joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54ec30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b864f
mov eax, dword fs:[0]
push eax
sub esp, 0x94
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1c], 0
test ebx, ebx
je 0x54edcf
call fcn.00546d80
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 2
push esi
mov edi, eax
call fcn.0056f898
add esp, 8
cmp edi, 0xffffffff
je 0x54edcf
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 2
push 0x400
call fcn.00546d80
push eax
push 1
call dword [sym.imp.CRYPT32.dll_CryptQueryObject]
test eax, eax
je 0x54edcf
mov edi, dword [sym.imp.CRYPT32.dll_CryptMsgGetParam]
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 6
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x54edcf
push dword [ebp - 0x14]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x54edcf
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 6
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x54edcf
mov eax, dword [esi + 4]
mov dword [ebp - 0x88], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x84], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x9c], eax
mov eax, dword [esi + 0x10]
push 0
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0xa0]
push eax
push 0xb0000
push 0
push 0x10001
push dword [ebp - 0x18]
call dword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x54edcf
mov ebx, dword [sym.imp.CRYPT32.dll_CertGetNameStringW]
push 0
push 0
push 0
push 0
push 4
push eax
call ebx
mov edi, eax
test edi, edi
je 0x54edcf
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x54edcf
push edi
push esi
push 0
push 0
push 4
push dword [ebp - 0x20]
call ebx
test eax, eax
je 0x54edc8
push 8
call fcn.0056f5ce
add esp, 4
mov dword [ebp - 0x20], eax
push esi
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00545630
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54efd0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x63b404]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x210], ebx
push esi
test ecx, ecx
je 0x54f00c
call fcn.00546d80
mov esi, eax
jmp 0x54f029
push 0x208
call fcn.0056f8a6
add esp, 4
mov esi, eax
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test esi, esi
je 0x54f13b
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x214], eax
test eax, eax
je 0x54f132
push edi
push eax
call fcn.0056f8a6
add esp, 4
mov edi, eax
push edi
push dword [ebp - 0x214]
push dword [ebp - 0x20c]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x54f131
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x21c]
push eax
push str.VarFileInfoTranslation
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov eax, dword [ebp - 0x218]
cmp eax, 3
ja case.default.0x54f09e
jmp dword [eax*4 + 0x54f150]
mov eax, 0x626db0
jmp 0x54f0bf
mov eax, 0x626d98
jmp 0x54f0bf
mov eax, 0x626dec
jmp 0x54f0bf
mov eax, str.SupportFlags
mov ecx, dword [ebp - 0x21c]
push eax
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04x_s
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.00548670
add esp, 0x18
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je case.default.0x54f09e
cmp dword [ebp - 0x208], ebx
jbe case.default.0x54f09e
mov ecx, dword [ebp - 0x210]
call fcn.00545ad0
mov ebx, eax
mov ecx, ebx
call fcn.00547520
test edi, edi
je 0x54f131
push edi
call fcn.0056fc1b
add esp, 4
pop edi
push esi
call fcn.0056fc1b
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0056f3c2
mov esp, ebp
pop ebp
ret
Function at 0x550560
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov byte [esi + 9], 1
test eax, eax
jne 0x55058f
push eax
push 4
push esi
push 0x550410
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [esi + 0xc]
mov dword [esi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 4]
pop esi
test eax, eax
je 0x55059b
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret

Function at 0x5505a0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x550649
cmp byte [esi + 8], 0
mov ecx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jne 0x55061d
push ebx
push edi
mov byte [esi + 8], 1
mov edi, 0x64
nop word [eax + eax]
lea ebx, [edi - 1]
mov dword [ebp - 8], ebx
xor bl, bl
cmp byte [esi + 9], bl
je 0x550601
mov eax, dword [esi + 4]
test eax, eax
je 0x550601
lea edx, [ebp - 4]
push edx
push eax
call ecx
test eax, eax
je 0x550601
cmp dword [ebp - 4], 0x103
mov eax, 1
movzx ebx, bl
cmovne ebx, eax
xor edi, edi
test bl, bl
push 0x64
cmove edi, dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test edi, edi
jne 0x5505d0
pop edi
pop ebx
cmp byte [esi + 9], 0
je 0x55063e
mov eax, dword [esi + 4]
test eax, eax
je 0x55063e
lea edx, [ebp - 8]
push edx
push eax
call ecx
test eax, eax
je 0x55063e
cmp dword [ebp - 8], 0x103
jne 0x550649
push 1
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x553270
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 8
push esi
push edi
test ecx, ecx
je 0x5532d9
lea edx, [ebp + 0x10]
call fcn.00545b60
mov edi, eax
test edi, edi
je 0x5532d9
push str.Cheese
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x5532d9
mov ecx, edi
mov dword [ebp - 8], str.Cheese
call fcn.00546d80
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0
push 2
push 0
push 0
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x553420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b8c82
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
lea esi, [eax + 8]
mov byte [eax], 0
mov dword [ebp - 0x18], esi
mov dword [esi], 0x6262e4
mov dword [esi + 0x50], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push 0
push 0
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
mov ecx, esi
mov dword [ebp - 0x10], 1
call fcn.005437e0
mov eax, dword [esi]
push 8
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], edi
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + esi - 4], eax
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0056f5ce
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x5534d2
push 1
mov byte [ebp - 4], 2
call fcn.00571946
add esp, 4
mov dword [ebx + 4], eax
jmp 0x5534d4
xor ebx, ebx
lea eax, [edi + 4]
mov dword [edi + 0x34], ebx
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 4
push 0x623d7c
push dword [ebp + 0xc]
mov dword [ebp - 4], 3
push 0x6259f4
push dword [ebp + 8]
push esi
call fcn.005444d0
add esp, 8
push eax
call fcn.005444d0
add esp, 8
mov ecx, eax
call fcn.00542b60
push eax
call fcn.005444d0
mov eax, dword [ebp - 0x14]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5537d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b8ce0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x63b404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp byte [ebx], 0
jne 0x5538c6
lea eax, [ebx + 8]
push 0x611ed0
push eax
call fcn.005444d0
mov ecx, dword [ebx + 0x48]
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
test cl, 2
jne 0x55384b
mov eax, dword [ebx + 0x2c]
mov edx, dword [eax]
test edx, edx
je 0x55384b
mov eax, dword [ebx + 0x1c]
cmp edx, dword [ebx + 0x44]
cmovb edx, dword [ebx + 0x44]
mov ecx, dword [eax]
sub edx, ecx
push edx
jmp 0x553868
test cl, 4
jne 0x553871
mov eax, dword [ebx + 0x28]
mov edx, dword [eax]
test edx, edx
je 0x553871
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax]
mov eax, dword [ebx + 0x38]
mov eax, dword [eax]
sub eax, ecx
add eax, edx
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.0052b470
cmp dword [ebp - 0x14], 0x10
lea edi, [ebp - 0x28]
mov esi, dword [ebp - 0x18]
cmovae edi, dword [ebp - 0x28]
push 2
call fcn.005774c8
push eax
push esi
push 1
push edi
call fcn.0057ec89
mov edx, dword [ebp - 0x14]
add esp, 0x14
mov byte [ebx], 1
cmp edx, 0x10
jb 0x5538c6
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5538bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5538ea
push edx
push ecx
call fcn.0056f898
add esp, 8
lea ecx, [ebx + 8]
call fcn.00541270
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056f3c2
mov esp, ebp
pop ebp
ret
call fcn.0057a76e
int3
Function at 0x5597d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b92b1
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x63b404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x18]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x3c], 0
lea ebx, [edi + 0x40]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edi], edx
mov byte [ebp - 4], 2
mov eax, dword [edx + 8]
mov dword [edi + 4], eax
mov dword [edi + 8], 0
mov word [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push dword [edx + 0x10]
call fcn.0055af80
mov eax, dword [edi]
lea ecx, [edi + 0x2c]
push dword [eax + 0x10]
call fcn.0055af80
mov edx, dword [edi]
mov eax, dword [edx + 0x3c]
mov ecx, dword [edx + 0x30]
lea ecx, [eax + ecx*2]
mov eax, dword [edx + 0x34]
inc eax
add eax, ecx
mov dword [ebp + 8], eax
lea esi, [eax*8]
mov ecx, esi
cmp eax, 0x1fffffff
jbe 0x5598c4
or ecx, 0xffffffff
jmp 0x5598cc
cmp ecx, 0x1000
jb 0x5598f5
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.0056f5ce
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x559997
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x559906
test ecx, ecx
je 0x559904
push ecx
call fcn.0056f5ce
add esp, 4
jmp 0x559906
xor eax, eax
lea ecx, [ebp - 0x14]
cmp ebx, ecx
je 0x559947
mov ecx, dword [ebx + 4]
mov dword [ebx + 4], eax
test ecx, ecx
je 0x559940
mov edx, dword [ebx]
shl edx, 3
cmp edx, 0x1000
jb 0x559936
mov esi, dword [ecx - 4]
add edx, 0x23
sub ecx, esi
lea eax, [ecx - 4]
cmp eax, 0x1f
ja 0x559997
mov ecx, esi
push edx
push ecx
call fcn.0056f898
add esp, 8
mov eax, dword [ebp + 8]
mov dword [ebx], eax
jmp 0x55996f
test eax, eax
je 0x55996f
cmp esi, 0x1000
jb 0x559965
mov ecx, dword [eax - 4]
add esi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x559997
mov eax, ecx
push esi
push eax
call fcn.0056f898
add esp, 8
mov dword [edi + 0x48], 0
mov eax, edi
mov dword [edi + 0x4c], 0
mov byte [edi + 0x50], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0057a76e
int3
Function at 0x56cb30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edi + 0x18]
imul ecx, ecx, 0x1000193
pop edi
pop esi
and eax, ecx
pop ebp
ret 4

Function at 0x58e443
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0058e2c0

Function at 0x590826
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005904c8

Function at 0x59968b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x421da4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x421db3
pop dword [ebp - 0x1c]
mov eax, 0xffd5e5cd
add eax, 0x6c37e6
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x4bf15
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x89a95ba0
add ecx, 0x7656ee26
mov edi, eax
mov edx, 0xcb2c22ce
add edx, 0x351a0132
add edx, dword [ebp - 0x1c]
mov esi, 0x2650102d
xor dword [ebp - 0xc], ebx
mov ebx, dword [edx]
mov dword [ebp - 0x10], 0x3a5c9907
xor ebx, esi
sub dword [ebp - 0x10], 0xcf78d729
mov dword [edi], ebx
sub dword [ebp - 0x18], eax
add edi, 4
add edx, 0x61306701
sub edx, 0x613066fd
loop 0x421e07
add eax, 0x373c81a3
add eax, 0xc8c49848
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x21a60379
add ecx, 0xde99fc87
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x427214
Capabilities:
Create http request
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
or dword [ebp - 0x10], 0xffffffff
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0x18]
push ebx
push dword [edi]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call main
mov esi, eax
cmp esi, ebx
jge 0x427269
push str.Failed_to_copy_download_source_URL.
push esi
call main
pop ecx
pop ecx
jmp 0x4273c3
push ebx
push ebx
push ebx
push ebx
push str.Burn
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x4272b5
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, ebx
jle 0x427293
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x42729e
mov esi, 0x80004005
push esi
push 0x93
push str.downloadengine.cpp
call fcn.0043294e
push str.Failed_to_open_internet_session
jmp 0x42725c
lea eax, [ebp - 0xc]
push eax
push 0x78
push str.DownloadTimeout
push str.WiXBurn
call main
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jbe 0x427307
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 2
push dword [ebp - 4]
call esi
push 4
lea eax, [ebp - 0xc]
push eax
push 6
push dword [ebp - 4]
call esi
push 4
lea eax, [ebp - 0xc]
push eax
push 5
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x2c]
push eax
push dword [edi + 8]
lea eax, [ebp - 8]
push dword [edi + 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push dword [ebp + 0x10]
push dword [ebp + 8]
call main
mov esi, eax
cmp esi, ebx
jge 0x427342
push dword [ebp - 8]
push str.Failed_to_get_size_and_time_for_URL:__ls
push esi
call main
add esp, 0xc
jmp 0x4273c3
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x24]
lea esi, [ebp - 0x1c]
call main
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x24]
push dword [edi + 8]
push dword [edi + 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 8]
call main
mov esi, eax
cmp esi, ebx
jge 0x4273a1
push dword [ebp - 8]
push str.Failed_to_download_URL:__ls
push esi
call main
add esp, 0xc
jmp 0x4273b4
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x4273b4
cmp word [eax], bx
je 0x4273b4
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
cmp dword [ebp - 0x10], 0xffffffff
je 0x4273c3
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [ebp - 0x14], ebx
je 0x4273d0
push dword [ebp - 0x14]
call main
cmp dword [ebp - 4], ebx
je 0x4273de
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 8], ebx
je 0x4273eb
push dword [ebp - 8]
call main
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x20
Function at 0x427eaa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4540d0]
jne 0x427eb4
repz ret
jmp fcn.00429e94
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40673a
pop dword [ebp - 0xc]
mov eax, 0x79465a8a
add eax, 0x86fa0cb0
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x82ac5
sub dword [ebp - 0x1c], 0xb1b5e57a
mov dword [ebp - 0x18], 0xb0d32ce4
sub dword [ebp - 0x18], 0x7e9fe09f
mov dword [ebp - 0x14], 0x866d79a4
sub dword [ebp - 0x14], 0x3a213576
mov dword [ebp - 0x10], 0x4e13a8d1
add dword [ebp - 0x10], 0xb1ec572f
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x73e14b09
sub eax, 0x73a0ca05
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xbf76f2f8
sub dword [ebp - 0x1c], 0x4b0489a2
mov dword [ebp - 0x18], 0xe4a701b1
add dword [ebp - 0x18], 0x5cc55fc4
mov dword [ebp - 0x14], 0x28c4d647
sub dword [ebp - 0x14], 0xc55569db
mov dword [ebp - 0x10], 0x2047f7c0
add dword [ebp - 0x10], 0xdfb80840
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x379e9
push 0
call eax
mov ecx, 0x3daee3
add ecx, 0xffc29987
xor ebx, ebx
add ebx, eax
mov edx, 0x46e400
add edx, dword [ebp - 0xc]
mov edi, 0x33c8fb2c
add edi, 0xb5513547
xor dword [ebp - 4], 0x98de08e0
mov esi, dword [edx]
mov dword [ebp - 4], 0xd4a636ce
sub esi, edi
mov dword [ebp - 4], 0x21dca07e
mov dword [ebx], esi
add ebx, 4
add edx, 0x52f3ed0f
sub edx, 0x52f3ed0b
loop 0x406853
add eax, 0x25b29986
sub eax, 0x25b1850b
xor ebx, ebx
add ebx, eax
add eax, 0x1a38870b
sub eax, 0x1a388706
mov ecx, 0x9efb69f4
add ecx, 0x6144960c
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10008cd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10008d29
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10008d29
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10008d1a
cmp esi, edx
jae 0x10008d29
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10008d08
cmp esi, edx
jae 0x10008d29
cmp word [esi], 0
je 0x10008d29
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1000c000
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100ae5f0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi + 0x1c], 0
je 0x1000c032
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100264b9
mov esp, ebp
pop ebp
ret 4
push ebx
push esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10056ec0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x1000c085
lea eax, [ebp - 0x20c]
push eax
call ebx
sub esi, 1
jne 0x1000c077
push str.netul.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000c142
mov dword [edi + 0x1c], 1
cmp dword [edi], 0
jne 0x1000c118
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x1000c142
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x1000c118
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x1000c142
cmp dword [edi + 4], 0
je 0x1000c142
cmp dword [edi + 0xc], 0
je 0x1000c142
pop esi
pop ebx
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100264b9
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.100264b9
mov esp, ebp
pop ebp
ret 4