joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423d60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov esi, ecx
mov eax, dword [0x64a040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x423d82
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x423e0d
mov bl, 1
test al, 0x10
je 0x423dab
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005810d5
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00557ce0
add esp, 4
test al, al
je 0x423e09
lea edi, [ebp - 0xb8]
mov ecx, edi
push 2
push 0x25f
push str.crash_report_database_win.cc
call fcn.0040ca50
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00545ec0
add esp, 0xc
push esi
push eax
call fcn.00453e60
add esp, 8
push 0x11
push str.:_not_a_directory
push eax
call fcn.00545ec0
add esp, 0xc
mov ecx, edi
call fcn.0040b060
xor ebx, ebx
jmp 0x423d94
push 2
call fcn.00557ce0
add esp, 4
test al, al
je 0x423e09
call fcn.00417770
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 2
push 0x25b
push str.crash_report_database_win.cc
call fcn.00409720
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00545ec0
add esp, 0xc
push esi
push eax
call fcn.00453e60
add esp, 8
mov ecx, edi
call fcn.00409610
jmp 0x423e09
Function at 0x424890
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, ecx
mov eax, dword [0x64a040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x10]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
mov eax, esp
push 0xac
push str.file_win.cc
push str.GetLength
push eax
call fcn.0051dbb0
add esp, 0x10
xor esi, esi
mov ecx, ebx
push esi
push esi
call fcn.00536a30
mov dword [esp + 0x4c], 0xa
mov al, byte [0x64f42e]
test al, al
jne 0x424938
xor eax, eax
dec eax
mov dword [esp + 4], eax
mov dword [esp], eax
mov eax, esp
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb esi, esi
mov edi, dword [esp + 4]
or edi, esi
or esi, dword [esp]
lea ecx, [esp + 0x10]
call fcn.00545870
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005810d5
mov eax, esi
mov edx, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, al
lea eax, [esp + 0x54]
mov edx, esp
mov dword [eax], edx
lea ebx, [esp + 0x50]
mov dword [ebx], str.ScopedBlockingCall
lea edx, [esp + 0x4c]
push eax
push ebx
call fcn.005da0b0
add esp, 8
jmp 0x4248f5
Function at 0x42a930
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [0x64a040]
xor esi, ebp
mov dword [ebp - 0x10], esi
mov ecx, dword [ecx]
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
or eax, 8
push esi
push 2
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x42a9e1
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x42a9e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esi + 1]
cmp eax, 2
jb 0x42a9dd
call fcn.005050f0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov dword [ebx], 0
mov al, 1
test esi, esi
je 0x42a9ef
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
je 0x42a9f4
call fcn.005050f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebx], esi
call fcn.005050f0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x18]
mov byte [ebx + 4], al
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005810d5
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
xor esi, esi
jmp 0x42a989
mov eax, ebx
mov byte [ebx], 0
mov dword [ebp - 0x18], 0
jmp 0x42a9c1
mov dword [ebp - 0x18], eax
jmp 0x42a9c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x42a9ba
Function at 0x42bf00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi], ecx
mov ebx, dword [eax]
mov dword [eax], ecx
lea edi, [ebx + 1]
cmp edi, 2
jb 0x42bf23
call fcn.005050f0
cmp dword [esi], ebx
je 0x42bf4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x42bf59
cmp edi, 2
jb 0x42bf44
mov dword [esi], ebx
call fcn.005050f0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005050f0
mov eax, dword [esi]
cmp dword [0x65b01c], 0
mov dword [ebp - 0x18], eax
je 0x42bf92
mov eax, dword [0x65b01c]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x6445dc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x42bf38
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6384a9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42bfce
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x42bfc8
call dword [0x6445dc]
call ecx
push 0
push eax
call fcn.004464e0
add esp, 8
jmp 0x42bf6c
push 1
push 0
jmp 0x42bfbe
xor eax, eax
push eax
jmp 0x42bfbd
Function at 0x42e1e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x64a040]
xor eax, ebp
mov dword [esp + 0x28], eax
test byte [ebp + 0xc], 0x40
je 0x42e2dc
xor esi, esi
dec esi
mov edi, 0xffffbfff
mov dword [esp + 4], esi
mov dword [esp], esi
mov eax, dword [0x64f6c4]
mov ecx, dword [0x64d82c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42e2f1
mov ecx, dword [0x64f6c0]
test ecx, ecx
je 0x42e343
call dword [0x6445dc]
push 8
lea eax, [esp + 4]
push eax
call ecx
test eax, eax
je 0x42e33d
mov ebx, dword [esp]
cmp edi, ebx
mov eax, esi
sbb eax, dword [esp + 4]
jb 0x42e209
shl ebx, 0xa
and ebx, 0xff0000
add ebx, 0x80000
xor esi, esi
jmp 0x42e28e
push 1
push 0x2000
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
add esi, edi
cmp esi, ebx
jae 0x42e2dc
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0xc], xmm0
movdqa xmmword [esp], xmm0
push 0x1c
lea eax, [esp + 4]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x42e2dc
mov eax, ebx
sub eax, esi
mov edi, dword [esp + 0xc]
mov ecx, 0xffff
add edi, ecx
and edi, 0xffff0000
cmp eax, edi
cmovb edi, eax
test esi, esi
je 0x42e288
cmp dword [esp + 0x10], 0x10000
jne 0x42e288
jmp 0x42e276
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.005810d5
mov al, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x64f6c4
call fcn.0057dc73
add esp, 4
cmp dword [0x64f6c4], 0xffffffff
jne 0x42e231
push str.bcryptprimitives.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x42e340
push str.ProcessPrng
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x64f6c0], eax
push 0x64f6c4
call fcn.0057dcc2
add esp, 4
jmp 0x42e231
int3
int3
push 8
lea eax, [esp + 4]
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x42e256
int3
Function at 0x4302d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x64c0b0]
cmp eax, 0xffffffff
je 0x430391
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x430391
mov eax, dword [0x6506f0]
mov ecx, dword [0x64d82c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x43039b
mov edi, dword [0x6506ec]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4303df
mov ecx, dword [0x64f6e4]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x64f6e8], 0
jne 0x4303eb
lea ecx, [ebx + 0x64f6e8]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x6506e8]
inc edx
mov dword [0x6506e8], edx
mov dword [ecx + 0xc], edx
mov dword [0x64f6e4], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x4303dc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00421b30
jmp 0x4302f5
push 0x6506f0
call fcn.0057dc73
add esp, 4
cmp dword [0x6506f0], 0xffffffff
jne 0x430316
push 4
call fcn.0057dc30
add esp, 4
mov dword [eax], 0
mov dword [0x6506ec], eax
push 0x6506f0
call fcn.0057dcc2
add esp, 4
jmp 0x430316
int3
mov ecx, edi
call fcn.0051c110
jmp 0x43032b
inc edx
cmp edx, 0x100
jne 0x430334
jmp 0x43037b

Function at 0x4356a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x64a040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
lea edi, [ebp - 0x18]
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [eax], 4
push eax
push edi
push esi
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x4356ea
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005810d5
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b180
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x43b1a3
call fcn.005050f0
mov dword [esi], 0
test ebx, ebx
je 0x43b1d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x43b1f8
cmp edi, 2
jb 0x43b1ca
mov dword [esi], ebx
call fcn.005050f0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + 4]
mov byte [esi + 4], al
mov byte [ecx + 4], 0
mov eax, dword [ecx]
inc eax
cmp eax, 2
jae 0x43b26d
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005050f0
mov eax, dword [esi]
cmp dword [0x65b01c], 0
mov dword [ebp - 0x18], eax
je 0x43b231
mov eax, dword [0x65b01c]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x6445dc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x43b1be
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6384a9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43b277
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x43b267
call dword [0x6445dc]
call ecx
push 0
push eax
call fcn.004464e0
add esp, 8
jmp 0x43b20b
push 1
push 0
jmp 0x43b25d
call fcn.0056f500
jmp 0x43b1ec
xor eax, eax
push eax
jmp 0x43b25c
Function at 0x440290
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x65dd50]
mov ecx, dword [0x64d82c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x44037e
push dword [0x64c0b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x4402df
mov ecx, dword [0x65dd48]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x65dd4c]
jne 0x4402df
cmp dword [eax + ecx*8], 0
jne 0x440350
push 4
call fcn.0057dc30
add esp, 4
mov esi, eax
mov dword [eax], 0
push dword [0x64c0b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
and eax, 0xfffffffc
je 0x440319
mov ecx, dword [0x65dd48]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x65dd4c]
jne 0x440319
mov edi, dword [eax + ecx*8]
push dword [0x64c0b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
jne 0x440333
test esi, esi
je 0x44034c
call fcn.00421b30
mov ecx, dword [0x65dd48]
mov dword [eax + ecx*8], esi
mov ecx, dword [0x65dd4c]
mov edx, dword [0x65dd48]
mov dword [eax + edx*8 + 4], ecx
test edi, edi
jne 0x4403cd
push dword [0x64c0b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
xor eax, eax
and ecx, 0xfffffffc
je 0x44037a
mov edx, dword [0x65dd48]
mov esi, dword [ecx + edx*8 + 4]
cmp esi, dword [0x65dd4c]
jne 0x44037a
mov eax, dword [ecx + edx*8]
pop esi
pop edi
pop ebp
ret
push 0x65dd50
call fcn.0057dc73
add esp, 4
cmp dword [0x65dd50], 0xffffffff
jne 0x4402b6
mov dword [0x65dd4c], 0
mov dword [0x65dd48], 0xffffffff
mov ecx, 0x65dd48
push 0x467600
call fcn.004302d0
push 0x65dd50
call fcn.0057dcc2
add esp, 4
jmp 0x4402b6
push edi
call fcn.0057dc2b
add esp, 4
jmp 0x440350

Function at 0x441090
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov esi, dword [ebp + 8]
mov eax, dword [0x64a040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.004090a0
add esp, 0x10
or edx, eax
jne 0x4410c7
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x4410dd
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005810d5
mov eax, ebx
add esp, 0xac
pop esi
pop ebx
pop ebp
ret
cmp dword [0x650774], 2
jg 0x441122
call fcn.00417770
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0xfc
push str.file_io_win.cc
call fcn.00409720
lea eax, [ebp - 0xac]
push 0xc
push 0x63f9b0
push eax
call fcn.00545ec0
add esp, 0xc
mov ecx, esi
call fcn.00409610
xor ebx, ebx
jmp 0x4410c7
Function at 0x441130
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x1c], edx
mov eax, dword [0x64a040]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x44123f
mov edi, ecx
xor esi, esi
lea eax, [ebp - 0x14]
mov dword [eax], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov ecx, ebx
mov ebx, eax
call ecx
push 2
push esi
push esi
lea ecx, [ebp - 0x14]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne byte [ebp - 0x15]
je 0x441248
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
cmp dword [esi], ebx
je 0x4411b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4411c7
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4411ab
mov dword [esi], ebx
call fcn.005050f0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005810d5
mov al, byte [ebp - 0x15]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005050f0
mov eax, dword [esi]
cmp dword [0x65b01c], 0
mov dword [ebp - 0x24], eax
je 0x441200
mov eax, dword [0x65b01c]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
call dword [0x6445dc]
mov ecx, dword [ebp - 0x1c]
push dword [ebp - 0x24]
call dword [ebp - 0x20]
mov dword [esi], 0
jmp 0x44119c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6384a9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x441255
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x441239
call dword [0x6445dc]
call ecx
push 0
push eax
call fcn.004464e0
add esp, 8
mov esi, dword [ebp - 0x1c]
jmp 0x4411da
push 1
push 0
jmp 0x44122c
mov byte [ebp - 0x15], 1
jmp 0x4411b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x4411ab
xor eax, eax
push eax
jmp 0x44122b
Function at 0x4422d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x44247d
cmp dword [esi], 0
jne 0x44247d
cmp dword [esi + 0xc], 0
jne 0x44247d
xor eax, eax
cmp dword [esi + 4], 0
jne 0x44247d
mov ebx, dword [edi]
cmp eax, ebx
je 0x44233a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4423c2
lea eax, [ebx + 1]
cmp eax, 2
jb 0x442330
mov dword [esi], ebx
call fcn.005050f0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x44236d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x442383
lea eax, [ebx + 1]
cmp eax, 2
jb 0x442363
mov dword [esi + 4], ebx
call fcn.005050f0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005050f0
mov eax, dword [esi + 4]
cmp dword [0x65b01c], 0
mov dword [ebp - 0x18], eax
je 0x44243e
mov eax, dword [0x65b01c]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x6445dc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi + 4], 0
jmp 0x442353
call fcn.005050f0
mov eax, dword [esi]
cmp dword [0x65b01c], 0
mov dword [ebp - 0x18], eax
je 0x4423fe
mov eax, dword [0x65b01c]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x6445dc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x442321
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6384a9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44249b
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x442438
call dword [0x6445dc]
call ecx
push 0
push eax
call fcn.004464e0
add esp, 8
jmp 0x4423d5
push 1
push 0
jmp 0x44242e
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6384a9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4424a0
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x442477
call dword [0x6445dc]
call ecx
push 0
push eax
call fcn.004464e0
add esp, 8
jmp 0x44239b
push 1
push 0
jmp 0x44246a
mov ecx, esi
call fcn.0056f500
lea ecx, [esi + 4]
call fcn.0056f500
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, dword [esi]
jmp 0x442307
xor eax, eax
push eax
jmp 0x44242d
xor eax, eax
push eax
jmp 0x442469
Function at 0x4429b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, ecx
mov eax, dword [0x64a040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
mov ecx, 0x65c2937b
xor eax, eax
lock cmpxchg dword [esi], ecx
jne 0x442b88
mov dword [0x64e5d8], edi
mov dword [0x64e668], edi
mov dword [0x64e66c], 1
mov dword [ebp - 0x38], esi
xor eax, eax
dec eax
lea ebx, [ebp - 0x34]
mov dword [ebx + 0x20], eax
pcmpeqd xmm0, xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push ebx
call edi
mov edx, edi
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0x1c]
cmp eax, ecx
cmova ecx, eax
mov dword [0x64e670], ecx
mov eax, 0x10
mov dword [0x64e674], eax
mov eax, 0x20
mov dword [0x64e678], eax
mov dword [0x64e67c], esi
mov dword [0x64e5dc], esi
mov eax, 0x64e5dc
xor eax, 0xb37cc16a
mov dword [0x64e5e0], eax
xor eax, eax
dec eax
mov dword [ebx + 0x20], eax
mov edi, dword [ebp - 0x38]
mov dword [0x64e5e4], 0x64e5d8
pxor xmm0, xmm0
movdqu xmmword [0x64e5ec], xmm0
movdqu xmmword [0x64e5fc], xmm0
movdqu xmmword [0x64e60c], xmm0
movdqu xmmword [0x64e61c], xmm0
movdqu xmmword [0x64e62c], xmm0
movdqu xmmword [0x64e63c], xmm0
movdqu xmmword [0x64e64c], xmm0
movdqu xmmword [0x64e658], xmm0
mov dword [0x64e680], esi
mov dword [0x64e710], esi
mov dword [0x64e714], esi
pcmpeqd xmm0, xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
push ebx
call edx
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0x1c]
cmp eax, ecx
cmova ecx, eax
mov dword [0x64e718], ecx
mov eax, 0x10
mov dword [0x64e71c], eax
mov eax, 0x20
mov dword [0x64e720], eax
mov dword [0x64e724], esi
mov dword [0x64e684], esi
mov eax, 0x64e684
xor eax, 0xb37cc16a
mov dword [0x64e688], eax
mov dword [0x64e68c], 0x64e680
pxor xmm0, xmm0
movdqu xmmword [0x64e694], xmm0
movdqu xmmword [0x64e6a4], xmm0
movdqu xmmword [0x64e6b4], xmm0
movdqu xmmword [0x64e6c4], xmm0
movdqu xmmword [0x64e6d4], xmm0
movdqu xmmword [0x64e6e4], xmm0
movdqu xmmword [0x64e6f4], xmm0
movdqu xmmword [0x64e700], xmm0
mov eax, 0xdd
xchg dword [edi], eax
cmp eax, 0x5a308d2
je 0x442b7b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005810d5
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
push edi
call fcn.005b2a30
add esp, 8
jmp 0x442b69
push edx
push 0x62c0a4
push 3
push esi
call fcn.00453d40
add esp, 0x10
test eax, eax
jne 0x442b69
jmp 0x4429d8
Function at 0x443a60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [ebp + 8]
mov cl, byte [ecx + 4]
cmp cl, byte [eax + 4]
je 0x443a8a
test cl, cl
jne 0x443a9a
test esi, esi
je 0x443a97
mov ecx, esi
push eax
call fcn.0042bf00
mov byte [esi + 4], 1
pop esi
pop ebp
ret 4
test cl, cl
je 0x443a85
mov ecx, esi
pop esi
pop ebp
jmp fcn.00443ab0
int3
mov ecx, esi
call fcn.0043b280
mov byte [esi + 4], 0
jmp 0x443a85

Function at 0x443ab0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x443ad3
call fcn.005050f0
cmp dword [esi], ebx
je 0x443afd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x443b09
cmp edi, 2
jb 0x443af4
mov dword [esi], ebx
call fcn.005050f0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005050f0
mov eax, dword [esi]
cmp dword [0x65b01c], 0
mov dword [ebp - 0x18], eax
je 0x443b42
mov eax, dword [0x65b01c]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x6445dc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x443ae8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6384a9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x443b7e
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x443b78
call dword [0x6445dc]
call ecx
push 0
push eax
call fcn.004464e0
add esp, 8
jmp 0x443b1c
push 1
push 0
jmp 0x443b6e
xor eax, eax
push eax
jmp 0x443b6d
Function at 0x444a60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [esi], esi
mov dword [esi + 4], esi
lea eax, [ecx + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ecx + 0x10]
mov dword [ebp - 0x18], eax
xor eax, eax
jmp 0x444aa9
mov ebx, eax
add eax, 8
push 0x22c
push dword [ebp - 0x10]
push eax
call fcn.005822f0
add esp, 0xc
mov dword [ebx + 4], esi
mov eax, dword [esi]
mov dword [ebx], eax
mov dword [eax + 4], ebx
mov dword [esi], ebx
mov eax, dword [esi + 8]
inc eax
mov dword [esi + 8], eax
push 0x228
push 0
push dword [ebp - 0x18]
call fcn.00582870
add esp, 0xc
mov dword [edi + 0xc], 0x22c
cmp byte [edi + 8], 0
je 0x444b04
push dword [ebp - 0x10]
push dword [edi + 4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x444b15
mov ebx, dword [edi + 0x238]
test ebx, ebx
jne 0x444b21
push 0x234
call fcn.0057dc30
add esp, 4
test eax, eax
jne 0x444a83
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
push 0x62a183
call fcn.005aacb0
mov byte [edi + 8], 1
push dword [ebp - 0x10]
push dword [edi + 4]
call sub.KERNEL32.dll_Process32FirstW
jmp 0x444ad6
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [ebx]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
call dword [0x6445dc]
mov ecx, ebx
push dword [ebp - 0x10]
call dword [ebp - 0x14]
test al, al
je 0x444aac
jmp 0x444ae4