joyce8/EMBER2024-capa huggingface dataset:
Function at 0x566fc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb4a2
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x30], ebx
xor edi, edi
mov dword [ebp - 0x28], edi
lea ecx, [edi + 3]
call fcn.0059e240
mov esi, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x2c], edi
cmp dword [esi], edi
jbe 0x567049
xor ebx, ebx
nop
mov ecx, dword [esi + 4]
mov edi, dword [esi + 0xc]
add ecx, ebx
add edi, ebx
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005dc190
mov ecx, dword [ebp - 0x30]
push eax
call fcn.00566d80
mov edi, dword [ebp - 0x28]
add ebx, 0xc
add edi, eax
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], eax
cmp eax, dword [esi]
jb 0x567010
mov ebx, dword [ebp - 0x30]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
movq qword [ebp - 0x1c], xmm0
call fcn.005dc5e0
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
push 0
push 0
push 0x200
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], 0x200
call fcn.005db9a0
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x648054
lea ecx, [ebp - 0x1c]
call fcn.005da780
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push eax
push 0
mov ecx, ebx
call fcn.00566d80
push 0
push 1
push str.HivePermissionsChecked
push dword [ebx + 0x100]
add edi, eax
call fcn.00553890
lea ecx, [ebp - 0x1c]
call fcn.005dc430
push ecx
mov ecx, esi
call fcn.00402a20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x569a10
Capabilities:
Add user account to group

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb740
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x1a
lea ecx, [ebp - 0x34]
call fcn.005d8190
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movq qword [ebp - 0x28], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x569b09
lea edx, [ebp - 0x28]
call fcn.0059c490
test al, al
je 0x569b09
push 0x17
lea ecx, [ebp - 0x30]
call fcn.005d8190
push 0x18
lea ecx, [ebp - 0x2c]
call fcn.005d8190
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push 2
push eax
push 0
call fcn.005dc190
push eax
push 0
call dword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]
test eax, eax
je 0x569acf
cmp eax, 0x562
je 0x569acf
xor esi, esi
jmp 0x569ad4
mov esi, 1
cmp byte [ebp + 8], 0
je 0x569af7
push 0
push 0
test esi, esi
mov ecx, str.Failed_to_fix_the_local_group_access.
mov eax, str.Successfully_fixed_the_local_group_access.
cmove eax, ecx
mov ecx, edi
push 0
push eax
call fcn.0057b7e0
lea ecx, [ebp - 0x2c]
call fcn.005d8100
lea ecx, [ebp - 0x30]
call fcn.005d8100
jmp 0x569b0b
xor esi, esi
lea ecx, [ebp - 0x28]
call fcn.005dc430
lea ecx, [ebp - 0x34]
call fcn.005d8100
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
Function at 0x56a780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb848
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x40], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
push 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push 0x540310
push 0
push 0
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x34], esi
push ecx
mov dword [ebp - 4], 0
mov bl, 1
mov ecx, edi
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x38], bl
call fcn.0057c7a0
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x56a84c
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
test edi, edi
je 0x56a84c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
test eax, eax
je 0x56a84c
cmp eax, edi
jne 0x56a84c
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
movzx ebx, bl
test eax, eax
cmovne ebx, ecx
mov byte [ebp - 0x38], bl
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
je 0x56a896
xor edi, edi
mov eax, 3
test bl, bl
mov ebx, dword [ebp - 0x38]
cmovne edi, eax
mov ecx, dword [ebp - 0x40]
push edi
push ebx
call fcn.005494d0
test eax, eax
je 0x56a889
mov al, byte [ebp - 0x1c]
movzx ecx, al
test al, al
mov eax, 1
cmove ecx, eax
mov byte [ebp - 0x1c], cl
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x56a868
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp byte [ebp - 0x1c], 0
mov eax, 0xffffffff
mov edi, dword [ebp - 0x18]
cmovne edi, eax
cmp esi, eax
je 0x56a8bf
test esi, esi
je 0x56a8bf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 0x14
Function at 0x56bed9
Capabilities:
Check if file exists

Disassembly:
ret

Function at 0x56ce10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fbbc0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.Installing_uBlock_Origin_for_Edge...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, edi
call fcn.005494d0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x28]
movq qword [ebp - 0x28], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
call fcn.005dc5e0
push str.https:__microsoftedge.microsoft.com_addons_detail_ublock_origin_odfafepnkmbhccpbejgmiehpchacaeak
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push str.UBOforEdgeURL
mov ecx, edi
call fcn.005403a0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftEdgeApplicationmsedge.exe
sub esp, 8
mov ecx, edi
call fcn.0057c120
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.005dc200
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x56cf08
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.MicrosoftEdgeApplicationmsedge.exe
sub esp, 8
mov ecx, edi
call fcn.0057c080
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.005dc190
push eax
push 0x62438c
lea ecx, [ebp - 0x1c]
call fcn.005da780
push str.Running_Edge_to_install_uBlock_Origin..._r_nClick_Add_to_Edge_and_when_installed__close_it.
push 0xffffffffffffffff
mov ecx, edi
call fcn.0057b610
push 0
push 5
push 0
lea ecx, [ebp - 0x1c]
call fcn.005dc190
mov edx, eax
xor ecx, ecx
call fcn.005e2ad0
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 2
cmp esi, eax
je 0x56cf9e
test esi, esi
je 0x56cf9e
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
push esi
call fcn.0057a270
test al, al
jne 0x56cf85
or edi, 0xffffffff
jmp 0x56cfb2
push 0
push 0
push 0
push str.Successfully_launched_Edge_for_installing_uBlock_Origin
mov ecx, edi
call fcn.0057b7e0
mov edi, 1
jmp 0x56cfbb
push 0
push 0
push 0
push str.Failed_to_launch_Edge_for_installing_uBlock_Origin
mov ecx, edi
call fcn.0057b7e0
xor edi, edi
cmp esi, 0xffffffff
je 0x56cfc2
test esi, esi
je 0x56cfc2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
call fcn.005dc430
lea ecx, [ebp - 0x28]
call fcn.005dc430
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x56cff0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fbc04
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.Installing_uBlock_Origin_for_Firefox...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, edi
call fcn.005494d0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x28]
movq qword [ebp - 0x28], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
call fcn.005dc5e0
push str.https:__addons.mozilla.org_en_US_firefox_addon_ublock_origin_
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push str.UBOforFirefoxURL
mov ecx, edi
call fcn.005403a0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x63dc5c
sub esp, 8
mov ecx, edi
call fcn.0057c120
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.005dc200
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x56d0e8
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.Mozilla_Firefox_firefox.exe
sub esp, 8
mov ecx, edi
call fcn.0057c080
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.005dc190
push eax
push 0x62438c
lea ecx, [ebp - 0x1c]
call fcn.005da780
push str.Running_Firefox_to_install_uBlock_Origin..._r_nClick_Add_to_Firefox_and_when_installed__close_it.
push 0xffffffffffffffff
mov ecx, edi
call fcn.0057b610
push 0
push 5
push 0
lea ecx, [ebp - 0x1c]
call fcn.005dc190
mov edx, eax
xor ecx, ecx
call fcn.005e2ad0
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 2
cmp esi, eax
je 0x56d17e
test esi, esi
je 0x56d17e
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
push esi
call fcn.0057a270
test al, al
jne 0x56d165
or edi, 0xffffffff
jmp 0x56d192
push 0
push 0
push 0
push str.Successfully_launched_Firefox_for_installing_uBlock_Origin
mov ecx, edi
call fcn.0057b7e0
mov edi, 1
jmp 0x56d19b
push 0
push 0
push 0
push str.Failed_to_launch_Firefox_for_installing_uBlock_Origin
mov ecx, edi
call fcn.0057b7e0
xor edi, edi
cmp esi, 0xffffffff
je 0x56d1a2
test esi, esi
je 0x56d1a2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
call fcn.005dc430
lea ecx, [ebp - 0x28]
call fcn.005dc430
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x56d1d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fbc48
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.Installing_uBlock_Origin_for_Chrome...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, edi
call fcn.005494d0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x28]
movq qword [ebp - 0x28], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
call fcn.005dc5e0
push str.https:__chromewebstore.google.com_detail_ublock_origin_lite_ddkjiahejlhfcafbddmgiahcphecmpfh
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push str.UBOforChromeURL
mov ecx, edi
call fcn.005403a0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.GoogleChromeApplicationchrome.exe
sub esp, 8
mov ecx, edi
call fcn.0057c120
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.005dc200
lea ecx, [ebp - 0x1c]
call fcn.005dc190
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
jne 0x56d2ca
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.GoogleChromeApplicationchrome.exe
sub esp, 8
mov ecx, edi
call fcn.0057c080
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.005dc200
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push eax
call esi
test eax, eax
jne 0x56d2f9
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.GoogleChromeApplicationchrome.exe
push ecx
mov ecx, edi
call fcn.0057c260
push eax
lea ecx, [ebp - 0x1c]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.005dc190
push eax
push 0x62438c
lea ecx, [ebp - 0x1c]
call fcn.005da780
push str.Running_Chrome_to_install_uBlock_Origin..._r_nClick_Add_to_Chrome_and_when_installed__close_it.
push 0xffffffffffffffff
mov ecx, edi
call fcn.0057b610
push 0
push 5
push 0
lea ecx, [ebp - 0x1c]
call fcn.005dc190
mov edx, eax
xor ecx, ecx
call fcn.005e2ad0
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 2
cmp esi, eax
je 0x56d38f
test esi, esi
je 0x56d38f
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
push esi
call fcn.0057a270
test al, al
jne 0x56d376
or edi, 0xffffffff
jmp 0x56d3a3
push 0
push 0
push 0
push str.Successfully_launched_Chrome_for_installing_uBlock_Origin
mov ecx, edi
call fcn.0057b7e0
mov edi, 1
jmp 0x56d3ac
push 0
push 0
push 0
push str.Failed_to_launch_Chrome_for_installing_uBlock_Origin
mov ecx, edi
call fcn.0057b7e0
xor edi, edi
cmp esi, 0xffffffff
je 0x56d3b3
test esi, esi
je 0x56d3b3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
call fcn.005dc430
lea ecx, [ebp - 0x28]
call fcn.005dc430
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x56d3e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fbc8c
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.Installing_AdBlock_Plus_for_Edge...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, edi
call fcn.005494d0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x28]
movq qword [ebp - 0x28], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
call fcn.005dc5e0
push str.https:__microsoftedge.microsoft.com_addons_detail_adblock_plus_free_ad_bl_gmgoamodcdcjnbaobigkjelfplakmdhh
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push str.ABPforEdgeURL
mov ecx, edi
call fcn.005403a0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MicrosoftEdgeApplicationmsedge.exe
sub esp, 8
mov ecx, edi
call fcn.0057c120
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.005dc200
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x56d4d8
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.MicrosoftEdgeApplicationmsedge.exe
sub esp, 8
mov ecx, edi
call fcn.0057c080
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.005dc190
push eax
push 0x62438c
lea ecx, [ebp - 0x1c]
call fcn.005da780
push str.Running_Edge_to_install_AdBlock_Plus..._r_nClick_Add_to_Edge_and_when_installed__close_it.
push 0xffffffffffffffff
mov ecx, edi
call fcn.0057b610
push 0
push 5
push 0
lea ecx, [ebp - 0x1c]
call fcn.005dc190
mov edx, eax
xor ecx, ecx
call fcn.005e2ad0
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 2
cmp esi, eax
je 0x56d56e
test esi, esi
je 0x56d56e
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
push esi
call fcn.0057a270
test al, al
jne 0x56d555
or edi, 0xffffffff
jmp 0x56d582
push 0
push 0
push 0
push str.Successfully_launched_Edge_for_installing_AdBlock_Plus
mov ecx, edi
call fcn.0057b7e0
mov edi, 1
jmp 0x56d58b
push 0
push 0
push 0
push str.Failed_to_launch_Edge_for_installing_AdBlock_Plus
mov ecx, edi
call fcn.0057b7e0
xor edi, edi
cmp esi, 0xffffffff
je 0x56d592
test esi, esi
je 0x56d592
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
call fcn.005dc430
lea ecx, [ebp - 0x28]
call fcn.005dc430
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x56d5c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fbcd0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0xe4], 0
jne 0x56d5fc
xor eax, eax
jmp 0x56d794
push str.Installing_AdBlock_Plus_for_Firefox...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, edi
call fcn.005494d0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x28]
movq qword [ebp - 0x28], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
call fcn.005dc5e0
push str.https:__addons.mozilla.org_en_US_firefox_addon_adblock_plus_
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push str.ABPforFirefoxURL
mov ecx, edi
call fcn.005403a0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x63dc5c
sub esp, 8
mov ecx, edi
call fcn.0057c120
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.005dc200
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x56d6c8
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push str.Mozilla_Firefox_firefox.exe
sub esp, 8
mov ecx, edi
call fcn.0057c080
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.005dc190
push eax
push 0x62438c
lea ecx, [ebp - 0x1c]
call fcn.005da780
push str.Running_Firefox_to_install_AdBlock_Plus..._r_nClick_Add_to_Firefox_and_when_installed__close_it.
push 0xffffffffffffffff
mov ecx, edi
call fcn.0057b610
push 0
push 5
push 0
lea ecx, [ebp - 0x1c]
call fcn.005dc190
mov edx, eax
xor ecx, ecx
call fcn.005e2ad0
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 2
cmp esi, eax
je 0x56d75e
test esi, esi
je 0x56d75e
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
push esi
call fcn.0057a270
test al, al
jne 0x56d745
or edi, 0xffffffff
jmp 0x56d772
push 0
push 0
push 0
push str.Successfully_launched_Firefox_for_installing_AdBlock_Plus
mov ecx, edi
call fcn.0057b7e0
mov edi, 1
jmp 0x56d77b
push 0
push 0
push 0
push str.Failed_to_launch_Firefox_for_installing_AdBlock_Plus
mov ecx, edi
call fcn.0057b7e0
xor edi, edi
cmp esi, 0xffffffff
je 0x56d782
test esi, esi
je 0x56d782
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
call fcn.005dc430
lea ecx, [ebp - 0x28]
call fcn.005dc430
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x56fbf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fc0b1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0xe4], 0
jne 0x56fc2d
xor eax, eax
jmp 0x56fdb0
push str.Updating_the_DirectX__please_wait...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, esi
call fcn.005494d0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x28]
movq qword [ebp - 0x28], xmm0
call fcn.005dc5e0
sub esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0xe4]
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.dxwebsetup.exe
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005dc520
push str.https:__download.microsoft.com_download_1_7_1_1718CCC4_6315_4D8E_9543_8E28A4E18C4C_dxwebsetup.exe
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push str.DirectX
mov ecx, esi
call fcn.005403a0
push 0
lea ecx, [ebp - 0x28]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x1c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005795d0
cmp eax, 0xffffffff
jne 0x56fce9
push 0
push 1
mov ecx, esi
call fcn.005494d0
test eax, eax
jne 0x56fdcc
lea ecx, [ebp - 0x1c]
xor ebx, ebx
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x56fd81
push str.Installing_missing_DirectX_components...
push 0xffffffffffffffff
mov ecx, esi
call fcn.0057b610
push ebx
push 1
mov ecx, esi
call fcn.005494d0
mov ecx, dword [esi + 0xe4]
push 5
call fcn.005dc190
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x63d014
lea ecx, [ebp - 0x1c]
call fcn.005da780
mov ecx, eax
call fcn.005dc190
push eax
mov ecx, esi
call fcn.00579420
mov edi, eax
test edi, edi
je 0x56fd7a
mov ecx, edi
call fcn.005cc910
test al, al
je 0x56fd7a
push 0
push 0
mov ecx, esi
call fcn.005494d0
test eax, eax
jne 0x56fdcc
mov ecx, edi
call fcn.005cc910
test al, al
jne 0x56fd60
xor ebx, ebx
test edi, edi
setne bl
ret
push 0
push 0
test ebx, ebx
mov ecx, str.Failed_to_update_the_DirectX.
mov eax, str.Successfully_updated_the_DirectX.
cmove eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0057b7e0
lea ecx, [ebp - 0x1c]
call fcn.005dc430
lea ecx, [ebp - 0x28]
call fcn.005dc430
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
or ebx, 0xffffffff
jmp 0x56fd9e