joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460030
Capabilities:
Get hostname
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510b1b
mov eax, dword fs:[0]
push eax
sub esp, 0x550
mov eax, dword [0x58fa2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x54c]
push eax
push 0x64
push 0
mov dword [ebp - 0x54c], 0
call sub.NETAPI32.dll_NetWkstaGetInfo
test eax, eax
je 0x460086
xor al, al
jmp 0x460287
push 0x104
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.004b8570
mov eax, dword [ebp - 0x54c]
push 0x104
push dword [eax + 8]
lea eax, [ebp - 0x124]
push eax
call fcn.004c7436
add esp, 0x18
push dword [ebp - 0x54c]
call sub.NETAPI32.dll_NetApiBufferFree
lea eax, [ebp - 0x558]
mov dword [ebp - 0x558], 0x10
push eax
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x46007f
lea eax, [ebp - 0x550]
mov dword [ebp - 0x550], 0
push eax
lea eax, [ebp - 0x544]
mov dword [ebp - 0x544], 0
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsA
test eax, eax
je 0x46007f
xor edi, edi
cmp dword [ebp - 0x550], edi
jbe 0x460285
xor esi, esi
nop dword [eax]
lea eax, [ebp - 0x554]
mov dword [ebp - 0x540], 0
push eax
lea eax, [ebp - 0x540]
mov dword [ebp - 0x554], 0
push eax
mov eax, dword [ebp - 0x544]
push 5
push dword [esi + eax]
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x460275
lea eax, [ebp - 0x554]
mov dword [ebp - 0x548], 0
push eax
lea eax, [ebp - 0x548]
push eax
mov eax, dword [ebp - 0x544]
push 7
push dword [esi + eax]
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
jne 0x4601a5
push dword [ebp - 0x540]
jmp 0x460270
push 0x400
lea eax, [ebp - 0x524]
push 0
push eax
call fcn.004b8570
push dword [ebp - 0x548]
lea eax, [ebp - 0x20]
push eax
call fcn.004c56c4
add esp, 0x14
push dword [ebp - 0x540]
test eax, eax
je 0x4601f0
push dword [ebp - 0x548]
lea eax, [ebp - 0x524]
push str.N:_s_s
push eax
call fcn.004482a0
add esp, 0x10
jmp 0x46020f
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x524]
push str.L:_s_s_s
push eax
call fcn.004482a0
add esp, 0x14
mov eax, dword [ebp - 0x544]
lea ecx, [ebp - 0x53c]
mov eax, dword [esi + eax]
mov dword [ebp - 0x55c], eax
lea eax, [ebp - 0x524]
push eax
call fcn.0040d450
mov dword [ebp - 4], 0
mov ecx, ebx
push eax
lea eax, [ebp - 0x55c]
push eax
call fcn.0045fb00
mov ecx, eax
call fcn.00405650
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x53c]
call fcn.00405600
push dword [ebp - 0x540]
call sub.WTSAPI32.dll_WTSFreeMemory
push dword [ebp - 0x548]
call sub.WTSAPI32.dll_WTSFreeMemory
inc edi
add esi, 0xc
cmp edi, dword [ebp - 0x550]
jb 0x460130
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4566
mov esp, ebp
pop ebp
ret 4
Function at 0x461000
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
mov eax, dword [edi + 0x18]
imul ecx, ecx, 0x1000193
pop edi
pop esi
and eax, ecx
pop ebp
ret 4

Function at 0x461440
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xb]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
mov ecx, dword [edi + 0xc]
cmp dword [ecx + edx*8 + 4], eax
lea ecx, [ecx + edx*8]
jne 0x4614ac
cmp dword [ecx], eax
jne 0x4614a4
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x4614b4
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
jmp 0x4614b4
cmp dword [ecx], eax
jne 0x4614b7
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ecx, [edi + 4]
push eax
push esi
call fcn.004614d0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x461580
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x4615db
mov ecx, esi
jmp 0x4615e0
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x461605
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x4615ef
mov eax, dword [eax]
jmp 0x4615d3
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
mov ecx, dword [ebp + 8]
cmovne eax, esi
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x462130
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510f70
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x58fa2c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x230], edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x234], ebx
xor esi, esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x220], esi
push 0x104
push esi
lea eax, [ebp - 0x21c]
push eax
call fcn.004b8570
push 0x104
push esi
lea eax, [ebp - 0x118]
push eax
call fcn.004b8570
push esi
push esi
push 0x104
lea eax, [ebp - 0x21c]
push eax
call fcn.0049d330
add esp, 0x28
mov ecx, dword [edi + 0x14]
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
mov eax, dword [edi + 0x14]
mov ecx, dword [eax + 0x60]
add ecx, 0x1d4
lea edx, [ebp - 0x118]
nop dword [eax]
mov al, byte [ecx]
mov byte [edx], al
lea ecx, [ecx + 1]
lea edx, [edx + 1]
test al, al
jne 0x4621e0
mov edi, 1
mov dword [ebp - 0x220], edi
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x228], eax
cmp eax, 0xffffffff
je 0x4622ab
mov edi, 2
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x22c], 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx], eax
test eax, eax
je 0x46229f
mov edi, 3
mov dword [ebp - 0x220], edi
push eax
call fcn.004a4577
add esp, 4
mov esi, eax
mov dword [ebp - 0x224], esi
push 0
lea eax, [ebp - 0x22c]
push eax
push dword [ebx]
push esi
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46229f
or edi, 0xffffffff
mov dword [ebp - 0x220], edi
push esi
call fcn.004a4580
add esp, 4
xor esi, esi
mov dword [ebp - 0x224], esi
mov dword [ebx], esi
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push edi
push dword [ebx]
push esi
lea edx, [ebp - 0x118]
push edx
push str.GetLogFileContent__s__0x_p__d____d_
push 4
push eax
call dword [ecx + 8]
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
mov eax, esi
jmp 0x462306
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a4566
mov esp, ebp
pop ebp
ret 4
Function at 0x462640
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x248
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x60]
add eax, 0x9a24
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0x18], eax
test eax, eax
je 0x4627f6
mov eax, dword [0x58f3dc]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x60]
add eax, 0x1d4
push eax
push dword [esi + 0x18]
call fcn.004a0910
add esp, 0xc
mov ebx, eax
mov dword [esi + 0x1c], ebx
test ebx, ebx
je 0x46278b
push 0x30
push edi
lea eax, [ebp - 0x48]
push eax
call fcn.004b8570
mov dword [ebp - 0x40], 0x462ad0
mov dword [ebp - 0x44], 0x463050
mov dword [ebp - 0x48], 0x4631f0
mov dword [ebp - 0x38], 0x461d60
mov dword [ebp - 0x3c], 0x461e60
mov dword [ebp - 0x30], 0x461bf0
mov dword [ebp - 0x34], 0x461c80
mov dword [ebp - 0x28], method.std::codecvt_base.virtual_16
mov dword [ebp - 0x1c], esi
push 0x20c
push edi
lea eax, [ebp - 0x254]
push eax
call fcn.004b8570
add esp, 0x18
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x60]
mov eax, dword [eax + 0xa5d4]
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x24c], 0x81828384
mov dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0x23c], 5
mov eax, dword [ebx]
lea ecx, [ebp - 0x254]
push ecx
lea ecx, [ebp - 0x48]
push ecx
mov ecx, ebx
call dword [eax + 8]
mov edi, eax
mov dword [ebp - 0x18], edi
mov edx, dword [esi]
push edi
mov ecx, dword [esi + 0x14]
mov ecx, dword [ecx + 0x60]
push dword [ecx + 0xa5d4]
push str.Started_listening_on_port__d___d_.
push 2
push esi
call dword [edx + 8]
add esp, 0x14
jmp 0x46279e
mov eax, dword [esi]
push dword [ebp - 0x14]
push str.Failed_to_load_server_object:__s
push 0
push esi
call dword [eax + 8]
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00488bc0
test edi, edi
je 0x462812
lea eax, [esi + 0x28]
push eax
push 0
push esi
push 0x461af0
push 0
push 0
call fcn.004c63bb
add esp, 0x18
mov dword [esi + 0x20], eax
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
push 0xffffffffffffffff
call dword [eax + 0xc]
mov edi, 1
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x60]
add eax, 0x9a24
push eax
push str.Failed_to_load_communications_library___s_.
push 0
push esi
call dword [ecx + 8]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x462b70
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511070
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x58fa2c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x15c], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x16c], eax
xor ebx, ebx
mov dword [ebp - 0x164], ebx
test eax, eax
je 0x462d5c
mov dword [ebp - 4], 0
mov dword [ebp - 0x160], 0x11
or esi, 0xffffffff
mov dword [ebp - 0x168], esi
push 0x40
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.004b8570
push 0x104
push 0
lea eax, [ebp - 0x158]
push eax
call fcn.004b8570
add esp, 0x18
push 0x104
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
jne 0x462d01
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x462d01
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, ecx
shr eax, 0x18
push eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
push eax
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
movzx eax, cl
push eax
push str._d._d._d._d
lea eax, [ebp - 0x54]
push eax
call fcn.004482a0
add esp, 0x18
lea esi, [ebp - 0x158]
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x462c70
sub esi, ecx
lea edi, [ebp - 0x54]
lea ecx, [edi + 1]
nop
mov al, byte [edi]
inc edi
test al, al
jne 0x462c80
sub edi, ecx
lea edx, [esi + 0x13]
add edx, edi
mov dword [ebp - 0x160], edx
mov ecx, dword [ebp - 0x15c]
mov ecx, dword [ecx + 0x1c]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ebx, eax
mov dword [ebp - 0x164], ebx
lea ecx, [esi + 0x13]
add ecx, edi
push ecx
push 0
push ebx
call fcn.004b8570
mov dword [ebx], 0x200f
lea eax, [esi + 0x13]
add eax, edi
mov dword [ebx + 4], eax
lea ecx, [esi + 2]
add ecx, edi
mov dword [ebx + 0xc], ecx
push esi
lea eax, [ebp - 0x158]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.004b86d0
push edi
lea eax, [ebp - 0x54]
push eax
lea eax, [esi + 0x11]
add eax, ebx
push eax
call fcn.004b86d0
add esp, 0x24
xor esi, esi
mov dword [ebp - 0x168], esi
mov edi, dword [ebp - 0x15c]
mov eax, dword [edi]
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x158]
push ecx
push esi
mov ecx, dword [ebp - 0x160]
push ecx
push str.ProcessGetIPAddress___d__d___s____s
push 4
push edi
call dword [eax + 8]
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
jmp 0x462d5a
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a4566
mov esp, ebp
pop ebp
ret 4

Function at 0x463780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push ecx
push 0x462860
push 0
push 0
call fcn.004c63bb
add esp, 0x18
test eax, eax
je 0x4637ae
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x4637c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push ecx
push 0x462870
push 0
push 0
call fcn.004c63bb
add esp, 0x18
test eax, eax
je 0x4637ee
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x463810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 0x30], eax
lea eax, [ebp + 8]
push eax
push 0
push ecx
push 0x462880
push 0
push 0
mov dword [ebp + 8], 0
call fcn.004c63bb
add esp, 0x18
test eax, eax
je 0x463843
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret 4

Function at 0x463930
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x463947
call fcn.00463870
mov eax, 1
pop ebp
ret 4
push ecx
push 0
push 0x463800
call fcn.004c632b
add esp, 0xc
mov eax, 1
pop ebp
ret 4

Function at 0x4653b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5114cf
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x20]
push eax
push edi
push ebx
push 0x4686b0
push edi
push edi
call fcn.004c63bb
add esp, 0x18
mov dword [ebp - 0x28], eax
test eax, eax
je 0x46540e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x24]
push eax
push 0
push ebx
push 0x4686a0
push 0
push 0
call fcn.004c63bb
mov dword [ebx + 0x1c], eax
push 0x14
call fcn.00472260
add esp, 0x1c
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x465444
mov ecx, eax
call fcn.0045bd00
jmp 0x465446
xor eax, eax
mov byte [ebp - 4], 0
push eax
lea ecx, [ebp - 0x18]
call fcn.0045bc10
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x4654a2
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00411d30
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.0043b610
add esp, 8
test al, al
je 0x46548c
push dword [ebp - 0x14]
mov ecx, esi
call fcn.0045ce30
push dword [ebx + 0x10]
mov ecx, esi
call fcn.0045c0e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00411d30
cmp dword [ebp - 0x28], 0
je 0x4654b7
mov eax, 1
cmp dword [ebx + 0x1c], 0
cmovne edi, eax
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0045c320
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4688a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x4688b7
call fcn.00468790
mov eax, 1
pop ebp
ret 4
push ecx
push 0
push 0x4686c0
call fcn.004c632b
add esp, 0xc
mov eax, 1
pop ebp
ret 4
Function at 0x46a3e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511d70
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [esi]
mov edi, dword [ebp + 8]
push edi
push str.ExecCombinationsRequest_with_flag__X
push 2
push esi
call dword [eax + 8]
add esp, 0x10
mov dword [ebp - 4], 0
cmp dword [esi + 0x64], 0
jne 0x46a4c7
cmp dword [esi + 0x68], 0
jne 0x46a4c7
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esi + 0x60], 0
je 0x46a455
push 0xffffffffffffffff
push dword [esi + 0x2a4]
call ebx
lea ecx, [esi + 0x6c]
cmp dword [ecx], 0
je 0x46a46a
push 0xffffffffffffffff
push dword [esi + 0x2a8]
call ebx
lea ecx, [esi + 0x6c]
cmp edi, 0x1002
jne 0x46a4db
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0x60]
cmp dword [eax + 0xa8bc], 0xffffffff
je 0x46a4c7
mov eax, 1
xchg dword [ecx], eax
push esi
push 0
push 0x46ff40
call fcn.004c632b
add esp, 0xc
mov dword [esi + 0x2a8], eax
test eax, eax
jne 0x46a4bb
lea ecx, [esi + 0x6c]
xchg dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xffffffffffffffff
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edi, 0x1003
jne 0x46a51c
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0x60]
cmp dword [eax + 0xa8bc], 0xffffffff
je 0x46a4c7
mov edx, 1
lea ecx, [esi + 0x70]
xor eax, eax
lock cmpxchg dword [ecx], edx
test eax, eax
jne 0x46a513
mov ecx, dword [esi + 0x1a0]
test ecx, ecx
je 0x46a513
call fcn.00471eb0
mov ecx, esi
call fcn.0046ab20
jmp 0x46a4c0
cmp edi, 0x1004
jne 0x46a53e
push 0x1002
mov ecx, esi
call fcn.0046a3e0
push 0x1003
mov ecx, esi
call fcn.0046a3e0
jmp 0x46a4c0
cmp edi, 0x1005
jne 0x46a54d
push 0x1002
jmp 0x46a572
cmp edi, 0x1006
je 0x46a56d
cmp edi, 0x1007
jne 0x46a4c0
push 0x1002
mov ecx, esi
call fcn.0046a3e0
push 0x1003
mov ecx, esi
call fcn.0046a3e0
push 1
mov ecx, esi
call fcn.0046b690
jmp 0x46a4c0
Function at 0x46a5d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511d90
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp eax, 3
jne 0x46a661
cmp dword [edx + 0x60], 0
jne 0x46a64d
lea ecx, [edx + 0x64]
cmp dword [ecx], 0
jne 0x46a64d
cmp dword [edx + 0x68], 0
jne 0x46a64d
cmp dword [edx + 0x6c], 0
jne 0x46a64d
cmp dword [edx + 0x70], 0
jne 0x46a64d
mov eax, 1
xchg dword [ecx], eax
push edx
push 0
push 0x46ff50
call fcn.004c632b
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 4
jne 0x46a646
lea ecx, [edx + 0x64]
cmp dword [ecx], 2
jge 0x46a646
xor eax, eax
xchg dword [ecx], eax
mov ecx, dword [edx]
lea eax, [edx + 0x238]
push eax
push str.ExecInstallRequest_Abort__s
push 4
push edx
call dword [ecx + 8]
add esp, 0x10
jmp 0x46a646
Function at 0x46b4d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511e90
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov edi, dword [ebp + 8]
cmp edi, 5
je 0x46b557
cmp edi, 6
je 0x46b557
cmp edi, 7
jne 0x46b53c
lea ecx, [esi + 0x68]
cmp dword [ecx], 2
jge 0x46b53c
xor eax, eax
xchg dword [ecx], eax
mov ecx, dword [esi]
lea eax, [esi + 0x238]
push eax
push str.ExecUninstallRequest_Abort__s
push 4
push esi
call dword [ecx + 8]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x60], 0
jne 0x46b543
cmp dword [esi + 0x64], 0
jne 0x46b543
lea ebx, [esi + 0x68]
cmp dword [ebx], 0
jne 0x46b543
cmp dword [esi + 0x6c], 0
jne 0x46b543
cmp dword [esi + 0x70], 0
jne 0x46b543
push 0x111
mov ecx, esi
call fcn.0046ee50
xor eax, eax
cmp edi, 6
sete al
mov dword [0x591a88], eax
mov eax, 1
xchg dword [ebx], eax
push esi
push 0
push 0x46ff60
call fcn.004c632b
add esp, 0xc
jmp 0x46b53c

Function at 0x46b690
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511ed0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x46b742
cmp dword [esi + 0x64], 0
jne 0x46b770
cmp dword [esi + 0x68], 0
jne 0x46b770
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esi + 0x6c], 0
je 0x46b6f9
push 0xffffffffffffffff
push dword [esi + 0x2a8]
call edi
lea ebx, [esi + 0x60]
cmp dword [ebx], 0
je 0x46b70b
push 0xffffffffffffffff
push dword [esi + 0x2a4]
call edi
mov eax, 1
xchg dword [ebx], eax
push esi
push 0
push 0x46ff80
call fcn.004c632b
add esp, 0xc
mov dword [esi + 0x2a4], eax
test eax, eax
jne 0x46b769
xchg dword [ebx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 2
jne 0x46b769
lea ecx, [esi + 0x60]
cmp dword [ecx], eax
jge 0x46b769
xor eax, eax
xchg dword [ecx], eax
mov ecx, dword [esi]
lea eax, [esi + 0x238]
push eax
push str.ExecUpdateRequest_Abort__s
push 4
push esi
call dword [ecx + 8]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46b7b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511ef0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x58fa2c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
push ecx
push 0
push 0x46ff70
call fcn.004c632b
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret