joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd576
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x500158
call fcn.004c0268
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4bd693
cmp byte [ebx + 0x3e], 0
je 0x4bd693
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.004c0208
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x4bd5c2
xor al, al
jmp 0x4bd695
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004b1ca0
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x4bd5f2
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.004c0208
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x4bd627
sub eax, 1
je 0x4bd62b
dec eax
sub eax, 1
je 0x4bd681
xor bl, bl
jmp 0x4bd683
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x4bd63b
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x4bd663
cmp eax, 0x10
jae 0x4bd64a
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.004e1b87
add esp, 0x10
cmp esi, eax
jne 0x4bd623
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x4bd681
test esi, esi
jne 0x4bd5e6
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00421c90
jmp 0x4bd5e0
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00421400
mov al, bl
jmp 0x4bd695
mov al, 1
call fcn.004c0223
ret
Function at 0x4bdb61
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x500207
call fcn.004c0268
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x4bdb86
xor eax, eax
jmp 0x4bdcff
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4bdbb2
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x4bdbb2
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x4bdcff
cmp dword [esi + 0x4c], 0
je 0x4bdcfc
mov ecx, esi
call fcn.004bd7c3
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x4bdbe5
push dword [esi + 0x4c]
push edi
call fcn.004bd29f
pop ecx
pop ecx
test al, al
je 0x4bdcfc
movzx ebx, di
jmp 0x4bdcfc
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004b1ca0
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x4bdc1d
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.004c0208
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x4bdcf0
cmp eax, 1
jg 0x4bdccb
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x4bdc66
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x4bdc93
cmp eax, 0x10
jae 0x4bdc75
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.004e1b87
add esp, 0x10
cmp edi, eax
jne 0x4bdcc6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x4bdc96
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x4bdcc0
test edi, edi
jne 0x4bdc11
cmp dword [ebp - 0x18], 0x20
jae 0x4bdcea
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.00421c90
jmp 0x4bdc0b
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x4bdcea
cmp eax, 3
jne 0x4bdcf0
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.004bd29f
pop ecx
pop ecx
test al, al
je 0x4bdcea
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00421400
mov ax, bx
call fcn.004c0223
ret 4

Function at 0x4c2293
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4eee98
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004eeb5b

Function at 0x4eeea3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004eecdc
Function at 0x4f4824
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f44e4
Function at 0x402530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402549
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402586
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402582
nop word [eax + eax]
cmp esi, edx
jae 0x402586
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x402570
cmp esi, edx
jb 0x40258d
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4034c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x403523
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403523
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
je 0x403515
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetWebViewFactory
push eax
call edi
test eax, eax
je 0x4034fd
call eax
mov dword [esi + 4], eax
push str.IWebViewToIWebViewEx
push dword [esi]
call edi
push str.IsSupportedWebViewEngine
push dword [esi]
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
xor eax, eax
cmp dword [esi + 4], eax
pop edi
setne al
pop esi
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x404320
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ecx + 0x1e8]
push esi
sub ecx, 0x10
call fcn.004072d0
cmp dword [eax + 4], 0
lea esi, [eax + 0x10]
je 0x40434d
push 1
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or eax, 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x404365
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x404750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cfb20
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x6609c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x1b8]
test ecx, ecx
je 0x404793
mov eax, dword [ecx]
push ecx
call dword [eax + 0x1c]
mov dword [esi + 0x1b8], 0
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x4047ae
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x1a8], 0
mov edx, 0x630b94
mov dword [esi + 0x1ac], 0
lea ecx, [ebp - 0x10]
mov dword [esi + 0x1b0], 0
mov dword [esi + 0x1b4], 0
call fcn.0047c140
push 0x630ba4
lea edx, [ebp - 0x10]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00406200
add esp, 4
mov byte [ebp - 4], 1
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.0046c540
test eax, eax
je 0x404830
push dword [ebp - 0x14]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x404830
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x10]
call fcn.0046cb40
mov ecx, esi
call fcn.00404f40
mov ecx, esi
test eax, eax
js 0x404849
push 1
jmp 0x40484b
push 3
call fcn.00404370
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp - 0x18]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404871
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x404890
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x405010
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cfcde
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6609c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x66a328]
test eax, eax
jne 0x40506a
push 0x58
call fcn.0058a26e
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0040a4c0
mov dword [ebp - 4], 0xffffffff
mov dword [0x66a328], eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, eax
call fcn.0040afb0
mov dword [ebp - 4], 1
cmp byte [ebx + 0x1e0], 0
je 0x4050e4
cmp dword [0x66a328], 0
jne 0x4050af
push 0x58
call fcn.0058a26e
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0040a4c0
mov byte [ebp - 4], 1
mov dword [0x66a328], eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040b0d0
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00406bc0
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4050e4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40510d
push 0x62f864
push 0x631078
push str.cef_load
call fcn.0046c9a0
add esp, 0xc
xor edi, edi
jmp 0x40517d
push esi
lea ecx, [ebx + 0x1a8]
call fcn.004034c0
mov dword [ebx + 0x1cc], eax
test eax, eax
je 0x405157
mov ecx, dword [ebx + 0x19c]
cmp dword [ecx - 0xc], 0
je 0x40514b
push 0
push ecx
mov edi, esp
add ecx, 0xfffffff0
mov dword [ebp - 0x18], edi
call fcn.004072d0
add eax, 0x10
mov ecx, ebx
mov dword [edi], eax
call fcn.004048b0
push 0x62f864
push 0x631054
jmp 0x40516a
push 3
mov ecx, ebx
call fcn.00404370
push 0x62f864
push 0x631078
push str.cef_load
call fcn.0046c9a0
mov edi, dword [ebx + 0x1cc]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40519c
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408e80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d012a
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6609c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [ebp - 4], 2
call fcn.00402b70
mov ecx, eax
test ecx, ecx
jne 0x408ef5
push 0x80004005
call fcn.00402440
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x18], eax
mov byte [ebp - 4], 3
call fcn.00402b70
mov ecx, eax
test ecx, ecx
jne 0x408f19
push 0x80004005
call fcn.00402440
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x1c], eax
mov byte [ebp - 4], 4
call fcn.00402b70
mov ecx, eax
test ecx, ecx
jne 0x408f3d
push 0x80004005
call fcn.00402440
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x20], eax
mov byte [ebp - 4], 5
call fcn.00402b70
mov ecx, eax
test ecx, ecx
jne 0x408f61
push 0x80004005
call fcn.00402440
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x24], eax
lea esi, [edi + 0x28]
mov byte [ebp - 4], 6
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040e4e0
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408fc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d0162
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6609c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0x30]
call fcn.0040da30
mov eax, dword [ebx + 0x28]
lea ecx, [ebx + 0x28]
push eax
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.0040dcf0
push dword [ebx + 0x28]
call fcn.00589ff5
mov edx, dword [ebx + 0x24]
or esi, 0xffffffff
add esp, 4
sub edx, 0x10
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40902a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebx + 0x20]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x409044
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebx + 0x1c]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40905e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebx + 0x18]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x409078
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
mov edi, dword [ebx + 0x14]
test edi, edi
je 0x4090a5
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x4090a5
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x4090a5
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov dword [ebp - 4], 1
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x4090d2
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x4090d2
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x4090d2
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov dword [ebp - 4], 2
mov edi, dword [ebx + 4]
test edi, edi
je 0x4090fe
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x4090fe
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], esi
dec esi
jne 0x4090fe
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a430
Capabilities:
Get file size

Disassembly:
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40a455
xor eax, eax
pop edi
ret
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
ret
Function at 0x40a470
Capabilities:
Get file size

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x40a478
mov ecx, dword [ecx]
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40a49d
xor eax, eax
pop edi
ret
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
ret

Function at 0x40a4c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d021f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6609c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], eax
mov byte [ebp - 4], 1
lea ecx, [esi + 0x28]
push esi
mov dword [esi], vtable.CWebViewMgr.0
mov dword [esi + 4], vtable.CWebViewMgr.1.0
call fcn.0040d390
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
call fcn.00402b70
mov ecx, eax
test ecx, ecx
jne 0x40a55d
push 0x80004005
call fcn.00402440
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x44], eax
mov byte [ebp - 4], 4
call fcn.00402b70
mov ecx, eax
test ecx, ecx
jne 0x40a581
push 0x80004005
call fcn.00402440
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x54], eax
mov byte [ebp - 4], 5
lea eax, [esi + 0x24]
push dword [ebp - 0x10]
mov dword [esi + 0x3c], 0
push eax
push 0x661430
mov dword [esi + 0x40], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], 0
call fcn.0040e7a0
add esp, 0xc
movzx eax, ax
lea ecx, [esi + 4]
push 0
push eax
push 0
push 0
push 0x56000000
push 0
push 0
push 0xfffffffffffffffd
call fcn.0040e6f0
mov eax, dword [esi + 0x2c]
mov dword [eax + 0x38], 0x40d060
mov dword [eax + 0x3c], 0
mov eax, dword [esi + 0x2c]
mov dword [eax + 0x30], 0x40cfa0
mov dword [eax + 0x34], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a790
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d0288
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6609c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x32
xor eax, eax
mov dword [ebp - 0x14], 7
push str.https:__cdn.pdfxd.com_download_pdf_cefnew_small.7z
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00406cc0
push str.cefncefnew_small.7z
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.00408950
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 1
push eax
call fcn.0040aef0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
mov edx, dword [eax]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00408b30
add esp, 4
mov byte [ebp - 4], 3
mov eax, dword [eax]
test eax, eax
je 0x40a822
mov eax, dword [eax]
jmp 0x40a824
xor eax, eax
push eax
lea ecx, [ebp - 0x34]
call fcn.00406470
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x40a840
call fcn.00408c90
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 6
or edi, 0xffffffff
mov edx, dword [ebp - 0x38]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a861
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x40a871
call fcn.00408c90
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a897
xor ebx, ebx
jmp 0x40a8a9
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.0047d360
movd xmm1, ebx
cvtdq2pd xmm1, xmm1
shr ebx, 0x1f
addsd xmm1, qword [ebx*8 + 0x63ea80]
ucomisd xmm1, xmm0
lahf
test ah, 0x44
jnp 0x40a8e2
comisd xmm0, xmmword [0x63e908]
jbe 0x40a8e2
mov esi, 1
jmp 0x40a8e4
xor esi, esi
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x40a900
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x40a915
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00408130
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00589ffa
mov esp, ebp
pop ebp
ret
Function at 0x40aef0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d0369
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6609c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov edx, str.webview
mov dword [ebp - 0x14], 0
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0047c140
mov dword [ebp - 4], 0
push dword [esi]
mov dword [ebp - 0x14], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40af56
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.cef
mov edx, esi
lea ecx, [ebp - 0x10]
call fcn.00406200
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40af7f
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x10]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40af9a
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4