joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413460
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x413484
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.005402cd
add esp, 0x14
jmp 0x4134b3
test esi, esi
jle 0x4134ac
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, byte [eax + edi]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x4134ae
inc edi
mov eax, ebx
cmp esi, edi
jne 0x41348d
mov edi, esi
jmp 0x4134ae
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4134c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x5a05c4]
mov ebx, dword [ebp + 8]
xor eax, ebp
cmp ebx, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x413587
mov byte [ebp - 0x19], bl
mov esi, ecx
cmp byte [ecx + 0x2c], 0
je 0x41350e
xor edi, edi
lea eax, [ebp - 0x19]
inc edi
push dword [esi + 0x20]
push edi
push edi
push eax
call fcn.005402cd
add esp, 0x10
cmp eax, edi
je 0x413587
xor esi, esi
dec esi
jmp 0x41358f
lea ebx, [ebp - 0x19]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [esi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push ebx
push dword [esi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], ebx
je 0x413506
mov edi, eax
cmp eax, 3
je 0x41356f
cmp edi, 1
ja 0x413506
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub ebx, eax
push dword [esi + 0x20]
push ebx
push 1
push eax
call fcn.005402cd
add esp, 0x10
cmp eax, ebx
jne 0x413506
mov ebx, dword [ebp - 0x24]
cmp edi, 1
je 0x413519
jmp 0x413584
xor edi, edi
inc edi
push dword [esi + 0x20]
push edi
push edi
push ebx
call fcn.005402cd
add esp, 0x10
cmp eax, edi
jne 0x413506
mov ebx, dword [ebp + 8]
xor esi, esi
cmp ebx, 0xffffffff
cmovne esi, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4135e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x413604
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.005402cd
add esp, 0x14
jmp 0x413634
test esi, esi
jle 0x41362d
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, word [eax + edi*2]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x41362f
inc edi
mov eax, ebx
cmp esi, edi
jne 0x41360d
mov edi, esi
jmp 0x41362f
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x413640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x5a05c4]
movzx ebx, word [ebp + 8]
xor eax, ebp
cmp bx, 0xffff
mov dword [ebp - 0x10], eax
je 0x41370c
mov word [ebp - 0x1a], bx
mov edi, ecx
cmp byte [ecx + 0x2c], 0
je 0x413692
xor esi, esi
lea eax, [ebp - 0x1a]
inc esi
push dword [edi + 0x20]
push esi
push 2
push eax
call fcn.005402cd
add esp, 0x10
cmp eax, esi
je 0x41370c
xor ebx, ebx
dec ebx
jmp 0x413715
lea esi, [ebp - 0x1a]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x41368a
mov ebx, eax
cmp eax, 3
je 0x4136f3
cmp ebx, 1
ja 0x41368a
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.005402cd
add esp, 0x10
cmp eax, esi
jne 0x41368a
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x41369d
jmp 0x413708
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.005402cd
add esp, 0x10
cmp eax, ebx
jne 0x41368a
movzx ebx, word [ebp + 8]
xor eax, eax
cmp bx, 0xffff
cmove ebx, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4138a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x4138cf
movsx esi, byte [edx]
shl eax, 4
inc edx
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x4138b1
pop esi
pop edi
pop ebp
ret 8

Function at 0x4139d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x413a01
movzx esi, word [edx]
shl eax, 4
add edx, 2
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x4139e1
pop esi
pop edi
pop ebp
ret 8
Function at 0x418a60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x4266e0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor eax, eax
lea ecx, [esi + 0x20]
xor edi, edi
mov dword [ecx + 4], eax
mov dword [ecx], 0x25
mov eax, ecx
mov ecx, dword [ebp + 0x10]
inc edi
or eax, edi
push dword [ecx + 4]
mov ebx, ecx
push edi
push 0x5585e2
push eax
call fcn.0041871c
add esp, 0x10
mov ebx, dword [ebx + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, edi
lea eax, [ebx + 0x17]
mov dword [esi + 4], eax
sub esp, 0x18
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.00415740
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.004290e9
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.00418786
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx + ebx + 0x2e]
and eax, 0xfffffffc
call fcn.00527850
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.00410cf0
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.004187e0
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x418b7b
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, byte [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movsx edx, dl
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.004059c0
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x418d40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x426700
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
xor edx, edx
lea eax, [esi + 0x20]
inc edx
mov dword [eax + 4], ecx
mov dword [eax], 0x25
or eax, edx
mov edx, dword [ebp + 0x10]
push dword [edx + 4]
mov edi, edx
push ecx
push 0x5585e2
push eax
call fcn.0041871c
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x10], esp
shr ebx, 9
xor eax, eax
inc eax
and ebx, eax
lea edi, [ebx + 0x16]
inc edi
sub esp, 0x18
lea eax, [esi + 0x28]
mov dword [esi + 8], esp
push eax
call fcn.00415740
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push edi
mov edi, dword [esi + 8]
push edi
call fcn.004290e9
add esp, 0x1c
mov ecx, edi
add eax, edi
push dword [ebp + 0x10]
push eax
mov edi, eax
push ecx
call fcn.00418786
add esp, 0xc
mov dword [esi + 0x14], eax
lea eax, [ebx + ebx + 0x2e]
and eax, 0xfffffffc
call fcn.00527850
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 4]
mov ebx, esp
push eax
call fcn.00410cf0
lea edx, [esi + 4]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0xc], ebx
push ebx
push edi
push dword [esi + 0x14]
push dword [esi + 8]
call fcn.004187e0
add esp, 0x1c
mov ecx, dword [esi + 4]
xor eax, eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x418e58
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, byte [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movsx edx, dl
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0xc]
push ebx
push edi
call fcn.004059c0
add esp, 0x1c
mov esp, dword [esi + 0x10]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x41a340
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x426790
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor eax, eax
lea ecx, [esi + 0x20]
xor edi, edi
mov dword [ecx + 4], eax
mov dword [ecx], 0x25
mov eax, ecx
mov ecx, dword [ebp + 0x10]
inc edi
or eax, edi
push dword [ecx + 4]
mov ebx, ecx
push edi
push 0x5585e2
push eax
call fcn.0041871c
add esp, 0x10
mov ebx, dword [ebx + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, edi
lea eax, [ebx + 0x17]
mov dword [esi + 4], eax
sub esp, 0x18
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.00415740
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.004290e9
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.00418786
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx*4 + 0x58]
call fcn.00527850
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.00410cf0
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.00419ef0
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x41a45d
mov eax, dword [ecx]
call dword [eax + 4]
movzx edx, word [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movzx edx, dx
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.0041a180
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x41a640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x4267b0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
xor edx, edx
lea eax, [esi + 0x20]
inc edx
mov dword [eax + 4], ecx
mov dword [eax], 0x25
or eax, edx
mov edx, dword [ebp + 0x10]
push dword [edx + 4]
mov edi, edx
push ecx
push 0x5585e2
push eax
call fcn.0041871c
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x10], esp
shr ebx, 9
xor eax, eax
inc eax
and ebx, eax
lea edi, [ebx + 0x16]
inc edi
sub esp, 0x18
lea eax, [esi + 0x28]
mov dword [esi + 8], esp
push eax
call fcn.00415740
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push edi
mov edi, dword [esi + 8]
push edi
call fcn.004290e9
add esp, 0x1c
mov ecx, edi
add eax, edi
push dword [ebp + 0x10]
push eax
mov edi, eax
push ecx
call fcn.00418786
add esp, 0xc
mov dword [esi + 0x14], eax
lea eax, [ebx*4 + 0x58]
call fcn.00527850
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 4]
mov ebx, esp
push eax
call fcn.00410cf0
lea edx, [esi + 4]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0xc], ebx
push ebx
push edi
push dword [esi + 0x14]
push dword [esi + 8]
call fcn.00419ef0
add esp, 0x1c
mov ecx, dword [esi + 4]
xor eax, eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x41a75a
mov eax, dword [ecx]
call dword [eax + 4]
movzx edx, word [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movzx edx, dx
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0xc]
push ebx
push edi
call fcn.0041a180
add esp, 0x1c
mov esp, dword [esi + 0x10]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x41d0d8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00425f72
mov ebx, eax
test esi, esi
je 0x41d111
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x41d0fe
movzx eax, word [eax]
jmp 0x41d105
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x41d111
test bl, bl
jne 0x41d117
jmp 0x41d174
xor esi, esi
test bl, bl
jne 0x41d165
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x41d126
movzx eax, word [eax]
jmp 0x41d12b
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
movzx eax, ax
mov edx, dword [ecx]
push eax
push 8
call dword [edx + 0xc]
test al, al
je 0x41d156
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x41d14f
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x41d0e4
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x41d0e4
mov ecx, edi
call fcn.00425f72
mov ebx, eax
test esi, esi
jne 0x41d17d
jmp 0x41d16e
mov ecx, edi
call fcn.00425f72
mov ebx, eax
test bl, bl
jne 0x41d19c
jmp 0x41d1a2
mov ecx, edi
call fcn.00425f72
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x41d18a
movzx eax, word [eax]
jmp 0x41d191
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x41d1a2
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x4320fa
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
mov esi, dword [eax]
mov edx, dword [eax + 4]
lea edi, [esi + edx*2]
test cl, cl
lea edx, [eax + ecx*2]
mov ecx, 4
cmovs edx, edi
cmovs eax, esi
sub edx, eax
cmp edx, ecx
jb 0x432170
mov esi, 0xfffffffc
mov ebx, eax
lea ecx, [edx + esi]
and esi, ecx
mov dword [ebp - 0x14], ecx
mov ecx, edx
mov dword [ebp - 0x10], esi
imul edi, dword [ebx], 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
add edx, 0xfffffffc
add ebx, 4
mov esi, edi
shr esi, 0x18
xor esi, edi
imul esi, esi, 0x5bd1e995
xor ecx, esi
cmp edx, 3
ja 0x43213c
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
lea eax, [esi + eax + 4]
sub edx, esi
jmp 0x432172
mov ecx, edx
cmp edx, 1
je 0x432193
cmp edx, 2
je 0x43218a
cmp edx, 3
jne 0x43219e
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43442b
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x5a05c4]
mov esi, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x4344b9
xor edi, edi
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov dword [ecx], edi
mov dword [edx], edi
push edx
push ecx
push 0x18
push eax
push edi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x4344c2
mov dword [ebp - 0x20], esp
push eax
mov ebx, dword [ebp - 0x14]
mov esi, esp
push 0x18
call fcn.00527256
add esp, 4
mov edi, eax
mov ecx, eax
push 0x409220
push 0x434aa0
call fcn.00436ec0
lea ecx, [ebp - 0x1c]
mov dword [edi + 0x10], 0x554350
mov dword [edi + 0x14], ebx
mov dword [esi], edi
call fcn.0047a210
mov esp, dword [ebp - 0x20]
cmp dword [ebp - 0x18], 0xd7
ja 0x4344c9
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
jmp 0x4344e4
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
jmp 0x4344ec
mov dword [esi + 4], edi
mov dword [esi], edi
jmp 0x4344ec
mov eax, dword [ebp - 0x14]
push dword [eax + 0xcc]
push dword [eax + 0xc8]
mov esi, dword [ebp + 8]
push esi
call fcn.00459840
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.0047a240
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527311
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435a12
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov ecx, dword [ebp + 8]
mov eax, dword [0x5a05c4]
mov edi, dword [ebp + 0xc]
xor eax, ebp
add ecx, 4
cmp word [str.chedot.exe], 0
mov dword [esp + 0x148], eax
je 0x435a54
xor eax, eax
cmp word [eax + eax + 0x556c84], 0
lea eax, [eax + 1]
jne 0x435a44
jmp 0x435a56
xor eax, eax
lea esi, [esp + 0x13c]
push eax
push str.chedot.exe
push esi
call fcn.0043b210
lea ecx, [esp + 0x120]
push esi
call fcn.00437060
lea ebx, [esp + 0xc]
push dword [edi + 0x28]
push ebx
call fcn.004443a0
add esp, 8
lea esi, [esp + 0xdc]
mov ecx, esi
push str.try_chrome_again
call fcn.004026aa
lea ecx, [esp + 0x120]
push ebx
push esi
call fcn.00437da0
cmp byte [esi + 0xb], 0
jns 0x435abc
push dword [esp + 0xdc]
call fcn.005272d6
add esp, 4
cmp byte [esp + 0x17], 0
jns 0x435acf
push dword [esp + 0xc]
call fcn.005272d6
add esp, 4
xor ebx, ebx
xorps xmm0, xmm0
lea edi, [esp + 0xb4]
lea ecx, [esp + 0x120]
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x114], ebx
mov dword [esp + 0x110], ebx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x118], ebx
mov dword [esp + 0xdc], 0x44
movaps xmmword [esp + 0xc0], xmm0
push ebx
push edi
call fcn.00438800
cmp byte [edi + 0xb], bl
jns 0x435b78
mov edi, dword [esp + 0xb4]
cmp byte [esp + 0x147], bl
lea ecx, [esp + 0x13c]
jns 0x435b8f
mov ecx, dword [esp + 0x13c]
lea esi, [esp + 0xc0]
push esi
lea eax, [esp + 0xe0]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x435bcc
mov eax, esi
lea esi, [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047b1a0
mov ecx, esi
call fcn.0047b1f0
jmp 0x435c36
push 2
call fcn.0043e5e0
add esp, 4
test al, al
je 0x435c36
call fcn.0043ef80
lea esi, [esp + 0xc]
mov ecx, esi
push eax
push 2
push 0x223
push str..._.._chrome_installer_setup_user_experiment.cc
call fcn.0043f140
lea eax, [esp + 0x14]
push 0x12
push str.Failed_to_launch:
push eax
call fcn.004058b5
add esp, 0xc
cmp byte [esp + 0xbf], 0
jns 0x435c1e
mov ecx, dword [esp + 0xb4]
jmp 0x435c25
lea ecx, [esp + 0xb4]
push ecx
push eax
call fcn.0043f290
add esp, 8
mov ecx, esi
call fcn.0043f200
cmp byte [esp + 0xbf], 0
jns 0x435c4f
push dword [esp + 0xb4]
call fcn.005272d6
add esp, 4
lea ecx, [esp + 0x120]
call fcn.00437370
lea ecx, [esp + 0x13c]
call fcn.0043a4c0
mov ecx, dword [esp + 0x148]
xor ecx, ebp
call fcn.00527311
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4373d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
cmp dword [0x5a1da0], 0
jne 0x437466
push 0x1c
call fcn.00527256
add esp, 4
mov esi, eax
push 0xc
call fcn.00527256
add esp, 4
mov dword [esi], eax
lea ecx, [eax + 0xc]
mov dword [eax + 8], 0
mov dword [eax], 0
mov dword [eax + 4], 0
lea eax, [esi + 0x10]
mov dword [0x5a1da0], esi
mov dword [esi + 8], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x43745b
cmp word [eax], 0
je 0x43745b
xor ebx, ebx
nop dword [eax]
cmp word [eax + ebx*2 + 2], 0
lea ebx, [ebx + 1]
jne 0x437450
mov ecx, esi
push ebx
push eax
call fcn.00437470
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret