joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4236e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x542040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x211
push str....._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.0046dfd0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00465760
cmp byte [edi + 0xb], 0
jns 0x42373c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.004657d0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0048e2e5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x423770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x542040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x21a
push str....._base_files_file_util_win.cc
push str.PathHasAccess
push esi
call fcn.0046dfd0
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.00465760
cmp byte [edi + 0xb], 0
jns 0x4237d1
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
je 0x423867
test al, 0x10
mov edx, dword [esp + 0xc]
cmove edx, dword [ebp + 8]
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
push esi
push ecx
push 3
push esi
push 7
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x42382a
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp ebx, 0xffffffff
je 0x423863
call fcn.0046e000
mov esi, ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
setne bl
lea eax, [esi + 1]
cmp eax, 2
jb 0x423845
call fcn.0046e000
push esi
call fcn.00462e40
add esp, 4
lea ecx, [esp + 0x20]
call fcn.004657d0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0048e2e5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x423823
xor ebx, ebx
jmp 0x423845
Function at 0x423870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x542040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x239
push str....._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.0046dfd0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00465760
cmp byte [edi + 0xb], 0
jns 0x4238cc
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.004657d0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0048e2e5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x423900
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x542040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.004918a0
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x423983
push ebx
call fcn.004a76c4
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.0046eb70
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.0042c620
mov ecx, dword [ebp + 8]
push ebx
call fcn.0046ece0
mov ecx, ebx
call fcn.0046ec60
mov ecx, edi
call fcn.0046ec60
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e2e5
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4239b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x542040]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.004918a0
sub esp, 8
mov dword [esp + 0x10], edi
movsd xmm0, qword [0x5306f0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x423a2d
cmp word [ebp - 0x214], 0
je 0x423a2d
push edi
call fcn.004a76c4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0046eb70
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0048e2e5
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
xor eax, eax
dec eax
lea edi, [ebp - 0x220]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.0046eae0
push edi
call fcn.00423900
add esp, 4
mov ecx, esi
test al, al
jne 0x423a62
push 3
push 0x530760
call fcn.0046eb70
jmp 0x423a68
push edi
call fcn.0046eb40
lea ecx, [ebp - 0x220]
call fcn.0046ec60
jmp 0x423a17
Function at 0x423dc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov eax, dword [0x542040]
xor eax, ebp
mov dword [esp + 0x88], eax
cmp byte [0x548c98], 0
jne 0x423fe4
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x2bf
push str....._base_files_file_util_win.cc
push str.GetSecureSystemTemp
push ebx
call fcn.0046dfd0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00465760
cmp dword [ebp + 8], 0
je 0x423fe8
xor eax, eax
dec eax
lea esi, [esp + 4]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
call fcn.0046eae0
push esi
push 0x65
call fcn.00424e20
add esp, 8
test al, al
je 0x423eda
lea esi, [esp + 4]
mov ecx, esi
push 0xa
push str.SystemTemp
push ebx
call fcn.0042c4e0
mov ecx, esi
push ebx
call fcn.0046ece0
mov ecx, ebx
call fcn.0046ec60
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x50]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x40]
push 0x211
push str....._base_files_file_util_win.cc
push str.PathExists
push edi
call fcn.0046dfd0
add esp, 0x10
mov ecx, ebx
push 0
push edi
call fcn.00465760
cmp byte [esi + 0xb], 0
jns 0x423ec1
mov esi, dword [esp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov ecx, ebx
call fcn.004657d0
cmp esi, 0xffffffff
jne 0x423f8f
lea ecx, [esp + 4]
call fcn.0046ec60
xor eax, eax
dec eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea ebx, [esp + 4]
mov ecx, ebx
call fcn.0046eae0
push ebx
push 0x67
call fcn.00424e20
add esp, 8
test al, al
je 0x423f82
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x50]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x40]
push 0x211
push str....._base_files_file_util_win.cc
push str.PathExists
push edi
call fcn.0046dfd0
add esp, 0x10
mov ecx, esi
push 0
push edi
call fcn.00465760
cmp byte [esp + 0xf], 0
jns 0x423f53
mov ebx, dword [esp + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov ecx, esi
call fcn.004657d0
cmp ebx, 0xffffffff
je 0x423f82
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.00423770
add esp, 4
test al, al
jne 0x423fad
lea ecx, [esp + 4]
call fcn.0046ec60
xor ebx, ebx
jmp 0x423fc3
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.00423770
add esp, 4
test al, al
je 0x423eda
mov ecx, dword [ebp + 8]
lea esi, [esp + 4]
push esi
call fcn.0046ec80
mov ecx, esi
call fcn.0046ec60
mov bl, 1
lea ecx, [esp + 0x10]
call fcn.004657d0
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.0048e2e5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x423fcc
int3
Function at 0x4244e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov eax, dword [0x542040]
xor eax, ebp
mov dword [esp + 0x258], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x430
push str....._base_files_file_util_win.cc
push 0x5307e6
push ebx
call fcn.0046dfd0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00465760
lea esi, [esp + 0x52]
push 0x206
push 0xff
push esi
call fcn.004918a0
add esp, 0xc
mov word [esi - 2], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
dec esi
cmp esi, 0x103
ja 0x4245a6
push ebx
call fcn.004a76c4
add esp, 4
lea edi, [esp + 8]
mov ecx, edi
push eax
push ebx
call fcn.0046eb70
lea ebx, [esp + 0x14]
mov ecx, edi
push ebx
call fcn.0042c620
mov ecx, dword [ebp + 8]
push ebx
call fcn.0046ece0
mov ecx, ebx
call fcn.0046ec60
mov ecx, edi
call fcn.0046ec60
cmp esi, 0x104
setb bl
lea ecx, [esp + 0x20]
call fcn.004657d0
mov ecx, dword [esp + 0x258]
xor ecx, ebp
call fcn.0048e2e5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x424970
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4fc
mov ebx, edx
mov edi, ecx
mov eax, dword [0x542040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.004918a0
add esp, 0xc
mov ecx, esi
push ebx
push 3
push 0
push edi
call fcn.00437c40
xor eax, eax
dec eax
lea edi, [ebp - 0x500]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, esi
push edi
call fcn.00437e40
movsx eax, byte [edi + 0xb]
test eax, eax
jns 0x4249d7
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x424ad4
mov dword [ebp - 0x508], ebx
xor edi, edi
lea ebx, [ebp - 0x4f4]
push 0x250
push 0xff
push ebx
call fcn.004918a0
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00437e00
mov eax, dword [ebp - 0x4f4]
test al, 1
jne 0x424adc
mov ecx, ebx
call fcn.00437c30
test al, al
jne 0x424b33
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x424a3e
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x424ad8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x424a61
mov esi, eax
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00411550
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00437e40
lea ecx, [ebp - 0x500]
push ebx
call fcn.0046ece0
mov ecx, ebx
call fcn.0046ec60
movsx eax, byte [ebp - 0x4f5]
test eax, eax
jns 0x424a9d
mov eax, dword [ebp - 0x4fc]
mov edi, esi
test eax, eax
jne 0x4249ed
lea ecx, [ebp - 0x500]
call fcn.0046ec60
lea ecx, [ebp - 0x2a4]
call fcn.00437d90
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e2e5
mov eax, esi
add esp, 0x4fc
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x424aa7
xor esi, esi
jmp 0x424a61
cmp byte [ebp + 8], 0
jne 0x424b0c
lea ecx, [ebp - 0x4f4]
call fcn.00437c30
test al, al
je 0x424b06
lea ecx, [ebp - 0x4f4]
call fcn.00437c30
test al, al
je 0x424a29
jmp 0x424ad8
mov eax, dword [ebp - 0x4f4]
cmp byte [ebp - 0x4f5], 0
js 0x424b1d
lea ecx, [ebp - 0x500]
jmp 0x424b23
mov ecx, dword [ebp - 0x500]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x424a1a
xor esi, esi
cmp byte [ebp + 8], 0
je 0x424a61
lea ecx, [ebp - 0x500]
mov dword [ebp - 0x504], ecx
mov edx, dword [ebp - 0x508]
push 1
call fcn.00424970
add esp, 4
mov esi, eax
test eax, eax
jne 0x424a61
cmp byte [ebp - 0x4f5], 0
jns 0x424b7a
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x504], eax
push dword [ebp - 0x504]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, 0
test eax, eax
jne 0x424a61
jmp 0x424a4d
Function at 0x425b30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov dword [esp + 0xc], edx
mov eax, dword [0x542040]
xor eax, ebp
mov dword [esp + 0xa8], eax
xor ebx, ebx
test ecx, ecx
je 0x425caa
push ebx
push ebx
push ecx
mov dword [esp + 0x1c], ecx
call fcn.004a50c9
add esp, 0xc
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x70]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x30]
push 0x4f
push str....._base_files_file_util.cc
push str.ReadStreamToSpanWithMaxSize
push edi
call fcn.0046dfd0
add esp, 0x10
mov ecx, esi
push ebx
push edi
call fcn.00465760
mov dword [edi + 0x30], ebx
pxor xmm0, xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
push dword [esp + 0x10]
call fcn.0049d570
add esp, 4
push eax
call fcn.0049dd6d
add esp, 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x425cc2
mov eax, dword [esp + 0x54]
xor ecx, ecx
mov edx, eax
neg edx
sbb ecx, dword [esp + 0x50]
mov edi, 0xffff
cmovl edi, eax
mov eax, dword [esp + 0xc]
cmp edi, eax
cmovae edi, eax
inc edi
xor eax, eax
dec eax
lea ebx, [esp + 0x28]
mov dword [ebx], eax
mov dword [ebx + 4], eax
lea ecx, [ebp + 8]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], eax
call dword [0x53cee4]
mov eax, dword [esp + 0x20]
push edi
push eax
push ebx
mov dword [esp + 0x24], ecx
call ecx
add esp, 0xc
xor esi, esi
mov eax, dword [ebx]
add eax, esi
push dword [esp + 0x10]
push edi
push 1
push eax
call fcn.004a4dd9
add esp, 0x10
test eax, eax
je 0x425c68
mov ebx, eax
mov eax, dword [esp + 0xc]
sub eax, esi
cmp eax, ebx
jb 0x425ccc
add ebx, esi
push dword [esp + 0x10]
call fcn.004a474f
add esp, 4
test eax, eax
je 0x425cd4
mov esi, ebx
push dword [esp + 0x10]
call fcn.004a477b
add esp, 4
test eax, eax
sete bl
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa4], eax
mov ecx, dword [esp + 0x18]
call dword [0x53cee4]
mov eax, dword [esp + 0xa4]
lea edx, [esp + 0x20]
push esi
push eax
push edx
call ecx
add esp, 0xc
lea ecx, [esp + 0x70]
call fcn.004657d0
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.0048e2e5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0xffff
jmp 0x425bf2
xor ebx, ebx
mov esi, dword [esp + 0xc]
jmp 0x425c79
test esi, esi
mov eax, 0x10000
cmove edi, eax
lea eax, [ebx + edi]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa4], eax
mov ecx, dword [esp + 0x18]
call dword [0x53cee4]
mov eax, dword [esp + 0xa4]
lea esi, [esp + 0x20]
push dword [esp + 0x1c]
push eax
push esi
call ecx
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
mov esi, ebx
jmp 0x425c32
Function at 0x429a50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [0x542040]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00429bd0
mov eax, dword [edi]
mov dword [0x544014], eax
mov bl, 1
test al, 1
jne 0x429a8c
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e2e5
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x548d40]
test eax, eax
je 0x429ab6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x548d40], 0
cmp dword [0x548d44], 0
jne 0x429ab6
and byte [0x544014], 0xfe
mov eax, dword [edi + 0x18]
test eax, eax
je 0x429ad3
movsx ecx, byte [edi + 0xf]
test ecx, ecx
jns 0x429ac8
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x429b3e
mov dword [0x548d40], eax
jmp 0x429a78
movsx eax, byte [edi + 0xf]
test eax, eax
jns 0x429ade
mov eax, dword [edi + 8]
test eax, eax
je 0x429b7f
lea esi, [edi + 4]
mov ecx, dword [0x548d44]
test ecx, ecx
jne 0x429b12
push 0xc
call fcn.0048d95d
add esp, 4
mov ecx, eax
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [0x548d44], eax
push esi
call fcn.0045eb50
cmp dword [edi + 0x14], 0
jne 0x429b32
mov eax, dword [0x548d44]
cmp byte [eax + 0xb], 0
jns 0x429b2b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004d45e0
mov ebx, eax
jmp 0x429a78
lea eax, [ebp - 0x24]
push 0x231
push str....._baselogging.cc
push str.BaseInitLoggingImpl_built_with_NDEBUG
push eax
call fcn.0046dfd0
add esp, 0x10
lea esi, [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
push 0x7f
push str.settings.log_file_path.empty__
push esi
call fcn.004d6450
add esp, 0x10
mov ecx, esi
call fcn.004d6610
mov eax, dword [edi + 0x18]
jmp 0x429acc
lea ebx, [ebp - 0x24]
push 0x237
push str....._baselogging.cc
push str.BaseInitLoggingImpl_built_with_NDEBUG
push ebx
call fcn.0046dfd0
add esp, 0x10
lea esi, [ebp - 0x28]
push ebx
push 0x7f
push str._settings.log_file_path.empty__
push esi
call fcn.004d6450
add esp, 0x10
mov ecx, esi
push str.LOG_TO_FILE_set_but_no_log_file_path_
call fcn.004d45b0
mov ecx, esi
call fcn.004d6610
jmp 0x429ae6
Function at 0x42ce70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10010
call fcn.0048e6f0
mov esi, dword [ebp + 8]
mov eax, dword [0x542040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1001c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
push edx
push ecx
push ebx
call fcn.004664c0
add esp, 0xc
test esi, esi
je 0x42cf29
lea edi, [ebp - 0x1000e]
push 0xfffe
push 0xff
push edi
call fcn.004918a0
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x42ced5
mov ebx, dword [ebp - 0x1001c]
push 0x7fff
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x42cefb
cmp eax, 0x7fff
jae 0x42cf52
push esi
push eax
push edi
call fcn.00427c30
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x42cf12
push dword [ebp - 0x1001c]
call fcn.0048d98d
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e2e5
mov eax, ebx
add esp, 0x10010
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp - 0x10011], 0
js 0x42cf3a
lea eax, [ebp - 0x1001c]
jmp 0x42cf40
mov eax, dword [ebp - 0x1001c]
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x42cefb
int3

Function at 0x42d430
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x548dbc]
test ebx, ebx
jne 0x42d4b4
push 0x28
call fcn.0048d95d
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.0048d95d
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x42d4be
mov dword [eax + 8], edi
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x548dbc], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x42d4c5
mov edi, eax
push eax
call fcn.004a76c4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0042d4e0
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
jmp 0x42d4ca
push str....._third_partylibc_srcinclude_string_view:268:_assertion___s___nullptr_failed:_null_pointer_passed_to_non_null_argument_of_char_traits_..._::length_n
push 0x524b41
call fcn.004bbec0
int3
Function at 0x435fd0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x542040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x553668]
mov ecx, dword [0x545744]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x43601d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e2e5
mov eax, 0x553664
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x553668
call fcn.0048d9d1
add esp, 4
cmp dword [0x553668], 0xffffffff
jne 0x436003
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.004918a0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x58
call fcn.0048d95d
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x553698]
mov ecx, dword [0x545744]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4360c6
mov ecx, esi
push ebx
push 0x553674
push edi
call fcn.004361c0
mov dword [0x553664], esi
push 0x553668
call fcn.0048da4b
add esp, 4
jmp 0x436003
push 0x553698
call fcn.0048d9d1
add esp, 4
cmp dword [0x553698], 0xffffffff
jne 0x4360a0
xorps xmm0, xmm0
movups xmmword [0x553684], xmm0
movups xmmword [0x553674], xmm0
mov dword [0x553694], 0
push 0x553674
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x553698
call fcn.0048da4b
add esp, 4
jmp 0x4360a0

Function at 0x436120
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x553698]
mov ecx, dword [0x545744]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x436151
movzx eax, word [0x553674]
cmp eax, 9
jne 0x43619c
xor eax, eax
inc eax
pop ebp
ret
push 0x553698
call fcn.0048d9d1
add esp, 4
cmp dword [0x553698], 0xffffffff
jne 0x436140
xorps xmm0, xmm0
movups xmmword [0x553684], xmm0
movups xmmword [0x553674], xmm0
mov dword [0x553694], 0
push 0x553674
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x553698
call fcn.0048da4b
add esp, 4
jmp 0x436140
test eax, eax
je 0x43614f
cmp eax, 6
jne 0x4361ac
mov eax, 2
jmp 0x43614f
cmp eax, 0xc
jne 0x4361b8
mov eax, 3
jmp 0x43614f
mov eax, 4
jmp 0x43614f
Function at 0x436ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov eax, dword [0x542040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x436bdc
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [ebp - 0x44], eax
call dword [0x53cee4]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x53cee4]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x53cee4]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x436b81
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x436b75
push 1
call fcn.00476970
add esp, 4
bt eax, 0x19
jae 0x436be0
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403380
add esp, 0xc
mov eax, 0x401b90
mov ecx, section..text
lea edx, [ebp - 0x20]
mov edi, dword [ebp - 0x44]
mov dword [esi + 0xf4], ecx
mov dword [esi + 0xf8], eax
movups xmm0, xmmword [edx]
movups xmmword [edi], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048e2e5
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x436bc8
bt eax, 9
jae 0x436c01
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403ea0
add esp, 0xc
xor eax, eax
mov ecx, 0x403f50
jmp 0x436bad
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.004d99b0
add esp, 0xc
mov eax, 0x4da140
mov ecx, 0x4d98c0
jmp 0x436bad