joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ef20
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x693e59
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x7ca00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
call fcn.00434fc0
mov dword [ebp - 4], 0
cmp dword [edi + 0x10], 0
mov dword [ebp - 0x1c], 1
je 0x42ef9a
push ecx
mov edx, edi
mov ecx, esi
call fcn.005da720
mov ecx, esi
call fcn.005dac50
add esp, 4
push ecx
mov edx, ebx
mov ecx, esi
call fcn.005da720
mov edi, dword [0x7eaf28]
add esp, 4
test edi, edi
je 0x42f048
push dword [ebp - 0x18]
movzx eax, word [ebp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x42f048
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x42f048
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push ebx
push edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
cmp dword [esi + 0x14], 8
mov ebx, eax
mov ecx, esi
jb 0x42eff4
mov ecx, dword [esi]
push 0
push 0x200080
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
test edi, edi
je 0x42f048
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
test eax, eax
jne 0x42f031
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x42f048
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x42f041
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret 0x14
Function at 0x431830
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x7ca00c]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push 0xc
xor eax, eax
mov dword [esp + 0x18], 0
push str._C_taskmgr__
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.00428800
cmp dword [esp + 0x18], 8
lea eax, [esp + 4]
push 0
cmovae eax, dword [esp + 8]
push 0
push eax
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
lea ecx, [esp + 4]
setg bl
call fcn.00428770
mov ecx, dword [esp + 0x1c]
mov al, bl
pop ebx
xor ecx, esp
call fcn.0063de71
mov esp, ebp
pop ebp
ret
Function at 0x438420
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x438506
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4384f5
jg 0x438460
test edx, edx
je 0x4384f5
nop dword [eax]
call fcn.004398b0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4384b4
jg 0x438477
test esi, esi
je 0x4384b4
cmp ebx, eax
jg 0x438487
jl 0x438481
cmp edi, esi
jae 0x438487
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00650340
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4384d9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x4384ef
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x438460
jl 0x4384ef
test edi, edi
jne 0x438460
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x438528
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x43852a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x4385a8
jg 0x43853d
test esi, esi
je 0x4385a8
test eax, eax
jl 0x438582
jg 0x438547
test ebx, ebx
je 0x438582
cmp edi, eax
jg 0x438557
jl 0x438551
cmp esi, ebx
jae 0x438557
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00650340
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x438585
mov edx, dword [ebp + 8]
test edi, edi
jl 0x4385a8
jg 0x43858f
test esi, esi
je 0x4385a8
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x4385a8
push eax
push esi
push 1
push edx
call fcn.00658300
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x438af0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x7ca00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x438b20
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x438b5c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x438b5c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x438c43
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x438b84
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x438bb7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00656f21
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x438c43
cmp eax, 1
jle 0x438c16
cmp eax, 3
jne 0x438c43
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.00656f21
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x438c33
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00658300
add esp, 0x10
cmp edi, eax
jne 0x438c43
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x438b47
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0063de71
mov esp, ebp
pop ebp
ret 4
Function at 0x439600
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x7ca00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4396ba
cmp byte [esi + 0x3d], 0
je 0x4396ba
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4396a8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x439670
sub eax, 1
je 0x439674
sub eax, 2
jne 0x4396a8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x439691
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00658300
add esp, 0x10
cmp edi, eax
jne 0x4396a8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0063de71
mov esp, ebp
pop ebp
ret

Function at 0x439c40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x694d80
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7ca00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0063de82
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0063f47b
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f8b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x695699
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x7ca00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x48], 0
call fcn.00428650
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push 0xc
xor eax, eax
mov dword [ebp - 0x30], 0
push str.products.xml
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00428800
push ecx
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.005da720
add esp, 4
lea ecx, [ebp - 0x40]
call fcn.00428770
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
xor esi, esi
movq qword [ebp - 0x34], xmm0
mov dword [ebp - 0x30], esi
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x34], esi
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], esi
je 0x43fa32
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43fa32
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x34]
call fcn.005ea5f0
test al, al
je 0x43f9d1
push 0x20
xor eax, eax
mov dword [ebp - 0x50], esi
push str.__Products_Product_DriverXmlPath
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
call fcn.00428800
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 4
push eax
lea eax, [edi + 0x18]
mov dword [ebp - 0x48], 1
push eax
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.005ef560
test al, al
je 0x43f9d1
mov edi, dword [ebp - 0x44]
test edi, edi
jle 0x43f9d4
mov bl, 1
jmp 0x43f9d6
mov edi, dword [ebp - 0x44]
xor bl, bl
mov dword [ebp - 4], 3
test byte [ebp - 0x48], 1
je 0x43f9eb
lea ecx, [ebp - 0x60]
call fcn.00428770
lea eax, [ebp - 0x28]
test bl, bl
je 0x43fa23
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
push str.Successfully_parsed_products.xml_at__s
push 0x701e7c
push 0x701e7c
push str.AsyncProductInstallManager
push str.WAMB
push 0x1e
call fcn.00433ac0
mov esi, dword [ebp - 0x30]
add esp, 0x1c
jmp 0x43fa68
mov esi, dword [ebp - 0x30]
mov ecx, 0x28
mov edx, str.Invalid_product.xml_at__s
jmp 0x43fa3f
lea eax, [ebp - 0x28]
mov ecx, 0x1e
mov edx, str.Couldnt_find_any_product.xml_at__s
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
push edx
push 0x701e7c
push 0x701e7c
push str.AsyncProductInstallManager
push str.WAMB
push ecx
call fcn.00433ac0
add esp, 0x1c
xor edi, edi
mov byte [ebp - 4], 6
test esi, esi
je 0x43fa78
mov eax, dword [esi]
push esi
call dword [eax + 8]
xor esi, esi
cmp byte [ebp - 0x2c], 0
je 0x43fa84
call dword [sym.imp.ole32.dll_CoUninitialize]
test esi, esi
je 0x43fa8e
mov ecx, dword [esi]
push esi
call dword [ecx + 8]
lea ecx, [ebp - 0x28]
call fcn.00428770
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0063de71
mov esp, ebp
pop ebp
ret
Function at 0x441dc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [ebp + 8], 0
push esi
push edi
mov edi, ecx
jne 0x441e68
push str.Fetching_Hardware_Summary
push 0x701e7c
push 0x701e7c
push str.CompatibilityCheck
push str.WAMB
push 0x1e
call fcn.00433ac0
call fcn.00433b70
call fcn.00433b70
push 0
lea ecx, [edi + 4]
mov edx, dword [eax + 0x134]
call fcn.005f6b90
add esp, 0x1c
test al, al
jne 0x441e3b
push str.Failed_to_get_HardwareUtils_JSON
push 0x701e7c
push 0x701e7c
push str.CompatibilityCheck
push str.WAMB
push 0x32
call fcn.00433ac0
add esp, 0x18
push str.Fetching_Hardware_Summary_done
push 0x701e7c
push 0x701e7c
push str.CompatibilityCheck
push str.WAMB
push 0x1e
call fcn.00433ac0
add esp, 0x18
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x441e78
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push 8
call fcn.0063de82
add esp, 4
mov esi, eax
xorps xmm0, xmm0
mov dword [esp + 0xc], esi
push 0
push 0
push esi
push 0x5f22a0
push 0
movq qword [esi], xmm0
push 0
mov dword [esi], 0x441f00
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x441eea
push 8
push esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0063e103
push str.failed_to_create_a_new_Fetch_Hardware_Summary_Workflow_thread.
push 0x701e7c
push 0x701e7c
push str.CompatibilityCheck
push str.WAMB
push 0x28
call fcn.00433ac0
add esp, 0x20
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov dword [edi + 0x1c], eax
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x449c90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6969be
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x7ca00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 7
mov word [edi + 0x18], ax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], 7
mov word [edi + 0x30], ax
lea esi, [edi + 0x48]
mov byte [ebp - 4], 2
push 0x40
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0063de82
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
xor eax, eax
mov word [edi + 0x50], ax
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 7
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x70], eax
mov word [edi + 0x74], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x451600
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x697838
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x7ca00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
lea edi, [esi + 0x10]
je 0x45168d
push 0xf
xor eax, eax
mov dword [ebp - 0x18], 0
push str.cci.countryCode
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00428800
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebx + 0xbc]
call fcn.004390d0
cmp eax, esi
je 0x451685
cmp dword [esi + 0x14], 8
jb 0x45167b
mov esi, dword [esi]
push dword [edi]
mov ecx, eax
push esi
call fcn.00428800
lea ecx, [ebp - 0x28]
call fcn.00428770
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x457b30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 8
mov edi, ecx
call fcn.0063de82
add esp, 4
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 4], esi
push 0
push 0
push esi
push 0x5f22a0
push 0
movq qword [esi], xmm0
push 0
mov dword [esi], 0x457bc0
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x457ba7
push 8
push esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0063e103
push str.Failed_to_start_the_worker_Thread
push str.InitMessageGateway
push 0x701e7c
push str.MessageGateway
push str.WAMB
push 0x32
call fcn.00433ac0
add esp, 0x20
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [edi + 0xb4], eax
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x462830
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x697838
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x7ca00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [edi + 4], eax
test eax, eax
jne 0x462918
call fcn.00433b70
lea ecx, [eax + 0x148]
lea eax, [ebp - 0x28]
push eax
call fcn.00449060
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.005dd690
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
mov esi, 0x3e8
mov eax, edx
mul esi
mov ebx, eax
mov eax, ecx
mul esi
lea ecx, [ebp - 0x28]
add ebx, edx
mov esi, eax
call fcn.00428770
test ebx, ebx
jne 0x4628ba
cmp esi, 0x927c0
jbe 0x4628c1
mov esi, 0x927c0
xor ebx, ebx
push 8
mov dword [edi + 0x20], esi
mov dword [edi + 0x24], ebx
call fcn.0063de82
add esp, 4
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp + 8], esi
push 0
push 0
push esi
push 0x5f22a0
push 0
movq qword [esi], xmm0
push 0
mov dword [esi], 0x462940
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x462910
push 8
push esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0063e103
add esp, 8
jmp 0x46291d
mov dword [edi + 0xb8], eax
jmp 0x46291d
call fcn.00462a30
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x462a30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp byte [edi], 0
je 0x462a43
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 8
call fcn.0063de82
add esp, 4
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 4], esi
push 0
push 0
push esi
push 0x5f22a0
push 0
movq qword [esi], xmm0
push 0
mov dword [esi], 0x462ad0
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x462ab3
push 8
push esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0063e103
push str.Failed_to_start_otherinstaller_IpcReaderThread
push 0x701e7c
push 0x701e7c
push str.OtherInstallerHandler
push str.WAMB
push 0x32
call fcn.00433ac0
add esp, 0x20
xor al, al
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [edi + 0xb0], eax
mov al, 1
pop esi
mov byte [edi], 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x464880
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x4648ab
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x464894
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x465d80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69a368
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x7ca00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x38], 0
je 0x465de3
push str.Inside_startAppsBLResponseThread__Thread_already_running.
push 0x701e7c
push 0x701e7c
push str.ProductInstallManager
push str.WAMB
push 0x28
call fcn.00433ac0
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 8
mov byte [edi + 0x38], 1
call fcn.0063de82
add esp, 4
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 0x10], esi
push 0
push 0
push esi
push 0x5f22a0
push 0
movq qword [esi], xmm0
push 0
mov dword [esi], 0x466820
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x465ea5
push 8
push esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0063e103
push str.Inside_startAppsBLResponseThread__failed_to_create_a_new_thread.
push 0x701e7c
push 0x701e7c
push str.ProductInstallManager
push str.WAMB
push 0x28
call fcn.00433ac0
add esp, 0x20
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
lea ecx, [ebp - 0x28]
mov word [ebp - 0x28], ax
push 0x1a
push str.progress_waitThread_failed
call fcn.00428800
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.004294d0
mov ecx, eax
call fcn.0048c010
lea ecx, [ebp - 0x28]
call fcn.00428770
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [edi + 8], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret