joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008bc0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10084d9c
mov eax, dword fs:[0]
push eax
sub esp, 0x2f0
mov eax, dword [0x100b618c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
lea edi, [ebx + 0x40]
push 0x1008b67c
push edi
mov dword [ebp - 0x21c], esi
call fcn.10006d70
add esp, 8
test al, al
jne 0x10008dbe
push 0
push 0x1c
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.2345ExplorerUser_DataDefaultSecure_Preferences
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10008d90
call fcn.10044730
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10008d6e
push 0x69
push str.d:jenkins.jenkinsworkspacelib_common_browser_config_browser_config_src_browser_2345_plugin_config.cpp
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], 0xf
mov byte [ebp - 0x24c], al
call fcn.100093b0
push 3
push 0x1008b6e4
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
call fcn.100093b0
mov byte [ebp - 4], 1
call fcn.10044730
mov edx, dword [ebx]
mov ecx, ebx
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x264]
push eax
call dword [edx + 0x10]
mov edi, eax
push 0x14
lea eax, [ebp - 0x24c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.10007480
mov ebx, eax
cmp dword [edi + 0x14], 8
mov byte [ebp - 4], 3
jb 0x10008d10
mov edi, dword [edi]
test edi, edi
mov eax, 0x1008bc78
cmovne eax, edi
push eax
push ebx
call fcn.10006ac0
push 0x1008b754
push ebx
call fcn.10008300
mov ecx, dword [ebp - 0x21c]
add esp, 0x10
mov eax, dword [ecx]
push ebx
call dword [eax + 0x1c]
lea ecx, [ebp - 0x2fc]
call fcn.10008420
lea ecx, [ebp - 0x264]
call fcn.10007e70
lea ecx, [ebp - 0x234]
call fcn.10007e20
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], 0xffffffff
call fcn.10007e20
xor eax, eax
mov dword [esi + 0x10], 0
push eax
mov dword [esi + 0x14], 7
mov ecx, esi
push 0x1008b77c
mov word [esi], ax
call fcn.100094b0
jmp 0x10008dc6
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008da0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.100094b0
push edi
mov ecx, esi
call fcn.10007240
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10047a96
mov esp, ebp
pop ebp
ret 4
Function at 0x10009ad0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10084df8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x100b618c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.10047712
mov edi, eax
add esp, 4
test edi, edi
je 0x10009b73
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10029fb7
add esp, 4
mov dword [edi + 4], eax
jmp 0x10009b75
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.10007080
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x10009bd5
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x10009bd5
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x10009bf9
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10009c1b
cmp byte [ebp + 0xc], 0
je 0x10009c08
push esi
call fcn.1002a4c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10009c27
mov esi, str.ios_base::badbit_set
jmp 0x10009c37
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.10009c60
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.10007a70
push 0x100ac8e4
lea eax, [ebp - 0x30]
push eax
call fcn.1005e9bc
int3
Function at 0x1000e960
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000e9b9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000e9b9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000e9aa
cmp esi, edx
jae 0x1000e9b9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x1000e998
cmp esi, edx
jae 0x1000e9b9
cmp word [esi], 0
je 0x1000e9b9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1000e9e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100b618c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x1000ea81
cmp byte [esi + 0x3d], 0
je 0x1000ea81
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1000ea37
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1000ea49
sub eax, 1
je 0x1000ea4d
sub eax, 2
je 0x1000ea81
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047a96
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000ea6a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100669c1
add esp, 0x10
cmp edi, eax
jne 0x1000ea37
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047a96
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.10047a96
mov esp, ebp
pop ebp
ret

Function at 0x1000ec00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10085230
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100b618c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.10047712
mov edi, eax
add esp, 4
test edi, edi
je 0x1000ecb2
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10029fb7
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000f0e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100b618c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1000f110
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047a96
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1000f14c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1000f14c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047a96
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x1000f231
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1000f174
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1000f1a7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.1006606c
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047a96
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x1000f231
cmp eax, 1
jle 0x1000f204
cmp eax, 3
jne 0x1000f231
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1000ba20
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047a96
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000f221
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100669c1
add esp, 0x10
cmp edi, eax
jne 0x1000f231
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x1000f137
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10047a96
mov esp, ebp
pop ebp
ret 4
Function at 0x1000fb60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x1000fb84
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000fc50
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x1000fba5
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x1000fba7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x1000fc2f
jg 0x1000fbba
test esi, esi
je 0x1000fc2f
test ecx, ecx
jl 0x1000fbfc
jg 0x1000fbc4
test eax, eax
je 0x1000fbfc
cmp ebx, ecx
jg 0x1000fbd6
jl 0x1000fbce
cmp esi, eax
jae 0x1000fbd6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.1005ede0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x1000fc02
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x1000fc2f
jg 0x1000fc0c
test esi, esi
je 0x1000fc2f
cmp dword [edi + 0x4c], 0
je 0x1000fc2f
mov ecx, edi
call fcn.1000ece0
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.10066354
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000fd20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1000fd44
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000fe00
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x1000fd65
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1000fd67
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x1000fde4
jg 0x1000fd7a
test esi, esi
je 0x1000fde4
test ecx, ecx
jl 0x1000fdbe
jg 0x1000fd84
test eax, eax
je 0x1000fdbe
cmp edi, ecx
jg 0x1000fd96
jl 0x1000fd8e
cmp esi, eax
jae 0x1000fd96
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.1005ede0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x1000fdc1
mov edx, dword [ebp + 8]
test edi, edi
jl 0x1000fde4
jg 0x1000fdcb
test esi, esi
je 0x1000fde4
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1000fde4
push eax
push esi
push 1
push edx
call fcn.100669c1
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10010b70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [edi + 0x1c], 8
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x10010b94
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x10010bb1
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10010ba0
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x10010bea
cmp eax, edi
jne 0x10010be2
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x10010bf2
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10010bf2
cmp eax, edi
jne 0x10010bf2
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.10011010
push 0x38
push edi
call fcn.10047742
mov eax, dword [ebp - 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001a220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100b618c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [ecx + 0x1c]
mov dword [ebp - 0x210], esi
push 0x1008f814
push edi
call fcn.1000b730
add esp, 8
test al, al
jne 0x1001a26f
push edi
mov ecx, esi
call fcn.10007240
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047a96
mov esp, ebp
pop ebp
ret 4
push 0
push 0x1c
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.GoogleChromeUser_DataDefaultExtensions
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x20c]
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1001a2a0
sub edx, ecx
lea eax, [ebp - 0x20c]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.100094b0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
nop word [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001a2e0
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.100094b0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10047a96
mov esp, ebp
pop ebp
ret 4
Function at 0x1001a360
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10084d9c
mov eax, dword fs:[0]
push eax
sub esp, 0x2f0
mov eax, dword [0x100b618c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
lea edi, [ebx + 4]
push 0x1008f70c
push edi
mov dword [ebp - 0x21c], esi
call fcn.1000b730
add esp, 8
test al, al
je 0x1001a55e
push 0
push 0x1c
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.GoogleChromeUser_DataDefaultSecure_Preferences
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001a530
call fcn.10044730
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1001a50e
push 0x6b
push 0x1008f778
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], 0xf
mov byte [ebp - 0x24c], al
call fcn.100093b0
push 3
push 0x1008f7e4
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
call fcn.100093b0
mov byte [ebp - 4], 1
call fcn.10044730
mov edx, dword [ebx]
mov ecx, ebx
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x264]
push eax
call dword [edx + 0x10]
mov edi, eax
push 0x14
lea eax, [ebp - 0x24c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.10007480
mov ebx, eax
cmp dword [edi + 0x14], 8
mov byte [ebp - 4], 3
jb 0x1001a4b0
mov edi, dword [edi]
test edi, edi
mov eax, 0x1008bc78
cmovne eax, edi
push eax
push ebx
call fcn.10006ac0
push 0x1008f7e8
push ebx
call fcn.10008300
mov ecx, dword [ebp - 0x21c]
add esp, 0x10
mov eax, dword [ecx]
push ebx
call dword [eax + 0x1c]
lea ecx, [ebp - 0x2fc]
call fcn.10008420
lea ecx, [ebp - 0x264]
call fcn.10007e70
lea ecx, [ebp - 0x234]
call fcn.10007e20
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], 0xffffffff
call fcn.10007e20
xor eax, eax
mov dword [esi + 0x10], 0
push eax
mov dword [esi + 0x14], 7
mov ecx, esi
push 0x1008f810
mov word [esi], ax
call fcn.100094b0
jmp 0x1001a566
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001a540
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.100094b0
push edi
mov ecx, esi
call fcn.10007240
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10047a96
mov esp, ebp
pop ebp
ret 4
Function at 0x1001ea90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100b618c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [ecx + 0x58]
mov dword [ebp - 0x210], esi
push 0x1009093c
push edi
call fcn.10006d70
add esp, 8
test al, al
je 0x1001eadf
push edi
mov ecx, esi
call fcn.10007240
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047a96
mov esp, ebp
pop ebp
ret 4
push 0
push 0x1c
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.LenovoSLBrowserUser_DataDefaultExtensions
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x20c]
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1001eb10
sub edx, ecx
lea eax, [ebp - 0x20c]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.100094b0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
nop word [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001eb50
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.100094b0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10047a96
mov esp, ebp
pop ebp
ret 4
Function at 0x1001ebd0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10084d9c
mov eax, dword fs:[0]
push eax
sub esp, 0x2f0
mov eax, dword [0x100b618c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
lea edi, [ebx + 0x40]
push 0x10090830
push edi
mov dword [ebp - 0x21c], esi
call fcn.10006d70
add esp, 8
test al, al
jne 0x1001edce
push 0
push 0x1c
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x10090838
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001eda0
call fcn.10044730
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1001ed7e
push 0x6b
push str.d:jenkins.jenkinsworkspacelib_common_browser_config_browser_config_src_browser_lenovo_plugin_config.cpp
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], 0xf
mov byte [ebp - 0x24c], al
call fcn.100093b0
push 3
push 0x10090834
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
call fcn.100093b0
mov byte [ebp - 4], 1
call fcn.10044730
mov edx, dword [ebx]
mov ecx, ebx
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x264]
push eax
call dword [edx + 0x10]
mov edi, eax
push 0x13
lea eax, [ebp - 0x24c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.10007480
mov ebx, eax
cmp dword [edi + 0x14], 8
mov byte [ebp - 4], 3
jb 0x1001ed20
mov edi, dword [edi]
test edi, edi
mov eax, 0x1008bc78
cmovne eax, edi
push eax
push ebx
call fcn.10006ac0
push 0x10090914
push ebx
call fcn.10008300
mov ecx, dword [ebp - 0x21c]
add esp, 0x10
mov eax, dword [ecx]
push ebx
call dword [eax + 0x1c]
lea ecx, [ebp - 0x2fc]
call fcn.10008420
lea ecx, [ebp - 0x264]
call fcn.10007e70
lea ecx, [ebp - 0x234]
call fcn.10007e20
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], 0xffffffff
call fcn.10007e20
xor eax, eax
mov dword [esi + 0x10], 0
push eax
mov dword [esi + 0x14], 7
mov ecx, esi
push 0x100908a4
mov word [esi], ax
call fcn.100094b0
jmp 0x1001edd6
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001edb0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.100094b0
push edi
mov ecx, esi
call fcn.10007240
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10047a96
mov esp, ebp
pop ebp
ret 4