joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4774d6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x4c]
xor ebx, ebx
push eax
mov edi, edx
mov dword [ebp - 0x50], ebx
mov esi, ecx
call fcn.00445260
push eax
lea ecx, [ebp - 0x34]
call fcn.0042095a
lea ecx, [ebp - 0x4c]
call fcn.0043ef40
push ecx
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.004462b0
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push 0xffffffffffffffff
cmovae eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
cmp word [eax], 0x22
jne 0x47753a
mov eax, dword [ebp - 0x24]
add eax, 2
push eax
jmp 0x47753d
push dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call fcn.0041ade0
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041ae16
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.0041b875
lea eax, [ebp - 0x1c]
push eax
mov ecx, eax
call fcn.0043c4c0
pop ecx
call fcn.00477207
push 0x38
mov esi, eax
lea eax, [ebp - 0x88]
push ebx
push eax
call fcn.004cda10
add esp, 0xc
mov dword [ebp - 0x8c], 0x3c
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
mov dword [ebp - 0x88], 0x40
cmovae eax, dword [ebp - 0x34]
cmp dword [ebp - 8], 8
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x8c]
push eax
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x80], str.runas
mov dword [ebp - 0x70], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, 1
jne 0x4775ff
push 0xffffffffffffffff
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and dword [ebp - 0x50], ebx
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4775ff
mov bl, 1
test edi, edi
je 0x4775ff
mov eax, dword [ebp - 0x50]
mov dword [edi], eax
test esi, esi
je 0x47760a
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0041b875
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.0041b875
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret
Function at 0x477cd3
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
xor ebx, ebx
cmp dword [edx + 0x14], 8
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
jb 0x477cf5
mov edx, dword [edx]
push 2
push edx
push ecx
lea ecx, [ebp - 0x10]
call fcn.00442850
mov esi, dword [ebp + 0xc]
mov edi, eax
test edi, edi
jne 0x477d26
cmp dword [esi + 0x14], 8
jb 0x477d14
mov eax, dword [esi]
jmp 0x477d16
mov eax, esi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test edi, edi
je 0x477d98
cmp edi, 2
je 0x477d98
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x477d84
push ecx
push 0x147
push 0x506af8
lea ecx, [ebp - 0xc0]
call fcn.0044bca0
mov edx, str.Failed_to_delete_registry_value:
lea ecx, [eax + 8]
call fcn.0041cec3
cmp dword [esi + 0x14], 8
jb 0x477d62
mov esi, dword [esi]
mov edx, esi
mov ecx, eax
call fcn.0044c7c0
push edi
mov edx, str._error:
mov ecx, eax
call fcn.0041cec3
mov ecx, eax
call fcn.0041af3b
xor eax, eax
inc eax
jmp 0x477d87
mov eax, dword [ebp - 4]
test al, 1
je 0x477d9a
lea ecx, [ebp - 0xc0]
call fcn.0044bd90
jmp 0x477d9a
mov bl, 1
lea ecx, [ebp - 0x10]
call fcn.004426e0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x477e61
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
push 3
push edx
mov ebx, eax
mov dword [ebp - 0x2c], eax
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
mov esi, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], eax
mov word [ebp - 0x20], ax
call fcn.00442850
test eax, eax
jne 0x477f45
lea eax, [ebp - 0x20]
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.00442bb0
test eax, eax
jne 0x477f45
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
push ecx
mov ecx, edi
call dword [eax + 4]
test al, al
je 0x477f45
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
je 0x477f42
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x477f32
push ecx
push 0x17a
push 0x506af8
lea ecx, [ebp - 0xe4]
call fcn.0044bca0
push esi
mov edx, str.Failed_to_delete_registry_value:
lea ecx, [eax + 8]
call fcn.0041cec3
mov edx, str._Default_
mov ecx, eax
call fcn.0044c7c0
mov edx, str._error:
mov ecx, eax
call fcn.0041cec3
mov ecx, eax
call fcn.0041af3b
inc ebx
test bl, 1
je 0x477f42
lea ecx, [ebp - 0xe4]
call fcn.0044bd90
xor esi, esi
inc esi
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.0041b875
lea ecx, [ebp - 0x2c]
call fcn.004426e0
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret
Function at 0x479250
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
xor edx, edx
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], edx
test al, al
mov dword [ebp - 0x30], edx
mov eax, dword [ecx]
mov dword [ebp - 0x2c], edx
setne bl
mov dword [ebp - 0x28], edx
add ebx, 0x80000001
push esi
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push 0x202
cmovae eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x30]
push eax
push ebx
call fcn.00442850
xor ebx, ebx
lea ecx, [ebp - 0x1c]
push ebx
push 1
mov esi, eax
call fcn.0041b875
test esi, esi
jne 0x4792de
push 4
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
push eax
push 4
push ebx
push 0x5059a4
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x47932f
push 2
pop ecx
cmp esi, ecx
je 0x47932f
call fcn.0044bc30
test al, al
je 0x47931b
push ecx
push 0x5d
push str..._.._chrome_installer_util_product.cc
lea ecx, [ebp - 0xe0]
call fcn.0044bca0
push esi
mov edx, str.Failed_to_Open_or_Write_MSI_value_to_client_state_key._error:
lea ecx, [eax + 8]
call fcn.0041cec3
mov ecx, eax
call fcn.0041af3b
xor eax, eax
inc eax
jmp 0x47931e
mov eax, dword [ebp - 0x24]
test al, 1
je 0x479331
lea ecx, [ebp - 0xe0]
call fcn.0044bd90
jmp 0x479331
mov bl, 1
lea ecx, [ebp - 0x30]
call fcn.004426e0
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret 8
Function at 0x47b86f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47b8ca
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x47b8bb
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x47b8b7
cmp esi, ecx
jae 0x47b8bb
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x47b8a5
cmp esi, ecx
jb 0x47b8bf
xor eax, eax
jmp 0x47b8c9
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x47c3ec
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x51aae8]
push ebx
mov bl, dl
mov byte [ebp - 0x1d], bl
push esi
push edi
mov edi, ecx
cmp eax, 0xffffffff
jne 0x47c4cb
mov esi, dword [0x51ecc0]
mov ecx, esi
push str.toast_results_key
call fcn.004452d0
test al, al
je 0x47c4c4
mov eax, str.toast_results_key
push eax
mov dword [ebp - 0x28], eax
call fcn.00415c05
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00445560
push eax
lea ecx, [ebp - 0x28]
call fcn.0041ad80
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
lea ebx, [esi + eax*2]
cmp esi, ebx
je 0x47c49f
movzx eax, word [esi]
push eax
call fcn.004d90d2
pop ecx
test eax, eax
je 0x47c47a
add esi, 2
cmp esi, ebx
jne 0x47c465
cmp esi, ebx
je 0x47c49f
movzx eax, word [esi]
cmp eax, 0x2d
jne 0x47c497
push 0x51aae8
lea ecx, [esi + 2]
mov edx, ebx
call fcn.00442110
jmp 0x47c4ad
cmp eax, 0x2b
jne 0x47c49f
add esi, 2
push 0x51aae8
mov edx, ebx
mov ecx, esi
call fcn.004420a0
pop ecx
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0041b875
mov eax, dword [0x51aae8]
mov bl, byte [ebp - 0x1d]
jmp 0x47c4cb
xor eax, eax
mov dword [0x51aae8], eax
test eax, eax
je 0x47c525
push str.client
lea ecx, [ebp - 0x1c]
call fcn.0041ae60
mov ecx, dword [edi + 0x10]
add ecx, ecx
cmp dword [edi + 0x14], 8
jb 0x47c4e9
mov edi, dword [edi]
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push ecx
cmovae eax, dword [ebp - 0x1c]
push edi
push 1
push 0
push eax
push dword [0x51aae8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0041b875
test bl, bl
je 0x47c52c
push dword [0x51aae8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x47c52c
mov edx, edi
call fcn.00470138
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret
Function at 0x47ced9
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x51ee14]
sub esp, 0x28
push edi
mov edi, ecx
test eax, eax
jne 0x47cef2
xor al, al
jmp 0x47d02e
push ebx
push str.ShowHTMLDialog
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x47cf0c
xor al, al
jmp 0x47d02d
push esi
push 8
xor esi, esi
lea eax, [edi + 4]
pop ecx
mov dword [ebp - 4], esi
cmp dword [eax + 0x14], ecx
jb 0x47cf1f
mov eax, dword [eax]
push 1
lea ecx, [ebp - 4]
push ecx
push eax
push esi
call dword [sym.imp.urlmon.dll_CreateURLMonikerEx]
cmp dword [ebp - 4], esi
jne 0x47cf39
xor al, al
jmp 0x47d02c
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x47cf79
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
mov ecx, esi
call dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x47ce80
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ecx, dword [0x51ee18]
test eax, eax
mov dword [0x51ee1c], eax
cmovne ecx, esi
mov dword [0x51ee18], ecx
push 8
lea eax, [edi + 0x1c]
pop ecx
cmp dword [eax + 0x14], ecx
jb 0x47cf86
mov eax, dword [eax]
push eax
mov word [ebp - 0x28], cx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
push 0
call ebx
mov ecx, dword [ebp - 4]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
push 3
pop eax
cmp word [ebp - 0x18], ax
jne 0x47cfce
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x47cff5
push 8
pop eax
cmp word [ebp - 0x18], ax
jne 0x47cff5
mov eax, dword [ebp + 0xc]
push dword [ebp - 0x10]
mov dword [eax], 6
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
push dword [ebp - 0x10]
lea ecx, [edi + 0x34]
call fcn.0041b8e7
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [0x51ee1c]
test eax, eax
je 0x47d01d
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
and dword [0x51ee18], 0
and dword [0x51ee1c], 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test esi, esi
setns al
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x47d252
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.0047d0e4
push 2
push 0x5040c8
push SysReAllocString
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.00442630
cmp dword [esi + 0x14], 8
jb 0x47d289
mov esi, dword [esi]
push esi
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x28]
call fcn.004426e0
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0041b875
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret
Function at 0x47d67c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 8], ebx
cmp dword [ecx + 0x10], ebx
jne 0x47d6a3
mov eax, dword [ebp + 8]
push 0x505b10
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x47d6b9
cmp dword [ecx + 0x14], 8
jb 0x47d6ab
mov ecx, dword [ecx]
push ecx
mov ecx, dword [ebp + 8]
push 0x505b10
call fcn.00442d50
mov esi, eax
test esi, esi
je 0x47d70d
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x47d6f9
push ecx
push 0xae
push str..._.._chrome_installer_util_channel_info.cc
lea ecx, [ebp - 0xbc]
call fcn.0044bca0
push esi
mov edx, str.Failed_writing_channel_info__result:
lea ecx, [eax + 8]
call fcn.0041cec3
mov ecx, eax
call fcn.0041af3b
xor ebx, ebx
inc ebx
test bl, 1
je 0x47d709
lea ecx, [ebp - 0xbc]
call fcn.0044bd90
xor al, al
jmp 0x47d70f
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x47e2e7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x1c], edi
lea eax, [esi + 0xc]
mov dword [ebp - 0x18], edi
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x14], edi
jb 0x47e307
mov eax, dword [eax]
push 0x203
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1c]
call fcn.00442710
test eax, eax
jne 0x47e369
cmp dword [esi], edi
jne 0x47e338
lea eax, [esi + 0x24]
cmp dword [eax + 0x14], 8
jb 0x47e32b
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004428d0
test al, al
jne 0x47e369
lea ecx, [ebp - 0x10]
call fcn.0044a5e0
add esi, 0x24
mov ecx, dword [eax]
cmp dword [esi + 0x14], 8
mov dword [ebp - 8], ecx
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
jb 0x47e356
mov esi, dword [esi]
push 8
lea eax, [ebp - 8]
push eax
push 0xb
push edi
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x1c]
call fcn.004426e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x47e377
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [esi + 0xc]
cmp dword [eax + 0x14], 8
jb 0x47e396
mov eax, dword [eax]
push 0x202
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xc]
call fcn.00442850
test eax, eax
jne 0x47e3c0
lea eax, [esi + 0x24]
cmp dword [eax + 0x14], 8
jb 0x47e3b6
mov eax, dword [eax]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0xc]
call fcn.004426e0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47f137
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x51ecac]
lea edx, [ebp - 0x20]
push ebx
push esi
push edi
mov eax, dword [eax + 4]
mov edi, dword [ebp + 8]
mov bl, byte [eax + 0x1c]
xor eax, eax
and dword [ebp - 0x10], 0
mov cl, bl
mov dword [ebp - 0xc], 7
mov word [ebp - 0x20], ax
call fcn.0047e60e
test al, al
jne 0x47f17e
xor bl, bl
jmp 0x47f2d1
xor ecx, ecx
lea eax, [ebp - 0x20]
test bl, bl
push 0x202
setne cl
xor ebx, ebx
add ecx, 0x80000001
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0xc], 8
mov dword [ebp - 0x3c], ebx
cmovae eax, dword [ebp - 0x20]
push eax
push ecx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x38], ebx
call fcn.00442710
test eax, eax
jne 0x47f2c9
mov eax, dword [edi + 0x24]
mov esi, dword [ebp - 0x40]
push 4
pop ebx
push ebx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push str.State
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [edi + 0x28]
push ebx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
push str.Group
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [edi + 0x2c]
push ebx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0
push str.ToastLocation
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [edi + 0x30]
push ebx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push ebx
push 0
push str.InactiveDays
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [edi + 0x34]
push ebx
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push ebx
push 0
push str.ToastCount
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [edi + 0x38]
push 8
mov dword [ebp - 0x4c], eax
mov eax, dword [edi + 0x3c]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x4c]
push eax
push 0xb
pop ebx
push ebx
push 0
push str.FirstDisplayTime
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [edi + 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [edi + 0x44]
push 8
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x54]
push eax
push ebx
push 0
push str.LatestDisplayTime
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [edi + 0x48]
mov dword [ebp - 0x5c], eax
mov eax, dword [edi + 0x4c]
push 8
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push 0
push str.UserSessionUptime
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x64], eax
mov eax, dword [edi + 0x54]
push 8
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x64]
push eax
push ebx
push 0
push str.ActionDelay
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov bl, 1
lea ecx, [ebp - 0x40]
call fcn.004426e0
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.0041b875
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret 4
Function at 0x47f9c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push ecx
xor ebx, ebx
lea ecx, [ebp - 0x1c]
mov edx, 0x508390
mov dword [ebp - 0x20], ebx
call fcn.0041d164
pop ecx
push 0x38
lea eax, [ebp - 0x58]
mov dword [ebp - 0x5c], 0x3c
push ebx
push eax
call fcn.004cda10
add esp, 0xc
mov dword [ebp - 0x58], 0x500
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x50], str.open
cmovae eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x40], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x47fa37
mov bl, 1
jmp 0x47fa88
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x47fa76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
push 0x41
push str..._.._chrome_installer_util_google_chrome_distribution.cc
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x118], eax
call fcn.0044bca0
mov edx, str.Failed_to_launch_Edge_for_uninstall_survey
lea ecx, [ebp - 0x108]
call fcn.0041cec3
xor ebx, ebx
inc ebx
test bl, 1
je 0x47fa86
lea ecx, [ebp - 0x118]
call fcn.0044c710
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0041b875
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret
Function at 0x485537
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push ebx
push eax
push 0x509208
xor ebx, ebx
mov dword [ebp - 0xc], edx
inc ebx
push ebx
push 0
push 0x4f3260
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x485567
xor bl, bl
jmp 0x4855da
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp - 8]
push str.ROOTCIMV2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea ecx, [ebp - 4]
mov esi, eax
mov eax, dword [edi]
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push esi
push edi
call dword [eax + 0xc]
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
pop edi
pop esi
js 0x4855c7
xor eax, eax
push eax
push eax
push 3
push 3
push eax
push eax
push 0xa
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4855c7
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov dword [edx], eax
jmp 0x4855cc
mov ecx, dword [ebp - 4]
xor bl, bl
test ecx, ecx
je 0x4855da
and dword [ebp - 4], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4855eb
and dword [ebp - 8], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48702b
Capabilities:
Hash data using sha256

Disassembly:
push esi
push 0x70
mov esi, ecx
push 0
push esi
call fcn.004cda10
add esp, 0xc
mov dword [esi], 0x6a09e667
xor eax, eax
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
inc eax
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
pop esi
ret

Function at 0x487310
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 3
jne 0x48739f
mov edx, 0x4872d0
mov ecx, 0x51eee4
call fcn.0048729f
cmp dword [0x51eacc], 0
jne 0x48739f
push ebx
push dword [0x51ead0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x48739e
push esi
push edi
push 0x51eae0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, 0x51ead4
lea edi, [ebp - 0x10]
push 0x51eae0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, ebx
lea eax, [ebp - 0x10]
xor esi, esi
sub edi, eax
mov ecx, dword [ebp + esi*4 - 0x10]
test ecx, ecx
je 0x48738f
lea eax, [edi + esi*4]
push dword [ebp + eax - 0x10]
call ecx
pop ecx
inc esi
cmp esi, 3
jb 0x48737d
push ebx
call fcn.0044adf0
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret 0xc
Function at 0x490086
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor edx, edx
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x49008e
mov dword [edx*4 + 0x51f0c0], ecx
inc edx
cmp edx, 0x100
jb 0x490089
mov esi, 0x800
jmp 0x4900d7
mov ecx, dword [edx*4 + 0x51ecc0]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x51f0c0]
mov dword [edx*4 + 0x51f0c0], ecx
inc edx
cmp edx, esi
jb 0x4900bb
mov dword [0x5210c0], 0x492740
call fcn.00492989
mov ecx, dword [0x5210c0]
test eax, eax
mov edx, 0x4927e0
cmove ecx, edx
mov dword [0x5210c0], ecx
pop esi
ret