joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x5ac94d76
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0xd9b74ac
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x401000
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ebx
mov ebx, dword [eax + 4]
push esi
push edi
mov dword [ebp - 4], ecx
mov edx, 0
mov dword [ebp - 0x18], 0x58d84e99
add edi, eax
mov edx, 0
sub eax, eax
sub esi, eax
mov eax, dword [ebp - 0x18]
mov eax, ebx
and dword [ebp - 0x14], eax
xor dword [ebp - 0x13], eax
mov edx, 0x6c05
mov edx, dword [edx + 0x3fb463]
push 0x43ca
call edx
and dword [ebp - 0x97], eax
mov eax, 0xc6ef3720
sub edx, 0x6d
add edx, eax
add edi, eax
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov edx, ecx
shr edx, 5
mov esi, ecx
shl esi, 4
xor edx, esi
mov esi, eax
shr esi, 0xb
and esi, 3
add edx, dword [edi + esi*4]
mov esi, eax
xor esi, ecx
add edx, esi
sub ebx, edx
sub edx, 0xf7
mov esi, 0
add eax, 0x61c88647
sub esi, eax
add esi, eax
sub edx, eax
mov edx, ebx
shr edx, 5
mov esi, ebx
shl esi, 4
xor edx, esi
mov esi, eax
and esi, 3
add edx, dword [edi + esi*4]
mov esi, eax
xor esi, ebx
add edx, esi
sub ecx, edx
test eax, eax
mov dword [ebp - 4], ecx
jne 0x40105d
mov ecx, 0x665f
mov ecx, dword [ecx + 0x3fba29]
push 0x4cba
call ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax + 4], ebx
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44aa80
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
xor bl, bl
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x44aa9d
mov eax, dword [esi]
test eax, eax
je 0x44abc1
cmp word [eax], 0
je 0x44abc1
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44abc1
test al, 0x10
jne 0x44abc1
cmp dword [esi + 0x14], 8
jb 0x44aacf
mov esi, dword [esi]
push 0x462388
push esi
call fcn.00421673
mov esi, eax
add esp, 8
test esi, esi
je 0x44abc1
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [esp + 0x18], xmm0
call fcn.00428ceb
push 2
push 0
push esi
call fcn.0042836c
lea eax, [esp + 0x24]
push eax
push esi
call fcn.00428ceb
lea eax, [esp + 0x34]
push eax
push esi
call fcn.00429222
add esp, 0x24
cmp dword [esp + 0x10], 0x28
jbe 0x44abb8
xor eax, eax
mov dword [esp + 0x20], 0x48535844
push esi
push 1
mov word [esp + 0x40], ax
xorps xmm0, xmm0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x28]
push 0x28
push eax
mov dword [esp + 0x34], 0x28
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
movsd qword [esp + 0x40], xmm0
call fcn.00427955
add esp, 0x10
test eax, eax
je 0x44abb8
mov eax, dword [esp + 0x2c]
not eax
ror eax, 3
cmp eax, dword [esp + 0xc]
jne 0x44abb8
cmp dword [esp + 0x20], 0x48535844
jne 0x44abb8
cmp dword [esp + 0x24], 0x28
jne 0x44abb8
movzx ecx, word [esp + 0x38]
add ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
add ecx, dword [esp + 0x40]
add eax, 0x28
add eax, ecx
cmp eax, dword [esp + 0x10]
sete bl
push esi
call fcn.00421ab1
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x23150a75
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x1b401c2a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x403250
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x45ec74]
push ebx
xor ebx, ebx
push esi
test eax, eax
jne 0x4032df
push 0x206
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.0042b810
add esp, 0xc
mov esi, ebx
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [esi + 0x453d2c]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
ja 0x4032c7
push 8
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x45ec74], eax
jmp 0x4032cc
mov eax, dword [0x45ec74]
test eax, eax
jne 0x4032df
add esi, 4
cmp esi, 0xc
jb 0x403287
mov eax, dword [0x45ec80]
jmp 0x40331c
push str.FDICreate
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDIDestroy
push dword [0x45ec74]
mov dword [0x45ec78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICopy
push dword [0x45ec74]
mov dword [0x45ec7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45ec80], eax
cmp dword [0x45ec78], ebx
je 0x403332
cmp dword [0x45ec7c], ebx
je 0x403332
test eax, eax
je 0x403332
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00429462
mov esp, ebp
pop ebp
ret

Function at 0x404004
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
push esi
push 0x4040a0
push ebx
push ebx
call fcn.0043248e
add esp, 0x18
mov ecx, esi
push eax
call fcn.004042fe
cmp dword [esi], ebx
je 0x404041
cmp dword [esi], 0xffffffff
je 0x404041
mov al, 1
jmp 0x404081
xor eax, eax
mov dword [ebp - 0x10], ebx
push str.Failed_to_create_thread_for_async_http_requests
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], 7
mov word [ebp - 0x20], ax
mov byte [ebp - 8], bl
call fcn.004011fd
lea eax, [ebp - 0x20]
push eax
push eax
push 0x5b
push str.install_util::AsyncHttpRequestSender::TaskRunner::InitializeThread
push 1
call fcn.00415c43
add esp, 0x14
lea ecx, [ebp - 0x20]
call fcn.00402561
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00429462
mov esp, ebp
pop ebp
ret
Function at 0x406fab
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20f4
call fcn.0042a440
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edx + 0x10], 0
push ebx
push esi
push edi
mov esi, ecx
jne 0x407010
and dword [ebp - 0x20a0], 0
xor eax, eax
push 7
pop edi
mov dword [ebp - 0x209c], edi
mov word [ebp - 0x20b0], ax
and dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], edi
mov word [esi], ax
lea ecx, [ebp - 0x20b0]
call fcn.00402561
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429462
mov esp, ebp
pop ebp
ret
cmp dword [edx + 0x14], 8
mov dword [ebp - 0x20b4], 0x824
jb 0x407022
mov edx, dword [edx]
push 0x2000000
lea eax, [ebp - 0x20b4]
push eax
lea eax, [ebp - 0x1050]
push eax
push edx
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
test eax, eax
je 0x40707c
cmp dword [ebp - 0x20b4], 0
je 0x40707c
and dword [ebp - 0x20a0], 0
lea ecx, [ebp - 0x20b0]
xor eax, eax
push 7
pop edi
mov word [ebp - 0x20b0], ax
lea eax, [ebp - 0x1050]
push eax
mov dword [ebp - 0x209c], edi
call fcn.00406a3a
mov ebx, dword [ebp - 0x20a0]
jmp 0x407096
xor ebx, ebx
xor eax, eax
push 7
pop edi
mov dword [ebp - 0x20a0], ebx
mov dword [ebp - 0x209c], edi
mov word [ebp - 0x20b0], ax
test ebx, ebx
je 0x406fe6
push 0x38
lea eax, [ebp - 0x20ec]
push 0
push eax
call fcn.0042b810
add esp, 0xc
mov dword [ebp - 0x20f0], 0x3c
cmp dword [ebp - 0x209c], 8
lea ecx, [ebp - 0x20f0]
lea eax, [ebp - 0x2098]
mov dword [ebp - 0x20dc], 0x824
mov dword [ebp - 0x20e0], eax
lea eax, [ebp - 0x20b0]
cmovae eax, dword [ebp - 0x20b0]
push ecx
push 0x10000000
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x406fe6
push dword [ebp - 0x20e0]
mov ecx, esi
call fcn.00406a15
jmp 0x406ff2
Function at 0x408725
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x45d06c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.00409c9d
sub esp, 0x18
mov ecx, esp
call fcn.00422b00
lea ecx, [esp + 0x3c]
call fcn.00422d51
add esp, 0x18
lea edx, [esp + 0x24]
lea ecx, [esp + 0xc]
call fcn.00407156
push eax
lea ecx, [esi + 0x80]
call fcn.00405cf2
lea ecx, [esp + 0xc]
call fcn.00402561
lea ecx, [esp + 0x24]
call fcn.004025ed
mov ecx, dword [esi + 0x14]
add ecx, 0x4c
mov edx, ecx
cmp dword [ecx + 0x14], 0x10
jb 0x408794
mov edx, dword [ecx]
mov eax, dword [ecx + 0x10]
add eax, edx
cmp dword [ecx + 0x14], 0x10
jb 0x4087a1
mov ecx, dword [ecx]
push ecx
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.00405e2e
push 8
pop ebx
cmp dword [eax + 0x14], ebx
jb 0x4087b7
mov eax, dword [eax]
mov edx, eax
mov ecx, str.lang
call fcn.0041f368
lea ecx, [esp + 0xc]
call fcn.00402561
lea eax, [esi + 0x20]
mov ecx, esi
push eax
call fcn.00407216
lea edx, [esi + 0x38]
cmp dword [edx + 0x14], ebx
jb 0x4087e1
mov edx, dword [edx]
mov ecx, str.InstallerData
call fcn.0041f368
lea edx, [esi + 0x50]
cmp dword [edx + 0x14], ebx
jb 0x4087f5
mov edx, dword [edx]
mov edi, str.ClidsFile
mov ecx, edi
call fcn.0041f368
lea edx, [esi + 0x68]
cmp dword [edx + 0x14], ebx
jb 0x40880b
mov edx, dword [edx]
mov ecx, str.ClidsSearchbandFile
call fcn.0041f368
mov ecx, dword [esi + 0x14]
call fcn.00405068
mov ecx, esi
call fcn.00408c28
mov ebx, eax
test ebx, ebx
je 0x408854
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x4088ca
push edi
push dword [esi + 0xa0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4088be
mov ecx, dword [esi + 0x10]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x4088be
mov ecx, str.InstallerData
call fcn.0041f533
mov ecx, edi
call fcn.0041f533
mov ecx, str.ClidsSearchbandFile
call fcn.0041f533
mov ecx, 0x45444c
call fcn.0041f533
call fcn.00405104
mov eax, dword [esi + 0x14]
xor edi, edi
cmp dword [eax + 0xc0], edi
je 0x40889f
add eax, 0xb0
cmp dword [eax + 0x14], 8
jb 0x408898
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0x14]
cmp dword [eax + 0xd8], edi
je 0x4088be
add eax, 0xc8
cmp dword [eax + 0x14], 8
jb 0x4088b7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x10], edi
je 0x4088ca
mov ecx, esi
call fcn.004099f4
test ebx, ebx
mov ecx, esi
sete al
movzx eax, al
push eax
call fcn.00408096
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00429462
mov esp, ebp
pop ebp
ret
Function at 0x40a66f
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
mov dword [esi], 0x45980c
jne 0x40a684
pop esi
jmp fcn.0040a859
cmp byte [esi + 0x14], 0
jne 0x40a693
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, esi
pop esi
jmp fcn.0040a6c0

Function at 0x40a6c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push 0x7530
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40a739
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x20]
xor eax, eax
mov byte [esi + 0x15], 1
push str.The_elevated_installer_hangs_and_must_be_forcibly_terminated.
mov dword [ebp - 0xc], 7
mov word [ebp - 0x20], ax
mov byte [ebp - 8], al
call fcn.004011fd
lea eax, [ebp - 0x20]
push eax
push eax
push 0x526
push str.Installer::ElevatedProcessHolder::EnsureProcessFinished
push 1
call fcn.00415c43
add esp, 0x14
lea ecx, [ebp - 0x20]
call fcn.00402561
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, esi
call fcn.0040a859
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00429462
mov esp, ebp
pop ebp
ret
Function at 0x40c0c9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
push edi
mov eax, esi
mov edi, ecx
and eax, 0xf
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push dword [ebp + 8]
shr esi, 4
mov ebx, eax
inc esi
movzx ecx, si
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x40c130
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
test ecx, ecx
je 0x40c130
mov esi, dword [ebp - 4]
xor eax, eax
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x40c12a
cmp eax, esi
je 0x40c149
lea ecx, [ecx + edx*2]
inc eax
cmp eax, 0x10
jl 0x40c118
and dword [edi + 0x10], 0
xor eax, eax
mov dword [edi + 0x14], 7
mov word [edi], ax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
lea eax, [ecx + edx*2]
push eax
push ecx
mov ecx, edi
call fcn.0040df34
jmp 0x40c140

Function at 0x40c158
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x455248
mov ebx, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
test eax, eax
je 0x40c1c1
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40c1c1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 4]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
and dword [edi + 0x10], 0
add eax, esi
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
cmp esi, eax
je 0x40c1cf
sub eax, esi
mov ecx, edi
push eax
push esi
call fcn.00402637
jmp 0x40c1cf
and dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c394
Capabilities:
Identify system language via api

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov ecx, 0x41f
cmp eax, ecx
ja 0x40c42d
je 0x40c424
sub eax, 0x404
cmp eax, 0x15
ja case.0x40c3c0.1030
movzx eax, byte [eax + 0x40c4b8]
jmp dword [eax*4 + 0x40c490]
push 2
push 0x455610
jmp 0x40c477
push 2
push 0x4554f4
jmp 0x40c477
push 2
push 0x4554dc
jmp 0x40c477
push 2
push 0x455550
jmp 0x40c477
push 2
push 0x455624
jmp 0x40c477
push 5
push str.pt_BR
jmp 0x40c477
push 5
push str.zh_TW
jmp 0x40c477
push 2
push 0x455500
jmp 0x40c477
push 2
push 0x455510
jmp 0x40c477
push 2
push 0x455614
jmp 0x40c477
sub eax, 0x422
je 0x40c470
sub eax, 0x1d
je 0x40c467
sub eax, 0x3c5
je 0x40c45e
sub eax, 0x12
je 0x40c455
sub eax, 0x3f4
jne case.0x40c3c0.1030
push 2
push 0x4554e0
jmp 0x40c477
push 5
push str.pt_PT
jmp 0x40c477
push 5
push str.zh_CN
jmp 0x40c477
push 2
push 0x455618
jmp 0x40c477
push 2
push 0x455528
and dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.00402637
mov eax, esi
pop esi
ret
Function at 0x40c7d1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ecx + 0x14], 8
push ebx
push esi
push edi
mov edi, edx
jb 0x40c7e3
mov ecx, dword [ecx]
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40c836
cmp dword [edi + 0x14], 0x10
lea eax, [edi + 0x10]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], eax
jb 0x40c813
mov edi, dword [edi]
push ebx
lea ecx, [ebp - 4]
push ecx
push dword [eax]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c832
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, dword [ecx]
jne 0x40c832
mov bl, 1
test esi, esi
je 0x40c83d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c846
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [edx + 0x14], 8
push ebx
push esi
push edi
mov edi, ecx
jb 0x40c859
mov edx, dword [edx]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c88b
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], 0xf
mov byte [edi], bl
push eax
jmp 0x40c90f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ecx
push ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 8], ebx
call fcn.0040d649
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push ebx
mov ebx, dword [ebp - 0x14]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x40c8e7
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jne 0x40c8e7
and dword [edi + 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
cmp ebx, eax
je 0x40c8f5
sub eax, ebx
mov ecx, edi
push eax
push ebx
call fcn.00402637
jmp 0x40c8f5
and dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
test ebx, ebx
je 0x40c90a
mov eax, dword [ebp - 0xc]
push 1
sub eax, ebx
push eax
push ebx
call fcn.0040113b
add esp, 0xc
test esi, esi
je 0x40c915
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cef5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
push esi
push edi
mov edi, edx
mov esi, ecx
cmp dword [edi + 0x10], eax
jne 0x40cf17
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x40cf7d
push ecx
push 0x104
lea ecx, [ebp - 0xc]
call fcn.0040d69a
cmp dword [edi + 0x14], 8
jb 0x40cf2d
mov edi, dword [edi]
push ebx
mov ebx, dword [ebp - 0xc]
xor eax, eax
push ebx
push eax
push 0x4554e4
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40cf54
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x40cf74
mov eax, ebx
cmp ebx, dword [ebp - 8]
je 0x40cf6a
xor ecx, ecx
cmp word [eax], cx
je 0x40cf6a
add eax, 2
cmp eax, dword [ebp - 8]
jne 0x40cf5d
push ecx
push eax
push ebx
mov ecx, esi
call fcn.0040df34
lea ecx, [ebp - 0xc]
call fcn.0040dbce
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ece6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movsd xmm0, qword [0x459220]
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
push str.yandex.lite.set_import_progress
mov dword [ebx + 4], ecx
lea edi, [ebx + 0xc]
mov dword [ebx + 8], ecx
mov dword [edi], 0x459760
mov dword [ebx + 0x10], eax
mov dword [ebx], 0x459870
mov dword [edi], 0x459834
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x24], ecx
mov dword [ebx + 0x28], ecx
mov dword [ebx + 0x2c], ecx
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x3c], ecx
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x38], 0x4599e8
mov byte [ebx + 0x48], 1
mov byte [ebx + 0x50], cl
mov dword [ebx + 0x60], ecx
mov dword [ebx + 0x64], ecx
mov dword [ebx + 0x70], ecx
mov dword [ebx + 0x74], ecx
mov dword [ebx + 0x80], ecx
mov dword [ebx + 0x88], ecx
mov dword [ebx + 0x8c], ecx
mov dword [ebx + 0x98], ecx
mov dword [ebx + 0x9c], ecx
mov dword [ebx + 0xa8], ecx
mov dword [ebx + 0xac], ecx
mov dword [ebx + 0xb0], ecx
mov dword [ebx + 0xb4], ecx
mov dword [ebx + 0xb8], ecx
movsd qword [ebx + 0x68], xmm0
mov dword [ebx + 0xbc], ecx
movsd qword [ebx + 0x78], xmm0
mov dword [ebx + 0xc0], ecx
movsd qword [ebx + 0x90], xmm0
mov dword [ebx + 0xc4], ecx
movsd qword [ebx + 0xa0], xmm0
mov dword [ebx + 0xc8], ecx
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.yandex.lite.close_window
mov dword [ebx + 0xcc], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.yandex.lite.set_install_progress
mov dword [ebx + 0xd0], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.yandex.higher_version_exist
mov dword [ebx + 0xd4], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
movsd xmm0, qword [0x459220]
lea esi, [ebx + 0x108]
mov dword [ebx + 0xd8], eax
mov ecx, esi
xor eax, eax
mov dword [ebx + 0xdc], eax
mov word [ebx + 0xe0], ax
mov dword [ebx + 0xe4], eax
mov byte [ebx + 0xe8], al
mov dword [ebx + 0xf0], eax
mov dword [ebx + 0xf4], eax
movsd qword [ebx + 0xf8], xmm0
mov eax, dword [ebx + 0x10]
push dword [eax + 0x64]
call fcn.004125b6
push 0x140
mov dword [esi], 0x45997c
mov dword [esi + 0x20], 1
call fcn.004296cc
pop ecx
push dword [ebx + 0x14]
mov ecx, eax
push dword [ebx + 0x10]
push edi
call fcn.004072c1
mov ecx, dword [ebx + 0x80]
mov dword [ebx + 0x80], eax
test ecx, ecx
je 0x40ee8f
mov eax, dword [ecx]
push 1
call dword [eax]
mov esi, dword [ebx + 0x80]
push dword [esi + 0xa0]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [esi + 0xa4]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
push eax
push eax
push esi
push 0x407b80
push eax
push eax
call fcn.0043248e
add esp, 0x18
mov dword [esi + 0x9c], eax
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc