joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, edx
mov edi, ecx
mov eax, dword [0x4d100c]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov ebx, esp
push 0x212
push str....._base_files_file_util_win.cc
push str.PathHasAccess
push ebx
call fcn.00448cb0
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push ebx
call fcn.0044a760
cmp byte [edi + 0xb], 0
jns 0x4354ef
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x43553d
test al, 0x10
cmove esi, dword [ebp + 8]
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
push 0
push ecx
push 3
push 0
push 7
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x43554a
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x435541
call fcn.00448ce0
mov ebx, esi
jmp 0x435543
xor ebx, ebx
jmp 0x435569
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
setne al
mov esi, eax
lea eax, [ebx + 1]
cmp eax, 2
jb 0x435567
call fcn.00448ce0
push ebx
call fcn.0044ac40
add esp, 4
mov ebx, esi
lea ecx, [esp + 0x10]
call fcn.0044a7c0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0048b34a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x435590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x4d100c]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov ebx, esp
push 0x231
push str....._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.00448cb0
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.0044a760
cmp byte [edi + 0xb], 0
jns 0x435600
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.0044a7c0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0048b34a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435640
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x4d100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.0048ea80
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x4356c3
push ebx
call fcn.004a3a77
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.0043b5b0
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.0043cdf0
mov ecx, dword [ebp + 8]
push ebx
call fcn.0043b7c0
mov ecx, ebx
call fcn.0043b780
mov ecx, edi
call fcn.0043b780
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b34a
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4356f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x4d100c]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.0048ea80
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x4c1ab0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x435758
cmp word [ebp - 0x214], 0
je 0x435758
push edi
call fcn.004a3a77
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0043b5b0
jmp 0x4357b1
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x218], 0xffffffff
lea edi, [ebp - 0x220]
mov ecx, edi
call fcn.0043b550
push edi
call fcn.00435640
add esp, 4
mov ecx, esi
test al, al
je 0x43579a
push edi
call fcn.0043b580
jmp 0x4357a6
push 3
push 0x4c1b20
call fcn.0043b5b0
lea ecx, [ebp - 0x220]
call fcn.0043b780
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0048b34a
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
Function at 0x435af0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov eax, dword [0x4d100c]
xor eax, ebp
mov dword [esp + 0x98], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea ebx, [esp + 0x60]
push 0x2b3
push str....._base_files_file_util_win.cc
push str.GetSecureSystemTemp
push ebx
call fcn.00448cb0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.0044a760
cmp dword [ebp + 8], 0
je 0x435d62
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
lea edi, [esp + 4]
mov ecx, edi
call fcn.0043b550
push edi
push 0x65
call fcn.00437650
add esp, 8
test al, al
je 0x435c54
lea esi, [esp + 4]
mov ecx, esi
push 0xa
push str.SystemTemp
push ebx
call fcn.0043cd80
mov ecx, esi
push ebx
call fcn.0043b7c0
mov ecx, ebx
call fcn.0043b780
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x80], xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov dword [esp + 0x94], 0xffffffff
mov dword [esp + 0x90], 0xffffffff
lea ebx, [esp + 0x10]
push 0x209
push str....._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.00448cb0
add esp, 0x10
lea ecx, [esp + 0x60]
push 0
push ebx
call fcn.0044a760
cmp byte [esp + 0xf], 0
jns 0x435c1f
mov esi, dword [esp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
lea ecx, [esp + 0x60]
call fcn.0044a7c0
cmp esi, 0xffffffff
je 0x435c54
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.00435480
add esp, 4
test al, al
jne 0x435d22
mov ecx, edi
call fcn.0043b780
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
mov ecx, edi
call fcn.0043b550
push edi
push 0x67
call fcn.00437650
add esp, 8
test al, al
je 0x435d36
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x80], xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov dword [esp + 0x94], 0xffffffff
mov dword [esp + 0x90], 0xffffffff
lea ebx, [esp + 0x10]
push 0x209
push str....._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.00448cb0
add esp, 0x10
lea esi, [esp + 0x60]
mov ecx, esi
push 0
push ebx
call fcn.0044a760
cmp byte [esp + 0xf], 0
mov eax, edi
jns 0x435cf3
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov ecx, esi
call fcn.0044a7c0
cmp ebx, 0xffffffff
je 0x435d36
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.00435480
add esp, 4
test al, al
je 0x435d36
mov ecx, dword [ebp + 8]
push edi
call fcn.0043b7a0
mov ecx, edi
call fcn.0043b780
mov bl, 1
jmp 0x435d41
lea ecx, [esp + 4]
call fcn.0043b780
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.0044a7c0
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.0048b34a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x435e30
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x4d100c]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea ebx, [esp + 0x10]
push 0x2e9
push str....._base_files_file_util_win.cc
push str.CreateDirectoryAndGetError
push ebx
call fcn.00448cb0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.0044a760
cmp byte [edi + 0xb], 0
mov esi, edi
jns 0x435ea2
mov esi, dword [edi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x435ed4
mov bl, 1
test al, 0x10
jne 0x435f7c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x435ec5
mov dword [eax], 0xfffffff7
push 0x50
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x435f7c
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov ecx, edi
push ebx
call fcn.0043bdb0
push edi
push ebx
call fcn.00435fb0
add esp, 8
test al, al
je 0x435f1e
mov eax, 0xfffffffc
mov edi, 2
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x435f15
mov dword [esi], eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x435f71
push dword [ebp + 0xc]
push ebx
call fcn.00435e30
add esp, 8
test al, al
je 0x435f71
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x435f73
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
cmp eax, 0xb7
jne 0x435f5b
push edi
call fcn.00435590
add esp, 4
test al, al
jne 0x435f73
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x435f9a
mov edi, dword [esp + 0xc]
push edi
call fcn.004515c0
add esp, 4
jmp 0x435f13
xor ebx, ebx
lea ecx, [esp + 0x10]
call fcn.0043b780
lea ecx, [esp + 0x20]
call fcn.0044a7c0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0048b34a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [esp + 0xc]
jmp 0x435f15
Function at 0x436190
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov eax, dword [0x4d100c]
xor eax, ebp
mov dword [esp + 0x258], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x240], xmm0
movdqa xmmword [esp + 0x230], xmm0
movdqa xmmword [esp + 0x220], xmm0
mov dword [esp + 0x254], 0xffffffff
mov dword [esp + 0x250], 0xffffffff
lea ebx, [esp + 0x18]
push 0x41c
push str....._base_files_file_util_win.cc
push 0x4c1b9d
push ebx
call fcn.00448cb0
add esp, 0x10
lea ecx, [esp + 0x220]
push 0
push ebx
call fcn.0044a760
lea eax, [esp + 0x1a]
push 0x206
push 0xff
push eax
call fcn.0048ea80
add esp, 0xc
mov word [esp + 0x18], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x436279
push ebx
call fcn.004a3a77
add esp, 4
mov edi, esp
mov ecx, edi
push eax
push ebx
call fcn.0043b5b0
lea ebx, [esp + 0xc]
mov ecx, edi
push ebx
call fcn.0043cdf0
mov ecx, dword [ebp + 8]
push ebx
call fcn.0043b7c0
mov ecx, ebx
call fcn.0043b780
mov ecx, edi
call fcn.0043b780
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x220]
call fcn.0044a7c0
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.0048b34a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436610
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x4d100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.0048ea80
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.004556b0
mov dword [ebp - 0x500], 0xffffffff
mov dword [ebp - 0x4fc], 0xffffffff
mov dword [ebp - 0x4f8], 0xffffffff
lea eax, [ebp - 0x500]
mov ecx, esi
push eax
call fcn.004558b0
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x436693
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x436815
xor edi, edi
lea ebx, [ebp - 0x4f4]
jmp 0x4366ba
mov edi, esi
test eax, eax
je 0x436817
push 0x250
push 0xff
push ebx
call fcn.0048ea80
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00455870
mov eax, dword [ebp - 0x4f4]
test al, 1
je 0x436730
cmp byte [ebp + 8], 0
jne 0x436710
mov ecx, ebx
call fcn.00455680
test al, al
je 0x43670a
mov ecx, ebx
call fcn.00455680
xor esi, esi
test al, al
je 0x436790
jmp 0x4367d0
mov eax, dword [ebp - 0x4f4]
and eax, 0xfffffffe
cmp byte [ebp - 0x4f5], 0
lea ecx, [ebp - 0x500]
jns 0x436728
mov ecx, dword [ebp - 0x500]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, ebx
call fcn.00455680
test al, al
je 0x436790
xor esi, esi
cmp byte [ebp + 8], 0
je 0x4367d0
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.00436610
add esp, 4
mov esi, eax
test eax, eax
jne 0x4367d0
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x436778
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, 0
test eax, eax
jne 0x4367d0
jmp 0x4367b2
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x4367a5
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
test eax, eax
jne 0x4367d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x4367d0
mov esi, eax
nop word cs:[eax + eax]
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.004108d0
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004558b0
lea ecx, [ebp - 0x500]
push ebx
call fcn.0043b7c0
mov ecx, ebx
call fcn.0043b780
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x4366b0
mov eax, dword [ebp - 0x4fc]
jmp 0x4366b0
xor esi, esi
lea ecx, [ebp - 0x500]
call fcn.0043b780
lea ecx, [ebp - 0x2a4]
call fcn.00455800
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b34a
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x436c60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, dword [ebp + 0xc]
mov eax, dword [0x4d100c]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea edi, [esp + 8]
push 0x4d
push str....._base_file_version_info_win.cc
push str.CreateFileVersionInfoWin
push edi
call fcn.00448cb0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push edi
call fcn.0044a760
mov dword [esp + 4], 0xffffffff
cmp byte [esi + 0xb], 0
jns 0x436cd5
mov esi, dword [esi]
mov edi, dword [ebp + 8]
lea eax, [esp + 4]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x436ddc
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
js 0x436e1d
mov ebx, eax
push eax
call fcn.0048ae0c
add esp, 4
mov edi, eax
mov dword [esp + 8], eax
add eax, ebx
mov dword [esp + 0x10], eax
xor ecx, ecx
nop word cs:[eax + eax]
mov edx, edi
add edx, ecx
je 0x436e02
mov byte [edx], 0
inc ecx
cmp ebx, ecx
jne 0x436d30
mov dword [esp + 0xc], eax
push edi
push ebx
push dword [esp + 0xc]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x436db7
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0xffffffff
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x436db7
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x436db7
push 0x1c
call fcn.0048ae0c
add esp, 4
mov edi, eax
movzx eax, word [esi + 2]
movzx edx, word [esi]
mov ecx, edi
push eax
push edx
lea eax, [esp + 0x10]
push eax
call fcn.00436e40
mov esi, dword [ebp + 8]
mov dword [esi], edi
mov edi, dword [esp + 8]
test edi, edi
jne 0x436dc4
jmp 0x436de4
mov esi, dword [ebp + 8]
mov dword [esi], 0
test edi, edi
je 0x436de4
mov eax, dword [esp + 0xc]
mov ecx, eax
sub ecx, edi
dec eax
cmp ecx, eax
ja 0x436e26
push edi
call fcn.0048ae3c
add esp, 4
jmp 0x436de4
mov dword [edi], 0
mov esi, edi
lea ecx, [esp + 0x20]
call fcn.0044a7c0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0048b34a
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x25
push str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s
call fcn.00414c6c
lea ecx, [esp + 8]
call fcn.00414960
push str.null_pointer_given_to_destroy_at
push str.__loc___nullptr
push 0x41
jmp 0x436e0e
Function at 0x43d610
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x4d6c24]
test ebx, ebx
jne 0x43d6b0
push 0x28
call fcn.0048ae0c
add esp, 4
mov esi, eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov byte [eax + 8], 0
push 0xc
call fcn.0048ae0c
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x43d6ba
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x4d6c24], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x43d6d5
mov edi, eax
push eax
call fcn.004a3a77
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0043d6e0
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x25
push str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s
call fcn.00414c6c
int3
Function at 0x43d6e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x4d100c]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x20]
push 3
push ecx
push eax
push edx
call fcn.00452170
add esp, 0x10
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43d833
mov esi, dword [ebp - 0x20]
mov dword [edi], esi
mov dword [edi + 4], eax
mov dword [ebp - 0x14], 0
push 0x800
push 0
push 0x4c2160
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x30], eax
je 0x43d760
push 0x4c21b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43d770
mov ecx, eax
call dword [section..00cfg]
lea eax, [ebp - 0x14]
push eax
push esi
call ecx
jmp 0x43d76b
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x24], eax
jmp 0x43d777
mov dword [ebp - 0x24], 0
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
test esi, esi
je 0x43d7e7
mov dword [ebp - 0x2c], edi
shl esi, 2
cmp esi, 0x55555555
jae 0x43d887
lea edi, [esi + esi*2]
push edi
call fcn.0048ae0c
add esp, 4
mov ebx, eax
mov dword [ebp - 0x20], eax
add eax, edi
mov dword [ebp - 0x18], eax
xor edi, edi
mov dword [ebp - 0x28], ebx
test ebx, ebx
je 0x43d86c
mov ecx, ebx
mov eax, dword [ebp - 0x24]
push dword [eax + edi]
call fcn.00412be0
add ebx, 0xc
add edi, 4
cmp esi, edi
jne 0x43d7c0
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp - 0x2c]
jmp 0x43d7f0
xor ebx, ebx
mov dword [ebp - 0x28], 0
mov ecx, edi
lea eax, [ebp - 0x20]
push eax
call fcn.0043d470
mov dword [edi], 0
mov dword [edi + 4], 0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x43d81f
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x43d833
cmp ebx, edi
jne 0x43d856
push edi
call fcn.0048ae3c
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b34a
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ebx, esi
cmp esi, edi
je 0x43d82a
lea esi, [ebx - 0xc]
cmp byte [ebx - 1], 0
jns 0x43d850
push dword [ebx - 0xc]
call fcn.0048ae3c
add esp, 4
jmp 0x43d850
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x25
push str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s
call fcn.00414c6c
lea ecx, [ebp - 0x20]
call fcn.00414960
int3
Function at 0x43e1d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x4d100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [0x4d6c2c]
and eax, 1
neg eax
cmp eax, 0xfffffffd
je 0x43e2d4
mov edi, ecx
mov dword [ebp - 0x2c], edx
xor ecx, ecx
jmp 0x43e22e
test bl, bl
js 0x43e2b0
mov ecx, dword [ebp - 0x24]
inc ecx
movzx eax, byte [0x4d6c2c]
xor eax, 3
cmp ecx, eax
jae 0x43e2d4
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x24], ecx
lea eax, [ecx*8 + 0x4c2140]
lea esi, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.0043b680
movzx ebx, byte [ebp - 0x11]
test bl, bl
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov edx, esi
mov dword [ebp - 0x20], ecx
cmovs edx, ecx
mov ecx, ebx
mov dword [ebp - 0x28], eax
cmovs ecx, eax
mov esi, dword [ebp - 0x2c]
cmp esi, ecx
mov eax, ecx
cmovb eax, esi
test eax, eax
js 0x43e2ea
cmp ecx, esi
ja 0x43e210
test ecx, ecx
je 0x43e2c0
xor eax, eax
nop dword [eax]
movzx esi, word [edi + eax*2]
cmp si, word [edx + eax*2]
jne 0x43e210
inc eax
cmp ecx, eax
jne 0x43e290
jmp 0x43e2c0
push dword [ebp - 0x20]
call fcn.0048ae3c
add esp, 4
jmp 0x43e218
test bl, bl
jns 0x43e2d6
push dword [ebp - 0x20]
call fcn.0048ae3c
add esp, 4
mov ebx, dword [ebp - 0x28]
jmp 0x43e2d6
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b34a
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x440a7b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x4d100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4d6c40]
test eax, eax
jne 0x440b5f
mov edi, 0xc
push edi
call fcn.0048ae0c
add esp, 4
mov esi, eax
xor ebx, ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x4d6c40], eax
push edi
call fcn.0048ae0c
add esp, 4
mov edi, eax
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x4d6c44], eax
call fcn.00441fb4
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x28]
push str.user_data_dir
call fcn.00412be0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x34]
push eax
call fcn.00412be0
lea ebx, [ebp - 0x1c]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.004413a7
add esp, 0xc
push edi
push esi
push dword [ebp - 0x38]
push ebx
call fcn.004405c4
add esp, 0x10
mov byte [ebp - 0x38], al
cmp byte [ebx + 0xb], 0
jns 0x440b32
push dword [ebp - 0x1c]
call fcn.0048ae3c
add esp, 4
cmp byte [ebp - 0x29], 0
jns 0x440b43
push dword [ebp - 0x34]
call fcn.0048ae3c
add esp, 4
cmp byte [ebp - 0x1d], 0
jns 0x440b54
push dword [ebp - 0x28]
call fcn.0048ae3c
add esp, 4
cmp byte [ebp - 0x38], 0
je 0x440b80
mov eax, dword [0x4d6c40]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
call fcn.00436850
mov bl, 1
test esi, esi
je 0x440b82
mov ecx, esi
push dword [0x4d6c44]
call fcn.00436850
jmp 0x440b82
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b34a
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x440ecf
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x4d100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x216]
push 0x206
push 0xff
push eax
call fcn.0048ea80
add esp, 0xc
mov edi, 0xfffffff4
lea ebx, [ebp - 0x218]
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [edi + 0x4c2324]
mov word [ebp - 0x218], 0
push 0x104
push ebx
push eax
call esi
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x440f43
push dword [ebp + 8]
push eax
push ebx
call fcn.00440e6d
add esp, 0xc
test al, al
jne 0x440f4c
add edi, 4
jne 0x440f0f
xor ebx, ebx
jmp 0x440f4e
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b34a
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret