joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421f50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x421ff6
cmp dword [esi + 4], 0xffffffff
jne 0x421ff6
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421f82
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x421fb9
cmp eax, 0x2f
je 0x421fb9
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x421fa6
mov eax, dword [0x61f000]
mov dword [edi], eax
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00420bd0
add esp, 8
pop edi
test eax, eax
jne 0x421fd8
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
call fcn.00421020
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
pop esi
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x422650
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x422682
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x422682
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x42276c
push edi
mov edi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x42269f
cmp ax, 0x5c
jne 0x4226a1
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x422693
cmp edi, ebx
je 0x4226ea
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call fcn.0056cee0
add esp, 0xc
cmp edi, 0x208
jae 0x42277c
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, esi
mov word [ebp + edi - 0x414], ax
call fcn.00422650
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x422710
lea ecx, [ebp - 0x20c]
sub ecx, esi
nop
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x422700
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x422712
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x422730
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x42276c
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004387fb
mov esp, ebp
pop ebp
ret
call fcn.00438e5e
int3
Function at 0x423250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x414]
mov dword [ebp - 0x41c], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x418], esi
call fcn.0056ebe0
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0056ebe0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [ebp - 0x20c], ax
jne 0x4232ed
xor ecx, ecx
jmp 0x423305
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4232f6
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401d10
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004387fb
mov esp, ebp
pop ebp
ret

Function at 0x423330
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x595216
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x18]
movq qword [ebp - 0x18], xmm0
call fcn.00423090
cmp dword [ebp + 0x34], 8
lea ecx, [ebp + 0x20]
push 0
cmovae ecx, dword [ebp + 0x20]
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push ecx
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
mov byte [ebp - 4], 2
mov eax, dword [0x62e338]
test eax, eax
je 0x4233a4
push dword [ebp - 0x18]
call eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x4233c2
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00402170
xor eax, eax
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
mov eax, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
cmp eax, 8
jb 0x4233eb
inc eax
lea ecx, [ebp + 0x20]
push eax
push dword [ebp + 0x20]
call fcn.00402170
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret
Function at 0x423fe0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x424025
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 1
push eax
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x214]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop esi
sete al
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret
Function at 0x424090
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5953a6
mov eax, dword fs:[0]
push eax
sub esp, 0x850
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x844], 0
push eax
push 0x61c2f4
lea ecx, [ebp - 0x840]
mov dword [ebp - 0x82c], 7
mov dword [ebp - 0x830], 0
mov word [ebp - 0x840], ax
call fcn.00401d10
xor eax, eax
mov dword [ebp - 4], 0
push eax
push 0x61c2f4
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
call fcn.00401d10
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 1
push eax
mov edx, str.LenovoInstallPath
mov ecx, str.SOFTWARELenovopcmanager
call fcn.0041b910
add esp, 4
test eax, eax
jne 0x424187
push str.ludp.dll
lea edx, [ebp - 0x828]
lea ecx, [ebp - 0x85c]
call fcn.0041e580
add esp, 4
mov dword [ebp - 0x844], 1
cmp dword [eax + 0x14], 8
jb 0x424178
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x424187
mov bl, 1
jmp 0x424189
xor bl, bl
test byte [ebp - 0x844], 1
je 0x4241b0
mov eax, dword [ebp - 0x848]
cmp eax, 8
jb 0x4241b0
inc eax
lea ecx, [ebp - 0x85c]
push eax
push dword [ebp - 0x85c]
call fcn.00402170
test bl, bl
je 0x4241d5
lea eax, [ebp - 0x828]
cmp esi, eax
je 0x424286
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.004022a0
mov bl, 1
jmp 0x42428c
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.0056ebe0
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x42428a
cmp word [ebp - 0x810], 0
jne 0x424215
xor ecx, ecx
jmp 0x42422f
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424220
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x840]
call fcn.00401d10
push 0x14
push ecx
push str.ModulesSLBAgent.exe
lea ecx, [ebp - 0x840]
call fcn.0042c1f0
cmp eax, 0xffffffff
je 0x42428a
push eax
push 0
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x840]
call fcn.0042ab00
push eax
lea ecx, [ebp - 0x840]
call fcn.0042ab40
lea ecx, [ebp - 0x85c]
call fcn.00401a90
mov bl, 1
jmp 0x42428c
xor bl, bl
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x4242aa
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.00402170
mov ecx, dword [ebp - 0x82c]
xor eax, eax
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
cmp ecx, 8
jb 0x4242e5
inc ecx
push ecx
push dword [ebp - 0x840]
lea ecx, [ebp - 0x840]
call fcn.00402170
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret
Function at 0x424310
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5953f2
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x428], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x42c], esi
mov dword [esi + 0x10], 0
jb 0x42437a
mov eax, dword [esi]
jmp 0x42437c
mov eax, esi
xor ecx, ecx
mov word [eax], cx
push 0x208
push ecx
lea eax, [ebp - 0x420]
mov dword [ebp - 4], ecx
push eax
mov dword [ebp - 0x428], 1
call fcn.0056ebe0
add esp, 0xc
mov dword [ebp - 0x424], 0
lea eax, [ebp - 0x424]
push eax
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [ebp - 0x424]
test eax, eax
je 0x42443e
lea ecx, [ebp - 0x420]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x42443e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056ebe0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp word [ebp - 0x218], 0
jne 0x424417
xor ecx, ecx
jmp 0x42442f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424420
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00401d10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret
Function at 0x424460
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5953f2
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x428], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x42c], esi
mov dword [esi + 0x10], 0
jb 0x4244ca
mov eax, dword [esi]
jmp 0x4244cc
mov eax, esi
xor ecx, ecx
mov word [eax], cx
push 0x208
push ecx
lea eax, [ebp - 0x420]
mov dword [ebp - 4], ecx
push eax
mov dword [ebp - 0x428], 1
call fcn.0056ebe0
add esp, 0xc
mov dword [ebp - 0x424], 0
lea eax, [ebp - 0x424]
push eax
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [ebp - 0x424]
test eax, eax
je 0x42458e
lea ecx, [ebp - 0x420]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x42458e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056ebe0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp word [ebp - 0x218], 0
jne 0x424567
xor ecx, ecx
jmp 0x42457f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424570
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00401d10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret
Function at 0x424e70
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5954e0
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str..
lea edx, [ebp + 8]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x294]
call fcn.0041e580
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x424ec3
mov eax, dword [eax]
lea ecx, [ebp - 0x278]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x280]
mov esi, eax
mov dword [ebp - 0x27c], esi
cmp ecx, 8
jb 0x424ef7
inc ecx
push ecx
push dword [ebp - 0x294]
lea ecx, [ebp - 0x294]
call fcn.00402170
xor eax, eax
mov dword [ebp - 0x280], 7
mov dword [ebp - 0x284], 0
mov word [ebp - 0x294], ax
cmp esi, 0xffffffff
je 0x425006
nop dword [eax]
test byte [ebp - 0x278], 0x10
jne 0x424ff0
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebp - 0x24c], ax
je 0x424f62
lea eax, [ebp - 0x24c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424f53
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00401d10
push 0x61f6d8
lea ecx, [ebp - 0x28]
call fcn.004029c0
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
test eax, eax
je 0x424fde
push 0x61fa20
lea ecx, [ebp - 0x28]
call fcn.004029c0
test eax, eax
je 0x424fde
cmp dword [ebp + 0x34], 8
lea ecx, [ebp + 0x20]
lea edx, [ebp - 0x28]
cmovae ecx, dword [ebp + 0x20]
cmp edi, 8
cmovae edx, ebx
mov ebx, dword [ebp + 0x30]
cmp dword [ebp - 0x18], ebx
mov esi, ebx
cmovb esi, dword [ebp - 0x18]
test esi, esi
jne 0x425070
xor eax, eax
test eax, eax
jne 0x424fd5
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jb 0x424fd5
jbe 0x425097
mov ebx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x27c]
cmp edi, 8
jb 0x424ff0
lea eax, [edi + 1]
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.00402170
lea eax, [ebp - 0x278]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x424f20
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor bl, bl
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x425024
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00402170
mov ecx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x1c], 7
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
cmp ecx, 8
jb 0x42504d
inc ecx
push ecx
push dword [ebp + 0x20]
lea ecx, [ebp + 0x20]
call fcn.00402170
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret
mov ax, word [edx]
cmp ax, word [ecx]
jne 0x425086
add edx, 2
add ecx, 2
sub esi, 1
jmp 0x424fbc
movzx eax, word [edx]
cmp ax, word [ecx]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x424fc4
cmp edi, 8
jb 0x4250ab
lea eax, [edi + 1]
push eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00402170
mov bl, 1
jmp 0x42500f
Function at 0x425ef0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x425f22
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x425f22
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x425fe3
push esi
mov esi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x425f3f
cmp ax, 0x5c
jne 0x425f41
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x425f33
cmp esi, ebx
je 0x425f8a
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call fcn.0056cee0
add esp, 0xc
cmp esi, 0x208
jae 0x425ff3
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, edi
mov word [ebp + esi - 0x414], ax
call fcn.00425ef0
xor eax, eax
mov word [ebp - 0x20c], ax
pop esi
test edi, edi
je 0x425fad
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00574a31
add esp, 0xc
push ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.005733ba
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x425fe3
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004387fb
mov esp, ebp
pop ebp
ret
call fcn.00438e5e
int3
Function at 0x4282c0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x595a56
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x22
xor eax, eax
mov dword [ebp - 0x5c], 7
push str.C:ProgramDataLenovoSLBrowser_G_
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], 0
mov word [ebp - 0x70], ax
call fcn.00401d10
push esi
lea edx, [ebp - 0x70]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.0042e9b0
push str.Installer_setup.exe
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.0040f900
add esp, 8
mov eax, dword [ebp - 0x8c]
cmp eax, 8
jb 0x42835b
inc eax
lea ecx, [ebp - 0xa0]
push eax
push dword [ebp - 0xa0]
call fcn.00402170
xor eax, eax
mov dword [ebp - 0x8c], 7
mov dword [ebp - 0x90], 0
mov word [ebp - 0xa0], ax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x5c]
cmp eax, 8
jb 0x428391
inc eax
lea ecx, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
call fcn.00402170
xor eax, eax
mov dword [ebp - 0x5c], 7
cmp dword [ebp - 0x2c], 8
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
mov dword [ebp - 0x60], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4284df
push 0x22
xor eax, eax
mov dword [ebp - 0x74], 7
push str.C:ProgramDataLenovoSLBrowser_G_
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x78], 0
mov word [ebp - 0x88], ax
call fcn.00401d10
push 0x61efe4
lea edx, [ebp - 0x88]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x58]
call fcn.0040f900
add esp, 4
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x74]
cmp eax, 8
jb 0x428421
inc eax
lea ecx, [ebp - 0x88]
push eax
push dword [ebp - 0x88]
call fcn.00402170
xor eax, eax
mov dword [ebp - 0x74], 7
push 0x1b
push str.__register_chrome_browser_
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x78], 0
mov word [ebp - 0x88], ax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
call fcn.00401d10
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x28]
call fcn.0040e800
push 0x25
push str.____register_chrome_browser_suffix__
lea ecx, [ebp - 0x28]
call fcn.0040e6d0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push 1
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push 0
cmovae eax, dword [ebp - 0x40]
push ecx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4284b6
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00402170
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x4284df
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00402170
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4284f4
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00402170
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret
Function at 0x428790
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x595b1f
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x30], ecx
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov edx, str.InstallDir
lea eax, [ebp - 0x28]
mov ecx, str.SOFTWARELenovoSLBrowser_
push eax
call fcn.0041b910
add esp, 4
test eax, eax
jne 0x42897e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x428853
push 0x61f000
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x64]
call fcn.0041e580
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
push 0x61efe4
mov edx, eax
mov dword [ebp - 0x4c], 1
call fcn.0040f900
add esp, 8
mov ebx, 3
cmp dword [eax + 0x14], 8
jb 0x428848
mov eax, dword [eax]
push eax
call edi
mov byte [ebp - 0x29], 1
test eax, eax
jne 0x428857
mov byte [ebp - 0x29], 0
test bl, 2
je 0x428888
mov eax, dword [ebp - 0x34]
and ebx, 0xfffffffd
cmp eax, 8
jb 0x428874
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.00402170
xor eax, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0
test bl, 1
je 0x4288a9
mov eax, dword [ebp - 0x50]
cmp eax, 8
jb 0x4288a9
inc eax
lea ecx, [ebp - 0x64]
push eax
push dword [ebp - 0x64]
call fcn.00402170
cmp byte [ebp - 0x29], 0
je 0x42897e
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
cmp eax, ecx
je 0x4288c9
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.004022a0
push 0x61f000
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x64]
call fcn.0041e580
sub esp, 0x14
mov byte [ebp - 4], 2
mov ecx, esp
mov edx, eax
push 0x61efe4
call fcn.0040f900
add esp, 4
lea ecx, [ebp - 0x48]
call fcn.00423bf0
add esp, 0x18
mov edi, eax
cmp esi, edi
je 0x42893c
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x428915
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402170
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x42892d
mov eax, dword [esi]
jmp 0x42892f
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push edi
call fcn.00407c50
mov eax, dword [ebp - 0x34]
cmp eax, 8
jb 0x428951
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.00402170
xor eax, eax
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], 0
cmp eax, 8
jb 0x42897a
inc eax
lea ecx, [ebp - 0x64]
push eax
push dword [ebp - 0x64]
call fcn.00402170
mov bl, 1
jmp 0x428980
xor bl, bl
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x428995
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00402170
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret