joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4688f0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x468923
push esi
call fcn.00476cb0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x46891c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4689a9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x468992
mov eax, dword [esi + 8]
test eax, eax
je 0x468947
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x46898e
cmp eax, 2
je 0x468992
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x46893a
cmp eax, 3
je 0x46896d
cmp eax, 1
jne 0x46893a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x46893a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x46893a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004689d0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4689b8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004689d0
add esp, 4
pop esi
ret

Function at 0x469250
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x469271
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x469271
mov eax, dword [eax + 0x44]
test eax, eax
je 0x469271
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x484700
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4847a3
test eax, eax
jbe 0x4847a3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4847a3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x48474e
xor esi, esi
jmp 0x484754
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x48477f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00488a20
add esi, eax
push esi
mov ebx, esi
call fcn.00488a20
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x484760
pop ebp
test edi, edi
pop edi
jne 0x4847a3
test ebx, ebx
je 0x4847a3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004a1bb0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4848c5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4849dd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4849dd
mov eax, dword [esi + 0x3c]
push eax
call fcn.004b3471
mov esi, eax
test esi, esi
je 0x4849dd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4849dd
mov ecx, esi
call fcn.00484850
cmp edi, eax
jge 0x4849dd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x484963
mov dword [esp + 0x34], 1
jmp 0x4849be
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4849dd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00483e00
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x48baa0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x8a21ac]
xor edx, edx
cmp eax, edx
jne 0x48bac6
xor eax, eax
mov byte [eax + 0x8a20ac], al
inc eax
cmp eax, 0x100
jl 0x48baae
mov dword [0x8a21ac], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x8a20ac
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x48bb57
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x48bb2a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x48baf8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x48bbd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x48bc23
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x48bc0a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4925a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c056e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00492ec0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x85b35c
call fcn.004b1788
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x492633
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004b1788
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x49262c
push 0
mov ecx, eax
call fcn.004896d0
mov dword [esi + 0xc], eax
jmp 0x492635
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x492635
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4b3e15
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b3e4d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b1ea2
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b1e7a
jmp 0x4b3e59
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b550c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b554e
call fcn.004bafbf
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4b554e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b5545
xor eax, eax
jmp 0x4b5556
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b555c
pop edi
pop esi
pop ebx
ret 4
Function at 0x4bb4ef
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4bb51d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4bb53b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004bb455
jmp 0x4bb53b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4bb53b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004bb455
test edi, edi
mov eax, edi
jne 0x4bb525
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x42058b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x4f4284]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
and dword [ebp - 0x58], 0
push ebx
push edi
push 0
mov dword [ebp - 0x60], eax
or edi, 0xffffffff
mov eax, dword [ebp + 0xc]
mov ebx, edi
push 0x8000
push eax
mov dword [ebp - 0x64], ecx
call fcn.0042093a
add esp, 0xc
mov dword [ebp - 0x5c], eax
test eax, eax
jns 0x4205d4
push 6
pop eax
jmp 0x4206b5
push esi
lea ecx, [ebp - 0x54]
push ecx
push eax
call fcn.00420873
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x42068a
push eax
push 0x8000
push dword [ebp - 0x60]
call fcn.0042093a
mov edi, eax
add esp, 0xc
test edi, edi
jns 0x42060a
push 6
pop esi
jmp 0x42068a
lea eax, [ebp - 0x34]
push eax
push edi
call fcn.004a772f
pop ecx
pop ecx
test eax, eax
jne 0x420602
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x20], eax
je 0x420626
push 8
jmp 0x420604
push eax
call fcn.00431260
mov esi, eax
mov dword [ebp - 0x58], esi
pop ecx
test esi, esi
jne 0x420639
inc esi
jmp 0x42068a
push dword [ebp - 0x4c]
push esi
push edi
call fcn.004b735d
add esp, 0xc
cmp eax, dword [ebp - 0x4c]
jne 0x420602
push dword [ebp - 0x4c]
push esi
call fcn.0047c5e4
pop ecx
pop ecx
cmp eax, dword [ebp - 0x48]
je 0x42065f
push 4
jmp 0x420604
push 0
push 0x8301
push dword [ebp - 0x64]
call fcn.0042093a
mov ebx, eax
add esp, 0xc
test ebx, ebx
js 0x420602
push ebx
push esi
push dword [ebp - 0x5c]
lea eax, [ebp - 0x54]
push eax
call fcn.004206c5
add esp, 0x10
mov esi, eax
push dword [ebp - 0x58]
call fcn.00431240
push dword [ebp - 0x5c]
call fcn.004a9dae
pop ecx
pop ecx
test edi, edi
js 0x4206a7
push edi
call fcn.004a9dae
pop ecx
test ebx, ebx
js 0x4206b2
push ebx
call fcn.004a9dae
pop ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0049d8a1
mov esp, ebp
pop ebp
ret
Function at 0x4206c5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebx + 8]
add ecx, eax
mov eax, dword [ebx + 0x14]
add eax, dword [ebx + 0x18]
add eax, dword [ebx + 0x1c]
push eax
mov dword [ebp - 0xc], ecx
call fcn.00431260
mov dword [ebp - 8], eax
pop ecx
test eax, eax
jne 0x4206fa
inc eax
jmp 0x42086e
push esi
push edi
mov edi, dword [ebx + 0x14]
xor esi, esi
add edi, dword [ebx + 0x18]
mov ecx, eax
mov dword [ebp + 8], ecx
add edi, dword [ebx + 0x1c]
je 0x420740
push edi
push ecx
push dword [ebp + 0xc]
call fcn.004b735d
add esp, 0xc
test eax, eax
js 0x420856
mov ecx, dword [ebp + 8]
sub edi, eax
add ecx, eax
mov dword [ebp + 8], ecx
test eax, eax
jne 0x420739
test edi, edi
jne 0x42085e
test edi, edi
jne 0x42070e
mov eax, dword [ebp - 8]
mov ecx, dword [ebx + 0x14]
mov edi, eax
xor edx, edx
mov dword [ebp - 0x10], 0xc
mov eax, ecx
div dword [ebp - 0x10]
test edx, edx
jne 0x42085e
add ecx, dword [ebp - 8]
mov edx, dword [ebx + 0x18]
mov ebx, dword [ebx + 0x1c]
add edx, ecx
add ebx, edx
mov dword [ebp + 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 8], ecx
jae 0x420861
mov ebx, dword [ebp + 0x10]
push dword [edi]
call dword [sym.imp.WS2_32.dll_ntohl]
push dword [edi + 4]
mov dword [edi], eax
call dword [sym.imp.WS2_32.dll_ntohl]
push dword [edi + 8]
mov dword [edi + 4], eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0xc]
sub eax, ebx
cmp dword [edi], eax
ja 0x42085e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
sub eax, ecx
cmp dword [edi], eax
ja 0x42085e
cmp dword [edi], 0
mov dword [ebp - 0x18], esi
jbe 0x4207e5
mov eax, ebx
mov edx, ecx
sub eax, ecx
mov dword [ebp + 0x10], eax
mov ecx, eax
mov al, byte [ecx + edx]
add byte [edx], al
inc esi
inc edx
cmp esi, dword [edi]
jb 0x4207d5
mov ecx, dword [ebp + 8]
xor esi, esi
mov eax, dword [edi]
push eax
push ecx
push dword [ebp + 0x14]
mov dword [ebp + 0x10], eax
call fcn.004a95fd
mov ecx, dword [ebp + 0x10]
add esp, 0xc
cmp eax, ecx
jne 0x42085a
add dword [ebp + 8], ecx
add ebx, ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
sub eax, ecx
cmp dword [edi + 4], eax
ja 0x42085e
mov eax, dword [edi + 4]
push eax
push ecx
push dword [ebp + 0x14]
mov dword [ebp + 0x10], eax
call fcn.004a95fd
mov ecx, dword [ebp + 0x10]
add esp, 0xc
cmp eax, ecx
jne 0x42085a
add dword [ebp - 4], ecx
mov ecx, ebx
mov eax, dword [ebp - 0x20]
neg ecx
add eax, ecx
cmp dword [edi + 8], eax
jl 0x42085e
mov eax, dword [ebp - 0xc]
add eax, ecx
cmp dword [edi + 8], eax
jg 0x42085e
add ebx, dword [edi + 8]
add edi, dword [ebp - 0x10]
cmp edi, dword [ebp - 0x24]
jb 0x420783
jmp 0x420861
push 6
jmp 0x420860
push 7
jmp 0x420860
push 8
pop esi
push dword [ebp - 8]
call fcn.00431240
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420873
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4f4284]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0xc]
push 0x20
push edi
push dword [ebp + 8]
call fcn.004b735d
add esp, 0xc
cmp eax, 0x20
je 0x4208a1
push 6
jmp 0x42092a
push esi
push dword [edi + 8]
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
call esi
push dword [edi + 0xc]
mov dword [edi + 8], eax
call esi
push dword [edi + 0x10]
mov dword [edi + 0xc], eax
call esi
push dword [edi + 0x14]
mov dword [edi + 0x10], eax
call esi
push dword [edi + 0x18]
mov dword [edi + 0x14], eax
call esi
push dword [edi + 0x1c]
mov dword [edi + 0x18], eax
call esi
mov dword [edi + 0x1c], eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call fcn.004a772f
pop ecx
pop ecx
pop esi
test eax, eax
jne 0x42089a
cmp dword [edi], 0x4944424d
jne 0x420928
cmp dword [edi + 4], 0x30314646
jne 0x420928
mov eax, dword [ebp - 0x20]
cmp eax, 0x20
jb 0x420928
add eax, 0xffffffe0
cmp eax, dword [edi + 0x14]
jb 0x420928
sub eax, dword [edi + 0x14]
cmp eax, dword [edi + 0x18]
jb 0x420928
sub eax, dword [edi + 0x18]
cmp eax, dword [edi + 0x1c]
jb 0x420928
sub eax, dword [edi + 0x1c]
neg eax
sbb eax, eax
and eax, 8
jmp 0x42092b
push 8
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0049d8a1
mov esp, ebp
pop ebp
ret

Function at 0x421ea7
Capabilities:
Check mutex on windows

Disassembly:
push esi
xor eax, eax
mov esi, ecx
push 0x4d4090
push eax
push eax
mov byte [esi], al
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x421ed9
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb al, al
inc al
mov byte [esi], al
mov eax, esi
pop esi
ret
Function at 0x423ecc
Capabilities:
Create process on windows
Create process suspended
Inject apc
Query environment variable
Resume thread
Self delete
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x4f4284]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov edi, 0x104
xor ebx, ebx
push edi
push eax
push str._SystemRoot_System32_rundll32.exe
mov dword [ebp - 0x210], ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4240df
cmp eax, edi
jae 0x4240df
push 0x40
lea eax, [ebp - 0x274]
mov dword [ebp - 0x278], 0x44
push ebx
push eax
call fcn.004a0ee0
add esp, 0xc
lea eax, [ebp - 0x220]
xorps xmm0, xmm0
movups xmmword [ebp - 0x220], xmm0
push eax
lea eax, [ebp - 0x278]
push eax
push ebx
push ebx
push 4
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
mov dword [ebp - 0x210], edi
test edi, edi
je 0x4240da
mov ecx, dword [esi + 0x10]
push 4
push 0x1000
lea ecx, [ecx*2 + 2]
push ecx
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov dword [ebp - 0x230], ecx
test ecx, ecx
je 0x424068
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x224], ebx
jb 0x423fae
mov esi, dword [esi]
lea edx, [ebp - 0x224]
push edx
lea eax, [eax*2 + 2]
push eax
push esi
push ecx
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x4d44bc
push edi
call esi
push 0x4d44c4
push edi
mov dword [ebp - 0x228], eax
call esi
push 0x4d44d0
push edi
mov dword [ebp - 0x22c], eax
call esi
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x234], eax
test ecx, ecx
je 0x424064
mov edi, dword [ebp - 0x22c]
test edi, edi
je 0x424064
test eax, eax
je 0x424064
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push dword [ebp - 0x21c]
push ecx
call esi
push dword [ebp - 0x230]
push dword [ebp - 0x21c]
push edi
call esi
push ebx
push dword [ebp - 0x21c]
push dword [ebp - 0x234]
call esi
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [ebp - 0x210]
jmp 0x4240c2
mov edi, ebx
jmp 0x4240c2
push 2
call fcn.00432780
pop ecx
test al, al
je 0x4240a4
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x198
push str.c:_bc_bwin_archive_srcchromeinstaller_setup_setup_util.cc
lea ecx, [ebp - 0x330]
call fcn.00431820
add eax, 0x10
push 0x4d44dc
push eax
call fcn.00415b8c
pop ecx
xor ebx, ebx
pop ecx
inc ebx
test bl, 1
je 0x4240b4
lea ecx, [ebp - 0x330]
call fcn.00431af0
push 0xffffffffffffffff
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x220]
call esi
test edi, edi
setne al
jmp 0x4240e1
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d8a1
mov esp, ebp
pop ebp
ret
Function at 0x42947d
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
lea esi, [ecx + 4]
test esi, esi
je 0x4294bb
mov edi, dword [ebp + 0xc]
lea ebx, [edi + 4]
test ebx, ebx
je 0x4294bb
call fcn.0042c3ba
test al, al
je 0x4294bb
mov ecx, edi
call fcn.0042c3ba
test al, al
je 0x4294bb
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
jmp 0x4294bd
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x430c6b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push eax
push 0x42ffd9
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
pop ebp
ret

Function at 0x430c85
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push 0x4300bd
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
pop ebp
ret

Function at 0x430ca1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push 0x43005b
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
pop ebp
ret

Function at 0x430cbd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push eax
push 0x430187
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
pop ebp
ret
Function at 0x431880
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x534
mov eax, dword [0x4f4284]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx], 3
jne 0x4318c9
call fcn.0044fc50
test al, al
jne 0x4318c9
lea ecx, [ebp - 0x534]
call fcn.00450c70
lea esi, [ebx + 8]
push esi
call fcn.00431610
add esp, 4
lea ecx, [ebp - 0x534]
push esi
call fcn.00450f10
lea edi, [ebx + 8]
push edi
call fcn.00431610
add esp, 4
lea eax, [ebp - 0x41c]
lea esi, [ebx + 0xc]
mov ecx, esi
push eax
call fcn.0042f8c7
mov eax, dword [0x4f51ec]
test eax, eax
je 0x431917
lea ecx, [ebp - 0x41c]
push ecx
push dword [ebx + 0xa0]
push dword [ebx + 0xa8]
push dword [ebx + 0xa4]
push dword [ebx]
call eax
add esp, 0x14
test al, al
jne 0x431a97
test byte [0x4f407c], 2
je 0x43193d
cmp dword [ebp - 0x408], 0x10
lea eax, [ebp - 0x41c]
cmovae eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x431942
cmp dword [ebx], 2
jl 0x431983
cmp dword [ebp - 0x408], 0x10
lea edi, [ebp - 0x41c]
mov esi, dword [ebp - 0x40c]
cmovae edi, dword [ebp - 0x41c]
push 2
call fcn.004a8139
push eax
push 1
push esi
push edi
call fcn.004a9003
push 2
call fcn.004a8139
push eax
call fcn.004a8d88
lea edi, [ebx + 8]
add esp, 0x1c
lea esi, [ebx + 0xc]
test byte [0x4f407c], 1
je 0x4319c5
call fcn.004325f0
test al, al
je 0x4319c5
cmp dword [ebp - 0x408], 0x10
lea ecx, [ebp - 0x438]
push 0
push ecx
push dword [ebp - 0x40c]
lea eax, [ebp - 0x41c]
cmovae eax, dword [ebp - 0x41c]
push eax
push dword [0x4f51e0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebx], 3
jne 0x431a97
mov ecx, dword [0x4f5280]
test ecx, ecx
je 0x431a01
sub esp, 8
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x408], 0x10
mov edx, esp
cmovae eax, dword [ebp - 0x41c]
mov dword [edx], eax
mov eax, dword [ebp - 0x40c]
mov dword [edx + 4], eax
call fcn.00450bb0
mov ecx, 0x400
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x40c], ecx
cmovb ecx, dword [ebp - 0x40c]
cmp dword [ebp - 0x408], 0x10
cmovae eax, dword [ebp - 0x41c]
test ecx, ecx
je 0x431a3c
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.004a0960
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
call fcn.00450c60
add esp, 4
cmp dword [0x4f51e8], 0
je 0x431a92
lea eax, [ebp - 0x434]
mov ecx, esi
push eax
call fcn.0042f8c7
lea eax, [ebp - 0x434]
push eax
call dword [0x4f51e8]
mov eax, dword [ebp - 0x420]
add esp, 4
cmp eax, 0x10
jb 0x431a97
inc eax
lea ecx, [ebp - 0x434]
push eax
push dword [ebp - 0x434]
call fcn.004310c0
jmp 0x431a97
call fcn.0044fc60
mov eax, dword [ebp - 0x408]
cmp eax, 0x10
jb 0x431ab5
inc eax
lea ecx, [ebp - 0x41c]
push eax
push dword [ebp - 0x41c]
call fcn.004310c0
push dword [ebx + 0xac]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea esi, [edi + 0x50]
mov ecx, esi
call fcn.0042f22d
push esi
mov dword [esi], vtable.std::ios_base.0
call fcn.0049c9f9
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0049d8a1
mov esp, ebp
pop ebp
ret