joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428796
Capabilities:
Get http content length
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x28], edi
je 0x4287bb
xor eax, eax
jmp 0x42890c
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], edi
push eax
push 0x8000
push dword [esi + 0x60]
push dword [esi + 0x5c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x428853
lea eax, [ebp - 0x1c]
push str.internet_read_
push eax
call fcn.004278d5
pop ecx
pop ecx
push eax
lea ecx, [esi + 0x18]
call fcn.0040dbb0
push edi
push 1
lea ecx, [ebp - 0x1c]
call fcn.00404310
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00433b58
pop ecx
pop ecx
push eax
push 0x2a8
push str.lite_installer::Downloader::ReadChunk
push 1
lea ecx, [ebp - 0x94]
call fcn.0043386f
push str.Download_chunk_error.
lea ecx, [eax + 8]
call fcn.0041fc9c
lea ecx, [ebp - 0x94]
call fcn.00433958
push edi
push 1
lea ecx, [ebp - 0x1c]
call fcn.00404a00
jmp 0x4287b4
cmp dword [ebp - 0x98], edi
jbe 0x4288c7
mov ecx, dword [esi + 0x4c]
push dword [ebp - 0x98]
push dword [esi + 0x60]
mov eax, dword [ecx]
call dword [eax]
test al, al
jne 0x4288c7
lea eax, [ebp - 0x1c]
push str.write_file_
push eax
call fcn.004278d5
pop ecx
pop ecx
push eax
lea ecx, [esi + 0x18]
call fcn.0040dbb0
push edi
push 1
lea ecx, [ebp - 0x1c]
call fcn.00404310
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00433b58
pop ecx
pop ecx
push eax
push 0x2af
push str.lite_installer::Downloader::ReadChunk
push 1
lea ecx, [ebp - 0x94]
call fcn.0043386f
push str.Write_file_error.
jmp 0x428830
cmp dword [esi + 0x48], edi
jne 0x428906
push edi
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x9c], edi
push eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0xa0], 4
push eax
push 0x20000005
push dword [esi + 0x5c]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x428906
mov eax, dword [ebp - 0x9c]
mov dword [esi + 0x48], eax
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043a597
mov esp, ebp
pop ebp
ret

Function at 0x428bd9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x428be7
mov eax, dword [eax]
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x428c3b
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp + 8], ebx
cmp dword [eax + 0x14], 0x10
lea edi, [eax + 0x10]
jb 0x428c1a
mov eax, dword [eax]
push ebx
lea ecx, [ebp + 8]
push ecx
push dword [edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x428c36
mov eax, dword [ebp + 8]
cmp eax, dword [edi]
jne 0x428c36
mov bl, 1
pop edi
test esi, esi
je 0x428c42
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
ret
Function at 0x4295fe
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x475154]
push ebx
xor ebx, ebx
push esi
test eax, eax
jne 0x42968d
push 0x206
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.0043d870
add esp, 0xc
mov esi, ebx
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [esi + 0x45feb8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
ja 0x429675
push 8
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x475154], eax
jmp 0x42967a
mov eax, dword [0x475154]
test eax, eax
jne 0x42968d
add esi, 4
cmp esi, 0xc
jb 0x429635
mov eax, dword [0x475150]
jmp 0x4296c4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
call esi
push str.FDIDestroy
push dword [0x475154]
mov dword [0x475148], eax
call esi
push str.FDICopy
push dword [0x475154]
mov dword [0x47514c], eax
call esi
mov dword [0x475150], eax
cmp dword [0x475148], ebx
je 0x4296db
cmp dword [0x47514c], ebx
je 0x4296db
test eax, eax
je 0x4296db
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a597
mov esp, ebp
pop ebp
ret
Function at 0x429d29
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x429d88
push ebx
xor ecx, ecx
mov dword [ebp - 0xa], ebx
push 3
mov word [ebp - 0xc], cx
lea ecx, [ebp - 0xc]
push ecx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
cmp eax, 3
jne 0x429d88
lea eax, [ebp - 0xcd]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x24]
call fcn.0042991d
jmp 0x429d95
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0xf
push 0x4f
mov esi, str._anonymous_namespace::AutodetectBrandName
lea ecx, [ebp - 0xcc]
push esi
push ebx
call fcn.004338f7
lea ecx, [ebp - 0x24]
push ecx
push str.User_region:
lea ecx, [eax + 8]
call fcn.0041fc9c
mov ecx, eax
call fcn.0042316a
lea ecx, [ebp - 0xcc]
call fcn.004339b2
lea eax, [ebp - 0x6c]
push eax
call fcn.00427e09
pop ecx
push 0x51
push esi
push ebx
lea ecx, [ebp - 0xcc]
call fcn.004338f7
lea ecx, [ebp - 0x6c]
push ecx
push str.User_locale:
lea ecx, [eax + 8]
call fcn.0041fc9c
mov ecx, eax
call fcn.0042316a
lea ecx, [ebp - 0xcc]
call fcn.004339b2
mov dword [ebp - 0xc], ebx
mov esi, ebx
push dword [esi + 0x460130]
lea ecx, [ebp - 0x3c]
call fcn.004036f0
cmp dword [ebp - 0x2c], 0
je 0x429e31
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040ea20
test eax, eax
jne 0x429e64
push dword [esi + 0x460134]
lea ecx, [ebp - 0x54]
call fcn.004036f0
cmp dword [ebp - 0x44], 0
je 0x429eca
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x54]
call fcn.0040ea20
test eax, eax
je 0x429eca
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.00404a00
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.00404a00
inc dword [ebp - 0xc]
add esi, 0xc
cmp esi, 0x60
jb 0x429e0d
push 0x63
push str._anonymous_namespace::AutodetectBrandName
push ebx
lea ecx, [ebp - 0xcc]
call fcn.004338f7
mov esi, str.yandex
push esi
push str.Didnt_found_brand_name._Use_default:
lea ecx, [eax + 8]
call fcn.0041fc9c
mov ecx, eax
call fcn.0041fc9c
lea ecx, [ebp - 0xcc]
call fcn.004339b2
push esi
mov ecx, edi
call fcn.004036f0
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.00404a00
push ebx
push 1
jmp 0x429f36
push 0x5f
push str._anonymous_namespace::AutodetectBrandName
push ebx
lea ecx, [ebp - 0xcc]
call fcn.004338f7
imul esi, dword [ebp - 0xc], 0xc
lea ecx, [eax + 8]
push dword [esi + 0x460138]
push str.Detected_brand_name:
call fcn.0041fc9c
mov ecx, eax
call fcn.0041fc9c
lea ecx, [ebp - 0xcc]
call fcn.004339b2
push dword [esi + 0x460138]
mov ecx, edi
call fcn.004036f0
xor esi, esi
lea ecx, [ebp - 0x54]
push ebx
inc esi
push esi
call fcn.00404a00
push ebx
push esi
lea ecx, [ebp - 0x3c]
call fcn.00404a00
push ebx
push esi
lea ecx, [ebp - 0x6c]
call fcn.00404a00
push ebx
push esi
lea ecx, [ebp - 0x24]
call fcn.00404a00
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a597
mov esp, ebp
pop ebp
ret
Function at 0x42bddd
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0xc], 0
push edi
mov edi, ecx
mov dword [ebp - 8], 7
xor ecx, ecx
mov word [ebp - 0x1c], cx
lea ecx, [ebp - 0x1c]
push ecx
push 0x4604b8
push eax
call fcn.0042c033
add esp, 0xc
cmp dword [ebp - 0xc], 0
je 0x42be50
and dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push esi
cmovae eax, dword [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x42be4f
push esi
push dword [ebp - 0x20]
mov ecx, edi
call fcn.0042bc13
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00404310
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0043a597
mov esp, ebp
pop ebp
ret 4

Function at 0x42cfca
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x208
mov dword [ebp - 0x290], eax
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0043d870
add esp, 0xc
test edi, edi
jne 0x42d024
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x42d024
xor al, al
jmp 0x42d15e
push esi
test edi, edi
lea esi, [ebp - 0x20c]
push ebx
cmovne esi, edi
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x42d044
xor al, al
jmp 0x42d15d
push edi
lea ecx, [ebp - 0x29c]
call fcn.00409b50
push dword [ebp - 0x29c]
push edi
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42d150
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x288], ebx
push eax
lea eax, [ebp - 0x288]
mov dword [ebp - 0x28c], ebx
push eax
push 0x46e8d8
push dword [ebp - 0x29c]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42d150
cmp dword [ebp - 0x28c], 0x34
jb 0x42d150
push esi
lea ecx, [ebp - 0x224]
call fcn.00409580
push 0x1a9
push str.lite_installer::GetFileVersion
push ebx
lea ecx, [ebp - 0x284]
call fcn.004338f7
mov ecx, dword [ebp - 0x288]
push dword [ecx + 0x10]
lea ecx, [ebp - 0x224]
push str._Version:
push ecx
push str.Module:
lea ecx, [eax + 8]
call fcn.0041fc9c
mov ecx, eax
call fcn.0041fc44
mov ecx, eax
call fcn.0041fc9c
mov ecx, eax
call fcn.004209c2
mov esi, eax
xor ebx, ebx
push 0x2e
inc ebx
push ebx
lea ecx, [esi + 0x40]
call fcn.00406490
mov ecx, dword [ebp - 0x288]
push dword [ecx + 0x14]
mov ecx, esi
call fcn.004209c2
lea ecx, [ebp - 0x284]
call fcn.004339b2
push 0
push ebx
lea ecx, [ebp - 0x224]
call fcn.00404310
mov eax, dword [ebp - 0x288]
xor edx, edx
mov ecx, dword [eax + 0x10]
or edx, dword [eax + 0x14]
mov eax, dword [ebp - 0x290]
mov dword [eax], edx
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x29c]
call fcn.00409bd0
mov al, bl
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0043a597
mov esp, ebp
pop ebp
ret
Function at 0x42e96d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x4755e4]
push edi
push 0xa
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x42e9f5
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42e9ce
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push 2
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x42e9ce
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x42e9d2
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x42e9f4
push edi
push ebx
push eax
call fcn.0043d2c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 4]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4302bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x410], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40c], eax
xor eax, eax
push 0x60
push eax
push esi
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x408], eax
call ebx
mov edi, eax
test edi, edi
jne 0x430325
push 2
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x430325
call fcn.0042f7d1
mov esi, eax
jmp 0x4303c6
push dword [ebp - 0x40c]
push dword [ebp - 0x410]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x430345
call fcn.0042f7d1
jmp 0x4303b9
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x43033e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x43036b
mov esi, 0x8007000e
jmp 0x4303bb
push eax
lea ecx, [ebp - 0x408]
call fcn.0042f5f3
cmp dword [ebp - 0x408], 0
je 0x430364
push esi
push dword [ebp - 0x408]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x43033e
mov eax, dword [ebp - 0x408]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x418]
push dword [ebp - 0x408]
call fcn.00430181
mov esi, eax
test edi, edi
je 0x4303c6
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x4303df
lea ecx, [ebp - 0x408]
call fcn.0042fa6c
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a597
mov esp, ebp
pop ebp
ret 0x10
Function at 0x430a66
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test edx, edx
jne 0x430a79
push 0xd
pop eax
jmp 0x430abd
push esi
xor eax, eax
push edi
mov dword [ebp + 0xc], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp + 0xc]
jne 0x430a8c
sub ecx, dword [ebp - 4]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x430a84
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x430ac4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x430ad6
push 0xd
pop eax
jmp 0x430b08
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x430adf
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x43155b
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0043a5b0
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x100c]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push edx
lea edx, [ebp - 0x804]
mov dword [ebp - 0x100c], 0x800
push edx
lea edx, [ebp - 0x1008]
inc ebx
push edx
push 0
push eax
push dword [ecx]
mov dword [ebp - 0x1008], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x43162d
cmp dword [ebp - 0x1008], ebx
jne 0x4315da
lea eax, [ebp - 0x804]
push eax
call fcn.00401160
pop ecx
push eax
lea eax, [ebp - 0x804]
push eax
mov ecx, edi
call fcn.004046d0
jmp 0x43162d
cmp dword [ebp - 0x1008], 2
jne 0x431628
mov ebx, 0x400
lea eax, [ebp - 0x1004]
push ebx
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x100c], eax
test eax, eax
je 0x431621
cmp eax, ebx
ja 0x431621
lea eax, [ebp - 0x1004]
push eax
call fcn.00401160
pop ecx
push eax
lea eax, [ebp - 0x1004]
jmp 0x4315d0
mov esi, 0xea
jmp 0x43162d
mov esi, 0x3f4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a597
mov esp, ebp
pop ebp
ret 8

Function at 0x431642
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x43164f
sub edx, esi
sar edx, 1
lea eax, [edx*2 + 2]
push eax
push dword [ebp + 0xc]
push 1
push edi
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 8
Function at 0x43175c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x431787
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x431787
mov ecx, dword [ecx + eax + 0x98]
test ecx, ecx
je 0x431787
add eax, ecx
jmp 0x431789
xor eax, eax
pop ebp
ret 4

Function at 0x431810
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
call fcn.004316cb
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4318a3
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x43189c
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [esi + 0xc], edx
test edx, edx
je 0x431893
push 6
pop ecx
mov dword [ebp - 0x1c], edi
xor eax, eax
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x431893
mov ecx, dword [ebp - 0x10]
mov al, 1
mov dword [esi + 0x10], ecx
jmp 0x4318a5
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.004316cb
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x434a1c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x475274
push edi
mov edi, dword [ebp + 8]
mov ecx, esi
call fcn.00434c4e
mov bl, byte [ebp + 0xc]
cmp dword [eax + 0x10], 0
je 0x434b21
mov ecx, esi
call fcn.00434c4e
cmp dword [eax + 0x14], 8
jb 0x434a5d
mov eax, dword [eax]
push 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00449b78
add esp, 0xc
push ecx
push ecx
mov esi, esp
mov eax, 0x461658
push eax
mov dword [esi], eax
call fcn.00401160
mov dword [esi + 4], eax
lea eax, [ebp - 0x224]
pop ecx
push eax
push ecx
push ecx
mov esi, esp
lea eax, [ebp - 0x20c]
push eax
mov dword [esi], eax
call fcn.00401160
pop ecx
lea ecx, [ebp - 0x23c]
mov dword [esi + 4], eax
call fcn.004021a0
mov ecx, eax
call fcn.00402bd0
lea ecx, [ebp - 0x23c]
call fcn.00402220
test bl, bl
je 0x434b73
lea eax, [ebp - 0x224]
push eax
call fcn.0041e640
pop ecx
test al, al
jne 0x434b73
push 0x4f
push str.broupdater::GetUserIdFilePath
push 1
lea ecx, [ebp - 0x29c]
call fcn.004338f7
lea ecx, [ebp - 0x224]
push ecx
push str.Cant_create_directory:
lea ecx, [eax + 8]
call fcn.0041fc9c
mov ecx, eax
call fcn.0041fc44
lea ecx, [ebp - 0x29c]
call fcn.004339b2
mov ecx, edi
call fcn.00402150
jmp 0x434b94
movzx eax, bl
push eax
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x434a72
push 0x48
push str.broupdater::GetUserIdFilePath
push 1
lea ecx, [ebp - 0x29c]
call fcn.004338f7
push str.Cant_get_path_to_AppData_folder
lea ecx, [eax + 8]
call fcn.0041fc9c
lea ecx, [ebp - 0x29c]
call fcn.004339b2
mov ecx, edi
call fcn.00402150
jmp 0x434b9f
push ecx
push ecx
mov esi, esp
mov eax, 0x461684
push eax
mov dword [esi], eax
call fcn.00401160
pop ecx
push edi
lea ecx, [ebp - 0x224]
mov dword [esi + 4], eax
call fcn.00402bd0
lea ecx, [ebp - 0x224]
call fcn.00402220
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a597
mov esp, ebp
pop ebp
ret

Function at 0x434bb2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x114
lea eax, [ebp - 0x178]
push esi
push 0
push eax
call fcn.0043d870
add esp, 0xc
mov dword [ebp - 0x178], esi
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
pop esi
test eax, eax
jne 0x434c1f
push 0x2b
push str.broupdater::_anonymous_namespace::IsVistaOrGreater
push 1
lea ecx, [ebp - 0x64]
call fcn.004338f7
push str.Cant_get_Windows_version_info
lea ecx, [eax + 8]
call fcn.0041fc9c
lea ecx, [ebp - 0x64]
call fcn.004339b2
xor al, al
jmp 0x434c29
cmp dword [ebp - 0x174], 6
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a597
mov esp, ebp
pop ebp
ret

Function at 0x4369be
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x1505
jmp 0x4369d1
imul eax, eax, 0x21
add eax, edx
inc ecx
movsx edx, byte [ecx]
test edx, edx
jne 0x4369cb
pop ebp
ret
Function at 0x4375a4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0x10]
xor eax, eax
push dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4375e1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040e5c0
lea ecx, [ebp - 0xc]
call fcn.00409bd0
jmp 0x437638
push edi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x437623
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x437623
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x437623
push edi
lea ecx, [ebp - 0xc]
call fcn.00437b47
push edi
push esi
push dword [ebp - 0xc]
call fcn.0043d2c0
add esp, 0xc
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040e5c0
lea ecx, [ebp - 0xc]
call fcn.00409bd0
pop edi
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4387d0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x47426c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [ecx + 4]
push esi
xor ebx, ebx
push ebx
push ebx
push 0x8004
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x43885e
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00433b58
pop ecx
pop ecx
push eax
push 0x35
push str.SignatureVerifier::HashData
push 1
lea ecx, [ebp - 0x94]
call fcn.0043386f
mov esi, eax
call edi
push eax
push str.Failed_to_initialize_hash_object__error:
lea ecx, [esi + 8]
call fcn.0041fc9c
mov ecx, eax
call fcn.004209c2
lea ecx, [ebp - 0x94]
call fcn.00433958
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.00404a00
xor al, al
jmp 0x4388a6
push ebx
push dword [ebp + 0xc]
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4388a4
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00433b58
pop ecx
pop ecx
push eax
push 0x3a
push str.SignatureVerifier::HashData
push 1
lea ecx, [ebp - 0x94]
call fcn.0043386f
mov esi, eax
call edi
push eax
push str.Failed_to_hash_data__error:
jmp 0x438835
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a597
mov esp, ebp
pop ebp
ret 8
Function at 0x451674
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004514f1