joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4048c0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x804
mov eax, dword [0x511014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [0x514c54]
cmp esi, 0xffffffff
je 0x404955
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x404987
mov ebx, 0x800
lea eax, [ebp - 0x810]
push ebx
push 0
push eax
call fcn.00498980
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.00495b47
add esp, 4
mov edi, eax
push ebx
lea eax, [ebp - 0x810]
push eax
push edi
call fcn.00498400
add esp, 0xc
mov eax, edi
or eax, 3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496ce3
mov eax, edi
add esp, 0x804
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40498a
mov esi, eax
xor eax, eax
dec eax
lock cmpxchg dword [0x514c54], esi
je 0x4048e1
push esi
call fcn.004e58d0
add esp, 4
mov esi, dword [0x514c54]
jmp 0x4048e1
int3
int3

Function at 0x404c70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x514c54]
cmp eax, 0xffffffff
je 0x404d31
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x404d31
mov eax, dword [0x524a18]
mov ecx, dword [0x514f00]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x404d3b
mov edi, dword [0x524a14]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x404d7c
mov ecx, dword [0x523e10]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x523e14], 0
jne 0x404d88
lea eax, [eax*4 + 0x523e14]
mov dword [eax], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x523e18], ecx
mov dword [0x523e10], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x523e1c]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x404d97
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004048c0
jmp 0x404c95
push 0x524a18
call fcn.00494ba0
add esp, 4
cmp dword [0x524a18], 0xffffffff
jne 0x404cb6
push 4
call fcn.00494aa6
add esp, 4
mov dword [eax], 0
mov dword [0x524a14], eax
push 0x524a18
call fcn.00495b95
add esp, 4
jmp 0x404cb6
mov ecx, edi
call fcn.004597a0
jmp 0x404ccb
inc edx
cmp edx, 0x100
jne 0x404cd4
jmp 0x404d1b
int3
Function at 0x40e790
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x511014]
xor eax, ebp
mov dword [esp + 0x18], eax
mov eax, dword [0x524a40]
mov ecx, dword [0x514f00]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40e85d
push dword [0x514c54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
jne 0x40e83f
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x11e1a300
mov esi, esp
push 0x1db
push str....._base_threading_thread_local_storage.cc
push 0x50535a
push esi
call fcn.00454af0
add esp, 4
movsd xmm0, qword [esp + 0x1c]
movsd qword [esp + 4], xmm0
mov dword [esp], esi
call fcn.004be150
add esp, 0xc
xor ecx, ecx
lea eax, [ecx - 1]
test ecx, ecx
mov esi, 2
cmovne esi, eax
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.00496ce3
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
xor ecx, ecx
and eax, 0xfffffffc
je 0x40e81f
mov edx, dword [0x524a38]
mov esi, dword [eax + edx*8 + 4]
cmp esi, dword [0x524a3c]
jne 0x40e81f
mov ecx, dword [eax + edx*8]
jmp 0x40e81f
push 0x524a40
call fcn.00494ba0
add esp, 4
cmp dword [0x524a40], 0xffffffff
jne 0x40e7c6
mov dword [0x524a38], 0xffffffff
xor eax, eax
mov dword [0x524a3c], eax
mov ecx, 0x524a38
push eax
call fcn.00404c70
push 0x524a40
call fcn.00495b95
add esp, 4
jmp 0x40e7c6

Function at 0x40e8b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
call fcn.004729c0
test eax, eax
jne 0x40e96c
call fcn.004729c0
xor ecx, ecx
test eax, eax
je 0x40e8d6
cmp dword [eax + 0x24], 1
sete cl
push ecx
push esi
call fcn.0040e990
add esp, 8
mov eax, dword [0x524a40]
mov ecx, dword [0x514f00]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40e92b
inc esi
push dword [0x514c54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x40e980
mov ecx, dword [0x524a38]
mov dword [eax + ecx*8], esi
mov ecx, dword [0x524a3c]
mov edx, dword [0x524a38]
mov dword [eax + edx*8 + 4], ecx
pop esi
pop ebp
ret
push 0x524a40
call fcn.00494ba0
add esp, 4
cmp dword [0x524a40], 0xffffffff
jne 0x40e8fd
mov dword [0x524a38], 0xffffffff
xor eax, eax
mov dword [0x524a3c], eax
mov ecx, 0x524a38
push eax
call fcn.00404c70
push 0x524a40
call fcn.00495b95
add esp, 4
jmp 0x40e8fd
cmp dword [eax + 0x24], 3
jne 0x40e8c4
mov ecx, 3
jmp 0x40e8d6
test esi, esi
je 0x40e928
call fcn.004048c0
jmp 0x40e90f
Function at 0x40ec00
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov edi, dword [ebp + 8]
mov eax, dword [0x511014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 4]
push 0x3d3
push str....._base_files_file_util_win.cc
push 0x5029ef
push ebx
call fcn.00454af0
add esp, 0x10
mov ecx, esi
mov esi, ebx
xor ebx, ebx
push ebx
push ebx
push esi
call fcn.0046afe0
test byte [0x512ba0], 0x19
jne 0x40ec9a
cmp byte [edi + 0xb], 0
jns 0x40ec70
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
lea ecx, [esp + 0x20]
call fcn.004840c0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.00496ce3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [esp + 0x14]
mov dword [edx], esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
sub esp, 8
movq xmm0, qword [esp + 0x20]
movq qword [esp], xmm0
mov ecx, str.ScopedBlockingCall
call fcn.004d8680
add esp, 8
jmp 0x40ec68
Function at 0x40ecd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x280
mov eax, dword [0x511014]
xor eax, ebp
mov dword [esp + 0x278], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x230]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x28]
push 0x3c3
push str....._base_files_file_util_win.cc
push 0x5029da
push ebx
call fcn.00454af0
add esp, 0x10
xor edi, edi
mov ecx, esi
push edi
push edi
push ebx
call fcn.0046afe0
test byte [0x512ba0], 0x19
jne 0x40ee3d
lea esi, [esp + 0x2a]
push 0x206
push 0xff
push esi
call fcn.00498980
add esp, 0xc
mov word [esi - 2], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
add esi, 0xfffffefb
cmp esi, 0xfffffefc
jb 0x40ee04
push ebx
call fcn.00495e86
add esp, 4
lea edi, [esp + 0xc]
mov ecx, edi
push eax
push ebx
call fcn.004700e0
xor eax, eax
dec eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x40edb4
mov edi, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
jmp 0x40edb7
and eax, 0x7f
lea ebx, [esp + 0x18]
mov ecx, ebx
push eax
push edi
call fcn.004700e0
mov ecx, ebx
call fcn.0046fff0
mov edi, dword [ebp + 8]
cmp byte [edi + 0xb], 0
js 0x40ee31
mov eax, dword [esp + 0x20]
mov dword [edi + 8], eax
movq xmm0, qword [esp + 0x18]
movq qword [edi], xmm0
mov byte [esp + 0x23], 0
mov word [esp + 0x18], 0
cmp byte [esp + 0x17], 0
jns 0x40ee04
push dword [esp + 0xc]
call fcn.00494aa1
add esp, 4
cmp esi, 0xfffffefc
setae bl
lea ecx, [esp + 0x230]
call fcn.004840c0
mov ecx, dword [esp + 0x278]
xor ecx, ebp
call fcn.00496ce3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [edi]
call fcn.00494aa1
add esp, 4
jmp 0x40edd4
lea edx, [esp + 0xc]
mov dword [edx], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
sub esp, 8
movq xmm0, qword [esp + 0x20]
movq qword [esp], xmm0
mov ecx, str.ScopedBlockingCall
call fcn.004d8680
add esp, 8
jmp 0x40ed40
Function at 0x413a90
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0xc], ecx
mov eax, dword [0x511014]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x30]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0xa8
push str....._base_files_file_win.cc
push str.GetLength
push edi
call fcn.00454af0
add esp, 0x10
xor esi, esi
mov ecx, ebx
push esi
push esi
push edi
call fcn.0046afe0
test byte [0x512ba0], 0x19
jne 0x413b41
xor eax, eax
dec eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
push edi
mov eax, dword [esp + 0x10]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb esi, esi
mov edi, dword [esp + 0x14]
or edi, esi
or esi, dword [esp + 0x10]
lea ecx, [esp + 0x30]
call fcn.004840c0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00496ce3
mov eax, esi
mov edx, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [esp + 0x24]
mov dword [edx], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], esi
sub esp, 8
movq xmm0, qword [esp + 0x30]
movq qword [esp], xmm0
mov ecx, str.ScopedBlockingCall
call fcn.004d8680
add esp, 8
jmp 0x413afa
Function at 0x413ed0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x511014]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x413f07
mov eax, dword [0x512b3c]
cmp eax, 0xffffffff
je 0x413f94
mov ebx, 0x100000
test eax, eax
jne 0x413f07
mov ebx, 0x80000
push 0x10
call fcn.00494aa6
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x518914]
bt ecx, eax
jb 0x413f89
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x520914], 1
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push 0x10000
push esi
push 0x401350
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x413fb8
test edi, edi
je 0x414016
mov dword [edi], eax
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496ce3
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.00455550
add esp, 4
jmp 0x413f35
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x512b3c
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x41408a
mov eax, dword [0x512b3c]
jmp 0x413ef9
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x413fd4
mov edi, eax
cmp eax, 0x5af
je 0x413fd4
cmp edi, 0xe
jne 0x414026
push ebx
call fcn.004d8a90
add esp, 4
test esi, esi
mov eax, dword [ebp - 0x20]
je 0x413f70
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x518914]
bt edx, ecx
jae 0x414005
push eax
call fcn.00454d60
add esp, 4
push esi
call fcn.00494aa1
add esp, 4
mov eax, dword [ebp - 0x20]
jmp 0x413f70
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x413f70
mov eax, dword [0x521150]
mov ecx, dword [0x514f00]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x414099
lea ebx, [ebp - 0x1c]
push edi
push ebx
call fcn.004329a0
add esp, 8
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x414060
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
jmp 0x414063
and eax, 0x7f
push eax
push ebx
push dword [0x52114c]
call fcn.00459370
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x413fdd
push dword [ebp - 0x1c]
call fcn.00494aa1
jmp 0x413fda
mov dword [0x512b3c], 0
jmp 0x413f02
push 0x521150
call fcn.00494ba0
add esp, 4
cmp dword [0x521150], 0xffffffff
jne 0x414043
push 0x20
push str.create_thread_last_error
call fcn.00409690
add esp, 8
mov dword [0x52114c], eax
push 0x521150
call fcn.00495b95
add esp, 4
jmp 0x414043
Function at 0x416890
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.00497600
mov esi, ecx
mov eax, dword [0x511014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x800
lea edi, [ebp - 0x810]
push ebx
push 0xff
push edi
call fcn.00498980
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], ebx
push ecx
push edi
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416929
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x41692d
push edi
call fcn.00495e86
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00416990
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496ce3
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x416910
cmp eax, 2
jne 0x416979
lea ebx, [ebp - 0x1010]
push 0x800
push 0xff
push ebx
call fcn.00498980
add esp, 0xc
push 0x400
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x416980
push ebx
call fcn.00495e86
add esp, 4
mov ecx, esi
push eax
push ebx
jmp 0x416909
mov esi, 0x3f4
jmp 0x416910
mov esi, 0xea
jmp 0x416910
Function at 0x41c100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x449b40
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [ecx + 4], 1
jne 0x41c171
movzx ebx, byte [ebp + 0x18]
mov eax, dword [esi]
mov edi, dword [eax + 0x18]
mov ecx, edi
call dword [section..00cfg]
movsx eax, byte [ebp + 0x14]
mov ecx, esi
push ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x30]
mov dword [ecx], eax
mov dword [ebp - 0x20], eax
lock inc dword [eax + 4]
mov dword [ebp - 0x10], 0
push 0x516174
call fcn.004881f0
mov esi, eax
xor ebx, ebx
dec ebx
mov eax, ebx
mov ecx, dword [ebp - 0x20]
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x41c1c9
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, dword [ebp - 0x20]
call edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov eax, dword [esi]
mov cl, byte [ebp + 0x18]
xor cl, 1
movzx ecx, cl
mov edi, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], ebx
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
lea esi, [ebp - 0x30]
push esi
call edi
mov cl, byte [ebp - 0x25]
test cl, cl
mov eax, dword [ebp - 0x30]
cmovs esi, eax
mov dword [ebp - 0x20], esi
lea edx, [ebp - 0x30]
test cl, cl
cmovs edx, eax
js 0x41c242
movzx eax, cl
add edx, eax
cmp dword [ebp - 0x20], edx
je 0x41c28a
cmp dword [ebp - 0x24], 0
je 0x41c24c
mov eax, dword [ebp - 0x20]
mov al, byte [eax]
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x18]
cmp ecx, dword [edx + 0x1c]
je 0x41c255
lea edx, [ecx + 1]
mov esi, dword [ebp - 0x24]
mov dword [esi + 0x18], edx
mov byte [ecx], al
inc dword [ebp - 0x20]
mov cl, byte [ebp - 0x25]
mov eax, dword [ebp - 0x30]
jmp 0x41c202
add edx, dword [ebp - 0x2c]
cmp dword [ebp - 0x20], edx
jne 0x41c216
jmp 0x41c2a3
mov dword [ebp - 0x24], 0
jmp 0x41c237
movzx edi, al
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov esi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
call dword [section..00cfg]
mov dword [ebp - 0x10], 1
mov ecx, ebx
push edi
call esi
xor ecx, ecx
cmp eax, 0xffffffff
je 0x41c285
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], ecx
jmp 0x41c237
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x41c167
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov dword [ecx], edx
push eax
call fcn.00494aa1
add esp, 4
jmp 0x41c292
Function at 0x41cb60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], edx
mov eax, dword [0x511014]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x41cc14
mov edi, ecx
xor esi, esi
lea eax, [ebp - 0x14]
mov dword [eax], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov ecx, ebx
mov ebx, eax
call ecx
push 2
push esi
push esi
lea ecx, [ebp - 0x14]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x41cc18
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
cmp dword [esi], ebx
je 0x41cbde
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x41cbf7
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x41cbd7
mov dword [esi], ebx
mov esi, eax
call fcn.00459380
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496ce3
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x18], eax
call fcn.00459380
push dword [esi]
call fcn.0048c780
mov eax, dword [ebp - 0x18]
add esp, 4
mov dword [esi], 0
jmp 0x41cbc4
mov bl, 1
jmp 0x41cbe3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41cbd7

Function at 0x41cd10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ebx, ecx
mov eax, dword [0x511014]
xor eax, ebp
mov dword [esp + 0x18], eax
xor esi, esi
lea edi, [esp + 8]
mov dword [edi + 4], esi
mov dword [edi], esi
mov dword [edi + 8], esi
push edi
mov dword [esp + 8], edx
push edx
push ecx
call fcn.0046f990
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x41cd50
mov edi, dword [esp + 8]
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [esp + 0x13], 0
jns 0x41cd6e
push dword [esp + 8]
call fcn.00494aa1
add esp, 4
cmp dword [ebp + 8], 0
je 0x41ce19
test esi, esi
je 0x41ce19
lea eax, [esi + esi]
xor ecx, ecx
dec ecx
test esi, esi
cmovns ecx, eax
push ecx
call fcn.00495b47
add esp, 4
mov edi, eax
xor eax, eax
mov ecx, ebx
lea ebx, [esp + 8]
mov dword [ebx + 4], eax
mov dword [ebx], eax
mov dword [ebx + 8], eax
push ebx
push dword [esp + 8]
push ecx
call fcn.0046f990
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x41cdbe
mov ebx, dword [esp + 8]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [esp + 0x13], 0
jns 0x41cdda
push dword [esp + 8]
call fcn.00494aa1
add esp, 4
test edi, edi
mov ebx, dword [ebp + 8]
je 0x41ce33
push edi
call fcn.00495e86
add esp, 4
lea ecx, [esp + 8]
push eax
push edi
push ecx
call fcn.0047bbf0
add esp, 0xc
cmp byte [ebx + 0xb], 0
js 0x41ce36
mov eax, dword [esp + 0x10]
mov dword [ebx + 8], eax
movsd xmm0, qword [esp + 8]
movsd qword [ebx], xmm0
push edi
call fcn.00495b42
add esp, 4
test esi, esi
setne bl
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.00496ce3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
int3
push dword [ebx]
call fcn.00494aa1
add esp, 4
jmp 0x41cdff
Function at 0x41db40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x41dce7
cmp dword [esi], 0
jne 0x41dce7
cmp dword [esi + 0xc], 0
jne 0x41dce7
xor eax, eax
cmp dword [esi + 4], 0
jne 0x41dce7
mov ebx, dword [edi]
cmp eax, ebx
je 0x41dba6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x41dbef
lea eax, [ebx + 1]
cmp eax, 2
jb 0x41db9c
mov dword [esi], ebx
call fcn.00459380
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x41dbd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x41dc2b
lea eax, [ebx + 1]
cmp eax, 2
jb 0x41dbcf
mov dword [esi + 4], ebx
call fcn.00459380
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00459380
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
cmp dword [0x523df0], 0
je 0x41dc69
mov eax, dword [0x523df0]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [section..00cfg]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x41db8d
call fcn.00459380
mov eax, dword [esi + 4]
mov dword [ebp - 0x18], eax
cmp dword [0x523df0], 0
je 0x41dca2
mov eax, dword [0x523df0]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [section..00cfg]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi + 4], 0
jmp 0x41dbbf
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x50511c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41dcf5
mov ecx, eax
cmp eax, sym.opera.exe_GetHandleVerifier
je 0x41dcdb
call dword [section..00cfg]
call ecx
push 0
push eax
call fcn.00426270
add esp, 8
jmp 0x41dc02
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x50511c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41dcfa
mov ecx, eax
cmp eax, sym.opera.exe_GetHandleVerifier
je 0x41dce1
call dword [section..00cfg]
call ecx
push 0
push eax
call fcn.00426270
add esp, 8
jmp 0x41dc3f
push 1
push 0
jmp 0x41dc95
push 1
push 0
jmp 0x41dcce
mov ecx, esi
call fcn.004e5460
mov eax, dword [esi]
jmp 0x41db77
xor eax, eax
push eax
jmp 0x41dc94
xor eax, eax
push eax
jmp 0x41dccd