joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a320
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movsx ecx, ax
cmp ecx, 0x41e
jg 0x42a35c
add eax, 0xfffffbfc
cmp ax, 0x15
ja case.0x42a34b.2
mov edx, 0x50745a
movzx eax, ax
jmp dword [eax*4 + 0x507cac]
mov edx, str.zh_TW
jmp case.0x42a34b.21
movzx eax, ax
cmp ecx, 0x442
jle 0x42a384
cmp ecx, 0x815
jg 0x42a3a0
cmp eax, 0x443
je 0x42a3e6
cmp eax, 0x804
jne case.0x42a34b.2
mov edx, str.zh_CN
jmp case.0x42a34b.21
cmp eax, 0x41f
je 0x42a3ed
cmp eax, 0x422
je 0x42a3f4
cmp eax, 0x43f
jne case.0x42a34b.2
mov edx, 0x50748a
jmp case.0x42a34b.21
cmp eax, 0x816
je 0x42a3fb
cmp eax, 0xc0a
jne case.0x42a34b.2
mov edx, 0x507466
jmp case.0x42a34b.21
mov edx, 0x507493
jmp case.0x42a34b.21
mov edx, 0x507490
jmp case.0x42a34b.21
mov edx, 0x507463
jmp case.0x42a34b.21
mov edx, 0x507469
jmp case.0x42a34b.21
mov edx, 0x50746c
jmp case.0x42a34b.21
mov edx, 0x50746f
jmp case.0x42a34b.21
mov edx, str.pt_BR
jmp case.0x42a34b.21
mov edx, 0x50748d
jmp case.0x42a34b.21
mov edx, 0x507460
jmp case.0x42a34b.21
mov edx, 0x50745d
jmp case.0x42a34b.21
mov edx, str.pt_PT
mov ecx, esi
push edx
call fcn.004b9300
mov eax, esi
pop esi
pop ebp
ret

Function at 0x42aac0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [ebp + 8]
mov esi, 0x208
push esi
call fcn.0048e8dd
add esp, 4
mov edi, eax
push esi
push 0
push eax
call fcn.004926b0
add esp, 0xc
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec eax
cmp eax, 0x102
ja 0x42ab1d
mov ecx, esi
add ecx, esi
js 0x42ab95
mov ebx, ecx
sar ebx, 1
cmp ecx, 9
ja 0x42ab29
mov eax, dword [ebp + 8]
mov byte [eax + 0xb], bl
mov ebx, eax
mov edx, eax
jmp 0x42ab5e
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx], eax
mov dword [ebx + 8], eax
jmp 0x42ab7e
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], esi
lea esi, [ebx + 8]
and esi, 0xfffffff8
js 0x42ab9d
lea eax, [esi + esi]
push eax
call fcn.0048e8dd
add esp, 4
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
or esi, 0x80000000
mov dword [eax + 8], esi
mov dword [eax + 4], ebx
mov ebx, eax
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
lea eax, [edi + esi*2]
cmp eax, edi
je 0x42ab79
push ecx
push edi
push edx
mov dword [ebp - 0x10], edx
call fcn.00491bb0
mov edx, dword [ebp - 0x10]
add esp, 0xc
lea edx, [edx + esi*2]
mov word [edx], 0
test edi, edi
je 0x42ab8b
push edi
call fcn.0048e90d
add esp, 4
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
call fcn.004d0930
call fcn.004a2770
int3
Function at 0x42abb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [0x520014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp byte [eax + 0xb], 0
jns 0x42abcf
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x5062e0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor ebx, ebx
cmp eax, 0xffffffff
je 0x42ac3e
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
movzx eax, byte [edi + 0xb]
mov ecx, edi
test al, al
jns 0x42ac15
mov eax, dword [edi + 4]
mov ecx, dword [edi]
lea edx, [ebp - 0x14]
push ebx
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42ac3a
mov eax, dword [ebp - 0x14]
movzx ecx, byte [edi + 0xb]
test cl, cl
jns 0x42ac35
mov ecx, dword [edi + 4]
cmp eax, ecx
sete bl
test esi, esi
je 0x42ac45
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42ac60
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x520014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp byte [eax + 0xb], 0
jns 0x42ac7f
mov eax, dword [eax]
mov esi, dword [ebp + 8]
sub esp, 0x1c
movaps xmm0, xmmword [0x507420]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x42ad39
xor edi, edi
push edi
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov edi, 0
mov ebx, 0
test eax, eax
je 0x42acff
js 0x42adc5
push esi
call fcn.0048e8dd
add esp, 4
mov ebx, eax
mov dword [ebp - 0x1c], eax
lea edi, [eax + esi]
mov dword [ebp - 0x14], edi
push esi
push 0
push eax
call fcn.004926b0
add esp, 0xc
lea eax, [ebp - 0x20]
xor ecx, ecx
mov dword [eax], ecx
push ecx
push eax
push esi
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x42ad45
cmp esi, dword [ebp - 0x20]
jne 0x42ad45
mov eax, edi
sub eax, ebx
cmp eax, 0xfffffff0
jae 0x42adbd
cmp eax, 0xa
ja 0x42ad54
mov esi, dword [ebp + 8]
mov byte [esi + 0xb], al
mov eax, esi
jmp 0x42ad84
xor ecx, ecx
mov dword [esi + 4], ecx
mov dword [esi], ecx
mov dword [esi + 8], ecx
jmp 0x42ada2
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
jmp 0x42ad8e
lea esi, [eax + 0x10]
and esi, 0xfffffff0
push esi
mov dword [ebp - 0x28], eax
call fcn.0048e8dd
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
or esi, 0x80000000
mov dword [ecx + 8], esi
mov esi, ecx
mov ecx, dword [ebp - 0x28]
mov dword [esi + 4], ecx
jmp 0x42ad84
mov cl, byte [ebx]
mov byte [eax], cl
inc ebx
inc eax
cmp ebx, edi
jne 0x42ad7e
mov byte [eax], 0
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x42ad9b
push ebx
call fcn.0048e90d
add esp, 4
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x42ada9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f468
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
call fcn.004d0930
lea ecx, [ebp - 0x1c]
call fcn.004b9210
int3
Function at 0x42add0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov eax, ebx
test bl, bl
jns 0x42ade7
mov eax, dword [esi + 4]
test eax, eax
je 0x42ae43
mov eax, 0x208
push eax
call fcn.0048e8dd
add esp, 4
mov edi, eax
xor eax, eax
mov ecx, 0x208
push ecx
push eax
push edi
call fcn.004926b0
add esp, 0xc
test bl, bl
jns 0x42ae13
mov esi, dword [esi]
push edi
xor eax, eax
push eax
push 0x507572
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x42ae55
mov ecx, 0x208
add ecx, edi
xor eax, eax
cmp word [edi + eax], 0
je 0x42ae64
add eax, 2
cmp eax, 0x208
jne 0x42ae30
jmp 0x42ae68
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
jmp 0x42aee8
xor eax, eax
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
jmp 0x42aedb
add eax, edi
mov ecx, eax
mov eax, ecx
sub eax, edi
js 0x42aef2
mov ebx, eax
sar ebx, 1
cmp eax, 9
ja 0x42ae85
mov esi, dword [ebp + 8]
mov byte [esi + 0xb], bl
mov ebx, esi
jmp 0x42aeb6
mov dword [ebp - 0x10], ecx
lea esi, [ebx + 8]
and esi, 0xfffffff8
js 0x42aefa
lea eax, [esi + esi]
push eax
call fcn.0048e8dd
add esp, 4
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
or esi, 0x80000000
mov dword [eax + 8], esi
mov esi, eax
mov dword [eax + 4], ebx
mov ebx, ecx
mov ecx, dword [ebp - 0x10]
sub ecx, edi
je 0x42aed6
lea esi, [ecx - 2]
and esi, 0xfffffffe
and ecx, 0xfffffffe
push ecx
push edi
push ebx
call fcn.00491bb0
add esp, 0xc
add ebx, esi
add ebx, 2
mov esi, dword [ebp + 8]
mov word [ebx], 0
test edi, edi
je 0x42aee8
push edi
call fcn.0048e90d
add esp, 4
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
call fcn.004d0930
call fcn.004a2770
int3

Function at 0x42afd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [ecx + 0xb], 0
js 0x42afe2
je 0x42b001
mov eax, esi
jmp 0x42afea
cmp dword [esi + 4], 0
je 0x42aff7
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [esi + 0xb], 0
jns 0x42b001
push dword [esi]
call fcn.0048e90d
add esp, 4
pop esi
pop ebp
ret

Function at 0x42c5e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [ebp + 8]
mov ecx, dword [0x520014]
xor ecx, ebp
mov dword [esp + 0x6c], ecx
test eax, eax
je 0x42c61c
push eax
push 0x42c680
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 0x6c]
xor ecx, ebp
call fcn.0048f468
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 4]
push eax
push edi
call fcn.004bcc70
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push edi
push 0x3c8
push str.BringProcessWindowToTop
push 1
call fcn.004bca70
lea ecx, [esp + 0x4c]
push 0x5076fd
push str.Failed_to_bring_process_window_to_top:_wrong_process_id
call fcn.004b9460
mov ecx, esi
call fcn.004bcab0
cmp byte [edi + 0xb], 0
jns 0x42c60a
push dword [esp + 4]
call fcn.0048e90d
add esp, 4
jmp 0x42c60a
Function at 0x430d60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x68], eax
call fcn.004131d0
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x108]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x430da5
push 0
push dword [esi + 0x108]
call dword [sym.imp.USER32.dll_ShowWindow]
lea edi, [esp + 0x10]
mov ecx, edi
push 0x273
push str.OnCloseWindow
push 0
call fcn.0043a1a0
lea ecx, [esp + 0x4c]
push 0x507efa
push str.____Installer___MainWindow::OnCloseWindow
call fcn.004b9460
mov ecx, edi
call fcn.0043a3d0
mov ecx, dword [esi + 0x88]
test ecx, ecx
je 0x430de9
call fcn.0041b190
test al, al
je 0x430e33
lea ecx, [esi + 0x110]
call fcn.004131d0
xor ebx, ebx
inc ebx
mov edi, dword [sym.imp.USER32.dll_EndDialog]
push ebx
push eax
call edi
mov ecx, esi
call fcn.004131d0
push ebx
push eax
call edi
mov ecx, esi
call fcn.004131d0
push 0x64
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0048f468
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004bcc70
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0x277
push str.OnCloseWindow
push 1
call fcn.004bca70
lea ecx, [esp + 0x4c]
push 0x507f41
push str.____Installer___MainWindow::OnCloseWindow:_WaitForInstallAsync_timeout
call fcn.004b9460
mov ecx, edi
call fcn.004bcab0
cmp byte [ebx + 0xb], 0
jns 0x430de9
push dword [esp + 4]
call fcn.0048e90d
add esp, 4
jmp 0x430de9

Function at 0x430ea0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x68], eax
call fcn.004131d0
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x108]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x430ee5
push 0
push dword [esi + 0x108]
call dword [sym.imp.USER32.dll_ShowWindow]
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi + 0x40], xmm0
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 4]
push ebx
call fcn.00429b50
add esp, 4
mov eax, dword [esi + 0x10]
mov ecx, edi
push ebx
push dword [eax + 0x64]
call fcn.00429670
mov ecx, edi
push 0
call fcn.00425610
mov ecx, esi
call fcn.004131d0
push 1
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, edi
call fcn.00429cb0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0048f468
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x431230
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edi, ecx
movzx eax, word [ebp + 0xc]
mov ecx, dword [0x520014]
xor ecx, ebp
mov dword [esp + 0x38], ecx
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], ecx
cmp eax, 0x3f6
je 0x4312a5
cmp ax, 0x7b
je 0x4312a5
cmp ax, 0x76
jne 0x4313d6
mov ebx, dword [edi + 0x10]
xor eax, eax
dec eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
cmp byte [ebx + 0x7f], 0
mov dword [esp + 8], edi
js 0x4312c5
lea eax, [ebx + 0x74]
mov ecx, dword [eax + 8]
mov dword [esp + 0x30], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x28], xmm0
jmp 0x4312d4
lea esi, [esp + 0x28]
push dword [edi + 0x10]
push esi
call fcn.0042bc00
add esp, 8
mov eax, dword [esi + 8]
mov dword [esp + 0x20], eax
movsd xmm0, qword [esi]
jmp 0x4313ac
lea ecx, [esp + 0x28]
push dword [ebx + 0x78]
push dword [ebx + 0x74]
call fcn.0046a6f0
lea edi, [esp + 0x28]
mov ecx, edi
push str._lang
call fcn.0046b440
movzx eax, byte [ebx + 0x63]
test al, al
jns 0x4312f4
mov eax, dword [ebx + 0x5c]
mov ebx, dword [ebx + 0x58]
jmp 0x4312f7
add ebx, 0x58
mov ecx, edi
push eax
push ebx
call fcn.0046ab40
movzx eax, byte [esp + 0x33]
mov esi, dword [esp + 0x28]
mov ebx, eax
test al, al
jns 0x431315
mov ebx, dword [esp + 0x2c]
mov edi, esi
cmp ebx, 0x7ffffff0
jae 0x43140f
mov dword [esp + 4], eax
cmp ebx, 5
jae 0x431337
lea eax, [esp + 0xc]
mov byte [eax + 0xb], bl
test ebx, ebx
jne 0x431361
jmp 0x431372
mov dword [esp], esi
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.0048e8dd
add esp, 4
mov dword [esp + 0xc], eax
or esi, 0x80000000
mov dword [esp + 0x14], esi
mov esi, dword [esp]
mov dword [esp + 0x10], ebx
xor ecx, ecx
movsx edx, byte [edi + ecx]
mov word [eax], dx
add eax, 2
inc ecx
cmp ebx, ecx
jne 0x431363
mov word [eax], 0
cmp byte [esp + 4], 0
jns 0x431387
push esi
call fcn.0048e90d
add esp, 4
cmp byte [esp + 0x23], 0
mov edi, dword [esp + 8]
jns 0x43139e
push dword [esp + 0x18]
call fcn.0048e90d
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
movsd xmm0, qword [esp + 0xc]
movsd qword [esp + 0x18], xmm0
cmp byte [esp + 0x23], 0
jns 0x4313bf
mov eax, dword [esp + 0x18]
jmp 0x4313c3
lea eax, [esp + 0x18]
xor ecx, ecx
push 5
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [edi + 0x88]
lea esi, [esp + 0x18]
push esi
call fcn.004220e0
cmp byte [esi + 0xb], 0
jns 0x4313f8
push dword [esp + 0x18]
call fcn.0048e90d
add esp, 4
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.0048f468
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
lea ecx, [esp + 0xc]
call fcn.004d0930
int3
Function at 0x435ab0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x520014]
xor ecx, ebp
mov esi, 0x7fffffff
cmp eax, esi
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push edx
mov edi, ebx
push ebx
call ecx
test eax, eax
je 0x435b28
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x435b15
cmp ebx, 0xffffffff
je 0x435b3a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x435b3d
mov ebx, dword [ebp - 0x14]
jmp 0x435b01
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x435b01
int3
mov edx, dword [ebp + 0xc]
jmp 0x435ad7

Function at 0x435cd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ecx + 8]
inc eax
cmp eax, 2
jae 0x435d4f
mov esi, ecx
push dword [ebp + 8]
call fcn.00435b50
add esp, 4
mov edi, eax
cmp dword [esi + 8], eax
je 0x435d1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 8]
inc eax
cmp eax, 2
jae 0x435d36
mov eax, edi
inc eax
cmp eax, 2
jb 0x435d14
mov dword [esi + 8], edi
call fcn.0046dd90
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi + 8]
lea eax, [edi + 1]
cmp eax, 2
jb 0x435d29
mov dword [esi + 0x14], edi
cmp eax, 2
setae al
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0046dd90
push dword [esi + 8]
call fcn.00470d70
add esp, 4
mov dword [esi + 8], 0
jmp 0x435d04
int3
Function at 0x4381f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc0
mov ebx, dword [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x438213
mov eax, dword [ebx]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x438297
mov edi, eax
push eax
call fcn.0048e943
add esp, 4
mov esi, eax
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x438236
mov eax, dword [ebx]
push esi
push edi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43829b
xor eax, eax
dec eax
lea ecx, [ebp - 0xc4]
mov dword [ecx], eax
lea edx, [ebp - 0xc8]
mov dword [edx], eax
push edx
push ecx
push 0x505448
push esi
call sub.VERSION.dll_VerQueryValueW
mov edi, eax
test eax, eax
je 0x4382ad
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc4]
movups xmm0, xmmword [ecx]
movups xmm1, xmmword [ecx + 0x10]
movups xmmword [eax + 0x10], xmm1
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x30], edx
movups xmm1, xmmword [ecx + 0x20]
movups xmmword [eax + 0x20], xmm1
movups xmmword [eax], xmm0
mov ecx, dword [eax + 0x18]
and dword [eax + 0x1c], ecx
jmp 0x4382bf
xor ebx, ebx
jmp 0x4382d1
push 1
call fcn.0046dda0
add esp, 4
test al, al
jne 0x4382e8
xor ebx, ebx
jmp 0x4382c4
push 1
call fcn.0046dda0
add esp, 4
test al, al
jne 0x438387
test edi, edi
setne bl
test esi, esi
je 0x4382d1
push esi
call fcn.0048e94c
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f468
mov eax, ebx
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004459b0
lea ecx, [ebp - 0xb8]
push eax
push 1
push 0x23
push str..._.._chrome_installer_lite_util_crash_reporter_module_version.cc
call fcn.004d2650
lea eax, [ebp - 0xb0]
push 0x14
push str.GetFileVersionInfo:
push eax
call fcn.004b9800
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
mov dword [ebp - 0xcc], eax
jns 0x43832b
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
lea edi, [ebp - 0xc4]
push ecx
push ebx
push edi
call fcn.0046fb00
add esp, 0xc
movzx eax, byte [edi + 0xb]
test al, al
jns 0x438350
mov eax, dword [ebp - 0xc0]
mov edi, dword [ebp - 0xc4]
push eax
push edi
push dword [ebp - 0xcc]
call fcn.004b9800
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x438377
push dword [ebp - 0xc4]
call fcn.0048e90d
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004d26b0
jmp 0x4382a9
call fcn.004459b0
lea ebx, [ebp - 0xb8]
mov ecx, ebx
push eax
push 1
push 0x2e
push str..._.._chrome_installer_lite_util_crash_reporter_module_version.cc
call fcn.004d2650
lea eax, [ebp - 0xb0]
push 0xd
push str.VerQueryValue
push eax
call fcn.004b9800
add esp, 0xc
mov ecx, ebx
call fcn.004d26b0
jmp 0x4382bf
Function at 0x43a280
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x525078]
mov ecx, dword [0x52420c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x43a31c
mov ecx, 0x525070
call fcn.00470270
test eax, eax
je 0x43a2da
mov eax, dword [0x525078]
mov ecx, dword [0x52420c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x43a357
mov ecx, 0x525070
pop ebp
jmp fcn.00470270
mov eax, dword [0x525078]
mov ecx, dword [0x52420c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x43a392
push 0xc
call fcn.0048e8dd
add esp, 4
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax], ecx
mov dword [eax + 8], ecx
mov ecx, 0x525070
push eax
call fcn.004702a0
jmp 0x43a2ae
push 0x525078
call fcn.0048e987
add esp, 4
cmp dword [0x525078], 0xffffffff
jne 0x43a2a0
mov ecx, 0x525070
push 0x43a560
call fcn.004471c0
push 0x525078
call fcn.0048e9fd
add esp, 4
jmp 0x43a2a0
push 0x525078
call fcn.0048e987
add esp, 4
cmp dword [0x525078], 0xffffffff
jne 0x43a2cf
mov ecx, 0x525070
push 0x43a560
call fcn.004471c0
push 0x525078
call fcn.0048e9fd
add esp, 4
jmp 0x43a2cf
push 0x525078
call fcn.0048e987
add esp, 4
cmp dword [0x525078], 0xffffffff
jne 0x43a2fb
mov ecx, 0x525070
push 0x43a560
call fcn.004471c0
push 0x525078
call fcn.0048e9fd
add esp, 4
jmp 0x43a2fb
Function at 0x43ca90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x442560
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [ecx + 4], 1
jne 0x43cb01
movzx edi, byte [ebp + 0x18]
mov eax, dword [esi]
mov ebx, dword [eax + 0x18]
mov ecx, ebx
call dword [section..00cfg]
movsx eax, byte [ebp + 0x14]
mov ecx, esi
push edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x30]
mov ecx, dword [ebp + 0x10]
push esi
call fcn.0046a090
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x5257a4
call fcn.0046a490
mov esi, eax
mov edi, dword [ebp - 0x30]
xor ebx, ebx
dec ebx
mov eax, ebx
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x43cb53
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0xffffffff
call dword [section..00cfg]
mov ecx, edi
call dword [ebp - 0x24]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov eax, dword [esi]
mov cl, byte [ebp + 0x18]
xor cl, 1
movzx ecx, cl
mov edi, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], ebx
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
lea eax, [ebp - 0x30]
push eax
call edi
movzx eax, byte [ebp - 0x25]
test al, al
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov esi, eax
cmovs esi, edx
test esi, esi
je 0x43cc29
test al, al
lea esi, [ebp - 0x30]
cmovs esi, ecx
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x20], 0
je 0x43cbf9
mov eax, dword [ebp - 0x24]
mov al, byte [eax]
movzx esi, al
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 0x18]
cmp ecx, dword [edx + 0x1c]
je 0x43cc02
lea edx, [ecx + 1]
mov edi, dword [ebp - 0x20]
mov dword [edi + 0x18], edx
mov byte [ecx], al
xor edi, edi
cmp esi, 0xffffffff
je 0x43cbd0
mov edi, dword [ebp - 0x20]
mov al, byte [ebp - 0x25]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edi
mov ebx, dword [ebp - 0x24]
inc ebx
test al, al
lea esi, [ebp - 0x30]
cmovs esi, ecx
movzx edi, al
cmovs edi, edx
add edi, esi
mov dword [ebp - 0x24], ebx
cmp ebx, edi
jne 0x43cba2
jmp 0x43cc29
mov dword [ebp - 0x20], 0
jmp 0x43cbdc
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov edi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov dword [ebp - 0x10], 1
mov ecx, ebx
push esi
call edi
mov esi, eax
jmp 0x43cbc6
shr al, 7
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0x20]
mov dword [edx], esi
test al, al
je 0x43cc41
push ecx
call fcn.0048e90d
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x43caf7