joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c120
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2cf8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5256a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov ecx, dword [ebp + 8]
lea edx, [edi + 0x3c]
lea ebx, [edi + 0x38]
push edx
mov dword [ebp - 4], eax
mov dword [edi], vtable.acrobat_broker::SandboxClipboardDispatcher.0
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], eax
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x509338
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x5092fc
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x5092c0
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x509284
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x509248
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x50920c
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x5091d0
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x509194
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x509158
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x50911c
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x5090e0
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x5090a4
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x509068
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x50902c
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x508ff0
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x508fb4
lea ecx, [edi + 4]
call fcn.00413dd0
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [edi + 0x1c], eax
call esi
push ebx
push 0
push edi
push 0x41c800
mov dword [edi + 0x20], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x18], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41cc00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], ebx
jb 0x41cc1c
mov eax, dword [eax]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
push 0x20019
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41cc8a
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x14], 8
push esi
mov esi, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp + 0xc], esi
mov dword [ebp - 8], esi
jb 0x41cc4f
mov eax, dword [eax]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
lea ecx, [ebp + 0xc]
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41cc7f
cmp dword [ebp + 0xc], esi
jne 0x41cc7f
cmp dword [ebp - 8], esi
jne 0x41cc7f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov bl, 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d590
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e1893
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5256a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [ebp + 8]
mov dword [esi], vtable.acrobat_broker::SandboxPreviewDispatcher.0
mov dword [esi + 0x14], eax
push 0x2c
mov dword [ebp - 4], ebx
mov dword [esi + 0x20], ebx
call fcn.00404fba
add esp, 4
cmp eax, ebx
je 0x41d6cf
mov dword [esi + 0x1c], eax
mov dword [eax], eax
mov eax, dword [esi + 0x1c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x1c]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0x1c]
mov al, 1
mov byte [ecx + 0x28], al
mov edx, dword [esi + 0x1c]
mov byte [edx + 0x29], al
mov byte [ebp - 4], al
mov dword [esi + 0x28], ebx
lea eax, [esi + 0x4c]
lea ebx, [esi + 0x2c]
push eax
mov dword [ebx], 0
mov byte [esi + 0x64], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x50639c
lea ecx, [esi + 4]
call fcn.00413dd0
push 0x506360
lea ecx, [esi + 4]
call fcn.00413dd0
push 0x506324
lea ecx, [esi + 4]
call fcn.00413dd0
push 0x5062e8
lea ecx, [esi + 4]
call fcn.00413dd0
push 0x5062ac
lea ecx, [esi + 4]
call fcn.00413dd0
push 0x506270
lea ecx, [esi + 4]
call fcn.00413dd0
push 0x506234
lea ecx, [esi + 4]
call fcn.00413dd0
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x30], eax
call edi
push ebx
push 0
push esi
push 0x41d7e0
push 0
push 0
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x28], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], ebx
call fcn.004b6baa
push 0x5137c0
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call fcn.004b6ce9
int3
Function at 0x41d700
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e15f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5256a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov ecx, dword [ebp + 8]
lea ebx, [esi + 0x1c]
mov dword [esi], vtable.acrobat_broker::SandboxDDEDispatcher.0
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], eax
mov dword [ebx], eax
mov dword [ebp - 4], eax
cmp dword [0x528178], eax
jne 0x41d76d
lea ecx, [ebp - 0x1c]
call fcn.004b6b11
push 0x51569c
lea edx, [ebp - 0x1c]
push edx
call fcn.004b6ce9
lea eax, [esi + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x505e74
lea ecx, [esi + 4]
call fcn.00413dd0
push 0x505e38
lea ecx, [esi + 4]
call fcn.00413dd0
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x20], eax
call edi
push ebx
push 0
push esi
push 0x41dce0
push 0
push 0
mov dword [esi + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x18], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41d8f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2348
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5256a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x18]
push ecx
mov dword [ebp - 4], 0
mov dword [edi], vtable.acrobat_broker::AtomDispatcher.0
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x505ae4
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x505aa8
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x505a6c
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x505a30
lea ecx, [edi + 4]
call fcn.00413dd0
push 0x80000
call fcn.00416893
push 0x80000
push 0
push eax
mov dword [edi + 0x30], eax
call fcn.004b7120
add esp, 0x10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41fec0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5256a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 4], 0
jne 0x41ff21
lea eax, [ebp - 0x20]
push str.Readerplug_insTest_Tools_aaFEAT.api
push eax
mov byte [esi + 4], 1
call fcn.00414970
add esp, 8
cmp dword [ebp - 0x10], 0
je 0x41ff0f
cmp dword [ebp - 0xc], 8
mov eax, dword [ebp - 0x20]
jae 0x41ff00
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41ff0f
mov byte [esi + 5], 1
cmp dword [ebp - 0xc], 8
jb 0x41ff21
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00406cf9
add esp, 4
mov ecx, dword [ebp - 4]
mov al, byte [esi + 5]
xor ecx, ebp
pop esi
call fcn.00401306
mov esp, ebp
pop ebp
ret

Function at 0x420570
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5256a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push ecx
push 0
mov dword [ebp - 0x214], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x420609
cmp word [ebp - 0x210], 0
je 0x420609
test edi, edi
je 0x4205d0
push edi
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x420609
cmp byte [ebp + 0x14], 0
je 0x420601
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x420609
push 0x4ffebc
push 0x105
lea ecx, [ebp - 0x210]
push ecx
call fcn.00420830
test eax, eax
js 0x420609
lea edx, [ebp - 0x210]
jmp 0x42060e
mov edx, 0x4e796c
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420626
sub eax, edi
sar eax, 1
push eax
push edx
mov ecx, esi
call fcn.00406030
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401306
mov esp, ebp
pop ebp
ret
Function at 0x421280
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5256a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0x105
mov dword [ebp - 0x214], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x42131d
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x42131d
cmp byte [ebp + 0xc], 0
je 0x4212e8
push 0x4ffebc
push 0x105
lea edx, [ebp - 0x210]
push edx
call fcn.00420830
test eax, eax
js 0x42131d
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421304
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x210]
push ecx
jmp 0x421336
xor edx, edx
push edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], dx
push 0x4e796c
mov ecx, esi
call fcn.00406030
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401306
mov esp, ebp
pop ebp
ret 8

Function at 0x421840
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
je 0x4218bc
mov ecx, ebx
cmp word [ebx], si
je 0x42187a
mov eax, ecx
lea esi, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x421860
sub eax, esi
sar eax, 1
cmp word [ecx + eax*2 + 2], dx
lea ecx, [ecx + eax*2 + 2]
jne 0x421857
sub ecx, ebx
push edi
lea edi, [ecx + 2]
sar edi, 1
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
push 0x528ef9
neg ecx
or ecx, eax
push ecx
call fcn.004218c1
mov esi, eax
add esp, 8
test esi, esi
je 0x4218b6
lea eax, [edi + edi]
push eax
push ebx
push esi
call fcn.004b6440
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret
mov eax, esi
pop esi
pop ebx
ret
Function at 0x421c70
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de758
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5256a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x421cf2
cmp word [esi], bx
je 0x421cf2
mov edi, 7
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0040fa60
add esp, 4
test al, al
jne 0x421d10
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x421ce6
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00406cf9
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401306
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x48]
push ecx
call fcn.00421de0
add esp, 4
mov byte [ebp - 4], 1
cmp dword [ebp - 0x38], ebx
jne 0x421d42
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00409fe0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00409fe0
jmp 0x421cf2
mov eax, dword [ebp - 0x48]
mov ebx, 8
cmp dword [ebp - 0x34], ebx
jae 0x421d52
lea eax, [ebp - 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push eax
call edi
test eax, eax
je 0x421d25
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x64]
call fcn.00421ee0
mov byte [ebp - 4], 2
push 0x4ea370
lea ecx, [ebp - 0x64]
call fcn.00421f10
push esi
lea ecx, [ebp - 0x64]
call fcn.00421f10
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x50], ebx
jae 0x421d90
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jae 0x421da4
lea eax, [ebp - 0x2c]
push eax
call edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.00409fe0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00409fe0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00409fe0
mov eax, esi
jmp 0x421cf4
Function at 0x421de0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de712
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5256a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push edi
mov dword [ebp - 0x21c], edi
push ecx
mov dword [ebp - 0x220], esi
mov word [ebp - 0x218], ax
call fcn.004b7120
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
je 0x421e91
cmp eax, 0x104
jae 0x421e91
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov word [esi], ax
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x421e71
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x218]
push ecx
mov ecx, esi
call fcn.00406030
jmp 0x421ead
push edi
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
push 0x4e796c
mov ecx, esi
mov word [esi], dx
call fcn.00406030
mov dword [ebp - 4], edi
mov dword [ebp - 0x21c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401306
mov esp, ebp
pop ebp
ret
Function at 0x421f40
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e076b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x5256a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
mov dword [ebp - 0x23c], ecx
jne 0x421f84
mov al, 1
jmp 0x422095
mov edi, 8
xor bl, bl
cmp dword [esi + 0x14], edi
jb 0x421f94
mov eax, dword [esi]
jmp 0x421f96
mov eax, esi
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x421fb5
cmp eax, 0x50
je 0x421fb5
cmp eax, 0xb7
jne 0x422093
cmp dword [esi + 0x14], edi
jb 0x421fbc
mov esi, dword [esi]
lea eax, [ebp - 0x21c]
mov ecx, eax
xor edi, edi
mov edx, 0x105
sub esi, ecx
lea ecx, [ecx]
lea ecx, [edx + 0x7ffffef9]
test ecx, ecx
je 0x421fee
movzx ecx, word [esi + eax]
test cx, cx
je 0x421fee
mov word [eax], cx
add eax, 2
dec edx
jne 0x421fd0
jmp 0x421ff2
test edx, edx
jne 0x421ffa
sub eax, 2
mov edi, 0x8007007a
xor edx, edx
mov word [eax], dx
test edi, edi
js 0x422093
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x422093
push 0x4ffebc
push 0x105
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00420830
test eax, eax
js 0x422093
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x238]
call fcn.00408770
lea eax, [ebp - 0x238]
push eax
mov dword [ebp - 4], 0
call fcn.00417940
mov eax, dword [ebp - 0x238]
add esp, 4
cmp dword [ebp - 0x224], 8
jae 0x42206f
lea eax, [ebp - 0x238]
mov ecx, dword [ebp - 0x23c]
mov ecx, dword [ecx]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x2c]
push 0
push 0
call eax
test eax, eax
lea ecx, [ebp - 0x238]
sete bl
call fcn.00409fe0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401306
mov esp, ebp
pop ebp
ret 4
Function at 0x422fd0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.004b75b0
mov eax, dword [0x5256a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0x1008]
push edx
lea edx, [ebp - 0x804]
push edx
lea edx, [ebp - 0x100c]
push edx
push 0
mov dword [ebp - 0x1010], 0
push eax
mov eax, dword [ecx]
push eax
mov dword [ebp - 0x100c], 1
mov dword [ebp - 0x1008], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x4230f5
mov eax, dword [ebp - 0x100c]
cmp eax, 1
jne 0x423082
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423050
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x804]
push ecx
mov ecx, edi
call fcn.00406030
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401306
mov esp, ebp
pop ebp
ret 8
cmp eax, 2
jne 0x4230f0
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea ecx, [ebp - 0x804]
xor edx, edx
push ecx
mov word [ebp - 6], dx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1008], eax
test eax, eax
je 0x4230d9
cmp eax, 0x400
ja 0x4230d9
lea edx, [ebp - 0x1004]
push edx
mov ecx, edi
call fcn.004321e0
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401306
mov esp, ebp
pop ebp
ret 8
pop edi
mov eax, 0xea
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401306
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00401306
mov esp, ebp
pop ebp
ret 8
Function at 0x4238f0
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e1045
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
push ebx
push esi
push edi
mov eax, dword [0x5256a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov edi, dword [ebp + 8]
push ebx
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
push 0x4e796c
mov ecx, edi
mov dword [ebp - 4], ebx
mov word [edi], ax
call fcn.00406030
lea ecx, [ebp - 0x1c]
push ecx
push 0xf01ff
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x423a97
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
cmp eax, ebx
je 0x423984
cmp eax, 0xffffffff
je 0x423984
mov dword [ebp - 0x10], eax
call fcn.00416220
push 0x4c
mov dword [ebp - 4], 2
mov dword [ebp - 0x20], 0x4c
call fcn.00416893
mov esi, eax
add esp, 4
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
push 1
push ecx
mov byte [ebp - 4], 3
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4239e6
push esi
call fcn.004168eb
add esp, 4
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004168b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov eax, dword [esi]
push edx
push eax
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x4239be
mov edx, dword [ebp - 0x18]
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 0x24], ecx
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x423a04
sub eax, dword [ebp - 0x24]
mov ecx, edi
sar eax, 1
push eax
push edx
call fcn.00406030
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call fcn.004168eb
mov esi, dword [ebp - 0x10]
add esp, 4
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x423a97
cmp esi, 0xffffffff
je 0x423a97
call fcn.00416220
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x423a97
push 4
push 0x65
push str.f:CB11X_MainQImportsOpenChromeChrome_src_base_win_scoped_handle.h
lea ecx, [ebp - 0xd8]
call fcn.00450680
add eax, 8
push str.Check_failed:_false.
push eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], 5
call fcn.00441d30
add esp, 8
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
call fcn.00450a20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427a80
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5256a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
xor esi, esi
cmp byte [eax + 0x38], 0
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], esi
jne 0x427abc
pop esi
mov eax, 0x3f0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401306
mov esp, ebp
pop ebp
ret 4
mov edx, dword [eax + 0x30]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 0x50]
push ecx
push esi
push esi
push 2
push edx
mov dword [ebp - 0x50], esi
call edi
mov eax, dword [ebp - 0x50]
cmp eax, esi
je 0x427b0a
push eax
call fcn.00416893
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x60]
add esp, 4
mov esi, eax
lea eax, [ebp - 0x50]
push eax
mov eax, dword [edx + 0x30]
push ecx
push esi
push 2
push eax
mov dword [ebp - 0x54], esi
call edi
test eax, eax
jne 0x427b23
push esi
call fcn.004168eb
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401306
mov esp, ebp
pop ebp
ret 4
cmp dword [esi], 0
mov dword [ebp - 0x58], 0
jbe 0x427bf4
lea ecx, [esi + 4]
mov dword [ebp - 0x4c], ecx
lea esp, [esp]
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 4]
test al, 0x20
jne 0x427be1
test eax, 0xc0000000
jne 0x427be1
test ebx, ebx
je 0x427bbf
mov esi, dword [ebx]
mov ecx, dword [ebx + 4]
sub ecx, esi
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
xor edi, edi
add eax, edx
je 0x427bbc
mov dword [ebp - 0x5c], edi
lea esp, [esp]
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x5c]
add ecx, esi
push eax
call fcn.00427c20
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x427bde
mov esi, dword [ebx]
mov ecx, dword [ebx + 4]
add dword [ebp - 0x5c], 0x44
sub ecx, esi
mov eax, 0x78787879
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
inc edi
add ecx, edx
cmp edi, ecx
jb 0x427b80
mov esi, dword [ebp - 0x54]
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x48]
call fcn.00427970
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x60]
add ecx, 0x20
call fcn.00427700
jmp 0x427be1
mov esi, dword [ebp - 0x54]
mov eax, dword [ebp - 0x58]
add dword [ebp - 0x4c], 8
inc eax
mov dword [ebp - 0x58], eax
cmp eax, dword [esi]
jb 0x427b40
push esi
call fcn.004168eb
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00401306
mov esp, ebp
pop ebp
ret 4