joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437310
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [ebp + 8]
mov cl, byte [ecx + 4]
cmp cl, byte [eax + 4]
je 0x43733a
test cl, cl
jne 0x43734a
test esi, esi
je 0x437347
mov ecx, esi
push eax
call fcn.00430b60
mov byte [esi + 4], 1
pop esi
pop ebp
ret 4
test cl, cl
je 0x437335
mov ecx, esi
pop esi
pop ebp
jmp fcn.00437360
int3
mov ecx, esi
call fcn.00424690
mov byte [esi + 4], 0
jmp 0x437335

Function at 0x437360
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [eax], 0
lea edi, [ebx + 1]
cmp edi, 2
jb 0x437383
call fcn.00501530
cmp dword [esi], ebx
je 0x4373ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4373b9
cmp edi, 2
jb 0x4373a4
mov dword [esi], ebx
call fcn.00501530
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00501530
mov eax, dword [esi]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x4373f2
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e1bc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi], 0
jmp 0x437398
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6318bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43742e
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x437428
call dword [0x63e1bc]
call ecx
push 0
push eax
call fcn.004292e0
add esp, 8
jmp 0x4373cc
push 1
push 0
jmp 0x43741e
xor eax, eax
push eax
jmp 0x43741d
Function at 0x437d90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov ebx, esp
push 0x5f
push str.file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.0050b300
add esp, 0x10
xor eax, eax
mov ecx, edi
push eax
push eax
call fcn.00522210
mov dword [esp + 0x4c], 0xa
mov al, byte [0x649456]
test al, al
jne 0x437e57
mov ecx, dword [ebp + 0xc]
test ecx, ecx
js 0x437e3b
mov eax, dword [ebp + 8]
mov dword [esp], 0xffffffff
push 0
push ebx
push ecx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x437e45
mov ebx, dword [esp]
test ebx, ebx
js 0x437e40
lea ecx, [esp + 0x10]
call fcn.00540b60
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
dec ebx
jmp 0x437e1b
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x437e1b
movzx ecx, al
lea eax, [esp + 0x54]
mov dword [eax], ebx
lea edi, [esp + 0x50]
mov dword [edi], str.ScopedBlockingCall
lea edx, [esp + 0x4c]
push eax
push edi
call fcn.005b5b90
add esp, 8
jmp 0x437df2
Function at 0x439450
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [esi], esi
mov dword [esi + 4], esi
lea eax, [ecx + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ecx + 0x10]
mov dword [ebp - 0x18], eax
xor eax, eax
jmp 0x439499
mov ebx, eax
add eax, 8
push 0x22c
push dword [ebp - 0x10]
push eax
call fcn.005670c0
add esp, 0xc
mov dword [ebx + 4], esi
mov eax, dword [esi]
mov dword [ebx], eax
mov dword [eax + 4], ebx
mov dword [esi], ebx
mov eax, dword [esi + 8]
inc eax
mov dword [esi + 8], eax
push 0x228
push 0
push dword [ebp - 0x18]
call fcn.00567640
add esp, 0xc
mov dword [edi + 0xc], 0x22c
cmp byte [edi + 8], 0
je 0x4394f4
push dword [ebp - 0x10]
push dword [edi + 4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x439505
mov ebx, dword [edi + 0x238]
test ebx, ebx
jne 0x439511
push 0x234
call fcn.00562bc5
add esp, 4
test eax, eax
jne 0x439473
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
push 0x622e92
call fcn.0058fdd0
mov byte [edi + 8], 1
push dword [ebp - 0x10]
push dword [edi + 4]
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4394c6
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [ebx]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
call dword [0x63e1bc]
mov ecx, ebx
push dword [ebp - 0x10]
call dword [ebp - 0x14]
test al, al
je 0x43949c
jmp 0x4394d4
Function at 0x439e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 0x18]
or eax, dword [ecx + 0x1c]
je 0x439f01
mov esi, ecx
mov eax, dword [ecx + 0x20]
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x1c], ecx
mov ebx, dword [eax + 0x3c]
mov ecx, dword [0x646080]
cmp ecx, 0x552d10
jne 0x439f14
mov dword [esp + 0x10], ebx
xor eax, eax
lea ebx, [esp + 0x28]
mov dword [ebx + 4], eax
mov dword [ebx], eax
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebx]
mov ebx, dword [ebx + 4]
mov eax, 0x7bd05af6
cmp eax, edi
mov eax, 0x863
sbb eax, ebx
jl 0x439fbd
mov ecx, 0xf4240
mov eax, edi
mul ecx
imul ecx, ebx, 0xf4240
add ecx, edx
push dword [0x6496cc]
push dword [0x6496c8]
push ecx
push eax
call fcn.00586340
mov ebx, dword [esp + 0x10]
sub eax, dword [esi + 0x18]
sbb edx, dword [esi + 0x1c]
seto cl
mov edi, edx
sar edi, 0x1f
test cl, cl
cmovne eax, edi
add edi, 0x80000000
test cl, cl
cmove edi, edx
cmp eax, dword [esp + 0x1c]
sbb edi, ebx
jge 0x439f2b
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.00565ea5
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [0x63e1bc]
lea edi, [esp + 0x20]
push edi
call ecx
add esp, 4
mov eax, dword [edi]
mov edx, dword [edi + 4]
jmp 0x439edb
cmp byte [esi + 0x29], 0
jne 0x439f6c
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0x5c]
mov edx, dword [eax + 0xa0]
inc edx
mov dword [eax + 0xa0], edx
cmp ecx, dword [eax + 0x60]
je 0x439f51
cmp dword [eax + 0xa8], edx
jae 0x439fa4
mov word [eax + 0x78], 0
mov eax, dword [esi + 0x18]
or eax, dword [esi + 0x1c]
je 0x439f6c
mov byte [esi + 0x29], 1
mov eax, dword [esi + 0x20]
dec dword [eax + 0xb0]
cmp byte [esi + 0x11], 0
je 0x439fae
cmp byte [esi + 0x10], 0
jne 0x439f01
cmp byte [esi + 0x2a], 0
jne 0x439f01
mov ecx, dword [esi + 0x20]
call fcn.00590c60
mov eax, dword [esi + 0x18]
or eax, dword [esi + 0x1c]
je 0x439f01
mov byte [esi + 0x2a], 1
mov eax, dword [esi + 0x20]
dec dword [eax + 0xb4]
jmp 0x439f01
movzx ecx, word [ecx + 8]
mov word [eax + 0x78], cx
jmp 0x439f57
push str....._third_partylibc_srcincludeoptional:795:_assertion_this__has_value___failed:_optional_operator_called_on_a_disengaged_value_n
push 0x622e92
call fcn.0058fdd0
mov eax, dword [0x6496c8]
mov dword [esp + 8], eax
mov ecx, dword [0x6496cc]
mov dword [esp + 0xc], ecx
push ecx
push eax
push ebx
push edi
call fcn.00586340
mov dword [esp], eax
mov dword [esp + 0x14], edx
mul dword [esp + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp]
imul ecx, dword [esp + 0xc]
add edx, ecx
mov eax, dword [esp + 0x14]
imul ecx, eax, 0xf4240
mov dword [esp + 4], ecx
imul eax, dword [esp + 8]
add eax, edx
sub edi, dword [esp + 0x18]
sbb ebx, eax
mov ecx, 0xf4240
mov eax, dword [esp]
mul ecx
mov dword [esp], eax
add edx, dword [esp + 4]
mov dword [esp + 4], edx
mov eax, edi
mul ecx
imul ecx, ebx, 0xf4240
add edx, ecx
push dword [esp + 0xc]
push dword [esp + 0xc]
push edx
push eax
call fcn.00586340
add eax, dword [esp]
adc edx, dword [esp + 4]
jmp 0x439ed7
Function at 0x43aff0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov byte [ecx + 4], 0
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx], 0x621010
mov dword [ecx + 0xc], eax
sub esp, 0x10
movaps xmm0, xmmword [0x62e020]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp dword [esi + 0xc], eax
je 0x43b050
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0xc]
inc eax
cmp eax, 2
jae 0x43b05a
lea eax, [edi + 1]
cmp eax, 2
jb 0x43b049
mov dword [esi + 0xc], edi
call fcn.00501530
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00501530
mov eax, dword [esi + 0xc]
cmp dword [0x655038], 0
mov dword [ebp - 0x18], eax
je 0x43b095
mov eax, dword [0x655038]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
call dword [0x63e1bc]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [ebp - 0x10]
mov dword [esi + 0xc], 0
jmp 0x43b039
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6318bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43b0d1
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x43b0cb
call dword [0x63e1bc]
call ecx
push 0
push eax
call fcn.004292e0
add esp, 8
jmp 0x43b06e
push 1
push 0
jmp 0x43b0c1
xor eax, eax
push eax
jmp 0x43b0c0
Function at 0x43c260
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx], 0
je 0x43c320
cmp dword [esi + 4], 0xffffffff
je 0x43c320
lea ecx, [esi + 8]
cmp byte [esi + 0x13], 0
jns 0x43c348
mov edx, 0x7fffffff
and edx, dword [esi + 0x10]
dec edx
mov dword [ebp - 0x20], edx
lea eax, [ebp - 0x14]
mov dword [eax], edx
mov edi, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
sub eax, edi
add eax, 0xfffffffe
lea ebx, [esi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [ebp - 0x1c], eax
push edx
push ecx
mov dword [ebp - 0x24], ecx
call fcn.0043c3e0
add esp, 8
mov dword [ebp - 0x28], ebx
push ebx
push edi
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x43c361
test eax, eax
jne 0x43c320
mov eax, dword [esi + 0x20]
inc eax
shr eax, 1
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
sub edx, ecx
sar edx, 1
cmp edx, eax
jbe 0x43c352
mov word [ecx + eax*2], 0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + 8]
cmp byte [esi + 0x13], 0
jns 0x43c32b
mov eax, dword [eax]
mov word [eax], 0
mov eax, dword [esi + 0x14]
cmp dword [esi + 0x18], eax
je 0x43c352
mov word [eax], 0
mov dword [esi + 0x20], 0
xor ebx, ebx
jmp 0x43c30c
mov edx, 4
jmp 0x43c29e
push str....._third_partylibc_srcinclude_vector:1411:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x622e92
call fcn.0058fdd0
mov ebx, dword [ebp - 0x20]
mov edx, dword [esi + 0x20]
inc edx
shr edx, 1
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edi, ecx
sub eax, ecx
mov ecx, eax
sar ecx, 1
cmp edx, ecx
jb 0x43c39b
lea ecx, [esi + 0x14]
inc edx
lea eax, [ebp - 0x16]
mov word [eax], 0
push eax
call fcn.0044fe90
add esp, 4
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edi, ecx
sub eax, ecx
add eax, 0xfffffffe
mov dword [esi + 0x20], eax
cmp dword [ebp - 0x14], ebx
mov eax, 0x4000
cmovne eax, ebx
mov dword [ebp - 0x14], eax
push eax
push dword [ebp - 0x24]
call fcn.0043c3e0
add esp, 8
push dword [ebp - 0x28]
push edi
push dword [ebp - 0x1c]
push 0
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x43c2ec
Function at 0x43e510
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x43e532
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43e567
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43e580
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov ecx, esi
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0043e660
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00538880
add esp, 4
test al, al
je 0x43e636
call fcn.004f27f0
lea ecx, [ebp - 0xb0]
push eax
push 2
push 0x26f
push str.crash_report_database_win.cc
call fcn.0045af70
lea eax, [ebp - 0xa8]
push 0x10
push str.CreateDirectory
push eax
call fcn.00538a30
add esp, 0xc
mov edi, eax
movsx eax, byte [esi + 0xb]
test eax, eax
jns 0x43e5d4
mov eax, dword [esi + 4]
mov esi, dword [esi]
test eax, eax
js 0x43e644
sete cl
test esi, esi
setne dl
or dl, cl
je 0x43e63d
lea ebx, [ebp - 0xbc]
push eax
push esi
push ebx
call fcn.00530880
add esp, 0xc
movsx eax, byte [ebx + 0xb]
test eax, eax
jns 0x43e609
mov eax, dword [ebp - 0xb8]
mov ebx, dword [ebp - 0xbc]
push eax
push ebx
push edi
call fcn.00538a30
add esp, 0xc
cmp byte [ebp - 0xb1], 0
jns 0x43e62b
push dword [ebp - 0xbc]
call fcn.00562bc0
add esp, 4
lea ecx, [ebp - 0xb0]
call fcn.0044fb10
xor ebx, ebx
jmp 0x43e569
push str....._third_partylibc_srcinclude_string_view:320:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
jmp 0x43e649
push str....._third_partylibc_srcinclude_string_view:318:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
push 0x622e92
call fcn.0058fdd0
int3
Function at 0x43e660
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x43e682
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43e70d
mov bl, 1
test al, 0x10
je 0x43e6ab
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00538880
add esp, 4
test al, al
je 0x43e709
lea edi, [ebp - 0xb0]
mov ecx, edi
push 2
push 0x25f
push str.crash_report_database_win.cc
call fcn.0040b630
lea eax, [ebp - 0xa8]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00538a30
add esp, 0xc
push esi
push eax
call fcn.005baa80
add esp, 8
push 0x11
push str.:_not_a_directory
push eax
call fcn.00538a30
add esp, 0xc
mov ecx, edi
call fcn.0040ae00
xor ebx, ebx
jmp 0x43e694
push 2
call fcn.00538880
add esp, 4
test al, al
je 0x43e709
call fcn.004f27f0
lea edi, [ebp - 0xb0]
mov ecx, edi
push eax
push 2
push 0x25b
push str.crash_report_database_win.cc
call fcn.0045af70
lea eax, [ebp - 0xa8]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00538a30
add esp, 0xc
push esi
push eax
call fcn.005baa80
add esp, 8
mov ecx, edi
call fcn.0044fb10
jmp 0x43e709
Function at 0x43eb10
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, ecx
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
mov ecx, 0x65c2937b
xor eax, eax
lock cmpxchg dword [esi], ecx
jne 0x43ece8
mov dword [0x648600], edi
mov dword [0x648690], edi
mov dword [0x648694], 1
mov dword [ebp - 0x38], esi
xor eax, eax
dec eax
lea ebx, [ebp - 0x34]
mov dword [ebx + 0x20], eax
pcmpeqd xmm0, xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push ebx
call edi
mov edx, edi
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0x1c]
cmp eax, ecx
cmova ecx, eax
mov dword [0x648698], ecx
mov eax, 0x10
mov dword [0x64869c], eax
mov eax, 0x20
mov dword [0x6486a0], eax
mov dword [0x6486a4], esi
mov dword [0x648604], esi
mov eax, 0x648604
xor eax, 0xb37cc16a
mov dword [0x648608], eax
xor eax, eax
dec eax
mov dword [ebx + 0x20], eax
mov edi, dword [ebp - 0x38]
mov dword [0x64860c], 0x648600
pxor xmm0, xmm0
movdqu xmmword [0x648614], xmm0
movdqu xmmword [0x648624], xmm0
movdqu xmmword [0x648634], xmm0
movdqu xmmword [0x648644], xmm0
movdqu xmmword [0x648654], xmm0
movdqu xmmword [0x648664], xmm0
movdqu xmmword [0x648674], xmm0
movdqu xmmword [0x648680], xmm0
mov dword [0x6486a8], esi
mov dword [0x648738], esi
mov dword [0x64873c], esi
pcmpeqd xmm0, xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
push ebx
call edx
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0x1c]
cmp eax, ecx
cmova ecx, eax
mov dword [0x648740], ecx
mov eax, 0x10
mov dword [0x648744], eax
mov eax, 0x20
mov dword [0x648748], eax
mov dword [0x64874c], esi
mov dword [0x6486ac], esi
mov eax, 0x6486ac
xor eax, 0xb37cc16a
mov dword [0x6486b0], eax
mov dword [0x6486b4], 0x6486a8
pxor xmm0, xmm0
movdqu xmmword [0x6486bc], xmm0
movdqu xmmword [0x6486cc], xmm0
movdqu xmmword [0x6486dc], xmm0
movdqu xmmword [0x6486ec], xmm0
movdqu xmmword [0x6486fc], xmm0
movdqu xmmword [0x64870c], xmm0
movdqu xmmword [0x64871c], xmm0
movdqu xmmword [0x648728], xmm0
mov eax, 0xdd
xchg dword [edi], eax
cmp eax, 0x5a308d2
je 0x43ecdb
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
push edi
call fcn.005924d0
add esp, 8
jmp 0x43ecc9
push edx
push 0x624d84
push 3
push esi
call fcn.00455710
add esp, 0x10
test eax, eax
jne 0x43ecc9
jmp 0x43eb38
Function at 0x4406a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x22c
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.00567640
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x4407b4
push ebx
call fcn.005643e2
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.00550450
xor eax, eax
dec eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
movsx eax, byte [edi + 0xb]
test eax, eax
mov dword [ebp - 0x238], esi
jns 0x440749
mov eax, dword [ebp - 0x230]
test eax, eax
js 0x4407d4
mov edi, dword [ebp - 0x234]
sete cl
test edi, edi
setne dl
or dl, cl
je 0x4407d7
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x228]
mov ecx, ebx
push eax
push edi
call fcn.00550450
mov ecx, ebx
call fcn.0043fb80
cmp byte [esi + 0xb], 0
jns 0x440772
push dword [esi]
call fcn.00562bc0
add esp, 4
mov eax, dword [ebp - 0x220]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x228]
movsd qword [esi], xmm0
mov byte [ebp - 0x21d], 0
mov word [ebp - 0x228], 0
cmp byte [ebp - 0x229], 0
jns 0x4407ae
push dword [ebp - 0x234]
call fcn.00562bc0
add esp, 4
mov esi, dword [ebp - 0x238]
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
add esp, 0x22c
pop esi
pop edi
pop ebx
pop ebp
ret
int3
int3

Function at 0x441c00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.00567640
sub esp, 8
mov dword [esp + 0x10], edi
movsd xmm0, qword [0x62e390]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x441c7d
cmp word [ebp - 0x214], 0
je 0x441c7d
push edi
call fcn.005643e2
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00550450
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00565ea5
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
xorps xmm0, xmm0
lea eax, [ebp - 0x220]
movsd qword [eax], xmm0
mov dword [eax + 8], 0
push eax
call fcn.004406a0
add esp, 4
test al, al
jne 0x441cc5
mov ecx, esi
push 3
push 0x62e3f4
call fcn.00550450
cmp byte [ebp - 0x215], 0
jns 0x441c67
push dword [ebp - 0x220]
call fcn.00562bc0
add esp, 4
jmp 0x441c67
mov eax, dword [ebp - 0x218]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x220]
movsd qword [esi], xmm0
jmp 0x441c67
Function at 0x445da0
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
cmp dword [ecx + 8], 0
mov eax, dword [ecx]
je 0x445edb
push 0x32
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [esi + 0x20]
mov dword [esi + 0x20], 0
test edi, edi
je 0x445de6
mov ecx, edi
call fcn.00445f20
push edi
call fcn.00562bc0
add esp, 4
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x2c], 0
test eax, eax
je 0x445e04
push 0
push eax
push 0x635600
call fcn.0050f6b0
add esp, 0xc
mov eax, dword [esi + 0x24]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x64c810]
bt edx, ecx
jb 0x445ecd
xor eax, eax
mov dword [esi + 0x24], eax
mov edi, dword [esi + 0x20]
mov dword [esi + 0x20], eax
test edi, edi
jne 0x445efc
mov eax, dword [esi + 0x18]
inc eax
cmp eax, 2
jae 0x445e5b
lea ecx, [esi + 0x14]
call fcn.00424690
lea ecx, [esi + 0x10]
call fcn.00424690
mov ecx, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0042cbf0
call fcn.00501530
mov edi, dword [esi + 0x18]
cmp dword [0x655038], 0
je 0x445e91
mov dword [ebp - 0x10], edi
mov edi, dword [0x655038]
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [0x63e1bc]
mov ecx, edi
push dword [ebp - 0x10]
call ebx
mov dword [esi + 0x18], 0
jmp 0x445e3d
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6318bd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x445f11
mov ecx, eax
cmp eax, sym.browser.exe_GetHandleVerifier
je 0x445ec7
call dword [0x63e1bc]
call ecx
push 0
push eax
call fcn.004292e0
add esp, 8
jmp 0x445e6c
push 1
push 0
jmp 0x445ebd
push eax
call fcn.004ff570
add esp, 4
jmp 0x445e21
test eax, eax
jne 0x445db5
cmp dword [esi + 0xc], 0
jne 0x445db5
cmp dword [esi + 4], 0
jne 0x445db5
jmp 0x445dc8
mov ecx, edi
call fcn.00445f20
push edi
call fcn.00562bc0
add esp, 4
jmp 0x445e34
xor eax, eax
push eax
jmp 0x445ebc
Function at 0x449140
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x50f
push str.file_util_win.cc
push 0x62e487
push ebx
call fcn.0050b300
add esp, 0x10
xor eax, eax
mov ecx, esi
push eax
push eax
call fcn.00522210
mov dword [esp + 0x4c], 0xa
mov al, byte [0x649456]
test al, al
jne 0x4491d8
cmp byte [edi + 0xb], 0
jns 0x4491ae
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
lea ecx, [esp + 0x10]
call fcn.00540b60
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00565ea5
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, al
lea eax, [esp + 0x54]
mov dword [eax], ebx
lea esi, [esp + 0x50]
mov dword [esi], str.ScopedBlockingCall
lea edx, [esp + 0x4c]
push eax
push esi
call fcn.005b5b90
add esp, 8
jmp 0x4491a6