joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410edc
Capabilities:
Capture webcam image
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x4c], 0
lea eax, [ebp - 4]
movaps xmm0, xmmword [0x459330]
push ebx
mov ebx, ecx
lea ecx, [ebp - 0x24]
mov edx, ecx
mov dword [ebp - 0x48], ecx
push esi
cmp eax, edx
movups xmmword [ebp - 0x24], xmm0
sbb esi, esi
movaps xmm0, xmmword [0x459320]
and esi, 0xfffffff8
add esi, 8
push edi
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x2c], esi
mov eax, dword [ecx]
push eax
push dword [ebx + 4]
mov dword [ebp - 0x50], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x410f63
mov esi, dword [ebp - 0x50]
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x410f42
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
add ecx, 4
inc eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], eax
cmp eax, esi
jne 0x410f23
mov esi, dword [ebx + 0x14]
xor ecx, ecx
push 0xf
pop eax
push 6
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x1c], cl
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x40], cl
lea ecx, [ebp - 0x40]
push 0x4554ec
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], eax
call fcn.00402637
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00406915
test al, al
je 0x410fc8
mov edx, 0x454444
lea ecx, [ebp - 0x1c]
call fcn.0040369d
mov byte [ebp - 0x41], 1
test al, al
jne 0x410fcc
mov byte [ebp - 0x41], 0
lea ecx, [ebp - 0x40]
call fcn.004025ed
lea ecx, [ebp - 0x1c]
call fcn.004025ed
cmp byte [ebp - 0x41], 0
je 0x41102f
lea eax, [ebp - 0x38]
mov ecx, 0x455944
push eax
call fcn.00415045
mov esi, eax
lea edi, [ebp - 0x14]
pop ecx
mov ecx, dword [ebx + 0xb0]
lea eax, [ebp - 0x30]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00413398
mov eax, dword [ebp - 0x14]
mov edx, 0x3f1
add eax, dword [ebp - 0x30]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
call fcn.004156f6
pop ecx
jmp 0x411037
lea ecx, [ebx + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x20]
push 5
push dword [ebx + 0x3c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x640000
push 0
push 0x401
push dword [ebx + 0x3c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x402
push dword [ebx + 0x3c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0x10]
mov edx, 0x42a
mov ecx, 0x130
cmp dword [eax + 0x64], 0x419
cmove ecx, edx
push ecx
lea ecx, [ebx + 0x98]
call fcn.0041535a
push 0
push 0x14
push 0x64
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429462
mov esp, ebp
pop ebp
ret
Function at 0x411310
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor edi, edi
mov word [ebp - 0x1c], ax
mov esi, ecx
movzx eax, word [ebp + 0xc]
mov dword [ebp - 0xc], edi
push 7
pop ebx
mov dword [ebp - 8], ebx
sub eax, 0x3fd
je 0x411358
sub eax, 0x21
je 0x41134b
sub eax, 0xe
jne 0x411390
mov edx, dword [esi + 0x10]
lea ecx, [ebp - 0x34]
call fcn.0040d03b
jmp 0x411363
mov edx, dword [esi + 0x10]
lea ecx, [ebp - 0x34]
call fcn.0040e696
push eax
lea ecx, [ebp - 0x1c]
call fcn.00405cf2
lea ecx, [ebp - 0x34]
call fcn.00402561
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push 5
cmovae eax, dword [ebp - 0x1c]
push edi
push edi
push eax
push 0x4558e8
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [esi + 0x80]
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], edi
push str.clicked_link
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x34], ax
call fcn.00406a3a
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00409b01
lea ecx, [ebp - 0x34]
call fcn.00402561
lea ecx, [ebp - 0x1c]
call fcn.00402561
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429462
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4114a5
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x100]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4114d1
push 0
push dword [esi + 0x100]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x411cca
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0x7d0
mov edi, ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor eax, eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push dword [ebp + 0x18]
lea ecx, [edi + 0x3c]
xor ebx, ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.004044ab
lea eax, [ebp + 8]
mov byte [edi + 0x54], 1
push eax
lea ecx, [edi + 0x18]
call fcn.00411fc1
push ebx
push ebx
push edi
push 0x411d40
push ebx
push ebx
call fcn.0043248e
mov ecx, dword [ebp + 0xc]
add esp, 0x18
test ecx, ecx
je 0x411d36
call fcn.00414d9d
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x414e76
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xa
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x414f02
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x414edb
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push 2
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x414edb
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x414edf
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x414f01
push edi
push ebx
push eax
call fcn.0042b290
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 4]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416785
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
call fcn.0041681f
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x416815
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x41680e
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [esi + 0xc], edx
test edx, edx
je 0x416805
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x416805
mov ecx, dword [ebp - 0x10]
mov al, 1
mov dword [esi + 0x10], ecx
jmp 0x416817
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.0041681f
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x41685d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
test eax, eax
je 0x4168cc
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4168cc
mov edx, dword [eax + 0x3c]
cmp dword [edx + eax], 0x4550
jne 0x4168cc
mov edx, dword [edx + eax + 0x98]
add eax, edx
neg edx
sbb edx, edx
and edx, eax
je 0x4168cc
lea eax, [edx + 8]
test eax, eax
je 0x4168cc
cmp byte [eax], 0x30
push esi
jne 0x4168bb
cmp byte [eax + 1], 0x82
jne 0x4168bb
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl ecx, 8
add eax, 0x13
add eax, ecx
and eax, 0xffffff8
jmp 0x4168bd
xor eax, eax
pop esi
test eax, eax
je 0x4168cc
mov dword [edi + 0x14], eax
mov al, 1
mov dword [edi + 0x18], edx
jmp 0x4168ce
xor al, al
pop edi
pop ebp
ret 4
Function at 0x416960
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov esi, edx
push esi
push 3
push ecx
push ecx
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x2e8], esi
call fcn.0041cd50
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0041cfc0
cmp dword [ebp - 0x10], 0
je 0x416ac0
cmp byte [ebp - 0x2e4], 0
jne 0x4169c8
push 0x250
lea eax, [ebp - 0x53c]
push 0
push eax
call fcn.0042b810
add esp, 0xc
jmp 0x4169e1
mov ecx, 0x94
lea esi, [ebp - 0x2e0]
lea edi, [ebp - 0x53c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2e8]
mov ebx, dword [ebp - 0x53c]
test bl, 1
je 0x416a04
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x20]
mov eax, ebx
cmovae ecx, dword [ebp - 0x20]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
shr ebx, 4
test bl, 1
je 0x416a37
push 1
mov edx, esi
lea ecx, [ebp - 0x20]
call fcn.00416960
add esp, 4
test al, al
je 0x416b27
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x416a49
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x416b27
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0041cfc0
push eax
lea ecx, [ebp - 0x20]
call fcn.00417f60
mov eax, dword [ebp - 0x24]
cmp eax, 8
jb 0x416ab6
mov ecx, dword [ebp - 0x38]
inc eax
cmp eax, 0x7fffffff
ja 0x416b6a
add eax, eax
cmp eax, 0x1000
jb 0x416aad
test cl, 0x1f
jne 0x416b6a
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x416b6a
sub ecx, eax
sub ecx, 4
cmp ecx, 0x1f
ja 0x416b6a
mov ecx, eax
push ecx
call fcn.0042945d
add esp, 4
cmp dword [ebp - 0x10], 0
jne 0x4169a7
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x416b07
mov ecx, dword [ebp - 0x20]
inc eax
cmp eax, 0x7fffffff
ja 0x416b6a
add eax, eax
cmp eax, 0x1000
jb 0x416afe
test cl, 0x1f
jne 0x416b6a
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x416b6a
sub ecx, eax
cmp ecx, 4
jb 0x416b6a
cmp ecx, 0x23
ja 0x416b6a
mov ecx, eax
push ecx
call fcn.0042945d
add esp, 4
mov bl, 1
lea ecx, [ebp - 0x2e4]
call fcn.0041cf10
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429462
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x416b66
mov ecx, dword [ebp - 0x20]
inc eax
cmp eax, 0x7fffffff
ja 0x416b6a
add eax, eax
cmp eax, 0x1000
jb 0x416b5d
test cl, 0x1f
jne 0x416b6a
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x416b6a
sub ecx, eax
cmp ecx, 4
jb 0x416b6a
cmp ecx, 0x23
ja 0x416b6a
mov ecx, eax
push ecx
call fcn.0042945d
add esp, 4
xor bl, bl
jmp 0x416b09
call fcn.0042e703
int3
Function at 0x416b70
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x416b9f
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429462
mov esp, ebp
pop ebp
ret
cmp eax, 0x104
jae 0x416d2f
lea eax, [ebp - 0x1c]
push eax
call fcn.00418fa0
push ecx
push 0x4564e8
mov ecx, eax
call fcn.00417950
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00417d90
cmp esi, 0xffffffff
je 0x416c1e
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.00418fa0
sub esp, 8
mov esi, eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.00418680
add esp, 4
mov edx, esi
mov ecx, eax
call fcn.00416960
add esp, 4
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00417d90
lea ecx, [ebp - 0x34]
call fcn.00417d90
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429462
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x416c28
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x416b8c
test bl, 1
je 0x416c5e
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x416c49
mov ecx, dword [edi]
mov eax, ebx
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x416d2f
test bl, 0x10
jne 0x416c88
cmp dword [edi + 0x14], 8
jb 0x416c6b
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429462
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 8], 7
push 2
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push 0x4564f0
push eax
mov dword [ebp - 0xc], 1
call fcn.0042a470
add esp, 8
lea edx, [ebp - 0x1c]
xor eax, eax
mov ecx, edi
mov word [ebp - 0x1a], ax
call fcn.00416960
add esp, 4
test al, al
mov eax, dword [ebp - 8]
setne bl
cmp eax, 8
jb 0x416d06
mov ecx, dword [ebp - 0x1c]
inc eax
cmp eax, 0x7fffffff
ja 0x416d42
add eax, eax
cmp eax, 0x1000
jb 0x416cfd
test cl, 0x1f
jne 0x416d42
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x416d42
sub ecx, eax
cmp ecx, 4
jb 0x416d42
cmp ecx, 0x23
ja 0x416d42
mov ecx, eax
push ecx
call fcn.0042945d
add esp, 4
test bl, bl
je 0x416d2f
cmp dword [edi + 0x14], 8
jb 0x416d12
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429462
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429462
mov esp, ebp
pop ebp
ret
call fcn.0042e703
int3

Function at 0x416d80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x416d88
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret
Function at 0x416da0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x218]
mov edi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x416e67
lea eax, [ebp - 0x218]
sub esp, 8
mov edx, esp
mov ecx, eax
mov dword [edx], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416de7
sub ecx, esi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x248]
call fcn.00417ce0
sub esp, 8
mov ecx, eax
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x416e13
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [ebp - 0x230]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.00417ce0
lea ecx, [ebp - 0x230]
call fcn.00419470
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.00417f60
lea ecx, [ebp - 0x230]
call fcn.00417d90
lea ecx, [ebp - 0x248]
call fcn.00417d90
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429462
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00429462
mov esp, ebp
pop ebp
ret
Function at 0x417890
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ecx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.004192a0
test al, al
jne 0x4178fc
mov ecx, esi
call fcn.004192a0
test al, al
jne 0x4178fc
cmp dword [edi + 0x10], 0x104
jae 0x4178fc
cmp dword [esi + 0x10], 0x104
jae 0x4178fc
cmp dword [esi + 0x14], 8
jb 0x4178c5
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x4178cd
mov edi, dword [edi]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4178fc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4178fc
test al, 1
je 0x4178f6
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 1
pop edi
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret
Function at 0x41f368
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0xc], 7
xor ecx, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], ecx
mov edi, edx
mov byte [ebp - 8], cl
lea ecx, [ebp - 0x20]
push str.HKEY_CURRENT_USER_
mov word [ebp - 0x20], ax
call fcn.004011fd
mov esi, eax
push str.SoftwareYandexYandexBrowser
mov ecx, esi
call fcn.00402462
push 0x5c
mov ecx, esi
call fcn.004012a9
mov esi, eax
push ebx
mov ecx, esi
call fcn.00402462
push 0x456770
mov ecx, esi
call fcn.004011fd
push edi
mov ecx, eax
call fcn.00402462
lea eax, [ebp - 0x20]
xor esi, esi
push eax
push eax
push 0x3c
push str.installer::StoreValueInRegistry
push esi
call fcn.00415c43
add esp, 0x14
lea ecx, [ebp - 0x20]
call fcn.00402561
sub esp, 0xc
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x24]
call fcn.00423bff
test eax, eax
jne 0x41f431
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x41f40c
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push esi
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x24], esi
je 0x41f43f
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429462
mov esp, ebp
pop ebp
ret

Function at 0x41f533
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], 7
xor ebx, ebx
lea ecx, [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x10], ebx
push str.Remove_HKEY_CURRENT_USER_
mov word [ebp - 0x20], ax
mov byte [ebp - 8], bl
call fcn.004011fd
mov esi, eax
push str.SoftwareYandexYandexBrowser
mov ecx, esi
call fcn.00402462
push 0x5c
mov ecx, esi
call fcn.004012a9
push edi
mov ecx, eax
call fcn.00402462
lea eax, [ebp - 0x20]
push eax
push eax
push 0x55
push str.installer::RemoveValueFromRegistry
push ebx
call fcn.00415c43
add esp, 0x14
lea ecx, [ebp - 0x20]
call fcn.00402561
sub esp, 0xc
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x24]
call fcn.00423bff
test eax, eax
jne 0x41f5c2
push edi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x24], ebx
je 0x41f5d0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429462
mov esp, ebp
pop ebp
ret
Function at 0x41f757
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
mov dword [ebp - 0x244], edx
lea eax, [ebp - 0x210]
mov edi, ecx
push ebx
push eax
call fcn.0042b810
add esp, 0xc
test edi, edi
jne 0x41f7ae
push 0x104
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x41f7ae
xor al, al
jmp 0x41f906
test edi, edi
lea esi, [ebp - 0x210]
push ebx
cmovne esi, edi
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x41f7a7
push ecx
push edi
lea ecx, [ebp - 0x240]
call fcn.0040d649
push dword [ebp - 0x240]
push edi
push ebx
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41f8de
lea eax, [ebp - 0x234]
mov dword [ebp - 0x230], ebx
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x234], ebx
push eax
push 0x4565c8
push dword [ebp - 0x240]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41f8de
cmp dword [ebp - 0x234], 0x34
jb 0x41f8de
xor eax, eax
mov dword [ebp - 0x21c], ebx
push str.Module:
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x218], 7
mov word [ebp - 0x22c], ax
mov byte [ebp - 0x214], bl
call fcn.004011fd
mov edi, eax
push esi
mov ecx, edi
call fcn.00402462
mov eax, dword [ebp - 0x230]
mov ecx, edi
push str._Version:
mov esi, dword [eax + 0x10]
call fcn.004011fd
push esi
mov ecx, eax
call fcn.004012f9
mov ecx, eax
mov eax, dword [ebp - 0x230]
push 0x2e
mov esi, dword [eax + 0x14]
call fcn.004012a9
push esi
mov ecx, eax
call fcn.004012f9
lea eax, [ebp - 0x22c]
push eax
push eax
push 0x95
push str.installer::GetFileVersion
push ebx
call fcn.00415c43
add esp, 0x14
lea ecx, [ebp - 0x22c]
call fcn.00402561
mov eax, dword [ebp - 0x230]
xor edx, edx
mov ecx, dword [eax + 0x10]
or edx, dword [eax + 0x14]
or ecx, ebx
mov eax, dword [ebp - 0x244]
mov bl, 1
mov dword [eax], edx
mov dword [eax + 4], ecx
cmp dword [ebp - 0x240], 0
je 0x41f904
mov ecx, dword [ebp - 0x238]
sub ecx, dword [ebp - 0x240]
push 1
push ecx
push dword [ebp - 0x240]
call fcn.0040113b
add esp, 0xc
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429462
mov esp, ebp
pop ebp
ret
Function at 0x41fb23
Capabilities:
Get common file path
Get disk size
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
mov bl, cl
call fcn.0042b810
add esp, 0xc
lea eax, [ebp - 0x210]
test bl, bl
push eax
push esi
push esi
push 0x1c
pop eax
push 0x26
pop ecx
cmovne eax, ecx
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x41fbcf
xor eax, eax
mov dword [ebp - 0x21c], ebx
push str.SHGetFolderPath_failed
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x218], 7
mov word [ebp - 0x22c], ax
mov byte [ebp - 0x214], bl
call fcn.004011fd
lea eax, [ebp - 0x22c]
push eax
push eax
push 0xb6
push str.installer::HasEnoughDiskSpace
push ebx
call fcn.00415c43
add esp, 0x14
lea ecx, [ebp - 0x22c]
call fcn.00402561
mov al, 1
jmp 0x41fc94
push ebx
push ebx
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x41fc25
push str.GetDiskFreeSpaceEx_failed
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], 7
mov word [ebp - 0x22c], ax
mov byte [ebp - 0x214], bl
call fcn.004011fd
lea eax, [ebp - 0x22c]
push eax
push eax
push 0xbc
jmp 0x41fbaf
cmp dword [ebp - 0x234], ebx
ja 0x41fc90
cmp dword [ebp - 0x238], 0x25800000
jae 0x41fc90
xor eax, eax
mov dword [ebp - 0x21c], ebx
push str.There_is_not_enough_disk_space_to_install_browser
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x218], 7
mov word [ebp - 0x22c], ax
mov byte [ebp - 0x214], bl
call fcn.004011fd
lea eax, [ebp - 0x22c]
push eax
push eax
push 0xc2
push str.installer::HasEnoughDiskSpace
push ebx
call fcn.00415c43
add esp, 0x14
lea ecx, [ebp - 0x22c]
call fcn.00402561
jmp 0x41fc92
mov bl, 1
mov al, bl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00429462
mov esp, ebp
pop ebp
ret

Function at 0x420bd8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x10], 0
xor eax, eax
push esi
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x20]
push edi
mov edi, ecx
mov dword [ebp - 0xc], 7
mov ecx, dword [ebp + 8]
push eax
call fcn.004201d6
cmp dword [ebp - 0x10], 0
pop ecx
je 0x420c42
and dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
push ecx
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x420c42
push esi
push dword [ebp - 0x24]
mov ecx, edi
call fcn.00420c5c
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x20]
call fcn.00402561
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00429462
mov esp, ebp
pop ebp
ret 4