joyce8/EMBER2024-capa huggingface dataset:
Function at 0x117fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x118b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.01176e52
and dword [ebp - 0x14], 0
cmp dword [0x11cd558], 0
mov dword [ebp - 0x18], eax
jne 0x117fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x117fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x117fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x11cd558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x11cd55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x11cd560], eax
call edi
push eax
call esi
mov dword [0x11cd568], eax
test eax, eax
je 0x117fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x11cd564], eax
mov eax, dword [0x11cd564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x117fc78
cmp dword [0x11cd568], ecx
je 0x117fc78
push eax
call esi
push dword [0x11cd568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x117fc78
test ebx, ebx
je 0x117fc78
call edi
test eax, eax
je 0x117fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x117fc6f
test byte [ebp - 8], 1
jne 0x117fc78
or dword [ebp + 0x10], 0x200000
jmp 0x117fcab
mov eax, dword [0x11cd55c]
cmp eax, dword [ebp - 0x18]
je 0x117fcab
push eax
call esi
test eax, eax
je 0x117fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x117fcab
mov eax, dword [0x11cd560]
cmp eax, dword [ebp - 0x18]
je 0x117fcab
push eax
call esi
test eax, eax
je 0x117fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x11cd558]
call esi
test eax, eax
je 0x117fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x117fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.011713cb
leave
ret

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x72e7391d
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x64214d9
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7114443f
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x49883fad
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4068d0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x646040]
xor eax, ebp
mov dword [esp + 0x40], eax
movsd xmm0, qword [0x64b680]
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x4068fb
jnp 0x406920
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.00567335
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x64b690]
mov ecx, dword [0x64984c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x406a55
mov eax, dword [0x64b6a0]
mov ecx, dword [0x64984c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x406a8e
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
xor eax, eax
lea esi, [esp + 0x38]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub ebx, dword [0x64b698]
sbb edi, dword [0x64b69c]
movd xmm0, edi
movd xmm1, ebx
punpckldq xmm1, xmm0
movq qword [esp + 0x28], xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movsd xmm1, qword [esp + 0x20]
fild qword [esp + 0x38]
fstp qword [esp + 0x30]
divsd xmm1, qword [esp + 0x30]
pxor xmm0, xmm0
movsd xmm2, qword [0x627470]
ucomisd xmm2, xmm1
ja 0x4068fb
mov eax, dword [esp + 8]
sub eax, dword [0x64b688]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x64b68c]
movd xmm2, ecx
movd xmm0, eax
punpckldq xmm0, xmm2
punpckldq xmm0, xmmword [0x627450]
subpd xmm0, xmmword [0x627460]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x64b680], xmm0
jmp 0x4068fb
push 0x64b690
call fcn.00565714
add esp, 4
cmp dword [0x64b690], 0xffffffff
jne 0x40695f
rdtsc
mov dword [0x64b688], eax
mov dword [0x64b68c], edx
push 0x64b690
call fcn.00565763
add esp, 4
jmp 0x40695f
push 0x64b6a0
call fcn.00565714
add esp, 4
cmp dword [0x64b6a0], 0xffffffff
jne 0x406980
xor eax, eax
lea esi, [esp + 0x38]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [0x64b69c], ecx
mov dword [0x64b698], eax
push 0x64b6a0
call fcn.00565763
add esp, 4
jmp 0x406980
Function at 0x40ade0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x40ae18
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x40ae22
lea eax, [ebx + 1]
cmp eax, 2
jb 0x40ae11
mov dword [esi], ebx
call fcn.004ffee0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004ffee0
mov eax, dword [esi]
cmp dword [0x657038], 0
mov dword [ebp - 0x18], eax
je 0x40ae5b
mov eax, dword [0x657038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x6401dc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x40ae02
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6338bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ae97
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x40ae91
call dword [0x6401dc]
call ecx
push 0
push eax
call fcn.0043a140
add esp, 8
jmp 0x40ae35
push 1
push 0
jmp 0x40ae87
xor eax, eax
push eax
jmp 0x40ae86
Function at 0x40f9b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x40f9ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x40fa0c
lea eax, [ebx + 1]
cmp eax, 2
jb 0x40f9e7
mov dword [esi], ebx
call fcn.004ffee0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x40fa81
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004ffee0
mov eax, dword [esi]
cmp dword [0x657038], 0
mov dword [ebp - 0x18], eax
je 0x40fa45
mov eax, dword [0x657038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x6401dc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x40f9d8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6338bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40fa84
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x40fa7b
call dword [0x6401dc]
call ecx
push 0
push eax
call fcn.0043a140
add esp, 8
jmp 0x40fa1f
push 1
push 0
jmp 0x40fa71
int3
xor eax, eax
push eax
jmp 0x40fa70
Function at 0x410770
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2b8
mov esi, edx
mov dword [ebp - 0x2c0], ecx
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x2a4]
push 0x294
push 0xff
push edi
call fcn.00568ad0
add esp, 0xc
xor ebx, ebx
mov ecx, edi
push ebx
push ebx
mov dword [ebp - 0x2c4], esi
push esi
push 3
push ebx
push dword [ebp - 0x2c0]
call fcn.00410b10
xor eax, eax
dec eax
lea edi, [ebp - 0x2b0]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
lea ecx, [ebp - 0x2a4]
push edi
call fcn.0053ffe0
movsx eax, byte [edi + 0xb]
mov ecx, eax
test eax, eax
jns 0x4107ef
mov ecx, dword [ebp - 0x2ac]
test ecx, ecx
je 0x4108b9
xor esi, esi
cmp byte [ebp - 0x2a4], 0
je 0x41093f
mov ebx, dword [ebp - 0x2a0]
test bl, 1
jne 0x410949
test bl, 0x10
jne 0x4108f4
cmp byte [ebp - 0x2a5], 0
mov eax, edi
jns 0x41082f
mov eax, dword [ebp - 0x2b0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4108ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor ebx, ebx
cmp ecx, 2
je 0x410852
mov ebx, eax
test esi, esi
cmovne ebx, esi
lea ecx, [ebp - 0x2a4]
lea eax, [ebp - 0x2bc]
push eax
call fcn.0053ffe0
cmp byte [ebp - 0x2a5], 0
jns 0x410880
push dword [ebp - 0x2b0]
call fcn.00564050
add esp, 4
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x2a8], eax
movsd xmm0, qword [ebp - 0x2bc]
movsd qword [ebp - 0x2b0], xmm0
movsx eax, byte [ebp - 0x2a5]
mov ecx, eax
test eax, eax
jns 0x4108af
mov ecx, dword [ebp - 0x2ac]
mov esi, ebx
test ecx, ecx
jne 0x4107f9
test al, al
jns 0x4108cb
push dword [ebp - 0x2b0]
call fcn.00564050
add esp, 4
lea ecx, [ebp - 0x2a4]
call fcn.00410990
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, ebx
add esp, 0x2b8
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x410852
xor ebx, ebx
cmp byte [ebp + 8], 0
je 0x410852
mov ecx, edi
mov edx, dword [ebp - 0x2c4]
push 1
call fcn.00410770
add esp, 4
test eax, eax
jne 0x410850
cmp byte [ebp - 0x2a5], 0
mov eax, edi
jns 0x41092b
mov eax, dword [ebp - 0x2b0]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x410852
jmp 0x41083e
call fcn.005938f0
jmp 0x41081e
mov dword [ebp - 0x2c0], ebx
mov ecx, ebx
shr cl, 4
mov dl, byte [ebp + 8]
xor dl, 1
xor ebx, ebx
test cl, dl
jne 0x410852
test al, al
jns 0x410970
mov eax, dword [ebp - 0x2b0]
jmp 0x410976
lea eax, [ebp - 0x2b0]
mov ebx, dword [ebp - 0x2c0]
mov ecx, ebx
and ecx, 0xfffffffe
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x410815
Function at 0x412070
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x64c7e4]
test ebx, ebx
jne 0x4120f4
push 0x28
call fcn.00564055
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.00564055
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x4120fe
mov dword [eax + 8], edi
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x64c7e4], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x412101
mov edi, eax
push eax
call fcn.00565872
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00541020
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
int3
int3

Function at 0x4132a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x4132c3
call fcn.004ffee0
cmp dword [esi], ebx
je 0x4132ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x413312
cmp edi, 2
jb 0x4132e4
mov dword [esi], ebx
call fcn.004ffee0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + 4]
mov byte [esi + 4], al
mov byte [ecx + 4], 0
mov eax, dword [ecx]
inc eax
cmp eax, 2
jae 0x413387
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004ffee0
mov eax, dword [esi]
cmp dword [0x657038], 0
mov dword [ebp - 0x18], eax
je 0x41334b
mov eax, dword [0x657038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x6401dc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x4132d8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6338bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x413391
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x413381
call dword [0x6401dc]
call ecx
push 0
push eax
call fcn.0043a140
add esp, 8
jmp 0x413325
push 1
push 0
jmp 0x413377
call fcn.00556790
jmp 0x413306
xor eax, eax
push eax
jmp 0x413376
Function at 0x413cc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], 0
mov byte [ecx + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
je 0x413de4
mov dword [esp], 0x18
call fcn.00564055
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x80000018
mov dword [ebp - 0x18], 0x15
lea ecx, [eax + 0x15]
mov edx, str.ExitCodeWatcherThread
cmp eax, edx
seta bl
cmp ecx, edx
setbe cl
or cl, bl
je 0x413de7
lea ecx, [esi + 8]
movsd xmm0, qword [0x6257a1]
movsd qword [eax + 0xd], xmm0
movups xmm0, xmmword [str.ExitCodeWatcherThread]
movups xmmword [eax], xmm0
mov byte [eax + 0x15], 0
lea edi, [ebp - 0x1c]
mov dword [esp], edi
call fcn.00413e00
sub esp, 4
cmp byte [edi + 0xb], 0
jns 0x413d61
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.00564050
mov dword [esi + 0x50], 0x103
movsd xmm0, qword [0x625780]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
sub esp, 0x10
mov dword [esi + 0x54], 0
test eax, eax
je 0x413db7
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0x54]
inc eax
cmp eax, 2
jae 0x413dcb
lea eax, [edi + 1]
cmp eax, 2
jb 0x413dab
mov dword [esi + 0x54], edi
call fcn.004ffee0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004ffee0
mov eax, dword [esi + 0x54]
mov dword [esp], eax
call fcn.00550af0
mov dword [esi + 0x54], 0
jmp 0x413d9b
int3
mov dword [esp + 4], str....._third_partylibc_srcinclude__stringchar_traits.h:145:_assertion__std::__is_pointer_in_range___s1____s1____n____s2__failed:_char_traits::copy:_source_and_destination_ranges_overlap_n
mov dword [esp], 0x624e92
call fcn.005912b0
int3
Function at 0x415970
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x646040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov ebx, esp
push 0x5f
push str.file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.00509c60
add esp, 0x10
xor eax, eax
mov ecx, edi
push eax
push eax
call fcn.00520c00
mov dword [esp + 0x4c], 0xa
mov al, byte [0x64b456]
test al, al
jne 0x415a37
mov ecx, dword [ebp + 0xc]
test ecx, ecx
js 0x415a1b
mov eax, dword [ebp + 8]
mov dword [esp], 0xffffffff
push 0
push ebx
push ecx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x415a25
mov ebx, dword [esp]
test ebx, ebx
js 0x415a20
lea ecx, [esp + 0x10]
call fcn.00540880
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00567335
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
dec ebx
jmp 0x4159fb
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x4159fb
movzx ecx, al
lea eax, [esp + 0x54]
mov dword [eax], ebx
lea edi, [esp + 0x50]
mov dword [edi], str.ScopedBlockingCall
lea edx, [esp + 0x4c]
push eax
push edi
call fcn.005b7340
add esp, 8
jmp 0x4159d2
Function at 0x418be0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x80
mov esi, ecx
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp byte [ecx], 1
je 0x418c3b
cmp byte [esi + 0x1b], 0
js 0x418c1c
cmp byte [esi + 0xf], 0
js 0x418c29
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00567335
add esp, 0x80
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call fcn.00564050
jmp 0x418c02
mov eax, dword [esi + 4]
mov dword [esp], eax
call fcn.00564050
jmp 0x418c08
mov ecx, dword [esi + 8]
jmp 0x418c5b
mov ecx, esi
call fcn.005c86b0
test al, al
je 0x418d0b
mov ecx, esi
call fcn.005c8720
movsx eax, byte [esi + 0xf]
test eax, eax
js 0x418c36
mov ecx, eax
test ecx, ecx
je 0x418d0e
pxor xmm0, xmm0
movdqu xmmword [ebp - 0x1c], xmm0
movdqu xmmword [ebp - 0x2c], xmm0
movdqu xmmword [ebp - 0x3c], xmm0
movdqu xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x50], 0x44
lea ecx, [esi + 0x10]
pcmpeqd xmm0, xmm0
movdqu xmmword [ebp - 0x60], xmm0
cmp byte [esi + 0x1b], 0
jns 0x418c96
mov ecx, dword [ecx]
lea edx, [esi + 4]
test al, al
jns 0x418c9f
mov edx, dword [edx]
lea eax, [ebp - 0x60]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x50]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
movaps xmm0, xmmword [0x636290]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x418bfc
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
sub esp, 4
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
sub esp, 4
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call edi
sub esp, 4
jmp 0x418bfc
int3
int3
Function at 0x41a5a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov esi, ecx
mov eax, dword [0x646040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], 0x623a28
mov dword [ecx + 8], eax
mov ecx, 0x623a3c
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
mov byte [esi + 0x14], al
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
sub esp, 0x10
movsd xmm0, qword [0x625780]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
mov eax, dword [esi + 0x10]
test eax, eax
setne cl
cmp eax, edi
sete dl
and dl, cl
cmp dl, 1
je 0x41a6b1
test eax, eax
jne 0x41a6b6
mov dword [esi + 0x10], edi
cmp dword [0x64c79c], 3
setl al
test edi, edi
sete cl
and cl, al
cmp cl, 1
je 0x41a6cf
sub esp, 0x10
movsd xmm0, qword [0x625780]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
mov eax, dword [esi + 0x1c]
test eax, eax
setne cl
cmp eax, edi
sete dl
and dl, cl
cmp dl, 1
je 0x41a6b1
test eax, eax
jne 0x41a6c4
mov dword [esi + 0x1c], edi
cmp dword [0x64c79c], 3
setl al
test edi, edi
sete cl
and cl, al
cmp cl, 1
je 0x41a70d
xor eax, eax
push eax
push eax
push esi
push 0x4f3d50
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x41a74b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567335
mov eax, esi
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0057887c
push eax
call fcn.004f3c00
add esp, 4
jmp 0x41a614
push eax
call fcn.004f3c00
add esp, 4
jmp 0x41a660
call fcn.004f17a0
lea edi, [ebp - 0xb4]
mov ecx, edi
push eax
push 2
push 0x5b
push str.session_end_watcher.cc
call fcn.005bb140
lea eax, [ebp - 0xac]
push 0xb
push str.CreateEvent
push eax
call fcn.0052f110
add esp, 0xc
mov ecx, edi
call fcn.005bb1a0
jmp 0x41a631
call fcn.004f17a0
lea edi, [ebp - 0xb4]
mov ecx, edi
push eax
push 2
push 0x5e
push str.session_end_watcher.cc
call fcn.005bb140
lea eax, [ebp - 0xac]
push 0xb
push str.CreateEvent
push eax
call fcn.0052f110
add esp, 0xc
mov ecx, edi
call fcn.005bb1a0
jmp 0x41a67d
lea ebx, [ebp - 0xb4]
push 0x1b
push str.thread_win.cc
push str.Start
push ebx
call fcn.00509c60
add esp, 0x10
lea edi, [ebp - 0x14]
push ebx
push edi
call fcn.005bc600
add esp, 8
mov ecx, edi
push 0x639650
call fcn.005d93b0
mov ecx, edi
call fcn.00591bc0
jmp 0x41a69a