ecx, dword [edi + 0x7f0]
mov eax, dword [ecx]
call dword [eax + 0x100]
test al, al
je 0x479147
or dword [ebp - 4], 0xffffffff
push 0x7be
push dword [edi + 0x7c8]
lea ecx, [edi + 0x30]
call fcn.0049a615
xor eax, eax
call fcn.005077ff
ret
cmp byte [edi + 0x1430], 0
jne 0x4791e1
mov ecx, dword [edi + 0x888]
push ebx
call fcn.0046873f
test al, al
je 0x4791e1
mov ecx, dword [edi + 0x888]
push 1
call fcn.0046873f
test al, al
je 0x4791e1
mov ecx, dword [edi + 0x888]
push 2
call fcn.0046873f
test al, al
je 0x4791e1
cmp dword [0x5952dc], 0
je 0x4791ab
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._INFO___d___WaeWnd_Install_success.
push 3
push dword [0x5952dc]
call fcn.004801f3
add esp, 0x10
mov eax, dword [edi + 0x888]
cmp byte [eax + 0x719], 0
jne 0x4791ce
add eax, 0x640
cmp dword [eax + 0x14], 8
jb 0x4791c7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push 0x8066
mov ecx, edi
call fcn.0049f926
jmp 0x479128
cmp dword [edi + 0x89c], ebx
jne 0x479293
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea esi, [edi + 0x8cc]
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x8e8]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x24]
call fcn.0047c199
lea ecx, [edi + 0x8e8]
mov eax, dword [ecx]
push esi
mov dword [ecx + 4], eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x24]
cmp dword [ebp - 0x20], esi
je 0x479270
cmp dword [0x5952dc], 0
je 0x47925e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._WARN___d___WaeWnd_Install__retry_down_task__task_id__d_
push 2
push dword [0x5952dc]
call fcn.004801f3
add esp, 0x14
push dword [esi]
mov ecx, dword [edi + 0x888]
call fcn.00468619
add esi, 4
jmp 0x479232
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x24], 0
je 0x479293
push dword [ebp - 0x24]
call fcn.0050266e
pop ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
or dword [ebp - 4], 0xffffffff
jmp 0x47910b