joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435970
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov byte [ecx], 0
xor eax, eax
mov dword [ecx + 4], eax
push str.A946A6A9_917E_4949_B9BC_6BADA8C7FD63
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x4359a3
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete byte [esi]
mov eax, esi
pop esi
pop ebp
ret
Function at 0x43ac90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x38], eax
push 0x20
push edi
push ebx
call fcn.0051706f
add esp, 0xc
mov esi, 6
cmp eax, 0x20
jne 0x43ad60
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push dword [edi + 8]
call esi
mov dword [edi + 8], eax
push dword [edi + 0xc]
call esi
mov dword [edi + 0xc], eax
push dword [edi + 0x10]
call esi
mov dword [edi + 0x10], eax
push dword [edi + 0x14]
call esi
mov dword [edi + 0x14], eax
push dword [edi + 0x18]
call esi
mov dword [edi + 0x18], eax
push dword [edi + 0x1c]
call esi
mov dword [edi + 0x1c], eax
pcmpeqd xmm0, xmm0
mov eax, esp
movdqa xmmword [eax + 0x20], xmm0
movdqa xmmword [eax + 0x10], xmm0
movdqa xmmword [eax], xmm0
push eax
push ebx
call fcn.00515371
add esp, 8
mov esi, 6
test eax, eax
jne 0x43ad60
mov eax, 0x4944424d
xor eax, dword [edi]
mov ecx, 0x30314646
xor ecx, dword [edi + 4]
or ecx, eax
mov esi, 8
jne 0x43ad60
mov eax, dword [esp + 0x14]
cmp eax, 0x20
jb 0x43ad60
add eax, 0xffffffe0
sub eax, dword [edi + 0x14]
jb 0x43ad60
sub eax, dword [edi + 0x18]
jb 0x43ad60
cmp eax, dword [edi + 0x1c]
jb 0x43ad60
setne al
movzx esi, al
shl esi, 3
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.00504596
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43ad80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov edi, dword [ecx + 0x18]
add edi, dword [ecx + 0x14]
add edi, dword [ecx + 0x1c]
push edi
call fcn.004e8530
add esp, 4
test eax, eax
je 0x43add4
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov esi, eax
test edi, edi
je 0x43add9
push edi
push esi
push ebx
call fcn.0051706f
add esp, 0xc
test eax, eax
js 0x43adf9
sub edi, eax
add esi, eax
test eax, eax
jne 0x43adb3
test edi, edi
je 0x43adb3
jmp 0x43adf0
xor eax, eax
inc eax
jmp 0x43ae0e
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
imul ecx, eax, 0xaaaaaaab
ror ecx, 2
cmp ecx, 0x15555555
jbe 0x43ae16
mov dword [ebp - 0x10], 8
jmp 0x43ae00
mov dword [ebp - 0x10], 6
push dword [ebp - 0x1c]
call fcn.004e8580
add esp, 4
mov eax, dword [ebp - 0x10]
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
test eax, eax
jle 0x43af13
mov ebx, dword [ebp - 0x1c]
mov esi, ebx
add esi, eax
mov eax, dword [edx + 0x18]
add eax, esi
mov ecx, dword [edx + 0x1c]
add ecx, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], esi
mov edi, dword [ebp + 0x10]
push dword [ebx]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebx], eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebx + 4], eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebx + 8], eax
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x20]
sub ecx, edi
cmp eax, ecx
ja 0x43adf0
mov ecx, dword [ebp - 0x2c]
sub ecx, esi
cmp eax, ecx
ja 0x43adf0
test eax, eax
je 0x43ae8d
xor eax, eax
mov cl, byte [edi + eax]
add byte [esi + eax], cl
inc eax
mov ecx, dword [ebx]
cmp eax, ecx
jb 0x43ae7e
jmp 0x43ae8f
xor ecx, ecx
push ecx
push esi
push dword [ebp + 0x14]
call fcn.0051af09
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp eax, dword [ebx]
jne 0x43af1f
mov dword [ebp - 0x10], 7
mov eax, dword [ebx + 4]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
sub ecx, edx
cmp eax, ecx
ja 0x43adf0
push eax
push edx
push dword [ebp + 0x14]
call fcn.0051af09
add esp, 0xc
cmp eax, dword [ebx + 4]
jne 0x43ae00
add edi, dword [ebp - 0x18]
mov ecx, dword [ebx + 8]
mov edx, dword [ebp + 0x10]
sub edx, edi
cmp ecx, edx
jl 0x43adf0
mov edx, dword [ebp - 0x20]
sub edx, edi
cmp ecx, edx
jg 0x43adf0
add esi, dword [ebp - 0x18]
add dword [ebp - 0x14], eax
add edi, ecx
add ebx, 0xc
mov dword [ebp - 0x10], 0
cmp ebx, dword [ebp - 0x24]
jb 0x43ae3e
jmp 0x43ae00
mov dword [ebp - 0x10], 0
jmp 0x43ae00
mov dword [ebp - 0x10], 7
jmp 0x43ae00
Function at 0x43af30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x5ff014]
xor ecx, ebp
mov dword [esp + 0x78], ecx
lea esi, [esp + 0x10]
mov dword [esi], 0xffffffff
xor ebx, ebx
push ebx
push esi
push ebx
push 0x40
push 0x8000
push eax
call fcn.00517d12
add esp, 0x18
cmp eax, 1
mov edi, 0
sbb edi, edi
not edi
or edi, dword [esi]
js 0x43afad
pcmpeqd xmm0, xmm0
lea eax, [esp + 0x50]
movdqa xmmword [eax + 0x10], xmm0
movdqa xmmword [eax], xmm0
push eax
push edi
call fcn.0043ac90
add esp, 8
xor ecx, ecx
dec ecx
test eax, eax
mov dword [esp + 4], ecx
je 0x43afb7
mov dword [esp], eax
mov esi, ecx
jmp 0x43b0ee
mov esi, 6
jmp 0x43b121
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0xffffffff
xor ebx, ebx
push ebx
push esi
push ebx
push 0x40
push 0x8000
push eax
call fcn.00517d12
add esp, 0x18
mov ecx, dword [esp + 0x10]
cmp eax, 1
mov eax, esi
mov esi, 0
sbb esi, esi
not esi
or esi, ecx
js 0x43b02a
mov dword [esp + 0xc], ecx
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
push eax
push esi
call fcn.00515371
add esp, 8
xor ebx, ebx
xor ecx, ecx
dec ecx
test eax, eax
mov dword [esp + 4], ecx
je 0x43b036
mov dword [esp], 6
jmp 0x43b0ea
mov dword [esp], 6
jmp 0x43b0ee
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x58]
jne 0x43b0d2
mov dword [esp], eax
push eax
call fcn.004e8530
add esp, 4
test eax, eax
je 0x43b0db
push dword [esp]
push eax
push esi
mov ebx, eax
call fcn.0051706f
add esp, 0xc
cmp eax, dword [esp + 0x58]
jne 0x43b01e
mov esi, eax
call fcn.00561f70
mov ecx, ebx
mov edx, esi
call fcn.00561f40
not eax
cmp dword [esp + 0x5c], eax
jne 0x43b0e3
mov dword [esp + 8], ebx
mov eax, dword [ebp + 0x10]
lea ebx, [esp + 0x4c]
mov dword [ebx], 0xffffffff
xor esi, esi
push esi
push ebx
push esi
push 0x40
push 0x8301
push eax
call fcn.00517d12
add esp, 0x18
mov ecx, dword [ebx]
cmp eax, 1
sbb esi, esi
not esi
or esi, ecx
js 0x43b136
mov dword [esp + 4], ecx
push esi
mov ebx, dword [esp + 0xc]
push ebx
push edi
lea eax, [esp + 0x5c]
push eax
call fcn.0043ad80
add esp, 0x10
jmp 0x43b0de
mov dword [esp], 8
jmp 0x43b0ea
xor eax, eax
inc eax
mov dword [esp], eax
jmp 0x43b0ea
mov dword [esp], 4
mov esi, dword [esp + 0xc]
push ebx
call fcn.004e8580
add esp, 4
push edi
call fcn.00512683
add esp, 4
test esi, esi
js 0x43b10d
push esi
call fcn.00512683
add esp, 4
mov eax, dword [esp + 4]
test eax, eax
js 0x43b11e
push eax
call fcn.00512683
add esp, 4
mov esi, dword [esp]
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00504596
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], esi
mov ebx, dword [esp + 8]
jmp 0x43b01e
Function at 0x43c8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4421c0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [ecx + 4], 1
jne 0x43c951
movzx edi, byte [ebp + 0x18]
mov eax, dword [esi]
mov ebx, dword [eax + 0x18]
mov ecx, ebx
call dword [section..00cfg]
movsx eax, byte [ebp + 0x14]
mov ecx, esi
push edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x30]
mov ecx, dword [ebp + 0x10]
push esi
call fcn.004d9660
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x60592c
call fcn.004d9fd0
mov esi, eax
mov edi, dword [ebp - 0x30]
xor ebx, ebx
dec ebx
mov eax, ebx
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x43c9a3
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0xffffffff
call dword [section..00cfg]
mov ecx, edi
call dword [ebp - 0x24]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov eax, dword [esi]
mov cl, byte [ebp + 0x18]
xor cl, 1
movzx ecx, cl
mov edi, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], ebx
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
lea eax, [ebp - 0x30]
push eax
call edi
movzx eax, byte [ebp - 0x25]
test al, al
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov esi, eax
cmovs esi, edx
test esi, esi
je 0x43ca79
test al, al
lea esi, [ebp - 0x30]
cmovs esi, ecx
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x20], 0
je 0x43ca49
mov eax, dword [ebp - 0x24]
mov al, byte [eax]
movzx esi, al
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 0x18]
cmp ecx, dword [edx + 0x1c]
je 0x43ca52
lea edx, [ecx + 1]
mov edi, dword [ebp - 0x20]
mov dword [edi + 0x18], edx
mov byte [ecx], al
xor edi, edi
cmp esi, 0xffffffff
je 0x43ca20
mov edi, dword [ebp - 0x20]
mov al, byte [ebp - 0x25]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edi
mov ebx, dword [ebp - 0x24]
inc ebx
test al, al
lea esi, [ebp - 0x30]
cmovs esi, ecx
movzx edi, al
cmovs edi, edx
add edi, esi
mov dword [ebp - 0x24], ebx
cmp ebx, edi
jne 0x43c9f2
jmp 0x43ca79
mov dword [ebp - 0x20], 0
jmp 0x43ca2c
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov edi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov dword [ebp - 0x10], 1
mov ecx, ebx
push esi
call edi
mov esi, eax
jmp 0x43ca16
shr al, 7
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0x20]
mov dword [edx], esi
test al, al
je 0x43ca91
push ecx
call fcn.00503da5
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x43c947
Function at 0x44c1d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ecx], eax
mov ebx, dword [ebp + 8]
mov dword [ebp + 8], eax
lea edi, [ebx + 1]
cmp edi, 2
jb 0x44c1fc
call fcn.004deab0
cmp dword [esi], ebx
je 0x44c229
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x44c2d8
cmp edi, 2
jb 0x44c222
mov dword [esi], ebx
mov edi, eax
call fcn.004deab0
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x14], esp
mov dword [esi + 4], 0xffffffff
lea eax, [esi + 8]
mov dword [ebp - 0x18], eax
push eax
mov edi, esp
xor eax, eax
mov dword [edi], eax
lea ecx, [ebp + 8]
mov ebx, dword [ecx + 4]
mov dword [ecx + 4], eax
cmp ebx, 0xffffffff
je 0x44c257
test ebx, ebx
je 0x44c277
call fcn.004deab0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x44c270
mov dword [edi], ebx
mov edi, eax
call fcn.004deab0
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x18]
call fcn.00564e50
mov esp, dword [ebp - 0x14]
lea edi, [ebp + 8]
mov eax, dword [edi]
inc eax
cmp eax, 2
jb 0x44c2a2
call fcn.004deab0
push dword [edi]
call fcn.004e84d0
add esp, 4
mov dword [edi], 0
mov eax, dword [edi + 4]
inc eax
cmp eax, 2
jb 0x44c2c2
call fcn.004deab0
push dword [edi + 4]
call fcn.004e84d0
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [ebp - 0x14], eax
call fcn.004deab0
push dword [esi]
call fcn.004e84d0
mov eax, dword [ebp - 0x14]
add esp, 4
mov dword [esi], 0
jmp 0x44c212
Function at 0x44cd80
Capabilities:
Create process on windows
Inject apc
Query environment variable
Resume thread
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x320
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x318], eax
lea esi, [esp + 0x110]
push 0x208
push 0xff
push esi
call fcn.00508060
add esp, 0xc
push 0x104
push esi
push str._SystemRoot_System32_rundll32.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
xor ebx, ebx
cmp eax, 0x102
ja 0x44cf90
xorps xmm0, xmm0
lea eax, [esp + 0xcc]
movups xmmword [eax + 0x34], xmm0
movups xmmword [eax + 0x24], xmm0
movups xmmword [eax + 0x14], xmm0
movups xmmword [eax + 4], xmm0
mov dword [eax], 0x44
lea ecx, [esp + 0xb0]
movaps xmmword [ecx], xmm0
sub esp, 0x28
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x5e1a50]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x44cf8b
mov dword [esp], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi + 0xb]
test al, al
jns 0x44ce45
mov eax, dword [esi + 4]
add eax, eax
add eax, 2
push 4
push 0x1000
push eax
push 0
push dword [esp + 0xc0]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
je 0x44cf1b
lea edx, [esp + 8]
mov dword [edx], 0
movzx ecx, byte [esi + 0xb]
test cl, cl
cmovs ecx, dword [esi + 4]
lea ecx, [ecx + ecx + 2]
cmovs esi, dword [esi]
push edx
push ecx
push esi
mov dword [esp + 0x10], eax
push eax
push dword [esp + 0xc0]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x5e1be4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5e1bfe
push eax
call ebx
mov edi, eax
push 0x5e1c04
push esi
call ebx
mov ecx, ebx
mov ebx, eax
push 0x5e1c10
push esi
call ecx
xor ecx, ecx
test edi, edi
je 0x44cf17
test ebx, ebx
je 0x44cf17
test eax, eax
je 0x44cf17
mov esi, dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push dword [ebp + 0xc]
push dword [esp + 0xb8]
push edi
mov edi, eax
call esi
push dword [esp + 4]
push dword [esp + 0xb8]
push ebx
call esi
push 0
push dword [esp + 0xb8]
push edi
call esi
push dword [esp + 0xb4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp]
mov ebx, ecx
jmp 0x44cf73
push 2
call fcn.004deac0
add esp, 4
test al, al
mov ebx, dword [esp]
je 0x44cf64
call fcn.00551fb0
lea esi, [esp + 8]
mov ecx, esi
push eax
push 2
push 0x15b
push str..._.._chrome_installer_setup_setup_util.cc
call fcn.005520e0
lea eax, [esp + 0x10]
push 0xe
push 0x5e1c1c
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, esi
call fcn.00552140
push 0xffffffffffffffff
push dword [esp + 0xb4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0xb4]
call esi
push dword [esp + 0xb0]
call esi
test ebx, ebx
setne bl
mov ecx, dword [esp + 0x318]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44e770
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x44e807
xor edi, edi
lea ecx, [ebp - 0x14]
mov dword [ecx], edi
lea edx, [ebp - 0x18]
mov dword [edx], edi
push edx
push ecx
push 0x18
push eax
push edi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x44e810
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0x1c]
mov dword [eax], 0xffffffff
push eax
mov esi, esp
mov edi, dword [ebp - 0x14]
push 0x18
call fcn.00503d75
add esp, 4
mov ebx, eax
mov ecx, eax
push 0x435740
push 0x44ece0
call fcn.004dbc50
mov dword [ebx + 0x10], 0x5b46f0
mov dword [ebx + 0x14], edi
mov dword [esi], ebx
lea ecx, [ebp - 0x1c]
call fcn.004ed560
mov esp, dword [ebp - 0x20]
cmp dword [ebp - 0x18], 0xd7
ja 0x44e817
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi], eax
jmp 0x44e832
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
jmp 0x44e83a
mov dword [esi + 4], edi
mov dword [esi], edi
jmp 0x44e83a
mov eax, dword [ebp - 0x14]
push dword [eax + 0xcc]
push dword [eax + 0xc8]
mov esi, dword [ebp + 8]
push esi
call fcn.004616a0
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.004ed580
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44fda0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov esi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x158], eax
xor ebx, ebx
dec ebx
lea edi, [esp + 0x14c]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
add esi, 4
mov eax, str.chrome.exe
push eax
call fcn.0051f544
add esp, 4
mov ecx, esi
push eax
mov eax, str.chrome.exe
push eax
push edi
call fcn.004de0b0
lea ecx, [esp + 0x120]
mov dword [ecx + 0x20], ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
push edi
call fcn.00451030
mov ebx, esp
mov eax, dword [ebp + 0xc]
push dword [eax + 0x28]
push ebx
call fcn.00457950
add esp, 8
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x44fe2f
mov ebx, dword [esp]
mov eax, dword [esp + 4]
mov ecx, str.try_chrome_again
push ecx
mov esi, eax
call fcn.0051f310
add esp, 4
lea ecx, [esp + 0x120]
push esi
push ebx
push eax
mov eax, str.try_chrome_again
push eax
call fcn.00451e10
cmp byte [esp + 0xb], 0
jns 0x44fe66
push dword [esp]
call fcn.00503da5
add esp, 4
pxor xmm0, xmm0
movdqu xmmword [esp + 0x110], xmm0
movdqu xmmword [esp + 0x100], xmm0
movdqu xmmword [esp + 0xf0], xmm0
movdqu xmmword [esp + 0xe0], xmm0
mov dword [esp + 0xdc], 0x44
movdqa xmmword [esp + 0xc0], xmm0
lea esi, [esp + 0xb4]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea ecx, [esp + 0x120]
push esi
call fcn.00452970
cmp byte [esi + 0xb], 0
jns 0x44fece
mov esi, dword [esp + 0xb4]
cmp byte [esp + 0x157], 0
jns 0x44fedf
mov edi, dword [esp + 0x14c]
sub esp, 0x28
lea ebx, [esp + 0xe8]
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x104]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
movdqa xmm0, xmmword [0x5e2050]
movdqu xmmword [esp + 8], xmm0
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x44ff3c
pcmpeqd xmm0, xmm0
mov esi, esp
movdqa xmmword [esi], xmm0
mov ecx, esi
push ebx
call fcn.0047e2a0
mov ecx, esi
call fcn.0047e3b0
jmp 0x44ff91
push 2
call fcn.004deac0
add esp, 4
test al, al
je 0x44ff91
call fcn.00551fb0
mov esi, esp
mov ecx, esi
push eax
push 2
push 0x228
push str..._.._chrome_installer_setup_user_experiment.cc
call fcn.005520e0
lea eax, [esp + 8]
push 0x12
push str.Failed_to_launch:
push eax
call fcn.004d4870
add esp, 0xc
lea ecx, [esp + 0xb4]
push ecx
push eax
call fcn.00455670
add esp, 8
mov ecx, esi
call fcn.00552140
cmp byte [esp + 0xbf], 0
jns 0x44ffaa
push dword [esp + 0xb4]
call fcn.00503da5
add esp, 4
lea ecx, [esp + 0x120]
call fcn.00451270
lea ecx, [esp + 0x14c]
call fcn.004dd1f0
mov ecx, dword [esp + 0x158]
xor ecx, ebp
call fcn.00504596
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4512d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x605fe4]
test ebx, ebx
jne 0x451348
push 0x24
call fcn.00503d75
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax + 4], edi
mov dword [eax], edi
push 0xc
call fcn.00503d75
add esp, 4
mov dword [esi + 8], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x10], ecx
mov dword [eax + 8], edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [esi + 0xc], ecx
lea eax, [esi + 0x18]
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], 1
mov dword [0x605fe4], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x451352
mov edi, eax
push eax
call fcn.0051f544
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00451360
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x453130
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
xor eax, eax
mov dword [ecx], eax
mov ebx, dword [ebp + 8]
mov dword [ebp + 8], eax
lea edi, [ebx + 1]
cmp edi, 2
jb 0x453150
call fcn.004deab0
cmp dword [esi], ebx
je 0x453179
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x4531b1
cmp edi, 2
jb 0x453172
mov dword [esi], ebx
mov edi, eax
call fcn.004deab0
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
call fcn.004dd0a0
lea ecx, [esi + 0x10]
call fcn.004ee690
mov dword [esi + 0x14], 0
mov byte [esi + 0x18], 0
lea edi, [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 0x19], al
mov eax, dword [edi]
inc eax
cmp eax, 2
jae 0x4531ce
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [ebp - 0x10], eax
call fcn.004deab0
push dword [esi]
call fcn.004e84d0
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
jmp 0x453162
call fcn.004deab0
push dword [edi]
call fcn.004e84d0
add esp, 4
mov dword [edi], 0
jmp 0x4531a5

Function at 0x4531f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.004e7f60
mov dword [esi], 0
test eax, eax
je 0x453237
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x453269
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x453230
mov dword [esi], ebx
mov ebx, eax
call fcn.004deab0
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.004dd0c0
lea ecx, [esi + 0x10]
call fcn.004ee690
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.004deab0
push dword [esi]
call fcn.004e84d0
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
jmp 0x45321d