joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417be0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov ebp, edx
push esi
push ebx
mov esi, eax
sub esp, 0x5c
lea eax, [esp + 0x2c]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll__fstat
test eax, eax
jne 0x417c50
mov edi, dword [esp + 0x40]
test edi, edi
js 0x417c50
mov dword [esp], edi
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x417c50
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll__read
cmp eax, edi
mov dword [esp + 0x1c], eax
jne 0x417c70
mov dword [esp], esi
call sub.msvcrt.dll__close
test ebp, ebp
je 0x417c90
mov edx, dword [esp + 0x1c]
mov eax, ebx
mov dword [ebp], edx
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov edi, dword [eax]
mov dword [esp], esi
call sub.msvcrt.dll__close
call sub.msvcrt.dll__errno
mov dword [eax], edi
add esp, 0x5c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov edi, dword [eax]
mov dword [esp], esi
call sub.msvcrt.dll__close
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x417c5f
mov eax, ebx
jmp 0x417c42

Function at 0x417ca0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, edx
sub esp, 0x18
mov dword [esp + 4], 0x8000
mov dword [esp], eax
call sub.msvcrt.dll__open
test eax, eax
js 0x417cc5
add esp, 0x18
mov edx, ebx
pop ebx
jmp fcn.00417be0
add esp, 0x18
xor eax, eax
pop ebx
ret
Function at 0x418390
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov edi, str.boot
push ebx
mov ecx, 5
sub esp, 0x1a0
mov esi, dword [esp + 0x1b0]
mov ebx, dword [esp + 0x1b4]
repe cmpsb byte [esi], byte es:[edi]
je 0x418422
mov esi, dword [esp + 0x1b0]
mov edi, str.recovery
mov ecx, 9
repe cmpsb byte [esi], byte es:[edi]
jne 0x418490
test ebx, ebx
mov esi, str.recovery.img
jne 0x41842b
mov dword [esp], str.ANDROID_PRODUCT_OUT
call sub.msvcrt.dll_getenv
test eax, eax
je 0x418570
cmp byte [eax], 0
je 0x418570
lea ebx, [esp + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s
mov dword [esp], ebx
call fcn.00417b90
mov dword [esp], ebx
call sub.msvcrt.dll__strdup
add esp, 0x1a0
pop ebx
pop esi
pop edi
ret
mov esi, str.boot.img
test ebx, ebx
je 0x4183d7
lea edi, [esp + 0x1c]
mov dword [esp], edi
call fcn.0041a800
mov edx, edi
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x418439
test eax, 0x8080
je 0x418544
add al, al
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
sbb edx, 3
mov dword [esp + 4], str..._.._.._target_product__s__s
mov dword [esp], edx
call fcn.00417b90
mov dword [esp], edi
call sub.msvcrt.dll__strdup
add esp, 0x1a0
pop ebx
pop esi
pop edi
ret
mov esi, dword [esp + 0x1b0]
mov edi, str.system
mov ecx, 7
repe cmpsb byte [esi], byte es:[edi]
je 0x418550
mov esi, dword [esp + 0x1b0]
mov edi, 0x42c638
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x418560
mov esi, dword [esp + 0x1b0]
mov edi, str.userdata
mov ecx, 9
repe cmpsb byte [esi], byte es:[edi]
je 0x418583
mov esi, dword [esp + 0x1b0]
mov edi, str.cache
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
je 0x418590
mov esi, dword [esp + 0x1b0]
mov edi, str.info
mov ecx, 5
repe cmpsb byte [esi], byte es:[edi]
mov esi, str.android_info.txt
seta dl
setb al
cmp dl, al
je 0x418427
mov eax, dword [esp + 0x1b0]
mov dword [esp + 4], str.unknown_partition__s_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00417b60
xor eax, eax
jmp 0x41847f
shr eax, 0x10
add edx, 2
jmp 0x41845a
mov esi, str.system.img
jmp 0x418427
mov esi, str.tos.img
jmp 0x418427
mov dword [esp], str.neither__p_product_specified_nor_ANDROID_PRODUCT_OUT_set
call fcn.0041a070
xor eax, eax
jmp 0x41847f
mov esi, str.userdata.img
jmp 0x418427
mov esi, str.cache.img
jmp 0x418427
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40288e
pop dword [ebp - 0x30]
mov eax, 0xb2de73d1
add eax, 0x4d61b4bd
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xc92b0db
add dword [ebp - 0x40], 0x41bf9470
mov dword [ebp - 0x3c], 0xd27b38a8
add dword [ebp - 0x3c], 0x5fb8139d
mov dword [ebp - 0x38], 0x8852d635
sub dword [ebp - 0x38], 0x3c069207
mov dword [ebp - 0x34], 0xe91262dc
sub dword [ebp - 0x34], 0xe91262dc
lea eax, [ebp - 0x40]
push eax
mov eax, 0x749c8580
sub eax, 0x745c151c
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x2204795e
add dword [ebp - 0x40], 0x526deff8
mov dword [ebp - 0x3c], 0xf4ee515a
sub dword [ebp - 0x3c], 0xb381efe5
mov dword [ebp - 0x38], 0x1abf4d51
sub dword [ebp - 0x38], 0xb74fe0e5
mov dword [ebp - 0x34], 0x57772b7a
add dword [ebp - 0x34], 0xa888d486
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x614ef9f4
sub eax, 0x610e894c
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x33a8a
push 0
call eax
mov ecx, 0x3c40
xor edx, edx
add edx, eax
mov ebx, 0x2f2c7153
sub ebx, 0x2eeb7153
add ebx, dword [ebp - 0x30]
mov esi, 0x2cd46ac0
add esi, 0x944261ec
sub dword [ebp - 0x10], 0xee0d07c8
mov edi, dword [ebx]
mov dword [ebp - 0x1c], 0x3f1ead51
xor edi, esi
add dword [ebp - 0x14], esi
mov dword [edx], edi
add edx, 0x649e0747
sub edx, 0x649e0743
add ebx, 0x8865a4e8
add ebx, 0x779a5b1c
loop 0x4029ac
add eax, 0x942f819f
sub eax, 0x942e9dcc
xor ebx, ebx
add ebx, eax
add eax, 0x6372d462
sub eax, 0x6372d45d
mov ecx, 0x3a715510
add ecx, 0xc5ceaaf0
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x7e5008], 0x8088405
inc edx
mov dword [ebx + 0x7e5008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f05c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x7c954a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ab
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
jmp 0x41f0ca
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f13c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f125
test esi, esi
jbe 0x41f13c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f117
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f13c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0f4
jmp 0x41f13c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f13c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c9551
ret
Function at 0x420294
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x7ca8af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202cf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202e8
lea eax, [ebp - 0x10]
mov edx, dword [0x7e7348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202fb
lea eax, [ebp - 0x10]
mov edx, dword [0x7e7348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x420307
adc edx, 0
mov edx, dword [edx*4 + 0x7e6178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420481
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420474
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420474
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420412
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420412
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420412
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420412
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420474
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420474
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420499
inc ebx
cmp ebx, 0x19
jne 0x4202c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7ca8b6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x4062e5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40b508
cmp edx, dword [eax]
je 0x406307
add eax, 8
inc ecx
cmp eax, 0x40b598
jl 0x4062f8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40b508]
jne 0x406435
mov eax, dword [0x40ba54]
cmp eax, 1
je 0x40640f
test eax, eax
jne 0x406338
cmp dword [0x40b1b4], 1
je 0x40640f
cmp edx, 0xfc
je 0x406435
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40636f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004037b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004038a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4063b2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004038a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40957c
push edi
call fcn.004077b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004037b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004037c0
lea eax, [ebp - 0xa0]
push 0x40955c
push eax
call fcn.004037c0
push dword [esi + 0x40b50c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004037c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00407726
add esp, 0x2c
pop edi
jmp 0x406435
lea eax, [ebp + 8]
lea esi, [esi + 0x40b50c]
push 0
push eax
push dword [esi]
call fcn.004038a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x1000bcb1
Capabilities:
Delete directory

Disassembly:
push 0xc0
mov eax, 0x100450f2
call fcn.1002b17c
mov dword [ebp - 4], 1
call fcn.1001a60e
mov edi, str.CleanUp
test eax, eax
je 0x1000bd09
push 0x5a
push edi
call fcn.1001a60e
push eax
mov ecx, 0x10049808
lea ebx, [ebp - 0xa0]
call fcn.1001ac41
mov ecx, eax
mov eax, 0x10049800
mov byte [ebp - 4], 2
call fcn.1001ab2c
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.1001a66c
sub esp, 0x1c
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x74], esp
push eax
call fcn.10001c43
lea ebx, [ebp - 0x50]
call fcn.10019afe
lea eax, [ebp - 0x6c]
push eax
mov eax, ebx
push eax
mov byte [ebp - 4], 3
call fcn.10010bd6
mov esi, ebx
mov byte [ebp - 4], 4
call fcn.10012a29
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x74], esp
push str._RSS
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.10004854
sub esp, 0x10
mov byte [ebp - 4], 5
lea eax, [ebp + 0x24]
mov ecx, esp
mov dword [ebp - 0x70], esp
push eax
call fcn.10001c43
mov byte [ebp - 4], 4
call fcn.1000bb0e
add esp, 0x1c
mov eax, esp
mov dword [ebp - 0x70], esp
push str._Distr
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.10004854
sub esp, 0x10
mov byte [ebp - 4], 6
lea eax, [ebp - 0x6c]
mov ecx, esp
mov dword [ebp - 0x74], esp
push eax
call fcn.10001c43
mov byte [ebp - 4], 4
call fcn.1000bb0e
add esp, 0x38
push str.dlgs
sub esp, 0x1c
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x70], esp
push eax
call fcn.10001c43
lea eax, [ebp - 0x90]
push eax
call fcn.1002042a
add esp, 0x20
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 7
call fcn.100088e8
add esp, 0xc
xor ebx, ebx
push ebx
mov byte [ebp - 4], 9
push 1
lea esi, [ebp - 0x90]
call fcn.10002d0f
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x70], esp
push 0x1004a4b8
lea ecx, [ebp - 0x2c]
push ecx
push eax
call fcn.100088e8
add esp, 0xc
call fcn.1002077a
mov eax, dword [ebp - 0x28]
add esp, 0x1c
cmp dword [ebp - 0x14], 8
jae 0x1000be22
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1000be76
call fcn.1001a60e
test eax, eax
je 0x1000be76
push 0x66
push edi
call fcn.1001a60e
push eax
mov ecx, 0x10049924
lea ebx, [ebp - 0xcc]
call fcn.1001ac41
xor edi, edi
inc edi
mov esi, eax
mov byte [ebp - 4], 0xa
call fcn.1001aa80
mov ecx, eax
mov eax, str.RemoveDirectory
call fcn.1001ab2c
mov ecx, ebx
mov byte [ebp - 4], 9
call fcn.1001a66c
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp - 0x2c]
call fcn.10002d0f
push ebx
push edi
lea ecx, [ebp - 0x6c]
call fcn.10002b97
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.1000fc43
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.10002b97
push ebx
push edi
lea ecx, [ebp + 0x24]
call fcn.10002b97
call fcn.1002b1ff
ret
Function at 0x10011447
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1004242e
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x100572c0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x54]
mov eax, dword [eax]
mov ecx, dword [ebx + 0x40]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x54]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x40]
lea edi, [esp + 0x18]
lea esi, [esp + 0x10]
mov dword [esp + 0x18], eax
call fcn.1001364f
xor edi, edi
inc edi
test al, al
je 0x100114d7
call fcn.100135f5
mov esi, dword [eax]
push str._xml
add esi, 0x60
call fcn.1000489a
pop ecx
lea esi, [esp + 0x10]
test al, al
jne 0x100114cc
call fcn.10013620
jmp 0x10011486
call fcn.100135f5
mov esi, dword [eax]
test esi, esi
jne 0x1001150d
push str._xml
lea ecx, [esp + 0x24]
call fcn.10001c21
and dword [esp + 0x80], 0
lea eax, [esp + 0x20]
push eax
call fcn.10011663
or dword [esp + 0x80], 0xffffffff
push 0
push edi
lea ecx, [esp + 0x28]
mov esi, eax
call fcn.10002b97
push str.version
lea ecx, [esp + 0x40]
call fcn.10001c21
lea eax, [esp + 0x3c]
lea ebx, [esi + 4]
push eax
mov dword [esp + 0x84], edi
call fcn.1000ed9d
push 0x1004ada8
mov ecx, eax
call fcn.100029e3
or dword [esp + 0x80], 0xffffffff
push 0
push edi
lea ecx, [esp + 0x44]
call fcn.10002b97
push str.encoding
lea ecx, [esp + 0x5c]
call fcn.10001c21
mov eax, dword [ebp + 8]
mov dword [esp + 0x80], 2
mov eax, dword [eax + 0xa0]
mov ecx, 0x100497c0
cmp eax, dword [ecx]
je 0x100115bd
add ecx, 8
cmp ecx, 0x100497d0
jne 0x10011576
mov esi, 0x10049800
lea eax, [esp + 0x58]
push eax
call fcn.1000ed9d
push esi
mov ecx, eax
call fcn.100029e3
push 0
push edi
lea ecx, [esp + 0x60]
call fcn.10002b97
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ecx + 4]
jmp 0x1001158a
Function at 0x1001af0e
Capabilities:
Create directory

Disassembly:
push 0x4c
mov eax, 0x100431f1
call fcn.1002b17c
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x30], esi
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
cmp dword [edi + 0x2c], esi
je 0x1001af41
push esi
push ebx
lea esi, [ebp + 8]
call fcn.10002d0f
push 0
push ebx
jmp 0x1001b078
lea eax, [edi + 0x34]
push eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0x38], esi
je 0x1001af58
lea eax, [ebp + 0x24]
jmp 0x1001af7c
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x30], esp
push str.YandexUpdater
call fcn.10002136
lea ecx, [ebp - 0x58]
call fcn.10020590
add esp, 0x1c
mov byte [ebp - 4], 2
mov dword [ebp - 0x30], ebx
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x34], esp
push eax
call fcn.10002160
lea ebx, [ebp - 0x2c]
call fcn.100211c9
add esp, 0x1c
push 0xffffffffffffffff
add edi, 0x18
push 0
mov ecx, edi
mov dword [ebp - 4], 3
call fcn.10002c83
xor ebx, ebx
push 0
inc ebx
push ebx
lea esi, [ebp - 0x2c]
call fcn.10002d0f
mov dword [ebp - 4], ebx
test byte [ebp - 0x30], bl
je 0x1001afcb
push 0
push ebx
lea esi, [ebp - 0x58]
call fcn.10002d0f
push 0
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x34], esp
push edi
call fcn.10002160
lea ebx, [ebp - 0x58]
call fcn.10021259
add esp, 0x1c
cmp dword [eax + 0x18], 8
jb 0x1001aff1
mov eax, dword [eax + 4]
jmp 0x1001aff4
add eax, 4
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push ebx
push 1
lea esi, [ebp - 0x58]
call fcn.10002d0f
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 8]
mov ecx, edi
call fcn.10004de3
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x34], esp
push edi
call fcn.10002160
call fcn.10020d6c
add esp, 0x1c
cmp edx, ebx
ja 0x1001b037
cmp eax, 0x100000
jbe 0x1001b057
push edi
lea esi, [ebp - 0x2c]
call fcn.10002160
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.10020baa
push ebx
push 1
mov byte [ebp - 4], 1
call fcn.10002d0f
mov edi, dword [ebp - 0x3c]
call fcn.1001adb6
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 1
lea esi, [ebp + 8]
call fcn.10002d0f
push 0
push 1
lea esi, [ebp + 0x24]
call fcn.10002d0f
call fcn.1002b1ff
ret 0x38