joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409273
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x2dc
mov eax, 0x4dbfa9
call fcn.004bb813
mov ebx, dword [ebp + 8]
call fcn.00409c55
test al, al
jne 0x4092bd
push 0x28
call fcn.004b9bb1
pop ecx
mov edi, eax
xor esi, esi
call fcn.004bbc9b
add eax, dword [0x532ad4]
mov dword [edi + esi*4], eax
inc esi
cmp esi, 0xa
jl 0x40929a
mov eax, dword [edi + 0x24]
push edi
mov dword [0x532ad4], eax
call fcn.004baa14
pop ecx
and dword [ebp - 0x2c8], 0
lea eax, [ebp - 0x2c8]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4092ed
xor al, al
jmp 0x4094cc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
xor edi, edi
call fcn.004bc640
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x2cc]
push eax
lea eax, [ebp - 0x218]
push eax
push ecx
push dword [ebp - 0x2c8]
mov dword [ebp - 0x2cc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
call fcn.00409c09
test al, al
jne 0x4094a8
lea eax, [ebp - 0x2c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x4094a8
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2d0]
call fcn.00401855
and dword [ebp - 4], 0
and dword [ebp - 0x2d8], 0
push str.Volatile_Environment
lea ecx, [ebp - 0x2dc]
call fcn.00401855
push 0x5311f0
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 1
call fcn.00401749
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x2e0]
push eax
mov byte [ebp - 4], 2
call fcn.0044ced3
lea ecx, [ebp - 0x2dc]
push ecx
push eax
lea eax, [ebp - 0x2e4]
push eax
mov byte [ebp - 4], 3
call fcn.0044ced3
add esp, 0x18
lea ecx, [ebp - 0x2d8]
push ecx
push 0x20019
push 0
push dword [eax]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x2e4]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00404c8b
mov ecx, dword [ebp - 0x2e0]
add ecx, 0xfffffff0
call fcn.00404c8b
mov ecx, dword [ebp - 0x2d4]
lea ecx, [ecx - 0x10]
call fcn.00404c8b
mov ecx, dword [ebp - 0x2dc]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00404c8b
test esi, esi
jne 0x409468
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2e8]
call fcn.00401855
push eax
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.00409c9b
mov ecx, dword [ebp - 0x2e8]
lea ecx, [ecx - 0x10]
call fcn.00404c8b
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x2cc]
push eax
lea eax, [ebp - 0x218]
push eax
inc edi
push edi
push dword [ebp - 0x2c8]
mov dword [ebp - 0x2cc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, dword [ebp - 0x2d0]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
mov esi, eax
call fcn.00404c8b
test esi, esi
je 0x409359
push dword [ebp - 0x2c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
xor ecx, ecx
sar eax, 2
cmp ecx, eax
sbb eax, eax
neg eax
call fcn.004bb7c2
ret
Function at 0x40eec6
Capabilities:
Write file on windows

Disassembly:
push 0x28
mov eax, 0x4dca5e
call fcn.004bb813
mov esi, ecx
mov dword [ebp - 0x2c], esi
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x40efd1
cmp byte [esi + 0x46], bl
je 0x40efd1
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x40ef05
xor al, al
jmp 0x40efd3
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0040f778
lea eax, [esi + 0x48]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x34]
mov ecx, dword [ecx + 0x40]
push eax
mov eax, dword [ebp - 0x18]
lea edi, [ebp - 0x28]
cmovae edi, edx
lea esi, [ebp - 0x28]
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
push dword [ebp - 0x30]
call dword [edx + 0x20]
sub eax, ebx
je 0x40ef60
dec eax
jne 0x40efb8
mov esi, dword [ebp - 0x2c]
jmp 0x40ef66
mov esi, dword [ebp - 0x2c]
mov byte [esi + 0x46], bl
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x34]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, edx
sub edi, eax
je 0x40ef9e
push dword [esi + 0x50]
cmp ecx, 0x10
push edi
lea eax, [ebp - 0x28]
cmovae eax, edx
push 1
push eax
call fcn.004be23c
add esp, 0x10
cmp edi, eax
jne 0x40efc1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [esi + 0x46], 0
je 0x40efbf
test edi, edi
jne 0x40ef2c
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.0040f5a7
jmp 0x40ef26
dec eax
dec eax
jne 0x40efc5
inc eax
jmp 0x40efc3
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.00401056
mov al, bl
jmp 0x40efd3
mov al, 1
call fcn.004bb7c2
ret

Function at 0x42ae31
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 8]
xor ebx, ebx
call fcn.0042ac48
mov esi, eax
pop ecx
test esi, esi
jne 0x42ae4c
push 7
pop eax
jmp 0x42aebf
push edi
call fcn.0042acd7
push esi
test eax, eax
je 0x42aea1
jmp 0x42ae76
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42aead
mov eax, ebx
inc ebx
cmp eax, 3
jge 0x42aead
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test edi, edi
je 0x42ae59
jmp 0x42aead
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42aead
mov eax, ebx
inc ebx
cmp eax, 3
jge 0x42aead
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, eax
test edi, edi
je 0x42ae84
push esi
call fcn.004392e1
pop ecx
push 0xa
xor ecx, ecx
pop eax
test edi, edi
cmovne eax, ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42af24
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
call fcn.0042ac48
mov esi, eax
pop ecx
test esi, esi
jne 0x42af3c
push 7
pop eax
jmp 0x42af67
push ebx
call fcn.0042acd7
push esi
test eax, eax
je 0x42af4f
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x42af55
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
cmp eax, 0xffffffff
push esi
setne bl
call fcn.004392e1
pop ecx
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x42b021
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x42b030
xor eax, eax
jmp 0x42b08e
call fcn.0042acd7
test eax, eax
jne 0x42b047
push esi
call fcn.004bb070
pop ecx
cmp eax, 0x104
ja 0x42b02c
push esi
call fcn.0042ac48
mov esi, eax
pop ecx
test esi, esi
jne 0x42b059
push 7
pop eax
jmp 0x42b08e
push ebx
call fcn.0042acd7
push esi
test eax, eax
je 0x42b06c
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x42b072
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
mov ebx, eax
call fcn.004392e1
pop ecx
cmp ebx, 0xffffffff
jne 0x42b084
xor eax, eax
jmp 0x42b08d
movsx eax, bl
and eax, 0x10
shr eax, 4
pop ebx
pop esi
pop ebp
ret

Function at 0x42b2ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a8
mov eax, dword [0x531698]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5330d4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test eax, eax
je 0x42b32b
push 0x118
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004be5d0
add esp, 0xc
mov byte [ebp - 0x24], 0
jmp 0x42b3a3
call fcn.0042acd7
mov esi, 0x118
test eax, eax
je 0x42b36c
lea eax, [ebp - 0x3a8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x3a8]
push eax
call fcn.0042b550
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x42b388
push 7
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bb744
leave
ret
lea eax, [ebp - 0x274]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x274]
push eax
call fcn.0042ad91
jmp 0x42b353
push esi
lea eax, [ebp - 0x13c]
push ebx
push eax
call fcn.004be5d0
push ebx
mov byte [ebp - 0x24], 0
call fcn.004392e1
add esp, 0x10
lea eax, [ebp - 0x13c]
push eax
call fcn.004bb070
pop ecx
test eax, eax
jle 0x42b3c6
lea ecx, [ebp - 0x13c]
cmp byte [ecx + eax - 1], 0x5c
jne 0x42b3c6
dec eax
test eax, eax
jg 0x42b3ba
cmp eax, 0x136
jae 0x42b42b
mov byte [ebp + eax - 0x13c], 0
lea eax, [ebp - 0x13c]
push eax
push str._setilqs_
push edi
call fcn.004c1d88
push edi
call fcn.004bb070
mov esi, eax
lea ecx, [edi + esi]
push ecx
push 0xf
call fcn.004327ca
add esp, 0x18
push 0xf
pop ecx
movzx eax, byte [edi + esi]
xor edx, edx
push 0x3e
pop ebx
div ebx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi], al
inc esi
dec ecx
jne 0x42b400
push edi
mov byte [edi + esi], cl
call fcn.0042af24
pop ecx
test eax, eax
jne 0x42b3d5
jmp 0x42b35d
call fcn.004c2358
int3
Function at 0x42b431
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x5330d0], 0
push esi
jne 0x42b473
call fcn.0042af1d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
mov dword [0x5330d8], esi
cmp esi, 0xffffffff
jne 0x42b462
call fcn.0042b091
xor eax, eax
jmp 0x42b4ec
mov dword [0x5330d0], 1
call fcn.0042b091
jmp 0x42b479
mov esi, dword [0x5330d8]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x42b4b7
test ebx, ebx
jne 0x42b4e9
push 0xc
call fcn.0042adbb
mov ebx, eax
pop ecx
test ebx, ebx
je 0x42b4e9
push edi
mov esi, 0x4eb7fc
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
push dword [0x5330d8]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
jmp 0x42b4e9
test ebx, ebx
je 0x42b4e9
test eax, eax
jns 0x42b4e9
push 0xc
push 0x4eb7fc
push ebx
call fcn.004c041a
add esp, 0xc
test eax, eax
jne 0x42b4e9
push ebx
call fcn.004ba78f
pop ecx
xor ebx, ebx
push ebx
push dword [0x5330d8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
Function at 0x43692d
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 2
jge 0x43693e
push 0x17
pop eax
jmp 0x4369a8
push ebx
mov ebx, dword [ebp + 8]
push esi
movzx eax, byte [ebx + edi - 1]
movzx ecx, byte [ebx]
movzx eax, byte [eax + 0x4eeee0]
movzx ecx, byte [ecx + 0x4eeee0]
imul eax, eax, 3
shl ecx, 2
xor eax, ecx
xor eax, edi
push 0x7f
cdq
pop ecx
idiv ecx
movzx esi, byte [edx + str.Pk_]
jmp 0x4369a0
movzx eax, byte [esi + 0x4ee950]
cmp eax, edi
jne 0x436999
movzx eax, word [esi*2 + 0x4ee9c8]
push edi
add eax, str.ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSTATEMENTANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHEREVIRTUAL
push ebx
push eax
call fcn.004398e9
add esp, 0xc
test eax, eax
je 0x4369ab
movzx esi, byte [esi + 0x4ee8d8]
dec esi
jns 0x436972
push 0x17
pop eax
pop esi
pop ebx
pop edi
pop ebp
ret
movzx eax, byte [esi + 0x4eeab8]
jmp 0x4369a6

Function at 0x4369b4
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043632d

Function at 0x4369bd
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043692d
Function at 0x438f7e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, esi
xorps xmm0, xmm0
mov dword [ebp - 8], 1
mov dword [ebp - 4], edi
movsd qword [ebp - 0x10], xmm0
jmp 0x438fa0
inc esi
movsx eax, byte [esi]
push eax
call fcn.004bcadf
pop ecx
test eax, eax
jne 0x438f9f
mov al, byte [esi]
cmp al, 0x2d
jne 0x438fba
or dword [ebp - 8], 0xffffffff
jmp 0x438fe7
cmp al, 0x2b
jne 0x438fe8
jmp 0x438fe7
movsx eax, byte [esi]
movsd xmm1, qword [ebp - 0x10]
mulsd xmm1, qword [0x4e7e68]
sub eax, 0x30
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm1
movaps xmm1, xmm0
movsd qword [ebp - 0x10], xmm1
inc esi
movzx eax, byte [esi]
push eax
call fcn.004bca89
pop ecx
test eax, eax
jne 0x438fc0
cmp byte [esi], 0x2e
movsd xmm0, qword [0x4e9bd8]
movsd qword [ebp - 0x18], xmm0
jne 0x439066
movsd qword [ebp - 0x20], xmm0
jmp 0x439048
movsx eax, byte [esi]
movsd xmm1, qword [ebp - 0x10]
mulsd xmm1, qword [0x4e7e68]
sub eax, 0x30
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm1
movaps xmm1, xmm0
movsd xmm0, qword [ebp - 0x20]
mulsd xmm0, qword [0x4e7e68]
movsd qword [ebp - 0x10], xmm1
movsd qword [ebp - 0x20], xmm0
inc esi
movzx eax, byte [esi]
push eax
call fcn.004bca89
pop ecx
test eax, eax
jne 0x43900f
movsd xmm0, qword [ebp - 0x10]
divsd xmm0, qword [ebp - 0x20]
movsd qword [ebp - 0x10], xmm0
mov al, byte [esi]
cmp al, 0x65
je 0x439074
cmp al, 0x45
jne 0x43915c
xor edi, edi
inc esi
mov dword [ebp + 8], 1
mov al, byte [esi]
cmp al, 0x2d
jne 0x43908a
or dword [ebp + 8], 0xffffffff
jmp 0x43908e
cmp al, 0x2b
jne 0x43908f
inc esi
movzx eax, byte [esi]
push eax
call fcn.004bca89
pop ecx
test eax, eax
je 0x43913b
movsx eax, byte [esi]
imul edi, edi, 0xa
add eax, 0xffffffd0
add edi, eax
inc esi
movzx eax, byte [esi]
push eax
call fcn.004bca89
pop ecx
test eax, eax
jne 0x4390a1
movsd xmm0, qword [0x4e9bd8]
cmp edi, 0x40
jl 0x4390e4
mov ecx, edi
shr ecx, 6
mov eax, ecx
imul eax, eax, 0xffffffc0
add edi, eax
mulsd xmm0, qword [0x4ef020]
dec ecx
jne 0x4390d4
movsd qword [ebp - 0x18], xmm0
cmp edi, 0x10
jl 0x439105
mov ecx, edi
shr ecx, 4
mov eax, ecx
imul eax, eax, 0xfffffff0
add edi, eax
mulsd xmm0, qword [0x4ef018]
dec ecx
jne 0x4390f5
movsd qword [ebp - 0x18], xmm0
cmp edi, 4
jl 0x439126
mov ecx, edi
shr ecx, 2
mov eax, ecx
imul eax, eax, 0xfffffffc
add edi, eax
mulsd xmm0, qword [0x4ef010]
dec ecx
jne 0x439116
movsd qword [ebp - 0x18], xmm0
cmp edi, 1
jl 0x43913b
mulsd xmm0, qword [0x4e7e68]
dec edi
jne 0x43912b
movsd qword [ebp - 0x18], xmm0
cmp dword [ebp + 8], 0
mov edi, dword [ebp - 4]
jge 0x439150
movsd xmm0, qword [ebp - 0x10]
divsd xmm0, qword [ebp - 0x18]
jmp 0x439161
movsd xmm0, qword [ebp - 0x18]
mulsd xmm0, qword [ebp - 0x10]
jmp 0x439161
movsd xmm0, qword [ebp - 0x10]
cmp dword [ebp - 8], 0
jge 0x43916f
xorpd xmm0, xmmword [0x4e9c80]
mov ecx, dword [ebp + 0xc]
sub esi, edi
pop edi
mov eax, esi
movsd qword [ecx], xmm0
pop esi
leave
ret
Function at 0x447eb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x531698]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push esi
mov esi, dword [0x53540c]
push edi
push 0xf0
push eax
xor edi, edi
push esi
mov dword [ebp - 0x10c], ecx
inc edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x44801f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x44801f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x44801f
push ebx
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x44801e
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
mov dword [ebp - 0x110], ecx
mov ecx, 0x403
add esi, 8
cmp cx, ax
jne 0x447f98
push 3
lea eax, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x108], eax
call fcn.00448b45
push dword [ebp - 0x108]
mov eax, dword [ebp - 0x10c]
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x104]
cmove edi, ecx
cmp dword [ebp - 0x108], eax
je 0x448010
push dword [ebp - 0x108]
call fcn.004bbd0c
pop ecx
jmp 0x448010
mov ecx, 0x1234
cmp cx, ax
jne 0x448010
or dword [ebp - 0x130], 0xffffffff
push 3
lea eax, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x134], 1
mov dword [ebp - 0x108], eax
call fcn.00448b45
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x12c], eax
cmp eax, ecx
je 0x447fea
push eax
call fcn.004bbd0c
pop ecx
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x10c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x110]
test edi, edi
jne 0x447f0f
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004bb744
leave
ret 4

Function at 0x4493b2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0xcf
mov esi, ecx
call fcn.00447eb0
mov eax, dword [ebp + 0x14]
xor edi, edi
mov dword [eax], edi
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x44ac8c
push edi
push edi
mov dword [ebp - 4], edi
call fcn.004c2df8
add esp, 0x18
mov dword [esi + 0x30], eax
push edi
push 0x3e8
push 0x5df
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
pop edi
inc eax
pop esi
leave
ret 0x10
Function at 0x44b73e
Capabilities:
Get disk size
Get file size
Read file on windows

Disassembly:
push 0x14
mov eax, 0x4dd38c
call fcn.004bb7e0
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
push str.chrome
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], ebx
call fcn.00403740
test eax, eax
jle 0x44b8db
push 0x5c
push dword [ebp + 0xc]
call fcn.004bd397
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x44b77f
or esi, 0xffffffff
jmp 0x44b784
sub esi, dword [ebp + 0xc]
sar esi, 1
mov ecx, dword [0x532ad4]
push 5
lea eax, [ecx + 1]
imul eax, ecx
cdq
pop ecx
idiv ecx
cmp edx, 3
jne 0x44b7a6
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor ebx, ebx
inc ebx
test esi, esi
jle 0x44b8bb
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0xc]
call fcn.0040491d
push str.VisualElementsManifest.xml
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], bl
call fcn.00401e50
add esp, 0xc
push 0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00404be3
xor ecx, ecx
push ecx
push 0x80
push 3
push ecx
push ecx
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x44b8a1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [esi + 0xa]
push ecx
call fcn.004c1f38
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x1c]
push eax
push esi
mov esi, dword [ebp - 0x18]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
push str.SplashScreen_Image
push edi
mov byte [eax + edi], 0
call fcn.004c3190
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x44b8a1
push str.SplashScreen_Image
call fcn.004bb070
inc eax
add esi, eax
push 0x5c
push esi
call fcn.004c3060
add esp, 0xc
test eax, eax
je 0x44b8a1
sub esp, 0x18
mov ecx, esp
push esi
mov byte [eax], 0
call fcn.00401027
push dword [ebp + 8]
call fcn.00465080
mov ecx, dword [ebp - 0x10]
add esp, 0x1c
lea ecx, [ecx - 0x10]
call fcn.00404c8b
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00404c8b
jmp 0x44b8e8
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404c8b
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00404c8b
call fcn.0044cdcc
test al, al
jne 0x44b8db
mov eax, ebx
mov edx, 0xc1
dec edx
lea ecx, [eax + ebx]
lea ebx, [eax]
mov eax, ecx
jns 0x44b8cb
mov dword [0x532ad4], ecx
mov ecx, dword [ebp + 8]
push 0x4efe6c
call fcn.00401855
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00404c8b
mov eax, dword [ebp + 8]
call fcn.004bb7ae
ret
Function at 0x44c8e2
Capabilities:
Check os version

Disassembly:
push 8
mov eax, 0x4dd5e9
call fcn.004bb7e0
and dword [ebp - 0x14], 0
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
shr ecx, 8
movzx edi, al
movzx ebx, cl
cmp eax, 0x80000000
jae 0x44c911
mov esi, eax
shr esi, 0x10
cmp edi, 6
jb 0x44c929
cmp ebx, 2
jb 0x44c929
push dword [ebp + 8]
call fcn.0044c971
mov eax, dword [ebp + 8]
pop ecx
jmp 0x44c96b
push 0x5311f0
lea ecx, [ebp - 0x10]
call fcn.00401749
and dword [ebp - 4], 0
push esi
push ebx
push edi
lea eax, [ebp - 0x10]
push 0x4f0374
push eax
call fcn.0040384a
mov edi, dword [ebp - 0x10]
add edi, 0xfffffff0
push edi
call fcn.0040356e
mov esi, dword [ebp + 8]
add eax, 0x10
add esp, 0x18
mov ecx, edi
mov dword [esi], eax
call fcn.00404c8b
mov eax, esi
call fcn.004bb7ae
ret
Function at 0x454a96
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, ecx
push 0
push dword [eax + 0x20]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov eax, 0x404
push eax
mov dword [ebp - 0x10], esi
call fcn.004b9bb1
pop ecx
push 4
pop ecx
xor ebx, ebx
mov edi, eax
cmp esi, ecx
jbe 0x454b4a
test ebx, ebx
jne 0x454b4a
lea eax, [ecx + 0x400]
cmp eax, esi
mov ecx, eax
cmova ecx, esi
push ebx
mov eax, esi
sub eax, ecx
push ebx
sub esi, eax
push eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push dword [eax + 0x20]
mov ecx, 0x404
cmp esi, ecx
cmova esi, ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push esi
push edi
push dword [eax + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esi, 0xfffffffd
jmp 0x454b35
dec esi
cmp byte [esi + edi], 0x50
jne 0x454b35
cmp byte [esi + edi + 1], 0x4b
jne 0x454b35
cmp byte [esi + edi + 2], 5
jne 0x454b35
cmp byte [esi + edi + 3], 6
je 0x454b3b
test esi, esi
jg 0x454b19
jmp 0x454b40
mov ebx, dword [ebp - 8]
add ebx, esi
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
cmp ecx, esi
jb 0x454acb
push edi
call fcn.004baa14
pop ecx
test ebx, ebx
je 0x454b5c
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
mov ecx, dword [ebp - 4]
push 0xffffffffffffff99
call fcn.00454104
int3