joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e9a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [0x64a7e4]
test esi, esi
je 0x41e9e0
mov ecx, esi
push 0x62fc00
call fcn.00530400
test al, al
jne 0x41ea05
mov ecx, esi
push str.vmodule
call fcn.00530400
test al, al
jne 0x41ea05
mov eax, dword [edi]
mov dword [0x6460b4], eax
mov bl, 1
test al, 1
jne 0x41ea95
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x30]
mov ecx, esi
push 7
push str.vmodule
push eax
call fcn.00530520
lea ebx, [ebp - 0x1c]
mov ecx, esi
push 1
push 0x62fc00
push ebx
call fcn.00530520
push 0x10
call fcn.00562bc5
add esp, 4
mov esi, eax
mov ecx, eax
push 0x64a79c
lea eax, [ebp - 0x30]
push eax
push ebx
call fcn.005c6810
cmp byte [ebx + 0xb], 0
jns 0x41ea57
push dword [ebp - 0x1c]
call fcn.00562bc0
add esp, 4
cmp byte [ebp - 0x25], 0
jns 0x41ea68
push dword [ebp - 0x30]
call fcn.00562bc0
add esp, 4
test esi, esi
je 0x41e9e0
xor eax, eax
lock cmpxchg dword [0x64a7a0], esi
je 0x41e9e0
mov ecx, esi
call fcn.005c68e0
push esi
call fcn.00562bc0
add esp, 4
jmp 0x41e9e0
mov eax, dword [0x64a794]
test eax, eax
je 0x41eabf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x64a794], 0
cmp dword [0x64a798], 0
jne 0x41eabf
and byte [0x6460b4], 0xfe
mov eax, dword [edi + 0x18]
test eax, eax
je 0x41eadf
movsx ecx, byte [edi + 0xf]
test ecx, ecx
jns 0x41ead1
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x41eb4a
mov dword [0x64a794], eax
jmp 0x41e9f1
movsx eax, byte [edi + 0xf]
test eax, eax
jns 0x41eaea
mov eax, dword [edi + 8]
test eax, eax
je 0x41eb8b
lea esi, [edi + 4]
mov ecx, dword [0x64a798]
test ecx, ecx
jne 0x41eb1e
push 0xc
call fcn.00562bc5
add esp, 4
mov ecx, eax
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [0x64a798], eax
push esi
call fcn.0052b270
cmp dword [edi + 0x14], 0
jne 0x41eb3e
mov eax, dword [0x64a798]
cmp byte [eax + 0xb], 0
jns 0x41eb37
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0040ca30
mov ebx, eax
jmp 0x41e9f1
lea eax, [ebp - 0x30]
push 0x246
push str.logging.cc
push str.BaseInitLoggingImpl_built_with_NDEBUG
push eax
call fcn.0050b300
add esp, 0x10
lea esi, [ebp - 0x20]
lea eax, [ebp - 0x30]
push eax
push 0x7f
push str.settings.log_file_path.empty__
push esi
call fcn.00590960
add esp, 0x10
mov ecx, esi
call fcn.00590430
mov eax, dword [edi + 0x18]
jmp 0x41ead5
lea ebx, [ebp - 0x30]
push 0x24c
push str.logging.cc
push str.BaseInitLoggingImpl_built_with_NDEBUG
push ebx
call fcn.0050b300
add esp, 0x10
lea esi, [ebp - 0x1c]
push ebx
push 0x7f
push str._settings.log_file_path.empty__
push esi
call fcn.00590960
add esp, 0x10
mov ecx, esi
call fcn.005905e0
push 0x25
push str.LOG_TO_FILE_set_but_no_log_file_path_
push eax
call fcn.00538a30
add esp, 0xc
mov ecx, esi
call fcn.00590430
jmp 0x41eaf2
Function at 0x41f260
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x22c
push str.file_util_win.cc
push str.PathExists
push ebx
call fcn.0050b300
add esp, 0x10
xor eax, eax
mov ecx, esi
push eax
push eax
call fcn.00522210
mov dword [esp + 0x4c], 0xa
mov al, byte [0x649456]
test al, al
jne 0x41f2f9
cmp byte [edi + 0xb], 0
jns 0x41f2ce
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
lea ecx, [esp + 0x10]
call fcn.00540b60
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, al
lea eax, [esp + 0x54]
mov dword [eax], ebx
lea esi, [esp + 0x50]
mov dword [esi], str.ScopedBlockingCall
lea edx, [esp + 0x4c]
push eax
push esi
call fcn.005b5b90
add esp, 8
jmp 0x41f2c6
Function at 0x4207e0
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movaps xmm0, xmmword [0x639b80]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x420810
mov eax, dword [edi]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x110000
call ebx
cmp eax, 0xffffffff
je 0x4208ad
mov esi, eax
lea eax, [ebp - 0xb4]
mov dword [eax], 2
xor edi, edi
push edi
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x4209c4
lea eax, [ebp - 0xb8]
mov dword [eax], edi
push edi
push eax
push 0xc
push dword [ebp + 0x10]
push 0x24
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x4209f8
mov bl, 1
cmp dword [ebp - 0xb8], 0xc
jne 0x420959
push esi
call fcn.0044be70
add esp, 4
test al, al
je 0x4208aa
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x420910
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4208c4
mov eax, dword [edi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
movaps xmm0, xmmword [0x639b80]
jne 0x420806
cmp dword [0x64a79c], 2
jg 0x420952
call fcn.004f27f0
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x71
push str.registration_protocol_win.cc
call fcn.0045af70
lea eax, [ebp - 0xa8]
push 0xd
push str.WaitNamedPipe
jmp 0x420942
cmp dword [0x64a79c], 2
jg 0x420952
call fcn.004f27f0
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x6c
push str.registration_protocol_win.cc
call fcn.0045af70
lea eax, [ebp - 0xa8]
push 0xa
push str.CreateFile
push eax
call fcn.00538a30
add esp, 0xc
mov ecx, esi
call fcn.0044fb10
xor ebx, ebx
jmp 0x420893
cmp dword [0x64a79c], 2
jg 0x420a3d
lea edi, [ebp - 0xb0]
mov ecx, edi
push 2
push 0x8c
push str.registration_protocol_win.cc
call fcn.0040b630
lea eax, [ebp - 0xa8]
push 0x1c
push str.TransactNamedPipe:_expected
push eax
call fcn.00538a30
add esp, 0xc
mov ecx, eax
push 0xc
call fcn.0040cdb0
push 0xb
push str.__observed
push eax
call fcn.00538a30
add esp, 0xc
mov ecx, eax
push dword [ebp - 0xb8]
call fcn.00429600
mov ecx, edi
call fcn.0040ae00
jmp 0x420a3d
cmp dword [0x64a79c], 2
jg 0x420a3d
call fcn.004f27f0
lea edi, [ebp - 0xb0]
mov ecx, edi
push eax
push 2
push 0x7a
push str.registration_protocol_win.cc
call fcn.0045af70
lea eax, [ebp - 0xa8]
push 0x17
push 0x639bf6
jmp 0x420a2d
cmp dword [0x64a79c], 2
jg 0x420a3d
call fcn.004f27f0
lea edi, [ebp - 0xb0]
mov ecx, edi
push eax
push 2
push 0x88
push str.registration_protocol_win.cc
call fcn.0045af70
lea eax, [ebp - 0xa8]
push 0x11
push 0x639c0e
push eax
call fcn.00538a30
add esp, 0xc
mov ecx, edi
call fcn.0044fb10
xor ebx, ebx
jmp 0x420886
Function at 0x423ff0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x6460b0]
cmp eax, 0xffffffff
je 0x4240b1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x4240b1
mov eax, dword [0x64a718]
mov ecx, dword [0x64784c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4240bb
mov edi, dword [0x64a714]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4240ff
mov ecx, dword [0x64970c]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x649710], 0
jne 0x42410b
lea ecx, [ebx + 0x649710]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x64a710]
inc edx
mov dword [0x64a710], edx
mov dword [ecx + 0xc], edx
mov dword [0x64970c], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x4240fc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00412e70
jmp 0x424015
push 0x64a718
call fcn.00562c08
add esp, 4
cmp dword [0x64a718], 0xffffffff
jne 0x424036
push 4
call fcn.00562bc5
add esp, 4
mov dword [eax], 0
mov dword [0x64a714], eax
push 0x64a718
call fcn.00562c57
add esp, 4
jmp 0x424036
int3
mov ecx, edi
call fcn.0050a710
jmp 0x42404b
inc edx
cmp edx, 0x100
jne 0x424054
jmp 0x42409b

Function at 0x424590
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x4245b3
call fcn.00501530
mov dword [esi], 0
test ebx, ebx
je 0x4245e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x424608
cmp edi, 2
jb 0x4245da
mov dword [esi], ebx
call fcn.00501530
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + 4]
mov byte [esi + 4], al
mov byte [ecx + 4], 0
mov eax, dword [ecx]
inc eax
cmp eax, 2
jae 0x42467d
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00501530
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x424641
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e1bc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x4245ce
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6318bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x424687
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x424677
call dword [0x63e1bc]
call ecx
push 0
push eax
call fcn.004292e0
add esp, 8
jmp 0x42461b
push 1
push 0
jmp 0x42466d
call fcn.00555660
jmp 0x4245fc
xor eax, eax
push eax
jmp 0x42466c
Function at 0x4263b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x644040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov esi, 0x7fffffff
cmp eax, 0x7fffffff
cmovb esi, eax
lea edi, [ebp - 0x14]
mov dword [edi], 0xffffffff
push 0
push edi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x426449
mov eax, dword [sym.imp.KERNEL32.dll_GetFileType]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x426416
cmp ebx, 0xffffffff
je 0x426428
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 8]
push ebx
mov ebx, eax
call eax
cmp eax, 3
je 0x42642b
mov ebx, dword [ebp - 0x14]
jmp 0x426402
int3
mov dword [ebp - 0x14], 0xffffffff
push 0
push edi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
test eax, eax
mov eax, ebx
jne 0x4263f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x426402
Function at 0x4294d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x28], edx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x4295dc
mov edi, ecx
xor esi, esi
lea eax, [ebp - 0x14]
mov dword [eax], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov ecx, ebx
mov ebx, eax
call ecx
push 2
push esi
push esi
lea ecx, [ebp - 0x14]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne byte [ebp - 0x15]
je 0x4295e5
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x28]
cmp dword [esi], ebx
je 0x429552
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x429567
lea eax, [ebx + 1]
cmp eax, 2
jb 0x42954b
mov dword [esi], ebx
call fcn.00501530
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov al, byte [ebp - 0x15]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00501530
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x24], eax
je 0x4295a0
mov eax, dword [0x655038]
mov dword [ebp - 0x20], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
call dword [0x63e1bc]
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [ebp - 0x1c]
mov dword [esi], 0
jmp 0x42953c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6318bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4295f2
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x4295d6
call dword [0x63e1bc]
call ecx
push 0
push eax
call fcn.004292e0
add esp, 8
jmp 0x42957a
push 1
push 0
jmp 0x4295cc
mov byte [ebp - 0x15], 1
jmp 0x429552
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x42954b
xor eax, eax
push eax
jmp 0x4295cb
Function at 0x42b850
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x6586f0]
mov ecx, dword [0x64784c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42b93e
push dword [0x6460b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x42b89f
mov ecx, dword [0x6586e8]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x6586ec]
jne 0x42b89f
cmp dword [eax + ecx*8], 0
jne 0x42b910
push 4
call fcn.00562bc5
add esp, 4
mov esi, eax
mov dword [eax], 0
push dword [0x6460b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
and eax, 0xfffffffc
je 0x42b8d9
mov ecx, dword [0x6586e8]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x6586ec]
jne 0x42b8d9
mov edi, dword [eax + ecx*8]
push dword [0x6460b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
jne 0x42b8f3
test esi, esi
je 0x42b90c
call fcn.00412e70
mov ecx, dword [0x6586e8]
mov dword [eax + ecx*8], esi
mov ecx, dword [0x6586ec]
mov edx, dword [0x6586e8]
mov dword [eax + edx*8 + 4], ecx
test edi, edi
jne 0x42b98d
push dword [0x6460b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
xor eax, eax
and ecx, 0xfffffffc
je 0x42b93a
mov edx, dword [0x6586e8]
mov esi, dword [ecx + edx*8 + 4]
cmp esi, dword [0x6586ec]
jne 0x42b93a
mov eax, dword [ecx + edx*8]
pop esi
pop edi
pop ebp
ret
push 0x6586f0
call fcn.00562c08
add esp, 4
cmp dword [0x6586f0], 0xffffffff
jne 0x42b876
mov dword [0x6586ec], 0
mov dword [0x6586e8], 0xffffffff
mov ecx, 0x6586e8
push 0x406b10
call fcn.00423ff0
push 0x6586f0
call fcn.00562c57
add esp, 4
jmp 0x42b876
push edi
call fcn.00562bc0
add esp, 4
jmp 0x42b910
Function at 0x42bcb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x42be5b
cmp dword [esi], 0
jne 0x42be5b
cmp dword [esi + 0xc], 0
jne 0x42be5b
xor eax, eax
cmp dword [esi + 4], 0
jne 0x42be5b
mov ebx, dword [edi]
cmp eax, ebx
je 0x42bd16
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x42bd5f
lea eax, [ebx + 1]
cmp eax, 2
jb 0x42bd0c
mov dword [esi], ebx
call fcn.00501530
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x42bd49
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x42bd9b
lea eax, [ebx + 1]
cmp eax, 2
jb 0x42bd3f
mov dword [esi + 4], ebx
call fcn.00501530
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00501530
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x42bdd9
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e1bc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x42bcfd
call fcn.00501530
mov eax, dword [esi + 4]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x42be1c
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e1bc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi + 4], 0
jmp 0x42bd2f
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6318bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42be79
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x42be16
call dword [0x63e1bc]
call ecx
push 0
push eax
call fcn.004292e0
add esp, 8
jmp 0x42bd72
push 1
push 0
jmp 0x42be09
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6318bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42be7e
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x42be55
call dword [0x63e1bc]
call ecx
push 0
push eax
call fcn.004292e0
add esp, 8
jmp 0x42bdaf
push 1
push 0
jmp 0x42be48
mov ecx, esi
call fcn.00555660
lea ecx, [esi + 4]
call fcn.00555660
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, dword [esi]
jmp 0x42bce7
xor eax, eax
push eax
jmp 0x42be08
xor eax, eax
push eax
jmp 0x42be47
Function at 0x42dcd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x88], eax
mov eax, dword [ecx]
inc eax
cmp eax, 1
ja 0x42ded0
mov esi, ecx
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov edx, dword [esi]
cmp edx, eax
je 0x42dd39
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x42de46
lea eax, [edi + 1]
cmp eax, 2
jb 0x42dd30
mov dword [esi], edi
call fcn.00501530
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esi]
lea eax, [edx + 1]
cmp eax, 1
jbe 0x42deeb
mov dword [esp + 8], esi
mov ecx, dword [ebp + 8]
xorps xmm0, xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x3c], 0xffffffff
test ecx, ecx
mov dword [esp + 4], edx
jne 0x42de1f
mov eax, 0xff
mov edi, 0x408
mov dword [esp + 0x2c], 1
mov ebx, edi
mov esi, eax
mov edx, ebx
mov dword [esp + 0xc], esi
mov ebx, esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x42dedc
or edx, 0x2000
mov dword [esp + 0x20], edx
lea eax, [esp + 0x10]
push 0x70
push eax
push 9
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x42dec2
mov eax, dword [ebp + 0xc]
not eax
and ebx, eax
lea eax, [esp + 0xc]
mov dword [eax], ebx
mov ecx, 4
push ecx
push eax
push ecx
mov eax, dword [esp + 0x14]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov dword [esp], 0
test eax, eax
je 0x42dec2
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.00565ea5
mov eax, dword [esp]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
xor ebx, ebx
dec ecx
cmp ecx, 3
ja case.default.0x42de3f
mov dword [esp], 0xa0
mov esi, 0xc8
mov eax, 0xd8
mov edi, 8
xor edx, edx
jmp dword [ecx*4 + 0x63ae34]
call fcn.00501530
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [esp], eax
je 0x42de86
mov eax, dword [0x655038]
mov dword [esp + 8], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [esp + 4], ecx
call dword [0x63e1bc]
mov ecx, dword [esp + 8]
push dword [esp]
call dword [esp + 8]
mov dword [esi], 0
jmp 0x42dd21
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6318bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42df08
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x42debc
call dword [0x63e1bc]
call ecx
push 0
push eax
call fcn.004292e0
add esp, 8
jmp 0x42de59
push 1
push 0
jmp 0x42deb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
jmp case.0x42de3f.4
mov dword [esp], 0x4df
jmp case.0x42de3f.4
or edx, 0x100
mov dword [esp + 0x70], eax
jmp 0x42ddaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.00565ea5
mov eax, esi
jmp 0x42de15
xor eax, eax
push eax
jmp 0x42deb1
Function at 0x42f580
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [0x644040]
xor esi, ebp
mov dword [ebp - 0x10], esi
mov ecx, dword [ecx]
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
or eax, 8
push esi
push 2
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x42f62f
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x42f62f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esi + 1]
cmp eax, 2
jb 0x42f62b
call fcn.00501530
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebx], 0
mov al, 1
test esi, esi
je 0x42f63b
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
je 0x42f640
call fcn.00501530
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebx], esi
call fcn.00501530
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x18]
mov byte [ebx + 4], al
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
xor esi, esi
jmp 0x42f5d9
mov byte [ebx], 0
mov dword [ebp - 0x18], 0
jmp 0x42f60f
mov dword [ebp - 0x18], eax
jmp 0x42f60f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x42f608
Function at 0x430b60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi], ecx
mov ebx, dword [eax]
mov dword [eax], ecx
lea edi, [ebx + 1]
cmp edi, 2
jb 0x430b83
call fcn.00501530
cmp dword [esi], ebx
je 0x430bad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x430bb9
cmp edi, 2
jb 0x430ba4
mov dword [esi], ebx
call fcn.00501530
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00501530
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x430bf2
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e1bc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x430b98
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6318bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x430c2e
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x430c28
call dword [0x63e1bc]
call ecx
push 0
push eax
call fcn.004292e0
add esp, 8
jmp 0x430bcc
push 1
push 0
jmp 0x430c1e
xor eax, eax
push eax
jmp 0x430c1d