joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409861
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi]
test ecx, ecx
je 0x409874
mov eax, dword [ecx]
call dword [eax + 0x78]
mov edi, eax
jmp 0x409876
xor edi, edi
test edi, edi
setne bh
test edi, edi
je 0x409888
cmp dword [esi + 0x308], 0
jmp 0x40988f
cmp byte [esi + 0x304], 0
sete bl
cmp dword [esi + 0x308], 0
jne 0x4098ad
cmp byte [esi + 0x304], 0
jne 0x4098ad
mov ecx, esi
call fcn.00402020
jmp 0x4098b4
mov ecx, esi
call fcn.004095f0
test bl, bl
je 0x4098cd
test edi, edi
je 0x4098c1
cmp dword [esi], 0
je 0x4098cd
mov dl, bh
mov ecx, esi
pop edi
pop esi
pop ebx
jmp fcn.00409440
pop edi
pop esi
pop ebx
ret

Function at 0x4098e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x304], 0
jne 0x40992f
cmp dword [esi + 0x308], 0
jne 0x40992f
mov ecx, dword [esi]
test ecx, ecx
je 0x409918
mov eax, dword [ecx]
call dword [eax + 0x80]
test eax, eax
jne 0x40992f
mov eax, dword [0x56be3c]
cmp byte [eax + 0xa8], 0
je 0x40992f
cmp dword [esi], 0
je 0x40992f
mov bl, 1
jmp 0x409931
xor bl, bl
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
mov byte [ebp - 0x28], 1
mov eax, 0
mov byte [ebp - 0x20], bl
sete al
lea eax, [eax*2 - 1]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x7c]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x70]
mov dword [ebp - 0x1c], eax
test bl, bl
je 0x40999f
mov ecx, dword [esi]
test ecx, ecx
je 0x409999
mov eax, dword [ecx]
call dword [eax + 0x78]
test eax, eax
je 0x40999f
mov ecx, dword [esi]
test ecx, ecx
je 0x409989
mov eax, dword [ecx]
call dword [eax + 0x78]
jmp 0x40998b
xor eax, eax
mov ecx, dword [eax + 0x28]
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
call eax
test al, al
jne 0x40999f
mov byte [ebp - 0x18], 1
jmp 0x4099a3
mov byte [ebp - 0x18], 0
cmp byte [esi + 0x94], 0
mov eax, dword [esi + 0x90]
mov dword [ebp - 0x14], eax
je 0x4099c2
cmp byte [esi + 0x95], 0
mov byte [ebp - 0x10], 1
jne 0x4099c6
mov byte [ebp - 0x10], 0
mov eax, dword [esi + 0xa0]
mov dword [ebp - 0xc], eax
mov eax, dword [0x56be3c]
mov al, byte [eax + 0xa9]
mov byte [ebp - 8], al
call dword [sym.imp.USER32.dll_GetFocus]
xor edx, edx
cmp dword [ebp + edx*8 - 0x2c], eax
je 0x4099f1
inc edx
cmp edx, 5
jb 0x4099e5
mov eax, dword [ebp - 0x30]
cmp edx, 5
jne 0x4099fd
mov edx, eax
neg edx
lea ecx, [eax + 5]
mov esi, 5
lea eax, [ecx + edx]
xor edx, edx
div esi
cmp byte [ebp + edx*8 - 0x28], 0
je 0x409a05
push dword [ebp + edx*8 - 0x2c]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
Function at 0x40dec0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x220], ecx
push 0
push eax
call fcn.004bef30
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x20c]
call fcn.0041ce70
mov esi, eax
mov edi, esi
test esi, esi
je 0x40df51
lea esp, [esp]
movzx eax, word [edi]
test ax, ax
je 0x40df39
push eax
call fcn.004c8e80
add esp, 4
mov word [edi], ax
add edi, 2
jne 0x40df20
mov edx, esi
lea ecx, [edx + 2]
mov edi, edi
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40df40
sub edx, ecx
sar edx, 1
jmp 0x40df53
xor edx, edx
add edx, edx
mov ecx, esi
call fcn.0041f250
push eax
push str.SumatraPDF__08x
call fcn.00419f30
add esp, 8
mov dword [ebp - 0x218], 3
mov edi, eax
push edi
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x40e032
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 4
push 0
push 0
cmp eax, 0xb7
push 0xf001f
push ebx
sete byte [ebp - 0x20d]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 0x214], ecx
test ecx, ecx
jne 0x40dfca
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40e032
cmp byte [ebp - 0x20d], 0
je 0x40e051
mov eax, dword [ecx]
push ecx
mov dword [ebp - 0x214], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.SUMATRA_PDF_FRAME
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov ebx, eax
test ebx, ebx
je 0x40e032
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0x21c], eax
je 0x40e048
push 0
push str.SUMATRA_PDF_FRAME
push ebx
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov ebx, eax
test ebx, ebx
jne 0x40e000
sub dword [ebp - 0x218], 1
js 0x40e06e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40df76
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
jmp 0x40e070
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x214]
push ecx
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x220]
mov dword [eax], ebx
xor ebx, ebx
push edi
call fcn.004bf8aa
push esi
call fcn.004bf8aa
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
Function at 0x416a50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
lea edx, [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.00429160

Function at 0x416c00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x10], edx
push edi
mov dword [ebp - 0xc], eax
xor edi, edi
mov ebx, 0x20019
lea ecx, [ebp - 4]
push ecx
push ebx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x416c86
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x416c7d
mov eax, dword [ebp - 8]
shr eax, 1
inc eax
push 2
push eax
call fcn.004bf417
add esp, 8
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x416c7d
push edi
call fcn.004bf8aa
add esp, 4
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x416caa
mov eax, dword [ebp - 0xc]
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
jne 0x416caa
cmp ebx, 0x20019
jne 0x416caa
mov edx, dword [ebp - 0x10]
mov ebx, 0x20119
jmp 0x416c18
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416cc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
test edi, edi
je 0x416ce5
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x416cd4
sub esi, ecx
sar esi, 1
jmp 0x416ce7
xor esi, esi
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push dword [ebp + 8]
push edx
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
pop ebp
ret

Function at 0x417260
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
push eax
mov dword [ebp - 4], eax
call fcn.004c8cd1
mov esi, eax
add esp, 4
test esi, esi
je 0x4172b5
push esi
push dword [ebp - 4]
push edi
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4172b5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x4f06a4
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4172b5
mov eax, dword [ebp - 4]
mov edi, dword [eax + 8]
push esi
call fcn.004bf8aa
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4172d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
jne 0x4172e8
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.004bef30
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x400
push eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x417330
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], 0
push 0x40
push eax
mov dword [ebp - 0x10], eax
mov edi, edx
mov dword [ebp - 0xc], eax
mov esi, ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x58]
push eax
call fcn.004bef30
add esp, 0xc
mov dword [ebp - 0x5c], 0x44
test esi, esi
je 0x417375
push esi
call fcn.004c91a0
add esp, 4
mov esi, eax
jmp 0x417377
xor esi, esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push edi
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4173ab
push esi
xor edi, edi
call fcn.004bf8aa
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x14]
push esi
call fcn.004bf8aa
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x417af0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
mov bl, dl
test edi, edi
jne 0x417b06
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
test bl, bl
jne 0x417b1c
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x417afe
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417b21
sub ecx, edx
sar ecx, 1
push esi
lea eax, [ecx + 1]
mov dword [ebp - 4], eax
add eax, eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x417b71
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x417b61
mov edx, dword [ebp - 4]
mov ecx, eax
push edi
call fcn.0041a480
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test bl, bl
jne 0x417b7b
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
test esi, esi
pop esi
pop edi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417b90
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x417ba6
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
cmp dword [ebp - 4], 0
je 0x417be9
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
push esi
call dword [sym.imp.USER32.dll_CopyImage]
mov esi, eax
push esi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
mov edi, eax
call dword [sym.imp.GDI32.dll_DeleteObject]
test edi, edi
setne al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
mov edi, eax
test edi, edi
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418280
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push 0
push 0
mov edi, ecx
push 0xe
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 8], eax
inc eax
push 2
push eax
mov dword [ebp - 4], eax
call fcn.004bf417
mov esi, eax
add esp, 8
test esi, esi
jne 0x4182b5
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 4]
push 0xd
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 8]
xor ecx, ecx
pop edi
mov word [esi + eax*2], cx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418c10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xa
push 0xbeb
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x418c53
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebx + 1]
push edi
call fcn.004c8cd1
mov esi, eax
add esp, 4
test esi, esi
je 0x418c76
push edi
push dword [ebp - 4]
push esi
call fcn.004e0070
add esp, 0xc
mov byte [esi + ebx], 0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418df0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
push 2
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0xd
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
cmp word [ebp - 4], 0x30
setne al
mov esp, ebp
pop ebp
ret
Function at 0x419080
Capabilities:
Enumerate files on windows

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x58]
test eax, eax
je 0x419098
push eax
call fcn.004c91a0
add esp, 4
mov esi, eax
jmp 0x41909a
xor esi, esi
push dword [edi + 0x5c]
call fcn.004bf8aa
add esp, 4
mov dword [edi + 0x5c], esi
mov edx, 0x4ef160
mov ecx, esi
call fcn.0041cdf0
mov esi, eax
lea eax, [edi + 0x68]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [edi + 0x64], eax
push esi
cmp eax, 0xffffffff
jne 0x4190d6
call fcn.004bf8aa
add esp, 4
xor al, al
jmp 0x4190e0
call fcn.004bf8aa
add esp, 4
mov al, 1
mov byte [edi + 0x2b8], al
test al, al
jne 0x4190ef
pop edi
xor eax, eax
pop esi
ret
mov ecx, edi
pop edi
pop esi
jmp fcn.00419100

Function at 0x419230
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
mov eax, dword [0x56800c]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push esi
push edi
mov dword [esp + 0x14], edx
mov edi, ecx
call fcn.0041cd60
mov esi, eax
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [esp + 0x1c], ebx
cmp ebx, 0xffffffff
jne 0x419278
xor bl, bl
jmp 0x4193b4
mov cl, byte [ebp + 8]
mov edi, 0x2e
test cl, cl
sete dl
mov byte [esp + 0x13], dl
lea esp, [esp]
test byte [esp + 0x20], 0x10
mov ax, word [esp + 0x4c]
je 0x4192c5
test cl, cl
je 0x419388
cmp di, ax
jne 0x4192cd
mov cx, word [esp + 0x4e]
test cx, cx
je 0x419388
cmp di, cx
jne 0x4192cd
xor ecx, ecx
cmp cx, word [esp + 0x50]
jmp 0x4192c7
test dl, dl
je 0x419388
mov ecx, 0x5c
lea ebx, [esp + 0x4c]
cmp cx, ax
je 0x4192e5
mov ecx, 0x2f
cmp cx, ax
jne 0x4192e9
lea ebx, [esp + 0x4e]
xor edx, edx
test esi, esi
je 0x419305
mov eax, esi
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4192f4
sub eax, edi
sar eax, 1
jmp 0x419307
xor eax, eax
movzx eax, word [esi + eax*2 - 2]
mov ecx, 0x5c
cmp cx, ax
je 0x419325
mov ecx, 0x2f
cmp cx, ax
je 0x419325
mov edx, 0x4f06a4
push ebx
mov ecx, esi
call fcn.00419a10
mov edi, dword [esp + 0x18]
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, edi
mov ebx, dword [edi]
lea eax, [ebx + 1]
push eax
call fcn.0040c470
test al, al
jne 0x41934d
xor eax, eax
mov byte [eax], al
mov eax, dword [edi + 0xc]
lea edi, [eax + ebx*4]
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
cmp eax, ebx
jbe 0x419370
sub eax, ebx
shl eax, 2
push eax
lea eax, [edi + 4]
push edi
push eax
call fcn.004bdaf0
add esp, 0xc
mov ecx, dword [esp + 0x14]
lea eax, [ebx + 1]
mov ebx, dword [esp + 0x1c]
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
mov dword [edi], eax
mov edi, 0x2e
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov cl, byte [ebp + 8]
mov dl, byte [esp + 0x13]
test eax, eax
jne 0x419290
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
cmp dword [eax], 0
seta bl
push esi
call fcn.004bf8aa
mov ecx, dword [esp + 0x278]
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
Function at 0x41a580
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov esi, ecx
push edi
push 4
mov word [ebp - 0xc], ax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x41a5ce
push 1
push 0x4ef06c
lea eax, [ebp - 0xc]
push 4
push eax
call fcn.004cb865
add esp, 0x10
push esi
push 0x4f06e8
call fcn.00419f30
mov esi, eax
add esp, 8
mov dword [ebp - 0x20], esi
test esi, esi
je 0x41a601
mov edi, esi
lea ecx, [edi + 2]
lea ebx, [ebx]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x41a5f0
sub edi, ecx
sar edi, 1
jmp 0x41a603
xor edi, edi
lea edx, [ebp - 0xc]
lea ecx, [edx + 2]
lea esp, [esp]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41a610
sub edx, ecx
sar edx, 1
test esi, esi
je 0x41a641
mov ecx, esi
lea ebx, [ecx + 2]
jmp 0x41a630
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a630
sub ecx, ebx
sar ecx, 1
jmp 0x41a643
xor ecx, ecx
add ecx, 3
mov eax, 0xaaaaaaab
imul ecx, edx
push 2
mul ecx
lea eax, [edi + 1]
shr edx, 1
add eax, edx
push eax
mov dword [ebp - 0x10], eax
call fcn.004bf417
mov edi, eax
add esp, 8
mov dword [ebp - 0x18], edi
test edi, edi
je 0x41a73b
mov ebx, edi
test esi, esi
je 0x41a691
mov ecx, esi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a680
sub ecx, edx
sar ecx, 1
jmp 0x41a693
xor ecx, ecx
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
inc edx
lea edx, [edx + edx*2]
sub edx, ecx
cmp word [esi], 0
mov dword [ebp - 0x14], edx
mov ecx, esi
je 0x41a736
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x1c], 3
jmp 0x41a6c0
mov ax, word [ecx]
add ecx, 2
mov word [ebx], ax
add ebx, 2
mov dword [ebp - 0x10], ecx
cmp word [ecx], 0
je 0x41a723
cmp edx, 2
jne 0x41a723
mov eax, ebx
mov ecx, esi
sub eax, edi
sar eax, 1
sub ecx, eax
jne 0x41a6ea
xor eax, eax
mov byte [eax], al
lea edi, [ebp - 0xc]
lea edx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x41a6f0
sub edi, edx
lea eax, [ecx - 1]
sar edi, 1
cmp edi, eax
jb 0x41a708
mov edi, eax
push edi
lea eax, [ebp - 0xc]
push eax
push ecx
push ebx
call fcn.004cb865
mov ecx, dword [ebp - 0x10]
lea ebx, [ebx + edi*2]
mov edx, dword [ebp - 0x14]
add esp, 0x10
mov edi, dword [ebp - 0x18]
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x1c]
cmp word [ecx], 0
mov dword [ebp - 0x14], edx
jne 0x41a6c0
mov esi, dword [ebp - 0x20]
xor eax, eax
mov word [ebx], ax
push esi
call fcn.004bf8aa
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
Function at 0x41a760
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
fld qword [ebp + 8]
fmul qword [0x55dc38]
fnstcw word [ebp - 0xe]
movzx eax, word [ebp - 0xe]
or eax, 0xc00
mov dword [ebp - 8], eax
mov eax, 0x51eb851f
push ebx
push esi
push edi
fadd qword [0x55da58]
fldcw word [ebp - 8]
fistp qword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
fldcw word [ebp - 0xe]
mul esi
mov ebx, edx
shr ebx, 5
mov ecx, ebx
call fcn.0041a580
push 4
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x41a7de
push 1
push 0x4f06f0
lea eax, [ebp - 0xc]
push 4
push eax
call fcn.004cb865
add esp, 0x10
imul eax, ebx, 0x64
sub esi, eax
lea eax, [ebp - 0xc]
push esi
push eax
push edi
push 0x4f06f4
call fcn.00419f30
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41a846
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a801
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jb 0x41a846
dec ecx
mov edx, 0x4f0708
lea ecx, [esi + ecx*2]
call fcn.00419570
test al, al
je 0x41a846
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a830
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [esi + ecx*2 - 2], ax
push 0
call fcn.004bf8aa
push edi
call fcn.004bf8aa
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
Function at 0x41bbc0
Capabilities:
Check http status code
Create http request
Delete file
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x56bf24]
mov ecx, edx
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x420], ecx
push esi
push 0x80
push 2
push esi
push 1
push 0x40000000
push ecx
mov dword [ebp - 0x410], eax
xor bl, bl
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x40c], esi
mov dword [ebp - 0x41c], 4
mov dword [ebp - 0x414], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x408], edi
cmp edi, 0xffffffff
je 0x41bd1d
push esi
push esi
push esi
push esi
push str.BaseHTTP
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x418], eax
test eax, eax
je 0x41bd1d
push esi
push esi
push esi
push esi
push dword [ebp - 0x410]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
test esi, esi
je 0x41bd1d
push 0
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x20000013
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x41bd1d
cmp dword [ebp - 0x414], 0xc8
jne 0x41bd1d
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [ebp - 0x40c]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push esi
call edi
test eax, eax
je 0x41bd17
lea ecx, [ecx]
mov eax, dword [ebp - 0x40c]
test eax, eax
je 0x41bd15
push 0
lea ecx, [ebp - 0x410]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41bd17
mov eax, dword [ebp - 0x410]
cmp eax, dword [ebp - 0x40c]
jne 0x41bd17
lea eax, [ebp - 0x40c]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push esi
call edi
test eax, eax
jne 0x41bcc0
jmp 0x41bd17
mov bl, 1
mov edi, dword [ebp - 0x408]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test esi, esi
je 0x41bd31
push esi
call edi
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x41bd3e
push eax
call edi
test bl, bl
jne 0x41bd58
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41bd58
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
Function at 0x41bff0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
sub esp, 0x30
mov eax, esp
lea esi, [eax + 8]
mov dword [eax], str.https:__kjkpub.s3.amazonaws.com_sumatrapdf_sumpdf_update.txt_v3.1.2
mov dword [esi + 0x24], 0
mov ecx, dword [edx + 0x24]
test ecx, ecx
je 0x41c01c
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
lea ecx, [ebp - 0x28]
call fcn.0041c190
push 0x28
call fcn.004bcd25
mov esi, dword [ebp - 4]
mov edi, eax
add esp, 4
mov dword [edi + 0x24], 0
test esi, esi
je 0x41c048
mov edx, dword [esi]
mov ecx, esi
push edi
call dword [edx]
mov dword [edi + 0x24], eax
push 0
push 0
push edi
push 0x420dd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x41c07a
mov edx, dword [esi]
lea eax, [ebp - 0x28]
cmp esi, eax
mov ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret