joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420560
Capabilities:
Create thread

Disassembly:
push 0xcc
mov eax, 0x4ce284
call fcn.0044dabe
mov ebx, 0x4fd3b0
push ebx
push 0x11c
call fcn.00448e3d
xor edi, edi
pop ecx
pop ecx
cmp eax, edi
je 0x420598
push 0x54485245
mov esi, eax
call fcn.0041fdf3
mov dword [ebp - 0x30], eax
jmp 0x42059b
mov dword [ebp - 0x30], edi
mov esi, dword [ebp - 0x30]
cmp esi, edi
jne 0x4205b7
xor ecx, ecx
push str.Allocate_memory_for_CreateThread_failed_
inc ecx
call fcn.0042181f
pop ecx
xor eax, eax
jmp 0x4206cd
push ebx
push 8
call fcn.00448e3d
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
jne 0x4205dc
xor ecx, ecx
push str.Failed_to_allocate_memory_in_CreateThread
inc ecx
call fcn.0042181f
pop ecx
call fcn.004206d3
jmp 0x4205b0
mov eax, dword [ebp + 0xc]
push 0xc
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
pop esi
push esi
mov dword [ebx], eax
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.00447b70
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
push 0x420542
lea eax, [ebp - 0x40]
push edi
push eax
mov dword [ebp - 0x40], esi
call fcn.0044c529
mov ecx, dword [ebp - 0x30]
add esp, 0x18
mov dword [ecx + 8], eax
cmp eax, edi
jne 0x4206c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0xd8]
push eax
call fcn.00404d9c
lea eax, [ebp - 0xd8]
push str.::CreateThread_failed__err_
push eax
mov dword [ebp - 4], edi
call fcn.00405e4c
pop ecx
pop ecx
push esi
lea eax, [ebp - 0xd8]
push eax
call fcn.0040aae0
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0xd8]
call fcn.00404d5e
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x420676
lea eax, [ebp - 0x2c]
xor ecx, ecx
push eax
inc ecx
call fcn.0042181f
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00401198
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.00404e06
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], vtable.std::ios_base.0
call fcn.00445c6f
mov esi, dword [ebp - 0x30]
pop ecx
call fcn.004206d3
push ebx
call fcn.00447004
jmp 0x4205af
mov eax, dword [ebp - 0x34]
mov dword [ecx + 4], eax
mov eax, ecx
call fcn.0044db41
ret
Function at 0x42073a
Capabilities:
Check mutex on windows

Disassembly:
push 0xd0
mov eax, 0x4cf69d
call fcn.0044dabe
mov eax, dword [ebp + 8]
push 0x4fd3b0
push 0x11c
mov ebx, ecx
mov dword [ebp - 0x44], eax
call fcn.00448e3d
xor edi, edi
pop ecx
pop ecx
cmp eax, edi
je 0x42077b
push 0x4d555458
mov esi, eax
call fcn.0041fdf3
mov esi, eax
mov dword [ebp - 0x34], esi
jmp 0x420780
mov dword [ebp - 0x34], edi
mov esi, edi
cmp esi, edi
jne 0x420799
xor ecx, ecx
push str.Allocate_memory_for_CreateMutex_failed_
inc ecx
call fcn.0042181f
pop ecx
xor eax, eax
jmp 0x4208bb
mov edx, ebx
mov ecx, esi
call fcn.0041fe17
test al, al
jne 0x4207ad
call fcn.004206d3
jmp 0x420792
mov dword [ebp - 0x40], 0xc
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
cmp ebx, edi
je 0x4207c9
lea eax, [ebp - 0x40]
push eax
call fcn.0041ff12
xor edi, edi
push ebx
push edi
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 8], eax
cmp eax, edi
jne 0x420894
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0xdc]
push eax
call fcn.00404d9c
lea eax, [ebp - 0xdc]
push str.CreateMutex_failed__err_
push eax
mov byte [ebp - 4], 1
call fcn.00405e4c
pop ecx
pop ecx
push esi
lea eax, [ebp - 0xdc]
push eax
call fcn.0040aae0
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0xdc]
call fcn.00404d5e
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x420839
lea eax, [ebp - 0x30]
xor ecx, ecx
push eax
inc ecx
call fcn.0042181f
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00401198
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0
call fcn.00404e06
lea eax, [ebp - 0x8c]
push eax
mov dword [ebp - 0x8c], vtable.std::ios_base.0
call fcn.00445c6f
mov esi, dword [ebp - 0x34]
pop ecx
call fcn.004206d3
cmp dword [ebp - 0x3c], edi
je 0x420792
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x420792
mov ebx, dword [ebp - 0x44]
cmp ebx, edi
je 0x4208ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
mov byte [ebx], al
cmp dword [ebp - 0x3c], edi
je 0x4208b9
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
call fcn.0044db41
ret
Function at 0x4208c1
Capabilities:
Check mutex on windows

Disassembly:
push 0xbc
mov eax, 0x4ce249
call fcn.0044dabe
push 0x4fd3b0
push 0x11c
call fcn.00448e3d
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x30], esi
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x4208fd
push 0x434f4e44
call fcn.0041fdf3
mov ebx, eax
jmp 0x4208ff
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
cmp ebx, edi
jne 0x42091c
xor ecx, ecx
push str.Allocate_memory_for_CreateConditionVar_failed_
inc ecx
call fcn.0042181f
pop ecx
xor eax, eax
jmp 0x420a92
push edi
push 0x7fffffff
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [ebx + 8], eax
cmp eax, edi
jne 0x4209e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00404d9c
lea eax, [ebp - 0xc8]
push str.CreateConditionVar_failed__err_
push eax
mov dword [ebp - 4], 2
call fcn.00405e4c
pop ecx
pop ecx
push esi
lea eax, [ebp - 0xc8]
push eax
call fcn.0040aae0
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0xc8]
call fcn.00404d5e
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x42098e
lea eax, [ebp - 0x2c]
xor ecx, ecx
push eax
inc ecx
call fcn.0042181f
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00401198
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.00404e06
lea eax, [ebp - 0x78]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x78], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], vtable.std::ios_base.0
call fcn.00445c6f
pop ecx
mov esi, ebx
call fcn.004206d3
jmp 0x420915
push edi
push edi
push edi
mov dword [ebx + 0x114], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebx + 0x10c], eax
cmp eax, edi
jne 0x420a90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00404d9c
lea eax, [ebp - 0xc8]
push str.CreateMutex_failed_in_CreateConditionVar__err_
push eax
mov dword [ebp - 4], 7
call fcn.00405e4c
pop ecx
pop ecx
push esi
lea eax, [ebp - 0xc8]
push eax
call fcn.0040aae0
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0xc8]
call fcn.00404d5e
mov byte [ebp - 4], 8
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x420a58
lea eax, [ebp - 0x2c]
xor ecx, ecx
push eax
inc ecx
call fcn.0042181f
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 7
call fcn.00401198
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.00404e06
lea eax, [ebp - 0x78]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x78], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
jmp 0x4209c1
mov eax, ebx
call fcn.0044db41
ret
Function at 0x42137a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x3c
mov eax, 0x4cd09d
call fcn.0044daf4
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, edx
mov dword [ebp - 0x44], eax
cmp dword [ecx + 0x10], ebx
je 0x4213d7
cmp dword [esi + 0x10], ebx
je 0x4213d7
cmp eax, ebx
je 0x4213d7
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.0042116b
pop ecx
pop ecx
cmp al, bl
jne 0x4213df
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00401198
xor al, al
call fcn.0044db50
ret
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x4213eb
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x40]
push ecx
push 0x201
push ebx
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4213cb
cmp dword [esi + 0x14], 8
mov eax, dword [ebp - 0x40]
push 4
pop edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x3c], ebx
jb 0x42141a
mov esi, dword [esi]
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x3c]
push ecx
push ebx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x421450
cmp dword [ebp - 0x34], ebx
je 0x421440
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00401198
mov al, bl
jmp 0x4213d9
cmp dword [ebp - 0x3c], edi
sete byte [ebp - 0x35]
cmp dword [ebp - 0x34], ebx
je 0x421465
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, byte [ebp - 0x35]
jmp 0x421440
Function at 0x421470
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x50
mov eax, 0x4cd070
call fcn.0044daf4
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, edx
mov dword [ebp - 0x5c], eax
cmp dword [ecx + 0x10], ebx
je 0x4214c9
cmp dword [edi + 0x10], ebx
je 0x4214c9
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 1
call fcn.0042116b
pop ecx
pop ecx
cmp al, bl
jne 0x4214d1
push 1
xor edi, edi
lea esi, [ebp - 0x34]
call fcn.00401198
xor al, al
call fcn.0044db50
ret
cmp dword [ebp - 0x20], 8
mov eax, dword [ebp - 0x34]
jae 0x4214dd
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x54]
push ecx
push 0x201
push ebx
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4214bd
mov esi, dword [ebp - 0x54]
mov dword [ebp - 0x38], esi
mov byte [ebp - 4], 2
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
jb 0x42150f
mov eax, dword [edi]
jmp 0x421511
mov eax, edi
lea ecx, [ebp - 0x3c]
push ecx
push ebx
lea ecx, [ebp - 0x40]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x421534
cmp esi, ebx
je 0x4214bd
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4214bd
cmp dword [ebp - 0x40], 1
jne 0x421527
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x58]
shr eax, 1
push ecx
lea esi, [ebp - 0x50]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
call fcn.00405642
mov byte [ebp - 4], 3
cmp dword [edi + 0x14], 8
jb 0x421563
mov edi, dword [edi]
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x50]
lea eax, [ebp - 0x40]
push eax
push ebx
push edi
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea esi, [ebp - 0x50]
test eax, eax
je 0x421593
call fcn.0041a6ce
cmp dword [ebp - 0x38], ebx
je 0x4214bd
push dword [ebp - 0x38]
jmp 0x42152c
cmp dword [ebp - 0x40], 1
je 0x4215bf
call fcn.0041a6ce
cmp dword [ebp - 0x38], ebx
je 0x4215ac
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
xor edi, edi
lea esi, [ebp - 0x34]
call fcn.00401198
mov al, bl
jmp 0x4214cb
mov eax, dword [ebp - 0x3c]
shr eax, 1
call fcn.0041715a
mov eax, dword [ebp - 0x4c]
cmp word [eax - 2], bx
jne 0x4215dd
cmp dword [ebp - 0x50], eax
je 0x4215dd
add eax, 0xfffffffe
mov dword [ebp - 0x4c], eax
sub eax, dword [ebp - 0x50]
mov edi, dword [ebp - 0x5c]
mov esi, eax
sar esi, 1
mov eax, esi
mov ecx, edi
call fcn.00416b95
cmp dword [edi + 0x14], 8
jb 0x4215f8
mov edi, dword [edi]
lea eax, [esi + esi]
push eax
push dword [ebp - 0x50]
push edi
call fcn.00447440
add esp, 0xc
lea esi, [ebp - 0x50]
call fcn.0041a6ce
cmp dword [ebp - 0x38], ebx
je 0x42161e
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x4215ac
Function at 0x421628
Capabilities:
Set registry value

Disassembly:
push 0x30
mov eax, 0x4cd033
call fcn.0044daf4
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, edx
cmp dword [ecx + 0x10], ebx
je 0x42167e
cmp dword [edi + 0x10], ebx
je 0x42167e
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.0042116b
pop ecx
pop ecx
cmp al, bl
jne 0x421686
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00401198
xor al, al
call fcn.0044db50
ret
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], ebx
jae 0x421695
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push ebx
push 0x202
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x421672
cmp dword [esi + 0x14], 8
mov edx, dword [ebp - 0x3c]
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x34], edx
jb 0x4216c5
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x4216cf
mov ecx, dword [edi]
jmp 0x4216d1
mov ecx, edi
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x421707
cmp dword [ebp - 0x34], ebx
je 0x4216f4
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00401198
mov al, bl
jmp 0x421680
cmp dword [ebp - 0x34], ebx
je 0x421715
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x4216f4
Function at 0x421c79
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x80
mov eax, 0x4cd003
call fcn.0044daf4
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x8c], eax
cmp eax, edi
je 0x421d15
lea eax, [ebp - 0x70]
push eax
push 0xf023f
push edi
push str.SOFTWARENVIDIA_CorporationGlobalNVUpdatus
push 0x80000002
mov dword [ebp - 0x70], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x421d15
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
lea eax, [ebp - 0x88]
push eax
push edi
lea eax, [ebp - 0x84]
push eax
push edi
mov dword [ebp - 4], edi
mov ebx, str.Link
push ebx
push dword [ebp - 0x70]
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x84], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov byte [ebp - 4], 1
cmp eax, edi
jne 0x421d8c
cmp dword [ebp - 0x84], 1
je 0x421d1b
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebp - 0x80]
call fcn.0041a6ce
call fcn.0044db50
ret
mov eax, dword [ebp - 0x88]
shr eax, 1
lea esi, [ebp - 0x80]
call fcn.0041715a
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x80]
lea eax, [ebp - 0x84]
push eax
push edi
push ebx
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x70]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x70], edi
cmp esi, edi
jne 0x421d0d
cmp dword [ebp - 0x84], 1
jne 0x421d0d
mov ecx, dword [ebp - 0x7c]
sub ecx, dword [ebp - 0x80]
push 0x27
sar ecx, 1
pop eax
cmp ecx, eax
jbe 0x421de9
lea esi, [ebp - 0x80]
call fcn.0041715a
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x7c]
sub ecx, eax
sar ecx, 1
xor edx, edx
mov word [eax + ecx*2 - 2], dx
jmp 0x421de9
push 0x27
pop eax
lea esi, [ebp - 0x80]
call fcn.0041715a
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x421d04
mov esi, dword [ebp - 0x7c]
sub esi, dword [ebp - 0x80]
lea eax, [ebp - 0x44]
sar esi, 1
push esi
push dword [ebp - 0x80]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [esi + esi]
push eax
push dword [ebp - 0x80]
push 1
push edi
push ebx
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x70]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x70], edi
cmp esi, edi
jne 0x421d0d
mov esi, 0x4e63f8
push esi
lea eax, [ebp - 0x6c]
push eax
call fcn.00404c84
mov byte [ebp - 4], 2
push dword [ebp - 0x80]
lea ebx, [ebp - 0x50]
mov ecx, eax
call fcn.00404d08
push esi
lea ebx, [ebp - 0x34]
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00404d08
push 1
xor edi, edi
lea esi, [ebp - 0x50]
call fcn.00401198
push 1
lea esi, [ebp - 0x6c]
call fcn.00401198
cmp dword [ebp - 0x20], 8
mov eax, dword [ebp - 0x34]
jae 0x421e39
mov eax, ebx
cmp dword [ebp - 0x20], 8
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0x34]
jae 0x421e4b
lea ecx, [ebp - 0x34]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push ecx
push dword [ebp - 0x8c]
call fcn.00447440
add esp, 0xc
push 1
xor edi, edi
lea esi, [ebp - 0x34]
call fcn.00401198
jmp 0x421d0d
Function at 0x424e6b
Capabilities:
Write file on windows

Disassembly:
push 0x44
mov eax, 0x4d1bda
call fcn.0044dabe
push 0x4e1840
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call fcn.004243cb
push eax
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
call fcn.00424486
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.0041d23b
pop ecx
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0041d625
lea eax, [ebp - 0x2c]
call fcn.0041d568
mov edi, dword [ebp - 0x1c]
cmp edi, ebx
je 0x424f4a
xor eax, eax
mov ecx, edi
and ecx, eax
mov dword [ebp - 0x50], edi
cmp ecx, 0xffffffff
je 0x424f4a
mov ecx, edi
or ecx, eax
je 0x424f4a
lea eax, [esi + 0x50]
cmp dword [eax + 0x14], 8
jb 0x424ee1
mov eax, dword [eax]
push 0x4de2f8
push eax
call fcn.00446e9a
cmp dword [ebp - 0x18], 0x10
pop ecx
mov ebx, eax
mov eax, dword [ebp - 0x2c]
pop ecx
jae 0x424efc
lea eax, [ebp - 0x2c]
push ebx
push edi
push 1
push eax
call fcn.00448990
push ebx
mov esi, eax
xor edi, edi
call fcn.0044707c
mov eax, esi
add esp, 0x14
or eax, edi
je 0x424f46
mov eax, esi
and eax, edi
cmp eax, 0xffffffff
je 0x424f46
cmp esi, dword [ebp - 0x50]
jne 0x424f46
xor eax, eax
cmp edi, eax
jne 0x424f46
push eax
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401154
push 1
lea esi, [ebp - 0x48]
call fcn.00401198
mov al, 1
jmp 0x424f63
push 0
jmp 0x424f4b
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401154
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.00401198
xor al, al
call fcn.0044db41
ret
Function at 0x428ee1
Capabilities:
Read file on windows

Disassembly:
push 0x444
mov eax, 0x4d0fc0
call fcn.0044daf4
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 8
mov edi, ecx
mov dword [ebp - 0x440], eax
mov dword [eax + 0x10], ebx
jb 0x428f0b
mov eax, dword [eax]
xor ecx, ecx
push 0xc
mov word [eax], cx
call fcn.00447c3b
mov esi, eax
pop ecx
mov dword [ebp - 0x444], esi
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x428f75
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.004289c7
test al, al
jne 0x428f77
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x43c], str.HashImplementation::reset_failed
call fcn.00447350
push 0x4ee2a8
lea eax, [ebp - 0x450]
push eax
mov dword [ebp - method.std::logic_error.virtual_0], vtable.std::runtime_error.0
call fcn.0044d625
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x43c], ebx
mov byte [ebp - 4], 2
cmp dword [edi + 0x14], 8
jb 0x428f8d
mov eax, dword [edi]
jmp 0x428f8f
mov eax, edi
push 0x4e149c
push eax
call fcn.00446e9a
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x428fba
test esi, esi
je 0x428fb2
call fcn.00428e8e
push esi
call fcn.00447004
pop ecx
xor al, al
call fcn.0044db50
ret
push edi
call fcn.0044cb93
pop ecx
push edi
test eax, eax
jne 0x429008
push 0x400
lea eax, [ebp - 0x41c]
push 1
push eax
call fcn.00448614
add esp, 0x10
test eax, eax
je 0x428fba
push eax
lea eax, [ebp - 0x41c]
push eax
mov eax, ebx
call fcn.00428a16
test al, al
jne 0x428fba
push edi
call fcn.0044707c
pop ecx
test ebx, ebx
je 0x428fb2
mov esi, ebx
call fcn.00428e8e
push ebx
jmp 0x428fac
call fcn.0044707c
pop ecx
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x43c]
call fcn.00428ec8
mov ecx, dword [ebp - 0x440]
push 0xffffffffffffffff
push 0
mov byte [ebp - 4], 3
call fcn.00405528
push 1
xor edi, edi
lea esi, [ebp - 0x438]
call fcn.00401198
test ebx, ebx
je 0x429054
mov esi, ebx
call fcn.00428e8e
push ebx
call fcn.00447004
pop ecx
mov al, 1
jmp 0x428fb4

Function at 0x429225
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x429256
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push edx
sub eax, ecx
push 1
push eax
push ecx
call fcn.00448990
add esp, 0x10
cmp eax, 1
jne 0x429252
mov al, al
jmp 0x429258
mov byte [esi + 0x18], 1
xor al, al
pop esi
pop ebp
ret 4
Function at 0x4296d6
Capabilities:
Check for peb ntglobalflag flag
Read http header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cf276
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x4fa654]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov eax, dword [0x4fa654]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
xor ebx, ebx
push ebx
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push 0x16
mov esi, edx
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
call edi
cmp eax, ebx
jne 0x4297da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x4297da
push str.WinHttpQueryHeaders_failed:
lea eax, [esp + 0x28]
push eax
call fcn.00404c84
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x2c]
mov ecx, esi
mov dword [esp + 0x90], ebx
call fcn.00405528
or dword [esp + 0x88], 0xffffffff
push 1
xor edi, edi
lea esi, [esp + 0x28]
call fcn.00401198
lea eax, [esp + 0x40]
push eax
call fcn.00420059
pop ecx
mov esi, dword [esp + 0x18]
push ebx
push eax
inc edi
or eax, 0xffffffff
mov dword [esp + 0x90], edi
call fcn.004058b2
push edi
xor edi, edi
lea esi, [esp + 0x44]
call fcn.00401198
xor al, al
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.004466c5
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
shr eax, 1
lea esi, [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.0041715a
push ebx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x90], 2
push dword [esp + 0x2c]
push ebx
push 0x16
push dword [esp + 0x34]
call edi
test eax, eax
jne 0x42988f
push str.WinHttpQueryHeaders_failed:
lea eax, [esp + 0x44]
push eax
call fcn.00404c84
mov ecx, dword [esp + 0x18]
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x48]
mov byte [esp + 0x90], 3
call fcn.00405528
push 1
xor edi, edi
lea esi, [esp + 0x44]
mov byte [esp + 0x8c], 2
call fcn.00401198
lea eax, [esp + 0x5c]
push eax
call fcn.00420059
pop ecx
mov esi, dword [esp + 0x18]
push ebx
push eax
or eax, 0xffffffff
mov byte [esp + 0x90], 4
call fcn.004058b2
push 1
lea esi, [esp + 0x60]
call fcn.00401198
lea esi, [esp + 0x24]
call fcn.0041a6ce
mov al, bl
jmp 0x4297b9
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, esi
call fcn.00416b95
cmp dword [esi + 0x14], 8
jb 0x4298a6
mov esi, dword [esi]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x24]
sar eax, 1
add eax, eax
push eax
push dword [esp + 0x28]
push esi
call fcn.00447440
add esp, 0xc
mov bl, 1
jmp 0x42987f