joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4f70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov edi, edx
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0xc0], eax
xor eax, eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb8], eax
lea esi, [ebx + 0xf]
test ebx, ebx
cmovns esi, ebx
mov eax, esi
sar eax, 4
inc eax
movzx eax, ax
movzx ecx, word [ebp + 8]
push ecx
push eax
push 6
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x4c500e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4c5047
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4c507c
and esi, 0xfffffff0
sub ebx, esi
test ebx, ebx
jle 0x4c50f2
mov esi, dword [esp + 4]
movzx ecx, word [eax]
lea eax, [eax + ecx*2]
add eax, 2
dec ebx
jne 0x4c4ffd
jmp 0x4c50f6
push 2
call fcn.005e42f0
add esp, 4
test al, al
je 0x4c50bf
call fcn.006a2ff0
lea edi, [esp + 8]
mov ecx, edi
push eax
push 2
push 0x39
push str.....operadesktopwindowsl10n_handler_resource_l10n_handler.cc
call fcn.006a3120
lea eax, [esp + 0x10]
push 0x15
push str.Failed_to_find_string
jmp 0x4c50af
push 2
call fcn.005e42f0
add esp, 4
test al, al
je 0x4c50bf
call fcn.006a2ff0
lea edi, [esp + 8]
mov ecx, edi
push eax
push 2
push 0x3f
push str.....operadesktopwindowsl10n_handler_resource_l10n_handler.cc
call fcn.006a3120
lea eax, [esp + 0x10]
push 0x15
push str.Failed_to_load_string
jmp 0x4c50af
push 2
call fcn.005e42f0
add esp, 4
test al, al
je 0x4c50bf
call fcn.006a2ff0
lea edi, [esp + 8]
mov ecx, edi
push eax
push 2
push 0x45
push str.....operadesktopwindowsl10n_handler_resource_l10n_handler.cc
call fcn.006a3120
lea eax, [esp + 0x10]
push 0x15
push str.Failed_to_lock_string
push eax
call fcn.0067fe70
add esp, 0xc
mov ecx, edi
call fcn.006a3180
mov eax, dword [esp + 0xb8]
mov esi, dword [esp + 4]
mov dword [esi + 8], eax
movsd xmm0, qword [esp + 0xb0]
movsd qword [esi], xmm0
mov ecx, dword [esp + 0xc0]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + 4]
movzx edx, word [eax]
add eax, 2
lea edi, [esp + 0xb0]
mov ecx, edi
push edx
push eax
call fcn.0053b7a0
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
je 0x4c5159
movzx eax, byte [esp + 0xbb]
test al, al
jns 0x4c5130
mov edi, dword [esp + 0xb0]
mov eax, dword [esp + 0xb4]
push 0
push ecx
push eax
push edi
push esi
call fcn.006a92f0
add esp, 0x14
cmp byte [esp + 0xbb], 0
jns 0x4c50da
push dword [esp + 0xb0]
call fcn.0064cd6e
add esp, 4
jmp 0x4c50da
mov eax, dword [esp + 0xb8]
jmp 0x4c50ca
Function at 0x4c79c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
mov dword [esi], 0
push esi
push 0x4c5170
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x4c7ab7
push 0x74582c
push 0x86
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
mov dword [ebp - 0x1c], 0
push esi
push 0x4c5170
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x4c7aba
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x1c], 0
push esi
push 0x4c5170
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x4c7abd
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
push esi
call fcn.00547e90
add esp, 0xc
movzx eax, byte [ebp - 0x11]
test al, al
jns 0x4c7a76
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
inc ecx
push 0
push ecx
push ecx
push 0x745834
push eax
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.005500a0
add esp, 0x1c
cmp byte [ebp - 0x11], 0
jns 0x4c7aa1
push dword [ebp - 0x1c]
call fcn.0064cd6e
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3
int3
int3
Function at 0x4cf6c0
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
xor eax, eax
xor ecx, ecx
cpuid
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x4cf7af
xor eax, eax
inc eax
xor ecx, ecx
cpuid
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], edx
mov edi, eax
cmp dword [ebp - 0x14], 7
mov ebx, 0
jb 0x4cf702
mov eax, 7
xor ecx, ecx
cpuid
and ebx, 0x20
mov dword [esi], edi
mov eax, edi
and eax, 0xf
mov dword [esi + 8], eax
shr edi, 0xc
and edi, 3
mov dword [esi + 4], edi
mov ecx, dword [ebp - 0x18]
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [esi + 0xc], al
mov eax, ecx
shr eax, 0x19
and al, 1
mov byte [esi + 0xd], al
shr ecx, 0x1a
and cl, 1
mov byte [esi + 0xe], cl
mov ecx, dword [ebp - 0x10]
mov eax, ecx
and al, 1
mov byte [esi + 0xf], al
mov eax, ecx
shr eax, 9
and al, 1
mov byte [esi + 0x10], al
mov eax, ecx
shr eax, 0x13
and al, 1
mov byte [esi + 0x11], al
mov eax, ecx
shr eax, 0x14
and al, 1
mov byte [esi + 0x12], al
mov eax, ecx
shr eax, 0x17
and al, 1
mov byte [esi + 0x13], al
mov eax, ecx
shr eax, 0x1f
mov byte [esi + 0x19], al
mov eax, ecx
not eax
test eax, 0x1c000000
jne 0x4cf7da
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [esi + 0x14], al
mov edx, dword [ebp - 0x10]
mov ecx, edx
shr ecx, 0x19
and cl, 1
mov byte [esi + 0x17], cl
shr edx, 0xc
and dl, 1
mov byte [esi + 0x15], dl
test al, al
setne al
test ebx, ebx
setne cl
and cl, al
mov byte [esi + 0x16], cl
mov eax, SysReAllocString
xor ecx, ecx
cpuid
cmp eax, reloc.OLEAUT32.dll_SysStringLen
jle 0x4cf7de
mov eax, reloc.WS2_32.dll_getsockopt
xor ecx, ecx
cpuid
and dh, 1
mov byte [esi + 0x18], dh
test dh, dh
je 0x4cf7e3
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x4cf786
mov dh, byte [esi + 0x18]
jmp 0x4cf7ce
cmp byte [esi + 0x19], 0
je 0x4cf7d2
mov eax, 0x40000000
xor ecx, ecx
cpuid
cmp ebx, 0x7263694d
jne 0x4cf7d2
cmp ecx, 0x666f736f
jne 0x4cf7d2
cmp edx, 0x76482074
jne 0x4cf7d2
mov byte [esi + 0x18], 1
jmp 0x4cf7d2
Function at 0x4d1910
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov ecx, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0x28], eax
test ecx, ecx
je 0x4d1b21
cmp dword [0x7abcc0], 0xe69e32f3
jne 0x4d1b24
mov edx, dword [ecx + 8]
lea esi, [edx + 0x1c8]
mov byte [esp + 0xf], 0xff
cmp byte [ecx + 3], 0
mov eax, esi
mov dword [esp + 4], esi
je 0x4d1b27
mov edx, 0x20
mov esi, 0x20
test eax, eax
je 0x4d1974
bsr esi, eax
xor esi, 0x1f
mov ecx, 0x7465e0
sub ecx, esi
mov cl, byte [ecx]
mov edi, eax
shr edi, cl
sub edx, esi
and edi, 3
and eax, dword [edx*4 + 0x7465e4]
lea ecx, [edi + edx*4]
cmp eax, 1
sbb ecx, 0xffffffff
movzx edi, word [ecx + ecx + 0x7464b4]
shl edi, 5
mov eax, dword [ebp + 8]
lea ebx, [eax + edi]
add ebx, 0x48
lea esi, [eax + 0x40]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4d1aeb
mov dword [esp + 8], esi
mov eax, dword [ebx]
mov esi, dword [eax]
test esi, esi
je 0x4d1a8c
mov byte [esp + 0xf], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x4d1ae1
mov edx, dword [ebp + 8]
mov ebx, dword [edx + edi + 0x54]
mov edi, edx
bswap ecx
mov edx, ecx
xor edx, esi
cmp edx, 0x1fffff
ja 0x4d1af7
mov edx, ecx
and edx, 0x1fc000
je 0x4d1af7
prefetcht0 byte [ecx]
mov dword [eax], ecx
mov ecx, dword [eax + 0xc]
lea edx, [ecx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [eax + 0xc], ecx
mov eax, dword [eax + 8]
mov ecx, dword [edi + 0x8fc]
add ecx, dword [eax + 0xc]
mov eax, dword [edi + 0x900]
mov dword [edi + 0x8fc], ecx
cmp eax, ecx
cmova ecx, eax
mov dword [edi + 0x900], ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, esi
push edi
call fcn.005d51e0
push esi
push dword [0x7ba6cc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x7ae174]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x90], esi
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 0xf]
mov ecx, ebx
push eax
push 0x4000
push dword [esp + 0xc]
push 2
mov edi, dword [ebp + 8]
push edi
call fcn.005d2330
test eax, eax
je 0x4d1b77
mov esi, eax
mov ecx, eax
and ecx, 0xffe00000
mov edx, eax
shr edx, 9
and edx, 0xfe0
lea eax, [edx + ecx]
movzx ecx, byte [edx + ecx + 0x101e]
and ecx, 0x3f
shl ecx, 5
sub eax, ecx
add eax, 0x1000
jmp 0x4d1a20
xor ecx, ecx
mov edi, dword [ebp + 8]
jmp 0x4d1a07
mov ecx, esi
call fcn.005d4e20
jmp 0x4d19bc
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi], xmm0
mov ecx, edi
push dword [esi]
push str.first
call fcn.00682160
push edi
call fcn.004a2a70
add esp, 4
mov ecx, ebx
call fcn.00682250
int3
int3
lea ecx, [edx + 0xc7]
mov eax, esi
cmp ecx, 0x7fefe
ja 0x4d1960
xor ecx, ecx
cmp esi, 1
sbb ecx, ecx
or ecx, 0x20
add edx, 0x1c7
je 0x4d1b70
bsr eax, edx
xor eax, 0x1f
sub ecx, eax
xor edx, edx
inc edx
shl edx, cl
mov eax, edx
shr eax, 1
lea eax, [eax + eax*4]
shr eax, 2
cmp eax, dword [esp + 4]
cmovb eax, edx
jmp 0x4d1960
mov eax, 0x20
jmp 0x4d1b53
xor esi, esi
jmp 0x4d1a43
Function at 0x4d1c10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x4d1c27
test eax, eax
je 0x4d1c27
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
jne 0x4d1c35
mov ecx, dword [0x7ba718]
test ecx, ecx
jne 0x4d1c71
cmp dword [0x7ba710], 0
je 0x4d1c21
mov esi, dword [0x7ba714]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x4d1c7b
test esi, esi
je 0x4d1c21
mov ecx, dword [0x7ba710]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x4d1c21
call dword [section..00cfg]
call ecx
jmp 0x4d1c35
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4d1c59
Function at 0x4d6710
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x218]
mov dword [esi], 0x101
lea edi, [ebp - 0x212]
push 0x202
push 0xff
push edi
call fcn.00650600
add esp, 0xc
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, eax
test eax, eax
je 0x4d6762
mov ecx, dword [ebp + 8]
push edi
call fcn.0053b8e0
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d98a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x224
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 0x214], esi
mov eax, dword [ecx]
mov dword [ebp - 0x22c], ecx
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x230], ecx
or ecx, 0x2001f
lea edi, [ebp - 0x210]
mov dword [edi], esi
push edi
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4d98f5
mov ebx, eax
jmp 0x4d99c5
mov ebx, dword [ebp - 0x210]
lea eax, [ebp - 0x21c]
mov dword [eax], ebx
mov ecx, dword [ebp - 0x230]
and ecx, 0x300
mov dword [eax + 4], ecx
xor eax, eax
dec eax
lea ecx, [ebp - 0x224]
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea eax, [ebp - 0x228]
mov dword [eax], 0x100
push 0x200
push 0xff
push edi
call fcn.00650600
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x228]
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4d997f
lea ecx, [ebp - 0x21c]
push edi
call fcn.004d98a0
test eax, eax
jne 0x4d99b2
mov dword [ebp - 0x228], 0x100
mov ebx, dword [ebp - 0x21c]
jmp 0x4d993f
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4d999a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov ecx, dword [ebp - 0x22c]
push dword [ebp + 8]
call fcn.004d9f90
mov ebx, eax
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4d99c5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0x224
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4de3a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, esp
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esi + 0xb8], eax
pxor xmm0, xmm0
movdqu xmmword [esi + 0x3c], xmm0
movdqu xmmword [esi + 0x5c], xmm0
movdqu xmmword [esi + 0x4c], xmm0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x34], 0x3c
mov dword [esi + 0x38], 0x40
mov dword [esi + 0x40], str.runas
xor ebx, ebx
dec ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea edi, [esi + 0x70]
push edi
call fcn.0053d900
cmp byte [edi + 0xb], 0
js 0x4de420
mov eax, dword [esi + 0x78]
mov dword [esi + 0x30], eax
movq xmm0, qword [esi + 0x70]
movq qword [esi + 0x28], xmm0
jmp 0x4de42e
lea ecx, [esi + 0x28]
push dword [esi + 0x74]
push dword [esi + 0x70]
call fcn.005df860
lea ecx, [esi + 0x70]
call fcn.005e1990
cmp byte [esi + 0x33], 0
jns 0x4de441
mov eax, dword [esi + 0x28]
jmp 0x4de444
lea eax, [esi + 0x28]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x44], eax
lea edi, [esi + 0x1c]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
push edi
call fcn.0053e4f0
cmp byte [edi + 0xb], 0
jns 0x4de464
mov edi, dword [esi + 0x1c]
lea eax, [esi + 0x34]
mov dword [eax + 0x14], edi
mov dword [eax + 0x1c], 5
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x70]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esi + 0xc]
push 0x176
push str.....operadesktopwindowsos_operationsos_operations_impl.cc
push str.RunElevatedProcess
push edi
call fcn.005e42b0
add esp, 0x10
mov ecx, ebx
push 0
push edi
call fcn.005eec20
lea eax, [esi + 0x34]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [esi + 4], esp
sub esp, 0xc
mov ebx, esp
lea ecx, [ebx + 4]
test eax, eax
je 0x4de4ce
push dword [esi + 0x6c]
jmp 0x4de4d0
push 0
call fcn.005f1b60
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov edi, dword [esi + 8]
mov eax, dword [edi]
mov ebx, dword [eax + 0x60]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
call ebx
mov esp, dword [esi + 4]
lea ecx, [esi + 0x70]
call fcn.005eec80
cmp byte [esi + 0x27], 0
jns 0x4de50a
push dword [esi + 0x1c]
call fcn.0064cd6e
add esp, 4
cmp byte [esi + 0x33], 0
mov edi, dword [ebp + 8]
jns 0x4de51e
push dword [esi + 0x28]
call fcn.0064cd6e
add esp, 4
mov ecx, dword [esi + 0xb8]
xor ecx, ebp
call fcn.0064d372
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4de550
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.005f29b0
Function at 0x4e3500
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov ebx, ecx
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], 0x73f3fc
cmp byte [ecx + 0x1c], 0
je 0x4e35d2
push 0x4c
push str.....operadesktopwindowsinstaller_transactionsdelete_file_operation.cc
call fcn.005e4320
add esp, 8
test eax, eax
jg 0x4e363c
lea esi, [ebx + 0x10]
push esi
call fcn.0054d370
add esp, 4
test al, al
jne 0x4e3558
push esi
call fcn.006a7e90
add esp, 4
cmp byte [ebx + 0x1e], 0
je 0x4e35f7
xor eax, eax
dec eax
lea edi, [ebp - 0xb4]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [ebp - 0xc4], ebx
lea ecx, [ebx + 4]
push edi
call fcn.005e1f90
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ebx, [ebp - 0xc0]
cmp byte [ebp - 0xa9], 0
mov eax, edi
jns 0x4e359f
mov eax, dword [ebp - 0xb4]
push eax
call esi
test eax, eax
je 0x4e35bf
mov ecx, edi
push ebx
call fcn.005e1f90
mov ecx, edi
push ebx
call fcn.005e1a10
mov ecx, ebx
call fcn.005e1990
jmp 0x4e358e
lea ecx, [ebp - 0xb4]
call fcn.005e1990
mov ebx, dword [ebp - 0xc4]
jmp 0x4e35f7
cmp dword [ebx + 0x20], 0
je 0x4e35f7
lea esi, [ebx + 0x20]
mov ecx, dword [0x7ba7b0]
test ecx, ecx
jne 0x4e35f1
call fcn.004dc890
mov ecx, eax
mov dword [0x7ba7b0], eax
push esi
call fcn.004dd550
mov edi, dword [ebx + 0x20]
mov dword [ebx + 0x20], 0
test edi, edi
je 0x4e3615
mov ecx, edi
call fcn.004de140
push edi
call fcn.0064cd6e
add esp, 4
lea ecx, [ebx + 0x10]
call fcn.005e1990
add ebx, 4
mov ecx, ebx
call fcn.005e1990
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [ebp - 0xb4]
mov ecx, edi
push 0xffffffffffffffff
push 0x25
push str.....operadesktopwindowsinstaller_transactionsdelete_file_operation.cc
call fcn.005417e0
lea eax, [ebp - 0xac]
push 0x12
push str.Actual_removal_of
push eax
call fcn.0067fe70
add esp, 0xc
lea ecx, [ebx + 0x10]
push ecx
push eax
call fcn.00542020
add esp, 8
mov ecx, edi
call fcn.00541c20
jmp 0x4e353f
Function at 0x4e4eb0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], 0x73f414
cmp byte [ecx + 0x20], 0
je 0x4e4f2a
xor eax, eax
dec eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [ebp - 0x2c], esi
lea ecx, [esi + 8]
push edi
call fcn.005e1f90
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ebx, [ebp - 0x28]
cmp byte [ebp - 0x11], 0
mov eax, edi
jns 0x4e4eff
mov eax, dword [ebp - 0x1c]
push eax
call esi
test eax, eax
je 0x4e4f1f
mov ecx, edi
push ebx
call fcn.005e1f90
mov ecx, edi
push ebx
call fcn.005e1a10
mov ecx, ebx
call fcn.005e1990
jmp 0x4e4ef4
lea ecx, [ebp - 0x1c]
call fcn.005e1990
mov esi, dword [ebp - 0x2c]
lea ecx, [esi + 0x14]
call fcn.005e1990
lea ecx, [esi + 8]
call fcn.005e1990
mov eax, dword [esi + 4]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x7b1224]
bt edx, ecx
jae 0x4e4f5c
push eax
call fcn.005e5140
add esp, 4
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4e6ad0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [0x7aa024]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov edi, dword [eax]
push edi
call fcn.0066b526
add esp, 4
cmp eax, 0x7ffffff0
jae 0x4e6bfc
mov ebx, eax
cmp eax, 5
jae 0x4e6b1e
lea esi, [ebp - 0x1c]
mov byte [esi + 0xb], bl
cmp ebx, 3
jne 0x4e6b49
movzx eax, word [edi + 4]
mov word [ebp - 0x18], ax
mov eax, dword [edi]
mov dword [ebp - 0x1c], eax
jmp 0x4e6b5c
mov dword [ebp - 0x20], edi
lea edi, [ebx + 8]
and edi, 0xfffffff8
lea eax, [edi + edi]
push eax
call fcn.0064cd3e
add esp, 4
mov esi, eax
mov dword [ebp - 0x1c], eax
or edi, 0x80000000
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x18], ebx
jmp 0x4e6b4d
test ebx, ebx
je 0x4e6b5c
mov eax, ebx
add eax, ebx
push eax
push edi
push esi
call fcn.00650080
add esp, 0xc
mov word [esi + ebx*2], 0
movzx ebx, byte [ebp - 0x11]
mov ecx, ebx
mov edx, dword [ebp - 0x1c]
test bl, bl
mov dword [ebp - 0x20], edx
jns 0x4e6b77
mov ebx, dword [ebp - 0x18]
jmp 0x4e6b7a
lea edx, [ebp - 0x1c]
add ebx, ebx
mov esi, ebx
cmp ebx, 4
jb 0x4e6ba9
imul eax, dword [edx], 0x5bd1e995
mov edi, eax
shr edi, 0x18
xor edi, eax
imul eax, edi, 0x5bd1e995
imul ebx, ebx, 0x5bd1e995
xor ebx, eax
add edx, 4
add esi, 0xfffffffc
cmp esi, 3
ja 0x4e6b83
cmp esi, 2
jne 0x4e6bc2
movzx eax, byte [edx + 1]
shl eax, 8
xor eax, ebx
movzx edx, byte [edx]
xor edx, eax
imul ebx, edx, 0x5bd1e995
mov eax, dword [ebp - 0x20]
test cl, cl
jns 0x4e6bd2
push eax
call fcn.0064cd6e
add esp, 4
mov eax, ebx
shr eax, 0xd
xor eax, ebx
imul eax, eax, 0x5bd1e995
mov esi, eax
shr esi, 0xf
xor esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.006626d0
int3
Function at 0x4ebf90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, ecx
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0x34], eax
mov eax, dword [0x7ba7f0]
mov ecx, dword [0x7ae174]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4ebfe7
mov eax, dword [0x7ba7ec]
mov dword [esi], eax
test eax, eax
je 0x4ebfd3
lock inc dword [eax]
mov ecx, dword [esp + 0x34]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x7ba7f0
call fcn.0064cde7
cmp dword [0x7ba7f0], 0xffffffff
jne 0x4ebfc5
mov eax, dword [0x7ba800]
mov ecx, dword [0x7ae174]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4ec0d7
mov dword [esp], 0x278
mov ecx, 0x7ba7f4
call fcn.0053ab70
sub esp, 4
mov edi, 0xfffffd88
movsx eax, byte [edi + 0x74d31e]
xor eax, 0x55
mov dword [esp], eax
mov ecx, 0x7ba7f4
call fcn.005df090
sub esp, 4
inc edi
jne 0x4ec036
xor eax, eax
lea edi, [esp + 0x18]
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
mov dword [esp + 4], edi
mov dword [esp], 0x7ba7f4
call fcn.006c4bd0
test al, al
je 0x4ec11e
mov byte [esp + 0x28], 1
mov dword [esp + 0x2c], 0x4e2
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
movsd xmm0, qword [esp + 0x28]
movsd qword [esp + 8], xmm0
mov dword [esp + 4], edi
lea eax, [esp + 0x14]
mov dword [esp], eax
call fcn.004ca760
cmp byte [esp + 0x23], 0
jns 0x4ec0bd
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.0064cd6e
mov eax, dword [esp + 0x14]
mov dword [0x7ba7ec], eax
mov dword [esp], 0x7ba7f0
call fcn.0064ce5d
jmp 0x4ebfc5
mov dword [esp], 0x7ba800
call fcn.0064cde7
cmp dword [0x7ba800], 0xffffffff
jne 0x4ec01d
xor eax, eax
mov dword [0x7ba7f8], eax
mov dword [0x7ba7f4], eax
mov dword [0x7ba7fc], eax
mov dword [esp], 0x4ec130
call fcn.0064d04d
mov dword [esp], 0x7ba800
call fcn.0064ce5d
jmp 0x4ec01d
int3