joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001be50
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x1001be71
xor eax, eax
jmp 0x1001bf8d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx], 0x4550
je 0x1001be8f
xor eax, eax
jmp 0x1001bf8d
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x14]
cmp ecx, 0x60
jl 0x1001bea4
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x74], 0
jne 0x1001beab
xor eax, eax
jmp 0x1001bf8d
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x1001beca
xor eax, eax
jmp 0x1001bf8d
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x10], 0
jmp 0x1001bf09
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x18]
jae 0x1001bf8b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10055540
add esp, 4
cmp eax, dword [ebp + 0xc]
je 0x1001bf3c
jmp 0x1001bf00
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x30]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx + 0x10]
add eax, edx
mov word [ebp - 4], ax
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx + 0x10]
sub eax, edx
mov word [ebp - 8], ax
mov dword [ebp - 0x20], 0
movzx eax, word [ebp - 8]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
jmp 0x1001bf8d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10061440
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x1006145f
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
jmp 0x1006148f
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax]
xor edx, dword [ebp + 0xc]
imul eax, edx, 0x1000193
push eax
mov ecx, 1
shl ecx, 0
add ecx, dword [ebp + 8]
push ecx
call fcn.10061440
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10072090
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
movzx eax, byte [0x100cd027]
cdq
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
movzx eax, word [0x100cd094]
cdq
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
mov al, byte [0x100cd06e]
mov byte [ebp - 3], al
mov ecx, dword [0x100cd0ac]
mov dword [ebp - 0x3c], ecx
mov edx, dword [0x100cd0f8]
mov eax, dword [0x100cd0fc]
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x74], eax
movsx ecx, word [0x100cd108]
mov dword [ebp - 0x38], ecx
xor edx, edx
mov dword [ebp - 0x80], 0x26
mov dword [ebp - 0x7c], edx
mov byte [ebp - 1], 0x99
mov al, byte [0x100cd110]
mov byte [ebp - 4], al
mov ecx, dword [0x100cd0f0]
xor edx, edx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], edx
xor eax, eax
mov dword [ebp - 0x90], 0x7f43f912
mov dword [ebp - 0x8c], eax
mov ecx, 3
mov word [ebp - 0x18], cx
mov dword [ebp - 0x40], 0xba
mov dl, byte [0x100cd082]
mov byte [ebp - 2], dl
xor eax, eax
mov dword [ebp - 0x98], 0xa4a7b03c
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x44], 0xcb069d08
mov dword [ebp - 0x48], 0xcd
mov dword [ebp - 0x4c], 0x4cab8604
mov cl, byte [0x100cd118]
mov byte [ebp - 5], cl
mov byte [ebp - 6], 0xa7
mov edx, 0x4a4d
mov word [ebp - 0x1c], dx
mov dword [ebp - 0x50], 0xeed6
mov eax, 0xfce6
mov word [ebp - 0x20], ax
movsx cx, byte [0x100cd083]
mov word [ebp - 0x24], cx
mov eax, dword [0x100cd104]
cdq
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], edx
mov edx, dword [0x100cd090]
mov word [ebp - 0x10], dx
xor eax, eax
mov dword [ebp - 0xa8], 0x44
mov dword [ebp - 0xa4], eax
mov byte [ebp - 7], 9
mov ecx, 0x7e06
mov word [ebp - 0x28], cx
mov edx, 0x36
mov word [ebp - 0x2c], dx
mov eax, dword [0x100cd118]
mov dword [ebp - 0x54], eax
mov cl, byte [str.6BlockUpgradeIfDriv]
mov byte [ebp - 8], cl
mov dword [ebp - 0x58], 0xe3ca090
xor edx, edx
mov dword [ebp - 0xb0], 0xcb78
mov dword [ebp - 0xac], edx
mov al, byte [0x100cd06f]
mov byte [ebp - 9], al
mov dword [ebp - 0x5c], 0x5a
mov byte [ebp - 0xa], 0xf
mov ecx, 0xe7
mov word [ebp - 0x30], cx
mov dword [ebp - 0x60], 0xb4c9
mov edx, dword [0x100cd0a0]
mov eax, dword [0x100cd0a4]
mov dword [ebp - 0xb8], edx
mov dword [ebp - 0xb4], eax
mov eax, dword [0x100cd104]
cdq
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], edx
mov ecx, 0x4030
mov word [ebp - 0x34], cx
movsx edx, byte [ebp - 2]
add edx, 0x2f
mov word [ebp - 0x10], dx
cmp dword [0x100cd0e0], 0
je 0x10072270
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
jmp 0x1007227a
movzx ecx, word [0x100cd10c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [0x100cd0ac], edx
movsx eax, byte [0x100cd083]
mov dword [ebp - 0x3c], eax
movsx ecx, word [0x100cd0d8]
movsx edx, byte [0x100cd06f]
imul ecx, edx
movsx eax, word [0x100cd0d8]
add eax, ecx
mov word [0x100cd0d8], ax
mov ecx, 2
imul edx, ecx, 0x388e
movzx eax, byte [ebp - 1]
mov cl, byte [edx + 0x1023d6b0]
shr al, cl
mov byte [ebp - 1], al
mov byte [0x100cd026], 0xd7
push str.C:NonExistentPath
push str.TEMP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret
Function at 0x1009f8dc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1009f979
push ebx
push esi
call fcn.1009f8a5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1009f7ee
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1009f926
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1009f978
push edi
push eax
call fcn.100a0895
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1009f946
call fcn.1009dc7b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1009f977
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1009f7ee
add esp, 0x20
test eax, eax
jne 0x1009f965
push edi
call fcn.1009dc7b
jmp 0x1009f96d
push ebx
call fcn.1009dc7b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1009fbe4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100a7ef8
push 0x100a7ef0
push str.FlsAlloc
push 0x1e
call fcn.1009fb02
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1009fc18
push dword [ebp + 8]
mov ecx, esi
call dword [0x100a624c]
call esi
jmp 0x1009fc1e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1009fc62
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100a7f08
push 0x100a7f00
push str.FlsGetValue
push 0x20
call fcn.1009fb02
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1009fc99
push dword [ebp + 8]
mov ecx, esi
call dword [0x100a624c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100a5340
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100a536d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100a536d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x407080
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5238e0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x568598]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0xc], 0
call fcn.004bae77
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0043c8ce
mov dword [esi + 4], eax
add esp, 8
mov dword [edi + 0x30], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x409253
Capabilities:
Set registry value

Disassembly:
push 0x218
mov eax, 0x5239e1
call fcn.004badac
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test ebx, ebx
jne 0x409273
xor eax, eax
jmp 0x4093ea
push 0x208
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.004fb180
add esp, 0xc
call fcn.004098dc
lea ecx, [ebp - 0x219]
test al, al
je 0x4092ed
call fcn.00408e5b
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x220]
call fcn.00409bbb
push esi
push edi
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x219]
call fcn.0040870d
push eax
lea ecx, [ebp - 0x220]
call fcn.00409d20
lea ecx, [ebp - 0x220]
mov edi, eax
call fcn.00409c98
jmp 0x4093e8
call fcn.0040895c
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x224]
push eax
push 0x20006
push edi
lea ecx, [ebp - 0x219]
call fcn.0040900f
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4093e8
call fcn.004063b0
push eax
lea ecx, [ebp - 0x220]
call fcn.004059c0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x219]
test esi, esi
je 0x40936e
push esi
push eax
call fcn.00408b28
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0040961d
add esp, 0x10
jmp 0x409384
push eax
call fcn.00408744
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0040961d
add esp, 0xc
mov esi, dword [ebp - 0x220]
cmp dword [esi - 4], 1
mov ebx, dword [esi - 0xc]
jle 0x4093a5
push ebx
lea ecx, [ebp - 0x220]
call fcn.00405b20
mov esi, dword [ebp - 0x220]
lea eax, [ebx + ebx]
push eax
push esi
push 1
push edi
lea ecx, [ebp - 0x219]
call fcn.00408ca5
push eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x220]
mov edi, eax
call fcn.004099ce
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esi - 0x10]
call fcn.00406160
mov eax, edi
call fcn.004bad56
ret
Function at 0x40953f
Capabilities:
Delete registry value

Disassembly:
push 0xc
mov eax, 0x523a11
call fcn.004bad78
cmp dword [ebp + 8], 0
jne 0x409558
xor eax, eax
jmp 0x4095dd
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
call fcn.00409735
pop ecx
pop ecx
test eax, eax
jne 0x409572
inc eax
jmp 0x4095dd
call fcn.004098dc
test al, al
je 0x4095a5
lea ecx, [ebp - 0x10]
call fcn.00409bbb
push 1
lea ecx, [ebp + 0xb]
mov dword [ebp - 4], esi
call fcn.00409046
push eax
lea ecx, [ebp - 0x10]
call fcn.0040a39b
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.00409c98
jmp 0x4095db
lea eax, [ebp - 0x18]
push eax
push 0x20006
push esi
lea ecx, [ebp + 0xb]
call fcn.004090b4
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4095db
lea ecx, [ebp + 0xb]
call fcn.0040907d
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov eax, esi
call fcn.004bad41
ret

Function at 0x409735
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x42c
mov eax, 0x523a4d
call fcn.004badac
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test esi, esi
jne 0x409755
xor eax, eax
jmp 0x4098d6
xor edi, edi
test ebx, ebx
je 0x40975d
mov dword [ebx], edi
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.004fb180
add esp, 0xc
call fcn.004098dc
lea ecx, [ebp - 0x421]
test al, al
je 0x4097d4
call fcn.00408993
push eax
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x430]
call fcn.00409bbb
push ebx
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x421]
call fcn.00408cdc
push eax
lea ecx, [ebp - 0x430]
call fcn.0040a6af
lea ecx, [ebp - 0x430]
mov edi, eax
call fcn.00409c98
jmp 0x4098d4
call fcn.00408e92
push eax
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x434]
push eax
push 0x20019
push edi
lea ecx, [ebp - 0x421]
call fcn.004084d4
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4098d4
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 0x104
push eax
lea eax, [ebp - 0x420]
push eax
push edi
push edi
lea ecx, [ebp - 0x421]
call fcn.004086d6
push eax
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x434]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4098d4
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x42c]
call fcn.0040840e
inc esi
lea ecx, [ebp - 0x42c]
mov dword [ebp - 4], esi
call fcn.004099a6
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x428]
call fcn.0040840e
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 2
call fcn.004099a6
push edi
push dword [ebp - 0x428]
lea ecx, [ebp - 0x42c]
call fcn.004095e3
test eax, eax
js 0x4098b8
mov edi, esi
test ebx, ebx
je 0x4098b8
mov dword [ebx], esi
mov ecx, dword [ebp - 0x428]
lea ecx, [ecx - 0x10]
call fcn.00406160
mov ecx, dword [ebp - 0x42c]
lea ecx, [ecx - 0x10]
call fcn.00406160
mov eax, edi
call fcn.004bad56
ret
Function at 0x40a585
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp word [0x56d420], 0
push esi
mov esi, 0x56d420
jne 0x40a5ac
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x100
push eax
push esi
push 2
call sub.Secur32.dll_GetUserNameExW
mov ecx, dword [ebp + 8]
push esi
call fcn.0040840e
mov eax, dword [ebp + 8]
pop esi
leave
ret 4

Function at 0x40d03e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x18]
push ebx
push esi
push edi
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
mov edi, dword [ebx]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [edi + 0x20]
call fcn.0040d3ca
pop ecx
pop ecx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jne 0x40d08f
mov edi, dword [edi]
cmp edi, ebx
jne 0x40d056
xor eax, eax
xor edx, edx
jmp 0x40d093
mov eax, dword [edi + 0x10]
cdq
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d098
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov eax, dword [ebx + 0x3c]
mov esi, dword [eax + ebx + 0x78]
add esi, ebx
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
add eax, ebx
mov ecx, dword [esi + 0x1c]
add edx, ebx
add ecx, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
cmp dword [esi + 0x18], edi
jbe 0x40d103
mov ecx, dword [eax + edi*4]
movzx eax, word [edx + edi*2]
add ecx, ebx
mov edx, dword [ebp - 4]
push dword [ebp + 0x10]
push ecx
mov eax, dword [edx + eax*4]
xor edx, edx
add eax, ebx
mov dword [ebp - 0x10], eax
adc edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
call fcn.0051147c
pop ecx
pop ecx
test eax, eax
je 0x40d10c
mov eax, dword [ebp - 8]
inc edi
mov edx, dword [ebp - 0xc]
cmp edi, dword [esi + 0x18]
jb 0x40d0cc
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
jmp 0x40d107

Function at 0x413e7e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi], ebx
jne 0x413ee9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x413efd
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CurlInit
push eax
call esi
push str.CurlUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
pop esi
test eax, eax
je 0x413ee9
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], ebx
je 0x413efb
cmp dword [edi + 4], ebx
je 0x413efb
cmp dword [edi + 0xc], ebx
je 0x413efb
xor ebx, ebx
inc ebx
mov eax, ebx
pop edi
pop ebx
pop ebp
ret 4
Function at 0x414004
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x568598]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov ebx, ecx
push 0
push eax
call fcn.004fb180
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [ebp + 8]
test esi, esi
je 0x41406e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
sub esi, 1
jne 0x41405c
push str.curlnet.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.0040840e
push dword [ebp - 0x210]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 0x210]
neg eax
sbb esi, esi
add ecx, 0xfffffff0
call fcn.00406160
neg esi
jne 0x4140b8
xor eax, eax
jmp 0x4140c6
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00413e7e
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004bad30
leave
ret 4

Function at 0x414264
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x568598]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x20d]
call fcn.00411a46
push 0x208
mov esi, eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004fb180
add esp, 0xc
push esi
call fcn.00413daa
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414309
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x414309
lea ecx, [ebp - 0x20d]
call fcn.004132e3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414309
and dword [ebp - 0x214], 0
lea ecx, [ebp - 0x214]
push ecx
push 1
call eax
test eax, eax
je 0x414309
mov dword [edi + 0x3f8], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004bad30
leave
ret
Function at 0x4197c8
Capabilities:
Get file version info

Disassembly:
push 0x20
mov eax, 0x524656
call fcn.004bad78
lea eax, [ebp - 0x14]
xor ebx, ebx
and dword [ebp - 0x14], ebx
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
push dword [eax]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x419967
push esi
call fcn.004baedd
mov edi, eax
pop ecx
test edi, edi
je 0x419967
mov eax, dword [ebp + 8]
push edi
push esi
push dword [ebp - 0x14]
push dword [eax]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x419960
call fcn.00419a44
mov ebx, dword [ebp + 0xc]
test al, al
je 0x419914
call fcn.004199c2
test al, al
jne 0x419914
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x419914
xor esi, esi
test dword [ebp + 8], 0xfffffffc
mov dword [ebp - 0x1c], esi
jbe 0x419914
call fcn.004063b0
push eax
lea ecx, [ebp - 0x18]
call fcn.004059c0
mov ecx, dword [ebp - 0x28]
and dword [ebp - 4], 0
movzx eax, word [ecx + esi*4 + 2]
push eax
movzx eax, word [ecx + esi*4]
push eax
lea eax, [ebp - 0x18]
push str.StringFileInfo_04x_04xFileVersion
push eax
call fcn.0040961d
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x20]
and dword [ebp - 0x24], 0
add esp, 0x10
and dword [ebp - 0x20], 0
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x4198d8
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00406160
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
inc esi
shr eax, 2
mov dword [ebp - 0x1c], esi
cmp esi, eax
jb 0x41986a
jmp 0x419914
push dword [ebp - 0x20]
mov ecx, ebx
push dword [ebp - 0x24]
call fcn.00405c70
push 0x2e
push 0x2c
mov ecx, ebx
call fcn.00419b26
push 0x20
mov ecx, ebx
call fcn.00419aa6
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
mov dword [ebp - 0x10], 1
call fcn.00406160
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jne 0x41995d
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x2c]
and dword [ebp - 0x2c], 0
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x52ea80
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41995d
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push ebx
call fcn.0040961d
xor ebx, ebx
add esp, 0x18
inc ebx
jmp 0x419960
mov ebx, dword [ebp - 0x10]
push edi
call fcn.004baea7
pop ecx
mov al, bl
call fcn.004bad41
ret