joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425370
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x425393
call fcn.005018d0
mov dword [esi], 0
test ebx, ebx
je 0x4253c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4253e8
cmp edi, 2
jb 0x4253ba
mov dword [esi], ebx
call fcn.005018d0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + 4]
mov byte [esi + 4], al
mov byte [ecx + 4], 0
mov eax, dword [ecx]
inc eax
cmp eax, 2
jae 0x42545d
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005018d0
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x425421
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e19c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x4253ae
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x631a0d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x425467
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x425457
call dword [0x63e19c]
call ecx
push 0
push eax
call fcn.0042a0c0
add esp, 8
jmp 0x4253fb
push 1
push 0
jmp 0x42544d
call fcn.00555a50
jmp 0x4253dc
xor eax, eax
push eax
jmp 0x42544c

Function at 0x427190
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x644040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov esi, 0x7fffffff
cmp eax, 0x7fffffff
cmovb esi, eax
lea edi, [ebp - 0x14]
mov dword [edi], 0xffffffff
push 0
push edi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x427229
mov eax, dword [sym.imp.KERNEL32.dll_GetFileType]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4271f6
cmp ebx, 0xffffffff
je 0x427208
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 8]
push ebx
mov ebx, eax
call eax
cmp eax, 3
je 0x42720b
mov ebx, dword [ebp - 0x14]
jmp 0x4271e2
int3
mov dword [ebp - 0x14], 0xffffffff
push 0
push edi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
test eax, eax
mov eax, ebx
jne 0x4271d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x4271e2
Function at 0x42a2b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x28], edx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x42a3bc
mov edi, ecx
xor esi, esi
lea eax, [ebp - 0x14]
mov dword [eax], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov ecx, ebx
mov ebx, eax
call ecx
push 2
push esi
push esi
lea ecx, [ebp - 0x14]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne byte [ebp - 0x15]
je 0x42a3c5
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x28]
cmp dword [esi], ebx
je 0x42a332
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x42a347
lea eax, [ebx + 1]
cmp eax, 2
jb 0x42a32b
mov dword [esi], ebx
call fcn.005018d0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov al, byte [ebp - 0x15]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005018d0
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x24], eax
je 0x42a380
mov eax, dword [0x655038]
mov dword [ebp - 0x20], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
call dword [0x63e19c]
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [ebp - 0x1c]
mov dword [esi], 0
jmp 0x42a31c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x631a0d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42a3d2
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x42a3b6
call dword [0x63e19c]
call ecx
push 0
push eax
call fcn.0042a0c0
add esp, 8
jmp 0x42a35a
push 1
push 0
jmp 0x42a3ac
mov byte [ebp - 0x15], 1
jmp 0x42a332
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x42a32b
xor eax, eax
push eax
jmp 0x42a3ab
Function at 0x42c630
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x6586f0]
mov ecx, dword [0x64784c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42c71e
push dword [0x6460b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x42c67f
mov ecx, dword [0x6586e8]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x6586ec]
jne 0x42c67f
cmp dword [eax + ecx*8], 0
jne 0x42c6f0
push 4
call fcn.00562f65
add esp, 4
mov esi, eax
mov dword [eax], 0
push dword [0x6460b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
and eax, 0xfffffffc
je 0x42c6b9
mov ecx, dword [0x6586e8]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x6586ec]
jne 0x42c6b9
mov edi, dword [eax + ecx*8]
push dword [0x6460b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
jne 0x42c6d3
test esi, esi
je 0x42c6ec
call fcn.0041e8b0
mov ecx, dword [0x6586e8]
mov dword [eax + ecx*8], esi
mov ecx, dword [0x6586ec]
mov edx, dword [0x6586e8]
mov dword [eax + edx*8 + 4], ecx
test edi, edi
jne 0x42c76d
push dword [0x6460b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
xor eax, eax
and ecx, 0xfffffffc
je 0x42c71a
mov edx, dword [0x6586e8]
mov esi, dword [ecx + edx*8 + 4]
cmp esi, dword [0x6586ec]
jne 0x42c71a
mov eax, dword [ecx + edx*8]
pop esi
pop edi
pop ebp
ret
push 0x6586f0
call fcn.00562fa8
add esp, 4
cmp dword [0x6586f0], 0xffffffff
jne 0x42c656
mov dword [0x6586ec], 0
mov dword [0x6586e8], 0xffffffff
mov ecx, 0x6586e8
push 0x406b10
call fcn.00424dd0
push 0x6586f0
call fcn.00562ff7
add esp, 4
jmp 0x42c656
push edi
call fcn.00562f60
add esp, 4
jmp 0x42c6f0
Function at 0x42ca90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x42cc3b
cmp dword [esi], 0
jne 0x42cc3b
cmp dword [esi + 0xc], 0
jne 0x42cc3b
xor eax, eax
cmp dword [esi + 4], 0
jne 0x42cc3b
mov ebx, dword [edi]
cmp eax, ebx
je 0x42caf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x42cb3f
lea eax, [ebx + 1]
cmp eax, 2
jb 0x42caec
mov dword [esi], ebx
call fcn.005018d0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x42cb29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x42cb7b
lea eax, [ebx + 1]
cmp eax, 2
jb 0x42cb1f
mov dword [esi + 4], ebx
call fcn.005018d0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005018d0
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x42cbb9
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e19c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x42cadd
call fcn.005018d0
mov eax, dword [esi + 4]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x42cbfc
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e19c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi + 4], 0
jmp 0x42cb0f
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x631a0d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42cc59
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x42cbf6
call dword [0x63e19c]
call ecx
push 0
push eax
call fcn.0042a0c0
add esp, 8
jmp 0x42cb52
push 1
push 0
jmp 0x42cbe9
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x631a0d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42cc5e
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x42cc35
call dword [0x63e19c]
call ecx
push 0
push eax
call fcn.0042a0c0
add esp, 8
jmp 0x42cb8f
push 1
push 0
jmp 0x42cc28
mov ecx, esi
call fcn.00555a50
lea ecx, [esi + 4]
call fcn.00555a50
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, dword [esi]
jmp 0x42cac7
xor eax, eax
push eax
jmp 0x42cbe8
xor eax, eax
push eax
jmp 0x42cc27
Function at 0x42eab0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x88], eax
mov eax, dword [ecx]
inc eax
cmp eax, 1
ja 0x42ecb0
mov esi, ecx
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov edx, dword [esi]
cmp edx, eax
je 0x42eb19
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x42ec26
lea eax, [edi + 1]
cmp eax, 2
jb 0x42eb10
mov dword [esi], edi
call fcn.005018d0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esi]
lea eax, [edx + 1]
cmp eax, 1
jbe 0x42eccb
mov dword [esp + 8], esi
mov ecx, dword [ebp + 8]
xorps xmm0, xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x3c], 0xffffffff
test ecx, ecx
mov dword [esp + 4], edx
jne 0x42ebff
mov eax, 0xff
mov edi, 0x408
mov dword [esp + 0x2c], 1
mov ebx, edi
mov esi, eax
mov edx, ebx
mov dword [esp + 0xc], esi
mov ebx, esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x42ecbc
or edx, 0x2000
mov dword [esp + 0x20], edx
lea eax, [esp + 0x10]
push 0x70
push eax
push 9
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x42eca2
mov eax, dword [ebp + 0xc]
not eax
and ebx, eax
lea eax, [esp + 0xc]
mov dword [eax], ebx
mov ecx, 4
push ecx
push eax
push ecx
mov eax, dword [esp + 0x14]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov dword [esp], 0
test eax, eax
je 0x42eca2
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.00566245
mov eax, dword [esp]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
xor ebx, ebx
dec ecx
cmp ecx, 3
ja case.default.0x42ec1f
mov dword [esp], 0xa0
mov esi, 0xc8
mov eax, 0xd8
mov edi, 8
xor edx, edx
jmp dword [ecx*4 + 0x63ae14]
call fcn.005018d0
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [esp], eax
je 0x42ec66
mov eax, dword [0x655038]
mov dword [esp + 8], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [esp + 4], ecx
call dword [0x63e19c]
mov ecx, dword [esp + 8]
push dword [esp]
call dword [esp + 8]
mov dword [esi], 0
jmp 0x42eb01
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x631a0d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42ece8
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x42ec9c
call dword [0x63e19c]
call ecx
push 0
push eax
call fcn.0042a0c0
add esp, 8
jmp 0x42ec39
push 1
push 0
jmp 0x42ec92
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
jmp case.0x42ec1f.4
mov dword [esp], 0x4df
jmp case.0x42ec1f.4
or edx, 0x100
mov dword [esp + 0x70], eax
jmp 0x42eb8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.00566245
mov eax, esi
jmp 0x42ebf5
xor eax, eax
push eax
jmp 0x42ec91
Function at 0x430360
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [0x644040]
xor esi, ebp
mov dword [ebp - 0x10], esi
mov ecx, dword [ecx]
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
or eax, 8
push esi
push 2
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x43040f
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x43040f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esi + 1]
cmp eax, 2
jb 0x43040b
call fcn.005018d0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebx], 0
mov al, 1
test esi, esi
je 0x43041b
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
je 0x430420
call fcn.005018d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebx], esi
call fcn.005018d0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x18]
mov byte [ebx + 4], al
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
xor esi, esi
jmp 0x4303b9
mov byte [ebx], 0
mov dword [ebp - 0x18], 0
jmp 0x4303ef
mov dword [ebp - 0x18], eax
jmp 0x4303ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x4303e8
Function at 0x431940
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi], ecx
mov ebx, dword [eax]
mov dword [eax], ecx
lea edi, [ebx + 1]
cmp edi, 2
jb 0x431963
call fcn.005018d0
cmp dword [esi], ebx
je 0x43198d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x431999
cmp edi, 2
jb 0x431984
mov dword [esi], ebx
call fcn.005018d0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005018d0
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x4319d2
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e19c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x431978
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x631a0d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x431a0e
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x431a08
call dword [0x63e19c]
call ecx
push 0
push eax
call fcn.0042a0c0
add esp, 8
jmp 0x4319ac
push 1
push 0
jmp 0x4319fe
xor eax, eax
push eax
jmp 0x4319fd
Function at 0x4380f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [ebp + 8]
mov cl, byte [ecx + 4]
cmp cl, byte [eax + 4]
je 0x43811a
test cl, cl
jne 0x43812a
test esi, esi
je 0x438127
mov ecx, esi
push eax
call fcn.00431940
mov byte [esi + 4], 1
pop esi
pop ebp
ret 4
test cl, cl
je 0x438115
mov ecx, esi
pop esi
pop ebp
jmp fcn.00438140
int3
mov ecx, esi
call fcn.00425470
mov byte [esi + 4], 0
jmp 0x438115

Function at 0x438140
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x438163
call fcn.005018d0
cmp dword [esi], ebx
je 0x43818d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x438199
cmp edi, 2
jb 0x438184
mov dword [esi], ebx
call fcn.005018d0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005018d0
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x4381d2
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e19c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x438178
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x631a0d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43820e
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x438208
call dword [0x63e19c]
call ecx
push 0
push eax
call fcn.0042a0c0
add esp, 8
jmp 0x4381ac
push 1
push 0
jmp 0x4381fe
xor eax, eax
push eax
jmp 0x4381fd
Function at 0x439c50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [esi], esi
mov dword [esi + 4], esi
lea eax, [ecx + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ecx + 0x10]
mov dword [ebp - 0x18], eax
xor eax, eax
jmp 0x439c99
mov ebx, eax
add eax, 8
push 0x22c
push dword [ebp - 0x10]
push eax
call fcn.00567460
add esp, 0xc
mov dword [ebx + 4], esi
mov eax, dword [esi]
mov dword [ebx], eax
mov dword [eax + 4], ebx
mov dword [esi], ebx
mov eax, dword [esi + 8]
inc eax
mov dword [esi + 8], eax
push 0x228
push 0
push dword [ebp - 0x18]
call fcn.005679e0
add esp, 0xc
mov dword [edi + 0xc], 0x22c
cmp byte [edi + 8], 0
je 0x439cf4
push dword [ebp - 0x10]
push dword [edi + 4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x439d05
mov ebx, dword [edi + 0x238]
test ebx, ebx
jne 0x439d11
push 0x234
call fcn.00562f65
add esp, 4
test eax, eax
jne 0x439c73
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
push 0x622e92
call fcn.00590170
mov byte [edi + 8], 1
push dword [ebp - 0x10]
push dword [edi + 4]
call sub.KERNEL32.dll_Process32FirstW
jmp 0x439cc6
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [ebx]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
call dword [0x63e19c]
mov ecx, ebx
push dword [ebp - 0x10]
call dword [ebp - 0x14]
test al, al
je 0x439c9c
jmp 0x439cd4
Function at 0x43a640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 0x18]
or eax, dword [ecx + 0x1c]
je 0x43a701
mov esi, ecx
mov eax, dword [ecx + 0x20]
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x1c], ecx
mov ebx, dword [eax + 0x3c]
mov ecx, dword [0x646080]
cmp ecx, 0x5536d0
jne 0x43a714
mov dword [esp + 0x10], ebx
xor eax, eax
lea ebx, [esp + 0x28]
mov dword [ebx + 4], eax
mov dword [ebx], eax
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebx]
mov ebx, dword [ebx + 4]
mov eax, 0x7bd05af6
cmp eax, edi
mov eax, 0x863
sbb eax, ebx
jl 0x43a7bd
mov ecx, 0xf4240
mov eax, edi
mul ecx
imul ecx, ebx, 0xf4240
add ecx, edx
push dword [0x6496cc]
push dword [0x6496c8]
push ecx
push eax
call fcn.005866e0
mov ebx, dword [esp + 0x10]
sub eax, dword [esi + 0x18]
sbb edx, dword [esi + 0x1c]
seto cl
mov edi, edx
sar edi, 0x1f
test cl, cl
cmovne eax, edi
add edi, 0x80000000
test cl, cl
cmove edi, edx
cmp eax, dword [esp + 0x1c]
sbb edi, ebx
jge 0x43a72b
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.00566245
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [0x63e19c]
lea edi, [esp + 0x20]
push edi
call ecx
add esp, 4
mov eax, dword [edi]
mov edx, dword [edi + 4]
jmp 0x43a6db
cmp byte [esi + 0x29], 0
jne 0x43a76c
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0x5c]
mov edx, dword [eax + 0xa0]
inc edx
mov dword [eax + 0xa0], edx
cmp ecx, dword [eax + 0x60]
je 0x43a751
cmp dword [eax + 0xa8], edx
jae 0x43a7a4
mov word [eax + 0x78], 0
mov eax, dword [esi + 0x18]
or eax, dword [esi + 0x1c]
je 0x43a76c
mov byte [esi + 0x29], 1
mov eax, dword [esi + 0x20]
dec dword [eax + 0xb0]
cmp byte [esi + 0x11], 0
je 0x43a7ae
cmp byte [esi + 0x10], 0
jne 0x43a701
cmp byte [esi + 0x2a], 0
jne 0x43a701
mov ecx, dword [esi + 0x20]
call fcn.00591000
mov eax, dword [esi + 0x18]
or eax, dword [esi + 0x1c]
je 0x43a701
mov byte [esi + 0x2a], 1
mov eax, dword [esi + 0x20]
dec dword [eax + 0xb4]
jmp 0x43a701
movzx ecx, word [ecx + 8]
mov word [eax + 0x78], cx
jmp 0x43a757
push str....._third_partylibc_srcincludeoptional:795:_assertion_this__has_value___failed:_optional_operator_called_on_a_disengaged_value_n
push 0x622e92
call fcn.00590170
mov eax, dword [0x6496c8]
mov dword [esp + 8], eax
mov ecx, dword [0x6496cc]
mov dword [esp + 0xc], ecx
push ecx
push eax
push ebx
push edi
call fcn.005866e0
mov dword [esp], eax
mov dword [esp + 0x14], edx
mul dword [esp + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp]
imul ecx, dword [esp + 0xc]
add edx, ecx
mov eax, dword [esp + 0x14]
imul ecx, eax, 0xf4240
mov dword [esp + 4], ecx
imul eax, dword [esp + 8]
add eax, edx
sub edi, dword [esp + 0x18]
sbb ebx, eax
mov ecx, 0xf4240
mov eax, dword [esp]
mul ecx
mov dword [esp], eax
add edx, dword [esp + 4]
mov dword [esp + 4], edx
mov eax, edi
mul ecx
imul ecx, ebx, 0xf4240
add edx, ecx
push dword [esp + 0xc]
push dword [esp + 0xc]
push edx
push eax
call fcn.005866e0
add eax, dword [esp]
adc edx, dword [esp + 4]
jmp 0x43a6d7
Function at 0x43b7f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov byte [ecx + 4], 0
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx], 0x621010
mov dword [ecx + 0xc], eax
sub esp, 0x10
movaps xmm0, xmmword [0x62e020]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp dword [esi + 0xc], eax
je 0x43b850
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0xc]
inc eax
cmp eax, 2
jae 0x43b85a
lea eax, [edi + 1]
cmp eax, 2
jb 0x43b849
mov dword [esi + 0xc], edi
call fcn.005018d0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005018d0
mov eax, dword [esi + 0xc]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x43b895
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e19c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi + 0xc], 0
jmp 0x43b839
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x631a0d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43b8d1
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x43b8cb
call dword [0x63e19c]
call ecx
push 0
push eax
call fcn.0042a0c0
add esp, 8
jmp 0x43b86e
push 1
push 0
jmp 0x43b8c1
xor eax, eax
push eax
jmp 0x43b8c0