joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d04a
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x44
mov eax, 0x447655
call fcn.00442101
mov eax, dword fs:[0x2c]
mov ecx, dword [0x462250]
mov esi, dword [ebp + 8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x462168]
cmp eax, dword [ecx + 4]
jg 0x43d092
push 0
push dword [ebp + 0xc]
push esi
push dword [0x462164]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x43d0cd
call fcn.004420bf
ret 8
mov edi, 0x462168
push edi
call fcn.00442047
cmp dword [0x462168], 0xffffffff
pop ecx
jne 0x43d075
and dword [ebp - 4], 0
mov ecx, 0x462164
call fcn.0043ce90
push 0x447c54
call fcn.00441d34
or dword [ebp - 4], 0xffffffff
push edi
call fcn.00441ff6
pop ecx
pop ecx
jmp 0x43d075
push eax
call fcn.0043d10a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x44d358
lea ecx, [ebp - 0x28]
call fcn.004079e0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x50]
call fcn.0043cf3b
push 0x458844
lea eax, [ebp - 0x50]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x43dea1
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x10]
xor ecx, ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0xc], ecx
cmp edi, 4
jb 0x43df01
push ebp
mov ebp, edi
shr ebp, 2
push 4
lea eax, [esp + 0x18]
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
push 4
lea eax, [esp + 0x34]
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x3c]
add esp, 0x18
xor eax, dword [esp + 0x14]
add ebx, 4
mov ecx, dword [esp + 0x10]
add esi, 4
or ecx, eax
sub edi, 4
mov dword [esp + 0x10], ecx
sub ebp, 1
jne 0x43dec3
pop ebp
mov edx, ecx
mov eax, ecx
shr edx, 8
or edx, ecx
shr eax, 0x10
and edx, 0xff00
or edx, eax
movzx eax, cl
shr edx, 8
or edx, eax
test edi, edi
je 0x43df34
sub ebx, esi
movzx ecx, byte [ebx + esi]
movzx eax, byte [esi]
xor ecx, eax
or edx, ecx
inc esi
sub edi, 1
jne 0x43df23
pop edi
test edx, edx
pop esi
sete al
pop ebx
pop ecx
pop ecx
ret

Function at 0x43df3f
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x43dfca
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x28]
cmp edi, 4
jb 0x43dfb1
mov eax, edi
shr eax, 2
mov dword [esp + 0x2c], eax
push 4
lea eax, [esp + 0x18]
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
push 4
lea eax, [esp + 0x20]
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x28]
xor eax, dword [esp + 0x2c]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
push 4
push eax
push ebp
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x24
add ebp, 4
add ebx, 4
add esi, 4
sub edi, 4
sub dword [esp + 0x2c], 1
jne 0x43df68
test edi, edi
je 0x43dfc7
sub ebx, esi
sub ebp, esi
mov al, byte [ebx + esi]
xor al, byte [esi]
mov byte [esi + ebp], al
inc esi
sub edi, 1
jne 0x43dfb9
pop esi
pop ebp
pop ebx
pop edi
add esp, 0xc
ret
Function at 0x43dfcf
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43e047
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
cmp edi, 4
jb 0x43e034
push ebp
mov ebp, edi
shr ebp, 2
push 4
lea eax, [esp + 0x14]
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
push 4
lea eax, [esp + 0x34]
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x3c]
xor eax, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x24
add esi, 4
add ebx, 4
sub edi, 4
sub ebp, 1
jne 0x43dfef
pop ebp
test edi, edi
je 0x43e045
sub ebx, esi
mov al, byte [ebx + esi]
xor byte [esi], al
inc esi
sub edi, 1
jne 0x43e03a
pop esi
pop ebx
pop edi
pop ecx
pop ecx
ret

Function at 0x44135c
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
mov edx, dword [esp + 4]
add eax, eax
push 4
lea ecx, [ecx*4 - 4]
movups xmm0, xmmword [edx + eax*8]
movups xmm1, xmmword [edx]
movups xmmword [edx], xmm0
movups xmmword [edx + eax*8], xmm1
pop eax
cmp ecx, eax
jbe 0x4413a2
aesimc xmm0, xmmword [edx + ecx*4]
aesimc xmm1, xmmword [edx + eax*4]
movups xmmword [edx + eax*4], xmm0
add eax, 4
movups xmmword [edx + ecx*4], xmm1
sub ecx, 4
cmp eax, ecx
jb 0x441384
aesimc xmm0, xmmword [edx + eax*4]
movups xmmword [edx + eax*4], xmm0
ret
Function at 0x4413ad
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push edi
push eax
push esi
movups xmm0, xmmword [eax + edi - 0x10]
movaps xmmword [esp + 0x2c], xmm0
call sub.VCRUNTIME140.dll_memcpy
movaps xmm1, xmmword [esp + 0x2c]
mov eax, edi
shr eax, 2
add esp, 0xc
mov edx, eax
mov dword [esp + 0x14], eax
aeskeygenassist xmm0, xmm1, 0
shl edx, 2
lea ecx, [eax + 7]
mov dword [esp + 0x18], 0x44e564
shl ecx, 4
add ecx, esi
mov dword [esp + 0x1c], ecx
pextrd ecx, xmm0, 3
xor ecx, dword [esi]
xor ecx, 1
mov dword [edx + esi], ecx
mov eax, dword [esi + 4]
xor eax, ecx
mov dword [edx + esi + 4], eax
mov ecx, dword [esi + 8]
xor ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esi + eax*4 + 8], ecx
mov eax, dword [esi + 0xc]
xor eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + ecx*4 + 0xc], eax
lea eax, [esi + 0x10]
add eax, edx
jmp 0x4414e9
cmp edi, 0x18
jne 0x44145c
mov eax, dword [esi + 0x24]
xor eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor ecx, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
pinsrd xmm1, ecx, 3
jmp 0x4414a1
cmp edi, 0x20
jne 0x44149a
pinsrd xmm1, dword [esi + 0x2c], 3
mov eax, dword [esi + 0x14]
aeskeygenassist xmm0, xmm1, 0
pextrd ecx, xmm0, 2
xor ecx, dword [esi + 0x10]
xor eax, ecx
mov dword [esi + 0x30], ecx
mov ecx, dword [esi + 0x18]
xor ecx, eax
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x1c]
xor eax, ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
pinsrd xmm1, eax, 3
jmp 0x4414a1
pinsrd xmm1, dword [esi + 0x1c], 3
mov eax, dword [esp + 0x18]
add esi, edx
aeskeygenassist xmm0, xmm1, 0
pextrd ecx, xmm0, 3
xor ecx, dword [eax]
add eax, 4
xor ecx, dword [esi]
mov dword [edx + esi], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 4]
xor eax, ecx
mov dword [edx + esi + 4], eax
mov ecx, dword [esi + 8]
xor ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esi + eax*4 + 8], ecx
mov eax, dword [esi + 0xc]
xor eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + ecx*4 + 0xc], eax
lea eax, [edx + 0x10]
add eax, esi
cmp eax, dword [esp + 0x1c]
jne 0x44143e
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x442b56
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x442b95
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x442b95
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x442b95
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x442b95
cmp dword [ecx + 0x74], 0xe
jbe 0x442b95
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x403d6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00402e4c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00402e01
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00402e3c
xchg esi, eax
xchg edi, eax
lahf
mov edx, 0x10468
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
Function at 0x3201402e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x3201403d
pop dword [ebp - 0x40]
mov eax, 0xbad0dcac
sub eax, 0x88cf9c6f
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xb556afae
sub dword [ebp - 0x50], 0x67046a63
mov dword [ebp - 0x4c], 0x7bf5bbe0
sub dword [ebp - 0x4c], 0x49c26f9b
mov dword [ebp - 0x48], 0xe726f530
add dword [ebp - 0x48], 0x65254efe
mov dword [ebp - 0x44], 0xaa56f94e
sub dword [ebp - 0x44], 0xaa56f94e
lea eax, [ebp - 0x50]
push eax
mov eax, 0xa7625718
add eax, 0x8aa2d96c
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x79335dcd
sub dword [ebp - 0x50], 0x4c0f477
mov dword [ebp - 0x4c], 0x8ea16e1c
sub dword [ebp - 0x4c], 0x4d350ca7
mov dword [ebp - 0x48], 0x8548332f
sub dword [ebp - 0x48], 0x21d8c6c3
mov dword [ebp - 0x44], 0xda801510
sub dword [ebp - 0x44], 0xda801510
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x13e430bf
sub eax, 0xe1df0043
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x467d9
push 0
call eax
mov ecx, 0x4431
xor edi, edi
add edi, eax
mov ebx, 0xd977ae30
sub ebx, 0xa7700c30
add ebx, dword [ebp - 0x40]
mov edx, 0x1bd40047
sub edx, 0x4f988ddd
sub dword [ebp - 0x3c], esi
mov esi, dword [ebx]
xor dword [ebp - 4], ebx
add esi, edx
mov dword [edi], esi
add edi, 4
add ebx, 0x234233ac
sub ebx, 0x234233a8
loop 0x3201415b
add eax, 0x2f562df1
add eax, 0xd0aad5a6
mov ebx, eax
add eax, 5
mov ecx, 0xd91eca74
sub ecx, 0xa71eca74
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x41ae1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x41ae2e
pop dword [ebp - 0x14]
mov eax, 0x7756964e
sub eax, 0x7714e820
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3b1a8
push 0
mov eax, 0x188e5f63
add eax, 0xe7b392ad
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xeefe0461
sub ecx, 0xeefdc881
xor edi, edi
add edi, eax
mov ebx, 0x930d4e6f
sub ebx, 0x92c9cc6f
add ebx, dword [ebp - 0x14]
mov edx, 0x4d44874c
sub edx, 0xddc9dec5
sub dword [ebp - 8], ecx
mov esi, dword [ebx]
mov dword [ebp - 0xc], 0x541312ff
add esi, edx
add dword [ebp - 0x10], eax
mov dword [edi], esi
xor dword [ebp - 4], 0x366d20eb
add edi, 0xd886b312
add edi, 0x27794cf2
add ebx, 0xbd0a344b
sub ebx, 0xbd0a3447
loop 0x41ae8f
add eax, 0xac26e989
sub eax, 0xac260736
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb48a345f
add ecx, 0x4bb5cba1
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x402c00
pop dword [ebp - 0x3c]
mov eax, 0x6f996c5
sub eax, 0x6b96ac5
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xe2991bd0
sub dword [ebp - 0x4c], 0x9446d685
mov dword [ebp - 0x48], 0xd10f182f
sub dword [ebp - 0x48], 0x9edbcbea
mov dword [ebp - 0x44], 0xf90eed88
add dword [ebp - 0x44], 0x533d56a6
mov dword [ebp - 0x40], 0x92ccd21c
add dword [ebp - 0x40], 0x6d332de4
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xbc31a0fd
sub dword [ebp - 0x4c], 0x47bf37a7
mov dword [ebp - 0x48], 0x4efb724d
add dword [ebp - 0x48], 0xf270ef28
mov dword [ebp - 0x44], 0x5df798ea
sub dword [ebp - 0x44], 0xfa882c7e
mov dword [ebp - 0x40], 0x8c93c3c5
add dword [ebp - 0x40], 0x736c3c3b
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x96957395
sub eax, 0x9654f2c1
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x389ba
push 0
call eax
mov ecx, 0x448299f1
add ecx, 0xbb7db5bc
xor esi, esi
add esi, eax
mov edi, 0x411000
add edi, dword [ebp - 0x3c]
mov edx, 0x49458084
add edx, 0x920c99c1
xor dword [ebp - 0x30], eax
mov ebx, dword [edi]
sub ebx, edx
add dword [ebp - 0x20], 0x721587fa
mov dword [esi], ebx
add dword [ebp - 0x20], ecx
add esi, 0xd62c0a1
sub esi, 0xd62c09d
add edi, 0x256a3b64
add edi, 0xda95c4a0
loop 0x402d19
add eax, 0xe81007ea
add eax, 0x17f1299d
xor ebx, ebx
add ebx, eax
add eax, 0x642da04d
sub eax, 0x642da048
mov ecx, 0xd60c8fc6
add ecx, 0x2a33703a
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x406b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.00406b49

Function at 0x413260
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x20c
mov eax, dword [0x521014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x525fcc]
test eax, eax
jne 0x413346
lea esi, [ebp - 0x214]
push 0x208
push 0
push esi
call fcn.0048ef90
add esp, 0xc
push 0x104
push esi
push 0x506660
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
jbe 0x4132b8
mov eax, dword [0x525fcc]
jmp 0x4132c8
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x525fcc], eax
test eax, eax
jne 0x413346
mov word [ebp - 0x214], 0
push 0x104
push esi
push str._SYSTEMROOT__system32cabinet.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
jbe 0x4132f5
mov eax, dword [0x525fcc]
jmp 0x413305
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x525fcc], eax
test eax, eax
jne 0x413346
mov word [ebp - 0x214], 0
push 0x104
push esi
push str.C:Windows_system32cabinet.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
jbe 0x413332
mov eax, dword [0x525fcc]
jmp 0x413342
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x525fcc], eax
test eax, eax
je 0x41337d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
call esi
mov dword [0x525fc0], eax
push str.FDIDestroy
push dword [0x525fcc]
call esi
mov dword [0x525fc4], eax
push str.FDICopy
push dword [0x525fcc]
call esi
mov dword [0x525fc8], eax
xor ebx, ebx
cmp dword [0x525fc0], 0
je 0x41339b
cmp dword [0x525fc4], 0
je 0x41339b
cmp dword [0x525fc8], 0
setne bl
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
add esp, 0x20c
pop esi
pop ebx
pop ebp
ret
Function at 0x413f60
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov edi, ecx
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0x68], eax
xor eax, eax
push eax
push eax
push ecx
push 0x4144d0
push eax
push eax
call fcn.00499eb0
add esp, 0x18
mov esi, eax
cmp dword [edi + 0x3c], eax
je 0x413fc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [edi + 0x3c]
inc eax
cmp eax, 2
jae 0x41403e
lea eax, [esi + 1]
cmp eax, 2
jb 0x413fb9
mov dword [edi + 0x3c], esi
call fcn.0046eab0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [edi + 0x3c]
inc esi
cmp esi, 1
jbe 0x413fe4
cmp esi, 2
setae bl
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004b9e70
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0xa8
push str.InitializeThread
push 1
call fcn.004b9c70
lea ecx, [esp + 0x4c]
push 0x5067b6
push str.Failed_to_create_thread_for_async_install_tasks
call fcn.004b5d50
mov ecx, edi
call fcn.004b9cb0
cmp byte [ebx + 0xb], 0
jns 0x413fc9
push dword [esp + 4]
call fcn.0048b376
add esp, 4
jmp 0x413fc9
call fcn.0046eab0
push dword [edi + 0x3c]
call fcn.00471760
add esp, 4
mov dword [edi + 0x3c], 0
jmp 0x413fa9
Function at 0x41a870
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0x68], eax
mov dword [ecx], fcn.00421ac0
cmp dword [ecx + 0xc4], 0
je 0x41a8c0
push dword [esi + 0xc8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xea60
push dword [esi + 0xc4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x41a9d4
cmp byte [esi + 0x137], 0
jns 0x41a8d7
push dword [esi + 0x12c]
call fcn.0048b376
add esp, 4
cmp byte [esi + 0x12b], 0
jns 0x41a8ee
push dword [esi + 0x120]
call fcn.0048b376
add esp, 4
mov ecx, dword [esi + 0x118]
mov dword [esi + 0x118], 0
test ecx, ecx
je 0x41a909
push 1
call fcn.00421af0
cmp byte [esi + 0x113], 0
jns 0x41a920
push dword [esi + 0x108]
call fcn.0048b376
add esp, 4
cmp byte [esi + 0xbf], 0
jns 0x41a937
push dword [esi + 0xb4]
call fcn.0048b376
add esp, 4
cmp byte [esi + 0xb3], 0
jns 0x41a94e
push dword [esi + 0xa8]
call fcn.0048b376
add esp, 4
cmp byte [esi + 0xa7], 0
jns 0x41a965
push dword [esi + 0x9c]
call fcn.0048b376
add esp, 4
cmp byte [esi + 0x9b], 0
jns 0x41a97c
push dword [esi + 0x90]
call fcn.0048b376
add esp, 4
cmp byte [esi + 0x8f], 0
jns 0x41a993
push dword [esi + 0x84]
call fcn.0048b376
add esp, 4
cmp byte [esi + 0x83], 0
jns 0x41a9a7
push dword [esi + 0x78]
call fcn.0048b376
add esp, 4
lea ecx, [esi + 0x64]
call fcn.004d46f0
cmp byte [esi + 8], 0
je 0x41a9c1
lea ecx, [esi + 0xc]
call fcn.00414060
mov byte [esi + 8], 0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0048b980
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004b9e70
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0x1d3
push str.Installer
push 1
call fcn.004b9c70
lea ecx, [esp + 0x4c]
push 0x5074cd
push str.Failed_to_wait_for_install_async_exit._Terminate_install_thread_
call fcn.004b5d50
mov ecx, edi
call fcn.004b9cb0
cmp byte [ebx + 0xb], 0
jns 0x41aa2c
push dword [esp + 4]
call fcn.0048b376
add esp, 4
push 0
push dword [esi + 0xc4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x41a8c0

Function at 0x41aa80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [ecx + 0xc8]
call edi
push dword [esi + 0xcc]
call edi
xor eax, eax
push eax
push eax
push esi
push 0x41aac0
push eax
push eax
call fcn.00499eb0
add esp, 0x18
mov dword [esi + 0xc4], eax
pop esi
pop edi
pop ebp
ret
Function at 0x420c10
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0x70], eax
call fcn.00410430
test al, al
je 0x420c99
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
push 0x5082f0
push str.BROWSER_SETUP_RESOURCE
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x420c99
mov ebx, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor ebx, ebx
test edi, edi
je 0x420c9b
mov esi, eax
test eax, eax
je 0x420c9b
mov eax, dword [ebp + 8]
lea ebx, [esp + 0x6c]
mov dword [ebx], 0xffffffff
push edi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push ebx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebx], esi
jne 0x420cb2
mov bl, 1
jmp 0x420c9b
xor ebx, ebx
mov ecx, dword [esp + 0x70]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 4]
push eax
push edi
call fcn.004b9e70
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push edi
push 0x501
push str.ExtractBrowserSetupResource
push 1
call fcn.004b9c70
lea ecx, [esp + 0x4c]
push 0x507b06
push str.Write_failed._Roll_back_write_operation.
call fcn.004b5d50
mov ecx, esi
call fcn.004b9cb0
cmp byte [edi + 0xb], 0
jns 0x420d0a
push dword [esp + 4]
call fcn.0048b376
add esp, 4
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x420c9b

Function at 0x421230
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov dword [ecx], fcn.004212a0
cmp dword [ecx + 4], 0
je 0x42125a
cmp byte [esi + 0x14], 0
jne 0x421251
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, esi
pop esi
pop ebp
jmp fcn.004212c0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x42126f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x421284
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x421299
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 8], 0
pop esi
pop ebp
ret
Function at 0x4212c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0x68], eax
push 0x7530
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x421355
mov eax, dword [esi + 4]
test eax, eax
je 0x421303
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x421318
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x42132d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x421342
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 8], 0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0048b980
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x15], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.004b9e70
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0x6b8
push str.EnsureProcessFinished
push 1
call fcn.004b9c70
lea ecx, [esp + 0x4c]
push 0x507e7d
push str.The_elevated_installer_hangs_and_must_be_forcibly_terminated.
call fcn.004b5d50
mov ecx, edi
call fcn.004b9cb0
cmp byte [ebx + 0xb], 0
jns 0x4213b1
push dword [esp + 4]
call fcn.0048b376
add esp, 4
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4212ee