joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4119ad
Capabilities:
Initialize winhttp library

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 4], edi
jne 0x4119ee
lea eax, [esi + 0x120]
cmp dword [eax + 0x18], 8
jb 0x4119c9
mov eax, dword [eax + 4]
jmp 0x4119cc
add eax, 4
push edi
push edi
push edi
push edi
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 4], eax
cmp eax, edi
jne 0x4119ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x114], eax
xor al, al
jmp 0x4119f0
mov al, 1
pop edi
pop esi
ret

Function at 0x4119f3
Capabilities:
Set http header

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x411a34
cmp dword [eax + 0x18], 8
jb 0x411a0c
mov eax, dword [eax + 4]
jmp 0x411a0f
add eax, 4
push 0x1000000
push ecx
push eax
push dword [esp + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x411a34
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x114], eax
xor al, al
jmp 0x411a36
mov al, 1
pop esi
ret 8

Function at 0x411d20
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x16
push dword [ebp + 8]
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
call esi
cmp eax, ebx
jne 0x411d52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x411da8
mov eax, dword [ebp - 8]
push edi
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004280de
mov edi, eax
pop ecx
cmp edi, ebx
je 0x411da7
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push edi
call fcn.0042a700
add esp, 0xc
push ebx
lea eax, [ebp - 8]
push eax
push edi
push ebx
push 0x16
push dword [ebp + 8]
call esi
test eax, eax
je 0x411da0
mov ecx, dword [ebp + 0xc]
push edi
call fcn.00405a65
mov byte [ebp - 1], 1
push edi
call fcn.004299f4
pop ecx
pop edi
mov al, byte [ebp - 1]
pop esi
pop ebx
leave
ret 8
Function at 0x41219e
Capabilities:
Prepare http request

Disassembly:
push 0x60
mov eax, 0x43e958
call fcn.00429953
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov byte [ebp - 0x66], bl
call fcn.004117d6
mov ecx, dword [esi + 0x1a4]
push 2
call fcn.00410288
test al, al
jne 0x4121d9
mov dword [esi + 0x114], 2
jmp 0x412365
push edi
lea ecx, [ebp - 0x64]
call fcn.00408e8d
mov dword [ebp - 4], ebx
cmp dword [esi + 0x28], ebx
je 0x412350
lea eax, [ebp - 0x64]
push eax
mov ecx, esi
call fcn.00411cc8
test al, al
je 0x412350
mov ecx, esi
call fcn.004119ad
test al, al
je 0x41235a
push dword [esi + 0x1a0]
push dword [esi + 0x19c]
push dword [esi + 0x198]
push dword [esi + 0x194]
push dword [esi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
push ebx
push 0x10000
push 0x411806
push dword [esi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
push 7
pop edi
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], edi
call fcn.004056a4
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], edi
call fcn.004056a4
lea eax, [ebp - 0x65]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
sub esp, 0x1c
lea eax, [esi + 0x14]
mov ecx, esp
mov dword [ebp - 0x6c], esp
push eax
mov byte [ebp - 4], 2
call fcn.00408e8d
mov ecx, esi
call fcn.00411ec7
cmp al, bl
je 0x412338
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x4122a0
lea eax, [ebp - 0x44]
push ebx
push dword [ebp - 0x6c]
push eax
push dword [esi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [esi + 8], eax
cmp eax, ebx
je 0x412331
movzx ecx, byte [ebp - 0x65]
mov edi, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
and ecx, 0x800000
cmp dword [ebp - 0x14], 8
jae 0x4122cf
lea edi, [ebp - 0x28]
cmp dword [ebp - 0x4c], 8
mov edx, dword [ebp - 0x60]
jae 0x4122db
lea edx, [ebp - 0x60]
push ecx
push ebx
push ebx
push ebx
push edi
push edx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 0xc], eax
cmp eax, ebx
je 0x412331
cmp byte [esi + 0x10], bl
jne 0x412301
cmp byte [ebp - 0x65], bl
je 0x412301
push eax
mov ecx, esi
call fcn.004113df
lea eax, [esi + 0xdc]
push eax
push dword [esi + 0xc]
mov ecx, esi
call fcn.004119f3
test al, al
je 0x412331
lea eax, [esi + 0xb8]
push eax
push dword [esi + 0xc]
mov ecx, esi
call fcn.00412144
test al, al
je 0x412331
mov byte [ebp - 0x66], 1
jmp 0x412338
mov ecx, esi
call fcn.004117d6
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040574b
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.0040574b
jmp 0x41235a
mov dword [esi + 0x114], 0x57
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.0040574b
mov al, byte [ebp - 0x66]
call fcn.004299d6
ret 4
Function at 0x412b1e
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov byte [ebp - 1], bl
call fcn.0041219e
test al, al
je 0x412bd2
lea eax, [esi + 0x15c]
cmp dword [eax + 0x18], 8
jb 0x412b4d
mov edx, dword [eax + 4]
jmp 0x412b50
lea edx, [eax + 4]
lea eax, [esi + 0x140]
cmp dword [eax + 0x18], 8
jb 0x412b61
mov ecx, dword [eax + 4]
jmp 0x412b64
lea ecx, [eax + 4]
lea eax, [esi + 0xf8]
cmp dword [eax + 0x18], 8
jb 0x412b75
mov eax, dword [eax + 4]
jmp 0x412b78
add eax, 4
push edx
push ecx
push eax
push dword [esi + 0xc]
mov ecx, esi
call fcn.0041143e
cmp byte [ebp + 0xc], bl
je 0x412b94
push dword [esi + 0xc]
mov ecx, esi
call fcn.00411404
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esi + 0xc]
call edi
test eax, eax
jne 0x412be9
push dword [esi + 0xc]
mov ecx, esi
call fcn.00411925
test al, al
je 0x412bd2
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esi + 0xc]
call edi
test eax, eax
jne 0x412be9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x114], eax
push dword [esi + 0x114]
mov ecx, esi
call fcn.004112f7
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 0x10
push dword [esi + 0xc]
mov ecx, esi
call fcn.004114f4
test al, al
je 0x412bd2
push ebx
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x412c1a
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [esi + 0xc]
call fcn.00412a92
mov byte [ebp - 1], al
jmp 0x412c26
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x114], eax
cmp byte [ebp - 1], bl
je 0x412bd2
mov ecx, esi
call fcn.004112e0
jmp 0x412bdf

Function at 0x413572
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.00412e20
xor eax, eax
push eax
push eax
push esi
push 0x413548
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x18], eax
pop esi
ret

Function at 0x413cbf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x2c], edi
jne 0x413d42
mov ecx, dword [esi + 0x10]
cmp ecx, edi
jle 0x413d42
mov eax, dword [esi + 0x14]
cmp eax, edi
jle 0x413d42
push edi
push 1
push eax
push ecx
call fcn.00409955
add esp, 0x10
mov dword [ebp + 8], eax
cmp eax, edi
je 0x413d3e
push ebx
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
mov ecx, esi
call fcn.004090cc
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x413d34
push edi
lea eax, [ebp - 4]
push eax
push dword [esi + 0x10]
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 0x4c], 1
push dword [ebp + 8]
call fcn.004299f4
pop ecx
pop ebx
mov al, 1
jmp 0x413d44
xor al, al
pop edi
pop esi
leave
ret
Function at 0x4169bd
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2020]
mov eax, 0x2020
call fcn.0042b440
push 0xffffffffffffffff
push 0x43eef6
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x44edb8]
xor eax, ebp
mov dword [ebp + 0x201c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004141d7
mov ecx, esi
call fcn.00416619
mov ecx, esi
call fcn.0040f082
lea edi, [esi + 0xcc]
mov eax, dword [edi]
push dword [eax + 0x36c]
mov ecx, esi
call fcn.0040f26f
mov eax, dword [edi]
add eax, 0x354
push eax
mov ecx, esi
call fcn.0040f2d1
xor eax, eax
push 0x1ffe
mov word [ebp + 0x1c], ax
xor edi, edi
lea eax, [ebp + 0x1e]
push edi
push eax
call fcn.0042a700
add esp, 0xc
push str.SoftwareMicrosoftInternet_Explorer
lea ecx, [ebp]
mov dword [ebp - 0x10], edi
call fcn.00405a89
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
mov dword [ebp - 4], edi
jae 0x416a6b
lea eax, [ebp + 4]
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push edi
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x416abd
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push str.Download_Directory
push dword [ebp - 0x10]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0x2000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416abd
lea eax, [ebp + 0x1c]
push eax
lea ecx, [esi + 0xb0]
call fcn.00405a65
cmp dword [esi + 0xc4], edi
jne 0x416ae2
push edi
push 0x10
lea eax, [ebp + 0x1c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x1c]
push eax
lea ecx, [esi + 0xb0]
call fcn.00405a65
lea eax, [esi + 0xb0]
cmp dword [eax + 0x18], 8
mov dword [ebp - 0x1c], 0x4424f0
jb 0x416afa
mov eax, dword [eax + 4]
jmp 0x416afd
add eax, 4
mov esi, dword [esi + 8]
push eax
push 0xf
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00405e46
push edi
push 1
lea ecx, [ebp]
call fcn.0040574b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x201c]
xor ecx, ebp
call fcn.004298db
add ebp, 0x2020
leave
ret

Function at 0x416fe7
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1fc], 0
jne 0x41703f
cmp byte [esi + 0x1e8], 0
je 0x41703f
push edi
push 0xfffffffffffffff0
lea edi, [esi + 0x108]
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffffff7
push eax
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 5
push dword [esi + 0x104]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1d20
push dword [esi + 8]
call dword [sym.imp.USER32.dll_KillTimer]
mov byte [esi + 0x1e8], 0
pop edi
pop esi
ret
Function at 0x417041
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
mov esi, ecx
mov eax, dword [esi + 8]
push 0x32
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push str.Installing...
push 0x32
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [esi + 8]
push 5
push 0x32
push eax
call edi
push eax
call ebx
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.00416f92

Function at 0x417086
Capabilities:
Get graphical window text

Disassembly:
push esi
xor eax, eax
mov esi, ecx
push eax
cmp byte [esi + 0x3d], al
je 0x41709e
call fcn.0040f5fb
mov ecx, esi
pop esi
jmp fcn.0040f679
call fcn.0040f93f
pop esi
ret
Function at 0x417b61
Capabilities:
Hide graphical window

Disassembly:
push ebp
sub esp, 0x21c
lea ebp, [esp - 4]
mov eax, dword [0x44edb8]
xor eax, ebp
mov dword [ebp + 0x21c], eax
push 4
mov eax, 0x43f08f
call fcn.004298ea
mov esi, ecx
cmp byte [esi + 0x1a0], 0
jne 0x417d16
xor edi, edi
cmp dword [ebp + 0x228], edi
je 0x417bbe
lea ecx, [esi - 0x5c]
call fcn.00416fe7
push edi
push dword [ebp + 0x228]
push 0x402
push dword [esi + 0xac]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x228]
push 0xa
cdq
pop ecx
idiv ecx
mov ebx, eax
mov dword [ebp - 0x10], ebx
cmp ebx, dword [esi + 0xb4]
je 0x417cf4
cmp dword [esi + 0xa8], edi
je 0x417cf4
push str._123i__
lea ecx, [ebp]
call fcn.00405a89
mov dword [ebp - 4], edi
mov edi, 0x4419f0
push edi
push 3
push 1
lea ecx, [ebp]
call fcn.00409fe1
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x417c15
lea eax, [ebp + 4]
push ebx
push eax
lea eax, [ebp + 0x1c]
push 0x100
push eax
call fcn.0042b4da
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
add esp, 0x10
push 0
push dword [esi + 0xa8]
call ebx
lea eax, [ebp + 0x1c]
push eax
push dword [esi + 0xa8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 5
push dword [esi + 0xa8]
call ebx
mov eax, dword [esi + 0x190]
cmp dword [eax + 0x1d4], 0
je 0x417cd1
push 0x442f5c
lea ecx, [ebp]
call fcn.00405a65
push edi
push 3
push 1
lea ecx, [ebp]
call fcn.00409fe1
push edi
push 3
push 8
lea ecx, [ebp]
call fcn.00409fe1
mov eax, dword [esi + 0x190]
add eax, 0x1c0
cmp dword [eax + 0x18], 8
jb 0x417c9e
mov eax, dword [eax + 4]
jmp 0x417ca1
add eax, 4
cmp dword [ebp + 0x18], 8
mov ecx, dword [ebp + 4]
jae 0x417cad
lea ecx, [ebp + 4]
push eax
push dword [ebp - 0x10]
lea eax, [ebp + 0x1c]
push ecx
push 0x100
push eax
call fcn.0042b4da
mov eax, dword [esi - 0x54]
add esp, 0x14
lea ecx, [ebp + 0x1c]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [ebp - 0x10]
lea ecx, [esi - 0x5c]
mov dword [esi + 0xb4], eax
call fcn.0040f750
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp]
call fcn.0040574b
xor edi, edi
mov ecx, dword [esi + 0x10c]
cmp ecx, edi
je 0x417d16
mov eax, dword [ebp + 0x228]
mov ebx, dword [ecx]
push edi
push 0x3e8
cdq
push edx
push eax
push dword [esi - 0x54]
push ecx
call dword [ebx + 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x21c]
xor ecx, ebp
call fcn.004298db
add ebp, 0x220
leave
ret 8
Function at 0x4183a4
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x43f1ff
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x44edb8]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44edb8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
push 0x1d20
push eax
mov byte [esi + 0x1ea], 1
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, esi
call fcn.0040f614
mov eax, dword [esi + 0x1ec]
add eax, 0x6e4
xor ebx, ebx
push eax
mov ecx, esi
mov byte [esi + 0x3d], bl
call fcn.0040f2d1
mov eax, dword [esi + 0x1ec]
add eax, 0x660
push eax
lea ecx, [esp + 0x1c]
call fcn.00408e8d
mov edi, 0x441eb4
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x44], ebx
call fcn.004065a4
mov eax, dword [esi + 0x1ec]
push 0xffffffffffffffff
push ebx
add eax, 0x67c
push eax
lea ecx, [esp + 0x24]
call fcn.00405f97
push edi
lea ecx, [esp + 0x1c]
call fcn.004065a4
mov eax, dword [esi + 0x1ec]
push 0xffffffffffffffff
push ebx
add eax, 0x698
push eax
lea ecx, [esp + 0x24]
call fcn.00405f97
mov eax, dword [esi + 8]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x34
push eax
call ebp
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push eax
mov dword [esp + 0x1c], eax
call edi
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x41849a
lea eax, [esp + 0x1c]
push eax
push 0x34
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [esi + 0x1ec]
push ebx
push dword [eax + 0x844]
lea ecx, [esi + 0x1f8]
push dword [esp + 0x1c]
call fcn.0040530b
push 5
push dword [esp + 0x18]
call edi
mov eax, dword [esi + 8]
push 5
push 8
push eax
call ebp
push eax
call edi
mov eax, dword [esi + 8]
push ebx
push 0x37
push eax
call ebp
push eax
call edi
mov eax, dword [esi + 8]
push ebx
push 0x32
push eax
call ebp
push eax
call edi
mov eax, dword [esi + 8]
push ebx
push 0x33
push eax
call ebp
push eax
call edi
mov eax, dword [esi + 8]
push ebx
push 0x3ea
push eax
call ebp
push eax
call edi
push 9
push dword [esi + 8]
call edi
push 1
push ebx
push dword [esi + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0x1f4]
cmp eax, ebx
je 0x418552
cmp byte [eax + 0x8c], bl
je 0x418552
mov eax, dword [esi + 8]
push 5
push 0x36
push eax
call ebp
push eax
call edi
mov eax, dword [esi + 8]
push 5
push 0x35
push eax
call ebp
push eax
call edi
push ebx
push dword [esi + 0x10c]
call edi
mov eax, dword [esi + 0x1ec]
add eax, 0x6b4
push eax
call fcn.004110f6
mov ecx, eax
call fcn.00411252
push ebx
push 1
lea ecx, [esp + 0x20]
call fcn.0040574b
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004298db
add esp, 0x30
ret
Function at 0x418595
Capabilities:
Get graphical window text

Disassembly:
push ebp
sub esp, 0x81c
lea ebp, [esp - 4]
mov eax, dword [0x44edb8]
xor eax, ebp
mov dword [ebp + 0x81c], eax
push 4
mov eax, 0x43f22f
call fcn.004298ea
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x1a0], bl
jne 0x4186a2
lea eax, [esi + 0x10c]
cmp dword [eax], ebx
je 0x4185e8
mov ecx, dword [eax]
mov edx, dword [esi - 0x54]
mov edi, dword [ecx]
push ebx
mov eax, 0x3e8
push eax
push ebx
push eax
push edx
push ecx
call dword [edi + 0x24]
mov ecx, dword [esi + 0xa4]
mov byte [ebp - 0xd], 1
call fcn.00413591
test al, al
je 0x418676
mov eax, dword [esi - 0x54]
push 0x400
lea ecx, [ebp + 0x1c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push str.Cannot_download_file_from:_r_n
lea ecx, [ebp]
call fcn.00405a89
push 0xffffffffffffffff
push ebx
lea eax, [esi + 0x110]
push eax
lea ecx, [ebp]
mov dword [ebp - 4], ebx
call fcn.00405f97
push str._r_n_Do_you_want_to_continue_
lea ecx, [ebp]
call fcn.004065a4
cmp dword [ebp + 0x18], 8
mov ecx, dword [ebp + 4]
jae 0x418649
lea ecx, [ebp + 4]
mov eax, dword [esi - 0x54]
push 4
lea edx, [ebp + 0x1c]
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x418662
mov byte [ebp - 0xd], bl
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp]
call fcn.0040574b
cmp byte [ebp - 0xd], bl
je 0x418698
lea edi, [esi - 0x5c]
mov ecx, edi
call fcn.004172de
mov ecx, edi
cmp dword [esi + 0x194], ebx
je 0x418691
call fcn.00417041
jmp 0x4186a2
call fcn.004183a4
jmp 0x4186a2
push 1
lea ecx, [esi - 0x5c]
call fcn.0040f93f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x81c]
xor ecx, ebp
call fcn.004298db
add ebp, 0x820
leave
ret 4
Function at 0x41ab13
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x44edb8]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0x45024c], 1
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x450230
jne 0x41ab5e
or dword [0x45024c], 1
push 0
mov ecx, ebx
mov dword [0x450248], 7
call fcn.004056a4
push 0x440b2a
call fcn.0042b2f9
pop ecx
cmp dword [esi + 0x14], 0
je 0x41acb8
push edi
xor eax, eax
push 0x616
push eax
mov word [ebp - 0x630], ax
lea eax, [ebp - 0x62e]
push eax
call fcn.0042a700
add esp, 0xc
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x41ab94
mov eax, dword [edi]
jmp 0x41ab96
mov eax, edi
push str.temp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41ac59
lea eax, [ebp - 0x630]
push eax
push 0x30c
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x44345c
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x630]
push eax
mov ecx, ebx
call fcn.00405a65
xor edi, edi
mov esi, 0x450234
cmp dword [0x450248], 8
mov eax, dword [0x450234]
jae 0x41ac00
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x41ac2a
cmp dword [0x450248], 8
mov eax, dword [0x450234]
jae 0x41ac1b
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41acb7
push edi
lea eax, [ebp - 0x18]
push 0x4423ac
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x630]
push eax
mov ecx, ebx
call fcn.00405a65
lea eax, [ebp - 0x18]
push eax
mov ecx, ebx
call fcn.004065a4
inc edi
jmp 0x41abf0
cmp dword [esi + 0x18], 8
jb 0x41ac63
mov eax, dword [edi]
jmp 0x41ac65
mov eax, edi
push str.download
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41ac7e
push ebx
call fcn.0040a213
pop ecx
jmp 0x41acb7
cmp dword [esi + 0x18], 8
jb 0x41ac86
mov edi, dword [edi]
push str.desktop
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41acb7
push 1
push 0x10
lea eax, [ebp - 0x630]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x630]
push eax
mov ecx, ebx
call fcn.00405a65
pop edi
cmp dword [0x450244], 0
mov eax, dword [ebp + 0xc]
je 0x41acc6
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004298db
leave
ret

Function at 0x4298db
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44edb8]
jne 0x4298e5
repz ret
jmp fcn.0043022c
Function at 0x43a53d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042f655
and dword [ebp - 4], 0
cmp dword [0x450fb4], 0
mov ebx, eax
jne 0x43a5ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43a69f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x43a69f
push eax
call fcn.0042f5e3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x450fb4], eax
call esi
push eax
call fcn.0042f5e3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x450fb8], eax
call esi
push eax
call fcn.0042f5e3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x450fbc], eax
call esi
push eax
call fcn.0042f5e3
pop ecx
mov dword [0x450fc4], eax
test eax, eax
je 0x43a5ee
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042f5e3
pop ecx
mov dword [0x450fc0], eax
mov eax, dword [0x450fc0]
cmp eax, ebx
je 0x43a646
cmp dword [0x450fc4], ebx
je 0x43a646
push eax
call fcn.0042f65e
push dword [0x450fc4]
mov esi, eax
call fcn.0042f65e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43a646
test edi, edi
je 0x43a646
call esi
test eax, eax
je 0x43a63d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43a63d
test byte [ebp - 0xc], 1
jne 0x43a646
or dword [ebp + 0x10], 0x200000
jmp 0x43a67f
mov eax, dword [0x450fb8]
cmp eax, ebx
je 0x43a67f
push eax
call fcn.0042f65e
pop ecx
test eax, eax
je 0x43a67f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43a67f
mov eax, dword [0x450fbc]
cmp eax, ebx
je 0x43a67f
push eax
call fcn.0042f65e
pop ecx
test eax, eax
je 0x43a67f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x450fb4]
call fcn.0042f65e
pop ecx
test eax, eax
je 0x43a69f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43a6a1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret