joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ecaa0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
or eax, 0xffffffff
test edi, edi
je 0x4ecae1
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
sub ebx, esi
nop dword [eax + eax]
mov edx, dword [esi + ebx]
lea esi, [esi + 4]
xor edx, dword [esi - 4]
lea ecx, [edx - 1]
not edx
shr ecx, 0x1f
shr edx, 0x1f
and ecx, edx
neg ecx
and eax, ecx
sub edi, 1
jne 0x4ecac0
pop esi
pop ebx
pop edi
ret

Function at 0x4edb10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x9c
mov eax, dword [0x601040]
xor eax, esp
mov dword [esp + 0x98], eax
mov edx, dword [esp + 0xa4]
xorps xmm0, xmm0
push ebp
mov ebp, dword [esp + 0xa4]
xor ecx, ecx
push ebx
add edx, 0x60
push esi
movups xmmword [esp + 0x14], xmm0
mov dword [esp + 0xc], edx
movups xmmword [esp + 0x24], xmm0
push edi
movups xmmword [esp + 0x38], xmm0
movups xmmword [esp + 0x48], xmm0
movups xmmword [esp + 0x58], xmm0
movups xmmword [esp + 0x68], xmm0
movups xmmword [esp + 0x78], xmm0
movups xmmword [esp + 0x88], xmm0
movups xmmword [esp + 0x98], xmm0
inc ecx
mov edi, edx
mov dword [esp + 0x14], ecx
xor ecx, dword [esp + 0xb8]
lea eax, [ecx - 1]
not ecx
shr eax, 0x1f
shr ecx, 0x1f
and eax, ecx
neg eax
xor esi, esi
mov ebx, eax
not ebx
mov edx, dword [edi - 0x60]
lea edi, [edi + 4]
and edx, eax
mov ecx, ebx
and ecx, dword [esp + esi + 0x18]
or edx, ecx
mov ecx, ebx
and ecx, dword [esp + esi + 0x48]
mov dword [esp + esi + 0x18], edx
mov edx, dword [edi - 0x34]
and edx, eax
or edx, ecx
mov ecx, dword [edi - 4]
mov dword [esp + esi + 0x48], edx
and ecx, eax
mov edx, dword [esp + esi + 0x78]
and edx, ebx
or edx, ecx
mov dword [esp + esi + 0x78], edx
add esi, 4
cmp esi, 0x30
jb 0x4edb98
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add edx, 0x90
mov dword [esp + 0x10], edx
cmp ecx, 0x10
jb 0x4edb75
pop edi
lea ecx, [esp + 0x40]
lea eax, [ebp + 0x2c]
pop esi
pop ebx
cmp ebp, ecx
ja 0x4edbff
lea ecx, [esp + 0xc]
movups xmm0, xmmword [esp + 0xc]
mov ecx, dword [esp + 0x9c]
movups xmmword [ebp], xmm0
movups xmm0, xmmword [esp + 0x1c]
movups xmmword [ebp + 0x10], xmm0
movups xmm0, xmmword [esp + 0x2c]
movups xmmword [ebp + 0x20], xmm0
movups xmm0, xmmword [esp + 0x3c]
movups xmmword [ebp + 0x30], xmm0
movups xmm0, xmmword [esp + 0x4c]
movups xmmword [ebp + 0x40], xmm0
movups xmm0, xmmword [esp + 0x5c]
movups xmmword [ebp + 0x50], xmm0
movups xmm0, xmmword [esp + 0x6c]
movups xmmword [ebp + 0x60], xmm0
movups xmm0, xmmword [esp + 0x7c]
movups xmmword [ebp + 0x70], xmm0
movups xmm0, xmmword [esp + 0x8c]
movups xmmword [ebp + 0x80], xmm0
pop ebp
xor ecx, esp
call fcn.004ee6f5
add esp, 0x9c
ret
Function at 0x4edef0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebp
push ebx
xorps xmm0, xmm0
mov dword [esp + 8], 0
movlpd qword [esp + 0x14], xmm0
mov eax, 1
mov edx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x40
push edi
mov edi, eax
xor ebx, ebx
and edi, 1
neg edi
adc ebx, ebx
and edi, dword [esp + 0x28]
neg ebx
mov ecx, edi
and edi, dword [esp + 0x14]
xor ecx, eax
mov esi, ebx
and esi, dword [esp + 0x2c]
mov eax, esi
and esi, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
shrd ecx, eax, 1
shr eax, 1
add ecx, edi
mov dword [esp + 0x14], ecx
adc eax, esi
and ebx, 0x80000000
shrd ebp, edx, 1
mov dword [esp + 0x10], eax
xor eax, eax
shr edx, 1
add ebp, eax
mov eax, ecx
adc edx, ebx
sub dword [esp + 0x18], 1
jne 0x4edf21
pop edi
pop esi
pop ebx
mov eax, ebp
pop ebp
add esp, 0x14
ret

Function at 0x4eebc8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x4eec07
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4eec07
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4eec07
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4eec07
cmp dword [ecx + 0x74], 0xe
jbe 0x4eec07
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4f6753
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4f67f0
push ebx
push esi
call fcn.004f671c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004f66b2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4f679d
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4f67ef
push edi
push eax
call fcn.004f7370
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4f67bd
call fcn.004f5280
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4f67ee
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004f66b2
add esp, 0x20
test eax, eax
jne 0x4f67dc
push edi
call fcn.004f5280
jmp 0x4f67e4
push ebx
call fcn.004f5280
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4fa398
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1418
call fcn.004ee650
mov eax, dword [0x601040]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, ecx
mov edx, dword [ebp + 0x10]
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
push ebx
push esi
mov eax, dword [eax*4 + 0x6020f8]
mov esi, dword [ebp + 8]
push edi
mov edi, esi
mov eax, dword [eax + ecx + 0x18]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x1410], eax
add ecx, edx
xor eax, eax
mov dword [ebp - 0x140c], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, edx
cmp edx, ecx
jae 0x4fa40d
mov esi, dword [ebp - 0x140c]
lea eax, [ebp - 0x6b0]
cmp edi, esi
jae 0x4fa37a
movzx ecx, word [edi]
add edi, 2
cmp ecx, 0xa
jne 0x4fa36d
push 0xd
pop edx
mov word [eax], dx
add eax, 2
mov word [eax], cx
add eax, 2
lea ecx, [ebp - 8]
cmp eax, ecx
jb 0x4fa355
push 0
push 0
push 0xd55
lea ecx, [ebp - 0x1408]
push ecx
lea ecx, [ebp - 0x6b0]
sub eax, ecx
sar eax, 1
push eax
mov eax, ecx
push eax
push 0
push 0xfde9
call fcn.004f66b2
mov esi, dword [ebp + 8]
add esp, 0x20
mov dword [ebp - 0x1418], eax
test eax, eax
je 0x4fa405
xor ebx, ebx
test eax, eax
je 0x4fa3ef
push 0
lea ecx, [ebp - 0x1414]
sub eax, ebx
push ecx
push eax
lea eax, [ebp - 0x1408]
add eax, ebx
push eax
push dword [ebp - 0x1410]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x4fa405
add ebx, dword [ebp - 0x1414]
mov eax, dword [ebp - 0x1418]
cmp ebx, eax
jb 0x4fa3ba
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
cmp edi, dword [ebp - 0x140c]
jb 0x4fa349
jmp 0x4fa40d
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ee6f5
leave
ret
Function at 0x4fd5f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4fd61d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4fd61d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4ff570
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov ebx, dword [esp + 0x44]
cmp ebx, 0xffffffff
je 0x4ff5fd
inc ebx
js 0x4ff5fd
movzx eax, byte [0x6019e5]
mov ebp, edx
mov esi, ecx
xor ecx, ecx
mov edx, ebx
call fcn.00499510
test eax, eax
je 0x4ff5fd
mov edi, dword [esp + 0x44]
push edi
push ebp
mov dword [esp + 8], eax
push eax
call fcn.004ef180
add esp, 0xc
lea eax, [ebp + 3]
and eax, 0xfffffffc
sub eax, ebp
je 0x4ff5ee
cmp eax, edi
cmovae eax, edi
test eax, eax
je 0x4ff5ee
mov ecx, ebp
mov edx, eax
nop word cs:[eax + eax]
nop
cmp byte [ecx], 0
je 0x4ff6a0
inc ecx
dec edx
jne 0x4ff5d0
mov ecx, dword [esp + 0x44]
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
add ecx, 0xfffffff8
jmp 0x4ff5ff
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
lea ecx, [edi - 8]
xor eax, eax
jmp 0x4ff603
ud2
cmp eax, ecx
ja 0x4ff62e
mov edx, dword [ebp + eax]
mov esi, dword [ebp + eax + 4]
mov ebx, 0x1010100
mov edi, 0x1010100
sub ebx, esi
sub edi, edx
or ebx, esi
or edi, edx
and edi, ebx
not edi
test edi, 0x80808080
jne 0x4ff62e
add eax, 8
jmp 0x4ff5ff
mov ecx, dword [esp + 0x44]
mov esi, dword [esp + 8]
mov ebx, dword [esp + 4]
sub ecx, eax
je 0x4ff64a
add ebp, eax
cmp byte [ebp], 0
je 0x4ff6a0
inc ebp
dec ecx
jne 0x4ff640
mov eax, dword [esp + 0x44]
mov edx, dword [esp]
xorps xmm0, xmm0
lea ecx, [esp + 0x10]
mov byte [edx + eax], 0
lea eax, [esp + 0xc]
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x18], 1
mov dword [esp + 0xc], 0
push eax
push ecx
push 0
push edx
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x4ff6bc
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov eax, 1
mov dword [esi + 4], 0
jmp 0x4ff6d5
mov eax, dword [0x5bbcb0]
mov ecx, dword [0x5bbcb4]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
push dword [esp]
jmp 0x4ff6e2
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0xc]
mov eax, dword [eax]
movzx eax, word [eax]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
xor eax, eax
mov dword [esi], eax
mov eax, dword [esp]
test ebx, ebx
mov byte [eax], 0
je 0x4ff6f0
push eax
push 0
push dword [0x6019d8]
call dword [sym.imp.kernel32.dll_HeapFree]
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40c5a0
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x40dfbb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41401c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CThreadHolder.0
mov dword [esp + 0x14], 0
mov eax, dword [esi + 4]
mov dword [esi + 8], 1
test eax, eax
je 0x40c611
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40c600
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
cmp dword [esi + 0x14], 0
jne 0x40c622
push esi
call fcn.0040c720
call fcn.0040c870
mov eax, dword [esi + 0x18]
lea edx, [eax - 0xc]
cmp edx, 0x414084
je 0x40c64d
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40c64d
mov eax, dword [esi + 0x18]
sub eax, 0xc
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x40cd4c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41401c]
jne 0x40cd56
repz ret
jmp fcn.0040d2de
Function at 0x4012e0
Capabilities:
Encode data using xor

Disassembly:
push 0x40cfb4
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + 0x414ccb3e], ch
pop edx
pop ebp
dec edx
mov cs, edi
add dword [ebx - 0x7d], esp
lds edx, [ebp - 0x6a]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
xor byte [edx], dh
xor byte [ebx + esi], dh
xor byte [ebx + 0x69], al
xor dword [eax + esi + 0x72], esp
push eax
popal
jae 0x401399
add byte [ebx + 0x30], al
xor byte [eax], dh
sub eax, 0
dec esp
xor dword [eax], eax
pop es
dec ecx
cmpsd dword [esi], dword es:[edi]
invalid
add byte [0x43000a01], cl
and dword [ecx], esi
xor byte fs:[edx + 0x50], dh
popal
jae 0x40141b
add byte [ebx], al
add byte [eax], al
add byte [eax], al
sbb dword [ecx], eax
add byte [edx], al
and dword [ebx + 0x6c0000b6], edx
je 0x4013bb
add byte [ebx - 0xffff4a], cl
fdivr st(7)
loopne 0x4013c5
adc byte [edx + 0x46], cl
dec ecx
inc esi
add byte [ecx], al
add dword [ecx], eax
add byte [eax], cl
dec eax
add byte [eax], al
invalid
add byte [ebx + 1], al
or dword [ecx], ecx
or dword [ebx + ecx], ecx
or al, 0x18
or eax, 0x2132180d
sbb al, 0x21
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
inc eax
add byte [ecx], dl
or byte [ecx], al
inc esi
add dword [esi + 0x220103], ebp
add dl, byte [ecx]
add dword [ebx], eax
adc dword [ecx], eax
inc esp
add byte [eax + eax], bl
add byte [edx], al
add al, byte [ebx]
add dword [ecx], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push es
pop es
add al, 5
add byte [edx], al
add eax, dword [ecx]
or bh, bh
les eax, [eax]
aas
adc byte [eax], al
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [edx]
add eax, 0x1060402
add eax, dword [ebx + eax]
add dword [ecx], eax
add al, byte [ebx]
add al, 0
add eax, 0x21120611
adc esi, dword [ecx]
inc ecx
and dl, byte [ecx + 7]
adc al, 0x32
popal
jno 0x40143a
xchg ecx, eax
adc eax, 0x16a14223
xor edx, dword [edx + 0x62]
mov cl, 0xc1
shl dword [edx + esi*2], 1
invalid
Function at 0x40ad40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x40ad78
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x40ad82
lea eax, [ebx + 1]
cmp eax, 2
jb 0x40ad71
mov dword [esi], ebx
call fcn.00501530
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00501530
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x40adbb
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e1cc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x40ad62
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6318bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40adf7
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x40adf1
call dword [0x63e1cc]
call ecx
push 0
push eax
call fcn.004292e0
add esp, 8
jmp 0x40ad95
push 1
push 0
jmp 0x40ade7
xor eax, eax
push eax
jmp 0x40ade6
Function at 0x4108c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x4108fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x41091c
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4108f7
mov dword [esi], ebx
call fcn.00501530
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x410991
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00501530
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x410955
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e1cc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x4108e8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6318bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410994
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x41098b
call dword [0x63e1cc]
call ecx
push 0
push eax
call fcn.004292e0
add esp, 8
jmp 0x41092f
push 1
push 0
jmp 0x410981
int3
xor eax, eax
push eax
jmp 0x410980
Function at 0x418790
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x4187b3
call fcn.00501530
cmp dword [esi], ebx
je 0x4187dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x418802
cmp edi, 2
jb 0x4187d4
mov dword [esi], ebx
call fcn.00501530
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + 4]
mov byte [esi + 4], al
mov byte [ecx + 4], 0
mov eax, dword [ecx]
inc eax
cmp eax, 2
jae 0x418877
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00501530
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x41883b
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e1cc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x4187c8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6318bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x418881
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x418871
call dword [0x63e1cc]
call ecx
push 0
push eax
call fcn.004292e0
add esp, 8
jmp 0x418815
push 1
push 0
jmp 0x418867
call fcn.00555660
jmp 0x4187f6
xor eax, eax
push eax
jmp 0x418866
Function at 0x423ff0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x6460b0]
cmp eax, 0xffffffff
je 0x4240b1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x4240b1
mov eax, dword [0x64a718]
mov ecx, dword [0x64784c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4240bb
mov edi, dword [0x64a714]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4240ff
mov ecx, dword [0x64970c]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x649710], 0
jne 0x42410b
lea ecx, [ebx + 0x649710]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x64a710]
inc edx
mov dword [0x64a710], edx
mov dword [ecx + 0xc], edx
mov dword [0x64970c], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x4240fc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00412e70
jmp 0x424015
push 0x64a718
call fcn.00562c08
add esp, 4
cmp dword [0x64a718], 0xffffffff
jne 0x424036
push 4
call fcn.00562bc5
add esp, 4
mov dword [eax], 0
mov dword [0x64a714], eax
push 0x64a718
call fcn.00562c57
add esp, 4
jmp 0x424036
int3
mov ecx, edi
call fcn.0050a710
jmp 0x42404b
inc edx
cmp edx, 0x100
jne 0x424054
jmp 0x42409b

Function at 0x424590
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x4245b3
call fcn.00501530
mov dword [esi], 0
test ebx, ebx
je 0x4245e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x424608
cmp edi, 2
jb 0x4245da
mov dword [esi], ebx
call fcn.00501530
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + 4]
mov byte [esi + 4], al
mov byte [ecx + 4], 0
mov eax, dword [ecx]
inc eax
cmp eax, 2
jae 0x42467d
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00501530
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x424641
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e1cc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x4245ce
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6318bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x424687
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x424677
call dword [0x63e1cc]
call ecx
push 0
push eax
call fcn.004292e0
add esp, 8
jmp 0x42461b
push 1
push 0
jmp 0x42466d
call fcn.00555660
jmp 0x4245fc
xor eax, eax
push eax
jmp 0x42466c
Function at 0x4294d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x28], edx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x4295dc
mov edi, ecx
xor esi, esi
lea eax, [ebp - 0x14]
mov dword [eax], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov ecx, ebx
mov ebx, eax
call ecx
push 2
push esi
push esi
lea ecx, [ebp - 0x14]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne byte [ebp - 0x15]
je 0x4295e5
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x28]
cmp dword [esi], ebx
je 0x429552
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x429567
lea eax, [ebx + 1]
cmp eax, 2
jb 0x42954b
mov dword [esi], ebx
call fcn.00501530
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov al, byte [ebp - 0x15]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00501530
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x24], eax
je 0x4295a0
mov eax, dword [0x655038]
mov dword [ebp - 0x20], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
call dword [0x63e1cc]
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [ebp - 0x1c]
mov dword [esi], 0
jmp 0x42953c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6318bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4295f2
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x4295d6
call dword [0x63e1cc]
call ecx
push 0
push eax
call fcn.004292e0
add esp, 8
jmp 0x42957a
push 1
push 0
jmp 0x4295cc
mov byte [ebp - 0x15], 1
jmp 0x429552
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x42954b
xor eax, eax
push eax
jmp 0x4295cb