joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401929
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401964
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401960
lea ebx, [ebx]
cmp esi, eax
jae 0x401964
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401950
cmp esi, eax
jb 0x40196a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402c60
Capabilities:
Identify system language via api

Disassembly:
push 0xffffffffffffffff
push 0x454549
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x46bd84]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
call fcn.0042d67b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402cb1
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov dword [esp + 0x18], 0
mov eax, dword [0x4700f8]
mov dword [esp + 0xc], 1
test eax, eax
jne 0x402cdd
call fcn.00402db0
shr eax, 0x10
add eax, dword [esp + 0x24]
mov esi, eax
push esi
call fcn.0042d670
test eax, eax
je 0x402cf9
push esi
push eax
mov ecx, ebx
call fcn.00401a50
mov eax, ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 8

Function at 0x402db0
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov cx, ax
and eax, 0x3ff
shr cx, 0xa
add eax, 0xfffffffc
movzx ecx, cx
cmp eax, 0x15
ja case.0x402ddb.5
movzx edx, byte [eax + 0x402e90]
jmp dword [edx*4 + 0x402e68]
cmp cx, 2
je 0x402df9
cmp cx, 4
je 0x402df9
mov eax, 0x12c0404
mov dword [0x4700f8], eax
ret
mov eax, 0xfa0804
mov dword [0x4700f8], eax
ret
mov eax, 0x1f40413
mov dword [0x4700f8], eax
ret
mov eax, 0x28a040c
mov dword [0x4700f8], eax
ret
mov eax, 0x2bc0407
mov dword [0x4700f8], eax
ret
mov eax, 0x3840410
mov dword [0x4700f8], eax
ret
mov eax, 0x3b60411
mov dword [0x4700f8], eax
ret
mov eax, 0x4e20816
mov dword [0x4700f8], eax
ret
mov eax, 0x5780419
mov dword [0x4700f8], eax
ret
mov eax, 0x60e040a
mov dword [0x4700f8], eax
ret
mov eax, 0x409
mov dword [0x4700f8], eax
ret
Function at 0x404ad0
Capabilities:
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x455518
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x46bd84]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
call fcn.0042d67b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404b0f
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], 0
mov ecx, dword [0x4701d8]
push ecx
push str.APN_Stub
lea edx, [esp + 0x14]
push str._s__s
push edx
call fcn.0040f030
mov esi, dword [esp + 0x1c]
push 0
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
lea eax, [esp + 0x2c]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
call fcn.00421210
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
xor edx, edx
add esp, 0x24
test eax, eax
mov eax, dword [esp + 0x10]
setne dl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edi, edx
mov edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404b90
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404bb4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x407a50
Capabilities:
Copy file
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x456638
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebp
push esi
push edi
mov eax, dword [0x46bd84]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
push 0
push str._nocleanup
push 0x470130
call fcn.00403330
test eax, eax
jne 0x407c3f
mov esi, dword [0x470110]
test esi, esi
jne 0x407aba
push 0x28
call fcn.0042d2aa
add esp, 4
test eax, eax
je 0x407ab0
mov esi, eax
call fcn.00411010
jmp 0x407ab2
xor eax, eax
mov esi, eax
mov dword [0x470110], esi
mov eax, dword [esi + 8]
mov eax, dword [eax - 0xc]
test eax, eax
jne 0x407b3a
test esi, esi
je 0x407b3a
push 1
lea ecx, [esp + 0x18]
push ecx
call fcn.00409950
mov dword [esp + 0x58], 0
mov eax, dword [eax]
push 0
push eax
push esi
call fcn.00411660
mov edi, eax
mov dword [esp + 0x58], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407b11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test edi, edi
je 0x407b3a
mov eax, dword [esi + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push eax
call edx
mov eax, dword [esi + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ecx, [esi + 8]
mov dword [esi + 4], 0
call fcn.00401b90
lea eax, [esp + 0x14]
push eax
mov ecx, 0x470130
call fcn.004051a0
lea ecx, [esp + 0x18]
mov dword [esp + 0x58], 1
call fcn.0042fe3e
mov byte [esp + 0x58], 2
mov ebp, dword [esp + 0x14]
push 0
push ebp
lea ecx, [esp + 0x20]
call fcn.0042fed6
test eax, eax
je 0x407c0d
lea ecx, [esp + 0x18]
call fcn.0042fa58
mov eax, dword [ebp - 0xc]
lea edi, [eax + 2]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042d2e4
add esp, 4
push ebp
mov esi, eax
push edi
push esi
call fcn.0043de53
xor eax, eax
mov word [esi + edi*2 - 2], ax
add esp, 0xc
lea edx, [esp + 0x30]
mov ecx, 0x414
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], eax
push edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov word [esp + 0x50], ax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 3
mov dword [esp + 0x3c], esi
mov word [esp + 0x44], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x407c04
push ebp
call fcn.00409a60
add esp, 4
push esi
call fcn.0042d2d9
add esp, 4
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], 1
call fcn.0042fe67
lea eax, [ebp - 0x10]
mov dword [esp + 0x58], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407c3f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x4c
ret
Function at 0x409240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x455490
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
mov eax, dword [0x46bd84]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x40928c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x38
ret 4
lea ecx, [esp + 0xc]
call fcn.00430990
push 0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x48], 0
call fcn.0040eee0
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x1c]
push eax
push 0x9001
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 1
call fcn.00430d91
test eax, eax
jne 0x409323
mov esi, dword [esp + 0x28]
mov byte [esp + 0x3c], al
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov dword [esp + 0x1c], vtable.CFileException.0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4092fd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00430a6b
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x38
ret 4
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [esp + 0x14]
call fcn.004306c6
lea ecx, [esp + 0xc]
call fcn.0043092a
mov byte [esp + 0x3c], 0
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov dword [esp + 0x1c], vtable.CFileException.0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409374
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00430a6b
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x38
ret 4
Function at 0x409a60
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x260
mov eax, dword [0x46bd84]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebp
mov ebp, dword [esp + 0x26c]
push esi
push edi
push ebp
call ebx
test eax, eax
je 0x409b9f
lea esi, [eax + 5]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042d2e4
add esp, 4
push ebp
push str._s.
mov edi, eax
push esi
push edi
mov dword [esp + 0x24], edi
call fcn.0043dec2
push 0x24c
lea eax, [esp + 0x30]
push 0
push eax
mov dword [esp + 0x34], 0
call fcn.0043f900
add esp, 0x1c
lea ecx, [esp + 0x18]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
je 0x409b8b
cmp word [esp + 0x44], 0x2e
je 0x409b70
push ebp
call ebx
lea edx, [esp + 0x44]
push edx
mov esi, eax
call ebx
lea esi, [esi + eax + 2]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042d2e4
add esp, 4
mov edi, eax
lea eax, [esp + 0x44]
push eax
push ebp
push 0x45c72c
push esi
push edi
call fcn.0043dec2
add esp, 0x14
test byte [esp + 0x18], 0x10
je 0x409b54
push edi
call fcn.00409a60
add esp, 4
jmp 0x409b5f
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
call fcn.0042d2d9
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
add esp, 4
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409af8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call fcn.0042d2d9
add esp, 4
push 4
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [esp + 0x26c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043d85c
add esp, 0x260
ret

Function at 0x40a7d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
push 0
push 4
push 0
push 0
push 0x45e814
mov edi, eax
call fcn.0042f56d
mov esi, eax
lea ecx, [esi + 0x44]
test edi, edi
jne 0x40a7f8
xor eax, eax
jmp 0x40a810
mov eax, edi
push ebx
lea ebx, [eax + 2]
mov edi, edi
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x40a800
sub eax, ebx
sar eax, 1
pop ebx
push eax
push edi
call fcn.00401d70
lea ecx, [esi + 0x48]
test ebp, ebp
jne 0x40a822
xor eax, eax
jmp 0x40a836
mov eax, ebp
lea edi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x40a827
sub eax, edi
sar eax, 1
push eax
push ebp
call fcn.00401d70
mov ecx, dword [esi + 0x2c]
mov eax, dword [esp + 0x14]
push ecx
mov dword [esi + 0x4c], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esi + 0x2c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
pop ebp
ret
Function at 0x40b350
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x4575d0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46bd84]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0042d67b
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40b395
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x18], vtable.CArray_struct_INCUMBENT_PROD_OBJ__struct_INCUMBENT_PROD_OBJ__.0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x38], 1
call fcn.004183b0
add esp, 4
test eax, eax
je 0x40b453
mov edx, dword [0x4701d8]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.00418b00
add esp, 8
cmp eax, 0xffffffff
je 0x40b453
cmp eax, ebx
jl 0x40b4cf
cmp eax, dword [esp + 0x20]
jge 0x40b4cf
mov edx, dword [esp + 0x1c]
lea ecx, [eax*8]
sub ecx, eax
lea esi, [edx + ecx*4]
lea eax, [esi + 0x10]
push eax
lea ecx, [esp + 0x18]
call fcn.0040f0a0
lea edx, [esi + 8]
lea ecx, [edi + 0x20]
push edx
call fcn.0040f0a0
lea eax, [esi + 0x14]
lea ecx, [edi + 0x1c]
push eax
call fcn.0040f0a0
lea edx, [esi + 0xc]
lea ecx, [edi + 0x24]
push edx
call fcn.0040f0a0
add esi, 4
lea ecx, [edi + 0x28]
push esi
call fcn.0040f0a0
mov ebp, dword [esp + 0x14]
cmp dword [ebp - 0xc], ebx
jne 0x40b4d4
mov esi, dword [0x4701d4]
call fcn.0040f520
push 0xd
push str.internalError
mov ecx, 0x4701f0
call fcn.00401d70
mov eax, dword [0x4701e0]
cmp eax, ebx
je 0x40b494
mov ecx, dword [0x4701d8]
push ecx
push str.Error:_Cannot_find_incumbent_toolbar__s
push 1
push eax
call fcn.00417320
add esp, 0x10
lea edi, [esp + 0x18]
mov byte [esp + 0x34], 0
call fcn.0040e380
add ebp, 0xfffffff0
mov dword [esp + 0x34], 0xffffffff
lea edx, [ebp + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40b4c7
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
or eax, 0xffffffff
jmp 0x40b551
call fcn.0042d54b
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [esp + 0x3c]
mov ecx, dword [ecx]
push ebp
mov ebx, eax
call fcn.0040cc20
mov dword [esp + 0x3c], eax
call esi
mov esi, dword [esp + 0x3c]
sub eax, ebx
mov dword [edi + 8], eax
test esi, esi
je 0x40b51c
cmp esi, 0x669
je 0x40b51c
cmp esi, 0xbc2
je 0x40b51c
push str.msiInstallationFailure
mov ecx, 0x4701f0
call fcn.00401e60
lea edi, [esp + 0x18]
mov byte [esp + 0x34], 0
call fcn.0040e380
add ebp, 0xfffffff0
mov dword [esp + 0x34], 0xffffffff
lea edx, [ebp + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40b54f
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x40d420
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x456540
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46bd84]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
call fcn.0042d67b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40d461
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], 0
call fcn.0042d67b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40d493
push 0x80004005
call fcn.00401f60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x18]
push ecx
push str._delaystartup
push 0x470130
mov byte [esp + 0x34], 1
call fcn.00403330
lea edx, [esp + 0x14]
push edx
push str._waitproc
push 0x470130
call fcn.00403330
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
je 0x40d4f4
push eax
call fcn.0043de32
imul eax, eax, 0x3e8
add esp, 4
test eax, eax
je 0x40d4f4
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40d52e
push ecx
call fcn.0043de32
add esp, 4
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40d52e
push 0xffffffffffffffff
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [sym.imp.KERNEL32.dll_OpenMutexW]
push str.Apn_Stub_Synchronization_Mutex
push 0
push 0x100000
call ebp
mov esi, eax
test esi, esi
je 0x40d557
push 0x493e0
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Apn_Stub_Synchronization_Mutex
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, 1
mov dword [esp + 0x1c], eax
cmp edi, 2
jne 0x40d57f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Global_MSIExecute
push 0
push 0x100000
call ebp
mov esi, eax
test esi, esi
je 0x40d59f
push 0xffffffffffffffff
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 2
jle 0x40d572
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d5ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d5f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x40f2f0
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00433b52
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
push 0x80
push ecx
call edi
mov edx, dword [esi + 0x80]
mov eax, dword [esi + 0x20]
push edx
push 0
push 0x80
push eax
call edi
mov eax, dword [0x4700f8]
test eax, eax
jne 0x40f335
call fcn.00402db0
mov edi, eax
mov ecx, 0x40d
cmp di, cx
je 0x40f34f
mov edx, 0x3801
cmp di, dx
je 0x40f34f
xor eax, eax
jmp 0x40f354
mov eax, 1
push eax
push esi
call fcn.00414230
add esp, 8
push edi
push esi
call fcn.00413d90
call fcn.0040f470
pop edi
mov eax, 1
pop esi
ret

Function at 0x40fca0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.0043408e

Function at 0x411200
Capabilities:
Download url
Receive data

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, eax
mov eax, dword [0x4701e0]
push edi
mov dword [esp + 0x14], eax
call fcn.004120c0
xor edi, edi
cmp eax, edi
je 0x411230
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x411230
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push 0x46d358
push edi
push ecx
push edx
push edi
call sub.urlmon.dll_URLDownloadToFileW
xor ebx, ebx
mov ebp, eax
cmp ebp, edi
setge bl
cmp ebx, edi
jne 0x411344
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edi
push 0x2710
push eax
push ecx
call fcn.00448870
mov ecx, dword [esi + 0x1c]
cmp ecx, edx
jb 0x411344
ja 0x41129b
mov edx, dword [esi + 0x18]
cmp edx, eax
jbe 0x411344
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x4112d2
push str.Downloader_URL__:_Downloading_Failed_
push 1
push eax
call fcn.00417320
add esp, 0xc
mov eax, ebp
call fcn.00412120
cmp eax, edi
je 0x4112d2
push eax
mov eax, dword [esp + 0x18]
push str._t_t_t_t_tError____s.
push edi
push eax
call fcn.00417320
add esp, 0x10
test byte [esp + 0x44], 1
je 0x411333
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push 0x22
push ecx
push edx
push eax
mov ecx, esi
call fcn.00411350
mov ebx, eax
cmp ebx, edi
jne 0x411344
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push edi
push 0x2710
push eax
push ecx
call fcn.00448870
mov ecx, dword [esi + 0x1c]
cmp ecx, edx
jb 0x411344
ja 0x411333
mov edx, dword [esi + 0x18]
cmp edx, eax
jbe 0x411344
test byte [esp + 0x44], 0x20
jne 0x411344
push 0x1f4
jmp 0x41121e
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x24
ret 0x10
Function at 0x4168b0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x455259
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x46bd84]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
lea esi, [ebx + 8]
push ecx
lea edi, [esp + 0x18]
mov dword [esp + 0x24], 0x5f
call fcn.0041f530
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x2c]
mov dword [esp + 0x3c], 1
push eax
mov dword [esp + 0x2c], 0x5f
call fcn.0041f530
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416948
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
lea edi, [esp + 0x18]
mov dword [esp + 0x28], 0x5f
call fcn.0041f530
mov byte [esp + 0x38], 2
mov ecx, dword [esp + 0x20]
mov eax, dword [ebx]
push ecx
push str.DBR_Map
push eax
push ebp
call fcn.00420b30
add esp, 0x18
cmp dword [esp + 0x3c], 0
mov dword [esp + 0x24], 1
je 0x4169b2
mov edx, dword [ebp]
cmp dword [edx - 0xc], 0
jne 0x416a14
push 4
lea eax, [esp + 0x40]
push eax
push ebx
call fcn.00415c20
push eax
mov ecx, ebp
mov byte [esp + 0x34], 3
call fcn.0040f0a0
jmp 0x4169ef
mov ecx, dword [ebp]
cmp dword [ecx - 0xc], 0
jne 0x4169c5
push esi
mov ecx, ebp
call fcn.0040f0a0
jmp 0x416a14
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x40]
push 0x4603b8
push eax
call fcn.0040ddc0
add esp, 0xc
mov byte [esp + 0x30], 4
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov ecx, ebp
call fcn.00401630
mov byte [esp + 0x30], 2
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416a14
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416a39
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x30], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416a5e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret 8