joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4123e0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x46a264]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
sub esp, 8
cmp dword [eax + 0x14], 0x10
mov edx, esp
jb 0x412404
mov ecx, dword [eax]
jmp 0x412406
mov ecx, eax
mov dword [edx], ecx
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
lea eax, [ebp - 0x38]
push eax
call fcn.0040a720
mov esi, eax
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x412424
mov esi, dword [esi]
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push dword [ebp + 0xc]
push eax
call fcn.0040a720
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x41243e
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
mov eax, dword [ebp - 0xc]
setne bl
cmp eax, 8
jb 0x412460
inc eax
lea ecx, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
call fcn.00402680
mov ecx, dword [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], 0
mov word [ebp - 0x20], ax
cmp ecx, 8
jb 0x412489
inc ecx
push ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
call fcn.00402680
mov ecx, dword [ebp - 8]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret 0xc

Function at 0x412820
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x46a264]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
xor eax, eax
mov dword [esp + 0x24], 7
push edi
mov edi, dword [ebp + 8]
lea ecx, [esp + 0x14]
xor bl, bl
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
call fcn.0040a080
test al, al
je 0x4128a8
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.00408590
cmp dword [esp + 0x3c], 0
je 0x412890
cmp dword [esp + 0x40], 8
lea eax, [esp + 0x2c]
cmovae eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov bl, 1
mov eax, dword [esp + 0x40]
cmp eax, 8
jb 0x4128a8
inc eax
lea ecx, [esp + 0x2c]
push eax
push dword [esp + 0x30]
call fcn.00402680
cmp dword [esi + 0x14], 8
jb 0x4128b0
mov esi, dword [esi]
push esi
call dword [esp + 0x14]
mov esi, eax
test esi, esi
jne 0x4128c7
test edi, edi
je 0x4128c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
test bl, bl
je 0x4128e0
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [esp + 0x28]
cmp eax, 8
jb 0x4128f8
inc eax
lea ecx, [esp + 0x14]
push eax
push dword [esp + 0x18]
call fcn.00402680
mov ecx, dword [esp + 0x44]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
Function at 0x4142d5
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0xa8]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
ret

Function at 0x414575
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x46a264]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x454bc0]
or dword [ebp - 8], 0xffffffff
push ebx
push esi
movups xmmword [ebp - 0x28], xmm0
mov ebx, ecx
mov dword [ebp - 0x2c], 9
movaps xmm0, xmmword [0x454bd0]
push edi
movups xmmword [ebp - 0x18], xmm0
lea edi, [ebp - 0x28]
jmp 0x4145b7
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [edi]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4145b0
add edi, 4
sub dword [ebp - 0x2c], 1
jne 0x4145b7
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
lea esi, [ebx + 0x44]
push 5
push dword [esi]
call edi
push 0x64
push 0
mov ecx, esi
call fcn.004154fb
push 0
push 0
push 0x402
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x3f5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret

Function at 0x414d64
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x46a264]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], 7
push esi
mov word [ebp - 0x1c], ax
mov esi, ecx
movzx eax, word [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0xc], edi
sub eax, 0x3fc
je 0x414da8
sub eax, 1
jne 0x414de6
push dword [esi + 0x24]
lea eax, [ebp - 0x34]
push eax
call fcn.00414238
jmp 0x414db4
push dword [esi + 0x24]
lea eax, [ebp - 0x34]
push eax
call fcn.0041aa08
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040e1d0
push edi
push 1
lea ecx, [ebp - 0x34]
call fcn.00401e60
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push 5
cmovae eax, dword [ebp - 0x1c]
push edi
push edi
push eax
push 0x454ba0
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esi + 0x88]
lea eax, [ebp - 0x1c]
push eax
call fcn.004190d9
push edi
push 1
lea ecx, [ebp - 0x1c]
call fcn.00401e60
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41651a
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46a264]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
call fcn.0041b2a1
test al, al
je 0x4165f4
push esi
mov esi, dword [0x46b604]
push edi
push 0x455b30
push dword [0x46a060]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4165f0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push esi
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4165f0
test esi, esi
je 0x4165f0
push 0
lea ecx, [ebp - 0x24]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x24], esi
jne 0x41659e
mov al, 1
jmp 0x4165f2
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0xc], 7
push str.Write_failed._Roll_back_write_operation.
mov word [ebp - 0x20], ax
mov byte [ebp - 8], al
call fcn.00412aa6
lea eax, [ebp - 0x20]
push eax
push eax
push 0x2f4
push str.Installer::ExtractBrowserSetupResource
push 1
call fcn.00424aa4
add esp, 0x14
lea ecx, [ebp - 0x20]
push 0
push 1
call fcn.00401e60
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret 4
Function at 0x416605
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20ec
call fcn.0042d2d0
mov eax, dword [0x46a264]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [eax + 0x10], 0
push edi
jne 0x416672
and dword [ebp - 0x209c], 0
xor eax, eax
push 7
pop edi
mov dword [ebp - 0x2098], edi
mov word [ebp - 0x20ac], ax
mov dword [esi + 0x14], edi
and dword [esi + 0x10], 0
xor eax, eax
mov word [esi], ax
push 0
push 1
lea ecx, [ebp - 0x20ac]
call fcn.00401e60
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x20b0], 0x824
jb 0x416684
mov eax, dword [eax]
push 0x2000000
lea ecx, [ebp - 0x20b0]
push ecx
lea ecx, [ebp - 0x104c]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
push 7
pop edi
test eax, eax
je 0x4166c8
cmp dword [ebp - 0x20b0], 0
je 0x4166c8
lea eax, [ebp - 0x104c]
push eax
lea ecx, [ebp - 0x20ac]
call fcn.00404750
mov ebx, dword [ebp - 0x209c]
jmp 0x4166df
xor ebx, ebx
mov dword [ebp - 0x2098], edi
xor eax, eax
mov dword [ebp - 0x209c], ebx
mov word [ebp - 0x20ac], ax
test ebx, ebx
je 0x416644
push 0x38
lea eax, [ebp - 0x20e8]
push 0
push eax
call fcn.004305d0
add esp, 0xc
mov dword [ebp - 0x20ec], 0x3c
cmp dword [ebp - 0x2098], 8
lea ecx, [ebp - 0x20ec]
lea eax, [ebp - 0x2094]
mov dword [ebp - 0x20d8], 0x824
mov dword [ebp - 0x20dc], eax
lea eax, [ebp - 0x20ac]
cmovae eax, dword [ebp - 0x20ac]
push ecx
push 0x10000000
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x416644
push dword [ebp - 0x20dc]
mov ecx, esi
call fcn.00404750
jmp 0x416650
Function at 0x417125
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x46a264]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x34]
mov esi, ecx
push edi
push eax
call fcn.00409540
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041ea72
add esp, 0xc
lea ecx, [esi + 0x68]
push eax
call fcn.0040e1d0
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00401e60
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00401eb0
mov ecx, dword [esi + 0x14]
call fcn.0041e756
call fcn.0041b2a1
mov ebx, str.ClidsFile
test al, al
jne 0x4171bb
lea eax, [esi + 0x38]
cmp dword [eax + 0x14], 8
jb 0x417192
mov eax, dword [eax]
push eax
push str.InstallerData
call fcn.00421a5b
lea eax, [esi + 0x50]
cmp dword [eax + 0x14], 8
pop ecx
pop ecx
jb 0x4171aa
mov eax, dword [eax]
push eax
push ebx
call fcn.00421a5b
pop ecx
pop ecx
mov ecx, dword [esi + 0x14]
call fcn.0041e7bf
mov ecx, esi
call fcn.004172a2
mov edi, eax
test edi, edi
je 0x4171d9
push edi
mov ecx, esi
call fcn.004164ea
call fcn.0041b2a1
test al, al
je 0x41723d
push str.InstallerData
call fcn.00421796
push ebx
call fcn.00421796
call fcn.0041fe31
push eax
call fcn.00421796
mov ecx, dword [esi + 0x14]
add esp, 0xc
call fcn.0041d362
mov eax, dword [esi + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [eax + 0xd8], 0
je 0x417221
add eax, 0xc8
cmp dword [eax + 0x14], 8
jb 0x41721e
mov eax, dword [eax]
push eax
call ebx
mov eax, dword [esi + 0x14]
cmp dword [eax + 0xf0], 0
je 0x41723d
add eax, 0xe0
cmp dword [eax + 0x14], 8
jb 0x41723a
mov eax, dword [eax]
push eax
call ebx
cmp dword [esi + 0x10], 0
je 0x41724a
mov ecx, esi
call fcn.00419300
test edi, edi
mov ecx, esi
sete al
movzx eax, al
push eax
call fcn.0041773c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret

Function at 0x41726b
Capabilities:
Create thread

Disassembly:
push edi
mov edi, ecx
push dword [edi + 0x88]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [edi + 0x8c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
push eax
push eax
push edi
push 0x4175c0
push eax
push eax
call fcn.004359dc
add esp, 0x18
mov dword [edi + 0x84], eax
pop edi
ret

Function at 0x4175a2
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0x88]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, esi
call fcn.00419127
mov ecx, esi
pop esi
jmp fcn.00417125
Function at 0x41a4ea
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x41a4fb
mov eax, dword [eax]
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41a53a
mov esi, dword [ebp + 8]
push eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x41a5ba
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea ecx, [ebp - 0x10]
push edi
call fcn.004036a0
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push edi
push dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x41a595
cmp edi, dword [ebp - 4]
jne 0x41a595
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xf]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00419370
lea ecx, [ebp - 0x10]
call fcn.00403810
test esi, esi
je 0x41a590
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
jmp 0x41a5b9
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.00403810
test esi, esi
je 0x41a5b7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a5c0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x46a264]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
xor eax, eax
cmp dword [edi + 0x28], eax
jne 0x41a6e7
push eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x4c], 4
push eax
push 0x20000013
push dword [edi + 0x5c]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x41a613
cmp dword [ebp - 0x48], 0xc8
jne 0x41a613
mov al, 1
jmp 0x41a6e9
push ebx
push esi
push 0xa
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x48]
call fcn.00432d69
add esp, 0xc
lea ecx, [ebp - 0x28]
push str.final_query_info_
call fcn.00401dc0
mov esi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.00401210
pop ecx
push eax
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00402130
mov ebx, 0x464e6c
mov esi, eax
push ebx
call fcn.00401210
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.00402130
cmp dword [eax + 0x14], 0x10
jb 0x41a66a
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0041a77a
pop ecx
pop ecx
push eax
lea ecx, [edi + 0x18]
call fcn.0040e1d0
xor ebx, ebx
lea ecx, [ebp - 0x44]
xor esi, esi
push ebx
inc esi
push esi
call fcn.00401e60
push ebx
push esi
lea ecx, [ebp - 0x28]
call fcn.00401eb0
xor eax, eax
mov dword [ebp - 0x18], 7
push str.Unsuccessful_download:
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
mov byte [ebp - 0x14], bl
call fcn.00412aa6
push 0xffffffffffffffff
push ebx
push edi
mov ecx, eax
call fcn.00403840
lea eax, [ebp - 0x2c]
push eax
push eax
push 0x2c9
push str.lite_installer::Downloader::FinalizeDownload
push esi
call fcn.00424aa4
add esp, 0x14
lea ecx, [ebp - 0x2c]
push ebx
push esi
call fcn.00401e60
pop esi
pop ebx
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret

Function at 0x41ac7e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
jne 0x41aca4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], edi
mov word [eax], cx
jmp 0x41ad1c
push 0x104
lea ecx, [ebp - 0xc]
call fcn.00403640
cmp dword [esi + 0x14], 8
jb 0x41acb9
mov esi, dword [esi]
push dword [ebp - 0xc]
push edi
push 0x455b84
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x41ace9
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov word [esi], ax
call fcn.004037e0
mov eax, esi
jmp 0x41ad1c
mov dword [ebp + 0xc], edi
lea eax, [ebp + 0xc]
push dword [ebp + 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.00419479
add esp, 0x10
lea ecx, [ebp + 0xf]
push ecx
mov ecx, dword [ebp + 8]
push eax
push dword [ebp - 0xc]
call fcn.0041939f
lea ecx, [ebp - 0xc]
call fcn.004037e0
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ade2
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov ecx, 0x41f
cmp eax, ecx
jg 0x41ae60
je 0x41ae59
sub eax, 0x404
cmp eax, 0x15
ja case.0x41ae0a.1030
movzx eax, byte [eax + 0x41aeea]
jmp dword [eax*4 + 0x41aec2]
push 0x455ba4
jmp 0x41aeb3
push 0x455bb4
jmp 0x41aeb3
push 0x455bbc
jmp 0x41aeb3
push 0x455bc0
jmp 0x41aeb3
push 0x455bc4
jmp 0x41aeb3
push str.pt_BR
jmp 0x41aeb3
push str.zh_TW
jmp 0x41aeb3
push 0x455bec
jmp 0x41aeb3
push 0x455bb0
jmp 0x41aeb3
push 0x455ba8
jmp 0x41aeb3
sub eax, 0x422
je 0x41aeae
sub eax, 0x1d
je 0x41aea7
sub eax, 0x3c5
je 0x41aea0
sub eax, 0x12
je 0x41ae99
sub eax, 0x3f4
je 0x41ae92
mov eax, dword [ebp + 8]
and dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
pop ebp
ret
push 0x455bb8
jmp 0x41aeb3
push str.pt_PT
jmp 0x41aeb3
push str.zh_CN
jmp 0x41aeb3
push 0x455be8
jmp 0x41aeb3
push 0x455bac
mov ecx, dword [ebp + 8]
call fcn.00401dc0
mov eax, dword [ebp + 8]
pop ebp
ret

Function at 0x41af43
Capabilities:
Get common file path
Get disk size
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x46a264]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004305d0
add esp, 0xc
lea eax, [ebp - 0x20c]
cmp byte [ebp + 8], bl
push eax
push ebx
push ebx
push 0x1c
pop eax
push 0x26
pop ecx
cmovne eax, ecx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x41afee
xor eax, eax
mov dword [ebp - 0x214], 7
push str.SHGetFolderPath_failed
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], ebx
mov word [ebp - 0x228], ax
mov byte [ebp - 0x210], bl
call fcn.00412aa6
lea eax, [ebp - 0x228]
push eax
push eax
push 0x30d
push str.lite_installer::HasEnoughDiskSpace
push ebx
call fcn.00424aa4
add esp, 0x14
lea ecx, [ebp - 0x228]
push ebx
push 1
call fcn.00401e60
mov al, 1
jmp 0x41b0b6
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x41b044
push str.GetDiskFreeSpaceEx_failed
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], ebx
mov word [ebp - 0x228], ax
mov byte [ebp - 0x210], bl
call fcn.00412aa6
lea eax, [ebp - 0x228]
push eax
push eax
push 0x313
jmp 0x41afcb
cmp dword [ebp - 0x22c], ebx
ja 0x41b0b2
cmp dword [ebp - 0x230], 0x19000000
jae 0x41b0b2
xor eax, eax
mov dword [ebp - 0x214], 7
push str.There_is_not_enough_disk_space_to_install_browser
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], ebx
mov word [ebp - 0x228], ax
mov byte [ebp - 0x210], bl
call fcn.00412aa6
lea eax, [ebp - 0x228]
push eax
push eax
push 0x319
push str.lite_installer::HasEnoughDiskSpace
push ebx
call fcn.00424aa4
add esp, 0x14
lea ecx, [ebp - 0x228]
push ebx
push 1
call fcn.00401e60
jmp 0x41b0b4
mov bl, 1
mov al, bl
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret
Function at 0x41b315
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [0x46b604]
push edi
push dword [ebp + 0x10]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
movzx eax, ax
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x41b36f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
test ecx, ecx
je 0x41b36f
xor eax, eax
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x41b369
cmp eax, edi
je 0x41b386
lea ecx, [ecx + edx*2]
inc eax
cmp eax, 0x10
jl 0x41b357
mov eax, dword [ebp + 8]
and dword [eax + 0x10], 0
xor ecx, ecx
mov dword [eax + 0x14], 7
mov word [eax], cx
pop edi
pop esi
pop ebp
ret
lea eax, [ebp + 0xf]
push eax
lea eax, [ecx + edx*2]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040ddc0
mov eax, dword [ebp + 8]
jmp 0x41b382
Function at 0x41b6e3
Capabilities:
Get http content length
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x46a264]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x28], ebx
je 0x41b705
xor eax, eax
jmp 0x41b82a
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push eax
push 0x8000
push dword [esi + 0x60]
push dword [esi + 0x5c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x41b78e
lea eax, [ebp - 0x1c]
push str.internet_read_
push eax
call fcn.0041a77a
pop ecx
pop ecx
push eax
lea ecx, [esi + 0x18]
call fcn.0040e1d0
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.00401e60
xor eax, eax
mov dword [ebp - 0xc], 7
push str.Download_chunk_error.
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
mov word [ebp - 0x20], ax
mov byte [ebp - 8], bl
call fcn.00412aa6
lea eax, [ebp - 0x20]
push eax
push eax
push 0x2a4
push str.lite_installer::Downloader::ReadChunk
push 1
call fcn.00424aa4
add esp, 0x14
lea ecx, [ebp - 0x20]
push ebx
push 1
call fcn.00401e60
jmp 0x41b6fe
cmp dword [ebp - 0x24], ebx
jbe 0x41b7f7
mov ecx, dword [esi + 0x4c]
push dword [ebp - 0x24]
push dword [esi + 0x60]
mov eax, dword [ecx]
call dword [eax]
test al, al
jne 0x41b7f7
lea eax, [ebp - 0x1c]
push str.write_file_
push eax
call fcn.0041a77a
pop ecx
pop ecx
push eax
lea ecx, [esi + 0x18]
call fcn.0040e1d0
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.00401e60
xor eax, eax
mov dword [ebp - 0xc], 7
push str.Write_file_error.
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
mov word [ebp - 0x20], ax
mov byte [ebp - 8], bl
call fcn.00412aa6
lea eax, [ebp - 0x20]
push eax
push eax
push 0x2ab
jmp 0x41b76f
cmp dword [esi + 0x48], ebx
jne 0x41b827
push ebx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], ebx
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], 4
push eax
push 0x20000005
push dword [esi + 0x5c]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x41b827
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x48], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret

Function at 0x41baf9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x41bb07
mov eax, dword [eax]
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41bb5b
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp + 8], ebx
cmp dword [eax + 0x14], 0x10
lea edi, [eax + 0x10]
jb 0x41bb3a
mov eax, dword [eax]
push ebx
lea ecx, [ebp + 8]
push ecx
push dword [edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41bb56
mov eax, dword [ebp + 8]
cmp eax, dword [edi]
jne 0x41bb56
mov bl, 1
pop edi
test esi, esi
je 0x41bb62
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
ret
Function at 0x41c817
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x46a264]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x46b190]
push ebx
xor ebx, ebx
push esi
test eax, eax
jne 0x41c8a6
push 0x206
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.004305d0
add esp, 0xc
mov esi, ebx
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [esi + 0x456190]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
ja 0x41c88e
push 8
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x46b190], eax
jmp 0x41c893
mov eax, dword [0x46b190]
test eax, eax
jne 0x41c8a6
add esi, 4
cmp esi, 0xc
jb 0x41c84e
mov eax, dword [0x46b18c]
jmp 0x41c8dd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
call esi
push str.FDIDestroy
push dword [0x46b190]
mov dword [0x46b184], eax
call esi
push str.FDICopy
push dword [0x46b190]
mov dword [0x46b188], eax
call esi
mov dword [0x46b18c], eax
cmp dword [0x46b184], ebx
je 0x41c8f4
cmp dword [0x46b188], ebx
je 0x41c8f4
test eax, eax
je 0x41c8f4
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d2b3
mov esp, ebp
pop ebp
ret