joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4934b0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x19], 0
jne 0x493500
cmp dword [edi + 0x1c], 0xffffffff
jne 0x493500
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x4934de
mov eax, dword [edi]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi + 0x1c], eax
sete al
mov byte [edi + 0x19], al
mov ecx, dword [edi + 0x1c]
cmp ecx, 0xffffffff
je 0x4935dd
cmp byte [esi], 0
jne 0x4935dd
mov eax, dword [esi + 4]
test eax, eax
jne 0x49353a
push eax
push eax
push eax
movzx eax, byte [ebp + 0x10]
shl eax, 0x18
add eax, 2
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x49355f
cmp dword [esi + 8], 0
jne 0x4935e1
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov dword [ebp - 0x40], edi
mov dword [esi + 8], edi
test edi, edi
jne 0x493564
mov byte [esi], 1
jmp 0x4935dd
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
lea eax, [ebp - 0x3c]
push 0x1c
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x4935c9
mov edi, dword [ebp - 0x30]
lea eax, [ebp - 0x20]
add edi, dword [ebp - 0x38]
push 0x1c
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x38]
jne 0x4935b9
nop dword [eax + eax]
add edi, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x38]
je 0x4935a0
sub edi, dword [ebp - 0x40]
je 0x4935c9
mov eax, dword [esi + 8]
dec eax
add eax, edi
mov dword [esi + 0xc], eax
jmp 0x4935dc
push dword [esi + 8]
mov byte [esi], 1
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 8], 0
pop ebx
cmp dword [esi + 8], 0
mov ecx, dword [ebp - 4]
setne al
pop edi
xor ecx, ebp
pop esi
call fcn.004016cd
mov esp, ebp
pop ebp
ret
Function at 0x4940e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x148], ecx
lea ecx, [ebp - 0x144]
push ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x49417d
push ebx
lea eax, [ebp - 0x140]
mov dword [ebp - 0x140], 0x136
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x49414d
xor bl, bl
jmp 0x49416c
push dword [ebp - 0x148]
lea eax, [ebp - 0x13c]
mov ecx, esi
push eax
push 0
push edi
mov bl, 1
call dword [0x5b1854]
call esi
add esp, 0x10
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
pop ebx
jne 0x494195
push dword [ebp - 0x148]
mov ecx, esi
push 0
push 0
push edi
call dword [0x5b1854]
call esi
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004016cd
mov esp, ebp
pop ebp
ret

Function at 0x4944a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4944fc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4944fc
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4944ea
cmp esi, edx
jae 0x4944fc
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4944d8
cmp esi, edx
jae 0x4944fc
cmp word [esi], 0
je 0x4944fc
mov eax, esi
lfence
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4945b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2847
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x62cf50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x631c4c]
test eax, eax
jne 0x4946da
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
test esi, esi
je 0x4946c0
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
lfence
push 0x635558
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041e564
mov edi, eax
add esp, 8
test edi, edi
je 0x4946c0
lea ecx, [esi*2 + 2]
push ecx
push 0
push edi
lfence
call fcn.0056aed0
add esp, 0xc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4946b7
cmp eax, esi
ja 0x4946b7
push edi
lea ecx, [ebp - 0x28]
lfence
call fcn.004102c0
mov ecx, dword [0x631c4c]
mov dword [ebp - 4], 0
test ecx, ecx
jne 0x494697
push 0x18
call fcn.00406b5e
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x49468e
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.0040b170
mov dword [0x631c4c], eax
jmp 0x4946af
xor eax, eax
mov dword [0x631c4c], eax
jmp 0x4946af
lea eax, [ebp - 0x28]
cmp ecx, eax
je 0x4946af
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00409db0
lea ecx, [ebp - 0x28]
call fcn.0040a580
push edi
call fcn.0041e935
add esp, 4
mov eax, dword [0x631c4c]
test eax, eax
jne 0x4946da
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [eax + 0x14], 8
jb 0x4946e2
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x494d40
Capabilities:
Check if file exists
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2960
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], 0
push eax
call fcn.0047eca0
add esp, 0x10
cmp dword [ebp - 0x14], 0x15
mov dword [ebp - 4], 0
jg 0x494db1
jne 0x494f33
cmp dword [ebp - 0x18], 1
jl 0x494f33
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x494f33
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.SHELL32.dll_PathIsExe]
test eax, eax
je 0x494f33
push 6
xor eax, eax
mov dword [ebp - 0x3c], 0
push str._pass
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
call fcn.00409db0
mov ecx, esi
mov byte [ebp - 4], 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x494e11
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x4c]
call fcn.0040f730
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x4c]
cmp ecx, 8
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
cmovae eax, edx
movlpd qword [ebp - 0x6c], xmm0
cmp dword [ebp - 0x1c], 8
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
mov dword [ebp - 0x8c], 0x3c
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x494f1d
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x74], 0
push eax
mov dword [ebp - 0x70], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
test eax, eax
je 0x494f02
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0
push eax
push 0x20006
push 0
push 0x5bca70
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x494f02
push 4
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 1
push eax
push 4
push 0
push str.bWasUserPassThroughed
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x494f35
inc eax
lea ecx, [ebp - 0x4c]
push eax
push dword [ebp - 0x4c]
call fcn.0040a5e0
jmp 0x494f35
mov byte [ebp - 4], 3
cmp ecx, 8
jb 0x494f33
lea eax, [ecx + 1]
push eax
push edx
lea ecx, [ebp - 0x4c]
call fcn.0040a5e0
xor bl, bl
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 4
cmp ecx, 8
jb 0x494f51
inc ecx
push ecx
push dword [ebp - 0x30]
lea ecx, [ebp - 0x30]
call fcn.0040a5e0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret
Function at 0x499180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x633594], 0
jne 0x4991fd
push 0x104
push 0
push 0x633490
call fcn.0056aed0
add esp, 0xc
mov eax, 1
mov word [0x633594], ax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push str.SOFTWAREAdobeAcroPerf
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4991fd
push 0x62bc70
push 0x633490
lea ecx, [ebp - 8]
push ecx
push 0
push str.tOutputDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x633490], 0
je 0x499219
push dword [0x62bc70]
push 0x633490
call fcn.0049a430
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret

Function at 0x499230
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
call fcn.0049a400
mov ecx, esi
pop esi
jmp fcn.0049a490
Function at 0x49d390
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x49d3b2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x49d3b4
mov eax, dword [esi]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne bl
test eax, eax
je 0x49d3fd
cmp byte [ebp + 0xc], 0
je 0x49d3e9
cmp byte [esi + 4], 0
je 0x49d3db
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x49d3dd
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x49d411
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x49d413
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x49d3e9
cmp byte [esi + 4], al
je 0x49d44d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.004016cd
mov esp, ebp
pop ebp
ret 8
Function at 0x49d770
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, 0x633d3c
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x49d8bd
push esi
push 0x118
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0056aed0
add esp, 0xc
mov dword [ebp - 0x124], 0x11c
lea eax, [ebp - 0x124]
mov esi, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x49d8ae
mov eax, dword [ebp - 0x120]
cmp eax, 6
jne 0x49d7ef
mov ecx, dword [ebp - 0x11c]
test ecx, ecx
jne 0x49d7f5
cmp word [ebp - 0x10], cx
ja 0x49d7f5
cmp eax, eax
jbe 0x49d8ae
push str.bcrypt.dll
mov esi, 1
call fcn.004396f0
add esp, 4
test eax, eax
je 0x49d8ae
push 0x5c0694
call fcn.004396f0
add esp, 4
test eax, eax
je 0x49d8ae
push ebx
push edi
push 0
push str.Microsoft_Primitive_Provider
push str.ECDH_P256
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0
push eax
mov dword [ebp - 8], 0
call sub.ncrypt.dll_BCryptOpenAlgorithmProvider
mov edi, eax
test edi, edi
je 0x49d861
mov dword [ebp - 0x128], 0
jmp 0x49d873
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x49d873
push 0
push eax
call sub.ncrypt.dll_BCryptCloseAlgorithmProvider
push 0
push str.Microsoft_Software_Key_Storage_Provider
lea eax, [ebp - 8]
push eax
call sub.ncrypt.dll_NCryptOpenStorageProvider
mov ecx, dword [ebp - 8]
mov ebx, eax
test ecx, ecx
je 0x49d895
push ecx
call sub.ncrypt.dll_NCryptFreeObject
mov ecx, dword [ebp - 8]
test edi, edi
jne 0x49d8ac
test ebx, ebx
jne 0x49d8ac
cmp dword [ebp - 0x128], ebx
je 0x49d8ac
xor eax, eax
test ecx, ecx
cmovne esi, eax
pop edi
pop ebx
lea ecx, [esi + 1]
xor eax, eax
mov edx, 0x633d3c
lock cmpxchg dword [edx], ecx
pop esi
cmp dword [0x633d3c], 1
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret

Function at 0x49d8e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.0056aed0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x49d969
cmp eax, 0x104
jae 0x49d969
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x20c]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49d950
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
jmp 0x49d982
xor eax, eax
mov dword [esi + 0x10], 0
push eax
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x5b6ea8
mov ecx, esi
call fcn.00409db0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004016cd
mov esp, ebp
pop ebp
ret
Function at 0x49d9a0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi], 0
jne 0x49da23
lea eax, [esi + 4]
push eax
call fcn.00418a00
add esp, 4
test al, al
je 0x49da23
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0056aed0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x101
ja 0x49da1f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x49da1f
mov al, 1
mov byte [esi], al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret
xor al, al
mov byte [esi], al
mov ecx, dword [ebp - 4]
mov al, byte [esi]
xor ecx, ebp
pop esi
call fcn.004016cd
mov esp, ebp
pop ebp
ret

Function at 0x49fb80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0x100000
test edi, edi
push 0xc
cmove edi, eax
call fcn.00406b5e
mov ecx, dword [ebp + 0xc]
add esp, 4
mov esi, dword [ebp + 0x10]
mov ebx, eax
test esi, esi
push 0
push 0x10000
push ebx
mov dword [ebx], ecx
setne cl
push 0x49fd90
push edi
mov byte [ebx + 4], cl
mov ecx, dword [ebp + 0x14]
push 0
mov dword [ebx + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x49fc01
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x49fbe6
cmp eax, 0xe
je 0x49fbe6
cmp eax, 0x5af
jne 0x49fbef
push edi
call fcn.004a0d90
add esp, 4
push 0xc
push ebx
call fcn.0040a1a2
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
test esi, esi
je 0x49fc0e
pop edi
mov dword [esi], eax
mov al, 1
pop esi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret
Function at 0x4a02b0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a305c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movsd xmm0, qword [0x633de0]
ucomisd xmm0, qword [0x5c0250]
lahf
test ah, 0x44
jnp 0x4a02fc
fld qword [0x633de0]
jmp 0x4a03f8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 2
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [0x6359c4]
mov ecx, dword fs:[0x2c]
mov eax, dword [0x633df0]
mov esi, dword [ecx + edx*4]
cmp eax, dword [esi + 4]
jg 0x4a0414
mov eax, dword [0x633e00]
cmp eax, dword [esi + 4]
jg 0x4a044d
rdtsc
mov esi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [0x633df8]
mov edx, dword [ebp - 0x14]
sbb edx, dword [0x633dfc]
call fcn.00553040
mov edx, dword [ebp - 0x1c]
movaps xmm1, xmm0
mov ecx, dword [ebp - 0x20]
movsd qword [ebp - 0x18], xmm1
call fcn.005530a0
movsd xmm1, qword [ebp - 0x18]
divsd xmm1, xmm0
movsd xmm0, qword [0x5c0a10]
comisd xmm0, xmm1
movsd qword [ebp - 0x18], xmm1
jbe 0x4a03ce
fldz
jmp 0x4a03f8
sub esi, dword [0x633de8]
mov ecx, esi
sbb edi, dword [0x633dec]
mov edx, edi
call fcn.00553040
divsd xmm0, qword [ebp - 0x18]
movsd qword [ebp - 0x20], xmm0
fld qword [ebp - 0x20]
movsd qword [0x633de0], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret
push 0x633df0
call fcn.0040b37e
add esp, 4
cmp dword [0x633df0], 0xffffffff
jne 0x4a033b
rdtsc
push 0x633df0
mov dword [0x633de8], eax
mov dword [0x633dec], edx
call fcn.0040b56b
add esp, 4
jmp 0x4a033b
push 0x633e00
call fcn.0040b37e
add esp, 4
cmp dword [0x633e00], 0xffffffff
jne 0x4a034c
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x18]
mov dword [0x633df8], eax
mov eax, dword [ebp - 0x14]
push 0x633e00
mov dword [0x633dfc], eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040b56b
add esp, 4
jmp 0x4a034c
Function at 0x4a0750
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a30b2
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x238], eax
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], eax
movzx eax, word [ebx + 0x14]
mov word [ebp - 0x228], ax
movzx eax, word [ebx + 0x16]
mov dword [ebp - 0x234], 1
mov word [ebp - 0x226], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x224], ax
mov esi, 0x4e4
movzx eax, word [ebx + 0x16]
mov word [ebp - 0x222], ax
movzx eax, word [ebx + 0x14]
mov word [ebp - 0x220], ax
mov word [ebp - 0x21e], si
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x21a], si
lea esi, [ebp - 0x228]
mov word [ebp - 0x21c], ax
nop dword [eax + eax]
push dword [ebp - 0x238]
movzx eax, word [esi + 2]
push eax
movzx eax, word [esi]
push eax
push str.StringFileInfo_04x_04x_ls
push 0x104
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004a0a10
add esp, 0x1c
mov dword [ebp - 0x230], 0
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebx + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4a088c
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x4a088c
mov ecx, dword [ebp - 0x22c]
test ecx, ecx
jne 0x4a089b
add esi, 4
lea eax, [ebp - 0x218]
cmp esi, eax
jne 0x4a0820
jmp 0x4a08a5
dec ecx
push ecx
push eax
mov ecx, edi
call fcn.00409db0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret 8
Function at 0x4a14a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3201
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x280]
push 0
push str.D:BTImportsOpenChromeChrome_src_base_files_file_util_win.cc
push eax
call fcn.004593e0
add esp, 8
lea ecx, [ebp - 0x240]
push eax
call fcn.00459410
xor eax, eax
mov dword [ebp - 4], 0
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4a158b
cmp eax, 0x104
ja 0x4a158b
xor ecx, ecx
lea edx, [ebp - 0x218]
mov eax, edx
cmp word [ebp - 0x218], cx
je 0x4a153b
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x4a1531
push ecx
push edx
lea ecx, [ebp - 0x270]
call fcn.0040a2c0
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 1
push ecx
mov ecx, eax
call fcn.0049d280
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00462860
lea ecx, [ebp - 0x258]
call fcn.0040a580
lea ecx, [ebp - 0x270]
call fcn.0040a580
lea ecx, [ebp - 0x240]
call fcn.0045a290
mov al, 1
jmp 0x4a1598
lea ecx, [ebp - 0x240]
call fcn.0045a290
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret

Function at 0x4a15c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a323b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x28
push 0
mov dword [ebp - 0x234], esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4a1646
cmp word [ebp - 0x218], 0
je 0x4a1646
sub esp, 8
lea ecx, [ebp - 0x218]
mov eax, esp
xor edx, edx
mov dword [eax], ecx
cmp word [ebp - 0x218], dx
je 0x4a163a
lea ecx, [ecx + 2]
inc edx
cmp word [ecx], 0
jne 0x4a1630
mov ecx, esi
mov dword [eax + 4], edx
call fcn.0040a2c0
jmp 0x4a16af
lea ecx, [ebp - 0x230]
call fcn.00462840
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
call fcn.004a16d0
add esp, 4
test al, al
je 0x4a167b
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.0047eb10
jmp 0x4a16a4
sub esp, 8
mov eax, 0x5c0e38
mov edx, esp
xor ecx, ecx
mov dword [edx], 0x5c0e38
nop dword [eax]
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x4a1690
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.0040a2c0
lea ecx, [ebp - 0x230]
call fcn.0040a580
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret