joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b4c0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [0x64a7d4]
test esi, esi
je 0x42b500
mov ecx, esi
push 0x630954
call fcn.005305b0
test al, al
jne 0x42b523
mov ecx, esi
push str.vmodule
call fcn.005305b0
test al, al
jne 0x42b523
mov eax, dword [edi]
mov dword [0x6460b4], eax
test al, 1
jne 0x42b5b3
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00568175
mov al, 1
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x1c]
mov ecx, esi
push 7
push str.vmodule
push eax
call fcn.005306d0
lea ebx, [ebp - 0x28]
mov ecx, esi
push 1
push 0x630954
push ebx
call fcn.005306d0
push 0x10
call fcn.00564ea5
add esp, 4
mov esi, eax
mov ecx, eax
push 0x64a78c
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.005c87a0
cmp byte [ebx + 0xb], 0
jns 0x42b575
push dword [ebp - 0x28]
call fcn.00564ea0
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x42b586
push dword [ebp - 0x1c]
call fcn.00564ea0
add esp, 4
test esi, esi
je 0x42b500
xor eax, eax
lock cmpxchg dword [0x64a790], esi
je 0x42b500
mov ecx, esi
call fcn.005c8870
push esi
call fcn.00564ea0
add esp, 4
jmp 0x42b500
mov eax, dword [0x64a784]
test eax, eax
je 0x42b5dd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x64a784], 0
cmp dword [0x64a788], 0
jne 0x42b5dd
and byte [0x6460b4], 0xfe
mov eax, dword [edi + 0x10]
test eax, eax
je 0x42b5ee
mov dword [0x64a784], eax
jmp 0x42b50f
mov ecx, dword [0x64a788]
test ecx, ecx
jne 0x42b617
push 0xc
call fcn.00564ea5
add esp, 4
mov ecx, eax
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [0x64a788], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x42b654
push eax
call fcn.004137d0
cmp dword [edi + 0xc], 0
jne 0x42b63e
mov eax, dword [0x64a788]
cmp byte [eax + 0xb], 0
jns 0x42b637
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00568175
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004084b0
push str....._third_partylibc_srcinclude_string:2719:_assertion___s___nullptr_failed:_string::assign_received_nullptr_n
push 0x624173
call fcn.00591ed0
int3
Function at 0x42b670
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], 0x622b58
mov dword [ecx + 8], eax
mov ecx, 0x622b6c
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
mov byte [esi + 0x14], al
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
sub esp, 0x10
movsd xmm0, qword [0x624b80]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x42b6d3
cmp eax, edi
je 0x42b759
test eax, eax
jne 0x42b75e
mov dword [esi + 0x10], edi
cmp dword [0x64a78c], 2
jg 0x42b6ef
test edi, edi
je 0x42b7b4
sub esp, 0x10
movsd xmm0, qword [0x624b80]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x42b711
cmp eax, edi
je 0x42b759
test eax, eax
jne 0x42b76c
mov dword [esi + 0x1c], edi
cmp dword [0x64a78c], 2
jg 0x42b729
test edi, edi
je 0x42b7f2
xor eax, eax
push eax
push eax
push esi
push 0x4eefe0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x42b777
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00568175
mov eax, esi
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005796d6
push eax
call fcn.004eeef0
add esp, 4
jmp 0x42b6db
push eax
call fcn.004eeef0
add esp, 4
jmp 0x42b715
lea ebx, [ebp - 0xbc]
push 0x1b
push str.thread_win.cc
push str.Start
push ebx
call fcn.005068d0
add esp, 0x10
lea edi, [ebp - 0x14]
push ebx
push edi
call fcn.005bdac0
add esp, 8
mov ecx, edi
push 0x637c60
call fcn.005d9840
mov ecx, edi
call fcn.00592840
jmp 0x42b742
call fcn.004ed0f0
lea edi, [ebp - 0xbc]
mov ecx, edi
push eax
push 2
push 0x5b
push str.session_end_watcher.cc
call fcn.00592570
lea eax, [ebp - 0xb4]
push 0xb
push str.CreateEvent
push eax
call fcn.005320d0
add esp, 0xc
mov ecx, edi
call fcn.00592350
jmp 0x42b6ef
call fcn.004ed0f0
lea edi, [ebp - 0xbc]
mov ecx, edi
push eax
push 2
push 0x5e
push str.session_end_watcher.cc
call fcn.00592570
lea eax, [ebp - 0xb4]
push 0xb
push str.CreateEvent
push eax
call fcn.005320d0
add esp, 0xc
mov ecx, edi
call fcn.00592350
jmp 0x42b729
Function at 0x42be80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x227
push str.file_util_win.cc
push str.PathExists
push ebx
call fcn.005068d0
add esp, 0x10
xor eax, eax
mov ecx, esi
push eax
push eax
call fcn.00520200
mov dword [esp + 0x4c], 0xa
mov al, byte [0x649446]
test al, al
jne 0x42bf19
cmp byte [edi + 0xb], 0
jns 0x42beee
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
lea ecx, [esp + 0x10]
call fcn.0053b480
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00568175
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, al
lea eax, [esp + 0x54]
mov dword [eax], ebx
lea esi, [esp + 0x50]
mov dword [esi], str.ScopedBlockingCall
lea edx, [esp + 0x4c]
push eax
push esi
call fcn.005b8bd0
add esp, 8
jmp 0x42bee6
Function at 0x42d400
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb4
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movaps xmm0, xmmword [0x63a070]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x42d430
mov eax, dword [edi]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x110000
call ebx
cmp eax, 0xffffffff
je 0x42d4cd
mov esi, eax
lea eax, [ebp - 0xbc]
mov dword [eax], 2
xor edi, edi
push edi
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x42d5e4
lea eax, [ebp - 0xc0]
mov dword [eax], edi
push edi
push eax
push 0xc
push dword [ebp + 0x10]
push 0x24
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x42d618
mov bl, 1
cmp dword [ebp - 0xc0], 0xc
jne 0x42d579
push esi
call fcn.00431ab0
add esp, 4
test al, al
je 0x42d4ca
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00568175
mov eax, ebx
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x42d530
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x42d4e4
mov eax, dword [edi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
movaps xmm0, xmmword [0x63a070]
jne 0x42d426
cmp dword [0x64a78c], 2
jg 0x42d572
call fcn.004ed0f0
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0x71
push str.registration_protocol_win.cc
call fcn.00592570
lea eax, [ebp - 0xb0]
push 0xd
push str.WaitNamedPipe
jmp 0x42d562
cmp dword [0x64a78c], 2
jg 0x42d572
call fcn.004ed0f0
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0x6c
push str.registration_protocol_win.cc
call fcn.00592570
lea eax, [ebp - 0xb0]
push 0xa
push str.CreateFile
push eax
call fcn.005320d0
add esp, 0xc
mov ecx, esi
call fcn.00592350
xor ebx, ebx
jmp 0x42d4b3
cmp dword [0x64a78c], 2
jg 0x42d65d
lea edi, [ebp - 0xb8]
mov ecx, edi
push 2
push 0x8c
push str.registration_protocol_win.cc
call fcn.0040a9f0
lea eax, [ebp - 0xb0]
push 0x1c
push str.TransactNamedPipe:_expected
push eax
call fcn.005320d0
add esp, 0xc
mov ecx, eax
push 0xc
call fcn.00451d70
push 0xb
push str.__observed
push eax
call fcn.005320d0
add esp, 0xc
mov ecx, eax
push dword [ebp - 0xc0]
call fcn.00430c70
mov ecx, edi
call fcn.00407a90
jmp 0x42d65d
cmp dword [0x64a78c], 2
jg 0x42d65d
call fcn.004ed0f0
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 2
push 0x7a
push str.registration_protocol_win.cc
call fcn.00592570
lea eax, [ebp - 0xb0]
push 0x17
push 0x63a0e6
jmp 0x42d64d
cmp dword [0x64a78c], 2
jg 0x42d65d
call fcn.004ed0f0
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 2
push 0x88
push str.registration_protocol_win.cc
call fcn.00592570
lea eax, [ebp - 0xb0]
push 0x11
push 0x63a0fe
push eax
call fcn.005320d0
add esp, 0xc
mov ecx, edi
call fcn.00592350
xor ebx, ebx
jmp 0x42d4a6
Function at 0x42fe50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x657d50]
mov ecx, dword [0x64783c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42ff3e
push dword [0x6460b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x42fe9f
mov ecx, dword [0x657d48]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x657d4c]
jne 0x42fe9f
cmp dword [eax + ecx*8], 0
jne 0x42ff10
push 4
call fcn.00564ea5
add esp, 4
mov esi, eax
mov dword [eax], 0
push dword [0x6460b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
and eax, 0xfffffffc
je 0x42fed9
mov ecx, dword [0x657d48]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x657d4c]
jne 0x42fed9
mov edi, dword [eax + ecx*8]
push dword [0x6460b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
jne 0x42fef3
test esi, esi
je 0x42ff0c
call fcn.004126f0
mov ecx, dword [0x657d48]
mov dword [eax + ecx*8], esi
mov ecx, dword [0x657d4c]
mov edx, dword [0x657d48]
mov dword [eax + edx*8 + 4], ecx
test edi, edi
jne 0x42ff8d
push dword [0x6460b0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
xor eax, eax
and ecx, 0xfffffffc
je 0x42ff3a
mov edx, dword [0x657d48]
mov esi, dword [ecx + edx*8 + 4]
cmp esi, dword [0x657d4c]
jne 0x42ff3a
mov eax, dword [ecx + edx*8]
pop esi
pop edi
pop ebp
ret
push 0x657d50
call fcn.00564ee8
add esp, 4
cmp dword [0x657d50], 0xffffffff
jne 0x42fe76
mov dword [0x657d4c], 0
mov dword [0x657d48], 0xffffffff
mov ecx, 0x657d48
push 0x454c60
call fcn.00420010
push 0x657d50
call fcn.00564f37
add esp, 4
jmp 0x42fe76
push edi
call fcn.00564ea0
add esp, 4
jmp 0x42ff10

Function at 0x430bd0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov esi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.00432540
add esp, 0x10
or edx, eax
jne 0x430c07
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x430c1d
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00568175
mov eax, ebx
add esp, 0xac
pop esi
pop ebx
pop ebp
ret
cmp dword [0x64a78c], 2
jg 0x430c62
call fcn.004ed0f0
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0xfc
push str.file_io_win.cc
call fcn.00592570
lea eax, [ebp - 0xac]
push 0xc
push 0x639a50
push eax
call fcn.005320d0
add esp, 0xc
mov ecx, esi
call fcn.00592350
xor ebx, ebx
jmp 0x430c07
Function at 0x430ec0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x1c], edx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x430fcf
mov edi, ecx
xor esi, esi
lea eax, [ebp - 0x14]
mov dword [eax], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov ecx, ebx
mov ebx, eax
call ecx
push 2
push esi
push esi
lea ecx, [ebp - 0x14]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne byte [ebp - 0x15]
je 0x430fd8
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
cmp dword [esi], ebx
je 0x430f42
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x430f57
lea eax, [ebx + 1]
cmp eax, 2
jb 0x430f3b
mov dword [esi], ebx
call fcn.004ef4b0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00568175
mov al, byte [ebp - 0x15]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004ef4b0
mov eax, dword [esi]
cmp dword [0x655034], 0
mov dword [ebp - 0x24], eax
je 0x430f90
mov eax, dword [0x655034]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
call dword [0x63e63c]
mov ecx, dword [ebp - 0x1c]
push dword [ebp - 0x24]
call dword [ebp - 0x20]
mov dword [esi], 0
jmp 0x430f2c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6326b5
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x430fe5
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x430fc9
call dword [0x63e63c]
call ecx
push 0
push eax
call fcn.00437740
add esp, 8
mov esi, dword [ebp - 0x1c]
jmp 0x430f6a
push 1
push 0
jmp 0x430fbc
mov byte [ebp - 0x15], 1
jmp 0x430f42
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x430f3b
xor eax, eax
push eax
jmp 0x430fbb

Function at 0x431250
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.00431b40
mov eax, dword [esi]
test eax, eax
je 0x4312a3
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x4312aa
lea ecx, [ebp - 0x14]
call fcn.00431310
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00568175
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x431285
cmp dword [ebx + 0x50], 0
jne 0x4312c9
cmp byte [ebx + 0x1b], 0
js 0x4312bb
lea eax, [ebx + 0x10]
jmp 0x4312be
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x4312ce
add ebx, 0x58
jmp 0x431281
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x4312f4
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.005d5bd0
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x4312c9
mov ecx, dword [ebp + 8]
push ebx
call fcn.005d5ac0
mov ecx, eax
jmp 0x4312ec
Function at 0x433690
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x43383b
cmp dword [esi], 0
jne 0x43383b
cmp dword [esi + 0xc], 0
jne 0x43383b
xor eax, eax
cmp dword [esi + 4], 0
jne 0x43383b
mov ebx, dword [edi]
cmp eax, ebx
je 0x4336f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x43373f
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4336ec
mov dword [esi], ebx
call fcn.004ef4b0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x433729
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x43377b
lea eax, [ebx + 1]
cmp eax, 2
jb 0x43371f
mov dword [esi + 4], ebx
call fcn.004ef4b0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004ef4b0
mov eax, dword [esi]
cmp dword [0x655034], 0
mov dword [ebp - 0x18], eax
je 0x4337b9
mov eax, dword [0x655034]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e63c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x4336dd
call fcn.004ef4b0
mov eax, dword [esi + 4]
cmp dword [0x655034], 0
mov dword [ebp - 0x18], eax
je 0x4337fc
mov eax, dword [0x655034]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e63c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi + 4], 0
jmp 0x43370f
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6326b5
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x433859
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x4337f6
call dword [0x63e63c]
call ecx
push 0
push eax
call fcn.00437740
add esp, 8
jmp 0x433752
push 1
push 0
jmp 0x4337e9
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6326b5
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43385e
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x433835
call dword [0x63e63c]
call ecx
push 0
push eax
call fcn.00437740
add esp, 8
jmp 0x43378f
push 1
push 0
jmp 0x433828
mov ecx, esi
call fcn.00553f00
lea ecx, [esi + 4]
call fcn.00553f00
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, dword [esi]
jmp 0x4336c7
xor eax, eax
push eax
jmp 0x4337e8
xor eax, eax
push eax
jmp 0x433827
Function at 0x433ed0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
mov ecx, 0x65c2937b
xor eax, eax
lock cmpxchg dword [esi], ecx
jne 0x4340a8
mov dword [0x6485f0], edi
mov dword [0x648680], edi
mov dword [0x648684], 1
mov dword [ebp - 0x38], esi
xor eax, eax
dec eax
lea ebx, [ebp - 0x34]
mov dword [ebx + 0x20], eax
pcmpeqd xmm0, xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push ebx
call edi
mov edx, edi
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0x1c]
cmp eax, ecx
cmova ecx, eax
mov dword [0x648688], ecx
mov eax, 0x10
mov dword [0x64868c], eax
mov eax, 0x20
mov dword [0x648690], eax
mov dword [0x648694], esi
mov dword [0x6485f4], esi
mov eax, 0x6485f4
xor eax, 0xb37cc16a
mov dword [0x6485f8], eax
xor eax, eax
dec eax
mov dword [ebx + 0x20], eax
mov edi, dword [ebp - 0x38]
mov dword [0x6485fc], 0x6485f0
pxor xmm0, xmm0
movdqu xmmword [0x648604], xmm0
movdqu xmmword [0x648614], xmm0
movdqu xmmword [0x648624], xmm0
movdqu xmmword [0x648634], xmm0
movdqu xmmword [0x648644], xmm0
movdqu xmmword [0x648654], xmm0
movdqu xmmword [0x648664], xmm0
movdqu xmmword [0x648670], xmm0
mov dword [0x648698], esi
mov dword [0x648728], esi
mov dword [0x64872c], esi
pcmpeqd xmm0, xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
push ebx
call edx
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0x1c]
cmp eax, ecx
cmova ecx, eax
mov dword [0x648730], ecx
mov eax, 0x10
mov dword [0x648734], eax
mov eax, 0x20
mov dword [0x648738], eax
mov dword [0x64873c], esi
mov dword [0x64869c], esi
mov eax, 0x64869c
xor eax, 0xb37cc16a
mov dword [0x6486a0], eax
mov dword [0x6486a4], 0x648698
pxor xmm0, xmm0
movdqu xmmword [0x6486ac], xmm0
movdqu xmmword [0x6486bc], xmm0
movdqu xmmword [0x6486cc], xmm0
movdqu xmmword [0x6486dc], xmm0
movdqu xmmword [0x6486ec], xmm0
movdqu xmmword [0x6486fc], xmm0
movdqu xmmword [0x64870c], xmm0
movdqu xmmword [0x648718], xmm0
mov eax, 0xdd
xchg dword [edi], eax
cmp eax, 0x5a308d2
je 0x43409b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00568175
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
push edi
call fcn.00593c60
add esp, 8
jmp 0x434089
push edx
push 0x626100
push 3
push esi
call fcn.00445200
add esp, 0x10
test eax, eax
jne 0x434089
jmp 0x433ef8
Function at 0x4350e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov ebx, esp
push 0x5f
push str.file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.005068d0
add esp, 0x10
xor eax, eax
mov ecx, edi
push eax
push eax
call fcn.00520200
mov dword [esp + 0x4c], 0xa
mov al, byte [0x649446]
test al, al
jne 0x4351a7
mov ecx, dword [ebp + 0xc]
test ecx, ecx
js 0x43518b
mov eax, dword [ebp + 8]
mov dword [esp], 0xffffffff
push 0
push ebx
push ecx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x435195
mov ebx, dword [esp]
test ebx, ebx
js 0x435190
lea ecx, [esp + 0x10]
call fcn.0053b480
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00568175
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
dec ebx
jmp 0x43516b
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x43516b
movzx ecx, al
lea eax, [esp + 0x54]
mov dword [eax], ebx
lea edi, [esp + 0x50]
mov dword [edi], str.ScopedBlockingCall
lea edx, [esp + 0x4c]
push eax
push edi
call fcn.005b8bd0
add esp, 8
jmp 0x435142

Function at 0x4351d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [ebp + 8]
mov cl, byte [ecx + 4]
cmp cl, byte [eax + 4]
je 0x4351fa
test cl, cl
jne 0x43520a
test esi, esi
je 0x435207
mov ecx, esi
push eax
call fcn.0041bc80
mov byte [esi + 4], 1
pop esi
pop ebp
ret 4
test cl, cl
je 0x4351f5
mov ecx, esi
pop esi
pop ebp
jmp fcn.00435220
int3
mov ecx, esi
call fcn.00420240
mov byte [esi + 4], 0
jmp 0x4351f5
Function at 0x435220
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x435243
call fcn.004ef4b0
cmp dword [esi], ebx
je 0x43526d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x435279
cmp edi, 2
jb 0x435264
mov dword [esi], ebx
call fcn.004ef4b0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004ef4b0
mov eax, dword [esi]
cmp dword [0x655034], 0
mov dword [ebp - 0x18], eax
je 0x4352b2
mov eax, dword [0x655034]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e63c]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x435258
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6326b5
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4352ee
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x4352e8
call dword [0x63e63c]
call ecx
push 0
push eax
call fcn.00437740
add esp, 8
jmp 0x43528c
push 1
push 0
jmp 0x4352de
xor eax, eax
push eax
jmp 0x4352dd