joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46cc00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x80c
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x810], 0xffffffff
mov ecx, dword [0x7a74b0]
mov dword [ebp - 0x810], ecx
cmp ecx, 0xffffffff
jne 0x46ccf4
lea edi, [ebp - 0x810]
push edi
call fcn.004c9880
add esp, 4
test al, al
jne 0x46cc73
lea esi, [ebp - 0x80c]
push str.PlatformThreadLocalStorage::AllocTLS_key_
push 0xd6
push str..._.._base_threading_thread_local_storage.cc
push esi
call fcn.00458d10
add esp, 0x10
mov ecx, esi
call fcn.00458d80
mov ecx, esi
call fcn.00458d90
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x46ccd0
push edi
call fcn.004c9880
add esp, 4
test al, al
je 0x46cc94
cmp dword [ebp - 0x810], 0xffffffff
jne 0x46ccc0
lea esi, [ebp - 0x80c]
push str.PlatformThreadLocalStorage::AllocTLS_key___key___PlatformThreadLocalStorage::TLS_KEY_OUT_OF_INDEXES
push 0xe0
push str..._.._base_threading_thread_local_storage.cc
push esi
call fcn.00458d10
add esp, 0x10
mov ecx, esi
call fcn.00458d80
mov ecx, esi
call fcn.00458d90
push 0xffffffffffffffff
call fcn.004c98a0
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x7a74b0], ecx
je 0x46ccf4
push ecx
call fcn.004c98a0
add esp, 4
mov ecx, dword [0x7a74b0]
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x80c], 0xffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
and esi, 3
je 0x46cd66
push 0
call fcn.00458ed0
add esp, 4
mov edi, eax
push esi
call fcn.00458ed0
add esp, 4
lea esi, [ebp - 0x80c]
mov ecx, esi
push edi
push eax
push str.GetTlsVectorStateAndValue_key___TlsVectorState::kUninitialized
call fcn.004592d0
cmp dword [ebp - 0x80c], 0
je 0x46cd66
lea edi, [ebp - 0x814]
push esi
push 0xf2
push str..._.._base_threading_thread_local_storage.cc
push edi
call fcn.00458dc0
add esp, 0x10
mov ecx, edi
call fcn.00458d80
mov ecx, edi
call fcn.00458d90
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.006ccfc0
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.004c98b0
add esp, 8
push 0x800
call fcn.006c9113
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.006cca40
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.004c98b0
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.006c9121
mov eax, esi
add esp, 0x80c
pop esi
pop edi
pop ebp
ret

Function at 0x470a90
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.00470aa0
Function at 0x470cc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov ebx, esp
push 0x1af
push str..._.._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.0045f9a0
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.004b4d70
cmp byte [edi + 0xb], 0
jns 0x470d26
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.004b4dd0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x470d50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov ebx, esp
push 0x1d7
push str..._.._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.0045f9a0
add esp, 0x10
lea esi, [esp + 0x10]
mov ecx, esi
push 0
push ebx
call fcn.004b4d70
cmp byte [edi + 0xb], 0
jns 0x470db6
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.004b4dd0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x470df0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.006ccfc0
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
add esi, 0xfffffefc
cmp esi, 0xfffffefd
jb 0x470e78
push ebx
call fcn.006e6814
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.0045d300
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.0045ea70
mov ecx, dword [ebp + 8]
push ebx
call fcn.0045d440
mov ecx, ebx
call fcn.0045d3c0
mov ecx, edi
call fcn.0045d3c0
cmp esi, 0xfffffefd
setae bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x470ea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.006ccfc0
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x732c60]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x470f08
cmp word [ebp - 0x214], 0
je 0x470f08
push edi
call fcn.006e6814
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0045d300
jmp 0x470f61
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x218], 0xffffffff
lea edi, [ebp - 0x220]
mov ecx, edi
call fcn.0045d270
push edi
call fcn.00470df0
add esp, 4
mov ecx, esi
test al, al
je 0x470f4a
push edi
call fcn.0045d2d0
jmp 0x470f56
push 3
push 0x732cd2
call fcn.0045d300
lea ecx, [ebp - 0x220]
call fcn.0045d3c0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.006c9121
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
Function at 0x471260
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov esi, esp
push 0x264
push str..._.._base_files_file_util_win.cc
push str.CreateDirectoryAndGetError
push esi
call fcn.0045f9a0
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push esi
call fcn.004b4d70
cmp byte [edi + 0xb], 0
mov ebx, edi
jns 0x4712c6
mov ebx, dword [edi]
mov esi, dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4712f8
mov bl, 1
test al, 0x10
jne 0x4713e5
test esi, esi
je 0x4712e9
mov dword [esi], 0xfffffff7
push 0x50
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x4713e5
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xffffffff
mov ecx, edi
mov eax, esp
push eax
call fcn.0045dc20
movzx edx, byte [esp + 0xb]
mov eax, edx
test dl, dl
jns 0x471328
mov eax, dword [esp + 4]
movzx ecx, byte [edi + 0xb]
test cl, cl
js 0x47133e
mov esi, edx
mov edx, edi
cmp eax, ecx
jne 0x471384
test eax, eax
jne 0x47134e
jmp 0x471371
cmp eax, dword [edi + 4]
jne 0x471384
mov esi, edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
test eax, eax
je 0x471371
mov edi, esp
mov ecx, esi
test cl, cl
jns 0x471359
mov edi, dword [esp]
xor ecx, ecx
nop dword [eax + eax]
movzx esi, word [edi + ecx*2]
cmp si, word [edx + ecx*2]
jne 0x471384
add ecx, 1
cmp eax, ecx
jne 0x471360
mov eax, 0xfffffffc
mov edi, 2
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4713d3
jmp 0x4713d5
mov esi, dword [ebp + 0xc]
push esi
lea eax, [esp + 4]
push eax
call fcn.00471260
add esp, 8
test al, al
je 0x4713dc
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x4713de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0xb7
jne 0x4713c6
push dword [ebp + 8]
call fcn.00470d50
add esp, 4
test al, al
jne 0x4713de
test esi, esi
je 0x4713d5
push edi
call fcn.004b4a20
add esp, 4
mov dword [esi], eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
mov ecx, esp
call fcn.0045d3c0
lea ecx, [esp + 0x10]
call fcn.004b4dd0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x471680
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x270
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0x268], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x250], xmm0
movdqa xmmword [esp + 0x240], xmm0
movdqa xmmword [esp + 0x230], xmm0
movdqa xmmword [esp + 0x220], xmm0
lea ebx, [esp + 0x18]
push 0x391
push str..._.._base_files_file_util_win.cc
push 0x732d34
push ebx
call fcn.0045f9a0
add esp, 0x10
lea ecx, [esp + 0x220]
push 0
push ebx
call fcn.004b4d70
lea eax, [esp + 0x1a]
push 0x206
push 0xff
push eax
call fcn.006ccfc0
add esp, 0xc
mov word [esp + 0x18], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
add esi, 0xfffffefb
cmp esi, 0xfffffefc
jb 0x471761
push ebx
call fcn.006e6814
add esp, 4
mov edi, esp
mov ecx, edi
push eax
push ebx
call fcn.0045d300
lea ebx, [esp + 0xc]
mov ecx, edi
push ebx
call fcn.0045ea70
mov ecx, dword [ebp + 8]
push ebx
call fcn.0045d440
mov ecx, ebx
call fcn.0045d3c0
mov ecx, edi
call fcn.0045d3c0
cmp esi, 0xfffffefc
setae bl
lea ecx, [esp + 0x220]
call fcn.004b4dd0
mov ecx, dword [esp + 0x268]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x471790
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.006ccfc0
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.004b37c0
mov dword [ebp - 0x500], 0xffffffff
mov dword [ebp - 0x4fc], 0xffffffff
mov dword [ebp - 0x4f8], 0xffffffff
lea eax, [ebp - 0x500]
mov ecx, esi
push eax
call fcn.004b39f0
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x471813
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x47198d
lea ebx, [ebp - 0x4f4]
xor edi, edi
jmp 0x47183a
mov edi, esi
test eax, eax
je 0x47198f
push 0x250
push 0xff
push ebx
call fcn.006ccfc0
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004b3970
mov eax, dword [ebp - 0x4f4]
test al, 1
je 0x4718b0
cmp byte [ebp + 8], 0
jne 0x471890
mov ecx, ebx
call fcn.004b3720
test al, al
je 0x47188a
mov ecx, ebx
call fcn.004b3720
xor esi, esi
test al, al
je 0x471910
jmp 0x471948
mov eax, dword [ebp - 0x4f4]
and eax, 0xfffffffe
cmp byte [ebp - 0x4f5], 0
lea ecx, [ebp - 0x500]
jns 0x4718a8
mov ecx, dword [ebp - 0x500]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, ebx
call fcn.004b3720
test al, al
je 0x471910
xor esi, esi
cmp byte [ebp + 8], 0
je 0x471948
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.00471790
add esp, 4
mov esi, eax
test eax, eax
jne 0x471948
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x4718f8
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, 0
test eax, eax
jne 0x471948
jmp 0x471932
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x471925
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
test eax, eax
jne 0x471948
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove esi, eax
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00405540
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004b39f0
lea ecx, [ebp - 0x500]
push ebx
call fcn.0045d440
mov ecx, ebx
call fcn.0045d3c0
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x471830
mov eax, dword [ebp - 0x4fc]
jmp 0x471830
xor esi, esi
lea ecx, [ebp - 0x500]
call fcn.0045d3c0
lea ecx, [ebp - 0x2a4]
call fcn.004b3900
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006c9121
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x473170
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
call fcn.004c6590
mov byte [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi], 0x732f00
mov dword [esi + 0xc], 0
movaps xmm0, xmmword [0x732d80]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
cmp dword [esi + 0xc], eax
je 0x4731f9
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0xc]
add eax, 1
cmp eax, 2
jb 0x4731dd
call fcn.0045f9d0
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call fcn.00474ca0
mov dword [esi + 0xc], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x4731ed
mov dword [esi + 0xc], edi
call fcn.0045f9d0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x473ef0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], 0
test ebx, ebx
je 0x473f4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x473f39
call fcn.0045f9d0
push dword [esi]
call fcn.00474ca0
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x473f48
mov dword [esi], ebx
call fcn.0045f9d0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x18], eax
cmp eax, ebx
jne 0x473fc4
lea eax, [ebp - 0x18]
push 0x424970
push eax
call fcn.00459120
add esp, 8
mov ebx, eax
lea eax, [ebp + 8]
push 0x424970
push eax
call fcn.00459120
add esp, 8
lea edi, [ebp - 0x14]
mov ecx, edi
push ebx
push eax
push str.handle___::GetCurrentProcess__
call fcn.004592d0
cmp dword [ebp - 0x14], 0
je 0x473fc4
lea ebx, [ebp - 0x1c]
push edi
push 0x21
push str..._.._base_process_process_win.cc
push ebx
call fcn.00458dc0
add esp, 0x10
mov ecx, ebx
call fcn.00458d80
mov ecx, ebx
call fcn.00458d90
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006c9121
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x473fe0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jb 0x474001
call fcn.0045f9d0
mov dword [esi], 0
test edi, edi
je 0x474027
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jae 0x47405f
cmp ebx, 2
jae 0x47407f
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
add eax, 1
cmp eax, 2
jb 0x474053
call fcn.0045f9d0
push dword [edi]
call fcn.00474ca0
add esp, 4
mov dword [edi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.0045f9d0
push dword [esi]
call fcn.00474ca0
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x474020
mov dword [esi], edi
mov edi, eax
call fcn.0045f9d0
mov eax, edi
jmp 0x474020

Function at 0x474090
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jae 0x4740b2
cmp dword [esi], edi
jne 0x4740bb
jmp 0x4740d7
call fcn.0045f9d0
cmp dword [esi], edi
je 0x4740d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jae 0x47410f
cmp ebx, 2
jae 0x47412f
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
add eax, 1
cmp eax, 2
jb 0x474103
call fcn.0045f9d0
push dword [edi]
call fcn.00474ca0
add esp, 4
mov dword [edi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.0045f9d0
push dword [esi]
call fcn.00474ca0
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x4740d0
mov dword [esi], edi
mov edi, eax
call fcn.0045f9d0
mov eax, edi
jmp 0x4740d0
Function at 0x474650
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x4746aa
mov eax, dword [0x7a74c0]
cmp eax, 0xffffffff
jne 0x474690
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x7a74c0
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x47469b
mov eax, dword [0x7a74c0]
mov ebx, 0x100000
test eax, eax
jne 0x4746aa
jmp 0x4746a5
mov dword [0x7a74c0], 0
mov ebx, 0x80000
push 0xc
call fcn.006c90b6
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x7b11b8]
bt ecx, eax
jae 0x4746d7
push edi
call fcn.00463e20
add esp, 4
jmp 0x4746e3
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x7b91b8], 1
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
push 0
push 0x10000
push esi
push 0x474a90
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x474716
test edi, edi
je 0x47476c
mov dword [edi], eax
jmp 0x474777
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x47472f
cmp eax, 0x5af
je 0x47472f
cmp eax, 0xe
jne 0x474790
push ebx
call fcn.004cd260
add esp, 4
test esi, esi
mov eax, edi
je 0x474777
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x7b11b8]
bt edx, ecx
jae 0x47475f
push eax
call fcn.00463f00
add esp, 4
push esi
call fcn.006c90e6
add esp, 4
mov eax, edi
jmp 0x474777
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x20], eax
mov eax, dword [0x7af1a0]
mov ecx, dword [0x7bafb8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x14]
jg 0x4747f4
lea ebx, [ebp - 0x1c]
push dword [ebp - 0x20]
push ebx
call fcn.00466ea0
add esp, 8
movzx eax, byte [ebp - 0x11]
test al, al
jns 0x4747cd
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push eax
push ebx
push dword [0x7af19c]
call fcn.004b5d90
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x474738
push dword [ebp - 0x1c]
call fcn.006c90e6
jmp 0x474735
push 0x7af1a0
call fcn.006c9157
add esp, 4
cmp dword [0x7af1a0], 0xffffffff
jne 0x4747b0
push 0x20
push str.create_thread_last_error
call fcn.004b5d50
add esp, 8
mov dword [0x7af19c], eax
push 0x7af1a0
call fcn.006c91cd
add esp, 4
jmp 0x4747b0
Function at 0x475320
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
add eax, 1
cmp eax, 2
jae 0x475344
xor ebx, ebx
jmp 0x47548a
mov esi, ecx
mov dword [ebp - 0x14], 0xffffffff
cmp dword [ecx + 4], 1
je 0x4753b6
push 1
call fcn.00458ed0
add esp, 4
mov edi, eax
push dword [esi + 4]
call fcn.00458ed0
add esp, 4
lea ebx, [ebp - 0x14]
mov ecx, ebx
push edi
push eax
push str.mode___Mode::kWritable
call fcn.004592d0
cmp dword [ebp - 0x14], 0
je 0x4753b6
lea edi, [ebp - 0x18]
push ebx
push 0xa6
push str..._.._base_memory_platform_shared_memory_region_win.cc
push edi
call fcn.00458dc0
add esp, 0x10
mov ecx, edi
call fcn.00458d80
push 0x40
push str.Only_writable_shared_memory_region_can_be_converted_to_read_only
push eax
call fcn.00402ac0
add esp, 0xc
mov ecx, edi
call fcn.00458d90
mov ebx, dword [esi]
mov dword [esi], 0
test ebx, ebx
je 0x4753d3
cmp ebx, 0xffffffff
jne 0x4753d7
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x4753e9
xor ebx, ebx
jmp 0x4753f0
call fcn.0045f9d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.0045f9d0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push 0
push 0
push 5
push ecx
push eax
mov dword [ebp - 0x20], ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x47546c
mov ebx, dword [ebp - 0x14]
cmp dword [esi], ebx
je 0x475465
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jb 0x47544b
mov dword [ebp - 0x1c], eax
call fcn.0045f9d0
push dword [esi]
call fcn.00474ca0
mov eax, dword [ebp - 0x1c]
add esp, 4
mov dword [esi], 0
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x47545e
mov dword [esi], ebx
mov ebx, eax
call fcn.0045f9d0
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esi + 4], 0
test edi, edi
setne bl
mov esi, dword [ebp - 0x20]
lea eax, [esi + 1]
cmp eax, 2
jb 0x47548a
call fcn.0045f9d0
push esi
call fcn.00474ca0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4754a0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0x38], eax
xor eax, eax
cmp dword [esi + 4], 0
setne al
mov ebx, ecx
sar ebx, 0x1f
add eax, eax
add eax, 4
push dword [ebp + 0xc]
push ecx
push ebx
mov dword [esp + 0x18], eax
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
test edi, edi
jne 0x47551d
call fcn.004ce360
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
test edi, edi
jne 0x47551d
call fcn.004ce360
mov eax, dword [ebp + 0x10]
mov edi, dword [eax]
test edi, edi
je 0x475568
mov esi, dword [ebp + 0x14]
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0x1c], xmm0
movdqa xmmword [esp + 0x10], xmm0
lea eax, [esp + 0x10]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, dword [esp + 0x1c]
sub ecx, edi
add ecx, dword [esp + 0x14]
test eax, eax
cmove ecx, eax
mov dword [esi], ecx
mov bl, 1
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
xor ebx, ebx
jmp 0x475551