joyce8/EMBER2024-capa huggingface dataset:
Function at 0x525a49
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x58e700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00511f90
mov dword [ebp - 0x14], eax
cmp dword [0x595134], esi
jne 0x525b3c
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x525ac9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x525c1c
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x525c1c
push 0x560ea0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x525c1c
push eax
call ebx
push 0x560eac
push edi
mov dword [0x595134], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x560ebc
push edi
mov dword [0x595138], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x59513c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x595144], eax
test eax, eax
je 0x525b39
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x595140], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x525b61
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x525b54
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x525b76
push 4
pop eax
jmp 0x525c1e
cmp dword [ebp - 0x14], esi
je 0x525b76
push dword [0x595134]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x525b5b
mov eax, dword [0x595140]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x525bd4
cmp dword [0x595144], edi
je 0x525bd4
push eax
call ebx
push dword [0x595144]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x525bd4
test eax, eax
je 0x525bd4
call ecx
test eax, eax
je 0x525bc9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x525bc9
test byte [ebp - 8], 1
jne 0x525bd4
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x525c04
mov eax, dword [0x595138]
cmp eax, edi
je 0x525c01
push eax
call ebx
test eax, eax
je 0x525c01
call eax
mov esi, eax
test esi, esi
je 0x525c01
mov eax, dword [0x59513c]
cmp eax, edi
je 0x525c01
push eax
call ebx
test eax, eax
je 0x525c01
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x595134]
call ebx
test eax, eax
je 0x525c1c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x525c1e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00502653
mov esp, ebp
pop ebp
ret
Function at 0x408a9a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x408ace
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call fcn.00408ad6
lea eax, [ebx + 1]
cmp eax, 2
jb 0x408ac7
mov dword [esi], ebx
call fcn.004835e0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x40cc92
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0xc], eax
push esi
call fcn.00421d40
add esp, 4
test al, al
je 0x40ccf1
lea ecx, [ebp - 0x14]
call fcn.00423f5c
cmp byte [esi + 0xb], 0
jns 0x40ccc7
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x40ccfe
xor esi, esi
push eax
call fcn.00421f83
add esp, 4
test al, al
jne 0x40cd06
mov dword [edi], 0xffffffff
mov esi, 2
jmp 0x40cd06
mov dword [edi], 0xffffffff
mov esi, 0x10000011
jmp 0x40cd0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x14]
call fcn.004241aa
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00596351
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebp
ret

Function at 0x40ce13
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb4
mov esi, dword [ebp + 8]
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
test esi, esi
je 0x40cec5
mov ecx, esi
push 0x200
call fcn.0040cede
lea edi, [ebp - 0x14]
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 1
mov ecx, esi
push eax
call fcn.0040cede
mov eax, dword [esi]
mov ebx, dword [esi + 4]
sub ebx, eax
push edi
push ebx
push eax
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x40ce7b
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x40ce43
shr eax, 2
mov ecx, esi
push eax
call fcn.0040cede
mov bl, 1
jmp 0x40cec7
push 2
call fcn.00483a10
add esp, 4
test al, al
je 0x40cec5
call fcn.00484390
lea esi, [ebp - 0xc0]
mov ecx, esi
push eax
push 2
push 0x156
push str..._.._chrome_chrome_cleaner_engines_broker_scanner_sandbox_interface.cc
call fcn.004844c0
lea eax, [ebp - 0xb8]
push 0x1d
push str.Failed_to_enumerate_processes
push eax
call fcn.00401baa
add esp, 0xc
mov ecx, esi
call fcn.00484570
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41ea3e
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
test cl, cl
mov esi, dword [eax]
mov edx, dword [eax + 4]
lea edi, [esi + edx*2]
lea edx, [eax + ecx*2]
cmovs edx, edi
cmovs eax, esi
sub edx, eax
mov ecx, edx
cmp edx, 4
jb 0x41ea8c
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x41ea66
cmp edx, 1
je 0x41eaad
cmp edx, 2
je 0x41eaa4
cmp edx, 3
jne 0x41eab8
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x4217a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xac
mov edi, dword [ebp + 8]
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 2
call fcn.00483a10
add esp, 4
test al, al
je 0x421801
lea esi, [ebp - 0xb4]
mov ecx, esi
push 2
push 0x10
push str..._.._chrome_chrome_cleaner_os_early_exit.cc
call fcn.00483ab0
lea eax, [ebp - 0xac]
push 0x15
push str.Early_exit_with_code
push eax
call fcn.00401baa
add esp, 0xc
mov ecx, eax
push edi
call fcn.00462e50
mov ecx, esi
call fcn.00483e50
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00596351
add esp, 0xac
pop esi
pop edi
pop ebp
ret

Function at 0x421f92
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, dword [ebp + 8]
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x421fb5
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x421fce
test eax, 0x441000
sete bl
jmp 0x42205b
push 2
call fcn.00483a10
add esp, 4
test al, al
je 0x422059
call fcn.00484390
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x144
push str..._.._chrome_chrome_cleaner_os_file_path_sanitization.cc
call fcn.004844c0
lea eax, [ebp - 0xb4]
push 0x2f
push str.IsFilePresentLocally_failed_to_get_attributes:
push eax
call fcn.00401baa
add esp, 0xc
mov esi, eax
lea ebx, [ebp - 0xc8]
push edi
push ebx
call fcn.004219d7
add esp, 8
cmp byte [ebx + 0xb], 0
jns 0x42202d
mov ebx, dword [ebp - 0xc8]
push ebx
push esi
call fcn.00484610
add esp, 8
cmp byte [ebp - 0xbd], 0
jns 0x42204e
push dword [ebp - 0xc8]
call fcn.00596316
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.00484570
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x423608
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2e0
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [esp + 0x2d8], eax
xor eax, eax
lea ebx, [esp + 0xbc]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov edi, 0x80
lea eax, [edi + edi]
mov ecx, ebx
push eax
call fcn.0040cede
shl edi, 3
push 3
lea eax, [esp + 0x14]
push eax
push edi
push dword [esp + 0xc8]
push dword [ebp + 8]
call sub.KERNEL32.dll_K32EnumProcessModulesEx
test eax, eax
je 0x4237ba
mov esi, dword [esp + 0x10]
mov edi, esi
shr edi, 2
mov edx, dword [esp + 0xbc]
mov ecx, dword [esp + 0xc0]
sub ecx, edx
sar ecx, 2
cmp edi, ecx
ja 0x42363b
mov dword [esp + 4], eax
test edi, edi
lea edi, [esp + 0x10]
je 0x423807
shr esi, 2
dec esi
mov dword [esp + 8], esi
xor ecx, ecx
push 0x104
lea eax, [esp + 0xd4]
push eax
mov dword [esp + 0x14], ecx
push dword [edx + ecx*4]
push dword [ebp + 8]
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x4236eb
mov ebx, eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
cmp ebx, 0x7ffffff0
jae 0x423843
cmp ebx, 5
jae 0x423730
mov byte [esp + 0x1b], bl
mov ecx, edi
jmp 0x423760
push 2
call fcn.00483a10
add esp, 4
test al, al
je 0x4237a3
call fcn.00484390
mov ecx, edi
push eax
push 2
push 0x2c
push str..._.._chrome_chrome_cleaner_os_process.cc
call fcn.004844c0
push 0x1d
push str.Failed_to_get_module_filename
lea eax, [esp + 0x20]
push eax
call fcn.00401baa
add esp, 0xc
mov ecx, edi
call fcn.00484570
jmp 0x4237a3
lea esi, [ebx + 8]
and esi, 0xfffffff8
js 0x42384c
lea eax, [esi + esi]
push eax
call fcn.00596296
add esp, 4
mov ecx, eax
mov dword [esp + 0x10], eax
or esi, 0x80000000
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
lea edi, [esp + 0x10]
mov eax, ebx
add eax, ebx
push eax
lea eax, [esp + 0xd4]
push eax
push ecx
mov esi, ecx
call fcn.00599c40
add esp, 0xc
mov word [esi + ebx*2], 0
mov ecx, dword [ebp + 0xc]
push edi
push edi
lea eax, [esp + 0xd0]
push eax
call fcn.00423b36
cmp byte [esp + 0x1b], 0
jns 0x4237a3
push dword [esp + 0x10]
call fcn.00596316
add esp, 4
mov ecx, dword [esp + 0xc]
cmp dword [esp + 8], ecx
je 0x423807
inc ecx
mov edx, dword [esp + 0xbc]
jmp 0x4236a2
mov esi, eax
push 2
call fcn.00483a10
add esp, 4
test al, al
je 0x42380b
call fcn.00484390
lea edi, [esp + 0xd0]
mov ecx, edi
push eax
push 2
push 0x1f
push str..._.._chrome_chrome_cleaner_os_process.cc
call fcn.004844c0
lea eax, [esp + 0xd8]
push 0x1b
push str.Failed_to_enumerate_modules
push eax
call fcn.00401baa
add esp, 0xc
mov ecx, edi
call fcn.00484570
jmp 0x42380b
mov esi, dword [esp + 4]
mov eax, dword [esp + 0xbc]
test eax, eax
je 0x423826
mov dword [esp + 0xc0], eax
push eax
call fcn.00596316
add esp, 4
test esi, esi
setne bl
mov ecx, dword [esp + 0x2d8]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x10]
call fcn.00478354
call fcn.005aa3fa
Function at 0x42b538
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
mov esi, dword [eax]
mov edi, dword [eax + 4]
add edi, esi
mov edx, ecx
add edx, eax
test cl, cl
cmovs edx, edi
cmovs eax, esi
sub edx, eax
mov ecx, edx
cmp edx, 4
jb 0x42b586
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x42b560
cmp edx, 1
je 0x42b5a7
cmp edx, 2
je 0x42b59e
cmp edx, 3
jne 0x42b5b2
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4
Function at 0x42c1e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm1, xmmword [ecx]
movdqu xmm2, xmmword [ecx + 0x10]
movdqu xmm4, xmmword [ecx + 0x20]
movdqu xmm3, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm1
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x42c2ce
nop word cs:[eax + eax]
nop
movdqa xmm6, xmm0
movdqa xmm1, xmmword [0x5c7ed0]
pclmulqdq xmm6, xmm1, 0
movdqa xmm5, xmmword [0x5c7ee0]
pclmulqdq xmm0, xmm5, 0x11
movdqa xmm7, xmm0
pxor xmm7, xmm6
movdqa xmm0, xmm2
movdqa xmm1, xmmword [0x5c7ed0]
pclmulqdq xmm0, xmm1, 0
pclmulqdq xmm2, xmm5, 0x11
movdqa xmm6, xmm2
pxor xmm6, xmm0
movdqa xmm0, xmm4
pclmulqdq xmm0, xmm1, 0
movdqa xmm2, xmm1
pclmulqdq xmm4, xmm5, 0x11
movdqa xmm1, xmm4
pxor xmm1, xmm0
movdqa xmm0, xmm3
pclmulqdq xmm0, xmm2, 0
pclmulqdq xmm3, xmm5, 0x11
movdqa xmm5, xmm3
pxor xmm5, xmm0
movdqu xmm0, xmmword [ecx]
pxor xmm0, xmm7
movdqu xmm2, xmmword [ecx + 0x10]
pxor xmm2, xmm6
movdqu xmm4, xmmword [ecx + 0x20]
pxor xmm4, xmm1
movdqu xmm3, xmmword [ecx + 0x30]
pxor xmm3, xmm5
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x42c220
movdqa xmm1, xmmword [0x5c7ef0]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm1, 0
pxor xmm5, xmm2
movdqa xmm2, xmmword [0x5c7f00]
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm1, 0
pxor xmm5, xmm4
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm5
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm3
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm4
cmp eax, 0x10
jb 0x42c408
lea edx, [eax - 0x10]
mov esi, edx
shr esi, 4
add esi, 1
and esi, 3
je 0x42c367
nop
movdqu xmm3, xmmword [ecx]
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm3
pclmulqdq xmm0, xmm2, 0x11
pxor xmm0, xmm4
add ecx, 0x10
add eax, 0xfffffff0
add esi, 0xffffffff
jne 0x42c340
movdqa xmm3, xmm0
cmp edx, 0x30
jb 0x42c40c
nop word cs:[eax + eax]
nop
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm1, 0
pclmulqdq xmm0, xmm2, 0x11
movdqu xmm3, xmmword [ecx]
pxor xmm3, xmm4
pxor xmm3, xmm0
movdqu xmm0, xmmword [ecx + 0x10]
movdqa xmm4, xmm3
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm0
pclmulqdq xmm3, xmm2, 0x11
pxor xmm3, xmm4
movdqu xmm0, xmmword [ecx + 0x20]
movdqa xmm4, xmm3
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm0
pclmulqdq xmm3, xmm2, 0x11
pxor xmm3, xmm4
movdqu xmm0, xmmword [ecx + 0x30]
movdqa xmm4, xmm3
pclmulqdq xmm4, xmm1, 0
pxor xmm4, xmm0
pclmulqdq xmm3, xmm2, 0x11
pxor xmm3, xmm4
add eax, 0xffffffc0
add ecx, 0x40
movdqa xmm0, xmm3
cmp eax, 0xf
ja 0x42c380
jmp 0x42c40c
movdqa xmm3, xmm0
movdqa xmm0, xmmword [0x5c7f00]
pclmulqdq xmm0, xmm3, 1
psrldq xmm3, 8
pxor xmm3, xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
pblendw xmm1, xmm3, 3
psrldq xmm3, 4
pclmulqdq xmm1, xmmword [0x5c7f10], 0
pxor xmm1, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm1, 3
pclmulqdq xmm2, xmmword [0x5c7f20], 0x10
pblendw xmm2, xmm0, 0xfc
pclmulqdq xmm2, xmmword [0x5c7f30], 0
pxor xmm2, xmm1
pextrd eax, xmm2, 1
pop esi
pop ebp
ret
Function at 0x43d1d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1b8
mov esi, ecx
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
lea ebx, [ebp - 0x110]
push 0
push eax
push 0x100
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43d266
lea eax, [ebp - 0x1c4]
push 0
push dword [ebp - 0x114]
push ebx
push eax
call fcn.0043d8b0
add esp, 0x10
mov ecx, dword [ebp - 0x1c4]
test ecx, ecx
je 0x43d2ca
call fcn.0043de10
cmp eax, 7
jbe 0x43d2ca
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x1c4]
call fcn.0043dc00
cmp dword [eax], edi
jne 0x43d326
mov eax, dword [ebp - 0x1c4]
mov dword [esi], eax
jmp 0x43d2b3
push 2
call fcn.00483a10
add esp, 4
test al, al
je 0x43d2ad
call fcn.00484390
lea edi, [ebp - 0x1c0]
mov ecx, edi
push eax
push 2
push 0x38
push str..._.._mojo_core_broker_win.cc
call fcn.004844c0
lea eax, [ebp - 0x1b8]
push 0x19
push str.Error_reading_broker_pipe
push eax
call fcn.00401baa
add esp, 0xc
mov ecx, edi
call fcn.00484570
mov dword [esi], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
mov eax, esi
add esp, 0x1b8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00483a10
add esp, 4
test al, al
je 0x43d30b
lea esi, [ebp - 0x1c0]
mov ecx, esi
push 2
push 0x3f
push str..._.._mojo_core_broker_win.cc
call fcn.00483ab0
lea eax, [ebp - 0x1b8]
push 0x16
push str.Invalid_broker_message
push eax
call fcn.00401baa
add esp, 0xc
mov ecx, esi
call fcn.00483e50
push ebx
call fcn.00413500
add esp, 4
lea eax, [ebp - 0x114]
push eax
call fcn.00413500
add esp, 4
int3
push 2
call fcn.00483a10
add esp, 4
test al, al
je 0x43d367
lea esi, [ebp - 0x1c0]
mov ecx, esi
push 2
push 0x4a
push str..._.._mojo_core_broker_win.cc
call fcn.00483ab0
lea eax, [ebp - 0x1b8]
push 0x1e
push str.Unexpected_broker_message_type
push eax
call fcn.00401baa
add esp, 0xc
mov ecx, esi
call fcn.00483e50
push ebx
call fcn.00413500
add esp, 4
lea eax, [ebp - 0x114]
push eax
call fcn.00413500
add esp, 4
int3
Function at 0x43f830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
mov ecx, edx
push eax
call fcn.0043e080
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
cmp ebx, esi
je 0x43f86e
nop dword [eax]
mov ecx, ebx
call fcn.00454bd0
add ebx, 0x10
cmp esi, ebx
jne 0x43f860
mov esi, dword [ebp - 0x20]
lea eax, [esi + 0x70]
push eax
push 0
push dword [edi + 8]
push dword [edi]
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43f896
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x43f8a6
mov byte [esi + 0x9a], 1
lock add dword [esi + 4], 1
mov bl, 1
jmp 0x43f8a8
xor ebx, ebx
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x43f8e1
mov esi, dword [ebp - 0x18]
cmp esi, edi
je 0x43f8d3
nop word cs:[eax + eax]
add esi, 0xfffffff0
mov ecx, esi
call fcn.00454b40
cmp edi, esi
jne 0x43f8c0
mov eax, dword [ebp - 0x1c]
jmp 0x43f8d5
mov eax, edi
mov dword [ebp - 0x18], edi
push eax
call fcn.00596316
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596351
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44a330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [0x6401e4]
xor eax, ebp
mov dword [esp + 0x28], eax
mov eax, dword [ecx + 8]
mov ecx, dword [eax + 0x20]
lea eax, [edi + 0x10]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.004c83b0
test eax, eax
je 0x44a38e
mov eax, dword [edi + 0x38]
test eax, eax
jne 0x44a37c
cmp byte [edi + 0x40], 0
jne 0x44a37c
mov eax, dword [edi + 0x44]
test eax, eax
je 0x44a501
mov dword [esi], 0
mov dword [esi + 4], 0
jmp 0x44a44c
movzx eax, byte [esp + 0x10]
cmp byte [esp + 0x12], 0
je 0x44a3b3
mov cl, byte [esp + 0x11]
or cl, al
movzx edx, cl
or eax, 4
or edx, 0x24
mov ebx, eax
cmp byte [edi + 0x68], 0
jne 0x44a3cb
jmp 0x44a3da
movzx ebx, byte [esp + 0x13]
shl ebx, 4
or ebx, eax
or ebx, 2
mov edx, 0x37
cmp byte [edi + 0x68], 0
je 0x44a3da
mov eax, dword [edi + 0x70]
mov ecx, dword [edi + 0x74]
cmp eax, dword [esp + 0x14]
sbb ecx, 0
jb 0x44a3f5
cmp byte [edi + 0x78], 0
je 0x44a3fa
mov eax, dword [edi + 0x80]
mov ecx, dword [edi + 0x84]
cmp eax, dword [esp + 0x18]
sbb ecx, 0
jae 0x44a3fa
or ebx, 0x20
jmp 0x44a426
cmp byte [edi + 0x88], 0
je 0x44a426
mov eax, dword [edi + 0x90]
mov ecx, dword [edi + 0x94]
mov dword [esp + 4], edx
mov edx, ebx
or edx, 0x20
cmp eax, dword [esp + 0x1c]
sbb ecx, 0
cmovb ebx, edx
mov edx, dword [esp + 4]
mov eax, dword [edi + 0x3c]
mov dword [edi + 0x3c], ebx
test bl, 4
je 0x44a447
and eax, 4
jne 0x44a447
mov dword [esp + 4], edx
test byte [0x63f84c], 0x19
jne 0x44a463
mov edx, dword [esp + 4]
mov dword [esi + 4], edx
mov dword [esi], ebx
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.00596351
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, 1
sub eax, dword [edi + 0x30]
mov ecx, eax
sar ecx, 0x1f
add eax, dword [edi + 0x28]
mov dword [esp + 0xc], eax
adc ecx, dword [edi + 0x2c]
mov dword [esp + 8], ecx
call fcn.0047aa60
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.0049af70
add esp, 4
push 0x82
push 0
lea eax, [esp + 0x28]
push eax
push edi
push dword [esp + 0x18]
push dword [esp + 0x20]
push 0
push 0
push 0
push str.MessagePipe_peer_closed
push 0x63f84c
push 0x58
call fcn.004a0f80
add esp, 0x30
cmp byte [0x63f84c], 0
je 0x44a443
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
sub esp, 0x10
movsd xmm0, qword [esp + 0x30]
movsd qword [esp + 8], xmm0
mov dword [esp + 4], str.MessagePipe_peer_closed
mov dword [esp], 0x63f84c
call fcn.004a10b0
add esp, 0x10
jmp 0x44a443
int3