joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x497008], 0x8088405
inc edx
mov dword [ebx + 0x497008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf75
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf5d
add dl, dl
jne 0x41cf80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cfd1
xor eax, eax
add dl, dl
jne 0x41cf8d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d06e
add dl, dl
jne 0x41cf9c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfbd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cfc7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf6c
mov eax, 1
add dl, dl
jne 0x41cfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfd6
sub eax, ebx
mov ebx, 1
jne 0x41d01d
mov ecx, 1
add dl, dl
jne 0x41d003
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d00e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cffa
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d034
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d03f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d02b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d08f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf6c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x47b58e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
jmp 0x41f10e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f180
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f169
test esi, esi
jbe 0x41f180
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f15b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f180
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f138
jmp 0x41f180
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f180
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b595
ret
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x47c8f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0x49954c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0x49954c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0x498378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c8fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x401045
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x632b80
call fcn.00401c14
mov ecx, esi
push str.EBWebViewx86EmbeddedBrowserWebView.dll
call fcn.00401c14
mov ecx, esi
call fcn.00401cd2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop esi
pop ebp
ret

Function at 0x40126c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x40132b
mov esi, eax
xor eax, eax
dec eax
lea edi, [ebp - 0x20]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.00401a58
mov ecx, edi
push esi
call fcn.00401ca2
test al, al
je 0x40130d
lea ecx, [ebp - 0x20]
call fcn.00401cd2
push eax
push esi
push dword [ebp - 0x14]
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40130d
xor eax, eax
lea esi, [ebp - 0x24]
mov dword [esi], eax
lea edi, [ebp - 0x28]
mov dword [edi], eax
lea ecx, [ebp - 0x20]
call fcn.00401cd2
push edi
push esi
push 0x632b84
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40130d
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x40130d
mov ecx, dword [ebp + 0xc]
push eax
call fcn.00401b42
xor esi, esi
jmp 0x401321
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea ecx, [ebp - 0x20]
call fcn.00401a6a
jmp 0x40133f
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058a7e9
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4018f7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x230
mov esi, edx
mov edi, ecx
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [esp + 0x228], eax
lea eax, [esp + 0x20]
push 0x208
push 0xff
push eax
call fcn.005ae810
add esp, 0xc
mov dword [esp + 0xc], 0x104
lea eax, [esp + 8]
mov dword [eax], 0xffffffff
mov ecx, 0x80000002
sub ecx, esi
push eax
push 0x20219
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x4019f1
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
push ebx
push ebx
push str.EBWebView
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 0
test esi, esi
jne 0x4019f1
mov esi, dword [ebp + 0xc]
mov ecx, esi
lea eax, [esp + 0x20]
push eax
call fcn.00401b42
mov ecx, esi
call fcn.00401cd2
push 0x5c
push eax
call fcn.005b005c
add esp, 8
test eax, eax
je 0x4019ef
mov edi, eax
add edi, 2
pcmpeqd xmm0, xmm0
lea edx, [esp + 0x10]
movdqa xmmword [edx], xmm0
mov ecx, edi
call fcn.00401854
test al, al
je 0x4019ef
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4019e0
push edi
call fcn.00401b42
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.00401a09
mov ebx, eax
jmp 0x4019f1
xor ebx, ebx
mov ecx, dword [esp + 0x228]
xor ecx, ebp
call fcn.0058a7e9
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401a09
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
xor eax, eax
mov edx, dword [eax + 0x632dbc]
cmp dword [ecx + eax], edx
ja 0x401a27
jb 0x401a32
add eax, 4
cmp eax, 0x10
jne 0x401a12
push esi
call fcn.00401045
add esp, 4
jmp 0x401a52
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Loader_skipped_an_incompatible_version:
call edi
mov ecx, esi
call fcn.00401cd2
push eax
call edi
push 0x632e1e
call edi
xor eax, eax
pop esi
pop edi
pop ebp
ret
Function at 0x4020fa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, edx
mov edi, ecx
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x40216d
mov dword [ebp - 0x1c], ecx
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
lea edx, [ebp - 0x18]
mov dword [edx], 4
push edx
push ecx
push eax
push 0x10
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x402187
mov ecx, edi
mov edx, esi
push dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
push esi
call fcn.004021ae
add esp, 8
test al, al
je 0x402198
push 0xa
push 0
push dword [esi]
call fcn.005c30c2
add esp, 0xc
jmp 0x40218a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058a7e9
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004021ae
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, 1
sete cl
mov dword [ebx], ecx
mov bl, 1
jmp 0x40219a
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058a7e9
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4021ae
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov esi, edx
mov dword [ebp - 0x220], ecx
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea edi, [ebp - 0x218]
push 0x208
push ebx
push edi
call fcn.005ae810
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], 0x104
push eax
push edi
push ebx
push 2
push esi
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test eax, eax
jne 0x402225
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, edi
lea eax, [ebp - 0x218]
push eax
call fcn.00401b42
mov ecx, edi
call fcn.00401cd2
mov dword [ebx], eax
test esi, esi
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058a7e9
mov eax, ebx
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409310
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ed3c0
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x238], edx
lea eax, [ebp - 0x234]
mov dword [ebp - 0x244], str.winzip.exe
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x240], str.winzip32.exe
push eax
push str.InstallLocation
push ecx
mov dword [ebp - 0x23c], str.winzip64.exe
mov dword [ebp - 0x234], 0x104
call dword [sym.imp.msi.dll_MsiGetPropertyW]
test eax, eax
jne 0x409498
xor esi, esi
xor eax, eax
mov dword [ebp - 0x230], 0
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], 0
lea edx, [eax + 2]
mov dword [ebp - 0x21c], 7
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4093c0
sub eax, edx
lea ecx, [ebp - 0x230]
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004059d0
push 1
push 0x642460
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0
call fcn.00405ae0
mov edx, dword [ebp + esi*4 - 0x244]
mov edi, eax
mov ecx, edx
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409410
sub ecx, ebx
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00405ae0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4094b6
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x40948e
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409484
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409523
push edx
push ecx
call fcn.0058a7f7
add esp, 8
inc esi
cmp esi, 3
jb 0x409390
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x230]
cmp ecx, eax
je 0x4094e0
cmp dword [ebp - 0x21c], 8
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.004059d0
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x40951c
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409512
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409523
push edx
push ecx
call fcn.0058a7f7
add esp, 8
mov al, 1
jmp 0x40949a
call fcn.005b1b1f
int3
Function at 0x4097e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ed40e
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x38], 0
push 2
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
push 0x642630
mov word [esi], ax
call fcn.004059d0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x38], 1
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x34]
cmp ax, 9
je 0x40986c
cmp ax, 6
jne 0x40987a
push 2
push 0x642638
mov ecx, esi
call fcn.004059d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret
Function at 0x409b00
Capabilities:
Parse pe header

Disassembly:
mov eax, ecx
and eax, 0x3ff
dec eax
cmp eax, 0x90
ja case.0x409b1a.5
movzx eax, byte [eax + 0x409fac]
jmp dword [eax*4 + 0x409e10]
mov eax, 0xe
ret
mov eax, 0xf
ret
mov eax, 0x10
ret
mov eax, 0x11
ret
mov eax, 0x12
ret
mov eax, 0x13
ret
mov eax, 0x14
ret
mov eax, 0x15
ret
mov eax, 0x16
ret
mov eax, 0x17
ret
mov eax, 0x18
ret
mov eax, 0x141a
cmp cx, ax
je 0x409beb
mov eax, 0x201a
cmp cx, ax
je 0x409beb
mov eax, 0x181a
cmp cx, ax
je 0x409be5
mov eax, 0x1c1a
cmp cx, ax
je 0x409be5
mov eax, 0x2c1a
cmp cx, ax
je 0x409be5
mov eax, 0x301a
cmp cx, ax
je 0x409be5
mov eax, 0x241a
cmp cx, ax
je 0x409be5
mov eax, 0x281a
cmp cx, ax
je 0x409be5
mov eax, 0x41a
cmp cx, ax
je 0x409be5
mov eax, 0x81a
cmp cx, ax
je 0x409be5
mov eax, 0xc1a
cmp cx, ax
je 0x409be5
mov eax, 0x101a
cmp cx, ax
jne case.0x409b1a.5
mov eax, 0x1d
ret
mov eax, 0x50
ret
mov eax, 0x19
ret
mov eax, 0x1a
ret
mov eax, 0x1b
ret
mov eax, 0xc
ret
mov eax, 0x1c
ret
mov eax, 0x1e
ret
mov eax, 0x1f
ret
mov eax, 8
ret
mov eax, 1
ret
mov eax, 0x20
ret
mov eax, 0x21
ret
mov eax, 2
ret
mov eax, 0x22
ret
mov eax, 0x23
ret
mov eax, 0x24
ret
mov eax, 3
ret
mov eax, 0x25
ret
mov eax, 0x26
ret
mov eax, 0x27
ret
mov eax, 0x28
ret
mov eax, 0x29
ret
mov eax, 0x2a
ret
mov eax, 0x2b
ret
mov eax, 0x2c
ret
mov eax, 0x2d
ret
mov eax, 0x2e
ret
mov eax, 0x2f
ret
mov eax, 0x30
ret
mov eax, 4
ret
mov eax, 5
ret
mov eax, 0x31
ret
mov eax, 0x32
ret
mov eax, 0x33
ret
mov eax, 0x34
ret
mov eax, 0x35
ret
mov eax, 0x36
ret
mov eax, 0x37
ret
mov eax, 0x38
ret
mov eax, 0x39
ret
mov eax, 0x3a
ret
mov eax, 0x3b
ret
mov eax, 0x3c
ret
mov eax, 0x3d
ret
mov eax, 0x3e
ret
mov eax, 0x3f
ret
mov eax, 0x40
ret
mov eax, 0x41
ret
mov eax, 0x42
ret
mov eax, 0x43
ret
mov eax, 0x44
ret
mov eax, 0x45
ret
mov eax, 0x46
ret
mov eax, 0x47
ret
mov eax, 0x48
ret
mov eax, 7
ret
mov eax, 0x49
ret
mov eax, 0x4a
ret
mov eax, 0x4b
ret
mov eax, 0x4c
ret
mov eax, 0xa
ret
mov eax, 0x4d
ret
mov eax, 0x4e
ret
mov eax, 0x4f
ret
mov eax, 0x51
ret
mov eax, 0x52
ret
mov eax, 0x53
ret
mov eax, 0x54
ret
mov eax, 0x55
ret
mov eax, 6
ret
mov eax, 0x56
ret
mov eax, 0x57
ret
mov eax, 0x58
ret
mov eax, 0x59
ret
mov eax, 0x5a
ret
mov eax, 0x5b
ret
mov eax, 0x5c
ret
mov eax, 0x5d
ret
mov eax, 0x5e
ret
mov eax, 0x5f
ret
mov eax, 0x60
ret
mov eax, 0x61
ret
mov eax, 0x62
ret
mov eax, 0x63
ret
mov eax, 0x64
ret
mov eax, 0x65
ret
mov eax, 0x66
ret
mov eax, 0x67
ret
mov eax, 0x68
ret
mov eax, 0x69
ret
mov eax, 0x6a
ret
mov eax, 0x6b
ret
xor eax, eax
ret
Function at 0x40e170
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ed860
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x673f64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00454d05
mov esi, eax
add esp, 4
test esi, esi
je 0x40e1d0
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0059d701
add esp, 4
mov dword [esi + 4], eax
jmp 0x40e1d2
xor esi, esi
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411530
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor ebx, ebx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, 1
mov edi, eax
cmp dword [ebp - 8], esi
jle 0x4115ac
nop word [eax + eax]
push dword [edi + esi*4]
push str.RESUMEDOWNLOADING
call fcn.005b1c6e
add esp, 8
test eax, eax
je 0x4115a7
push dword [edi + esi*4]
push str.RESUMEINSTALLING
call fcn.005b1c6e
add esp, 8
test eax, eax
je 0x4115a0
inc esi
cmp esi, dword [ebp - 8]
jl 0x411570
jmp 0x4115ac
mov ebx, 2
jmp 0x4115ac
mov ebx, 1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret