joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413220
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x64a7e4]
test ebx, ebx
jne 0x4132a4
push 0x28
call fcn.00562f65
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.00562f65
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x4132ae
mov dword [eax + 8], edi
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x64a7e4], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x4132b1
mov edi, eax
push eax
call fcn.00564782
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00541fd0
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
int3
int3

Function at 0x414450
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x414473
call fcn.005018d0
cmp dword [esi], ebx
je 0x41449d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4144c2
cmp edi, 2
jb 0x414494
mov dword [esi], ebx
call fcn.005018d0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + 4]
mov byte [esi + 4], al
mov byte [ecx + 4], 0
mov eax, dword [ecx]
inc eax
cmp eax, 2
jae 0x414537
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005018d0
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x4144fb
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e19c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x414488
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x631a0d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414541
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x414531
call dword [0x63e19c]
call ecx
push 0
push eax
call fcn.0042a0c0
add esp, 8
jmp 0x4144d5
push 1
push 0
jmp 0x414527
call fcn.00555a50
jmp 0x4144b6
xor eax, eax
push eax
jmp 0x414526
Function at 0x414e70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], 0
mov byte [ecx + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
je 0x414f94
mov dword [esp], 0x18
call fcn.00562f65
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x80000018
mov dword [ebp - 0x18], 0x15
lea ecx, [eax + 0x15]
mov edx, str.ExitCodeWatcherThread
cmp eax, edx
seta bl
cmp ecx, edx
setbe cl
or cl, bl
je 0x414f97
lea ecx, [esi + 8]
movsd xmm0, qword [0x6237a1]
movsd qword [eax + 0xd], xmm0
movups xmm0, xmmword [str.ExitCodeWatcherThread]
movups xmmword [eax], xmm0
mov byte [eax + 0x15], 0
lea edi, [ebp - 0x1c]
mov dword [esp], edi
call fcn.00414fb0
sub esp, 4
cmp byte [edi + 0xb], 0
jns 0x414f11
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.00562f60
mov dword [esi + 0x50], 0x103
movsd xmm0, qword [0x623780]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
sub esp, 0x10
mov dword [esi + 0x54], 0
test eax, eax
je 0x414f67
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0x54]
inc eax
cmp eax, 2
jae 0x414f7b
lea eax, [edi + 1]
cmp eax, 2
jb 0x414f5b
mov dword [esi + 0x54], edi
call fcn.005018d0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005018d0
mov eax, dword [esi + 0x54]
mov dword [esp], eax
call fcn.00554600
mov dword [esi + 0x54], 0
jmp 0x414f4b
int3
mov dword [esp + 4], str....._third_partylibc_srcinclude__stringchar_traits.h:145:_assertion__std::__is_pointer_in_range___s1____s1____n____s2__failed:_char_traits::copy:_source_and_destination_ranges_overlap_n
mov dword [esp], 0x622e92
call fcn.00590170
int3
Function at 0x416bb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov ebx, esp
push 0x5f
push str.file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.0050b5e0
add esp, 0x10
xor eax, eax
mov ecx, edi
push eax
push eax
call fcn.005224f0
mov dword [esp + 0x4c], 0xa
mov al, byte [0x649456]
test al, al
jne 0x416c77
mov ecx, dword [ebp + 0xc]
test ecx, ecx
js 0x416c5b
mov eax, dword [ebp + 8]
mov dword [esp], 0xffffffff
push 0
push ebx
push ecx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x416c65
mov ebx, dword [esp]
test ebx, ebx
js 0x416c60
lea ecx, [esp + 0x10]
call fcn.005403a0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
dec ebx
jmp 0x416c3b
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x416c3b
movzx ecx, al
lea eax, [esp + 0x54]
mov dword [eax], ebx
lea edi, [esp + 0x50]
mov dword [edi], str.ScopedBlockingCall
lea edx, [esp + 0x4c]
push eax
push edi
call fcn.005b5f10
add esp, 8
jmp 0x416c12
Function at 0x41a290
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x80
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp byte [ecx], 1
je 0x41a2eb
cmp byte [esi + 0x1b], 0
js 0x41a2cc
cmp byte [esi + 0xf], 0
js 0x41a2d9
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00566245
add esp, 0x80
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call fcn.00562f60
jmp 0x41a2b2
mov eax, dword [esi + 4]
mov dword [esp], eax
call fcn.00562f60
jmp 0x41a2b8
mov ecx, dword [esi + 8]
jmp 0x41a30b
mov ecx, esi
call fcn.005c72e0
test al, al
je 0x41a3bb
mov ecx, esi
call fcn.005c7350
movsx eax, byte [esi + 0xf]
test eax, eax
js 0x41a2e6
mov ecx, eax
test ecx, ecx
je 0x41a3be
pxor xmm0, xmm0
movdqu xmmword [ebp - 0x1c], xmm0
movdqu xmmword [ebp - 0x2c], xmm0
movdqu xmmword [ebp - 0x3c], xmm0
movdqu xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x50], 0x44
lea ecx, [esi + 0x10]
pcmpeqd xmm0, xmm0
movdqu xmmword [ebp - 0x60], xmm0
cmp byte [esi + 0x1b], 0
jns 0x41a346
mov ecx, dword [ecx]
lea edx, [esi + 4]
test al, al
jns 0x41a34f
mov edx, dword [edx]
lea eax, [ebp - 0x60]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x50]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
movaps xmm0, xmmword [0x6343e0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x41a2ac
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
sub esp, 4
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
sub esp, 4
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call edi
sub esp, 4
jmp 0x41a2ac
int3
int3
Function at 0x41bc50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], 0x621a28
mov dword [ecx + 8], eax
mov ecx, 0x621a3c
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
mov byte [esi + 0x14], al
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
sub esp, 0x10
movsd xmm0, qword [0x623780]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
mov eax, dword [esi + 0x10]
test eax, eax
setne cl
cmp eax, edi
sete dl
and dl, cl
cmp dl, 1
je 0x41bd61
test eax, eax
jne 0x41bd66
mov dword [esi + 0x10], edi
cmp dword [0x64a79c], 3
setl al
test edi, edi
sete cl
and cl, al
cmp cl, 1
je 0x41bd7f
sub esp, 0x10
movsd xmm0, qword [0x623780]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
mov eax, dword [esi + 0x1c]
test eax, eax
setne cl
cmp eax, edi
sete dl
and dl, cl
cmp dl, 1
je 0x41bd61
test eax, eax
jne 0x41bd74
mov dword [esi + 0x1c], edi
cmp dword [0x64a79c], 3
setl al
test edi, edi
sete cl
and cl, al
cmp cl, 1
je 0x41bdbd
xor eax, eax
push eax
push eax
push esi
push 0x4f4ff0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x41bdfb
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, esi
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0057778c
push eax
call fcn.004f4ea0
add esp, 4
jmp 0x41bcc4
push eax
call fcn.004f4ea0
add esp, 4
jmp 0x41bd10
call fcn.004f27a0
lea edi, [ebp - 0xb4]
mov ecx, edi
push eax
push 2
push 0x5b
push str.session_end_watcher.cc
call fcn.00417d50
lea eax, [ebp - 0xac]
push 0xb
push str.CreateEvent
push eax
call fcn.00538270
add esp, 0xc
mov ecx, edi
call fcn.00416650
jmp 0x41bce1
call fcn.004f27a0
lea edi, [ebp - 0xb4]
mov ecx, edi
push eax
push 2
push 0x5e
push str.session_end_watcher.cc
call fcn.00417d50
lea eax, [ebp - 0xac]
push 0xb
push str.CreateEvent
push eax
call fcn.00538270
add esp, 0xc
mov ecx, edi
call fcn.00416650
jmp 0x41bd2d
lea ebx, [ebp - 0xb4]
push 0x1b
push str.thread_win.cc
push str.Start
push ebx
call fcn.0050b5e0
add esp, 0x10
lea edi, [ebp - 0x14]
push ebx
push edi
call fcn.005bb200
add esp, 8
mov ecx, edi
push 0x637650
call fcn.005d7b80
mov ecx, edi
call fcn.005907d0
jmp 0x41bd4a
Function at 0x41be40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [0x64a7e4]
test esi, esi
je 0x41be80
mov ecx, esi
push 0x62fd50
call fcn.00543200
test al, al
jne 0x41bea5
mov ecx, esi
push str.vmodule
call fcn.00543200
test al, al
jne 0x41bea5
mov eax, dword [edi]
mov dword [0x6460b4], eax
mov bl, 1
test al, 1
jne 0x41bf35
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x30]
mov ecx, esi
push 7
push str.vmodule
push eax
call fcn.00543320
lea ebx, [ebp - 0x1c]
mov ecx, esi
push 1
push 0x62fd50
push ebx
call fcn.00543320
push 0x10
call fcn.00562f65
add esp, 4
mov esi, eax
mov ecx, eax
push 0x64a79c
lea eax, [ebp - 0x30]
push eax
push ebx
call fcn.005c6b90
cmp byte [ebx + 0xb], 0
jns 0x41bef7
push dword [ebp - 0x1c]
call fcn.00562f60
add esp, 4
cmp byte [ebp - 0x25], 0
jns 0x41bf08
push dword [ebp - 0x30]
call fcn.00562f60
add esp, 4
test esi, esi
je 0x41be80
xor eax, eax
lock cmpxchg dword [0x64a7a0], esi
je 0x41be80
mov ecx, esi
call fcn.005c6c60
push esi
call fcn.00562f60
add esp, 4
jmp 0x41be80
mov eax, dword [0x64a794]
test eax, eax
je 0x41bf5f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x64a794], 0
cmp dword [0x64a798], 0
jne 0x41bf5f
and byte [0x6460b4], 0xfe
mov eax, dword [edi + 0x18]
test eax, eax
je 0x41bf7f
movsx ecx, byte [edi + 0xf]
test ecx, ecx
jns 0x41bf71
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x41bfea
mov dword [0x64a794], eax
jmp 0x41be91
movsx eax, byte [edi + 0xf]
test eax, eax
jns 0x41bf8a
mov eax, dword [edi + 8]
test eax, eax
je 0x41c02b
lea esi, [edi + 4]
mov ecx, dword [0x64a798]
test ecx, ecx
jne 0x41bfbe
push 0xc
call fcn.00562f65
add esp, 4
mov ecx, eax
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [0x64a798], eax
push esi
call fcn.0052b550
cmp dword [edi + 0x14], 0
jne 0x41bfde
mov eax, dword [0x64a798]
cmp byte [eax + 0xb], 0
jns 0x41bfd7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0040c560
mov ebx, eax
jmp 0x41be91
lea eax, [ebp - 0x30]
push 0x246
push str.logging.cc
push str.BaseInitLoggingImpl_built_with_NDEBUG
push eax
call fcn.0050b5e0
add esp, 0x10
lea esi, [ebp - 0x20]
lea eax, [ebp - 0x30]
push eax
push 0x7f
push str.settings.log_file_path.empty__
push esi
call fcn.00590d00
add esp, 0x10
mov ecx, esi
call fcn.005907d0
mov eax, dword [edi + 0x18]
jmp 0x41bf75
lea ebx, [ebp - 0x30]
push 0x24c
push str.logging.cc
push str.BaseInitLoggingImpl_built_with_NDEBUG
push ebx
call fcn.0050b5e0
add esp, 0x10
lea esi, [ebp - 0x1c]
push ebx
push 0x7f
push str._settings.log_file_path.empty__
push esi
call fcn.00590d00
add esp, 0x10
mov ecx, esi
call fcn.00590980
push 0x25
push str.LOG_TO_FILE_set_but_no_log_file_path_
push eax
call fcn.00538270
add esp, 0xc
mov ecx, esi
call fcn.005907d0
jmp 0x41bf92
Function at 0x41c700
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x22c
push str.file_util_win.cc
push str.PathExists
push ebx
call fcn.0050b5e0
add esp, 0x10
xor eax, eax
mov ecx, esi
push eax
push eax
call fcn.005224f0
mov dword [esp + 0x4c], 0xa
mov al, byte [0x649456]
test al, al
jne 0x41c799
cmp byte [edi + 0xb], 0
jns 0x41c76e
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
lea ecx, [esp + 0x10]
call fcn.005403a0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, al
lea eax, [esp + 0x54]
mov dword [eax], ebx
lea esi, [esp + 0x50]
mov dword [esi], str.ScopedBlockingCall
lea edx, [esp + 0x4c]
push eax
push esi
call fcn.005b5f10
add esp, 8
jmp 0x41c766
Function at 0x41dc80
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movaps xmm0, xmmword [0x639b60]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x41dcb0
mov eax, dword [edi]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x110000
call ebx
cmp eax, 0xffffffff
je 0x41dd4d
mov esi, eax
lea eax, [ebp - 0xb4]
mov dword [eax], 2
xor edi, edi
push edi
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x41de64
lea eax, [ebp - 0xb8]
mov dword [eax], edi
push edi
push eax
push 0xc
push dword [ebp + 0x10]
push 0x24
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x41de98
mov bl, 1
cmp dword [ebp - 0xb8], 0xc
jne 0x41ddf9
push esi
call fcn.0044c4c0
add esp, 4
test al, al
je 0x41dd4a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x41ddb0
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x41dd64
mov eax, dword [edi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
movaps xmm0, xmmword [0x639b60]
jne 0x41dca6
cmp dword [0x64a79c], 2
jg 0x41ddf2
call fcn.004f27a0
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x71
push str.registration_protocol_win.cc
call fcn.00417d50
lea eax, [ebp - 0xa8]
push 0xd
push str.WaitNamedPipe
jmp 0x41dde2
cmp dword [0x64a79c], 2
jg 0x41ddf2
call fcn.004f27a0
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x6c
push str.registration_protocol_win.cc
call fcn.00417d50
lea eax, [ebp - 0xa8]
push 0xa
push str.CreateFile
push eax
call fcn.00538270
add esp, 0xc
mov ecx, esi
call fcn.00416650
xor ebx, ebx
jmp 0x41dd33
cmp dword [0x64a79c], 2
jg 0x41dedd
lea edi, [ebp - 0xb0]
mov ecx, edi
push 2
push 0x8c
push str.registration_protocol_win.cc
call fcn.0040b160
lea eax, [ebp - 0xa8]
push 0x1c
push str.TransactNamedPipe:_expected
push eax
call fcn.00538270
add esp, 0xc
mov ecx, eax
push 0xc
call fcn.0040c8e0
push 0xb
push str.__observed
push eax
call fcn.00538270
add esp, 0xc
mov ecx, eax
push dword [ebp - 0xb8]
call fcn.0042a3e0
mov ecx, edi
call fcn.0040a930
jmp 0x41dedd
cmp dword [0x64a79c], 2
jg 0x41dedd
call fcn.004f27a0
lea edi, [ebp - 0xb0]
mov ecx, edi
push eax
push 2
push 0x7a
push str.registration_protocol_win.cc
call fcn.00417d50
lea eax, [ebp - 0xa8]
push 0x17
push 0x639bd6
jmp 0x41decd
cmp dword [0x64a79c], 2
jg 0x41dedd
call fcn.004f27a0
lea edi, [ebp - 0xb0]
mov ecx, edi
push eax
push 2
push 0x88
push str.registration_protocol_win.cc
call fcn.00417d50
lea eax, [ebp - 0xa8]
push 0x11
push 0x639bee
push eax
call fcn.00538270
add esp, 0xc
mov ecx, edi
call fcn.00416650
xor ebx, ebx
jmp 0x41dd26
Function at 0x41e8b0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x804
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [0x6460b0]
cmp esi, 0xffffffff
je 0x41e945
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x41e977
mov ebx, 0x800
lea eax, [ebp - 0x810]
push ebx
push 0
push eax
call fcn.005679e0
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.005648ee
add esp, 4
mov edi, eax
push ebx
lea eax, [ebp - 0x810]
push eax
push edi
call fcn.00567460
add esp, 0xc
mov eax, edi
or eax, 3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, edi
add esp, 0x804
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x41e97a
mov esi, eax
xor eax, eax
dec eax
lock cmpxchg dword [0x6460b0], esi
je 0x41e8d1
push esi
call fcn.005c2ec0
add esp, 4
mov esi, dword [0x6460b0]
jmp 0x41e8d1
int3
int3
Function at 0x41fc80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10014
call fcn.00566670
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
dec edi
lea esi, [ebp - 0x1001c]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
push edx
push ecx
push esi
call fcn.00528780
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x41fd4c
lea ebx, [ebp - 0x1000e]
push 0xfffe
push 0xff
push ebx
call fcn.005679e0
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x41fce8
mov esi, dword [ebp - 0x1001c]
push 0x7fff
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne byte [ebp - 0x1001d]
jne 0x41fd34
mov bl, byte [ebp - 0x1001d]
cmp byte [ebp - 0x10011], 0
jns 0x41fd1d
push dword [ebp - 0x1001c]
call fcn.00562f60
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
add esp, 0x10014
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, eax
cmp eax, 0x7ffe
ja 0x41fd75
push dword [ebp + 8]
push esi
push ebx
call fcn.004405f0
add esp, 0xc
jmp 0x41fd00
cmp byte [ebp - 0x10011], 0
js 0x41fd5d
lea eax, [ebp - 0x1001c]
jmp 0x41fd63
mov eax, dword [ebp - 0x1001c]
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x41fd06
lea eax, [esi + esi]
test esi, esi
cmovns edi, eax
push edi
call fcn.005648ee
add esp, 4
mov ebx, eax
push edi
push 0
push eax
call fcn.005679e0
add esp, 0xc
cmp byte [ebp - 0x10011], 0
js 0x41fda5
lea eax, [ebp - 0x1001c]
jmp 0x41fdab
mov eax, dword [ebp - 0x1001c]
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec esi
push dword [ebp + 8]
push esi
push ebx
call fcn.004405f0
add esp, 0xc
test ebx, ebx
je 0x41fd00
push ebx
call fcn.0056477d
add esp, 4
jmp 0x41fd00
Function at 0x421060
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x10]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
mov eax, esp
push 0xac
push str.file_win.cc
push str.GetLength
push eax
call fcn.0050b5e0
add esp, 0x10
xor esi, esi
mov ecx, ebx
push esi
push esi
call fcn.005224f0
mov dword [esp + 0x4c], 0xa
mov al, byte [0x649456]
test al, al
jne 0x421108
xor eax, eax
dec eax
mov dword [esp + 4], eax
mov dword [esp], eax
mov eax, esp
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb esi, esi
mov edi, dword [esp + 4]
or edi, esi
or esi, dword [esp]
lea ecx, [esp + 0x10]
call fcn.005403a0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00566245
mov eax, esi
mov edx, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, al
lea eax, [esp + 0x54]
mov edx, esp
mov dword [eax], edx
lea ebx, [esp + 0x50]
mov dword [ebx], str.ScopedBlockingCall
lea edx, [esp + 0x4c]
push eax
push ebx
call fcn.005b5f10
add esp, 8
jmp 0x4210c5

Function at 0x424dd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x6460b0]
cmp eax, 0xffffffff
je 0x424e91
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x424e91
mov eax, dword [0x64a718]
mov ecx, dword [0x64784c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x424e9b
mov edi, dword [0x64a714]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x424edf
mov ecx, dword [0x64970c]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x649710], 0
jne 0x424eeb
lea ecx, [ebx + 0x649710]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x64a710]
inc edx
mov dword [0x64a710], edx
mov dword [ecx + 0xc], edx
mov dword [0x64970c], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x424edc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0041e8b0
jmp 0x424df5
push 0x64a718
call fcn.00562fa8
add esp, 4
cmp dword [0x64a718], 0xffffffff
jne 0x424e16
push 4
call fcn.00562f65
add esp, 4
mov dword [eax], 0
mov dword [0x64a714], eax
push 0x64a718
call fcn.00562ff7
add esp, 4
jmp 0x424e16
int3
mov ecx, edi
call fcn.0050aab0
jmp 0x424e2b
inc edx
cmp edx, 0x100
jne 0x424e34
jmp 0x424e7b