joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424be0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [0x598a40]
test edi, edi
jne 0x424c96
push 0x38
call fcn.00512878
add esp, 4
mov esi, eax
mov dword [eax + 4], 0
mov dword [eax], 0
push 0xc
call fcn.00512878
add esp, 4
mov dword [esi + 8], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x10], ecx
mov dword [eax + 8], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [esi + 0xc], ecx
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
lea eax, [esi + 0x24]
movaps xmm0, xmmword [0x53f7f0]
movups xmmword [esi + 0x24], xmm0
mov dword [esi + 0x20], eax
mov dword [esi + 0x34], 0
mov dword [0x598a40], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edx, edx
test eax, eax
je 0x424c8d
cmp word [eax], 0
je 0x424c8d
xor ecx, ecx
nop dword [eax]
lea edx, [ecx + 1]
cmp word [eax + ecx*2 + 2], 0
mov ecx, edx
jne 0x424c80
mov ecx, esi
push edx
push eax
call fcn.00424ca0
test edi, edi
sete al
pop esi
pop edi
pop ebp
ret
Function at 0x424ca0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x596ff8]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea ebx, [ebp - 0x20]
push 3
push ecx
push eax
push ebx
call fcn.00436cf0
add esp, 0x10
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x424e9b
mov esi, dword [ebp - 0x20]
mov dword [edi], esi
mov dword [edi + 4], eax
mov dword [ebp - 0x14], 0
push 0x800
push 0
push str.api_ms_win_downlevel_shell32_l1_1_0.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x2c], eax
je 0x424d1a
push 0x542f2a
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x424d2a
mov ecx, eax
lea eax, [ebp - 0x14]
push eax
push esi
call ecx
jmp 0x424d25
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x24], eax
jmp 0x424d31
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
test eax, eax
je 0x424e2d
mov dword [ebp - 0x28], edi
cmp eax, 0x15555556
jae 0x424eb6
shl eax, 2
mov dword [ebp - 0x30], eax
lea esi, [eax + eax*2]
push esi
call fcn.00512878
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
add eax, esi
mov dword [ebp - 0x18], eax
xor eax, eax
jmp 0x424dd6
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.00512878
add esp, 4
mov dword [edi + 8], eax
or esi, 1
mov dword [edi], esi
mov dword [edi + 4], ebx
mov ecx, ebx
add ecx, ebx
push ecx
push dword [ebp - 0x34]
push eax
mov esi, eax
call fcn.005162a0
mov eax, esi
add esp, 0xc
mov word [eax + ebx*2], 0
add edi, 0xc
mov eax, dword [ebp - 0x38]
add eax, 4
cmp dword [ebp - 0x30], eax
je 0x424e24
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + eax]
mov dword [edi + 4], 0
mov dword [edi], 0
mov dword [edi + 8], 0
mov dword [ebp - 0x34], eax
push eax
call fcn.0052b964
add esp, 4
cmp eax, 0x7ffffff0
jae 0x424eaf
mov ebx, eax
cmp eax, 5
jae 0x424d90
mov eax, ebx
add al, bl
mov byte [edi], al
lea eax, [edi + 2]
test ebx, ebx
jne 0x424dad
jmp 0x424dc2
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x28]
lea ebx, [ebp - 0x20]
mov ecx, edi
push ebx
call fcn.00424650
mov dword [edi], 0
mov dword [edi + 4], 0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x424e59
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x424e9b
mov eax, dword [ebp - 0x1c]
cmp eax, esi
jne 0x424e76
mov eax, esi
jmp 0x424e8f
mov eax, edi
cmp esi, edi
je 0x424e8c
lea edi, [eax - 0xc]
test byte [eax - 0xc], 1
je 0x424e70
push dword [eax - 4]
call fcn.005128f8
add esp, 4
jmp 0x424e70
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], esi
push eax
call fcn.005128f8
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, edi
call fcn.00420a88
lea ecx, [ebp - 0x20]
call fcn.00422b1c
int3
Function at 0x427fb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0043f550
mov dword [esi], 0
test eax, eax
je 0x428014
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jb 0x427ffa
mov dword [ebp - 0x10], eax
call fcn.0042a9a0
push dword [esi]
call fcn.00441df0
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x42800d
mov dword [esi], ebx
mov ebx, eax
call fcn.0042a9a0
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.00428100
lea ecx, [esi + 0x10]
call fcn.004575d0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x42a9b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00424ed0
test al, al
je 0x42aace
call fcn.00424ec0
mov esi, eax
mov ecx, eax
push 0x546227
call fcn.004253f0
test al, al
jne 0x42a9fe
mov ecx, esi
push str.vmodule
call fcn.004253f0
test al, al
je 0x42aace
cmp dword [0x598a48], 0
je 0x42aa30
lea edi, [ebp - 0x1c]
push str._g_vlog_info_prev
push 0x17d
push str..._.._base_logging.cc
push edi
call fcn.00423ce0
add esp, 0x10
mov ecx, edi
call fcn.00423d50
mov ecx, edi
call fcn.00423d60
mov eax, dword [0x598a4c]
mov dword [0x598a48], eax
push 0x10
call fcn.00512878
add esp, 4
mov edi, eax
mov dword [ebp - 0x24], str.vmodule
push str.vmodule
call fcn.0052b730
add esp, 4
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x1c]
mov ecx, esi
push eax
push edx
call fcn.00425460
mov dword [ebp - 0x38], 0x546227
push 0x546227
call fcn.0052b730
add esp, 4
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
lea ebx, [ebp - 0x30]
mov ecx, esi
push eax
push ebx
call fcn.00425460
mov ecx, edi
push 0x598a50
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.00457a40
mov dword [0x598a4c], edi
test byte [ebp - 0x30], 1
je 0x42aaba
push dword [ebp - 0x28]
call fcn.005128f8
add esp, 4
test byte [ebp - 0x1c], 1
mov edi, dword [ebp + 8]
je 0x42aace
push dword [ebp - 0x14]
call fcn.005128f8
add esp, 4
mov eax, dword [edi]
mov dword [0x5961a0], eax
mov bl, 1
test al, 1
je 0x42ab69
mov eax, dword [0x598a64]
test eax, eax
je 0x42ab0c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x598a64], 0
mov ecx, dword [0x598a54]
test ecx, ecx
jne 0x42ab3b
and byte [0x5961a0], 0xfe
jmp 0x42ab16
mov ecx, dword [0x598a54]
test ecx, ecx
jne 0x42ab3b
push 0xc
call fcn.00512878
add esp, 4
mov ecx, eax
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [0x598a54], eax
push dword [edi + 4]
call fcn.00421d26
cmp dword [edi + 0xc], 0
jne 0x42ab62
mov eax, dword [0x598a54]
test byte [eax], 1
je 0x42ab58
mov eax, dword [eax + 8]
jmp 0x42ab5b
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0042ab80
mov ebx, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42ab80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x598a64], 0
jne 0x42ade3
mov esi, dword [0x598a54]
test esi, esi
je 0x42abc1
test byte [0x5961a0], 1
jne 0x42acbb
jmp 0x42ade3
push 0xc
call fcn.00512878
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.00516da0
add esp, 0xc
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
push edi
call fcn.0052b964
add esp, 4
cmp eax, 0x7ffffff0
jae 0x42adfa
mov ebx, eax
cmp eax, 5
jae 0x42ac34
mov eax, ebx
add al, bl
mov byte [esi], al
mov eax, esi
add eax, 2
test ebx, ebx
jne 0x42ac57
jmp 0x42ac6a
lea edi, [ebx + 8]
and edi, 0xfffffff8
lea eax, [edi + edi]
push eax
call fcn.00512878
add esp, 4
mov dword [esi + 8], eax
or edi, 1
mov dword [esi], edi
lea edi, [ebp - 0x218]
mov dword [esi + 4], ebx
mov ecx, ebx
add ecx, ebx
push ecx
push edi
push eax
mov edi, eax
call fcn.005162a0
mov eax, edi
add esp, 0xc
mov word [eax + ebx*2], 0
movzx eax, byte [esi]
test al, 1
je 0x42ac7c
mov eax, dword [esi + 4]
jmp 0x42ac7e
shr eax, 1
mov bl, 1
mov ecx, esi
push eax
push 0x5c
call fcn.00422198
cmp eax, 0xffffffff
je 0x42ac9c
add eax, 1
mov ecx, esi
push 0xffffffffffffffff
push eax
call fcn.00421e68
mov ecx, esi
push 0x543104
call fcn.00421ba2
mov dword [0x598a54], esi
test byte [0x5961a0], 1
je 0x42ade3
test byte [esi], 1
jne 0x42acc5
add esi, 2
jmp 0x42acc8
mov esi, dword [esi + 8]
sub esp, 0x1c
movaps xmm0, xmmword [0x543040]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x598a64], eax
add eax, 1
cmp eax, 1
ja 0x42ade3
lea eax, [ebp - 0x216]
push 0x206
push 0xff
push eax
call fcn.00516da0
add esp, 0xc
mov word [ebp - 0x218], 0
lea esi, [ebp - 0x218]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x42ade1
cmp eax, 0x104
ja 0x42ade1
mov ecx, dword [0x598a54]
push esi
call fcn.00421d26
mov ecx, dword [0x598a54]
movzx eax, byte [ecx]
test al, 1
jne 0x42ad68
lea edx, [ecx + 2]
shr eax, 1
jmp 0x42ad6e
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
cmp word [edx + eax*2 - 2], 0x5c
je 0x42ad86
push 0x543100
call fcn.00421ba2
mov ecx, dword [0x598a54]
push 0x543104
call fcn.00421ba2
mov eax, dword [0x598a54]
test byte [eax], 1
jne 0x42ad9f
add eax, 2
jmp 0x42ada2
mov eax, dword [eax + 8]
movaps xmm0, xmmword [0x543040]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x598a64], eax
add eax, 1
cmp eax, 1
ja 0x42ade3
mov dword [0x598a64], 0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.00420a88
int3
Function at 0x437530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00437540

Function at 0x439de0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.00512ef0
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5961c0]
cmp eax, 0xffffffff
je 0x439f36
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x439f36
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.005162a0
add esp, 0xc
mov ecx, dword [0x5961c0]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.00462840
add esp, 8
push ebx
call fcn.0051292c
add esp, 4
mov eax, dword [0x599720]
mov ecx, dword [0x599af4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x439f57
mov esi, dword [0x59971c]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x439f4b
lea eax, [ebp - 0x1410]
push 0xc00
push 0x598b1c
push eax
call fcn.005162a0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ebx, 0x100
jmp 0x439eca
lea ecx, [ebx - 1]
cmp ebx, 2
mov ebx, ecx
jb 0x439f26
test al, 1
je 0x439f26
xor edi, edi
lea esi, [ebp - 0x1408]
xor eax, eax
jmp 0x439eee
add edi, 1
add esi, 0xc
cmp edi, 0x100
je 0x439ec0
mov ecx, dword [ebp + edi*8 - 0x810]
test ecx, ecx
je 0x439ee0
cmp dword [esi - 8], 0
je 0x439ee0
mov edx, dword [ebp + edi*8 - 0x80c]
cmp edx, dword [esi]
jne 0x439ee0
mov edx, dword [esi - 4]
test edx, edx
je 0x439ee0
mov dword [ebp + edi*8 - 0x810], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x439ee0
push 2
push dword [ebp - 0x1414]
call fcn.00462840
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.00440f10
jmp 0x439e8d
push 0x599720
call fcn.00512977
add esp, 4
cmp dword [0x599720], 0xffffffff
jne 0x439e78
push 4
call fcn.00512878
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.00440f00
mov dword [0x59971c], esi
push 0x599720
call fcn.005129ed
add esp, 4
jmp 0x439e78

Function at 0x439fa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5961c0]
cmp eax, 0xffffffff
je 0x439fc2
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x439fd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5961c0]
cmp eax, 0xffffffff
je 0x439ffa
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x439fff
call fcn.0043a1e0
mov eax, dword [0x599720]
mov ecx, dword [0x599af4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x43a199
mov edi, dword [0x59971c]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x43a18d
mov ecx, dword [0x598b18]
add ecx, 1
mov edx, 0x100
nop word cs:[eax + eax]
nop dword [eax]
movzx ebx, cl
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x598b1c], 0
je 0x43a07d
lea eax, [ecx + 1]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x598b1c], 0
je 0x43a07d
add ecx, 2
add edx, 0xfffffffe
jne 0x43a050
jmp 0x43a0ad
lea ecx, [eax*4 + 0x598b1c]
mov dword [ecx], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x598b20], ecx
mov dword [0x598b18], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x598b24]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov dword [ebp - 0x14], 0xffffffff
mov ebx, dword [esi]
cmp ebx, 0xffffffff
jne 0x43a116
push 0xffffffffffffffff
call fcn.00423e70
add esp, 4
mov ebx, eax
push 0xffffffffffffffff
call fcn.00423e70
add esp, 4
lea edi, [ebp - 0x14]
mov ecx, edi
push ebx
push eax
push str.slot____kInvalidSlotValue
call fcn.00424270
cmp dword [ebp - 0x14], 0
je 0x43a114
lea ebx, [ebp - 0x18]
push edi
push 0x197
push str..._.._base_threading_thread_local_storage.cc
push ebx
call fcn.00423d80
add esp, 0x10
mov ecx, ebx
call fcn.00423d50
mov ecx, ebx
call fcn.00423d60
mov ebx, dword [esi]
mov dword [ebp - 0x14], 0xffffffff
cmp ebx, 0x100
jl 0x43a179
push 0x100
call fcn.00423e70
add esp, 4
mov edi, eax
push ebx
call fcn.00423e70
add esp, 4
lea esi, [ebp - 0x14]
mov ecx, esi
push edi
push eax
push str.slot____kThreadLocalStorageSize
call fcn.00424270
cmp dword [ebp - 0x14], 0
je 0x43a179
lea edi, [ebp - 0x18]
push esi
push 0x198
push str..._.._base_threading_thread_local_storage.cc
push edi
call fcn.00423d80
add esp, 0x10
mov ecx, edi
call fcn.00423d50
mov ecx, edi
call fcn.00423d60
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ecx, edi
call fcn.00440f10
jmp 0x43a035
push 0x599720
call fcn.00512977
add esp, 4
cmp dword [0x599720], 0xffffffff
jne 0x43a020
push 4
call fcn.00512878
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.00440f00
mov dword [0x59971c], edi
push 0x599720
call fcn.005129ed
add esp, 4
jmp 0x43a020
Function at 0x43a1e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x80c
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x810], 0xffffffff
mov eax, dword [0x5961c0]
mov dword [ebp - 0x810], eax
cmp eax, 0xffffffff
jne 0x43a2d8
lea edi, [ebp - 0x810]
push edi
call fcn.00462810
add esp, 4
test al, al
jne 0x43a252
lea esi, [ebp - 0x80c]
push str.PlatformThreadLocalStorage::AllocTLS_key_
push 0xd1
push str..._.._base_threading_thread_local_storage.cc
push esi
call fcn.00423ce0
add esp, 0x10
mov ecx, esi
call fcn.00423d50
mov ecx, esi
call fcn.00423d60
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x43a2af
push edi
call fcn.00462810
add esp, 4
test al, al
je 0x43a273
cmp dword [ebp - 0x810], 0xffffffff
jne 0x43a29f
lea esi, [ebp - 0x80c]
push str.PlatformThreadLocalStorage::AllocTLS_key___key___PlatformThreadLocalStorage::TLS_KEY_OUT_OF_INDEXES
push 0xdb
push str..._.._base_threading_thread_local_storage.cc
push esi
call fcn.00423ce0
add esp, 0x10
mov ecx, esi
call fcn.00423d50
mov ecx, esi
call fcn.00423d60
push 0xffffffffffffffff
call fcn.00462830
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x5961c0], ecx
mov eax, dword [ebp - 0x810]
je 0x43a2d8
push eax
call fcn.00462830
add esp, 4
mov eax, dword [0x5961c0]
mov dword [ebp - 0x810], eax
mov dword [ebp - 0x80c], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
and esi, 3
je 0x43a34a
push 0
call fcn.00423e70
add esp, 4
mov edi, eax
push esi
call fcn.00423e70
add esp, 4
lea esi, [ebp - 0x80c]
mov ecx, esi
push edi
push eax
push str.GetTlsVectorStateAndValue_key___TlsVectorState::kUninitialized
call fcn.00424270
cmp dword [ebp - 0x80c], 0
je 0x43a34a
lea edi, [ebp - 0x814]
push esi
push 0xed
push str..._.._base_threading_thread_local_storage.cc
push edi
call fcn.00423d80
add esp, 0x10
mov ecx, edi
call fcn.00423d50
mov ecx, edi
call fcn.00423d60
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.00516da0
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.00462840
add esp, 8
push 0x800
call fcn.00512923
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.005162a0
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.00462840
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00512931
mov eax, esi
add esp, 0x80c
pop esi
pop edi
pop ebp
ret
Function at 0x43db80
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea edi, [esp + 0x10]
push 0x4d
push str..._.._base_file_version_info_win.cc
push str.CreateFileVersionInfoWin
push edi
call fcn.0042a970
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push edi
call fcn.004391c0
mov dword [esp + 0xc], 0xffffffff
test byte [ebx], 1
je 0x43dbf7
mov ebx, dword [ebx + 8]
jmp 0x43dbfa
add ebx, 2
mov edi, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x43dd74
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
test eax, eax
js 0x43dd98
push esi
call fcn.00512878
add esp, 4
mov ebx, eax
mov dword [esp + 0x10], eax
mov edi, esi
add edi, eax
mov dword [esp + 0x18], edi
push esi
push 0
push eax
call fcn.00516da0
add esp, 0xc
mov dword [esp + 0x14], edi
push ebx
push esi
push dword [esp + 0x14]
push dword [esp + 0x14]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43dd54
mov eax, dword [esp + 0x10]
mov dword [esp + 0x64], 0
mov dword [esp + 0x60], 0xffffffff
lea ecx, [esp + 0x60]
lea ebx, [esp + 0x64]
push ecx
push ebx
push str.VarFileInfoTranslation
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43dd54
mov esi, dword [esp + 0x64]
test esi, esi
je 0x43dd54
push 0x1c
call fcn.00512878
add esp, 4
mov edi, eax
mov eax, dword [esi]
mov dword [edi], 0x543dd0
mov ecx, dword [esp + 0x10]
mov dword [edi + 4], ecx
mov edx, dword [esp + 0x14]
mov dword [edi + 8], edx
mov edx, dword [esp + 0x18]
mov dword [edi + 0xc], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], eax
mov dword [esp + 0x64], 0
mov dword [esp + 0x60], 0xffffffff
lea eax, [esp + 0x60]
push eax
push ebx
push 0x543fc6
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x43dd44
lea ebx, [esp + 0x5c]
push str.::VerQueryValue_data__kRoot__fixed_file_info__dummy_size_
push 0x2a
push str..._.._base_file_version_info_win.cc
push ebx
call fcn.00423ce0
add esp, 0x10
mov ecx, ebx
call fcn.00423d50
mov ecx, ebx
call fcn.00423d60
mov eax, dword [esp + 0x64]
mov dword [edi + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov edi, eax
jmp 0x43dd5d
mov edi, dword [ebp + 8]
mov dword [edi], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43dd7a
mov dword [esp + 0x14], eax
push eax
call fcn.005128f8
add esp, 4
jmp 0x43dd7a
mov dword [edi], 0
lea ecx, [esp + 0x20]
call fcn.00439230
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.00512931
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x10]
call fcn.00422b1c
int3