joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416dd0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x184
push esi
push 0x80
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0x80
call fcn.00507270
mov eax, dword [esp + 0x19c]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x416e4b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x100
lea ecx, [esp + 0x8c]
mov esi, eax
push ecx
push esi
call fcn.00405770
mov edx, dword [esp + 0x198]
push eax
mov eax, dword [edx]
push esi
push str.getsockname___failed_with_errno__d:__s
push eax
call fcn.004100a0
add esp, 0x1c
pop esi
add esp, 0x184
ret
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x190]
lea ecx, [ebx + 0x3d4]
push ecx
lea edx, [ebx + 0x3a4]
push edx
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00416c20
add esp, 0x10
test eax, eax
jne 0x416eb0
push edi
call fcn.00505dc4
mov esi, eax
call fcn.00505dc4
push 0x100
lea edx, [esp + 0x94]
mov edi, eax
mov eax, dword [esi]
push edx
push eax
call fcn.00405770
mov ecx, dword [edi]
mov edx, dword [ebx]
push eax
push ecx
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.004100a0
add esp, 0x1c
pop edi
pop ebx
pop esi
add esp, 0x184
ret

Function at 0x417090
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [eax]
push 4
lea ecx, [esp + 8]
push ecx
push 1
push 6
push edx
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4170dc
push 0x100
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00405770
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0040ffd0
add esp, 0x18
pop esi
add esp, 0x104
ret

Function at 0x417230
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x474], 0
je 0x41724d
push eax
call fcn.004077e0
add esp, 4
test eax, eax
jne 0x41726d
xor eax, eax
ret
mov eax, dword [eax + 0x420]
cmp eax, 0xffffffff
je 0x41724a
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x41726d
ret
mov eax, 1
ret
Function at 0x41a580
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], 0
mov eax, dword [esp + 0x1c]
push edx
push eax
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 4], eax
test eax, eax
jne 0x41a739
push esi
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x41a716
push ebx
push ebp
mov eax, dword [edi + 0x14]
test eax, eax
je 0x41a5ee
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41a5e0
sub eax, edx
lea ebx, [eax + 1]
jmp 0x41a5f0
xor ebx, ebx
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x41a5fd
lea ebp, [eax + 0xe]
jmp 0x41a609
cmp eax, 0x17
jne 0x41a6a3
lea ebp, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x41a6a3
mov eax, dword [edi + 0x10]
test eax, eax
je 0x41a6a3
cmp eax, ebp
jb 0x41a6a3
lea edx, [ebx + ebp + 0x20]
push edx
call dword [0x58e0bc]
mov esi, eax
xor eax, eax
add esp, 4
cmp esi, eax
je 0x41a6b0
mov ecx, dword [edi]
mov dword [esi], ecx
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x20]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], ebp
mov dword [esi + 0x18], eax
mov ecx, dword [edi + 0x18]
push ebp
push ecx
push eax
call fcn.00506c20
add esp, 0xc
test ebx, ebx
je 0x41a689
mov eax, dword [esi + 0x18]
add eax, ebp
mov dword [esi + 0x14], eax
mov ecx, dword [edi + 0x14]
push ebx
push ecx
push eax
call fcn.00506c20
add esp, 0xc
cmp dword [esp + 0x10], 0
jne 0x41a694
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41a69f
mov dword [eax + 0x1c], esi
mov dword [esp + 0x18], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x41a5d3
jmp 0x41a6b8
mov dword [esp + 0x14], 8
mov eax, dword [esp + 0x1c]
pop ebp
pop ebx
test eax, eax
je 0x41a6c9
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [esp + 0xc], 0
je 0x41a70f
mov eax, dword [esp + 8]
test eax, eax
je 0x41a6f3
jmp 0x41a6e0
mov esi, dword [eax + 0x1c]
push eax
call dword [0x58e0c0]
add esp, 4
mov eax, esi
test esi, esi
jne 0x41a6e0
mov eax, dword [esp + 0x28]
mov dword [esp + 8], 0
mov edx, dword [esp + 8]
pop edi
mov dword [eax], edx
mov eax, dword [esp + 8]
pop esi
add esp, 0x10
ret
cmp dword [esp + 8], 0
jne 0x41a729
push 0x2af9
mov dword [esp + 0x10], 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 8]
pop edi
mov dword [eax], edx
mov eax, dword [esp + 8]
pop esi
add esp, 0x10
ret
Function at 0x425700
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x8c]
push ebp
mov ebp, dword [ebx]
push esi
mov esi, dword [ebx + 0x7c8]
push edi
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
mov edx, dword [esi + 0x154]
mov eax, dword [esi + 0x15c]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x14]
push 0
add edx, 4
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x42577a
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0xc8]
push ecx
call fcn.00506c20
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x148], edx
mov eax, dword [esi + 0x14c]
cmp eax, 4
jge 0x4257a7
push str.Received_too_short_packet
push ebp
call fcn.004100a0
add esp, 8
mov dword [esi + 0xc], 7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x84
ret
mov edx, dword [esi + 0x15c]
movzx ecx, byte [edx]
movzx edx, byte [edx + 1]
shl cx, 8
movzx ecx, cx
or ecx, edx
mov dword [esi + 0xc], ecx
add ecx, 0xfffffffd
cmp ecx, 3
ja case.default.0x4257cc
jmp dword [ecx*4 + 0x425928]
cmp eax, 4
jle case.0x4257cc.4
mov ecx, dword [esi + 0x15c]
movzx edx, byte [ecx + 2]
movzx ecx, byte [ecx + 3]
shl dx, 8
movzx edx, dx
or edx, ecx
movzx ecx, word [esi + 0x40]
inc ecx
and ecx, 0xffff
cmp ecx, edx
jne case.0x4257cc.4
mov edx, dword [esi + 0x15c]
add eax, 0xfffffffc
push eax
add edx, 4
push edx
push 1
push ebx
call fcn.00410460
mov edi, eax
add esp, 0x10
test edi, edi
je 0x42583e
mov eax, 5
mov ecx, esi
call fcn.00425680
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [ebp + 0x98], eax
mov ecx, dword [ebp + 0x98]
adc dword [ebp + 0x9c], edx
mov eax, dword [ebp + 0x9c]
push eax
push ecx
push ebp
call fcn.0041ed00
add esp, 0xc
jmp case.0x4257cc.4
mov edi, dword [esi + 0x15c]
lea ebx, [eax - 4]
mov eax, dword [esi + 0x15c]
movzx edx, byte [eax + 2]
shl dx, 8
movzx ecx, dx
movzx edx, byte [eax + 3]
push ebx
add edi, 4
or ecx, edx
push 0
push edi
mov dword [esi + 8], ecx
call fcn.00503c60
add esp, 0xc
test eax, eax
je 0x4258b8
sub eax, edi
cmp eax, ebx
jae 0x4258b8
push edi
push str.TFTP_error:__s_n
push ebp
call fcn.0040ffd0
add esp, 0xc
mov ebx, dword [esp + 0x98]
push ebx
call fcn.0041f700
add esp, 4
test eax, eax
je 0x42579a
mov eax, 5
mov ecx, esi
call fcn.00425680
pop edi
pop esi
pop ebp
mov eax, 0x2a
pop ebx
add esp, 0x84
ret
add eax, 0xfffffffe
push eax
mov eax, dword [esi + 0x15c]
add eax, 2
push eax
push esi
call fcn.00424460
add esp, 0xc
test eax, eax
je case.0x4257cc.4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
push str.Internal_error:_Unexpected_packet
push 0x54c2b4
push ebp
call fcn.004100a0
add esp, 0xc
jmp case.0x4257cc.4
Function at 0x42fd10
Capabilities:
Check http status code

Disassembly:
push ebx
mov ebx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebp
mov ebp, dword [esp + 0xc]
mov eax, edx
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
push edi
mov edi, dword [ebx]
cmp eax, 2
je 0x42fd4a
push str.Couldnt_set_desired_mode
push edi
call fcn.004100a0
add esp, 8
pop edi
lea eax, [esi + 0x11]
pop esi
pop ebp
pop ebx
ret
cmp ecx, 0xc8
je 0x42fd61
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edi
call fcn.0040ffd0
add esp, 0xc
cmp ebp, 0x13
jne 0x42fd76
push ebx
call fcn.0042fc90
add esp, 4
pop edi
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x42fd87
call fcn.0042cda0
pop edi
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x42fda0
push 0xd
push 1
push ebx
call fcn.0042ef40
add esp, 0xc
pop edi
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x42fdb4
push 0xe
push 1
push ebx
call fcn.0042ef40
add esp, 0xc
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x442d30
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x20
push ebp
mov ebp, dword [esp + 0x28]
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x442dce
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
lea esi, [esp + 0x20]
mov word [esp + 0x14], 0x208
mov dword [esp + 0x18], 0x6601
mov dword [esp + 0x1c], 8
call fcn.00442ca0
mov ecx, esi
push 8
push ecx
call fcn.00449a90
mov ecx, dword [esp + 0x10]
add esp, 8
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x14
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop esi
test eax, eax
jne 0x442dd5
mov edx, dword [esp + 4]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop ebp
add esp, 0x20
ret
mov eax, dword [ebp]
mov edx, dword [esp + 8]
push edx
mov dword [edi], eax
mov ecx, dword [ebp + 4]
lea eax, [esp + 0xc]
push eax
push edi
push 0
push 0
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x20]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [esp + 4]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
pop ebp
add esp, 0x20
ret

Function at 0x444450
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x444482
push 0x2e
push esi
call fcn.00502b20
add esp, 8
test eax, eax
je 0x444480
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x449ae0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x449b26
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x8002
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov eax, dword [esp + 0x18]
push esi
push eax
call fcn.004131e0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add esp, 4
push 0
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 0
lea eax, [esp + 8]
push eax
push 0
push 2
push ecx
mov dword [esp + 0x18], 0
call esi
cmp dword [esp + 4], 0x10
jne 0x449b83
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
push 0
lea edx, [esp + 8]
push edx
push eax
push 2
push ecx
call esi
mov eax, dword [esp + 0xc]
pop esi
test eax, eax
je 0x449b93
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 4]
test eax, eax
je 0x449ba4
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add esp, 0xc
ret
Function at 0x46646d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
sub esp, 0x310
lea ebp, [esp - 4]
mov eax, dword [0x58e700]
xor eax, ebp
mov dword [ebp + 0x310], eax
push 4
mov eax, 0x52f925
call fcn.005078b1
push 0xffffffffffffffff
push str.LANG_EN
lea ecx, [ebp]
call fcn.0049681b
xor ebx, ebx
lea ecx, [ebp]
push str.LANG_ES
mov dword [ebp - 4], ebx
call fcn.004969b6
push 4
call fcn.0049eed5
lea eax, [ebp + 0x84]
push eax
call fcn.0049a223
pop ecx
pop ecx
mov byte [ebp - 4], 1
call fcn.0049a3e2
dec eax
je 0x466615
dec eax
je 0x4665d8
dec eax
je 0x466560
dec eax
jne 0x46668f
push 0x564e44
push 0x85
call fcn.0049a3cd
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x46668f
push esi
call fcn.0049a3cd
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x466554
push esi
call fcn.0049a3cd
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x466554
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.0049eee2
add esp, 0xc
push ebx
push ecx
mov eax, esp
mov dword [eax], 0x564e54
call fcn.004671e6
mov ecx, eax
call fcn.004b8ca5
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x46668f
xor eax, eax
push 0x206
mov word [ebp + 0x108], ax
lea eax, [ebp + 0x10a]
push ebx
push eax
call fcn.00507270
sub esp, 0x78
lea eax, [ebp + 0x108]
lea esi, [ebp]
push 0x21
pop ecx
mov edi, esp
push str.skin_s_skin_
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x8c
lea eax, [ebp + 0x108]
lea ecx, [ebp + 0x84]
push eax
call fcn.00496a80
lea ecx, [ebp + 0x84]
call fcn.00496f15
push eax
call fcn.0049ee8c
mov dword [esp], 0x564dfc
push ecx
mov eax, esp
mov dword [eax], str.IDR_RES
jmp 0x466683
push str.skin_
lea ecx, [ebp + 0x84]
call fcn.00496a80
lea ecx, [ebp + 0x84]
call fcn.00496f15
push eax
call fcn.0049ee8c
push ebx
push 1
push str.res.zip
call fcn.0049ef70
add esp, 0x10
push ebx
push ecx
mov eax, esp
mov dword [eax], 0x564e30
jmp 0x466683
xor eax, eax
push 0x206
mov word [ebp + 0x108], ax
lea eax, [ebp + 0x10a]
push ebx
push eax
call fcn.00507270
sub esp, 0x78
lea eax, [ebp + 0x108]
lea esi, [ebp]
push 0x21
pop ecx
mov edi, esp
push str...lib_skin_s_skin_
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x8c
lea eax, [ebp + 0x108]
lea ecx, [ebp + 0x84]
push eax
call fcn.00496a80
lea ecx, [ebp + 0x84]
call fcn.00496f15
push eax
call fcn.0049ee8c
pop ecx
push ebx
push ecx
mov eax, esp
mov dword [eax], str.res.xml
call fcn.004671e6
mov ecx, eax
call fcn.004b8ca5
lea ecx, [ebp + 0x84]
mov byte [ebp - 4], bl
call fcn.0049691e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0049691e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x310]
xor ecx, ebp
call fcn.005026fe
lea esp, [ebp + 0x314]
pop ebp
ret
Function at 0x46844c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x52fd45
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x58e700]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58e700]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x70c], 0
jne 0x4684b7
cmp dword [0x5952dc], 0
je 0x468642
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._ERROR___d___function_interface_is_null.
push 1
push dword [0x5952dc]
call fcn.00480395
add esp, 0x10
jmp 0x468642
mov eax, dword [edi + 0x704]
mov esi, dword [eax]
cmp eax, esi
je 0x468629
mov eax, dword [esp + 0x7c]
cmp dword [esi + 0x21c], eax
jne 0x46861b
cmp dword [0x5952dc], 0
je 0x468585
lea edx, [esi + 0x3c]
lea ecx, [esp + 0x4c]
call fcn.00480e64
mov ebp, eax
and dword [esp + 0x74], 0
lea edx, [esi + 0x84]
lea ecx, [esp + 0x34]
call fcn.00480e64
mov ebx, eax
lea edx, [esi + 0x24]
mov byte [esp + 0x74], 1
lea ecx, [esp + 0x1c]
call fcn.00480e64
mov byte [esp + 0x74], 2
cmp dword [ebp + 0x14], 0x10
jb 0x468527
mov ebp, dword [ebp]
cmp dword [ebx + 0x14], 0x10
jb 0x46852f
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 0x10
jb 0x468537
mov eax, dword [eax]
push ebp
push ebx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._INFO___d___WaeMgr_StartDownTask:__d___s___s___s
push 3
push dword [0x5952dc]
call fcn.00480395
add esp, 0x20
lea ecx, [esp + 0x1c]
push 0
push 1
call fcn.0044ea87
push 0
push 1
lea ecx, [esp + 0x3c]
call fcn.0044ea87
or dword [esp + 0x74], 0xffffffff
lea ecx, [esp + 0x4c]
push 0
push 1
call fcn.0044ea87
lea eax, [esi + 0x3c]
cmp dword [eax + 0x14], 8
mov dword [esp + 0x18], eax
jb 0x468598
mov eax, dword [eax]
mov dword [esp + 0x18], eax
lea ebp, [esi + 0x84]
cmp dword [ebp + 0x14], 8
jb 0x4685a7
mov ebp, dword [ebp]
lea edx, [esi + 0x24]
cmp dword [edx + 0x14], 8
jb 0x4685b2
mov edx, dword [edx]
lea ebx, [esi + 0xc]
cmp dword [ebx + 0x14], 8
jb 0x4685c3
mov eax, dword [ebx]
mov dword [esp + 0x14], eax
jmp 0x4685c7
mov dword [esp + 0x14], ebx
mov ecx, dword [edi + 0x70c]
push 0
push dword [esp + 0x1c]
mov eax, dword [ecx]
push ebp
push dword [esi + 8]
push 0x565274
push edx
push dword [esp + 0x2c]
call dword [eax + 0xc]
mov ebp, 0x5952f0
push ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
mov ecx, 0x595310
mov dword [esp + 0x78], 3
call fcn.00464e55
push ebp
inc dword [eax]
or dword [esp + 0x78], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x7c]
mov esi, dword [esi]
cmp dword [edi + 0x704], esi
jne 0x4684cb
mov esi, 0x565278
push esi
call fcn.00450d65
pop ecx
push eax
push esi
lea ecx, [edi + 0x5b0]
call fcn.00450cf8
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.005026fe
add esp, 0x64
ret 4
Function at 0x468699
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x14
push edi
mov edi, ecx
cmp dword [edi + 0x70c], 0
je 0x4687b8
mov eax, dword [edi + 0x704]
push esi
mov esi, dword [eax]
cmp eax, esi
je 0x4687b7
push ebx
push ebp
mov ebp, dword [esp + 0x28]
cmp dword [esi + 8], ebp
jne 0x4687a7
push ebp
mov ecx, edi
call fcn.0047183c
test al, al
je 0x4686fd
lea eax, [esi + 0x19c]
cmp dword [eax + 0x14], 8
jb 0x4686e6
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4686fd
and dword [esi + 0x210], 0
jmp 0x4687a7
lea ecx, [esi + 8]
call fcn.004674b6
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
lea ebx, [edi + 0x748]
push eax
mov ecx, ebx
call fcn.00471dbd
mov ecx, dword [ebx]
mov eax, dword [esp + 0x14]
cmp eax, ecx
je 0x468735
cmp ebp, dword [eax + 0x10]
jl 0x468735
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
jmp 0x46873d
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x1c]
mov eax, dword [eax]
cmp eax, ecx
je 0x468750
push eax
lea eax, [esp + 0x24]
mov ecx, ebx
push eax
call fcn.0044da31
push 8
lea eax, [esi + 0x3c]
pop ecx
mov dword [esp + 0x10], eax
cmp dword [eax + 0x14], ecx
jb 0x468765
mov eax, dword [eax]
mov dword [esp + 0x10], eax
lea ebp, [esi + 0x84]
cmp dword [ebp + 0x14], ecx
jb 0x468773
mov ebp, dword [ebp]
lea ebx, [esi + 0x24]
cmp dword [ebx + 0x14], ecx
jb 0x46877d
mov ebx, dword [ebx]
lea edx, [esi + 0xc]
cmp dword [edx + 0x14], ecx
jb 0x468787
mov edx, dword [edx]
mov ecx, dword [edi + 0x70c]
push 0
push dword [esp + 0x14]
mov eax, dword [ecx]
push ebp
push dword [esi + 8]
push 0x56527c
push ebx
push edx
call dword [eax + 0xc]
mov ebp, dword [esp + 0x28]
mov esi, dword [esi]
cmp dword [edi + 0x704], esi
jne 0x4686c3
pop ebp
pop ebx
pop esi
pop edi
add esp, 0x14
ret 4
Function at 0x47791f
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x531ddc
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x58e700]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58e700]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x888]
lea eax, [esp + 0x5c]
push eax
call fcn.004708bc
mov edx, eax
xor ebx, ebx
mov dword [esp + 0x80], ebx
cmp dword [edx + 0x14], 8
jb 0x477976
mov edx, dword [edx]
mov ecx, dword [esi + 0x7f4]
push edx
mov eax, dword [ecx]
call dword [eax + 0x2c]
or dword [esp + 0x80], 0xffffffff
lea ecx, [esp + 0x5c]
xor ebp, ebp
push ebx
inc ebp
push ebp
call fcn.004510bf
mov ecx, dword [esi + 0x7dc]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x104]
mov ecx, dword [esi + 0x774]
push ebp
mov eax, dword [ecx]
call dword [eax + 0x104]
mov ecx, dword [esi + 0x7e0]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x104]
lea edi, [esi + 0xcb8]
mov ecx, edi
call fcn.0049f64a
test eax, eax
je 0x4779df
push ebp
push ebx
mov ecx, edi
call fcn.0049fe69
mov ecx, dword [esi + 0x7e4]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x104]
mov ecx, dword [esi + 0x7f0]
push ebp
mov eax, dword [ecx]
call dword [eax + 0x104]
push 0x7be
push dword [esi + 0x7c8]
lea ecx, [esi + 0x30]
call fcn.0049a6fa
push 0x561fce
lea ecx, [esp + 0x30]
call fcn.0044ea5a
push 0x561fcf
lea ecx, [esp + 0x18]
mov dword [esp + 0x84], ebp
call fcn.0044ea5a
push str.downloader_error_pop
lea ecx, [esp + 0x48]
mov byte [esp + 0x84], 2
call fcn.0044ea5a
lea eax, [esp + 0x2c]
mov byte [esp + 0x80], 3
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.0045eea0
mov ecx, eax
call fcn.0045f2ce
push ebx
push ebp
lea ecx, [esp + 0x4c]
call fcn.0044ea87
push ebx
push ebp
lea ecx, [esp + 0x1c]
call fcn.0044ea87
push ebx
push ebp
lea ecx, [esp + 0x34]
call fcn.0044ea87
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.005026fe
add esp, 0x70
ret
Function at 0x47929a
Capabilities:
Delete file

Disassembly:
push 0x1c
mov eax, 0x5320ff
call fcn.0050791a
mov edi, ecx
mov dword [ebp - 0x14], edi
xor ebx, ebx
cmp dword [edi + 0x89c], ebx
jne 0x4792ce
mov dword [ebp - 4], ebx
mov ecx, dword [edi + 0x7f0]
mov eax, dword [ecx]
call dword [eax + 0x100]
test al, al
je 0x4792e9
or dword [ebp - 4], 0xffffffff
push 0x7be
push dword [edi + 0x7c8]
lea ecx, [edi + 0x30]
call fcn.0049a6fa
xor eax, eax
call fcn.0050787f
ret
cmp byte [edi + 0x1430], 0
jne 0x479383
mov ecx, dword [edi + 0x888]
push ebx
call fcn.004687bf
test al, al
je 0x479383
mov ecx, dword [edi + 0x888]
push 1
call fcn.004687bf
test al, al
je 0x479383
mov ecx, dword [edi + 0x888]
push 2
call fcn.004687bf
test al, al
je 0x479383
cmp dword [0x5952dc], 0
je 0x47934d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._INFO___d___WaeWnd_Install_success.
push 3
push dword [0x5952dc]
call fcn.00480395
add esp, 0x10
mov eax, dword [edi + 0x888]
cmp byte [eax + 0x719], 0
jne 0x479370
add eax, 0x640
cmp dword [eax + 0x14], 8
jb 0x479369
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push 0x8066
mov ecx, edi
call fcn.0049fa70
jmp 0x4792ca
cmp dword [edi + 0x89c], ebx
jne 0x479435
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea esi, [edi + 0x8cc]
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x8e8]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x24]
call fcn.0047c33b
lea ecx, [edi + 0x8e8]
mov eax, dword [ecx]
push esi
mov dword [ecx + 4], eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x24]
cmp dword [ebp - 0x20], esi
je 0x479412
cmp dword [0x5952dc], 0
je 0x479400
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._WARN___d___WaeWnd_Install__retry_down_task__task_id__d_
push 2
push dword [0x5952dc]
call fcn.00480395
add esp, 0x14
push dword [esi]
mov ecx, dword [edi + 0x888]
call fcn.00468699
add esi, 4
jmp 0x4793d4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x24], 0
je 0x479435
push dword [ebp - 0x24]
call fcn.004b49b2
pop ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
or dword [ebp - 4], 0xffffffff
jmp 0x4792ad