joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405070
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d12ae
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6639c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x66d4ac]
test eax, eax
jne 0x4050ca
push 0x58
call fcn.0058b701
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0040a5c0
mov dword [ebp - 4], 0xffffffff
mov dword [0x66d4ac], eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, eax
call fcn.0040b0b0
mov dword [ebp - 4], 1
cmp byte [ebx + 0x1e0], 0
je 0x405144
cmp dword [0x66d4ac], 0
jne 0x40510f
push 0x58
call fcn.0058b701
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0040a5c0
mov byte [ebp - 4], 1
mov dword [0x66d4ac], eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040b1d0
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00406c20
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405144
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40516d
push 0x631874
push 0x633088
push str.cef_load
call fcn.0046d340
add esp, 0xc
xor edi, edi
jmp 0x4051dd
push esi
lea ecx, [ebx + 0x1a8]
call fcn.00403500
mov dword [ebx + 0x1cc], eax
test eax, eax
je 0x4051b7
mov ecx, dword [ebx + 0x19c]
cmp dword [ecx - 0xc], 0
je 0x4051ab
push 0
push ecx
mov edi, esp
add ecx, 0xfffffff0
mov dword [ebp - 0x18], edi
call fcn.00407330
add eax, 0x10
mov ecx, ebx
mov dword [edi], eax
call fcn.00404910
push 0x631874
push 0x633064
jmp 0x4051ca
push 3
mov ecx, ebx
call fcn.004043d0
push 0x631874
push 0x633088
push str.cef_load
call fcn.0046d340
mov edi, dword [ebx + 0x1cc]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4051fc
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408ee0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d16fa
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6639c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [ebp - 4], 2
call fcn.00402bb0
mov ecx, eax
test ecx, ecx
jne 0x408f55
push 0x80004005
call fcn.00402480
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x18], eax
mov byte [ebp - 4], 3
call fcn.00402bb0
mov ecx, eax
test ecx, ecx
jne 0x408f79
push 0x80004005
call fcn.00402480
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x1c], eax
mov byte [ebp - 4], 4
call fcn.00402bb0
mov ecx, eax
test ecx, ecx
jne 0x408f9d
push 0x80004005
call fcn.00402480
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x20], eax
mov byte [ebp - 4], 5
call fcn.00402bb0
mov ecx, eax
test ecx, ecx
jne 0x408fc1
push 0x80004005
call fcn.00402480
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x24], eax
lea esi, [edi + 0x28]
mov byte [ebp - 4], 6
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040e5d0
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1732
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6639c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0x30]
call fcn.0040db20
mov eax, dword [ebx + 0x28]
lea ecx, [ebx + 0x28]
push eax
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.0040dde0
push dword [ebx + 0x28]
call fcn.0058b4a5
mov edx, dword [ebx + 0x24]
or esi, 0xffffffff
add esp, 4
sub edx, 0x10
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40908a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebx + 0x20]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4090a4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebx + 0x1c]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4090be
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebx + 0x18]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4090d8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
mov edi, dword [ebx + 0x14]
test edi, edi
je 0x409105
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x409105
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x409105
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov dword [ebp - 4], 1
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x409132
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x409132
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x409132
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov dword [ebp - 4], 2
mov edi, dword [ebx + 4]
test edi, edi
je 0x40915e
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x40915e
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], esi
dec esi
jne 0x40915e
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a530
Capabilities:
Get file size

Disassembly:
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40a555
xor eax, eax
pop edi
ret
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
ret
Function at 0x40a570
Capabilities:
Get file size

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x40a578
mov ecx, dword [ecx]
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40a59d
xor eax, eax
pop edi
ret
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
ret

Function at 0x40a5c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d17ef
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6639c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], eax
mov byte [ebp - 4], 1
lea ecx, [esi + 0x28]
push esi
mov dword [esi], vtable.CWebViewMgr.0
mov dword [esi + 4], vtable.CWebViewMgr.1.0
call fcn.0040d480
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
call fcn.00402bb0
mov ecx, eax
test ecx, ecx
jne 0x40a65d
push 0x80004005
call fcn.00402480
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x44], eax
mov byte [ebp - 4], 4
call fcn.00402bb0
mov ecx, eax
test ecx, ecx
jne 0x40a681
push 0x80004005
call fcn.00402480
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x54], eax
mov byte [ebp - 4], 5
lea eax, [esi + 0x24]
push dword [ebp - 0x10]
mov dword [esi + 0x3c], 0
push eax
push 0x664430
mov dword [esi + 0x40], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], 0
call fcn.0040e890
add esp, 0xc
movzx eax, ax
lea ecx, [esi + 4]
push 0
push eax
push 0
push 0
push 0x56000000
push 0
push 0
push 0xfffffffffffffffd
call fcn.0040e7e0
mov eax, dword [esi + 0x2c]
mov dword [eax + 0x38], 0x40d150
mov dword [eax + 0x3c], 0
mov eax, dword [esi + 0x2c]
mov dword [eax + 0x30], 0x40d090
mov dword [eax + 0x34], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a890
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1858
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6639c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x32
xor eax, eax
mov dword [ebp - 0x14], 7
push str.https:__cdn.pdfxd.com_download_pdf_cefnew_small.7z
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00406d20
push str.cefncefnew_small.7z
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.004089b0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.0040aff0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
mov edx, dword [eax]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00408b90
add esp, 4
mov byte [ebp - 4], 3
mov eax, dword [eax]
test eax, eax
je 0x40a921
mov eax, dword [eax]
jmp 0x40a923
xor eax, eax
push eax
lea ecx, [ebp - 0x34]
call fcn.004064d0
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x40a93f
call fcn.00408cf0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 6
or edi, 0xffffffff
mov edx, dword [ebp - 0x38]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a960
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x40a970
call fcn.00408cf0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a996
xor ebx, ebx
jmp 0x40a9a8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.0047e6d0
movd xmm1, ebx
cvtdq2pd xmm1, xmm1
shr ebx, 0x1f
addsd xmm1, qword [ebx*8 + 0x6415f0]
ucomisd xmm1, xmm0
lahf
test ah, 0x44
jnp 0x40a9e1
comisd xmm0, xmmword [0x641470]
jbe 0x40a9e1
mov esi, 1
jmp 0x40a9e3
xor esi, esi
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x40a9ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x40aa14
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00408190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058b4aa
mov esp, ebp
pop ebp
ret
Function at 0x40aff0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1939
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x6639c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
mov edx, str.webview
mov dword [ebp - 0x14], 0
call fcn.0047d4b0
mov dword [ebp - 4], 0
push dword [esi]
mov dword [ebp - 0x14], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b056
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.cef
mov edx, esi
lea ecx, [ebp - 0x10]
call fcn.00406260
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b07f
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [ebp - 0x10]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b09a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b3c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d19f0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x6639c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call fcn.0040aff0
mov dword [ebp - 4], 0
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
or edi, 0xffffffff
test eax, eax
je 0x40b537
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x40b537
xor esi, esi
push 0x6339e4
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.00406260
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
push dword [esi + 0x6330a8]
mov edx, eax
call fcn.00406260
mov byte [ebp - 4], 0
add esp, 4
mov edx, dword [ebp - 0x1c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b468
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x14]
call ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
test eax, eax
mov eax, edi
je 0x40b525
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b48f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 4
cmp esi, 0x30
jb 0x40b420
push str.ceflibcef.dll
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x18]
call fcn.00406260
add esp, 4
lea edx, [ebp - 0x18]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.004815c0
mov byte [ebp - 4], 3
mov ecx, dword [0x67e368]
test ecx, ecx
jne 0x40b4d1
push 0x80004005
call fcn.00402480
push ecx
push dword [eax]
call fcn.005ac983
add esp, 8
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c]
test eax, eax
mov eax, edi
setne bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b4ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x18]
movzx esi, bl
add edx, 0xfffffff0
xor esi, 1
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b539
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40b539
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b537
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x40b558
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ce80
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1d60
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x6639c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x20], eax
push dword [eax + 0x44]
lea ebx, [eax + 0x44]
xor edi, edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d045
lea ecx, [ebp - 0x10]
call fcn.0040aff0
mov dword [ebp - 4], edi
mov edx, dword [eax]
mov ecx, dword [ebx]
call fcn.0049b1b0
neg eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
sbb edi, edi
add edx, 0xfffffff0
inc edi
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cefe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00402bb0
mov ecx, eax
test ecx, ecx
jne 0x40cf13
push 0x80004005
call fcn.00402480
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
test edi, edi
jne 0x40cff0
xorps xmm0, xmm0
lea ecx, [ebp - 0x14]
movlpd qword [ebp - 0x28], xmm0
call fcn.0040aff0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
push ecx
lea edx, [ebp - 0x1c]
mov ecx, eax
call fcn.0046dcb0
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp - 0x14]
add esp, 4
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cf73
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, ebx
lea ecx, [ebp - 0x18]
call fcn.004815c0
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebx]
cmp dword [ecx - 4], 1
jle 0x40cf96
push dword [ecx - 0xc]
mov ecx, ebx
call fcn.00406b10
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
call fcn.0058c380
mulsd xmm0, qword [0x641480]
sub esp, 8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebx]
movsd qword [esp], xmm0
push dword [eax]
call fcn.0040a530
push eax
lea eax, [ebp - 0x10]
push str.CEFUnzip_fileSize:_d_md5:_s_DiskFreeSpace:_.2f
push eax
call fcn.00408350
mov byte [ebp - 4], 1
add esp, 0x18
mov edx, dword [ebp - 0x18]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cfed
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x10]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
je 0x40d001
call fcn.0040b570
mov ecx, ebx
call fcn.00406630
mov ecx, 0x633110
test edi, edi
mov eax, 0x633108
push esi
cmove eax, ecx
push eax
push 0x6330e8
call fcn.0046d340
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40d045
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x20]
push 0
push edi
push 0xdadb
push dword [eax + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4106e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x4106fe
mov eax, 0x8000ffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea edi, [esi + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x410728
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x410722
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x410835
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov byte [edi + 0x18], 1
call ebx
mov dword [esi + 0x40], eax
test eax, eax
jne 0x41075e
cmp byte [edi + 0x18], al
je 0x410752
push edi
mov byte [edi + 0x18], al
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.00410400
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x410793
call fcn.00410400
push ecx
mov ecx, esi
mov edi, eax
call fcn.00410540
test eax, eax
jns 0x410833
test edi, edi
cmovns edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push edi
mov ecx, esi
call fcn.00410610
mov dword [esp + 0xc], eax
test eax, eax
jns 0x4107c1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esi
call fcn.00410540
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x41076e
push 0
push 0
push ebx
mov ecx, esi
call fcn.00410610
mov edi, eax
test edi, edi
jns 0x4107fb
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esi
call fcn.00410540
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x4108d0
push 0
push 0
call fcn.005b4575
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x41076e
push 0xffffffffffffffff
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x410833
call fcn.00410400
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410e50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d2044
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6639c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
lea edi, [esi + 0x20]
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [esi + 0x24], vtable.CSingletonBase_class_CCCMgr_.0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x28]
push esi
mov dword [esi], vtable.CCCMgr.0
mov dword [esi + 0x24], vtable.CCCMgr.1.0
call fcn.00411720
mov byte [ebp - 4], 2
call fcn.00402bb0
mov ecx, eax
test ecx, ecx
jne 0x410ee3
push 0x80004005
call fcn.00402480
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov byte [ebp - 4], 4
push dword [ebp - 0x10]
mov dword [esi + 0x40], 0
push edi
push 0x6644f0
call fcn.0040e890
add esp, 0xc
movzx eax, ax
mov ecx, esi
push 0
push eax
push 0
push 0
push 0x56000000
push 0
push 0
push 0xfffffffffffffffd
call fcn.0040e7e0
mov eax, dword [esi + 0x2c]
mov ecx, esi
mov dword [eax + 0x38], 0x411180
mov dword [eax + 0x3c], 0
call fcn.00411200
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413720
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d2434
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6639c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
lea edi, [esi + 0x20]
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [esi + 0x24], vtable.CCCCallback.0
mov dword [esi + 0x28], vtable.CSingletonBase_class_CKPMgr_.0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x2c]
push esi
mov dword [esi], vtable.CKPMgr.1.0
mov dword [esi + 0x24], vtable.CKPMgr.2.0
mov dword [esi + 0x28], vtable.CKPMgr.0
call fcn.00414890
mov byte [ebp - 4], 2
call fcn.00402bb0
mov ecx, eax
test ecx, ecx
jne 0x4137c1
push 0x80004005
call fcn.00402480
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x34], eax
mov byte [ebp - 4], 3
call fcn.00402bb0
mov ecx, eax
test ecx, ecx
jne 0x4137e5
push 0x80004005
call fcn.00402480
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x38], eax
mov byte [ebp - 4], 4
push dword [ebp - 0x10]
push edi
push 0x664610
call fcn.0040e890
add esp, 0xc
movzx eax, ax
mov ecx, esi
push 0
push eax
push 0
push 0
push 0x56000000
push 0
push 0
push 0xfffffffffffffffd
call fcn.0040e7e0
mov eax, dword [esi + 0x30]
mov dword [eax + 0x30], 0x413ac0
mov dword [eax + 0x34], 0
mov eax, dword [esi + 0x30]
mov dword [eax + 0x38], 0x40d150
mov dword [eax + 0x3c], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret