joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c32b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov eax, dword [0x526014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
dec edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
cmp ebx, edi
je 0x4c32f6
mov byte [ebp - 0x19], bl
cmp byte [ecx + 0x2c], 0
je 0x4c3310
xor esi, esi
inc esi
lea eax, [ebp - 0x19]
push dword [ecx + 0x20]
push esi
push esi
push eax
call fcn.004abb50
add esp, 0x10
cmp eax, esi
je 0x4c32f8
jmp 0x4c32fa
xor ebx, ebx
mov edi, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004948c8
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x20]
mov dword [edx], eax
lea edi, [ebp - 0x19]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0xffffffff
mov esi, dword [ecx + 0x24]
mov eax, dword [ecx + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
mov ebx, dword [eax + 8]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x2c]
call ebx
cmp dword [ebp - 0x24], edi
je 0x4c33b1
mov ebx, eax
cmp eax, 3
je 0x4c3399
cmp ebx, 1
ja 0x4c33b1
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
sub esi, ecx
mov eax, dword [ebp - 0x28]
push dword [eax + 0x20]
push esi
push 1
push ecx
call fcn.004abb50
add esp, 0x10
cmp eax, esi
jne 0x4c33b1
mov edi, dword [ebp - 0x24]
cmp ebx, 1
mov ecx, dword [ebp - 0x28]
je 0x4c331e
mov ebx, dword [ebp + 8]
jmp 0x4c32f8
xor esi, esi
inc esi
mov eax, dword [ebp - 0x28]
push dword [eax + 0x20]
push esi
push esi
push edi
call fcn.004abb50
add esp, 0x10
cmp eax, esi
je 0x4c3391
xor edi, edi
dec edi
jmp 0x4c32fa

Function at 0x4c3410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x4c343b
push dword [ecx + 0x20]
push edi
push 2
push eax
call fcn.004abb50
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
test edi, edi
jle 0x4c3477
mov dword [ebp - 0x10], ecx
xor edi, edi
mov esi, dword [ebp - 0x10]
movzx eax, word [eax + edi*2]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
mov ebx, dword [eax + 0x30]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push dword [ebp - 0x14]
call ebx
cmp ax, 0xffff
je 0x4c3479
inc edi
mov edx, dword [ebp + 0xc]
cmp edx, edi
mov eax, dword [ebp + 8]
jne 0x4c3447
mov edi, edx
jmp 0x4c3479
xor edi, edi
mov eax, edi
add esp, 8
jmp 0x4c3434
Function at 0x4c3480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
movzx esi, word [ebp + 8]
mov eax, dword [0x526014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp si, 0xffff
je 0x4c34cd
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x4c34e5
lea eax, [ebp - 0x1a]
push dword [ecx + 0x20]
push 1
push 2
push eax
call fcn.004abb50
add esp, 0x10
cmp eax, 1
je 0x4c34cf
xor esi, esi
dec esi
jmp 0x4c34cf
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004948c8
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x20]
mov dword [edx], eax
lea edi, [ebp - 0x1a]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0xffffffff
mov esi, dword [ecx + 0x24]
mov eax, dword [ecx + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
mov ebx, dword [eax + 8]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x2c]
call ebx
cmp dword [ebp - 0x24], edi
je 0x4c34c8
mov ebx, eax
cmp eax, 3
je 0x4c3573
cmp ebx, 1
ja 0x4c34c8
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
sub esi, ecx
mov eax, dword [ebp - 0x28]
push dword [eax + 0x20]
push esi
push 1
push ecx
call fcn.004abb50
add esp, 0x10
cmp eax, esi
jne 0x4c34c8
mov edi, dword [ebp - 0x24]
cmp ebx, 1
mov ecx, dword [ebp - 0x28]
je 0x4c34f3
movzx esi, word [ebp + 8]
jmp 0x4c34cf
xor esi, esi
inc esi
mov eax, dword [ebp - 0x28]
push dword [eax + 0x20]
push esi
push esi
push edi
call fcn.004abb50
add esp, 0x10
cmp eax, esi
jne 0x4c34c8
jmp 0x4c356a
Function at 0x4d7340
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.00493d3d
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x4d7390
push ecx
push ecx
call fcn.004a2a30
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4d737f
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x4da1e0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x18a
push str..._.._base_files_file_util_win.cc
push str.DeleteFileAfterReboot
push ebx
call fcn.004712d0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00478af0
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x4da246
mov ecx, dword [edi + 4]
cmp ecx, 0x103
jbe 0x4da252
xor ebx, ebx
jmp 0x4da268
test al, al
jns 0x4da258
mov edi, dword [edi]
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
lea ecx, [esp + 0x10]
call fcn.00478b50
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4da680
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x30]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x20]
push 0x8d
push str..._.._base_files_file_util_win.cc
push str.DoCopyFile
push esi
call fcn.004712d0
add esp, 0x10
mov ecx, ebx
mov ebx, edi
push 0
push esi
call fcn.00478af0
mov ecx, edi
call fcn.00470c60
test al, al
jne 0x4da6fd
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.00470c60
test al, al
je 0x4da71d
xor ebx, ebx
lea ecx, [esp + 0x30]
call fcn.00478b50
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4da728
mov eax, dword [ebx + 4]
cmp eax, 0x103
ja 0x4da6fd
movzx eax, byte [edi + 0xb]
test al, al
jns 0x4da73a
mov eax, dword [edi + 4]
cmp eax, 0x103
ja 0x4da6fd
mov dword [esp + 8], ebx
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x9a
push str..._.._base_files_file_util_win.cc
push str.DoCopyFile
push esi
call fcn.004712d0
add esp, 0x10
mov ecx, ebx
push 0x52cb24
push esi
mov esi, edi
call fcn.00454eb0
cmp byte [edi + 0xb], 0
jns 0x4da784
mov esi, dword [esi]
mov ecx, dword [esp + 8]
mov al, byte [ebp + 8]
movzx eax, al
cmp byte [ecx + 0xb], 0
jns 0x4da796
mov ecx, dword [ecx]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4da7d9
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x4da7c5
mov eax, edi
and eax, 1
je 0x4da7c5
mov eax, edi
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
setne bl
lea ecx, [esp + 0x20]
call fcn.00454fe0
jmp 0x4da6ff
xor ebx, ebx
jmp 0x4da7cb
Function at 0x4da800
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x234
mov eax, dword [ebp + 8]
mov ecx, dword [0x526014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor esi, esi
mov edi, 0
test eax, eax
je 0x4da846
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov edi, eax
test eax, eax
jne 0x4da846
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0
cmp eax, 6
je 0x4da8ed
lea ebx, [ebp - 0x238]
push 0x228
push 0xff
push ebx
call fcn.00497b10
add esp, 0xc
mov dword [ebx - 4], 0x22c
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ebx, [ebp - 0x240]
mov dword [ebx], esi
mov ecx, ebx
push eax
call fcn.0046f070
mov eax, dword [ebx]
lea ecx, [eax + 1]
cmp ecx, 2
jae 0x4da8be
mov eax, dword [ebp - 0x240]
inc eax
cmp eax, 2
jb 0x4da8a7
call fcn.00471300
push dword [ebp - 0x240]
call fcn.00474440
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004948c8
mov eax, esi
add esp, 0x234
pop esi
pop edi
pop ebx
pop ebp
ret
lea ebx, [ebp - 0x23c]
push ebx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4da888
cmp dword [ebp - 0x234], edi
je 0x4da8e5
push ebx
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32NextW
jmp 0x4da8cb
mov esi, dword [ebp - 0x224]
jmp 0x4da888
int3

Function at 0x4da8f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x526014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
jne 0x4da942
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4da94a
cmp byte [ebp + 0xc], 0
jne 0x4da970
mov ecx, esi
push edi
call fcn.0044a480
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4da910
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x4da98a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4da98e
xor ebx, ebx
jmp 0x4da92c
cmp byte [esi + 4], 0
je 0x4da9bc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4da922
mov eax, dword [esi]
jmp 0x4da95c
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x4da9c0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4da922
mov edi, dword [ebp - 0x14]
jmp 0x4da922
mov eax, dword [esi]
jmp 0x4da97c
mov eax, dword [esi]
jmp 0x4da9a1
Function at 0x4db130
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x526014]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
add ecx, 0x10
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edi, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.0043b3a0
mov ecx, esi
push edi
call fcn.004db600
cmp byte [edi + 0xb], 0
jns 0x4db184
push dword [ebp - 0x18]
call fcn.00493d6d
add esp, 4
mov ecx, esi
call fcn.004db6b0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004948c8
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret

Function at 0x4db600
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0x14], eax
xor eax, eax
lea edi, [esp + 8]
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
mov edx, edi
call fcn.0044c520
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x4db63e
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4db666
mov dword [esp + 4], 0
test al, al
jns 0x4db652
mov edi, dword [esp + 8]
lea eax, [esp + 4]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
jne 0x4db68a
mov al, byte [esp + 0x13]
test al, al
jns 0x4db676
push dword [esp + 8]
call fcn.00493d6d
add esp, 4
mov ecx, dword [esp + 0x14]
xor ecx, ebp
call fcn.004948c8
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret 4
mov edi, eax
mov ecx, esi
push eax
push dword [esp + 8]
call fcn.004db8a0
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4db662
Function at 0x4dc850
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov esi, ecx
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0x80], eax
mov ecx, dword [0x52cbd8]
test ecx, ecx
jne 0x4dc8e0
movzx eax, byte [esi + 0x1b]
test al, al
jns 0x4dc884
mov eax, dword [esi + 0x14]
xor ebx, ebx
test eax, eax
je 0x4dc8a4
mov ecx, dword [esp + 0x80]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea edi, [esp + 0x70]
mov dword [edi], ebx
lea eax, [esp + 0x6c]
mov dword [eax], 4
push ebx
push eax
push edi
push 0x20000013
push dword [esi + 0x58]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
sete cl
mov eax, dword [edi]
cmp eax, 0xc8
setne bl
or bl, cl
cmp bl, 1
je 0x4dc8fc
xor bl, 1
jmp 0x4dc88a
push dword [ebp + 8]
call fcn.004dc850
mov ebx, eax
mov ecx, dword [esp + 0x80]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
jmp 0x4dc89a
lea ecx, [esi + 0x10]
mov dword [esp + 4], ecx
xor ecx, ecx
dec ecx
lea edx, [esp + 0x74]
mov dword [edx + 4], ecx
mov dword [edx], ecx
mov word [edx + 8], 0xffff
push 0xa
push edx
push eax
call fcn.004a6331
add esp, 0xc
lea edi, [esp + 0x60]
mov ecx, edi
push str.final_query_info_
call fcn.004be760
mov ecx, edi
lea eax, [esp + 0x74]
push eax
call fcn.0046e130
mov ecx, eax
push 0x50eae8
call fcn.0046e130
cmp byte [eax + 0xb], 0
jns 0x4dc951
mov eax, dword [eax]
mov edi, dword [esp + 4]
lea ecx, [esp + 8]
mov edx, eax
call fcn.004dc4a0
cmp byte [edi + 0xb], 0
jns 0x4dc970
push dword [edi]
call fcn.00493d6d
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [edi + 8], eax
movsd xmm0, qword [esp + 8]
movsd qword [edi], xmm0
mov byte [esp + 0x13], 0
mov word [esp + 8], 0
cmp byte [esp + 0x6b], 0
jns 0x4dc9a0
push dword [esp + 0x60]
call fcn.00493d6d
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edi, [esp + 0x64]
push edi
call fcn.004c2100
add esp, 8
lea ecx, [esp + 8]
push edi
push 0x144
push str.FinalizeDownload
push 1
call fcn.004c1f00
lea edi, [esp + 0x10]
lea ecx, [esp + 0x44]
push 0x51277a
push str.Unsuccessful_download:
call fcn.004be8c0
add esi, 4
mov ecx, edi
push esi
call fcn.0043b040
lea ecx, [esp + 8]
call fcn.004c1f40
cmp byte [esp + 0x6b], 0
jns 0x4dca08
push dword [esp + 0x60]
call fcn.00493d6d
add esp, 4
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4dc8db
mov eax, dword [esp + 0x70]
mov dword [ecx], eax
jmp 0x4dc8db
Function at 0x4dcb60
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov edx, dword [ebp + 8]
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0xb8], eax
lea esi, [esp + 0x6c]
mov dword [esi], 0xffffffff
mov ecx, esi
call fcn.004dccc0
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jae 0x4dcbcc
xor ebx, ebx
inc eax
cmp eax, 2
jb 0x4dcbb4
call fcn.00471300
push dword [esp + 0x6c]
call fcn.00474440
add esp, 4
mov ecx, dword [esp + 0xb8]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x70]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov dword [esi + 0x40], 0xffffffff
lea eax, [esp + 0x68]
mov dword [eax], 0x44
push eax
push esi
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x4dcc68
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 4]
push eax
push edi
call fcn.004c2100
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push edi
push 0x5d
push str.IsUserAnAdminGroup
push 1
call fcn.004c1f00
lea ecx, [esp + 0x4c]
push 0x5127cc
push str.CreateWellKnownSid_failed
call fcn.004be8c0
mov ecx, esi
call fcn.004c1f40
cmp byte [edi + 0xb], 0
jns 0x4dcc5d
push dword [esp + 4]
call fcn.00493d6d
add esp, 4
xor ebx, ebx
mov eax, dword [esp + 0x6c]
jmp 0x4dcb9d
xor ebx, ebx
lea edi, [esp + 0x10]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, dword [esp + 0x6c]
mov edx, 2
push edi
call fcn.004dcd80
add esp, 4
mov edi, dword [edi]
test al, al
je 0x4dccae
xor ebx, ebx
cmp dword [edi], 0
je 0x4dccae
push dword [edi + ebx*8 + 4]
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4dcca9
inc ebx
cmp ebx, dword [edi]
jb 0x4dcc95
test eax, eax
setne bl
test edi, edi
je 0x4dcc5f
push edi
call fcn.00493d6d
add esp, 4
jmp 0x4dcc5f
Function at 0x4de240
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, edx
mov edi, ecx
mov eax, dword [0x526014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x4de261
mov eax, dword [edi]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4de308
mov ebx, eax
mov dword [ebp - 0x28], esi
xor eax, eax
dec eax
lea esi, [ebp - 0x1c]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push ebx
call fcn.0043a2d0
mov eax, dword [esi]
cmp byte [edi + 0xb], 0
jns 0x4de296
mov edi, dword [edi]
push eax
push ebx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
xor ebx, ebx
test eax, eax
je 0x4de2f3
lea esi, [ebp - 0x20]
mov dword [esi], ebx
lea eax, [ebp - 0x24]
mov dword [eax], ebx
push esi
push eax
push 0x50b618
push dword [ebp - 0x1c]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
sete al
cmp dword [esi], 0x34
setb bl
or bl, al
jne 0x4de2f0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x30]
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x30], ecx
movups xmm0, xmmword [eax + 0x20]
movups xmmword [edx + 0x20], xmm0
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [edx + 0x10], xmm1
movups xmmword [edx], xmm0
xor bl, 1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4de30a
mov dword [ebp - 0x18], eax
push eax
call fcn.00493d6d
add esp, 4
jmp 0x4de30a
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4de6a0
Capabilities:
Get common file path
Get disk size
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x260
mov bl, byte [ebp + 8]
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0x258], eax
xor edi, edi
lea esi, [esp + 0x50]
push 0x208
push edi
push esi
call fcn.00497b10
add esp, 0xc
test bl, bl
mov eax, 0x26
mov ecx, 0x1c
cmovne ecx, eax
push esi
push edi
push edi
push ecx
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4de734
xor eax, eax
dec eax
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx], eax
push edi
push edi
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4de75b
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 4]
mov bl, 1
cmp dword [esp], eax
sbb ecx, 0
jb 0x4de790
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [esp + 8]
mov ecx, esi
push 0xe0
push str.HasEnoughDiskSpace
push 0
call fcn.0043bcc0
lea ecx, [esp + 0x44]
push 0x512d22
push str.SHGetFolderPath_failed
jmp 0x4de780
lea esi, [esp + 8]
mov ecx, esi
push 0xe6
push str.HasEnoughDiskSpace
push 0
call fcn.0043bcc0
lea ecx, [esp + 0x44]
push 0x512d3c
push str.GetDiskFreeSpaceEx_failed
call fcn.004be8c0
mov ecx, esi
call fcn.0043bef0
mov bl, 1
jmp 0x4de71c
lea esi, [esp + 8]
mov ecx, esi
push 0xec
push str.HasEnoughDiskSpace
push 0
call fcn.0043bcc0
lea ecx, [esp + 0x44]
push 0x512d6e
push str.There_is_not_enough_disk_space_to_install_browser
call fcn.004be8c0
mov ecx, esi
call fcn.0043bef0
xor ebx, ebx
jmp 0x4de71c
Function at 0x4e0dc0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [0x526014]
xor eax, ebp
mov dword [esp + 0x68], eax
lea esi, [ecx + 4]
xor eax, eax
push esi
push eax
push eax
push 0x8004
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4e0e1d
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov bl, 1
test eax, eax
je 0x4e0e58
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004948c8
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004c2100
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push ebx
push 0x35
push str.HashData
push 1
call fcn.004c1f00
lea ecx, [esp + 0x4c]
push 0x515249
push str.Failed_to_initialize_hash_object__error:
jmp 0x4e0e91
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004c2100
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push ebx
push 0x3a
push str.HashData
push 1
call fcn.004c1f00
lea ecx, [esp + 0x4c]
push 0x515266
push str.Failed_to_hash_data__error:
call fcn.004be8c0
call edi
lea ecx, [esp + 0x18]
push eax
call fcn.004be7e0
mov ecx, esi
call fcn.004c1f40
cmp byte [ebx + 0xb], 0
jns 0x4e0ebb
push dword [esp + 4]
call fcn.00493d6d
add esp, 4
xor ebx, ebx
jmp 0x4e0e06

Function at 0x4e1460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ebx, edx
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4e14c9
mov edi, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4e14c9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4e14c9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4e14c9
mov edi, eax
mov ecx, esi
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00468f60
push ebx
push edi
push dword [esi]
call fcn.00497010
add esp, 0xc
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret