joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43454e
Capabilities:
Print debug messages

Disassembly:
push 0xe4
mov eax, 0x4f1817
call fcn.004bcfcf
call fcn.00434506
test eax, eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
mov edx, str.SOFTWAREClassesCLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
setne cl
test cl, cl
lea ecx, [ebp - 0x28]
lea eax, [esi - 2]
cmovne esi, eax
mov eax, str.CLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
cmove eax, edx
push eax
call fcn.00406c40
xor ebx, ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x41]
cmp dword [ebp - 0x14], 8
mov edi, 0xf003f
push 1
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push esi
call fcn.00433204
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push edi
cmovae ecx, dword [ebp - 0x28]
push ecx
push esi
lea ecx, [ebp - 0x50]
call fcn.00426042
mov ebx, eax
or edi, 0xffffffff
test ebx, ebx
jne 0x4345ee
push 1
mov eax, 0x50f8e0
lea ecx, [ebp - 0x50]
push eax
push eax
call fcn.00432207
mov edi, eax
push ecx
push ecx
lea ecx, [ebp - 0xf0]
call fcn.00434bd2
mov byte [ebp - 4], 2
lea eax, [ebp - 0xf0]
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
push eax
cmovae esi, dword [ebp - 0x28]
call fcn.00437912
pop ecx
push edi
push ecx
push dword [ebp - 0x54]
mov edx, str.CrashRepair::BeginRegisterAcessable
push ecx
push ebx
push ecx
mov ecx, eax
call fcn.00437944
mov edx, str.__reg.Open:
mov ecx, eax
call fcn.00437b91
pop ecx
mov ecx, eax
call fcn.00434dfd
mov edx, str.__helper.AddRegAccess:
mov ecx, eax
call fcn.00437b91
pop ecx
mov ecx, eax
call fcn.00434d05
mov edx, str.__reg.SetStringValue
mov ecx, eax
call fcn.00437b91
pop ecx
mov ecx, eax
call fcn.00434dfd
mov edx, str.__location_is:
mov ecx, eax
call fcn.00437b91
mov edx, esi
mov ecx, eax
call fcn.00437b91
push eax
call fcn.00437912
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xf0]
call fcn.00434ccd
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x43469e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00402a40
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 1
call fcn.00434c8a
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x512ee0
push eax
mov dword [ebp - 0xa0], 0x4fb9ac
call fcn.004bb773
pop ecx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.00426028
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a40
call fcn.004bcf7e
ret
Function at 0x4346ff
Capabilities:
Print debug messages

Disassembly:
push 0xdc
mov eax, 0x4f186a
call fcn.004bcfcf
call fcn.00434506
test eax, eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
mov edx, str.SOFTWAREClassesCLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
setne cl
test cl, cl
lea ecx, [ebp - 0x28]
lea eax, [esi - 2]
cmovne esi, eax
mov eax, str.CLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
cmove eax, edx
push eax
call fcn.00406c40
xor ebx, ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x49]
cmp dword [ebp - 0x14], 8
mov edi, ebx
cmovae eax, dword [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x50]
push eax
call fcn.00433381
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x50]
cmp dword [esi - 0xc], ebx
je 0x43479a
lea ecx, [ebp - 0x48]
call fcn.00432610
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00432747
push ebx
lea eax, [ebp - 0x48]
push eax
push 4
push esi
call fcn.00432f83
add esp, 0x10
movzx edi, al
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00432653
lea ecx, [esi - 0x10]
mov byte [ebp - 4], bl
call fcn.004206ab
push ecx
push ecx
lea ecx, [ebp - 0xe8]
call fcn.00434bd2
mov byte [ebp - 4], 3
lea eax, [ebp - 0xe8]
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
push eax
cmovae esi, dword [ebp - 0x28]
call fcn.00437912
pop ecx
push edi
push ecx
mov edx, str.CrashRepair::EndRegisterAcessable
mov ecx, eax
call fcn.00437944
mov edx, str.__RestoreRegAccess:
mov ecx, eax
call fcn.00437b91
pop ecx
mov ecx, eax
call fcn.00434d05
mov edx, str.__location_is:
mov ecx, eax
call fcn.00437b91
mov edx, esi
mov ecx, eax
call fcn.00437b91
push eax
call fcn.00437912
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe8]
call fcn.00434ccd
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x434827
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.00402a40
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], bl
call fcn.00434c8a
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x512ee0
push eax
mov dword [ebp - 0x98], 0x4fb9ac
call fcn.004bb773
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.00402a40
call fcn.004bcf7e
ret
Function at 0x437069
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], edx
push esi
mov esi, eax
mov dword [ebp - 8], eax
push edi
or edi, 0xffffffff
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x437082
sub esi, ecx
lea ebx, [esi + 1]
push ebx
call fcn.004bae68
mov esi, eax
pop ecx
test esi, esi
je 0x437156
push ebx
call fcn.004bae68
mov ebx, eax
mov dword [ebp - 0xc], ebx
pop ecx
test ebx, ebx
jne 0x4370ba
push esi
call fcn.004bbca6
jmp 0x437155
mov ecx, dword [ebp - 4]
mov edx, esi
inc ecx
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4370c2
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
sub eax, ecx
push eax
push ecx
push ebx
call fcn.004c59e0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, ebx
sub eax, dword [ebp - 8]
push 0
mov byte [eax + ecx], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
push esi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x437148
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x437148
push 0xc
call fcn.00481836
mov ebx, eax
pop ecx
test ebx, ebx
je 0x437145
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 0x10]
and dword [ebx + 4], 0
push dword [ebp - 8]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebx + 8], eax
mov edi, ebx
mov ebx, dword [ebp - 0xc]
push esi
call fcn.004bbca6
push ebx
call fcn.004bbca6
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43719b
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
mov edi, ecx
mov ebx, edx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x437201
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
je 0x4371fa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x4371fa
lea eax, [ebp - 8]
push eax
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
and eax, 0x27
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4388bf
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push str.winhttp.dll
mov edi, ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x43898d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinHttpOpen
push eax
call esi
push str.WinHttpConnect
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.WinHttpOpenRequest
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.WinHttpSendRequest
push dword [edi]
mov dword [edi + 0xc], eax
call esi
push str.WinHttpWriteData
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.WinHttpReceiveResponse
push dword [edi]
mov dword [edi + 0x14], eax
call esi
push str.WinHttpCloseHandle
push dword [edi]
mov dword [edi + 0x18], eax
call esi
push str.WinHttpReadData
push dword [edi]
mov dword [edi + 0x1c], eax
call esi
push str.WinHttpQueryDataAvailable
push dword [edi]
mov dword [edi + 0x20], eax
call esi
push str.WinHttpSetTimeouts
push dword [edi]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
pop esi
cmp dword [edi + 4], ebx
je 0x43898d
cmp dword [edi + 8], ebx
je 0x43898d
cmp dword [edi + 0xc], ebx
je 0x43898d
cmp dword [edi + 0x10], ebx
je 0x43898d
cmp dword [edi + 0x14], ebx
je 0x43898d
cmp dword [edi + 0x18], ebx
je 0x43898d
cmp dword [edi + 0x1c], ebx
je 0x43898d
cmp dword [edi + 0x20], ebx
je 0x43898d
cmp dword [edi + 0x24], ebx
je 0x43898d
test eax, eax
je 0x43898d
inc ebx
jmp 0x438994
mov ecx, edi
call fcn.00438999
pop edi
mov eax, ebx
pop ebx
ret
Function at 0x4392d3
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2028
call fcn.004bf2f0
mov eax, dword [0x52fe80]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0xfff
mov dword [ebp - 0x2020], eax
xor ebx, ebx
mov dword [ebp - 0x201c], ecx
push edi
lea eax, [ebp - 0x100b]
mov dword [ebp - 0x2014], 0x7d0
push ebx
push eax
mov esi, 0x80004005
mov dword [ebp - 0x2010], 0x1000
mov byte [ebp - 0x100c], bl
call fcn.004bf240
add esp, 0xc
mov byte [ebp - 0x200c], bl
lea eax, [ebp - 0x200b]
push edi
push ebx
push eax
call fcn.004bf240
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push str.KxeCollect_Agent
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, eax
mov dword [ebp - 0x2024], ebx
test ebx, ebx
jne 0x43937e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x4394e1
push 4
lea eax, [ebp - 0x2014]
push eax
push 2
push ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 1
xor eax, eax
push eax
push 3
push eax
push eax
push 0x50
push str.help.pc120.com
push ebx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x4393d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x4394de
push 4
lea ecx, [ebp - 0x2014]
push ecx
push 2
push eax
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov ebx, dword [ebp - 0x2018]
lea eax, [ebp - 0x2014]
push 4
push eax
push 5
push ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov eax, dword [ebp - 0x201c]
xor ecx, ecx
push 1
push 0x20000000
push ecx
push ecx
push str.HTTP_1.0
add eax, 0x2c
push eax
push ecx
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov ebx, eax
test ebx, ebx
jne 0x43943b
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x4394d0
xor eax, eax
push eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x43946b
lea eax, [ebp - 0x2010]
push eax
push dword [ebp - 0x2010]
lea eax, [ebp - 0x100c]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x439481
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x4394cd
lea eax, [ebp - 0x2010]
mov ecx, 0x1000
push eax
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x2010], ecx
push eax
push ecx
lea eax, [ebp - 0x100c]
push eax
call fcn.00438743
add esp, 0x10
test eax, eax
je 0x4394cd
push dword [ebp - 0x2010]
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 0x2020]
call fcn.00439660
xor ecx, ecx
test eax, eax
cmovne esi, ecx
push ebx
call edi
push dword [ebp - 0x2018]
call edi
mov ebx, dword [ebp - 0x2024]
push ebx
call edi
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bc1bd
mov esp, ebp
pop ebp
ret 0xc
Function at 0x439b0e
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov esi, ecx
mov al, byte [esi + edx]
cmp al, 0x41
jl 0x439b29
cmp al, 0x5a
jg 0x439b29
shl ecx, 6
add ecx, 0xffffffbf
jmp 0x439b47
cmp al, 0x61
jl 0x439b39
cmp al, 0x7a
jg 0x439b39
shl ecx, 6
add ecx, 0xffffffb9
jmp 0x439b47
cmp al, 0x30
jl 0x439b4e
cmp al, 0x39
jg 0x439b4e
shl ecx, 6
add ecx, 4
movsx eax, al
add ecx, eax
jmp 0x439b6d
cmp al, 0x2b
jne 0x439b5a
shl ecx, 6
add ecx, 0x3e
jmp 0x439b6d
cmp al, 0x2f
jne 0x439b66
shl ecx, 6
add ecx, 0x3f
jmp 0x439b6d
cmp al, 0x3d
jne 0x439b6d
shl ecx, 6
inc esi
cmp esi, 4
jl 0x439b16
mov byte [edi + 2], cl
shr ecx, 8
mov byte [edi + 1], cl
shr ecx, 8
mov byte [edi], cl
pop edi
pop esi
ret

Function at 0x439e68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x52fe80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, ecx
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
call fcn.004bf240
mov eax, dword [esi + 0x20]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x439ea7
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x439ee2
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004bc1bd
mov esp, ebp
pop ebp
ret
cmp word [ebp + eax*2 - 0x804], 0x5c
je 0x439ee5
dec eax
jns 0x439ed7
add eax, eax
cmp eax, 0x800
jae 0x439f13
xor ecx, ecx
push 5
mov word [ebp + eax - 0x804], cx
lea eax, [ebp - 0x804]
push eax
push ecx
push eax
push 0x511078
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x439ec6
call fcn.004bfbbc
int3

Function at 0x43a68b
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x52fe80]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, ecx
push 0
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push eax
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x43a6c1
add dword [esi + 4], eax
jmp 0x43a6d2
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
jne 0x43a6e3
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.004bc1bd
mov esp, ebp
pop ebp
ret 4
call esi
push eax
push 0x5131cc
lea ecx, [ebp - 0x30]
call fcn.0042ad56
push 0x52b58c
lea eax, [ebp - 0x30]
push eax
call fcn.004bcf07
int3
Function at 0x43bb9b
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xc
mov eax, 0x4f2197
call fcn.004bcf9c
mov dword [ebp - 0x18], ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
call fcn.00420bd2
push eax
lea ecx, [ebp - 0x14]
call fcn.00423e41
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
je 0x43bc3d
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43bc3d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
inc eax
push eax
call fcn.004bae68
mov edi, eax
pop ecx
test edi, edi
je 0x43bc36
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43bc2f
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
mov ecx, edi
mov byte [edi + eax], bl
call fcn.0043bc52
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.0043baf9
mov ebx, eax
push edi
call fcn.004bbca6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004206ab
mov eax, ebx
call fcn.004bcf6a
ret 4

Function at 0x43f67d
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
cmp dword [ecx + 0x14], 8
push edi
mov esi, ebx
jb 0x43f692
mov ecx, dword [ecx]
push ebx
push 0x8000000
push 3
push ebx
push 1
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x10], edi
cmp edi, 0xffffffff
jne 0x43f6ba
xor al, al
jmp 0x43f78d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push ebx
push 0x8000002
push ebx
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x43f76c
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x43f76c
mov ecx, dword [ebp - 4]
cmp ecx, 9
jb 0x43f76c
cmp dword [esi], 4
je 0x43f704
cmp dword [esi], 5
jne 0x43f76c
movzx eax, byte [esi + 8]
mov edx, dword [esi + 4]
cmp eax, 1
je 0x43f719
cmp eax, 2
je 0x43f719
test eax, eax
jne 0x43f76c
imul eax, edx, 6
mov dword [ebp - 0xc], eax
add eax, 9
cmp eax, ecx
ja 0x43f76c
lea eax, [edx + 1]
mov dword [ebp - 8], eax
test eax, eax
je 0x43f742
lea eax, [esi + 0xb]
mov edx, ebx
cmp dword [eax], ecx
ja 0x43f76c
inc edx
add eax, 6
cmp edx, dword [ebp - 8]
jb 0x43f735
cmp dword [esi], 5
jne 0x43f76a
mov eax, dword [ebp - 0xc]
mov ecx, ebx
mov edx, dword [eax + esi + 0xf]
inc edx
je 0x43f76a
add eax, 0x15
add eax, esi
mov edi, dword [ebp - 4]
cmp dword [eax], edi
mov edi, dword [ebp - 0x10]
ja 0x43f76c
inc ecx
add eax, 6
cmp ecx, edx
jb 0x43f758
mov bl, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
je 0x43f780
push eax
call edi
test esi, esi
je 0x43f78b
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f7bd
Capabilities:
Create thread

Disassembly:
push 0x38
mov eax, 0x4f28cd
call fcn.004bcfcf
mov dword [ebp - 0x40], ecx
and dword [ebp - 4], 0
mov eax, dword [ecx + 8]
test eax, eax
je 0x43f807
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x43f804
push 0xffffffffffffffff
push 0x5135d4
lea ecx, [ebp - 0x3c]
call fcn.0042ad56
push 0x52b58c
lea eax, [ebp - 0x3c]
push eax
call fcn.004bcf07
mov ecx, dword [ebp - 0x40]
mov edi, dword [ebp + 0xc]
lea ebx, [ecx + 0x10]
mov esi, dword [edi]
cmp esi, edi
je 0x43f829
lea eax, [esi + 8]
mov ecx, ebx
push eax
push dword [ebx]
call fcn.0042eb32
mov esi, dword [esi]
cmp esi, edi
jne 0x43f813
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ecx + 4], eax
lea eax, [ebp - 0x44]
push eax
push edx
push ecx
push 0x43f794
push edx
push edx
mov dword [ebp - 0x44], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 8], eax
test eax, eax
jne 0x43f85f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5135e8
jmp 0x43f7ee
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0042e858
push dword [ebp + 0xc]
call fcn.0048185e
pop ecx
call fcn.004bcf7e
ret 0xc
Function at 0x44006c
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x8c8
mov eax, 0x4f2a67
call fcn.004bcfcf
xor ebx, ebx
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x814], ebx
push ebx
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x814], 7
call fcn.00403c20
lea eax, [ebp - 0x828]
mov dword [ebp - 4], ebx
push eax
call fcn.0043fcbe
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4401f2
xor eax, eax
push 0x7fe
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push ebx
push eax
call fcn.004bf240
add esp, 0xc
lea eax, [ebp - 0x828]
cmp dword [ebp - 0x814], 8
cmovae eax, dword [ebp - 0x828]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, eax
test edi, edi
je 0x4401f2
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004bae68
pop ecx
push edi
push ebx
push eax
mov dword [ebp - 0x8d4], eax
call fcn.004bf240
add esp, 0xc
mov edx, ebx
mov esi, ebx
test edi, edi
je 0x4401e3
mov ecx, dword [ebp - 0x8d4]
mov ax, word [ebp + esi*2 - 0x810]
mov word [ecx + edx*2], ax
inc edx
cmp word [ebp + esi*2 - 0x810], bx
jne 0x4401da
lea ecx, [ebp - 0x8d0]
call fcn.0042cda7
mov byte [ebp - 4], 1
lea eax, [ebp - 0x828]
cmp dword [ebp - 0x814], 8
cmovae eax, dword [ebp - 0x828]
push eax
push dword [ebp - 0x8d4]
lea eax, [ebp - 0x8d0]
push eax
call fcn.0043fd81
lea eax, [ebp - 0x8d0]
push eax
call fcn.00440210
push edi
push ebx
push dword [ebp - 0x8d4]
call fcn.004bf240
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x8d0]
call fcn.00440583
mov ecx, dword [ebp - 0x8d4]
mov edx, ebx
inc esi
cmp esi, edi
jb 0x44015b
push dword [ebp - 0x8d4]
call fcn.004bbca6
xor ebx, ebx
pop ecx
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x828]
call fcn.00402a40
mov eax, ebx
call fcn.004bcf7e
ret 4
Function at 0x441581
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x6c
mov eax, 0x4f2df7
call fcn.004bcfcf
xor ebx, ebx
mov dword [ebp - 0x48], str.chrome.dll
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x44]
push ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 7
call fcn.00403c20
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.0044399e
mov esi, ebx
mov edi, 0x4fc6f8
inc ebx
push dword [ebp + esi*4 - 0x48]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00424515
add esp, 0xc
mov byte [ebp - 4], bl
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44163c
test al, 0x10
jne 0x44163c
lea ecx, [ebp - 0x78]
call fcn.0042ba72
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push ecx
cmovae eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x78]
push eax
call fcn.0043f114
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x78], edi
test eax, eax
jne 0x441637
call fcn.00424b15
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00402a40
inc esi
cmp esi, ebx
jb 0x4415bf
jmp 0x44164a
call fcn.00424b15
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00402a40
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00402a40
mov al, bl
call fcn.004bcf7e
ret

Function at 0x44165e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x64
mov eax, 0x4f2e34
call fcn.004bcfcf
xor ebx, ebx
mov dword [ebp - 0x24], str.resources.pak
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x54]
push ebx
mov dword [ebp - 0x20], str.chrome_100_percent.pak
mov dword [ebp - 0x1c], 0x513954
mov dword [ebp - 0x18], str.localeszh_CN.pak
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], 7
call fcn.00403c20
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], ebx
call fcn.0044399e
mov esi, ebx
inc ebx
mov dword [ebp - 0x70], ebx
jmp 0x4416b4
xor ebx, ebx
inc ebx
push dword [ebp + esi*4 - 0x24]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00424515
add esp, 0xc
mov byte [ebp - 4], bl
lea eax, [ebp - 0x3c]
cmp dword [ebp - 0x28], 8
cmovae eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44172f
test al, 0x10
jne 0x44172f
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x6c]
cmovae eax, dword [ebp - 0x3c]
push eax
call fcn.00406c40
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.0043f67d
mov bl, al
mov byte [ebp - 4], 1
neg bl
lea ecx, [ebp - 0x6c]
sbb bl, bl
call fcn.00402a40
inc bl
jne 0x44172f
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.00402a40
inc esi
cmp esi, 4
jb 0x4416b1
jmp 0x44173f
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0
call fcn.00402a40
mov byte [ebp - 0x70], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00402a40
mov al, byte [ebp - 0x70]
call fcn.004bcf7e
ret