joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433890
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x521014]
xor ecx, ebp
mov esi, 0x7fffffff
cmp eax, esi
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push edx
mov edi, ebx
push ebx
call ecx
test eax, eax
je 0x433908
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4338f5
cmp ebx, 0xffffffff
je 0x43391a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x43391d
mov ebx, dword [ebp - 0x14]
jmp 0x4338e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x4338e1
int3
mov edx, dword [ebp + 0xc]
jmp 0x4338b7

Function at 0x433ab0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ecx + 8]
inc eax
cmp eax, 2
jae 0x433b2f
mov esi, ecx
push dword [ebp + 8]
call fcn.00433930
add esp, 4
mov edi, eax
cmp dword [esi + 8], eax
je 0x433afe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 8]
inc eax
cmp eax, 2
jae 0x433b16
mov eax, edi
inc eax
cmp eax, 2
jb 0x433af4
mov dword [esi + 8], edi
call fcn.0046eab0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi + 8]
lea eax, [edi + 1]
cmp eax, 2
jb 0x433b09
mov dword [esi + 0x14], edi
cmp eax, 2
setae al
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0046eab0
push dword [esi + 8]
call fcn.00471760
add esp, 4
mov dword [esi + 8], 0
jmp 0x433ae4
int3
Function at 0x436070
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc0
mov ebx, dword [ebp + 8]
mov eax, dword [0x521014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x436093
mov eax, dword [ebx]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x43611e
mov edi, eax
push eax
call fcn.0048b3a3
add esp, 4
mov esi, eax
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x4360b6
mov eax, dword [ebx]
push esi
push edi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x436125
xor eax, eax
dec eax
lea ecx, [ebp - 0xc4]
mov dword [ecx], eax
lea edx, [ebp - 0xc8]
mov dword [edx], eax
push edx
push ecx
push 0x506338
push esi
call sub.VERSION.dll_VerQueryValueW
mov edi, eax
test eax, eax
je 0x4361d5
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc4]
movups xmm0, xmmword [ecx]
movups xmm1, xmmword [ecx + 0x10]
movups xmmword [eax + 0x10], xmm1
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x30], edx
movups xmm1, xmmword [ecx + 0x20]
movups xmmword [eax + 0x20], xmm1
movups xmmword [eax], xmm0
mov ecx, dword [eax + 0x18]
and dword [eax + 0x1c], ecx
jmp 0x43621c
xor ebx, ebx
jmp 0x43622e
push 1
call fcn.0046eac0
add esp, 4
test al, al
je 0x4361d1
call fcn.004cd8a0
lea ecx, [ebp - 0xb8]
push eax
push 1
push 0x23
push str..._.._chrome_installer_lite_util_crash_reporter_module_version.cc
call fcn.004cd9d0
lea eax, [ebp - 0xb0]
push 0x14
push str.GetFileVersionInfo:
push eax
call fcn.00467790
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
mov dword [ebp - 0xcc], eax
jns 0x43617a
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
lea edi, [ebp - 0xc4]
push ecx
push ebx
push edi
call fcn.00470750
add esp, 0xc
movzx eax, byte [edi + 0xb]
test al, al
jns 0x43619f
mov eax, dword [ebp - 0xc0]
mov edi, dword [ebp - 0xc4]
push eax
push edi
push dword [ebp - 0xcc]
call fcn.00467790
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x4361c6
push dword [ebp - 0xc4]
call fcn.0048b376
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004cda30
xor ebx, ebx
jmp 0x436221
push 1
call fcn.0046eac0
add esp, 4
test al, al
je 0x43621c
call fcn.004cd8a0
lea ebx, [ebp - 0xb8]
mov ecx, ebx
push eax
push 1
push 0x2e
push str..._.._chrome_installer_lite_util_crash_reporter_module_version.cc
call fcn.004cd9d0
lea eax, [ebp - 0xb0]
push 0xd
push str.VerQueryValue
push eax
call fcn.00467790
add esp, 0xc
mov ecx, ebx
call fcn.004cda30
test edi, edi
setne bl
test esi, esi
je 0x43622e
push esi
call fcn.0048b3ac
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x437530
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x280
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0x278], eax
lea edi, [esp + 0x70]
push 0x208
push 0xff
push edi
call fcn.0048ef90
add esp, 0xc
call fcn.004b8de0
movzx ecx, byte [eax + 0xb]
test cl, cl
jns 0x437574
mov ecx, dword [eax + 4]
mov bl, byte [ebp + 0xc]
test ecx, ecx
jne 0x437637
xor edx, edx
mov ecx, eax
push edx
push 0x508a1e
push 0xffffffffffffffff
push edx
call fcn.004401f0
test eax, eax
jne 0x437637
movzx eax, bl
push eax
push 0x1a
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x437658
xor eax, eax
dec eax
lea esi, [esp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push edi
call fcn.004a4ac6
add esp, 4
mov edx, edi
lea edi, [esp + 0x18]
mov ecx, edi
push eax
push edx
call fcn.00440f40
mov ecx, edi
push 6
push 0x509f48
push esi
call fcn.0046e370
mov ecx, edi
call fcn.0046dbe0
test bl, bl
je 0x437602
push esi
call fcn.00442550
add esp, 4
test al, al
je 0x4376bc
lea ecx, [esp + 0xc]
push 2
push 0x509f70
mov esi, dword [ebp + 8]
push esi
call fcn.0046e370
lea ecx, [esp + 0xc]
call fcn.0046dbe0
mov ecx, dword [esp + 0x278]
xor ecx, ebp
call fcn.0048b980
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004b8de0
cmp byte [eax + 0xb], 0
jns 0x437644
mov eax, dword [eax]
push 0x104
push eax
push edi
call fcn.004a4efa
add esp, 0xc
jmp 0x4375b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esp + 0xc]
push eax
push esi
call fcn.004b9e70
add esp, 8
lea edi, [esp + 0x18]
mov ecx, edi
push esi
push 0x4b
push str.GetUserIdFilePath
push 1
call fcn.004b9c70
lea ecx, [esp + 0x54]
push 0x509f47
push str.Cant_get_path_to_AppData_folder
call fcn.004b5d50
mov ecx, edi
call fcn.004b9cb0
cmp byte [esi + 0xb], 0
jns 0x4376ad
push dword [esp + 0xc]
call fcn.0048b376
add esp, 4
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00440eb0
jmp 0x43761f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, esp
push eax
push ebx
call fcn.004b9e70
add esp, 8
lea edi, [esp + 0x18]
mov ecx, edi
push ebx
push 0x52
push str.GetUserIdFilePath
push 1
call fcn.004b9c70
lea ecx, [esp + 0x54]
push 0x509f6e
push str.Cant_create_directory:
call fcn.004b5d50
lea ecx, [esp + 0x20]
push esi
call fcn.004b5c70
mov ecx, edi
call fcn.004b9cb0
cmp byte [ebx + 0xb], 0
jns 0x437718
push dword [esp]
call fcn.0048b376
add esp, 4
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00440eb0
jmp 0x437616
Function at 0x438390
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4383f9
movzx eax, word [esi]
cmp eax, 0x5a4d
jne 0x4383f9
mov eax, dword [esi + 0x3c]
cmp dword [esi + eax], 0x4550
jne 0x4383f9
mov edx, dword [esi + eax + 0x98]
xor eax, eax
test edx, edx
je 0x4383fb
add edx, esi
je 0x4383fb
cmp byte [edx + 8], 0x30
jne 0x4383f9
cmp byte [edx + 9], 0x82
jne 0x4383f9
movzx eax, word [edx + 0xa]
shl eax, 0x10
bswap eax
add eax, 0x13
and eax, 0x1fff8
je 0x4383f9
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], edx
add edx, eax
add esi, dword [ecx + 0x10]
cmp edx, esi
jae 0x4383f9
cmp dword [edx], 0x74636159
je 0x438401
xor eax, eax
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
movzx esi, word [edx + 4]
shl esi, 0x10
bswap esi
test edi, edi
je 0x43842c
cmp dword [eax], esi
jle 0x4383f9
add edx, 6
push esi
push edx
push edi
call fcn.0048e490
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x43842f
inc esi
mov dword [eax], esi
mov al, 1
jmp 0x4383fb
Function at 0x439fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x18]
mov dword [edx - 4], esp
mov dword [edx + 8], 0xffffffff
mov dword [edx + 4], 0x43f360
mov eax, dword fs:[0]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov dword fs:[0], edx
test byte [eax + 4], 1
jne 0x43a043
mov dl, byte [ebp + 0x14]
movzx esi, byte [ebp + 0x18]
mov edi, dword [ecx]
movsx edx, dl
push esi
push edx
push eax
push dword [ebp + 0xc]
push ebx
call dword [edi + 0x18]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x20], ecx
lea esi, [ebp - 0x2c]
mov ecx, eax
push esi
call fcn.0046bc00
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x526784
call fcn.0046bfe0
mov esi, eax
mov ecx, dword [ebp - 0x2c]
xor edi, edi
dec edi
mov eax, edi
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x43a07f
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov eax, dword [esi]
mov cl, byte [ebp + 0x18]
xor cl, 1
movzx ecx, cl
mov eax, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], edi
mov ecx, esi
lea edx, [ebp - 0x2c]
push edx
call eax
movzx eax, byte [ebp - 0x21]
test al, al
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov esi, eax
cmovs esi, edx
test esi, esi
je 0x43a136
test al, al
lea esi, [ebp - 0x2c]
cmovs esi, ecx
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x20], 0
je 0x43a119
mov eax, dword [ebp - 0x30]
mov cl, byte [eax]
movzx eax, cl
mov esi, dword [ebp - 0x20]
mov edx, dword [esi + 0x18]
cmp edx, dword [esi + 0x1c]
je 0x43a122
lea esi, [edx + 1]
mov edi, dword [ebp - 0x20]
mov dword [edi + 0x18], esi
mov byte [edx], cl
xor esi, esi
cmp eax, 0xffffffff
je 0x43a0f0
mov esi, dword [ebp - 0x20]
mov al, byte [ebp - 0x21]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x20], esi
mov ebx, dword [ebp - 0x30]
inc ebx
test al, al
lea esi, [ebp - 0x2c]
cmovs esi, ecx
movzx edi, al
cmovs edi, edx
add edi, esi
mov dword [ebp - 0x30], ebx
cmp ebx, edi
jne 0x43a0c2
jmp 0x43a136
mov dword [ebp - 0x20], 0
jmp 0x43a0fc
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
mov dword [ebp - 0x10], 1
push eax
call edx
jmp 0x43a0e6
shr al, 7
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0x20]
mov dword [edx], esi
test al, al
je 0x43a14e
push ecx
call fcn.0048b376
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x43a039
Function at 0x440d80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.004449c0
mov dword [esi], 0
test eax, eax
je 0x440dc8
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x440dfa
lea eax, [ebx + 1]
cmp eax, 2
jb 0x440dbf
mov dword [esi], ebx
call fcn.0046eab0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.00440ed0
lea ecx, [esi + 0x10]
call fcn.0044c760
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0046eab0
push dword [esi]
call fcn.00471760
add esp, 4
mov dword [esi], 0
jmp 0x440db0
Function at 0x4422d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov ecx, dword [ebp + 0x10]
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0xa8], eax
test ecx, ecx
je 0x442305
cmp byte [ecx + 0xb], 0
js 0x44249b
xor eax, eax
mov byte [ecx], al
mov byte [ecx + 0xb], al
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
xor esi, esi
push esi
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.004a279d
add esp, 0xc
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x60]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x20]
push 0xcd
push str..._.._base_files_file_util.cc
push str.ReadStreamToStringWithMaxSize
push ebx
call fcn.0046ea80
add esp, 0x10
mov ecx, edi
push esi
push ebx
call fcn.00474400
mov dword [ebx + 0x30], esi
pxor xmm0, xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
push dword [ebp + 8]
call fcn.0049d1a0
add esp, 4
push eax
call fcn.0049d1fa
add esp, 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x4424ac
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
xor eax, eax
mov edi, edx
neg edi
mov edi, 0
sbb edi, ecx
cmovl eax, ecx
mov ebx, 0xffff
cmovl ebx, edx
mov edx, dword [ebp + 0xc]
cmp edx, ebx
mov ecx, 0
sbb ecx, eax
lea edi, [esp + 0x10]
mov dword [edi + 4], esi
mov dword [edi], esi
mov dword [edi + 8], esi
cmovb ebx, edx
inc ebx
mov ecx, edi
push esi
push ebx
call fcn.0046d150
cmp byte [esp + 0x1b], 0
mov eax, edi
jns 0x4423e7
mov eax, dword [esp + 0x10]
add eax, esi
push dword [ebp + 8]
push ebx
push 1
push eax
call fcn.004a259a
add esp, 0x10
test eax, eax
je 0x442428
mov ecx, dword [ebp + 0xc]
sub ecx, esi
cmp ecx, eax
jb 0x4424b8
test esi, esi
mov ecx, 0x10000
cmove ebx, ecx
add esi, eax
push dword [ebp + 8]
call fcn.004a200e
add esp, 4
test eax, eax
je 0x4424bc
push dword [ebp + 8]
call fcn.004a203a
add esp, 4
test eax, eax
sete bl
mov dword [esp + 0xc], esi
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x442473
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
mov edx, dword [ecx + 8]
mov esi, dword [esp + 0x18]
mov dword [ecx + 8], esi
movq xmm0, qword [esp + 0x10]
movq qword [ecx], xmm0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edx
push 0
push dword [esp + 0x10]
call fcn.0046d150
cmp byte [esp + 0x1b], 0
js 0x4424cb
lea ecx, [esp + 0x60]
call fcn.00474460
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
jmp 0x442305
mov ebx, 0xffff
xor eax, eax
jmp 0x4423b5
xor ebx, ebx
jmp 0x44243c
lea eax, [esi + ebx]
lea ecx, [esp + 0x10]
push 0
push eax
jmp 0x4423d5
push dword [esp + 0x10]
call fcn.0048b376
add esp, 4
jmp 0x44247a
Function at 0x443a80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x522bb8]
cmp eax, 0xffffffff
je 0x443aa0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
jmp 0x443a9e

Function at 0x443ab0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x522bb8]
cmp eax, 0xffffffff
je 0x443b77
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x443b77
mov eax, dword [0x527abc]
mov ecx, dword [0x5251d0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x443b81
mov edi, dword [0x527ab8]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x443bc6
mov ecx, dword [0x526eb4]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x526eb8], 0
jne 0x443bd2
lea eax, [eax*4 + 0x526eb8]
mov dword [eax], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x526ebc], ecx
mov dword [0x526eb4], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x526ec0]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x443be4
cmp eax, 0x100
jge 0x443be7
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00443bf0
jmp 0x443ad5
push 0x527abc
call fcn.0048b3e7
add esp, 4
cmp dword [0x527abc], 0xffffffff
jne 0x443af6
push 4
call fcn.0048b346
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.004711f0
mov dword [0x527ab8], edi
push 0x527abc
call fcn.0048b45d
add esp, 4
jmp 0x443af6
mov ecx, edi
call fcn.00471200
jmp 0x443b0b
inc edx
cmp edx, 0x100
jne 0x443b14
jmp 0x443b5b
int3
int3
Function at 0x443bf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x521014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x814], 0xffffffff
mov ecx, dword [0x522bb8]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x443c9d
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x443ce6
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.0048ef90
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.0044f580
add esp, 8
push edi
call fcn.0048b3a3
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.0048e490
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.0044f580
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b980
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.0044f560
add esp, 4
test al, al
je 0x443ce9
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x443cec
xor eax, eax
dec eax
lock cmpxchg dword [0x522bb8], ecx
je 0x443c21
push ecx
call fcn.004de430
add esp, 4
mov ecx, dword [0x522bb8]
mov dword [ebp - 0x814], ecx
jmp 0x443c21
int3
int3
push esi
call fcn.0044f560
add esp, 4
test al, al
je 0x443d14
cmp dword [ebp - 0x814], 0xffffffff
je 0x443d14
push 0xffffffffffffffff
call fcn.004de430
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x443cbb
int3

Function at 0x443ea0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.00443eb0
Function at 0x444130
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x460
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0x458], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x410]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea eax, [esp + 0x208]
push 0x196
push str..._.._base_files_file_util_win.cc
push 0x50cf18
push eax
call fcn.0046ea80
add esp, 0x10
mov ecx, esi
lea esi, [esp + 0x208]
push 0
push esi
call fcn.00474400
mov eax, 0x208
mov ecx, 0xff
push eax
push ecx
push esi
call fcn.0048ef90
add esp, 0xc
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x4441c0
mov eax, dword [ebx]
mov ecx, 0x104
push ecx
push eax
push esi
call fcn.0044dad0
add esp, 0xc
push esi
call fcn.00466670
add esp, 4
mov esi, esp
mov eax, 0x208
push eax
mov eax, 0xff
push eax
push esi
call fcn.0048ef90
add esp, 0xc
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4441fa
mov eax, dword [edi]
mov ecx, 0x104
push ecx
push eax
push esi
call fcn.0044dad0
add esp, 0xc
push esi
call fcn.00466670
add esp, 4
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x44421d
mov eax, dword [ebx]
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x444227
mov ecx, dword [edi]
sub esp, 0x18
movaps xmm0, xmmword [0x50a3d0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x4442a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00444c80
add esp, 4
mov esi, eax
cmp byte [edi + 0xb], 0
jns 0x444260
mov edi, dword [edi]
cmp byte [ebx + 0xb], 0
jns 0x444268
mov ebx, dword [ebx]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
jne 0x44427e
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x4442a6
lea ecx, [esp + 0x410]
call fcn.00474460
mov ecx, dword [esp + 0x458]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov bl, 1
jmp 0x44427e
cmp esi, 0xfffffffc
jne 0x4442b2
call fcn.004d1330
mov esi, eax
mov dword [edi], esi
xor ebx, ebx
jmp 0x44427e

Function at 0x4442c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x1c9
push str..._.._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.0046ea80
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00474400
cmp byte [edi + 0xb], 0
jns 0x444321
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.00474460
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x444350
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x521014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x1f1
push str..._.._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.0046ea80
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00474400
cmp byte [edi + 0xb], 0
jns 0x4443b1
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.00474460
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4443f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x521014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.0048ef90
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x444473
push ebx
call fcn.004a4ac6
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.00440f40
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.00441fe0
mov ecx, dword [ebp + 8]
push ebx
call fcn.00441060
mov ecx, ebx
call fcn.0046dbe0
mov ecx, edi
call fcn.0046dbe0
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b980
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret