joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4129f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43b64d
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x44a5d0]
xor eax, esp
mov dword [esp + 0x228], eax
push ebp
push esi
mov eax, dword [0x44a5d0]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x10], ebp
xor eax, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebp
mov word [esp + 0x1c], ax
mov ecx, ebx
and ecx, 0x1fff0000
mov dword [esp + 0x240], 1
cmp ecx, 0xe0000
jne 0x412a6c
mov eax, 0x441544
jmp 0x412a95
lea edx, [ebx - 0x2ee0]
cmp edx, 0xaf
ja 0x412a83
push 0xb
mov eax, str.WININET.DLL
jmp 0x412a97
lea eax, [ebx - 0x834]
cmp eax, 0x383
ja 0x412aa6
mov eax, str.NETMSG.DLL
push 0xa
lea esi, [esp + 0x1c]
call fcn.004085a0
cmp dword [esp + 0x2c], ebp
jne 0x412aaa
xor eax, eax
jmp 0x412ac0
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x412ab9
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push ebp
push 0x400
lea ecx, [esp + 0x14]
push ecx
push 0x400
push ebx
push eax
neg eax
sbb eax, eax
and eax, 0xfffff800
add eax, 0x1000
or eax, 0x300
push eax
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
xor edx, edx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebp
mov word [edi + 4], dx
mov dword [esp + 0x10], 1
cmp eax, ebp
je 0x412b23
mov eax, dword [esp + 0xc]
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bp
jne 0x412b11
sub ecx, esi
sar ecx, 1
push ecx
jmp 0x412b74
push 0x1fe
lea ecx, [esp + 0x3a]
xor eax, eax
push ebp
push ecx
mov word [esp + 0x40], ax
call fcn.0042ad60
push ebx
push str.Unknown_error._Error_code:_0x_x
lea edx, [esp + 0x48]
push 0x100
push edx
call fcn.00426d7e
lea eax, [esp + 0x50]
add esp, 0x1c
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x412b60
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x38]
mov esi, edi
call fcn.004085a0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x30], 8
jb 0x412b9a
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004258ad
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00425821
add esp, 0x238
ret
Function at 0x412f40
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [0x44cde4]
push edi
mov edi, eax
call fcn.00412ea0
test eax, eax
je 0x41301e
mov ecx, dword [esp + 0x28]
push 0
push 0x412bd0
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x413005
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
call edi
test eax, eax
jle 0x412fe1
push ebx
mov ebx, dword [sym.imp.USER32.dll_IsDialogMessageW]
push ebp
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ecx]
lea eax, [esp + 0x10]
push eax
push esi
call ebx
test eax, eax
jne 0x412fce
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
jg 0x412fb0
pop ebp
pop ebx
mov ecx, dword [0x44cdd0]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [0x44cdd0]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x10]
pop edi
pop esi
add esp, 0x1c
ret
mov eax, dword [0x44cdd0]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [0x44cdd0]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
Function at 0x414e50
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esi + 0x168], 0
jne 0x414ea4
mov eax, dword [esi + 0xac]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [esi + 0xac]
or eax, 8
push eax
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [esi + 0xa8]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 8]
push 0
push 0x1e
push 0x1d20
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov byte [esi + 0x168], 1
ret

Function at 0x414eb0
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esi + 0x168], 0
je 0x414f00
mov eax, dword [esi + 0xac]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [esi + 0xac]
and eax, 0xfffffff7
push eax
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [esi + 0xa8]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 8]
push 0x1d20
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov byte [esi + 0x168], 0
ret
Function at 0x414f10
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x43cf8c
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x44a5d0]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44a5d0]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x14], ebx
cmp byte [edi + 0x169], bl
jne 0x414fab
mov eax, dword [edi + 0xa4]
lea esi, [esp + 0x18]
call fcn.00411330
mov ebp, 8
mov dword [esp + 0x7c], ebx
cmp dword [eax + 0x18], ebp
jb 0x414f74
mov eax, dword [eax + 4]
jmp 0x414f77
add eax, 4
mov esi, eax
call fcn.004087b0
cmp dword [esp + 0x30], ebp
jb 0x414f91
mov eax, dword [esp + 0x1c]
push eax
call fcn.004258ad
add esp, 4
mov ecx, dword [edi + 8]
push ebx
push ebx
push 0x400
push ecx
mov byte [edi + 0x3c], 1
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x41510c
mov edx, dword [edi + 0xa8]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0xa4]
lea esi, [esp + 0x18]
call fcn.00411330
mov dword [esp + 0x7c], 2
cmp dword [eax + 0x18], 8
jb 0x414fdc
mov eax, dword [eax + 4]
jmp 0x414fdf
add eax, 4
xor ecx, ecx
mov word [esp + 0x58], cx
mov ebp, 7
mov ecx, eax
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x68], ebx
lea esi, [ecx + 2]
jmp 0x415000
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x415000
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x58]
call fcn.004085a0
mov byte [esp + 0x7c], 4
cmp dword [esp + 0x30], 8
jb 0x415032
mov edx, dword [esp + 0x1c]
push edx
call fcn.004258ad
add esp, 4
mov esi, dword [edi + 0xa4]
mov dword [esp + 0x30], ebp
xor eax, eax
lea ebp, [esi + 0x2c]
push ebp
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], ax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebp
mov byte [esi + 0xe], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4c
call fcn.004258d3
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0x7c], 5
cmp eax, ebx
je 0x4150b7
lea ecx, [edi + 0x40]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
push ebx
push 0x835
push 0xffffffffffffffff
push ecx
lea ecx, [edi + 0x44]
push ecx
lea edx, [esp + 0x68]
push edx
mov byte [esp + 0x94], 6
lea ecx, [esp + 0x50]
xor dl, dl
mov esi, eax
mov dword [esp + 0x2c], 1
call fcn.004109d0
jmp 0x4150b9
xor eax, eax
test byte [esp + 0x14], 1
mov dword [edi + 0xa4], eax
je 0x4150da
cmp dword [esp + 0x50], 0x10
jb 0x4150da
mov eax, dword [esp + 0x3c]
push eax
call fcn.004258ad
add esp, 4
mov edi, dword [edi + 0xa4]
call fcn.004111c0
push ebx
push ebx
push edi
push 0x411380
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x18], eax
cmp dword [esp + 0x6c], 8
jb 0x41510c
mov ecx, dword [esp + 0x58]
push ecx
call fcn.004258ad
add esp, 4
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.00425821
add esp, 0x6c
ret
Function at 0x415480
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43c80b
mov eax, dword fs:[0]
push eax
sub esp, 0x830
mov eax, dword [0x44a5d0]
xor eax, esp
mov dword [esp + 0x828], eax
push ebx
push esi
push edi
mov eax, dword [0x44a5d0]
xor eax, esp
push eax
lea eax, [esp + 0x840]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0xc8]
xor ebx, ebx
cmp eax, ebx
je 0x4154e6
mov ecx, dword [edi - 0x38]
mov edx, dword [eax]
push ebx
push 0x3e8
push ebx
push 0x3e8
push ecx
push eax
mov eax, dword [edx + 0x24]
call eax
mov ecx, dword [edi + 0x64]
push ecx
mov byte [edi - 3], bl
mov byte [esp + 0x1b], 1
call fcn.00411220
test al, al
je 0x4155ea
mov eax, dword [edi - 0x38]
push 0x400
lea edx, [esp + 0x38]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
mov word [esp + 0x1c], ax
push 0x1c
mov eax, str.Cannot_download_file_from:_r_n
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
call fcn.004085a0
push ebx
lea ecx, [edi + 0xcc]
push ecx
or eax, 0xffffffff
mov dword [esp + 0x850], ebx
call fcn.00407210
cmp dword [esp + 0x30], 8
mov ebx, dword [esp + 0x1c]
jae 0x41555c
lea ebx, [esp + 0x1c]
mov esi, dword [edi - 0x38]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x7f01
push 0
mov dword [0x44cde4], eax
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x10
mov dword [0x44cde0], eax
mov dword [0x44cde8], ebx
mov dword [0x44cdf4], 2
call dword [sym.imp.USER32.dll_MessageBeep]
push esi
lea eax, [esp + 0x38]
call fcn.00412f40
add esp, 4
cmp eax, 2
jne 0x4155ac
xor bl, bl
jmp 0x4155b0
mov bl, byte [esp + 0x17]
mov dword [esp + 0x848], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x4155cf
mov edx, dword [esp + 0x1c]
push edx
call fcn.004258ad
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
test bl, bl
je 0x415662
mov eax, dword [edi - 0x38]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x37
push eax
call ebx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
mov eax, dword [edi - 0x38]
push 0
push 0x32
push eax
call ebx
push eax
call esi
mov eax, dword [edi - 0x38]
push 0
push 0x33
push eax
call ebx
push eax
call esi
mov eax, dword [edi - 0x38]
push 5
push 0x36
push eax
call ebx
push eax
call esi
mov eax, dword [edi - 0x38]
push 5
push 0x35
push eax
call ebx
push eax
call esi
mov ecx, dword [edi - 0x38]
push 9
push ecx
call esi
mov edx, dword [edi - 0x38]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
lea esi, [edi - 0x40]
call fcn.0040af90
mov eax, dword [edi - 0x38]
push 0x1d20
push eax
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x41566c
push 0
add edi, 0xffffffc0
call fcn.0040ade0
mov ecx, dword [esp + 0x840]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x828]
xor ecx, esp
call fcn.00425821
mov esp, ebp
pop ebp
ret 4
Function at 0x4156a0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x43ceff
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44a5d0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x44]
xor esi, esi
cmp eax, 0x410
jne 0x41570e
mov edi, dword [ebp + 0xa4]
call fcn.004111c0
push esi
push esi
push edi
push 0x411380
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x18], eax
mov ebp, dword [ebp + 8]
push 0x410
push ebp
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x41586b
cmp eax, 0x15ab
jne 0x415848
mov eax, dword [ebp + 8]
push 0x15ab
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0x4c
cmp byte [ebp + 0x12c], bl
je 0x415797
call fcn.004258d3
add esp, 4
mov dword [esp + 0x44], eax
mov dword [esp + 0x3c], esi
cmp eax, esi
je 0x415783
push 1
push 0x835
push 0xffffffffffffffff
lea edx, [ebp + 0x40]
push edx
lea edx, [ebp + 0x44]
push edx
lea edx, [ebp + 0x10c]
push edx
mov dl, byte [ebp + 0x169]
lea ecx, [ebp + 0x14c]
mov esi, eax
call fcn.004109d0
mov esi, ebp
mov dword [ebp + 0xa4], eax
call fcn.00414e50
jmp 0x41581a
xor eax, eax
mov esi, ebp
mov dword [ebp + 0xa4], eax
call fcn.00414e50
jmp 0x41581a
call fcn.004258d3
add esp, 4
mov dword [esp + 0x44], eax
mov dword [esp + 0x3c], 1
cmp eax, esi
je 0x4157f9
lea ecx, [ebp + 0x40]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], esi
mov byte [esp + 0x1c], 0
push esi
push 0x835
mov byte [esp + 0x44], 2
mov edx, dword [ebp + 0x128]
push edx
push ecx
lea ecx, [ebp + 0x44]
push ecx
lea edx, [ebp + 0x10c]
mov ebx, 1
push edx
lea ecx, [esp + 0x30]
mov dl, bl
mov esi, eax
mov dword [esp + 0x2c], ebx
call fcn.004109d0
jmp 0x4157fb
xor eax, eax
mov dword [ebp + 0xa4], eax
test bl, 1
je 0x41581a
cmp dword [esp + 0x30], 0x10
jb 0x41581a
mov eax, dword [esp + 0x1c]
push eax
call fcn.004258ad
add esp, 4
mov ecx, dword [ebp + 0xa4]
mov byte [ecx + 0xf], 1
mov edi, dword [ebp + 0xa4]
call fcn.004111c0
push 0
push 0
push edi
push 0x411380
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x18], eax
jmp 0x41586b
cmp eax, 0x1d20
jne 0x41586b
cmp byte [ebp + 0x168], bl
je 0x41586b
mov edx, dword [ebp + 0xac]
push esi
push esi
push 0x402
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4

Function at 0x415990
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3d], 1
jne 0x4159ac
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040aff0
pop esi
ret
push edi
push 0
mov edi, esi
call fcn.0040ade0
pop edi
pop esi
ret
Function at 0x416270
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43b4fb
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x44a5d0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 0xc], ebx
mov dword [esi], vtable.XmlBinary.0
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
xor eax, eax
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], ebx
mov word [esi + 0x1c], ax
lea ecx, [esi + 0x34]
push ecx
mov dword [esp + 0x18], ebx
call fcn.0041a620
mov byte [esi + 0x4c], bl
mov dword [esi + 0x50], ebx
mov dword [esi + 0x6c], 7
mov dword [esi + 0x68], ebx
xor edx, edx
mov word [esi + 0x58], dx
mov byte [esi + 0x70], bl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x416820
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
xor ebx, ebx
xor eax, eax
cmp dword [ecx + 0x14], ebx
push ebp
mov ebp, dword [esp + 0x18]
sete al
xor edx, edx
cmp dword [esp + 0x1c], ebx
sete dl
cmp eax, edx
jne 0x4168fc
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x1c]
push eax
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebp
push edx
call edi
test eax, eax
jne 0x4168f3
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x78], ebx
jne 0x416877
pop edi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jbe 0x4168f3
add eax, 2
push esi
push eax
call fcn.00424be9
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4168e9
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push esi
lea edx, [esp + 0x18]
push edx
push ebx
push ebp
push eax
call edi
test eax, eax
jne 0x4168e0
mov ecx, dword [esp + 0x20]
mov byte [esi + ecx], bl
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov byte [esi + edx + 1], bl
cmp dword [ecx + 0x7c], 8
jb 0x4168c8
mov ecx, dword [ecx + 0x68]
jmp 0x4168cb
add ecx, 0x68
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push edx
call fcn.00416910
mov bl, al
push esi
call fcn.00425fc3
add esp, 4
pop esi
pop edi
pop ebp
mov al, bl
pop ebx
pop ecx
ret 0x10
pop edi
pop ebp
mov al, bl
pop ebx
pop ecx
ret 0x10
pop ebp
mov al, bl
pop ebx
pop ecx
ret 0x10
Function at 0x416bd0
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
mov esi, ecx
push str.extra1
lea eax, [esi + 0x10]
push eax
call fcn.0041df60
push str.extra2
lea ecx, [esi + 0x2c]
push ecx
call fcn.0041df60
cmp byte [esi + 4], 0
lea edi, [esi + 0x48]
jne 0x416c12
cmp byte [esi + 5], 0
jne 0x416c12
mov eax, dword [esi + 0xc]
mov byte [esi + 6], 0
test eax, eax
je 0x416c12
call fcn.00420aa0
mov byte [esi + 6], al
mov ecx, edi
pop edi
pop esi
jmp 0x416c20
mov eax, 0x1454
call fcn.00436dc0
mov eax, dword [0x44a5d0]
xor eax, esp
mov dword [esp + 0x1450], eax
push esi
mov esi, ecx
cmp dword [esi + 0x18], 8
jb 0x416c46
mov eax, dword [esi + 4]
jmp 0x416c49
lea eax, [esi + 4]
push 0xa28
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x416c7e
lea eax, [esp + 4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416c65
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 8]
call fcn.004085a0
mov ecx, dword [esp + 0x1454]
pop esi
xor ecx, esp
call fcn.00425821
add esp, 0x1454
ret

Function at 0x416c20
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
mov esi, ecx
push str.extra1
lea eax, [esi + 0x10]
push eax
call fcn.0041df60
push str.extra2
lea ecx, [esi + 0x2c]
push ecx
call fcn.0041df60
cmp byte [esi + 4], 0
lea edi, [esi + 0x48]
jne 0x416c12
cmp byte [esi + 5], 0
jne 0x416c12
mov eax, dword [esi + 0xc]
mov byte [esi + 6], 0
test eax, eax
je 0x416c12
call fcn.00420aa0
mov byte [esi + 6], al
mov ecx, edi
pop edi
pop esi
jmp 0x416c20
mov eax, 0x1454
call fcn.00436dc0
mov eax, dword [0x44a5d0]
xor eax, esp
mov dword [esp + 0x1450], eax
push esi
mov esi, ecx
cmp dword [esi + 0x18], 8
jb 0x416c46
mov eax, dword [esi + 4]
jmp 0x416c49
lea eax, [esi + 4]
push 0xa28
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x416c7e
lea eax, [esp + 4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416c65
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 8]
call fcn.004085a0
mov ecx, dword [esp + 0x1454]
pop esi
xor ecx, esp
call fcn.00425821
add esp, 0x1454
ret
Function at 0x416ca0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x44a5d0]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.0042ad60
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x416d78
cmp dword [esi + 0x28], 8
jb 0x416cf1
mov eax, dword [esi + 0x14]
jmp 0x416cf4
lea eax, [esi + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x442a20
push eax
call edi
test eax, eax
jne 0x416d26
cmp dword [esp + 0xc], 5
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00425821
add esp, 0x118
ret
cmp dword [esi + 0x28], 8
jb 0x416d31
mov esi, dword [esi + 0x14]
jmp 0x416d34
add esi, 0x14
push 0x442a28
push esi
call edi
test eax, eax
jne 0x416d5f
cmp dword [esp + 0xc], 5
pop edi
setne al
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00425821
add esp, 0x118
ret
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00425821
add esp, 0x118
ret
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
xor al, al
call fcn.00425821
add esp, 0x118
ret

Function at 0x416d90
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, eax
cmp dword [esi + 0x5c], 0
push edi
je 0x416e48
mov ebx, 8
cmp dword [esi + 0x44], ebx
jb 0x416dae
mov eax, dword [esi + 0x30]
jmp 0x416db1
lea eax, [esi + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.file
push eax
call edi
test eax, eax
jne 0x416e02
cmp dword [esi + 0x60], ebx
jb 0x416dcd
mov eax, dword [esi + 0x4c]
jmp 0x416dd0
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416dfc
cmp dword [esi + 0x60], ebx
jb 0x416de5
mov esi, dword [esi + 0x4c]
jmp 0x416de8
add esi, 0x4c
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x416dfc
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp dword [esi + 0x44], ebx
jb 0x416e0c
mov eax, dword [esi + 0x30]
jmp 0x416e0f
lea eax, [esi + 0x30]
push str.folder
push eax
call edi
test eax, eax
jne 0x416e48
cmp dword [esi + 0x60], ebx
jb 0x416e34
mov esi, dword [esi + 0x4c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
ret
add esi, 0x4c
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x419510
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x43b428
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x44a5d0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov eax, dword [0x44a5d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
xor ecx, ecx
push 0xffffffffffffffff
mov word [esp + 0x18], cx
push ecx
lea eax, [esi + 0x14c]
lea ecx, [esp + 0x18]
mov bl, 1
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
call fcn.00408690
mov dword [esp + 0x38], 0
cmp dword [esp + 0x24], 0
jne 0x419590
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x130]
lea ecx, [esp + 0x18]
call fcn.00408690
mov eax, dword [esi + 0x5c]
sub eax, 1
mov ebp, 8
je 0x4195cc
sub eax, 2
jne 0x419604
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebp
jae 0x4195b0
lea eax, [esp + 0x14]
push 0x212
push eax
push str.Cannot_establish_connection_to_the_server._r_nSomethings_wrong_either_with_your_Internet_connection_or_with_our_server._We_recommend_you_to_go_back_to_the_site_and_download_the_original_file_again.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 3
jne 0x419604
xor bl, bl
jmp 0x419604
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebp
jae 0x4195da
lea eax, [esp + 0x14]
push 0x10
push eax
push str.Sorry__your_session_has_expired._r_nPlease_go_back_to_the_site_and_download_the_file_again._r_n
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor bl, bl
cmp dword [esi + 0x74], 0
je 0x419604
cmp dword [esi + 0x78], ebp
jb 0x4195fc
mov esi, dword [esi + 0x64]
jmp 0x4195ff
add esi, 0x64
call fcn.004087b0
cmp dword [esp + 0x28], ebp
jb 0x419617
mov edx, dword [esp + 0x14]
push edx
call fcn.004258ad
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00425821
add esp, 0x2c
ret