joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c2ba60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp si, 0xffff
je 0x1c2baaf
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x1c2bac7
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.01ccc467
add esp, 0x10
cmp eax, 1
je 0x1c2bab1
xor esi, esi
dec esi
jmp 0x1c2bab1
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x1c2baaa
mov ebx, eax
cmp eax, 3
je 0x1c2bb2f
cmp ebx, 1
ja 0x1c2baaa
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.01ccc467
add esp, 0x10
cmp eax, esi
jne 0x1c2baaa
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x1c2bad2
jmp 0x1c2bb48
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.01ccc467
add esp, 0x10
cmp eax, ebx
jne 0x1c2baaa
movzx esi, word [ebp + 8]
jmp 0x1c2bab1

Function at 0x1c2bcf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x1c2bd1f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x1c2bd01
pop esi
pop edi
pop ebp
ret 8

Function at 0x1c2be10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x1c2be41
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x1c2be21
pop esi
pop edi
pop ebp
ret 8
Function at 0x1c32420
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 8], esp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edx, edx
dec edx
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x1c3f830
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x18]
mov word [eax + 4], 0
mov dword [eax], 0x7025
lea edi, [esi + 0x50]
mov dword [edi + 0x10], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [edi], xmm0
push eax
sub esp, 0x18
mov ebx, esp
lea eax, [ebx + 8]
push eax
call fcn.01c2dd30
add esp, 4
mov dword [ebx], edi
mov dword [ebx + 4], 0x14
lea eax, [esi + 0x18]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x18], eax
call fcn.01c4233e
add esp, 0x1c
mov esp, dword [esi + 8]
mov dword [esi + 8], eax
add eax, esi
add eax, 0x50
mov ebx, dword [ebp + 0x10]
push ebx
mov dword [esi + 0x14], eax
push eax
push edi
call fcn.01c30ffc
add esp, 0xc
mov dword [esi + 0x10], eax
xor eax, eax
dec eax
mov dword [esi + 0x41], eax
mov dword [esi + 0x3d], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
lea edi, [esi + 0xc]
mov ecx, ebx
push edi
call fcn.01c2866a
lea eax, [esi + 0x70]
mov dword [eax + 8], 0
mov ecx, edi
push 0x1d0333c
call fcn.01c3b078
mov ebx, eax
mov ecx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x1c32512
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x78], 0xffffffff
lea edx, [esi + 0x20]
mov ecx, ebx
push edx
mov edi, dword [esi + 0x14]
push edi
lea ebx, [esi + 0x50]
push ebx
call eax
mov ecx, dword [esi + 0x10]
mov eax, ecx
sub eax, ebx
cmp ecx, edi
mov ecx, dword [esi + 8]
lea ecx, [esi + ecx + 0x20]
lea eax, [esi + eax + 0x20]
cmove eax, ecx
movsx edx, byte [ebp + 0x14]
push edx
push dword [ebp + 0x10]
push ecx
push eax
lea eax, [esi + 0x20]
push eax
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.01c23a20
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x1c35d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.01c3f0b2
mov ebx, eax
test esi, esi
je 0x1c35d69
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x1c35d56
movzx eax, word [eax]
jmp 0x1c35d5d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x1c35d69
test bl, bl
jne 0x1c35d6f
jmp 0x1c35dcc
xor esi, esi
test bl, bl
jne 0x1c35dbd
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x1c35d7e
movzx eax, word [eax]
jmp 0x1c35d83
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx eax, ax
push eax
push 8
call dword [edx + 0xc]
test al, al
je 0x1c35dae
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x1c35da7
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x1c35d3c
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x1c35d3c
mov ecx, edi
call fcn.01c3f0b2
mov ebx, eax
test esi, esi
jne 0x1c35dd5
jmp 0x1c35dc6
mov ecx, edi
call fcn.01c3f0b2
mov ebx, eax
test bl, bl
jne 0x1c35df4
jmp 0x1c35dfa
mov ecx, edi
call fcn.01c3f0b2
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x1c35de2
movzx eax, word [eax]
jmp 0x1c35de9
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x1c35dfa
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x1c37200
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, esp
mov dword [esi + 0x88], ebp
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x90]
mov dword [eax - 4], esp
xor edx, edx
dec edx
mov dword [eax + 8], edx
mov dword [eax + 4], 0x1c3f9b0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
lea ecx, [esi + 0x20]
mov dword [ecx + 0x60], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x50], xmm0
movdqa xmmword [ecx + 0x40], xmm0
movdqa xmmword [ecx + 0x30], xmm0
movdqa xmmword [ecx + 0x20], xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
mov dword [esi + 8], ecx
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0xc], sym.chrome_elf.dll_RequestSingleCrashUpload_ExportThunk
mov dword [esi + 0x14], edx
mov dword [eax + 8], 1
lea eax, [esi + 4]
mov dword [eax], edx
push eax
call fcn.01c2866a
mov dword [esi + 0x98], 2
lea ecx, [esi + 4]
push 0x1d0333c
call fcn.01c3b078
mov dword [esi + 0x10], eax
mov al, byte [ebp + 0x14]
lea ecx, [esi + 0x84]
lea edx, [esi + 3]
mov byte [edx], 0
lea edi, [esi + 0x14]
lea ebx, [esi + 8]
movzx eax, al
push ecx
push edi
push ebx
push dword [esi + 0x10]
push edx
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push dword [ecx + 4]
lea ecx, [esi + 4]
push ecx
push eax
push dword [esi + 0x1c]
lea eax, [ebp + 0xc]
push eax
call fcn.01c36760
add esp, 0x2c
test al, al
je 0x1c37358
mov ecx, dword [ebp + 0x20]
cmp byte [ecx + 0xb], 0
js 0x1c372fa
xor eax, eax
mov byte [ecx], al
mov byte [ecx + 0xb], al
jmp 0x1c37306
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
cmp byte [esi + 3], 0
je 0x1c37322
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x2d
call dword [eax + 0x1c]
movsx eax, al
mov ecx, dword [ebp + 0x20]
push eax
call fcn.01c404dc
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x30
call dword [eax + 0x1c]
mov edx, dword [esi + 8]
mov edi, dword [esi + 0x14]
lea ecx, [edi - 1]
cmp edx, ecx
jae 0x1c37344
cmp byte [edx], al
jne 0x1c37344
inc edx
cmp ecx, edx
jne 0x1c37339
mov edx, ecx
mov dword [esi + 0x98], 2
mov ecx, dword [ebp + 0x20]
push edi
push edx
call fcn.01c3f0f0
lea eax, [ebp + 0x10]
lea ecx, [ebp + 0xc]
push eax
call fcn.01c24110
mov edi, dword [ebp + 8]
test al, al
je 0x1c37371
mov eax, dword [ebp + 0x1c]
or byte [eax], 2
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
mov ecx, dword [esi + 4]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x1c3738a
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
je 0x1c373ac
mov dword [esi + 0x98], 0
push eax
call dword [esi + 0xc]
mov edi, dword [ebp + 8]
add esp, 4
mov eax, dword [esi + 0x90]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x1c42851
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.01cb30d6
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x1c428a0
push ecx
push ecx
call fcn.01cc1650
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x1c42890
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1c42fa1
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [esp + 0x38], eax
mov ebx, 0x57
test ecx, ecx
je 0x1c4302e
mov edi, edx
test edx, edx
je 0x1c4302e
mov esi, ecx
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movups xmmword [eax + 0xc], xmm0
movaps xmmword [eax], xmm0
push 0x1c
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1c43026
test byte [esp + 0x24], 0xf0
lea ebx, [esp + 0xc]
mov dword [ebx], 0
mov eax, 4
mov ecx, 0x40
cmove ecx, eax
push ebx
push ecx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1c43026
mov eax, dword [edi]
mov dword [esi], eax
push ebx
push dword [esp + 0x10]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ebx, ebx
jmp 0x1c4302e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.01cb3141
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c43a1d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [esp + 0x48], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x1c43a46
mov eax, dword [ecx + 4]
test eax, eax
je 0x1c43a6d
mov eax, 0x300
mov ecx, ebx
and ecx, eax
cmp ecx, eax
je 0x1c43a6d
cmp edi, 2
mov eax, 0x1d03c42
mov ecx, 0x1d03e42
cmove ecx, eax
cmp word [ecx], 0
je 0x1c43a80
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.01cb3141
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xorps xmm0, xmm0
lea esi, [esp + 0x20]
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x1c43a6d
cmp byte [0x1d03c40], 0
setne al
bt ebx, 8
jb 0x1c43a6d
shr ebx, 9
and ebx, 1
or bl, al
je 0x1c43a6d
cmp edi, 2
mov eax, 0x1ce3c14
mov edx, 0x1ce3c28
cmove edx, eax
mov eax, dword [ebp + 8]
movzx ebx, byte [eax + 0xb]
test bl, bl
js 0x1c43adf
mov ecx, ebx
mov esi, eax
mov eax, ebx
jmp 0x1c43ae4
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], ecx
mov ebx, dword [edx + 4]
mov edi, eax
sub edi, ebx
jb 0x1c43b32
push ebx
push dword [edx]
push esi
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], eax
call fcn.01cc9dbe
mov edx, dword [esp + 0x24]
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x14]
je 0x1c43b42
add edx, 0x14
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, dword [esp + 0x10]
jb 0x1c43b05
jmp 0x1c43bac
movzx ecx, word [esi + ebx*2]
cmp cx, 0x5c
je 0x1c43b51
test cx, cx
jne 0x1c43b32
lea eax, [esi + ebx*2]
mov ebx, dword [edx + 8]
cmp ebx, 1
je 0x1c43b71
cmp ebx, 2
mov esi, ebx
jne 0x1c43b7f
mov dword [esp + 8], str.WOW6432Node
mov dword [esp + 4], eax
jmp 0x1c43b7f
mov dword [esp + 8], str.WOW6432Node_
mov dword [esp + 4], esi
mov esi, ebx
mov dword [esp + 0xc], esi
cmp cx, 0x5c
jne 0x1c43b98
lea esi, [eax + 2]
dec edi
cmp word [eax + 2], 0x5c
mov eax, esi
je 0x1c43b89
jmp 0x1c43b9a
mov esi, eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 0xc]
xor ecx, ecx
mov edx, eax
mov eax, edi
jmp 0x1c43b3a
cmp dword [esp + 0xc], 0
je 0x1c43a6d
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
js 0x1c43bc4
mov eax, ecx
jmp 0x1c43bc6
mov eax, dword [ecx]
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
push dword [esp + 8]
push edx
call fcn.01c4106e
jmp 0x1c43a6d
Function at 0x1c44c7f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea esi, [ebp - 0x28]
mov ecx, esi
push str.type
call fcn.01c3ceea
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edi, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.01c3ceea
push esi
push edi
push ebx
call fcn.01c44d70
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x1c44cdc
push dword [ebp - 0x34]
call fcn.01cb3106
add esp, 4
cmp byte [ebp - 0x1d], 0
jns 0x1c44ced
push dword [ebp - 0x28]
call fcn.01cb3106
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x1c44d3e
mov esi, eax
push str.__typeplugin
push eax
call fcn.01cb7d3e
add esp, 8
test eax, eax
jne 0x1c44d1d
push str.__in_chromeie
push esi
call fcn.01cb7d3e
add esp, 8
test eax, eax
je 0x1c44d3e
cmp byte [ebp - 0x11], 0
js 0x1c44d2f
mov word [ebp - 0x1c], 0
mov byte [ebp - 0x11], 0
jmp 0x1c44d3e
mov eax, dword [ebp - 0x1c]
mov word [eax], 0
mov dword [ebp - 0x18], 0
lea esi, [ebp - 0x1c]
mov ecx, esi
call fcn.01c44eb6
mov dword [0x1d0424c], eax
cmp byte [esi + 0xb], 0
jns 0x1c44d5e
push dword [ebp - 0x1c]
call fcn.01cb3106
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c45112
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
push edi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1c45160
mov ebx, eax
xor eax, eax
dec eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
cmp ebx, 0x7ffffff0
jae 0x1c45222
cmp ebx, 5
jae 0x1c4516d
lea edi, [ebp - 0x1c]
mov byte [edi + 0xb], bl
jmp 0x1c45193
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [esi + 8], edi
jmp 0x1c4520e
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.01cb30d6
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], eax
or esi, 0x80000000
mov dword [ebp - 0x14], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], ebx
mov eax, ebx
add eax, ebx
push eax
push 0
push edi
call fcn.01cb76e0
add esp, 0xc
mov word [edi + ebx*2], 0
cmp byte [ebp - 0x11], 0
jns 0x1c451b4
mov eax, dword [ebp - 0x1c]
jmp 0x1c451b7
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movzx ecx, byte [ebp - 0x11]
test eax, eax
je 0x1c451f5
mov edx, ecx
test cl, cl
jns 0x1c451d4
mov edx, dword [ebp - 0x18]
cmp eax, edx
jae 0x1c451f5
lea edi, [ebp - 0x1c]
mov ecx, edi
push 0
push eax
call fcn.01c4153e
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
movsd xmm0, qword [edi]
movsd qword [esi], xmm0
jmp 0x1c4520e
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
test cl, cl
jns 0x1c4520e
push dword [ebp - 0x1c]
call fcn.01cb3106
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x1c]
call fcn.01c3fd04
Function at 0x1c45272
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [esp + 0x20], eax
push str.Chrome
call fcn.01c3e920
mov ecx, edi
push str.0.0.0.0_devel
call fcn.01c3e920
cmp byte [esi + 0xb], 0
js 0x1c452bc
mov word [esi], 0
mov byte [esi + 0xb], 0
jmp 0x1c452ca
mov eax, dword [esi]
mov word [eax], 0
mov dword [esi + 4], 0
mov dword [esp + 0x1c], 0
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x1c452dc
mov eax, dword [ebx]
lea ecx, [esp + 0x1c]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x1c45440
mov esi, eax
push eax
call fcn.01cb3133
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x1c]
cmp byte [ebx + 0xb], 0
jns 0x1c45308
mov ebx, dword [ebx]
push edi
push esi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1c45433
lea esi, [esp + 0x10]
mov ecx, esi
push 0x1ce523a
call fcn.01c3ceea
mov ecx, edi
mov edx, esi
push dword [ebp + 0x10]
call fcn.01c45486
add esp, 4
cmp byte [esi + 0xb], 0
jns 0x1c4534a
push dword [esp + 0x10]
call fcn.01cb3106
add esp, 4
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
lea ebx, [esp + 4]
mov ecx, ebx
push 0x1ce5258
call fcn.01c3ceea
mov ecx, edi
mov edx, ebx
push esi
call fcn.01c45486
add esp, 4
cmp byte [ebx + 0xb], 0
jns 0x1c45387
push dword [esp + 4]
call fcn.01cb3106
add esp, 4
movzx eax, byte [esp + 0x1b]
test al, al
jns 0x1c45394
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x1c453b1
lea ecx, [esp + 0x10]
push 1
push 0x1ce5276
push 0xffffffffffffffff
push 0
call fcn.01c4142a
test eax, eax
je 0x1c453be
mov ecx, dword [ebp + 0x10]
push str._devel
call fcn.01c414d0
lea esi, [esp + 4]
mov ecx, esi
push 0x1ce5288
call fcn.01c3ceea
mov ecx, edi
mov edx, esi
push dword [ebp + 0xc]
call fcn.01c45486
add esp, 4
cmp byte [esi + 0xb], 0
jns 0x1c453ef
push dword [esp + 4]
call fcn.01cb3106
add esp, 4
lea esi, [esp + 4]
mov ecx, esi
push str.SpecialBuild
call fcn.01c3ceea
mov ecx, edi
mov edx, esi
push dword [ebp + 0x14]
call fcn.01c45486
add esp, 4
cmp byte [esi + 0xb], 0
jns 0x1c45420
push dword [esp + 4]
call fcn.01cb3106
add esp, 4
cmp byte [esp + 0x1b], 0
jns 0x1c45433
push dword [esp + 0x10]
call fcn.01cb3106
add esp, 4
test edi, edi
je 0x1c45440
push edi
call fcn.01cb313c
add esp, 4
lea eax, [esp + 0x10]
push 1
push eax
call fcn.01c455e2
add esp, 8
mov esi, dword [ebp + 0x18]
cmp byte [esi + 0xb], 0
jns 0x1c45462
push dword [esi]
call fcn.01cb3106
add esp, 4
mov eax, dword [esp + 0x18]
mov dword [esi + 8], eax
movsd xmm0, qword [esp + 0x10]
movsd qword [esi], xmm0
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.01cb3141
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c45486
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov edi, edx
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
js 0x1c454b4
mov word [ecx], 0
mov byte [ecx + 0xb], 0
jmp 0x1c454c2
mov eax, dword [ecx]
mov word [eax], 0
mov dword [ecx + 4], 0
test esi, esi
je 0x1c455cd
xor ecx, ecx
lea edx, [ebp - 0x228]
mov dword [edx], ecx
lea eax, [ebp - 0x20]
mov dword [eax], ecx
push eax
push edx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1c455cd
mov dword [ebp - 0x234], esi
mov eax, dword [ebp - 0x228]
movzx esi, word [eax]
movzx ebx, word [eax + 2]
mov word [ebp - 0x20], si
mov word [ebp - 0x1e], bx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], bx
mov word [ebp - 0x18], si
mov bx, 0x4e4
mov word [ebp - 0x16], bx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], bx
xor ebx, ebx
push 0x208
push 0xff
lea eax, [ebp - 0x228]
push eax
call fcn.01cb76e0
add esp, 0xc
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1c45556
mov eax, dword [edi]
movzx ecx, word [ebp + ebx*2 - 0x1e]
movzx edx, si
push eax
push ecx
push edx
push str.StringFileInfo_04hx_04hx_ls
mov eax, 0x104
push eax
push eax
lea esi, [ebp - 0x228]
push esi
call fcn.01c45ed7
add esp, 0x1c
xor eax, eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
push dword [ebp - 0x234]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1c455b2
mov eax, dword [ebp - 0x22c]
test eax, eax
jne 0x1c455c4
cmp ebx, 5
ja 0x1c455cd
movzx esi, word [ebp + ebx*2 - 0x1c]
add ebx, 2
jmp 0x1c45533
mov ecx, dword [ebp + 8]
push eax
call fcn.01c3e920
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret