joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4028e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402935
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40292e
test esi, esi
je 0x40292e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402910
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402b50
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402b88
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x402b7e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x402b8a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402b70
xor eax, eax
pop ebx
pop esi
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6a
nop
sub eax, 0x403d10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401710
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str.55222
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x40178a
cmp dword [ebp - 0x118], 0
je 0x40178a
jmp 0x4017ec
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x4017ec
mov dword [ebp - 0x120], 0x3c41
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4360b4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4360d0], edx
mov dword [ebp - 0x120], 0x3c41
mov dword [ebp - 0x120], 0x3c41
call fcn.004011c0
mov eax, dword [ebp + 8]
mov dword [0x4360cc], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401a60
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x40178a
mov esp, ebp
pop ebp
ret

Function at 0x401aa0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4360c0], 0x24e1
mov eax, dword [0x4360c0]
sub eax, 0x24e1
mov dword [0x4360c0], eax
mov ecx, 1
test ecx, ecx
je 0x401b4b
mov edx, dword [0x4360c0]
cmp edx, dword [ebp + 0xc]
jb 0x401ad7
jmp 0x401b4b
cmp dword [0x4360c0], 0
jne 0x401af5
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x401af5
xor eax, eax
jmp 0x401b4b
mov eax, dword [ebp + 8]
add eax, dword [0x4360c0]
mov ecx, dword [eax]
add ecx, dword [0x4360c0]
mov edx, dword [ebp + 8]
add edx, dword [0x4360c0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x1a79
mov eax, dword [0x4360c0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4360c0]
push eax
jmp section..htext
mov esp, ebp
pop ebp
ret
Function at 0x66c200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x165000]
push edi
or ebp, 0xffffffff
jmp 0x66c222
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x66c229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x66c218
mov eax, 1
add ebx, ebx
jne 0x66c23b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x66c24c
jne 0x66c26b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x66c26b
dec eax
add ebx, ebx
jne 0x66c258
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x66c230
add ebx, ebx
jne 0x66c267
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x66c2bd
xor ecx, ecx
sub eax, 3
jb 0x66c283
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x66c2f2
sar eax, 1
mov ebp, eax
jmp 0x66c28e
add ebx, ebx
jne 0x66c28e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x66c25c
inc ecx
add ebx, ebx
jne 0x66c29c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x66c25c
add ebx, ebx
jne 0x66c2a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x66c29e
jne 0x66c2ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x66c29e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x66c2dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x66c2ce
jmp 0x66c21e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x66c2dc
add edi, ecx
jmp 0x66c21e
pop esi
mov edi, esi
mov ecx, 0x6808
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x66c2fa
cmp byte [edi], 0x2c
jne 0x66c2fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x66c2ff
lea edi, [esi + 0x269000]
mov eax, dword [edi]
or eax, eax
je 0x66c377
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x27d38c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x27d508]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x66c32c
mov ecx, edi
jns 0x66c35b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x27d510]
or eax, eax
je 0x66c371
mov dword [ebx], eax
add ebx, 4
jmp 0x66c349
call dword [esi + 0x27d50c]
mov ebp, dword [esi + 0x27d514]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x66c3ab
sub esp, 0xffffff80
jmp 0x4ddef0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x7b1f2b02
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x6b3a5b4a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4015ad
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48e07c]
jne 0x4015b7
repz ret
jmp fcn.00401eac

Function at 0x406e0c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48e07c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004044f4
and dword [ebp - 0x14], 0
cmp dword [0x490e8c], 0
mov dword [ebp - 0x18], eax
jne 0x406ebf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406f67
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406f67
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x490e8c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x490e90], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x490e94], eax
call edi
push eax
call esi
mov dword [0x490e9c], eax
test eax, eax
je 0x406ebf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x490e98], eax
mov eax, dword [0x490e98]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406f18
cmp dword [0x490e9c], ecx
je 0x406f18
push eax
call esi
push dword [0x490e9c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406f18
test ebx, ebx
je 0x406f18
call edi
test eax, eax
je 0x406f0f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406f0f
test byte [ebp - 8], 1
jne 0x406f18
or dword [ebp + 0x10], 0x200000
jmp 0x406f4b
mov eax, dword [0x490e90]
cmp eax, dword [ebp - 0x18]
je 0x406f4b
push eax
call esi
test eax, eax
je 0x406f4b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406f4b
mov eax, dword [0x490e94]
cmp eax, dword [ebp - 0x18]
je 0x406f4b
push eax
call esi
test eax, eax
je 0x406f4b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x490e8c]
call esi
test eax, eax
je 0x406f67
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406f69
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004015ad
leave
ret
Function at 0x7003e2a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x7003e39
pop dword [ebp - 0x38]
mov eax, 0x3ce24e9f
sub eax, 0x35e21066
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xd2c8273d
add dword [ebp - 0x48], 0x7b8a1e0e
mov dword [ebp - 0x44], 0x88f27d
sub dword [ebp - 0x44], 0xce55a638
mov dword [ebp - 0x40], 0x73ba4d6a
sub dword [ebp - 0x40], 0x276e093c
mov dword [ebp - 0x3c], 0x5dcb5a3a
sub dword [ebp - 0x3c], 0x5dcb5a3a
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x9c81eef7
sub dword [ebp - 0x48], 0x280f85a1
mov dword [ebp - 0x44], 0x9f107b52
add dword [ebp - 0x44], 0xa25be623
mov dword [ebp - 0x40], 0xc4bff094
add dword [ebp - 0x40], 0x9eaf7bd8
mov dword [ebp - 0x3c], 0xa8ef1414
sub dword [ebp - 0x3c], 0xa8ef1414
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3d4a9
push 0
call eax
mov ecx, 0x5ab0c903
sub ecx, 0x5ab07652
xor edi, edi
add edi, eax
mov ebx, 0xe50682c8
sub ebx, 0xde0480c8
add ebx, dword [ebp - 0x38]
mov esi, 0x54be87d3
add esi, 0xc0c1d75e
sub dword [ebp - 8], 0x4b3812ae
mov edx, dword [ebx]
xor dword [ebp - 0x30], ebx
add edx, esi
xor dword [ebp - 0x10], esi
mov dword [edi], edx
mov dword [ebp - 0x30], 0x56eb339d
add edi, 0x1e8f13b9
add edi, 0xe170ec4b
add ebx, 4
loop 0x7003f53
add eax, 0x8b037a59
add eax, 0x74fdc33e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x700d29f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x70120f1
call fcn.07001cf8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700d491
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700dd8a
lea ecx, [ebp - 0x10]
call fcn.0700d23c
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700d30c
mov eax, dword [eax + 0x14]
jmp 0x700d311
mov eax, 0x70138c2
push 0x7015240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700d343
mov ecx, dword [edi + 4]
call fcn.070076d1
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003e2a
mov eax, edi
call fcn.07001ea7
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003e2a
int3
Function at 0x401f10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
je 0x401f58
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
nop word [eax + eax]
imul edx, dword [eax], 0xe9
movzx ecx, byte [esi + ebx]
add ecx, edx
mov dword [eax], ecx
add byte [eax + 4], cl
xor byte [eax + 5], cl
movzx ecx, byte [esi + ebx]
add byte [eax + 6], cl
movzx ecx, byte [esi + ebx]
inc esi
xor byte [eax + 7], cl
cmp esi, edi
jb 0x401f30
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x404530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push dword [edi + 0x10]
call fcn.00404430
push dword [edi + 0x14]
call fcn.00406625
lea esi, [edi + 0x20]
xor ecx, ecx
mov edi, dword [edi + 0x14]
add esp, 8
mov edx, eax
mov dword [ebp - 4], ecx
xor ebx, ebx
mov dword [ebp - 0xc], edx
test edi, edi
je 0x404599
sub eax, esi
mov dword [ebp - 8], eax
nop word [eax + eax]
call fcn.004043e0
mov cl, byte [esi]
lea esi, [esi + 1]
sub cl, al
mov eax, dword [ebp - 8]
mov byte [eax + esi - 1], cl
movzx eax, byte [esi - 1]
mov ecx, dword [ebp - 4]
xor ebx, eax
add ecx, eax
mov dword [ebp - 4], ecx
sub edi, 1
jne 0x404570
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
cmp word [eax + 0x1c], cx
jne 0x4045b1
cmp word [eax + 0x1e], bx
jne 0x4045b1
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
push edx
call fcn.0040662e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404ab0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x457024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 6]
push eax
call fcn.00404430
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
add esp, 4
mov dword [ebp - 0x18], ecx
xor ebx, ebx
mov edi, dword [edx + 0x14]
lea esi, [edx + 0x20]
test edi, edi
je 0x404b1a
call fcn.004043e0
mov ecx, dword [ebp - 0x18]
lea esi, [esi + 1]
movzx eax, ax
add byte [esi - 1], al
mov al, byte [esi - 1]
movzx eax, al
xor ecx, eax
add ebx, eax
mov dword [ebp - 0x18], ecx
sub edi, 1
jne 0x404af4
mov edx, dword [ebp - 0x1c]
movzx eax, word [ebp - 6]
mov word [edx + 0x1e], cx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov word [edx + 0x1c], bx
xor ecx, ebp
mov dword [edx + 0x10], eax
pop ebx
call fcn.00406587
mov esp, ebp
pop ebp
ret

Function at 0x433baa
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00433a7e

Function at 0x436312
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00435cd0

Function at 0x438c86
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop edi
add ebx, ebx
call fcn.00438cc2
add ebx, 0xac8eb03a
add esi, ebx
or esi, esi
xor dword [eax], edi
add esi, 0x9657dc22
inc eax
sub ebx, 1
cmp eax, ecx
jne fcn.00438c86
add esi, 0x2c891dfc
dec esi
add ebx, esi
ret
Function at 0x41ed50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov esi, dword [esi]
test esi, esi
jne 0x41ed65
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
lea esp, [esp]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
add edi, ecx
sub esi, ecx
add ebx, ecx
test ecx, ecx
je 0x41eda7
test esi, esi
jne 0x41ed70
mov eax, dword [ebp + 0x10]
pop edi
mov dword [eax], ebx
xor eax, eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x41ed99
pop edi
pop ebx
mov eax, 8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42fa80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp + 0xb]
push esi
push dword [ebp + 8]
mov dword [ebp - 8], 0
push eax
push dword [ebx + 4]
push dword [ebx]
call fcn.0042f900
mov eax, dword [ebx]
lea ecx, [ebp - 0x20]
add esp, 0x10
mov dword [ebx + 4], eax
push 1
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00450220
mov esi, dword [ebp - 0x20]
mov dword [ebp - 8], esi
test esi, esi
jne 0x42fade
lea ecx, [ebp - 0x20]
mov esi, 0x80070002
call fcn.004503e0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 1
lea ecx, [ebp - 0x14]
mov dword [ebp + 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call fcn.0042e460
mov edi, dword [ebp - 0x14]
mov eax, edi
mov ecx, dword [ebp - 0x10]
sub eax, ecx
inc eax
push eax
push 0
push ecx
call fcn.0047cd50
add esp, 0xc
lea eax, [edi + 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
push str.PendingFileRenameOperations
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 2
jne 0x42fb47
mov esi, 0x80070002
jmp 0x42fbc3
cmp esi, 0xea
je 0x42fb5e
test esi, esi
jle 0x42fbc3
movzx esi, si
or esi, 0x80070000
jmp 0x42fbc3
cmp dword [ebp - 4], 7
je 0x42fb6b
mov esi, 0x8000ffff
jmp 0x42fbc3
mov eax, dword [ebp + 8]
test al, 1
je 0x42fb79
mov esi, 0x8000ffff
jmp 0x42fbc3
push eax
lea ecx, [ebp - 0x14]
call fcn.0042e4d0
mov edi, dword [ebp - 0x14]
lea eax, [ebp + 8]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
push str.PendingFileRenameOperations
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x42fbb1
jle 0x42fbc3
movzx esi, si
or esi, 0x80070000
jmp 0x42fbc3
mov eax, dword [ebp - 0x10]
push ebx
sub eax, edi
push eax
push edi
call fcn.0042fed0
add esp, 0xc
mov esi, eax
test edi, edi
je 0x42fbd0
push edi
call fcn.0047bc0a
add esp, 4
pop edi
lea ecx, [ebp - 0x20]
call fcn.004503e0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4306a0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x4b13a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
xorps xmm0, xmm0
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
movdqu xmmword [ebp - 0x24], xmm0
cmp dword [esi + 0x14], 8
movdqu xmmword [ebp - 0x14], xmm0
jb 0x4306d7
mov eax, dword [esi]
jmp 0x4306d9
mov eax, esi
lea ecx, [ebp - 0x28]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x430754
call fcn.00447db0
cmp eax, 1
jg 0x430732
mov ebx, 1
call sub.KERNEL32.dll_GetLastError
push eax
push ebx
push 0x3e
push str.c:_b_build_slavewin_build_srcchromeinstallerutildelete_after_reboot_helper.cc
lea ecx, [ebp - 0xe4]
call fcn.004474e0
cmp dword [esi + 0x14], 8
jb 0x43071a
mov esi, dword [esi]
add eax, 0x10
push esi
push eax
call fcn.00447950
push str._does_not_exist.
push eax
call fcn.00404cd0
add esp, 0x10
test bl, 1
je 0x430742
lea ecx, [ebp - 0xe4]
call fcn.00447780
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cd41
mov esp, ebp
pop ebp
ret
push edi
push esi
mov edi, 4
call fcn.00449190
add esp, 4
mov ecx, 5
test al, al
cmove edi, ecx
cmp dword [esi + 0x14], 8
jb 0x430777
mov eax, dword [esi]
jmp 0x430779
mov eax, esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
test eax, eax
jne 0x4307e6
call fcn.00447db0
cmp eax, 2
jg 0x4307de
mov ebx, 2
call sub.KERNEL32.dll_GetLastError
push eax
push ebx
push 0x49
push str.c:_b_build_slavewin_build_srcchromeinstallerutildelete_after_reboot_helper.cc
lea ecx, [ebp - 0xe4]
call fcn.004474e0
add eax, 0x10
push str.Could_not_schedule
push eax
call fcn.00404cd0
add esp, 8
cmp dword [esi + 0x14], 8
jb 0x4307c9
mov esi, dword [esi]
push esi
push eax
call fcn.00447950
push str._for_deletion.
push eax
call fcn.00404cd0
add esp, 0x10
test bl, 2
jmp 0x430735
push 0x53
push str.c:_b_build_slavewin_build_srcchromeinstallerutildelete_after_reboot_helper.cc
call fcn.00447dc0
add esp, 8
cmp eax, 1
jl 0x430836
push 0xffffffffffffffff
push 0x5d
push str.c:_b_build_slavewin_build_srcchromeinstallerutildelete_after_reboot_helper.cc
lea ecx, [ebp - 0xdc]
mov ebx, 4
call fcn.004472f0
add eax, 8
push str.Scheduled_for_deletion:
push eax
call fcn.00404cd0
add esp, 8
cmp dword [esi + 0x14], 8
jb 0x43082c
mov esi, dword [esi]
push esi
push eax
call fcn.00447950
add esp, 8
test bl, 4
je 0x430846
lea ecx, [ebp - 0xdc]
call fcn.00447510
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.0047cd41
mov esp, ebp
pop ebp
ret
Function at 0x433d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x433d85
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x433dc4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x433dc0
lea ebx, [ebx]
cmp esi, edx
jae 0x433dc4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x433db0
cmp esi, edx
jb 0x433dc9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x434500
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [eax + 0x10]
add edx, edx
cmp dword [eax + 0x14], 8
jb 0x434513
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
jb 0x43451e
mov ecx, dword [ecx]
push edx
push eax
push 1
push 0
push ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop ebp
ret