joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ca60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx], 0
je 0x43cb20
cmp dword [esi + 4], 0xffffffff
je 0x43cb20
lea ecx, [esi + 8]
cmp byte [esi + 0x13], 0
jns 0x43cb48
mov edx, 0x7fffffff
and edx, dword [esi + 0x10]
dec edx
mov dword [ebp - 0x20], edx
lea eax, [ebp - 0x14]
mov dword [eax], edx
mov edi, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
sub eax, edi
add eax, 0xfffffffe
lea ebx, [esi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [ebp - 0x1c], eax
push edx
push ecx
mov dword [ebp - 0x24], ecx
call fcn.0043cbe0
add esp, 8
mov dword [ebp - 0x28], ebx
push ebx
push edi
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x43cb61
test eax, eax
jne 0x43cb20
mov eax, dword [esi + 0x20]
inc eax
shr eax, 1
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
sub edx, ecx
sar edx, 1
cmp edx, eax
jbe 0x43cb52
mov word [ecx + eax*2], 0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + 8]
cmp byte [esi + 0x13], 0
jns 0x43cb2b
mov eax, dword [eax]
mov word [eax], 0
mov eax, dword [esi + 0x14]
cmp dword [esi + 0x18], eax
je 0x43cb52
mov word [eax], 0
mov dword [esi + 0x20], 0
xor ebx, ebx
jmp 0x43cb0c
mov edx, 4
jmp 0x43ca9e
push str....._third_partylibc_srcinclude_vector:1411:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x622e92
call fcn.00590170
mov ebx, dword [ebp - 0x20]
mov edx, dword [esi + 0x20]
inc edx
shr edx, 1
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edi, ecx
sub eax, ecx
mov ecx, eax
sar ecx, 1
cmp edx, ecx
jb 0x43cb9b
lea ecx, [esi + 0x14]
inc edx
lea eax, [ebp - 0x16]
mov word [eax], 0
push eax
call fcn.00450160
add esp, 4
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edi, ecx
sub eax, ecx
add eax, 0xfffffffe
mov dword [esi + 0x20], eax
cmp dword [ebp - 0x14], ebx
mov eax, 0x4000
cmovne eax, ebx
mov dword [ebp - 0x14], eax
push eax
push dword [ebp - 0x24]
call fcn.0043cbe0
add esp, 8
push dword [ebp - 0x28]
push edi
push dword [ebp - 0x1c]
push 0
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x43caec
Function at 0x43ed10
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x43ed32
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43ed67
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43ed80
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov ecx, esi
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0043ee60
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.005380c0
add esp, 4
test al, al
je 0x43ee36
call fcn.004f27a0
lea ecx, [ebp - 0xb0]
push eax
push 2
push 0x26f
push str.crash_report_database_win.cc
call fcn.00417d50
lea eax, [ebp - 0xa8]
push 0x10
push str.CreateDirectory
push eax
call fcn.00538270
add esp, 0xc
mov edi, eax
movsx eax, byte [esi + 0xb]
test eax, eax
jns 0x43edd4
mov eax, dword [esi + 4]
mov esi, dword [esi]
test eax, eax
js 0x43ee44
sete cl
test esi, esi
setne dl
or dl, cl
je 0x43ee3d
lea ebx, [ebp - 0xbc]
push eax
push esi
push ebx
call fcn.00543680
add esp, 0xc
movsx eax, byte [ebx + 0xb]
test eax, eax
jns 0x43ee09
mov eax, dword [ebp - 0xb8]
mov ebx, dword [ebp - 0xbc]
push eax
push ebx
push edi
call fcn.00538270
add esp, 0xc
cmp byte [ebp - 0xb1], 0
jns 0x43ee2b
push dword [ebp - 0xbc]
call fcn.00562f60
add esp, 4
lea ecx, [ebp - 0xb0]
call fcn.00416650
xor ebx, ebx
jmp 0x43ed69
push str....._third_partylibc_srcinclude_string_view:320:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
jmp 0x43ee49
push str....._third_partylibc_srcinclude_string_view:318:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
push 0x622e92
call fcn.00590170
int3
Function at 0x43ee60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x43ee82
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43ef0d
mov bl, 1
test al, 0x10
je 0x43eeab
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.005380c0
add esp, 4
test al, al
je 0x43ef09
lea edi, [ebp - 0xb0]
mov ecx, edi
push 2
push 0x25f
push str.crash_report_database_win.cc
call fcn.0040b160
lea eax, [ebp - 0xa8]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00538270
add esp, 0xc
push esi
push eax
call fcn.005bae00
add esp, 8
push 0x11
push str.:_not_a_directory
push eax
call fcn.00538270
add esp, 0xc
mov ecx, edi
call fcn.0040a930
xor ebx, ebx
jmp 0x43ee94
push 2
call fcn.005380c0
add esp, 4
test al, al
je 0x43ef09
call fcn.004f27a0
lea edi, [ebp - 0xb0]
mov ecx, edi
push eax
push 2
push 0x25b
push str.crash_report_database_win.cc
call fcn.00417d50
lea eax, [ebp - 0xa8]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00538270
add esp, 0xc
push esi
push eax
call fcn.005bae00
add esp, 8
mov ecx, edi
call fcn.00416650
jmp 0x43ef09
Function at 0x43f310
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
mov ecx, 0x65c2937b
xor eax, eax
lock cmpxchg dword [esi], ecx
jne 0x43f4e8
mov dword [0x648600], edi
mov dword [0x648690], edi
mov dword [0x648694], 1
mov dword [ebp - 0x38], esi
xor eax, eax
dec eax
lea ebx, [ebp - 0x34]
mov dword [ebx + 0x20], eax
pcmpeqd xmm0, xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push ebx
call edi
mov edx, edi
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0x1c]
cmp eax, ecx
cmova ecx, eax
mov dword [0x648698], ecx
mov eax, 0x10
mov dword [0x64869c], eax
mov eax, 0x20
mov dword [0x6486a0], eax
mov dword [0x6486a4], esi
mov dword [0x648604], esi
mov eax, 0x648604
xor eax, 0xb37cc16a
mov dword [0x648608], eax
xor eax, eax
dec eax
mov dword [ebx + 0x20], eax
mov edi, dword [ebp - 0x38]
mov dword [0x64860c], 0x648600
pxor xmm0, xmm0
movdqu xmmword [0x648614], xmm0
movdqu xmmword [0x648624], xmm0
movdqu xmmword [0x648634], xmm0
movdqu xmmword [0x648644], xmm0
movdqu xmmword [0x648654], xmm0
movdqu xmmword [0x648664], xmm0
movdqu xmmword [0x648674], xmm0
movdqu xmmword [0x648680], xmm0
mov dword [0x6486a8], esi
mov dword [0x648738], esi
mov dword [0x64873c], esi
pcmpeqd xmm0, xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
push ebx
call edx
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0x1c]
cmp eax, ecx
cmova ecx, eax
mov dword [0x648740], ecx
mov eax, 0x10
mov dword [0x648744], eax
mov eax, 0x20
mov dword [0x648748], eax
mov dword [0x64874c], esi
mov dword [0x6486ac], esi
mov eax, 0x6486ac
xor eax, 0xb37cc16a
mov dword [0x6486b0], eax
mov dword [0x6486b4], 0x6486a8
pxor xmm0, xmm0
movdqu xmmword [0x6486bc], xmm0
movdqu xmmword [0x6486cc], xmm0
movdqu xmmword [0x6486dc], xmm0
movdqu xmmword [0x6486ec], xmm0
movdqu xmmword [0x6486fc], xmm0
movdqu xmmword [0x64870c], xmm0
movdqu xmmword [0x64871c], xmm0
movdqu xmmword [0x648728], xmm0
mov eax, 0xdd
xchg dword [edi], eax
cmp eax, 0x5a308d2
je 0x43f4db
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
push edi
call fcn.00592870
add esp, 8
jmp 0x43f4c9
push edx
push 0x624d84
push 3
push esi
call fcn.00455880
add esp, 0x10
test eax, eax
jne 0x43f4c9
jmp 0x43f338
Function at 0x440ea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x22c
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.005679e0
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x440fb4
push ebx
call fcn.00564782
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.00550e10
xor eax, eax
dec eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
movsx eax, byte [edi + 0xb]
test eax, eax
mov dword [ebp - 0x238], esi
jns 0x440f49
mov eax, dword [ebp - 0x230]
test eax, eax
js 0x440fd4
mov edi, dword [ebp - 0x234]
sete cl
test edi, edi
setne dl
or dl, cl
je 0x440fd7
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x228]
mov ecx, ebx
push eax
push edi
call fcn.00550e10
mov ecx, ebx
call fcn.00440380
cmp byte [esi + 0xb], 0
jns 0x440f72
push dword [esi]
call fcn.00562f60
add esp, 4
mov eax, dword [ebp - 0x220]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x228]
movsd qword [esi], xmm0
mov byte [ebp - 0x21d], 0
mov word [ebp - 0x228], 0
cmp byte [ebp - 0x229], 0
jns 0x440fae
push dword [ebp - 0x234]
call fcn.00562f60
add esp, 4
mov esi, dword [ebp - 0x238]
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
add esp, 0x22c
pop esi
pop edi
pop ebx
pop ebp
ret
int3
int3

Function at 0x442400
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.005679e0
sub esp, 8
mov dword [esp + 0x10], edi
movsd xmm0, qword [0x62e390]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x44247d
cmp word [ebp - 0x214], 0
je 0x44247d
push edi
call fcn.00564782
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00550e10
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00566245
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
xorps xmm0, xmm0
lea eax, [ebp - 0x220]
movsd qword [eax], xmm0
mov dword [eax + 8], 0
push eax
call fcn.00440ea0
add esp, 4
test al, al
jne 0x4424c5
mov ecx, esi
push 3
push 0x62e3f4
call fcn.00550e10
cmp byte [ebp - 0x215], 0
jns 0x442467
push dword [ebp - 0x220]
call fcn.00562f60
add esp, 4
jmp 0x442467
mov eax, dword [ebp - 0x218]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x220]
movsd qword [esi], xmm0
jmp 0x442467
Function at 0x4465a0
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
cmp dword [ecx + 8], 0
mov eax, dword [ecx]
je 0x4466db
push 0x32
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [esi + 0x20]
mov dword [esi + 0x20], 0
test edi, edi
je 0x4465e6
mov ecx, edi
call fcn.00446720
push edi
call fcn.00562f60
add esp, 4
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x2c], 0
test eax, eax
je 0x446604
push 0
push eax
push 0x635600
call fcn.0050f990
add esp, 0xc
mov eax, dword [esi + 0x24]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x64c810]
bt edx, ecx
jb 0x4466cd
xor eax, eax
mov dword [esi + 0x24], eax
mov edi, dword [esi + 0x20]
mov dword [esi + 0x20], eax
test edi, edi
jne 0x4466fc
mov eax, dword [esi + 0x18]
inc eax
cmp eax, 2
jae 0x44665b
lea ecx, [esi + 0x14]
call fcn.00425470
lea ecx, [esi + 0x10]
call fcn.00425470
mov ecx, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0042d9d0
call fcn.005018d0
mov edi, dword [esi + 0x18]
cmp dword [0x655038], 0
je 0x446691
mov dword [ebp - 0x10], edi
mov edi, dword [0x655038]
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [0x63e19c]
mov ecx, edi
push dword [ebp - 0x10]
call ebx
mov dword [esi + 0x18], 0
jmp 0x44663d
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x631a0d
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x446711
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x4466c7
call dword [0x63e19c]
call ecx
push 0
push eax
call fcn.0042a0c0
add esp, 8
jmp 0x44666c
push 1
push 0
jmp 0x4466bd
push eax
call fcn.004ff910
add esp, 4
jmp 0x446621
test eax, eax
jne 0x4465b5
cmp dword [esi + 0xc], 0
jne 0x4465b5
cmp dword [esi + 4], 0
jne 0x4465b5
jmp 0x4465c8
mov ecx, edi
call fcn.00446720
push edi
call fcn.00562f60
add esp, 4
jmp 0x446634
xor eax, eax
push eax
jmp 0x4466bc
Function at 0x449940
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x50f
push str.file_util_win.cc
push 0x62e487
push ebx
call fcn.0050b5e0
add esp, 0x10
xor eax, eax
mov ecx, esi
push eax
push eax
call fcn.005224f0
mov dword [esp + 0x4c], 0xa
mov al, byte [0x649456]
test al, al
jne 0x4499d8
cmp byte [edi + 0xb], 0
jns 0x4499ae
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
lea ecx, [esp + 0x10]
call fcn.005403a0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, al
lea eax, [esp + 0x54]
mov dword [eax], ebx
lea esi, [esp + 0x50]
mov dword [esi], str.ScopedBlockingCall
lea edx, [esp + 0x4c]
push eax
push esi
call fcn.005b5f10
add esp, 8
jmp 0x4499a6
Function at 0x449a00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x270
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x268], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x60]
push 0x4ff
push str.file_util_win.cc
push 0x62e472
push ebx
call fcn.0050b5e0
add esp, 0x10
xor eax, eax
mov ecx, esi
push eax
push eax
call fcn.005224f0
mov dword [esp + 0x5c], 0xa
mov al, byte [0x649456]
test al, al
jne 0x449b83
lea esi, [esp + 0x62]
push 0x206
push 0xff
push esi
call fcn.005679e0
add esp, 0xc
mov word [esi - 2], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x449b53
push ebx
call fcn.00564782
add esp, 4
lea edi, [esp + 8]
mov ecx, edi
push eax
push ebx
call fcn.00550e10
xor eax, eax
dec eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
movsx eax, byte [edi + 0xb]
test eax, eax
mov dword [esp + 4], esi
jns 0x449af8
mov eax, dword [esp + 0xc]
test eax, eax
js 0x449b7d
mov edi, dword [esp + 8]
sete cl
test edi, edi
setne dl
or dl, cl
je 0x449b80
mov esi, dword [ebp + 8]
lea ebx, [esp + 0x14]
mov ecx, ebx
push eax
push edi
call fcn.00550e10
mov ecx, ebx
call fcn.00440380
cmp byte [esi + 0xb], 0
jns 0x449b1f
push dword [esi]
call fcn.00562f60
add esp, 4
mov eax, dword [esp + 0x1c]
mov dword [esi + 8], eax
movq xmm0, qword [esp + 0x14]
movq qword [esi], xmm0
mov byte [esp + 0x1f], 0
mov word [esp + 0x14], 0
cmp byte [esp + 0x13], 0
jns 0x449b4f
push dword [esp + 8]
call fcn.00562f60
add esp, 4
mov esi, dword [esp + 4]
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x20]
call fcn.005403a0
mov ecx, dword [esp + 0x268]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
int3
int3
movzx ecx, al
lea eax, [esp + 0x14]
mov dword [eax], ebx
lea esi, [esp + 8]
mov dword [esi], str.ScopedBlockingCall
lea edx, [esp + 0x5c]
push eax
push esi
call fcn.005b5f10
add esp, 8
jmp 0x449a6f
Function at 0x44a660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [0x644040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, 0x7fffffff
lea esi, [ebp - 0xb0]
mov edi, eax
test eax, eax
je 0x44a6e5
cmp edi, ecx
mov eax, 0x7fffffff
cmovb eax, edi
mov dword [ebp - 0xb0], 0xffffffff
push 0
push esi
push eax
push ebx
mov esi, edx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44a704
mov ecx, dword [ebp - 0xb0]
cmp ecx, 0xffffffff
je 0x44a701
test ecx, ecx
mov edx, 0
cmovns edx, ecx
mov eax, edi
sub eax, edx
add ebx, edx
test ecx, ecx
mov edx, esi
mov ecx, 0x7fffffff
lea esi, [ebp - 0xb0]
jns 0x44a68b
jmp 0x44a704
test edi, edi
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
int3
cmp dword [0x64a79c], 2
jg 0x44a6e5
call fcn.004f27a0
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x8c
push str.file_io.cc
call fcn.00417d50
lea eax, [ebp - 0xa8]
push 9
push 0x63957b
push eax
call fcn.00538270
add esp, 0xc
mov ecx, esi
call fcn.00416650
jmp 0x44a6e5

Function at 0x44b560
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xa4
mov esi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.0044cf70
add esp, 0x10
or edx, eax
jne 0x44b597
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x44b5ad
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
add esp, 0xa4
pop esi
pop ebx
pop ebp
ret
cmp dword [0x64a79c], 2
jg 0x44b5f2
call fcn.004f27a0
lea esi, [ebp - 0xac]
mov ecx, esi
push eax
push 2
push 0xfc
push str.file_io_win.cc
call fcn.00417d50
lea eax, [ebp - 0xa4]
push 0xc
push 0x639540
push eax
call fcn.00538270
add esp, 0xc
mov ecx, esi
call fcn.00416650
xor ebx, ebx
jmp 0x44b597
Function at 0x44bc60
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.0044c550
mov eax, dword [esi]
test eax, eax
je 0x44bcb3
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x44bcba
lea ecx, [ebp - 0x14]
call fcn.0044bd20
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x44bc95
cmp dword [ebx + 0x50], 0
jne 0x44bcd9
cmp byte [ebx + 0x1b], 0
js 0x44bccb
lea eax, [ebx + 0x10]
jmp 0x44bcce
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x44bcde
add ebx, 0x58
jmp 0x44bc91
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x44bd04
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.005d43d0
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x44bcd9
mov ecx, dword [ebp + 8]
push ebx
call fcn.005d42c0
mov ecx, eax
jmp 0x44bcfc
Function at 0x44d060
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov edi, edx
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
movsd qword [ecx], xmm0
mov dword [ecx + 8], 0
push ecx
push edx
call fcn.00440fe0
add esp, 8
test al, al
je 0x44d0c9
movsx eax, byte [esi + 0xb]
test eax, eax
jns 0x44d0a1
mov eax, dword [esi + 4]
test eax, eax
je 0x44d0c9
push esi
call fcn.0044d1b0
add esp, 4
test al, al
je 0x44d0c9
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
mov eax, esi
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.0055b010
mov ecx, 4
mov ebx, 0x62fbd8
mov eax, ecx
jmp 0x44d0ee
not eax
add eax, ecx
lea ebx, [ebx + edx*4]
add ebx, 0xc
mov ecx, eax
test eax, eax
je 0x44d0fa
shr eax, 1
lea edx, [eax + eax*2]
cmp dword [ebx + edx*4], edi
jge 0x44d0e8
jmp 0x44d0de
cmp ebx, 0x62fc08
je 0x44d142
cmp dword [ebx], edi
jg 0x44d142
lea edi, [ebp - 0x216]
push 0x206
push 0xff
push edi
call fcn.005679e0
add esp, 0xc
mov word [edi - 2], 0
lea edi, [ebp - 0x218]
push 0x104
push edi
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x102
jbe 0x44d155
xorps xmm0, xmm0
movsd qword [esi], xmm0
mov dword [esi + 8], 0
jmp 0x44d0b2
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push edi
call fcn.00564782
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00550e10
mov ecx, esi
call fcn.004f2890
test al, al
je 0x44d199
mov ecx, esi
call fcn.00528290
test al, al
jne 0x44d199
push esi
call fcn.0044d1b0
add esp, 4
test al, al
jne 0x44d0b2
mov ecx, esi
call fcn.0055b010
jmp 0x44d142

Function at 0x44d1b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x254
push str.file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.0050b5e0
add esp, 0x10
xor eax, eax
mov ecx, esi
push eax
push eax
call fcn.005224f0
mov dword [esp + 0x4c], 0xa
mov al, byte [0x649456]
test al, al
jne 0x44d253
cmp byte [edi + 0xb], 0
jns 0x44d21e
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
lea ecx, [esp + 0x10]
call fcn.005403a0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00566245
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, al
lea eax, [esp + 0x54]
mov dword [eax], ebx
lea esi, [esp + 0x50]
mov dword [esi], str.ScopedBlockingCall
lea edx, [esp + 0x4c]
push eax
push esi
call fcn.005b5f10
add esp, 8
jmp 0x44d216
Function at 0x4502f0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x234
mov dword [ebp - 0x240], edx
mov edi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, word [ecx + 0x14]
mov word [ebp - 0x28], ax
movzx eax, word [ecx + 0x16]
mov word [ebp - 0x26], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call esi
mov word [ebp - 0x24], ax
movzx eax, word [edi + 0x16]
mov word [ebp - 0x22], ax
movzx eax, word [edi + 0x14]
mov word [ebp - 0x20], ax
mov bx, 0x4e4
mov word [ebp - 0x1e], bx
call esi
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x1a], 0x40904e4
mov dword [ebp - 0x16], 0x40904b0
mov word [ebp - 0x12], bx
mov ebx, 2
lea esi, [ebp - 0x230]
push 0x208
push 0xff
push esi
call fcn.005679e0
add esp, 0xc
movzx eax, word [ebp + ebx - 0x28]
mov dword [ebp - 0x23c], ebx
movzx ecx, word [ebp + ebx - 0x2a]
push dword [ebp - 0x240]
push eax
push ecx
push str.StringFileInfo_04x_04x_ls
mov eax, 0x104
push eax
push eax
push esi
call fcn.0044e380
add esp, 0x1c
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x238], 0xffffffff
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x234]
push eax
push esi
push dword [edi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x450426
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x450426
mov ecx, dword [ebp - 0x238]
test ecx, ecx
je 0x450426
dec ecx
push ecx
push eax
call fcn.0056501a
add esp, 8
mov edx, dword [ebp - 0x234]
test eax, eax
sete cl
test edx, edx
setne ch
or ch, cl
je 0x450440
mov ecx, dword [ebp + 8]
push eax
push edx
call fcn.005543c0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00566245
add esp, 0x234
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp - 0x23c]
add ebx, 4
cmp ebx, 0x1a
lea esi, [ebp - 0x230]
jne 0x450365
jmp 0x450411
int3