joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bde20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
dec edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
cmp ebx, edi
je 0x4bde66
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x4bde80
xor esi, esi
inc esi
lea eax, [ebp - 0x19]
push dword [ecx + 0x20]
push esi
push esi
push eax
call fcn.004a66f0
add esp, 0x10
cmp eax, esi
je 0x4bde68
jmp 0x4bde6a
xor ebx, ebx
mov edi, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f468
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x20]
mov dword [edx], eax
lea edi, [ebp - 0x19]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0xffffffff
mov esi, dword [ecx + 0x24]
mov eax, dword [ecx + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
mov ebx, dword [eax + 8]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x2c]
call ebx
cmp dword [ebp - 0x24], edi
je 0x4bdf21
mov ebx, eax
cmp eax, 3
je 0x4bdf09
cmp ebx, 1
ja 0x4bdf21
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
sub esi, ecx
mov eax, dword [ebp - 0x28]
push dword [eax + 0x20]
push esi
push 1
push ecx
call fcn.004a66f0
add esp, 0x10
cmp eax, esi
jne 0x4bdf21
mov edi, dword [ebp - 0x24]
cmp ebx, 1
mov ecx, dword [ebp - 0x28]
je 0x4bde8e
mov ebx, dword [ebp + 8]
jmp 0x4bde68
xor esi, esi
inc esi
mov eax, dword [ebp - 0x28]
push dword [eax + 0x20]
push esi
push esi
push edi
call fcn.004a66f0
add esp, 0x10
cmp eax, esi
je 0x4bdf01
xor edi, edi
dec edi
jmp 0x4bde6a

Function at 0x4bdf80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x4bdfab
push dword [ecx + 0x20]
push edi
push 2
push eax
call fcn.004a66f0
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
test edi, edi
jle 0x4bdfe7
mov dword [ebp - 0x10], ecx
xor edi, edi
mov esi, dword [ebp - 0x10]
movzx eax, word [eax + edi*2]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
mov ebx, dword [eax + 0x30]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push dword [ebp - 0x14]
call ebx
cmp ax, 0xffff
je 0x4bdfe9
inc edi
mov edx, dword [ebp + 0xc]
cmp edx, edi
mov eax, dword [ebp + 8]
jne 0x4bdfb7
mov edi, edx
jmp 0x4bdfe9
xor edi, edi
mov eax, edi
add esp, 8
jmp 0x4bdfa4
Function at 0x4bdff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
movzx esi, word [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp si, 0xffff
je 0x4be03d
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x4be055
lea eax, [ebp - 0x1a]
push dword [ecx + 0x20]
push 1
push 2
push eax
call fcn.004a66f0
add esp, 0x10
cmp eax, 1
je 0x4be03f
xor esi, esi
dec esi
jmp 0x4be03f
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f468
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x20]
mov dword [edx], eax
lea edi, [ebp - 0x1a]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0xffffffff
mov esi, dword [ecx + 0x24]
mov eax, dword [ecx + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
mov ebx, dword [eax + 8]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x2c]
call ebx
cmp dword [ebp - 0x24], edi
je 0x4be038
mov ebx, eax
cmp eax, 3
je 0x4be0e3
cmp ebx, 1
ja 0x4be038
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
sub esi, ecx
mov eax, dword [ebp - 0x28]
push dword [eax + 0x20]
push esi
push 1
push ecx
call fcn.004a66f0
add esp, 0x10
cmp eax, esi
jne 0x4be038
mov edi, dword [ebp - 0x24]
cmp ebx, 1
mov ecx, dword [ebp - 0x28]
je 0x4be063
movzx esi, word [ebp + 8]
jmp 0x4be03f
xor esi, esi
inc esi
mov eax, dword [ebp - 0x28]
push dword [eax + 0x20]
push esi
push esi
push edi
call fcn.004a66f0
add esp, 0x10
cmp eax, esi
jne 0x4be038
jmp 0x4be0da
Function at 0x4d1eb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.0048e8dd
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x4d1f00
push ecx
push ecx
call fcn.0049d5d0
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4d1eef
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x4d4ba0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x18a
push str..._.._base_files_file_util_win.cc
push str.DeleteFileAfterReboot
push ebx
call fcn.0046dd60
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004745e0
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x4d4c06
mov ecx, dword [edi + 4]
cmp ecx, 0x103
jbe 0x4d4c12
xor ebx, ebx
jmp 0x4d4c28
test al, al
jns 0x4d4c18
mov edi, dword [edi]
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
lea ecx, [esp + 0x10]
call fcn.00474640
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d5040
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x30]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x20]
push 0x8d
push str..._.._base_files_file_util_win.cc
push str.DoCopyFile
push esi
call fcn.0046dd60
add esp, 0x10
mov ecx, ebx
mov ebx, edi
push 0
push esi
call fcn.004745e0
mov ecx, edi
call fcn.0046d860
test al, al
jne 0x4d50bd
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.0046d860
test al, al
je 0x4d50dd
xor ebx, ebx
lea ecx, [esp + 0x30]
call fcn.00474640
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4d50e8
mov eax, dword [ebx + 4]
cmp eax, 0x103
ja 0x4d50bd
movzx eax, byte [edi + 0xb]
test al, al
jns 0x4d50fa
mov eax, dword [edi + 4]
cmp eax, 0x103
ja 0x4d50bd
mov dword [esp + 8], ebx
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x9a
push str..._.._base_files_file_util_win.cc
push str.DoCopyFile
push esi
call fcn.0046dd60
add esp, 0x10
mov ecx, ebx
push 0x526ad4
push esi
mov esi, edi
call fcn.00453710
cmp byte [edi + 0xb], 0
jns 0x4d5144
mov esi, dword [esi]
mov ecx, dword [esp + 8]
mov al, byte [ebp + 8]
movzx eax, al
cmp byte [ecx + 0xb], 0
jns 0x4d5156
mov ecx, dword [ecx]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4d5199
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x4d5185
mov eax, edi
and eax, 1
je 0x4d5185
mov eax, edi
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
setne bl
lea ecx, [esp + 0x20]
call fcn.00453840
jmp 0x4d50bf
xor ebx, ebx
jmp 0x4d518b
Function at 0x4d51c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x234
mov eax, dword [ebp + 8]
mov ecx, dword [0x520014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor esi, esi
mov edi, 0
test eax, eax
je 0x4d5206
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov edi, eax
test eax, eax
jne 0x4d5206
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0
cmp eax, 6
je 0x4d52ad
lea ebx, [ebp - 0x238]
push 0x228
push 0xff
push ebx
call fcn.004926b0
add esp, 0xc
mov dword [ebx - 4], 0x22c
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ebx, [ebp - 0x240]
mov dword [ebx], esi
mov ecx, ebx
push eax
call fcn.0046c180
mov eax, dword [ebx]
lea ecx, [eax + 1]
cmp ecx, 2
jae 0x4d527e
mov eax, dword [ebp - 0x240]
inc eax
cmp eax, 2
jb 0x4d5267
call fcn.0046dd90
push dword [ebp - 0x240]
call fcn.00470d70
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f468
mov eax, esi
add esp, 0x234
pop esi
pop edi
pop ebx
pop ebp
ret
lea ebx, [ebp - 0x23c]
push ebx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4d5248
cmp dword [ebp - 0x234], edi
je 0x4d52a5
push ebx
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32NextW
jmp 0x4d528b
mov esi, dword [ebp - 0x224]
jmp 0x4d5248
int3

Function at 0x4d52b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
jne 0x4d5302
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4d530a
cmp byte [ebp + 0xc], 0
jne 0x4d5330
mov ecx, esi
push edi
call fcn.004491b0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4d52d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x4d534a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4d534e
xor ebx, ebx
jmp 0x4d52ec
cmp byte [esi + 4], 0
je 0x4d537c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4d52e2
mov eax, dword [esi]
jmp 0x4d531c
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x4d5380
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4d52e2
mov edi, dword [ebp - 0x14]
jmp 0x4d52e2
mov eax, dword [esi]
jmp 0x4d533c
mov eax, dword [esi]
jmp 0x4d5361
Function at 0x4d5af0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
add ecx, 0x10
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edi, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.00439870
mov ecx, esi
push edi
call fcn.004d5fc0
cmp byte [edi + 0xb], 0
jns 0x4d5b44
push dword [ebp - 0x18]
call fcn.0048e90d
add esp, 4
mov ecx, esi
call fcn.004d6070
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0048f468
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret

Function at 0x4d5fc0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x14], eax
xor eax, eax
lea edi, [esp + 8]
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
mov edx, edi
call fcn.0044b1f0
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x4d5ffe
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4d6026
mov dword [esp + 4], 0
test al, al
jns 0x4d6012
mov edi, dword [esp + 8]
lea eax, [esp + 4]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
jne 0x4d604a
mov al, byte [esp + 0x13]
test al, al
jns 0x4d6036
push dword [esp + 8]
call fcn.0048e90d
add esp, 4
mov ecx, dword [esp + 0x14]
xor ecx, ebp
call fcn.0048f468
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret 4
mov edi, eax
mov ecx, esi
push eax
push dword [esp + 8]
call fcn.004d6260
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4d6022
Function at 0x4d7210
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov esi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x80], eax
mov ecx, dword [0x526b88]
test ecx, ecx
jne 0x4d72a0
movzx eax, byte [esi + 0x1b]
test al, al
jns 0x4d7244
mov eax, dword [esi + 0x14]
xor ebx, ebx
test eax, eax
je 0x4d7264
mov ecx, dword [esp + 0x80]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea edi, [esp + 0x70]
mov dword [edi], ebx
lea eax, [esp + 0x6c]
mov dword [eax], 4
push ebx
push eax
push edi
push 0x20000013
push dword [esi + 0x58]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
sete cl
mov eax, dword [edi]
cmp eax, 0xc8
setne bl
or bl, cl
cmp bl, 1
je 0x4d72bc
xor bl, 1
jmp 0x4d724a
push dword [ebp + 8]
call fcn.004d7210
mov ebx, eax
mov ecx, dword [esp + 0x80]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
jmp 0x4d725a
lea ecx, [esi + 0x10]
mov dword [esp + 4], ecx
xor ecx, ecx
dec ecx
lea edx, [esp + 0x74]
mov dword [edx + 4], ecx
mov dword [edx], ecx
mov word [edx + 8], 0xffff
push 0xa
push edx
push eax
call fcn.004a0ed1
add esp, 0xc
lea edi, [esp + 0x60]
mov ecx, edi
push str.final_query_info_
call fcn.004b9300
mov ecx, edi
lea eax, [esp + 0x74]
push eax
call fcn.0046b440
mov ecx, eax
push 0x508918
call fcn.0046b440
cmp byte [eax + 0xb], 0
jns 0x4d7311
mov eax, dword [eax]
mov edi, dword [esp + 4]
lea ecx, [esp + 8]
mov edx, eax
call fcn.004d6e60
cmp byte [edi + 0xb], 0
jns 0x4d7330
push dword [edi]
call fcn.0048e90d
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [edi + 8], eax
movsd xmm0, qword [esp + 8]
movsd qword [edi], xmm0
mov byte [esp + 0x13], 0
mov word [esp + 8], 0
cmp byte [esp + 0x6b], 0
jns 0x4d7360
push dword [esp + 0x60]
call fcn.0048e90d
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edi, [esp + 0x64]
push edi
call fcn.004bcc70
add esp, 8
lea ecx, [esp + 8]
push edi
push 0x144
push str.FinalizeDownload
push 1
call fcn.004bca70
lea edi, [esp + 0x10]
lea ecx, [esp + 0x44]
push 0x50c5ba
push str.Unsuccessful_download:
call fcn.004b9460
add esi, 4
mov ecx, edi
push esi
call fcn.00439510
lea ecx, [esp + 8]
call fcn.004bcab0
cmp byte [esp + 0x6b], 0
jns 0x4d73c8
push dword [esp + 0x60]
call fcn.0048e90d
add esp, 4
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4d729b
mov eax, dword [esp + 0x70]
mov dword [ecx], eax
jmp 0x4d729b
Function at 0x4d7520
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov edx, dword [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0xb8], eax
lea esi, [esp + 0x6c]
mov dword [esi], 0xffffffff
mov ecx, esi
call fcn.004d7680
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jae 0x4d758c
xor ebx, ebx
inc eax
cmp eax, 2
jb 0x4d7574
call fcn.0046dd90
push dword [esp + 0x6c]
call fcn.00470d70
add esp, 4
mov ecx, dword [esp + 0xb8]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x70]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov dword [esi + 0x40], 0xffffffff
lea eax, [esp + 0x68]
mov dword [eax], 0x44
push eax
push esi
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x4d7628
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 4]
push eax
push edi
call fcn.004bcc70
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push edi
push 0x5d
push str.IsUserAnAdminGroup
push 1
call fcn.004bca70
lea ecx, [esp + 0x4c]
push 0x50c60c
push str.CreateWellKnownSid_failed
call fcn.004b9460
mov ecx, esi
call fcn.004bcab0
cmp byte [edi + 0xb], 0
jns 0x4d761d
push dword [esp + 4]
call fcn.0048e90d
add esp, 4
xor ebx, ebx
mov eax, dword [esp + 0x6c]
jmp 0x4d755d
xor ebx, ebx
lea edi, [esp + 0x10]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, dword [esp + 0x6c]
mov edx, 2
push edi
call fcn.004d7740
add esp, 4
mov edi, dword [edi]
test al, al
je 0x4d766e
xor ebx, ebx
cmp dword [edi], 0
je 0x4d766e
push dword [edi + ebx*8 + 4]
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4d7669
inc ebx
cmp ebx, dword [edi]
jb 0x4d7655
test eax, eax
setne bl
test edi, edi
je 0x4d761f
push edi
call fcn.0048e90d
add esp, 4
jmp 0x4d761f
Function at 0x4d8c00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, edx
mov edi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x4d8c21
mov eax, dword [edi]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4d8cc8
mov ebx, eax
mov dword [ebp - 0x28], esi
xor eax, eax
dec eax
lea esi, [ebp - 0x1c]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push ebx
call fcn.004385a0
mov eax, dword [esi]
cmp byte [edi + 0xb], 0
jns 0x4d8c56
mov edi, dword [edi]
push eax
push ebx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
xor ebx, ebx
test eax, eax
je 0x4d8cb3
lea esi, [ebp - 0x20]
mov dword [esi], ebx
lea eax, [ebp - 0x24]
mov dword [eax], ebx
push esi
push eax
push 0x505448
push dword [ebp - 0x1c]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
sete al
cmp dword [esi], 0x34
setb bl
or bl, al
jne 0x4d8cb0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x30]
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x30], ecx
movups xmm0, xmmword [eax + 0x20]
movups xmmword [edx + 0x20], xmm0
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [edx + 0x10], xmm1
movups xmmword [edx], xmm0
xor bl, 1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4d8cca
mov dword [ebp - 0x18], eax
push eax
call fcn.0048e90d
add esp, 4
jmp 0x4d8cca
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d9060
Capabilities:
Get common file path
Get disk size
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x260
mov bl, byte [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x258], eax
xor edi, edi
lea esi, [esp + 0x50]
push 0x208
push edi
push esi
call fcn.004926b0
add esp, 0xc
test bl, bl
mov eax, 0x26
mov ecx, 0x1c
cmovne ecx, eax
push esi
push edi
push edi
push ecx
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4d90f4
xor eax, eax
dec eax
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx], eax
push edi
push edi
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4d911b
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 4]
mov bl, 1
cmp dword [esp], eax
sbb ecx, 0
jb 0x4d9150
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [esp + 8]
mov ecx, esi
push 0xe0
push str.HasEnoughDiskSpace
push 0
call fcn.0043a1a0
lea ecx, [esp + 0x44]
push 0x50cb62
push str.SHGetFolderPath_failed
jmp 0x4d9140
lea esi, [esp + 8]
mov ecx, esi
push 0xe6
push str.HasEnoughDiskSpace
push 0
call fcn.0043a1a0
lea ecx, [esp + 0x44]
push 0x50cb7c
push str.GetDiskFreeSpaceEx_failed
call fcn.004b9460
mov ecx, esi
call fcn.0043a3d0
mov bl, 1
jmp 0x4d90dc
lea esi, [esp + 8]
mov ecx, esi
push 0xec
push str.HasEnoughDiskSpace
push 0
call fcn.0043a1a0
lea ecx, [esp + 0x44]
push 0x50cbae
push str.There_is_not_enough_disk_space_to_install_browser
call fcn.004b9460
mov ecx, esi
call fcn.0043a3d0
xor ebx, ebx
jmp 0x4d90dc
Function at 0x4db780
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x68], eax
lea esi, [ecx + 4]
xor eax, eax
push esi
push eax
push eax
push 0x8004
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4db7dd
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov bl, 1
test eax, eax
je 0x4db818
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004bcc70
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push ebx
push 0x35
push str.HashData
push 1
call fcn.004bca70
lea ecx, [esp + 0x4c]
push 0x50f089
push str.Failed_to_initialize_hash_object__error:
jmp 0x4db851
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004bcc70
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push ebx
push 0x3a
push str.HashData
push 1
call fcn.004bca70
lea ecx, [esp + 0x4c]
push 0x50f0a6
push str.Failed_to_hash_data__error:
call fcn.004b9460
call edi
lea ecx, [esp + 0x18]
push eax
call fcn.004b9380
mov ecx, esi
call fcn.004bcab0
cmp byte [ebx + 0xb], 0
jns 0x4db87b
push dword [esp + 4]
call fcn.0048e90d
add esp, 4
xor ebx, ebx
jmp 0x4db7c6

Function at 0x4dbf70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ebx, edx
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4dbfd9
mov edi, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4dbfd9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4dbfd9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4dbfd9
mov edi, eax
mov ecx, esi
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00466730
push ebx
push edi
push dword [esi]
call fcn.00491bb0
add esp, 0xc
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret