joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a210
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push ebx
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x43a2ad
mov ebx, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esi], eax
test eax, eax
je 0x43a2ad
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 4]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x54ea50]
bt edx, ecx
jae 0x43a27a
push eax
call fcn.0044f5d0
add esp, 4
mov edx, dword [ebp - 0x10]
mov eax, edx
shr eax, 0xe
mov ecx, edx
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x54ea50]
bt ecx, eax
jae 0x43a2b9
push edx
call fcn.0044f4e0
mov edx, dword [ebp - 0x10]
add esp, 4
mov dword [esi + 4], edx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 8], eax
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, edx
shr eax, 0x15
mov byte [eax + 0x556a50], 1
jmp 0x43a29f
Function at 0x43af40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [0x547008]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp byte [eax + 0xb], 0
jns 0x43af5f
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x52a960]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor ebx, ebx
cmp eax, 0xffffffff
je 0x43afd8
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
movzx eax, byte [edi + 0xb]
test al, al
js 0x43afa5
and eax, 0x7f
mov ecx, edi
jmp 0x43afaa
mov eax, dword [edi + 4]
mov ecx, dword [edi]
lea edx, [ebp - 0x14]
push ebx
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43afd4
mov eax, dword [ebp - 0x14]
movzx ecx, byte [edi + 0xb]
test cl, cl
js 0x43afcc
and ecx, 0x7f
jmp 0x43afcf
mov ecx, dword [edi + 4]
cmp eax, ecx
sete bl
test esi, esi
je 0x43afdf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b000
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x547008]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp byte [eax + 0xb], 0
jns 0x43b01f
mov eax, dword [eax]
mov edi, dword [ebp + 8]
sub esp, 0x1c
movaps xmm0, xmmword [0x52c020]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x43b137
xor esi, esi
push esi
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
test eax, eax
je 0x43b177
js 0x43b18d
mov ebx, eax
push eax
call fcn.004e82a5
add esp, 4
mov esi, eax
lea edx, [eax + ebx]
xor eax, eax
mov ecx, esi
add ecx, eax
je 0x43b15c
mov byte [ecx], 0
inc eax
cmp ebx, eax
jne 0x43b089
mov dword [ebp - 0x28], edx
xor edi, edi
lea eax, [ebp - 0x20]
mov dword [eax], edi
push edi
push eax
push ebx
push esi
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x43b10c
cmp ebx, dword [ebp - 0x20]
jne 0x43b10c
cmp ebx, 0x7ffffff8
jae 0x43b1a3
cmp ebx, 0xa
jbe 0x43b0f1
mov edi, ebx
or edi, 7
inc edi
push edi
call fcn.004e82a5
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
or edi, 0x80000000
mov dword [ecx + 8], edi
mov edi, ecx
mov dword [ecx + 4], ebx
jmp 0x43b0f9
mov edi, dword [ebp + 8]
mov byte [edi + 0xb], bl
mov eax, edi
xor ecx, ecx
mov dl, byte [esi + ecx]
mov byte [eax + ecx], dl
inc ecx
cmp ebx, ecx
jne 0x43b0fb
mov byte [eax + ecx], 0
jmp 0x43b119
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
mov dword [eax], edi
mov dword [eax + 8], edi
mov edi, eax
test esi, esi
je 0x43b12e
mov eax, dword [ebp - 0x28]
dec eax
cmp ebx, eax
ja 0x43b195
push esi
call fcn.004e82d5
add esp, 4
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x43b141
jmp 0x43b148
xor ecx, ecx
mov dword [edi + 4], ecx
mov dword [edi], ecx
mov dword [edi + 8], ecx
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8be6
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x28
push str....._third_partylibc_srcinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s_n
call fcn.00457520
push str.vector___index_out_of_bounds
push 0x52a71f
push 0x601
push str....._third_partylibc_srcinclude_vector
jmp 0x43b16d
lea ecx, [ebp - 0x1c]
call fcn.004171a0
push str.null_pointer_given_to_destroy_at
push str.__loc___nullptr
push 0x44
jmp 0x43b168
mov ecx, dword [ebp + 8]
call fcn.004148d0
int3
Function at 0x43b1b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movzx ebx, byte [edx + 0xb]
test bl, bl
js 0x43b1cb
mov ecx, ebx
and ecx, 0x7f
jmp 0x43b1ce
mov ecx, dword [edx + 4]
test ecx, ecx
je 0x43b2b4
xor esi, esi
push 0x208
mov edi, edx
call fcn.004e82a5
mov ecx, edi
add esp, 4
mov edi, eax
mov eax, edi
add eax, esi
je 0x43b2f2
mov word [eax], 0
add esi, 2
cmp esi, 0x208
jne 0x43b1eb
test bl, bl
jns 0x43b20b
mov ecx, dword [ecx]
mov esi, dword [ebp + 8]
push edi
push 0
push 0x52c11c
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x43b2a8
xor ebx, ebx
cmp word [edi + ebx*2], 0
je 0x43b2d0
inc ebx
cmp ebx, 0x104
jne 0x43b227
mov ebx, 0x104
mov esi, ebx
or esi, 3
lea eax, [esi*2 + 2]
inc esi
push eax
call fcn.004e82a5
add esp, 4
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
or esi, 0x80000000
mov dword [eax + 8], esi
mov dword [eax + 4], ebx
lea eax, [ebx + ebx]
push eax
push edi
push ecx
mov esi, ecx
call fcn.004ebca0
add esp, 0xc
lea eax, [esi + ebx*2]
mov esi, dword [ebp + 8]
mov word [eax], 0
test edi, edi
je 0x43b2c9
mov eax, 0x208
test eax, eax
je 0x43b2c0
add eax, 0xfffffffe
mov ecx, edi
add ecx, eax
jne 0x43b28d
push str.null_pointer_given_to_destroy_at
push str.__loc___nullptr
push 0x44
jmp 0x43b2fe
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
jmp 0x43b284
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax], ecx
mov dword [eax + 8], ecx
jmp 0x43b2cb
push edi
call fcn.004e82d5
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x7ffffff8
jae 0x43b30d
cmp ebx, 5
jae 0x43b240
mov byte [esi + 0xb], bl
mov ecx, esi
mov eax, esi
test ebx, ebx
jne 0x43b269
jmp 0x43b27f
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x28
push str....._third_partylibc_srcinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s_n
call fcn.00457520
mov ecx, esi
call fcn.004148d0
int3

Function at 0x43b470
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [ecx + 0xb], 0
js 0x43b49a
mov eax, esi
je 0x43b497
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [esi + 0xb], 0
jns 0x43b497
push dword [esi]
call fcn.004e82d5
add esp, 4
pop esi
pop ebp
ret
cmp dword [esi + 4], 0
je 0x43b48d
mov eax, dword [esi]
jmp 0x43b480
Function at 0x43c9a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x547008]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x1c]
mov byte [edi + 0xb], 4
cmp edi, str.stat
ja 0x43c9d0
lea eax, [ebp - 0x18]
cmp eax, str.stat
ja 0x43cac1
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], 0x74617473
mov byte [ebp - 0x18], 0
mov ecx, esi
push dword [ebp + 0xc]
push edi
call fcn.0041e8f0
mov bh, al
cmp byte [ebp - 0x11], 0
jns 0x43c9fc
push dword [ebp - 0x1c]
call fcn.004e82d5
add esp, 4
mov bl, 1
test bh, bh
jne 0x43ca7a
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x28]
mov byte [eax + 0xb], 9
cmp eax, str.statpromo
ja 0x43ca2a
lea ecx, [ebp - 0x1f]
cmp ecx, str.statpromo
ja 0x43cac1
mov dword [ebp - 0x24], 0x6d6f7270
mov dword [ebp - 0x28], 0x74617473
mov word [ebp - 0x20], 0x6f
mov ecx, esi
push edi
push eax
call fcn.0041e860
mov ebx, eax
cmp byte [ebp - 0x1d], 0
jns 0x43ca5a
push dword [ebp - 0x28]
call fcn.004e82d5
add esp, 4
mov edx, dword [ebp + 0xc]
test bl, bl
jne 0x43ca8e
test edx, edx
je 0x43ca69
xor eax, eax
mov byte [edx], al
cmp byte [ebp - 0x11], 0
jns 0x43ca7a
push dword [ebp - 0x1c]
call fcn.004e82d5
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
test edx, edx
je 0x43ca69
movzx ecx, byte [ebp - 0x11]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs eax, dword [ebp - 0x18]
cmovs edi, dword [ebp - 0x1c]
test eax, eax
js 0x43cadf
test edi, edi
jne 0x43cab1
test eax, eax
jne 0x43caf5
cmp eax, 4
jne 0x43ca65
cmp dword [edi], 0x65757274
sete al
jmp 0x43ca67
push str.char_traits::copy_overlapped_range
push str.__s2_____s1____s2_____s1____n
push 0xf3
push str....._third_partylibc_srcinclude__stringchar_traits.h
push str._s:_d:_assertion__s_failed:__s_n
call fcn.00457520
push str.string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type
push str.__len___static_cast_size_type__numeric_limits_difference_type_::max___
push 0x13a
push str....._third_partylibc_srcinclude_string_view
jmp 0x43cad5
push str.string_view::string_view__CharT___size_t_:_received_nullptr
push str.__len__0____s___nullptr
push 0x13c
jmp 0x43caee
Function at 0x43d270
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [ebp + 8]
mov ecx, dword [0x547008]
xor ecx, ebp
mov dword [esp + 0x6c], ecx
test eax, eax
je 0x43d2ac
push eax
push 0x43d310
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 0x6c]
xor ecx, ebp
call fcn.004e8be6
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 4]
push eax
push edi
call fcn.00516ab0
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push edi
push 0x46a
push str.BringProcessWindowToTop
push 1
call fcn.0045bec0
lea ecx, [esp + 0x4c]
push 0x52c287
push str.Failed_to_bring_process_window_to_top:_wrong_process_id
call fcn.004148f0
mov ecx, esi
call fcn.0045bf00
cmp byte [edi + 0xb], 0
jns 0x43d29a
push dword [esp + 4]
call fcn.004e82d5
add esp, 4
jmp 0x43d29a
Function at 0x4436c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov dword [ecx], fcn.00446980
mov dword [ecx + 0x1c], 0x527de0
mov eax, dword [0x54ca28]
test eax, eax
je 0x4436e5
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov edi, dword [esi + 0x144]
mov dword [esi + 0x144], 0
test edi, edi
je 0x44370b
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
push 1
call ebx
mov edi, dword [esi + 0x140]
mov dword [esi + 0x140], 0
test edi, edi
je 0x443731
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
push 1
call ebx
cmp byte [esi + 0x13b], 0
jns 0x443748
push dword [esi + 0x130]
call fcn.004e82d5
add esp, 4
cmp byte [esi + 0x12f], 0
jns 0x44375f
push dword [esi + 0x124]
call fcn.004e82d5
add esp, 4
cmp byte [esi + 0x123], 0
jns 0x443776
push dword [esi + 0x118]
call fcn.004e82d5
add esp, 4
lea ecx, [esi + 0x108]
call fcn.00437790
mov edi, dword [esi + 0x100]
mov dword [esi + 0x100], 0
test edi, edi
je 0x4437a7
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
push 1
call ebx
mov edi, dword [esi + 0xfc]
mov dword [esi + 0xfc], 0
test edi, edi
je 0x4437d1
mov eax, dword [edi]
test eax, eax
je 0x4437c8
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call fcn.004e82d5
add esp, 4
mov edi, dword [esi + 0xf8]
mov dword [esi + 0xf8], 0
test edi, edi
je 0x4437fb
mov eax, dword [edi]
test eax, eax
je 0x4437f2
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call fcn.004e82d5
add esp, 4
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0042cd50

Function at 0x4439a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ecx + 0x20]
call fcn.0041a520
test al, al
je 0x4439d5
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x4439d5
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4439d5
push 0
push dword [esi + 0xe0]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret
Function at 0x44ac20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x547008]
xor ecx, ebp
mov esi, 0x7fffffff
cmp eax, esi
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push ebx
push edi
call ecx
test eax, eax
je 0x44aca9
mov esi, ebx
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x44ac8b
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x44aca4
mov ebx, esi
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x44ac53
cmp ebx, 0xffffffff
je 0x44acbb
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp - 0x14]
jmp 0x44ac90
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x44ac90
int3

Function at 0x44af50
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [ecx + 8]
inc eax
cmp eax, 2
jae 0x44afcf
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
push dword [ebp + 8]
call fcn.0044acc0
add esp, 4
mov edi, eax
cmp dword [esi + 8], eax
je 0x44afb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 8]
inc eax
cmp eax, 2
jb 0x44af9b
call fcn.0049a530
push dword [esi + 8]
call fcn.004844e0
add esp, 4
mov dword [esi + 8], 0
mov eax, edi
inc eax
cmp eax, 2
jb 0x44afab
mov dword [esi + 8], edi
call fcn.0049a530
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi + 8]
lea eax, [edi + 1]
cmp eax, 2
jb 0x44afc0
mov dword [esi + 0x14], edi
test eax, 0xfffffffe
setne al
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3
Function at 0x44f2c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc0
mov ebx, dword [ebp + 8]
mov eax, dword [0x547008]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x44f2e3
mov eax, dword [ebx]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x44f392
mov edi, eax
push eax
call fcn.004e8303
add esp, 4
mov esi, eax
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x44f30a
mov eax, dword [ebx]
push esi
push edi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44f3df
xor eax, eax
dec eax
lea ecx, [ebp - 0xc4]
mov dword [ecx], eax
lea edx, [ebp - 0xc8]
mov dword [edx], eax
push edx
push ecx
push 0x52cf80
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
setne bl
je 0x44f396
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc4]
movups xmm0, xmmword [ecx]
movups xmm1, xmmword [ecx + 0x10]
movups xmmword [eax + 0x10], xmm1
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x30], edx
movups xmm1, xmmword [ecx + 0x20]
movups xmmword [eax + 0x20], xmm1
movups xmmword [eax], xmm0
mov ecx, dword [eax + 0x18]
and dword [eax + 0x1c], ecx
test esi, esi
je 0x44f37b
push esi
call fcn.004e830c
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x44f37b
push 1
call fcn.004e58a0
add esp, 4
test al, al
je 0x44f36e
call fcn.004991e0
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 1
push 0x2e
push str.module_version.cc
call fcn.00499310
lea eax, [ebp - 0xb0]
push 0xd
push str.VerQueryValue
push eax
call fcn.004171b0
add esp, 0xc
mov ecx, edi
call fcn.004993c0
jmp 0x44f36e
push 1
call fcn.004e58a0
add esp, 4
test al, al
je 0x44f4a6
call fcn.004991e0
lea ecx, [ebp - 0xb8]
push eax
push 1
push 0x23
push str.module_version.cc
call fcn.00499310
lea eax, [ebp - 0xb0]
push 0x14
push str.GetFileVersionInfo:
push eax
call fcn.004171b0
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
js 0x44f42e
and ecx, 0x7f
jmp 0x44f433
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
test ecx, ecx
js 0x44f4be
mov dword [ebp - 0xcc], eax
test ebx, ebx
jne 0x44f449
test ecx, ecx
jne 0x44f4ad
lea edi, [ebp - 0xc4]
push ecx
push ebx
push edi
call fcn.004e3de0
add esp, 0xc
movzx eax, byte [edi + 0xb]
test al, al
js 0x44f467
and eax, 0x7f
jmp 0x44f473
mov eax, dword [ebp - 0xc0]
mov edi, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xcc]
push eax
push edi
push ecx
call fcn.004171b0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x44f49b
push dword [ebp - 0xc4]
call fcn.004e82d5
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004993c0
xor ebx, ebx
jmp 0x44f36e
push str.string_view::string_view__CharT___size_t_:_received_nullptr
push str.__len__0____s___nullptr
push 0x13c
jmp 0x44f4cd
push str.string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type
push str.__len___static_cast_size_type__numeric_limits_difference_type_::max___
push 0x13a
push str....._third_partylibc_srcinclude_string_view
push str._s:_d:_assertion__s_failed:__s_n
call fcn.00457520
int3
Function at 0x452f90
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov ecx, dword [ebp + 8]
mov eax, dword [0x547008]
xor eax, ebp
mov dword [esp + 0x28], eax
test ecx, ecx
je 0x4531b7
cmp dword [0x549208], 0xe69e32f3
jne 0x4531b4
mov esi, 0x308
mov edx, 0x20
mov edi, 0x20
add esi, dword [ecx + 8]
mov byte [esp + 0xf], 0xff
mov al, byte [ecx + 2]
je 0x452fe4
bsr edi, esi
xor edi, 0x1f
mov ecx, 0x52de94
sub ecx, edi
mov cl, byte [ecx]
mov ebx, esi
shr ebx, cl
sub edx, edi
and ebx, 7
lea ecx, [ebx + edx*8]
mov edx, dword [edx*4 + 0x52de98]
and edx, esi
cmp edx, 1
mov edx, dword [ebp + 8]
lea edi, [edx + 0x48]
sbb ecx, 0xffffffff
movzx ecx, word [ecx + ecx + 0x52dc60]
test al, al
mov dword [esp], esi
jne 0x453033
cmp esi, 0x41
setae al
cmp cx, 0x76
setb dl
and dl, al
movzx eax, dl
or eax, ecx
mov ecx, eax
movzx ebx, cx
shl ebx, 5
mov dword [esp + 4], edi
lea esi, [edi + ebx]
mov eax, dword [ebp + 8]
lea edi, [eax + 0x40]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x453058
mov ecx, edi
call fcn.00452c00
mov dword [esp + 8], edi
mov eax, dword [esi]
mov edi, dword [eax]
test edi, edi
je 0x453133
mov byte [esp + 0xf], 0
mov edx, dword [edi]
test edx, edx
je 0x45312c
mov ecx, dword [esp + 4]
mov ebx, dword [ecx + ebx + 0xc]
mov ecx, edx
bswap ecx
mov esi, ecx
xor esi, edi
cmp esi, 0x1fffff
ja 0x453183
mov esi, ecx
and esi, 0x1fc000
je 0x453183
prefetcht0 byte [ecx]
mov dword [eax], ecx
mov ecx, dword [eax + 0xc]
lea edx, [ecx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [eax + 0xc], ecx
mov esi, dword [ebp + 8]
mov eax, dword [eax + 8]
mov ecx, dword [esi + 0x117c]
add ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x1180]
mov dword [esi + 0x117c], ecx
cmp eax, ecx
cmova ecx, eax
mov dword [esi + 0x1180], ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, edi
push esi
call fcn.004531d0
push edi
push dword [0x5572b0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x54bb78]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x98], edi
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.004e8be6
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
jmp 0x4530a4
lea eax, [esp + 0xf]
mov ecx, esi
push eax
push 0x4000
push dword [esp + 8]
push 2
mov esi, dword [ebp + 8]
push esi
call fcn.004508a0
test eax, eax
je 0x4531ad
mov edi, eax
and eax, 0xffe00000
mov ecx, edi
shr ecx, 9
and ecx, 0x1fe0
or ecx, eax
mov eax, ecx
or eax, 0x1000
or ecx, 0x101e
movzx ecx, byte [ecx]
and ecx, 0x3f
shl ecx, 5
sub eax, ecx
jmp 0x4530c0
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi], xmm0
mov ecx, esi
push 0
push edx
push str.first
call fcn.00451660
push esi
call fcn.004117a0
add esp, 4
push ebx
call fcn.004516d0
xor edi, edi
jmp 0x4530e3
int3
int3
Function at 0x453880
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x453891
test eax, eax
jne 0x4538e1
test eax, eax
jne 0x4538a7
mov ecx, dword [0x557314]
test ecx, ecx
je 0x4538a7
call dword [section..00cfg]
call ecx
cmp dword [0x55730c], 0
je 0x4538e1
mov esi, dword [0x557310]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x4538e7
test esi, esi
je 0x4538e1
mov ecx, dword [0x55730c]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
pop esi
pop edi
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4538cb
Function at 0x45a970
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov esi, ecx
mov eax, dword [0x547008]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x212]
push 0x202
push 0xff
push ebx
call fcn.004ec220
add esp, 0xc
lea eax, [ebp - 0x218]
mov dword [eax], 0x101
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
test eax, eax
je 0x45a9fb
movzx edx, byte [esi + 0xb]
test dl, dl
js 0x45aa17
mov eax, 4
mov ebx, 0xa
sub ebx, eax
mov ecx, esi
push str.UICreated_
push 0xa
push edx
push 0
push edx
push ebx
push eax
call fcn.0047d310
lea ebx, [ebp - 0x212]
push ebx
call fcn.005043ab
add esp, 4
mov ecx, esi
push eax
push ebx
call fcn.0047d900
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8be6
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0x7fffffff
and eax, dword [esi + 8]
dec eax
cmp eax, 0xa
jae 0x45aa2a
mov edx, dword [esi + 4]
jmp 0x45a9c8
mov eax, dword [esi]
movups xmm0, xmmword [str.UICreated_]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0x5f0064
cmp byte [esi + 0xb], 0
js 0x45aa4f
mov byte [esi + 0xb], 0xa
mov word [eax + 0x14], 0
jmp 0x45a9e9
mov dword [esi + 4], 0xa
jmp 0x45aa47