joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4327f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59af50
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x10]
lea eax, [esi + 0x10]
mov dword [ebp - 0x3c], eax
test ecx, ecx
je 0x43296e
mov edi, dword [esi + 0x14]
mov edx, esi
cmp edi, 8
jb 0x43283b
mov edx, dword [esi]
test ecx, ecx
je 0x43296e
mov eax, edx
cmp word [eax], 0x25
je 0x432858
add eax, 2
sub ecx, 1
jne 0x432845
jmp 0x43296e
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x43296e
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 4], 0
mov word [ebp - 0x28], ax
mov eax, esi
mov dword [ebp - 0x18], 0
cmp edi, 8
jb 0x432889
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test edi, edi
je 0x43294f
lea eax, [ebp - 0x35]
mov dword [ebp - 0x2c], 0
push eax
xorps xmm0, xmm0
lea ebx, [edi + 1]
push ebx
lea ecx, [ebp - 0x34]
movq qword [ebp - 0x34], xmm0
call fcn.00443b40
cmp dword [esi + 0x14], 8
mov eax, esi
mov byte [ebp - 4], 1
jb 0x4328cb
mov eax, dword [esi]
push ebx
mov ebx, dword [ebp - 0x34]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x432947
cmp eax, edi
ja 0x432947
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040bef0
lea ecx, [ebp - 0x34]
call fcn.0040bf20
cmp dword [esi + 0x14], 8
jb 0x4328f8
mov esi, dword [esi]
mov edx, dword [ebp - 0x14]
lea edi, [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
cmp edx, 8
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmovae edi, ebx
cmp ecx, dword [eax]
jne 0x43292a
test ecx, ecx
je 0x432955
sub edi, esi
mov ax, word [edi + esi]
cmp ax, word [esi]
jne 0x43292a
add esi, 2
sub ecx, 1
jne 0x432917
jmp 0x432955
mov dword [ebp - 4], 2
cmp edx, 8
jb 0x432943
lea eax, [edx + 1]
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040a5e0
mov al, 1
jmp 0x432970
lea ecx, [ebp - 0x34]
call fcn.0040bf20
mov ebx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], 3
cmp edx, 8
jb 0x43296e
lea eax, [edx + 1]
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040a5e0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret
Function at 0x4428b0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59cca0
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
cmp byte [ecx + 0x38], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
jne 0x4428f3
mov eax, 0x3f0
jmp 0x442a72
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 2
push dword [ecx + 0x30]
call fcn.004427b0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x442937
mov eax, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], esi
test eax, eax
je 0x442930
push eax
call fcn.0041e935
add esp, 4
xor edx, edx
mov dword [ebp - 0x1c], edx
jmp 0x44294c
mov esi, dword [ebp - 0x14]
mov edx, esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 1
test edx, edx
je 0x442a63
xor ecx, ecx
mov dword [ebp - 0x20], ecx
cmp dword [edx], ecx
jbe 0x442a61
mov esi, dword [ebp - 0x24]
lea edi, [edx + 4]
nop
test dword [edi + 4], 0xc0000020
jne 0x442a4f
xor al, al
mov byte [ebp - 0x15], al
test esi, esi
je 0x4429f4
xor ecx, ecx
mov eax, 0x78787879
mov dword [ebp - 0x28], ecx
mov ecx, dword [esi + 4]
sub ecx, dword [esi]
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4429eb
xor eax, eax
mov dword [ebp - 0x2c], eax
mov ecx, dword [esi]
push dword [edi]
add ecx, eax
call fcn.004090f0
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x442a38
mov ecx, dword [ebp - 0x24]
inc dword [ebp - 0x28]
add dword [ebp - 0x2c], 0x44
mov esi, dword [ebp - 0x24]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
jb 0x4429a8
mov al, byte [ebp - 0x15]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
test al, al
jne 0x442a4f
push dword [edi]
lea ecx, [ebp - 0x7c]
call fcn.00412d40
mov edx, dword [ebp - 0x38]
mov ecx, dword [edx + 0x1c]
cmp ecx, dword [edx + 0x20]
je 0x442a3c
movups xmm0, xmmword [ebp - 0x7c]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [ebp - 0x6c]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [ebp - 0x5c]
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [ebp - 0x4c]
movups xmmword [ecx + 0x30], xmm0
mov eax, dword [ebp - 0x3c]
mov dword [ecx + 0x40], eax
add dword [edx + 0x1c], 0x44
jmp 0x442a49
mov al, 1
jmp 0x4429ee
lea eax, [ebp - 0x7c]
push eax
push ecx
lea ecx, [edx + 0x18]
call fcn.00442400
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
inc ecx
add edi, 8
mov dword [ebp - 0x20], ecx
cmp ecx, dword [edx]
jb 0x442970
mov esi, dword [ebp - 0x30]
xor edi, edi
test esi, esi
je 0x442a70
push esi
call fcn.0041e935
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret 4
Function at 0x445c20
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x1c], eax
xor bl, bl
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x15], bl
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
test eax, eax
je 0x445d5b
mov dword [eax], 0
test edi, edi
je 0x445d5b
push 2
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
push edi
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x445d5b
push esi
mov esi, dword [ebp - 0xc]
add esi, 8
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x445d47
push 2
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x445d40
mov eax, dword [ebp - 0x10]
xor esi, esi
test eax, eax
je 0x445d24
nop word [eax + eax]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x445d21
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x445d21
cmp byte [ecx], 0
mov edi, ecx
jne 0x445cff
mov ecx, dword [ebp - 0x1c]
call fcn.004090f0
push eax
lea eax, [edi + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x445d14
mov ecx, dword [ebp - 0x14]
movzx eax, word [edi + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x445d21
mov eax, dword [ebp - 0x10]
inc esi
mov edi, dword [ebp - 0x20]
cmp esi, eax
jb 0x445cc0
jmp 0x445d24
mov eax, dword [ebp - 0x10]
cmp esi, eax
jne 0x445d40
mov ecx, dword [ebp - 0x24]
mov al, 1
pop esi
pop edi
mov dword [ecx], ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [ebp - 0x15]
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call int.004016cd
mov esp, ebp
pop ebp
ret
Function at 0x445f50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59d338
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov edi, dword [0x634a80]
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [edi + 0x54]
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xffffffff
test bl, bl
jne 0x446094
mov ebx, dword [ebp - 0x2c]
mov ecx, ebx
call fcn.004460c0
mov ecx, ebx
call fcn.00448960
mov ecx, ebx
call fcn.00448c00
cmp byte [ebx + 4], 0
jne 0x445fde
push 0x17
mov ecx, ebx
call fcn.00449730
push 0x18
mov ecx, ebx
call fcn.00449730
push 0x4265a0
push 0x635318
call fcn.00426240
add esp, 8
test al, al
je 0x446086
lea eax, [ebp - 0x28]
push str.Acrobatplug_ins_test_toolsAcroNGLToolsqe_ngl_tool.exe
push eax
call fcn.00448260
add esp, 8
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
je 0x44604f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44604f
mov edi, dword [ebx]
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae ecx, dword [ebp - 0x28]
mov eax, dword [edi]
push ecx
push 5
push 2
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x5b1854]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 2
cmp eax, 8
jb 0x44606b
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0040a5e0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
mov ecx, ebx
call fcn.00449e30
mov ecx, ebx
call fcn.0044b430
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret
Function at 0x4470b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [esi + 0x10], 0
jne 0x4470e4
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret 8
push ebx
xor bl, bl
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4470f1
mov eax, dword [esi]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x447110
cmp eax, 0x50
je 0x447110
cmp eax, 0xb7
jne 0x4471ad
cmp dword [esi + 0x14], 8
jb 0x447118
mov esi, dword [esi]
lea ecx, [ebp - 0x210]
mov edx, 0x105
mov eax, ecx
sub esi, eax
nop word [eax + eax]
lea eax, [edx + 0x7ffffef9]
test eax, eax
je 0x44714e
movzx eax, word [esi + ecx]
test ax, ax
je 0x44714e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x447130
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edx, edx
je 0x4471ad
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x4471ad
push 0x5c0e34
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.004471d0
test eax, eax
js 0x4471ad
mov edi, dword [edi]
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x5b1854]
mov ecx, edi
call esi
test eax, eax
sete bl
mov ecx, dword [ebp - 4]
mov al, bl
pop ebx
pop edi
xor ecx, ebp
pop esi
call int.004016cd
mov esp, ebp
pop ebp
ret 8

Function at 0x447330
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
mov edi, dword [ebp + 0x10]
xor bl, bl
push 0x20a
push 0
push eax
mov dword [ebp - 0x214], esi
call fcn.0056aed0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4473d6
cmp word [ebp - 0x210], 0
je 0x4473d6
test edi, edi
je 0x4473a4
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x4473d6
cmp byte [ebp + 0x14], bl
je 0x4473d4
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x4473d6
push 0x5c0e34
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.004471d0
test eax, eax
js 0x4473d6
mov bl, 1
test bl, bl
mov dword [esi + 0x10], 0
mov eax, 0x5b6ea8
mov dword [esi + 0x14], 7
lea edx, [ebp - 0x210]
cmove edx, eax
xor eax, eax
mov ecx, edx
mov word [esi], ax
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x447400
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00409db0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call int.004016cd
mov esp, ebp
pop ebp
ret
Function at 0x44c840
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
or eax, 0x20019
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push edi
push eax
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44c89a
push eax
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x44c8a2
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi], 0
jmp 0x44c8d8
mov ecx, dword [ebp - 8]
mov edx, dword [edi]
dec ecx
mov dword [edi + 4], ecx
test edx, edx
je 0x44c8d8
test ecx, ecx
js 0x44c8d8
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [edi + 8]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x44c8de
xor eax, eax
mov word [edi + 8], ax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call int.004016cd
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4544f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor ecx, ecx
mov esi, 0x633d38
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x454546
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x454532
push str.advapi32.dll
call fcn.004396f0
add esp, 4
test eax, eax
je 0x454546
push 0x5c0668
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [esi], ecx
mov dword [ebp - 8], 0
xor ecx, ecx
xor eax, eax
lock cmpxchg dword [esi], ecx
mov esi, eax
test esi, esi
je 0x454581
push 4
lea eax, [ebp - 8]
mov ecx, esi
push eax
call dword [0x5b1854]
call esi
test al, al
je 0x454581
mov eax, dword [ebp - 8]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
call fcn.00576ed8
add esp, 4
test eax, eax
jne 0x4545aa
mov eax, dword [ebp - 0xc]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00576ec6
add esp, 4
call fcn.00576ea5
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call int.004016cd
mov esp, ebp
pop ebp
ret
Function at 0x458720
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
push edi
mov edi, ecx
jne 0x458752
cmp dword [edi + 8], 0
jne 0x458784
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret 4
push 0
push 0x402240
push 1
push str.NtMapViewOfSection
push 0x5c7cbc
call fcn.004554b0
push 1
push 0x405070
push 1
push str.NtUnmapViewOfSection
push 0x5c7cbc
mov ecx, edi
call fcn.004554b0
mov eax, dword [edi]
push ebx
push esi
push 1
mov eax, dword [eax]
push 0x2000
push 0x10000
push 0
push eax
mov dword [ebp - 0x64], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, dword [edi + 8]
mov ebx, 0x10000
shl esi, 6
add esi, 0x50
mov dword [ebp - 0x68], eax
sub ebx, esi
lea eax, [ebp - 8]
push eax
call fcn.004588f0
movzx ecx, word [ebp - 8]
add esp, 4
mov dword [ebp - 8], ecx
cmp ecx, ebx
ja 0x4587b5
mov eax, 0x800
mov ebx, 0x1000
cmp esi, eax
ja 0x4587e8
nop word [eax + eax]
mov ebx, eax
shr eax, 1
cmp eax, esi
jae 0x4587e0
push 0x40
push 0x1000
lea eax, [esi + 0xfff]
neg ebx
and eax, 0xfffff000
and ebx, ecx
push eax
mov eax, ebx
and eax, 0xfffff000
add eax, dword [ebp - 0x68]
push eax
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
and ebx, 0xfff
add eax, ebx
mov dword [ebp - 0x68], eax
jne 0x458838
pop esi
pop ebx
mov eax, 7
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret 4
push 0x518
push 0
push 0x634c70
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x5c], 0x10
call fcn.0056aed0
mov ebx, dword [ebp - 0x68]
lea eax, [ebp - 0x60]
add esp, 0xc
mov ecx, edi
push eax
push esi
push ebx
call fcn.00458910
test eax, eax
jne 0x4588da
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x10
lea eax, [ebp - 0x60]
push eax
push ebx
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4588d5
cmp dword [ebp - 0xc], 0x10
jne 0x4588d5
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x20
push esi
push ebx
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [edi]
push 0
push 0x518
push 0x634c70
push str.g_originals
call fcn.004545d0
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret 4
mov eax, 0x2a
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
pop edi
call int.004016cd
mov esp, ebp
pop ebp
ret 4
Function at 0x4591d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e7a2
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x68]
mov ebx, dword [ebp + 0xc]
push 0
push str.D:BTImportsOpenChromeChrome_src_base_file_version_info_win.cc
mov dword [ebp - 0x20], esi
push eax
mov dword [ebp - 0x50], ebx
call fcn.004593e0
add esp, 8
lea ecx, [ebp - 0x4c]
push eax
call fcn.00459410
cmp dword [ebx + 0x14], 8
mov dword [ebp - 4], 0
jb 0x459235
mov ebx, dword [ebx]
mov dword [ebp - 0x50], ebx
lea eax, [ebp - 0x20]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x45924c
mov dword [esi], eax
jmp 0x4593a9
mov dword [ebp - 0x14], 0
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
cmp edi, 0x7fffffff
ja 0x4593cf
cmp edi, 0x1000
jb 0x4592ae
lea eax, [edi + 0x23]
cmp eax, edi
jbe 0x4593d4
push eax
lfence
call fcn.00406b5e
add esp, 4
test eax, eax
je 0x4593d9
lea ebx, [eax + 0x23]
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
jmp 0x4592bc
push edi
lfence
call fcn.00406b5e
add esp, 4
mov ebx, eax
push edi
lea eax, [ebx + edi]
mov dword [ebp - 0x1c], ebx
push 0
push ebx
mov dword [ebp - 0x14], eax
call fcn.0056aed0
lea eax, [ebx + edi]
add esp, 0xc
mov dword [ebp - 0x18], eax
push ebx
push edi
push dword [ebp - 0x20]
mov byte [ebp - 4], 1
push dword [ebp - 0x50]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x4592f7
mov dword [esi], 0
jmp 0x4593a1
lea eax, [ebp - 0x24]
mov dword [ebp - 0x50], 0
push eax
lea eax, [ebp - 0x50]
push eax
push 0x5c0a74
push ebx
call sub.VERSION.dll_VerQueryValueW
neg eax
sbb eax, eax
and eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
je 0x4592ec
push 0x1c
call fcn.00406b5e
mov edi, eax
add esp, 4
mov dword [ebp - 0x58], edi
mov byte [ebp - 4], 2
test edi, edi
je 0x45939d
mov eax, dword [ebp - 0x54]
movzx edx, word [eax + 2]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x14]
mov dword [edi], 0x5c0a48
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x54]
mov dword [edi + 0x10], ebx
push eax
push 0x5c0aa8
push ebx
mov word [edi + 0x14], cx
mov word [edi + 0x16], dx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x24], 0
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x54]
mov dword [edi + 0x18], eax
jmp 0x45939f
xor edi, edi
mov dword [esi], edi
lea ecx, [ebp - 0x1c]
call fcn.00414fa0
lea ecx, [ebp - 0x4c]
call fcn.0045a290
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret
call fcn.0047f6a0
call fcn.0047ea50
call fcn.0056e2db
int3
Function at 0x45bbf0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0056aed0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x101
ja 0x45bc54
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x45bc54
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret
Function at 0x463400
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x418], esi
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6359c4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x635324]
cmp eax, dword [ecx + 4]
jg 0x46352a
cmp byte [0x635320], 0
jne 0x46350d
lea eax, [ebp - 0x420]
mov byte [0x635320], 1
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAeDebug
push 0x80000002
mov dword [ebp - 0x420], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46350d
push 0x410
push eax
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x414]
push eax
call fcn.0056aed0
add esp, 0xc
mov dword [ebp - 0x41c], 0x410
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push str.Debugger
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x463501
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4634e0
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
mov ecx, 0x62c700
call fcn.00409db0
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x62c700
mov ecx, esi
call fcn.0040b170
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call int.004016cd
mov esp, ebp
pop ebp
ret
push 0x635324
call fcn.0040b37e
add esp, 4
cmp dword [0x635324], 0xffffffff
jne 0x46343d
push 0x5af790
call fcn.004060ec
push 0x635324
call fcn.0040b56b
add esp, 8
jmp 0x46343d