joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Print debug messages
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00409490
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
lea edx, [ebp - 0x1008]
push edx
mov edx, dword [ebp + 0x10]
dec edx
push edx
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
mov eax, dword [ebp - 0x1008]
push eax
push esi
push str.Reading_Launch_Args:_Status:__i__Bytes_Read:__u
lea ecx, [ebp - 0x1004]
push 0x1000
push ecx
call fcn.00409454
add esp, 0x14
lea edx, [ebp - 0x1004]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test esi, esi
pop esi
je 0x40107b
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409472
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
or eax, 0xffffffff
call fcn.00409472
mov esp, ebp
pop ebp
ret
Function at 0x401860
Capabilities:
Create directory
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.004027f0
test eax, eax
jne 0x4018ca
call fcn.00402870
test eax, eax
jne 0x4018ca
mov edi, dword [ebp + 0xc]
push esi
add edi, 0xfffffffb
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, edi
jb 0x4018bb
push str.ERROR:_dont_have_enough_buffer_size_to_store_download_file_path__Exit_now
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409472
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.OK:_Creating_download_location_for_non_XP_or_Vista_OS
call ebx
jmp 0x401931
push esi
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test eax, eax
jns 0x401913
push str.Warning:_Failed_to_get_common_appdata_folder_for_downloading_files__using_hard_coded_paths___
call ebx
call fcn.004027f0
test eax, eax
je 0x401903
push str.C:ProgramData
push esi
call fcn.004093d0
add esp, 8
jmp 0x40191a
push str.C:Documents_and_SettingsAll_UsersApplication_Data
push esi
call fcn.004093d0
add esp, 8
jmp 0x40191a
push str.OK:_Using_common_appdata_folder_for_downloading_files
call ebx
lea edi, [esi - 1]
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401920
mov ax, word [0x41766c]
mov word [edi], ax
lea eax, [esi - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401934
mov ecx, dword [str.CA_SupportBridge_]
mov dword [eax], ecx
mov edx, dword [0x41765c]
mov dword [eax + 4], edx
mov ecx, dword [0x417660]
mov dword [eax + 8], ecx
mov edx, dword [0x417664]
mov dword [eax + 0xc], edx
mov cx, word [0x417668]
push esi
lea edx, [ebp - 0x20c]
push str.location_for_exe_files:__s
push edx
mov word [eax + 0x10], cx
call fcn.004093d0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4019da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4019a9
push str.OK:_Found_existing_directory_for_downloading_files
jmp 0x4019df
push eax
lea ecx, [ebp - 0x20c]
push str.ERROR:_cannot_create_directory_for_downloaded_file._Error_code:__i._Exit_now_
push ecx
call fcn.004093d0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call ebx
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409472
mov esp, ebp
pop ebp
ret
push str.OK:_Created_directory_for_exe_files
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00409472
mov esp, ebp
pop ebp
ret
Function at 0x402010
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
mov dword [ebp - 0x808], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40207b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_file__error__d__n
call fcn.00409ffd
add esp, 8
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409472
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x80c]
push eax
push 0x7ff
lea ecx, [ebp - 0x804]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402171
cmp dword [ebp - 0x80c], 0
je 0x402171
lea edx, [ebp - 0x804]
push 0x4178a4
push edx
call fcn.00409f3f
add esp, 8
test eax, eax
je 0x402171
push 0x4178a4
push 0
call fcn.00409f3f
add esp, 8
test eax, eax
je 0x402171
nop
push str.AppServer
push eax
call fcn.00409d10
add esp, 8
test eax, eax
jne 0x402106
push 0x4178a4
push eax
call fcn.00409f3f
add esp, 8
test eax, eax
jne 0x4020e0
jmp 0x402171
mov ecx, eax
push esi
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x402110
sub ecx, esi
pop esi
cmp ecx, 0xd2
jae 0x402171
add eax, 0xa
mov edx, edi
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x402130
push 0x4178a4
push 0
call fcn.00409f3f
add esp, 8
test eax, eax
je 0x402171
push 0x417894
push eax
call fcn.00409d10
add esp, 8
test eax, eax
je 0x402171
add eax, 3
push eax
call fcn.00409f34
add esp, 4
mov dword [ebp - 0x808], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x808]
pop edi
xor ecx, ebp
pop ebx
call fcn.00409472
mov esp, ebp
pop ebp
ret
Function at 0x4027f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x94
lea eax, [ebp - 0x98]
push 9
push eax
call fcn.004094c0
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x402855
cmp dword [ebp - 0x94], 6
jne 0x402855
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409472
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00409472
mov esp, ebp
pop ebp
ret

Function at 0x402870
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x94
lea eax, [ebp - 0x98]
push 9
push eax
call fcn.004094c0
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x4028cf
cmp dword [ebp - 0x94], 5
jne 0x4028cf
mov eax, 1
cmp dword [ebp - 0x90], eax
je 0x4028d1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409472
mov esp, ebp
pop ebp
ret

Function at 0x4028e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402984
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0x3c
push esi
call edi
cmp eax, 0xffffffff
je 0x402983
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [ebp - 0xc]
push ecx
push 4
lea edx, [ebp - 8]
push edx
push esi
mov dword [ebp - 8], 0
call ebx
test eax, eax
je 0x402982
mov eax, dword [ebp - 8]
cmp eax, 0xffffffff
je 0x402982
push 0
push 0
add eax, 0x58
push eax
push esi
call edi
cmp eax, 0xffffffff
je 0x402982
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea ecx, [ebp - 8]
push ecx
push esi
mov dword [ebp - 8], 0
call ebx
test eax, eax
je 0x402982
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov byte [ebp - 1], 1
pop ebx
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4029a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
lea esi, [ebp - 0x324]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp + 0x14]
push edi
mov ecx, ebx
sub esi, ebx
nop
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x4029d0
lea edi, [ebp - 0x324]
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4029e1
mov cx, word [0x41766c]
mov word [edi], cx
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4029f5
sub eax, esi
lea edi, [ebx - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x402a01
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x464]
mov ecx, eax
push edx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402b77
push 0xc7
lea eax, [ebp - 0xcb]
push 0
push eax
mov byte [ebp - 0xcc], 0
call fcn.004094c0
add esp, 0xc
xor eax, eax
nop
mov cl, byte [ebp + eax - 0x324]
mov byte [ebp + eax - 0x1f8], cl
inc eax
test cl, cl
jne 0x402a50
push 0x103
lea ecx, [ebp - 0x438]
push ecx
lea edx, [ebp - 0x1f8]
push edx
call fcn.004090e6
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x1f8]
push ecx
call fcn.00402010
mov edi, dword [ebp + 0x10]
mov esi, eax
add esp, 0x14
cmp esi, edi
je 0x402b43
lea edx, [ebp - 0x464]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x402b5d
jmp 0x402ac0
xor eax, eax
jmp 0x402ad0
mov cl, byte [ebp + eax - 0x324]
mov byte [ebp + eax - 0x1f8], cl
inc eax
test cl, cl
jne 0x402ad0
push 0x103
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x1f8]
push ecx
call fcn.004090e6
lea edx, [ebp - 0xcc]
push edx
lea eax, [ebp - 0x1f8]
push eax
call fcn.00402010
mov esi, eax
add esp, 0x14
cmp esi, edi
je 0x402b43
lea ecx, [ebp - 0x464]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402ac0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409472
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x468]
lea eax, [ebp - 0xcc]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x402b53
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409472
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00409472
mov esp, ebp
pop ebp
ret
Function at 0x402b90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1208
call fcn.00409490
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
mov dword [ebp - 0x1208], eax
mov eax, dword [ebp + 0xc]
push 0x80000000
push eax
mov dword [ebp - 0x1200], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x1204], esi
cmp esi, 0xffffffff
jne 0x402c07
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_file__error__d__n
call fcn.00409ffd
add esp, 8
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409472
mov esp, ebp
pop ebp
ret
push edi
push ebx
lea ecx, [ebp - 0x11fc]
push ecx
push 0xfff
lea edx, [ebp - 0x11f8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402d87
cmp dword [ebp - 0x11fc], ebx
je 0x402d87
push 0x12b
lea eax, [ebp - 0x1f7]
push ebx
push eax
lea edi, [ebp - 0x11f8]
mov byte [ebp - 0x1f8], bl
call fcn.004094c0
push 0xc7
lea ecx, [ebp - 0xcb]
push ebx
push ecx
mov byte [ebp - 0xcc], bl
call fcn.004094c0
add esp, 0x18
cmp dword [ebp - 0x11fc], ebx
jbe 0x402d87
lea esp, [esp]
push str.directory
push edi
call fcn.00409d10
mov esi, eax
add esp, 8
test esi, esi
je 0x402d53
add ebx, 0xa
add edi, 0xa
cmp ebx, dword [ebp - 0x11fc]
jae 0x402d81
push str..slt
push edi
call fcn.00409d10
add esp, 8
test eax, eax
je 0x402d75
sub eax, esi
lea esi, [eax - 6]
cmp esi, 0x120
jae 0x402d12
push esi
lea edx, [ebp - 0x1f8]
push edi
push edx
call fcn.0040a0d0
push 0xc
lea eax, [ebp - 0x1f8]
push str.cookies.txt
push eax
mov byte [ebp + esi - 0x1f8], 0
call fcn.004090e6
lea ecx, [ebp - 0xcc]
push ecx
lea edx, [ebp - 0x1f8]
push edx
call fcn.00402010
add esp, 0x20
mov dword [ebp - 0x1200], eax
lea ebx, [ebx + esi + 1]
cmp ebx, dword [ebp - 0x11fc]
jae 0x402d22
lea edi, [edi + esi + 1]
mov eax, dword [ebp - 0x1200]
cmp eax, dword [ebp + 0x10]
jne 0x402d75
mov edx, dword [ebp - 0x1208]
lea eax, [ebp - 0xcc]
mov ecx, eax
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x402d40
mov edx, dword [ebp - 0x1204]
push edx
jmp 0x402d88
push edi
call fcn.004093bd
lea ebx, [ebx + eax + 1]
add esp, 4
cmp ebx, dword [ebp - 0x11fc]
jae 0x402d81
push edi
call fcn.004093bd
add esp, 4
lea edi, [edi + eax + 1]
cmp ebx, dword [ebp - 0x11fc]
jb 0x402c80
mov esi, dword [ebp - 0x1204]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1200]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409472
mov esp, ebp
pop ebp
ret
Function at 0x402db0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x130]
push eax
push 0x12c
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x130]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x402de0
mov ecx, dword [0x417a2c]
mov edx, dword [0x417a30]
mov dword [eax], ecx
mov cl, byte [0x417a34]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0xc]
push str..txt
mov byte [eax + 8], cl
push edx
lea eax, [ebp - 0x130]
push eax
push esi
call fcn.004029a0
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop esi
call fcn.00409472
mov esp, ebp
pop ebp
ret
Function at 0x4039a0
Capabilities:
Download and write a file
Get http content length
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov edx, dword [ebp + 8]
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xc]
push ecx
push 0x20000005
push edx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x403ad8
mov eax, 0xcccccccd
mul dword [ebp - 0xc]
push esi
mov esi, edx
shr esi, 3
push edi
push esi
mov dword [ebp - 0x10], esi
call fcn.0040a5a3
add esp, 4
mov edi, eax
jmp 0x4039f8
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push esi
push edi
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
add ebx, eax
xor esi, esi
test eax, eax
je 0x403a3f
mov ecx, dword [ebp + 0xc]
push 0
lea edx, [ebp - 0x18]
push edx
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403acd
add esi, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
cmp esi, eax
jb 0x403a16
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edx + 0xc0c]
test ecx, ecx
je 0x403aa8
mov eax, ebx
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
test eax, eax
jns 0x403a5e
fadd dword [0x418310]
mov eax, dword [ebp - 0xc]
fild dword [ebp - 0xc]
test eax, eax
jns 0x403a6e
fadd dword [0x418310]
fdivp st(1)
fmul qword [0x418308]
fnstcw word [ebp - 2]
movzx eax, word [ebp - 2]
or eax, 0xc00
mov dword [ebp - 0x20], eax
fldcw word [ebp - 0x20]
fistp qword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [edx + 0xc04]
mov edx, dword [edx + 0xc00]
fldcw word [ebp - 2]
push eax
push edx
call ecx
mov eax, dword [ebp - 8]
add esp, 0xc
test eax, eax
jne 0x4039f5
cmp dword [ebp - 0x28], eax
je 0x4039f5
push edi
call fcn.0040a569
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x403f70
Capabilities:
Delete file
Move file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.attemp_to_uncompress_the_downloaded_file
call edi
mov esi, dword [ebp + 8]
push esi
call edi
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403f90
sub eax, edx
add eax, 2
push eax
call fcn.00409a19
push esi
mov ebx, eax
push 0x4184e4
push ebx
call fcn.004093d0
push 0
push esi
call fcn.00408ae0
mov edi, eax
add esp, 0x18
test edi, edi
je 0x40404e
push str.seems_like_we_have_a_zip_file__unzip_it_now
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
push 0
push edi
call fcn.00408b00
add esp, 0xc
test eax, eax
je 0x404004
push str.Error_unzipping_files_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
call fcn.00408e60
add esp, 4
push ebx
call fcn.0040a0ba
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret 4
push edi
call fcn.00408e60
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test eax, eax
jne 0x404028
push str.Error_deleting_file
call edi
push esi
call edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x404059
push str.Error_renaming_file
call edi
push esi
call edi
push ebx
call fcn.0040a0ba
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret 4
push str.Cannot_open_zip_file__it_may_not_be_compressed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
call fcn.0040a0ba
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x404070
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 0
push 0
lea eax, [ebp - 0x408]
push eax
push 0x400
push ecx
push 0
push 0x1300
mov dword [ebp - 0x408], 0
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [ebp - 0x408]
push edx
push esi
push str._s_:__s
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.00409454
add esp, 0x14
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00409472
mov esp, ebp
pop ebp
ret
Function at 0x404100
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov ebx, ecx
mov byte [ebp - 1], 1
call fcn.00403af0
add esp, 4
add ebx, 0xa00
mov edi, eax
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404126
sub eax, edx
je 0x404153
test edi, edi
je 0x404153
push edi
push ebx
call fcn.0040a344
add esp, 8
test eax, eax
jne 0x404153
push str.Everything_is_OK._Signer_names_match.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov bl, byte [ebp - 1]
jmp 0x404176
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Signer_names_do_not_match2.
call esi
push str.ActiveX_Signer:
call esi
push ebx
call esi
push str.File_Signer:
call esi
push edi
call esi
xor bl, bl
test edi, edi
je 0x404183
push edi
call fcn.0040a0ba
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404190
Capabilities:
Get file version info
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x109c
call fcn.00409490
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1088], ecx
lea ecx, [ebp - 0x109c]
push ecx
push edi
mov dword [ebp - 0x1090], edi
mov dword [ebp - 0x1094], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x4041f5
push edi
lea edx, [ebp - 0x1084]
push str.Could_not_get_the_size_for_the_version_info_for_File___s_._Need_to_download.
push edx
call fcn.004093d0
add esp, 0xc
lea eax, [ebp - 0x1084]
push eax
jmp 0x4042ef
push ebx
push esi
call fcn.0040a5a3
add esp, 4
mov ebx, eax
push ebx
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [ebp - 0x1098]
push ecx
lea edx, [ebp - 0x108c]
push edx
push 0x41766c
push ebx
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 0x108c]
mov esi, dword [eax + 0xc]
mov edi, dword [eax + 8]
push ebx
call fcn.0040a569
movzx eax, si
push eax
movzx ecx, di
shr esi, 0x10
push esi
push ecx
shr edi, 0x10
push edi
lea edx, [ebp - 0x84]
push str._d._d._d._d
push edx
call fcn.004093d0
mov esi, dword [ebp - 0x1094]
lea eax, [ebp - 0x84]
push esi
push eax
call fcn.0040a344
add esp, 0x24
pop ebx
test eax, eax
jne 0x4042cc
mov ecx, dword [ebp - 0x1090]
push ecx
mov ecx, dword [ebp - 0x1088]
call fcn.00404100
push esi
lea edx, [ebp - 0x84]
test al, al
push edx
lea eax, [ebp - 0x1084]
jne 0x40429d
push str.The_actual_version___s__matches___s___but_the_certificate_signer_does_not_match._Need_to_download.
jmp 0x4042df
push str.The_actual_version___s__matches___s__and_the_certificate_signer_matches._No_need_to_download.
push eax
call fcn.004093d0
add esp, 0x10
lea ecx, [ebp - 0x1084]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409472
mov esp, ebp
pop ebp
ret 8
push esi
lea edx, [ebp - 0x84]
push edx
push str.The_actual_version___s__is_different_from___s_._Need_to_download
lea eax, [ebp - 0x1084]
push eax
call fcn.004093d0
add esp, 0x10
lea ecx, [ebp - 0x1084]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.00409472
mov esp, ebp
pop ebp
ret 8
Function at 0x404310
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x604
mov eax, dword [0x41e024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x800]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404332
sub eax, edx
cmp byte [eax + esi + 0x7ff], 0x5c
jne 0x404360
mov eax, edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404350
sub eax, edx
mov byte [eax + esi + 0x7ff], cl
lea eax, [esi + 0x200]
push eax
push edi
lea ecx, [ebp - 0x204]
push 0x418738
push ecx
call fcn.004093d0
add esp, 0x10
push 0
lea edx, [ebp - 0x404]
push edx
push 0x200
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea ecx, [ebp - 0x404]
push ecx
lea edx, [ebp - 0x204]
push edx
call fcn.0040a552
add esp, 8
test eax, eax
jne 0x40442c
lea eax, [ebp - 0x204]
push eax
mov ecx, esi
call fcn.00404100
test al, al
je 0x40442c
push 1
push edi
add esi, 0x600
push esi
lea ecx, [ebp - 0x204]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x4043f8
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409472
mov esp, ebp
pop ebp
ret
push eax
lea edx, [ebp - 0x604]
push str.ShellExecute_error_code:__i
push edx
call fcn.004093d0
add esp, 0xc
lea eax, [ebp - 0x604]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409472
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.EXE_Path_and_Actual_EXE_Path_do_not_match:
call esi
lea ecx, [ebp - 0x204]
push ecx
call esi
lea edx, [ebp - 0x404]
push edx
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor al, al
pop esi
call fcn.00409472
mov esp, ebp
pop ebp
ret