joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5290a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65e4f7
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6fc0c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 2
lea ecx, [ebp + 0x20]
call fcn.0043d1b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52910e
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.004048b0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x20]
call fcn.0043c550
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x3c]
call fcn.0048c410
jmp 0x5291f1
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.00434f90
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.004325e0
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.0053a8c0
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.00434f90
push eax
lea ecx, [ebp - 0x18]
call fcn.00428150
movzx ecx, al
test ecx, ecx
je 0x52918a
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.004048b0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x20]
call fcn.0043c550
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x3c]
call fcn.0048c410
jmp 0x5291f1
xor edx, edx
mov byte [ebp - 0xd], dl
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp + 0x38]
push ecx
lea edx, [ebp + 0x20]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xe]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.00521b00
mov ecx, eax
call fcn.005391b0
lea ecx, [ebp - 0x2c]
call fcn.00520cc0
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.004383e0
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.004048b0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x20]
call fcn.0043c550
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x3c]
call fcn.0048c410
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x5c
Function at 0x5292b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65e55d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6fc0c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 2
lea ecx, [ebp + 0x20]
call fcn.0043d1b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52931e
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0043c550
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x20]
call fcn.0043c550
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x40]
call fcn.0053e660
jmp 0x529405
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x1c
call fcn.00544380
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x1c
call fcn.00543cf0
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.0053a910
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x1c
call fcn.00544380
push eax
lea ecx, [ebp - 0x18]
call fcn.0053e9f0
movzx ecx, al
test ecx, ecx
je 0x52939a
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0043c550
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x20]
call fcn.0043c550
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x40]
call fcn.0053e660
jmp 0x529405
xor edx, edx
mov byte [ebp - 0xd], dl
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x3c]
push ecx
lea edx, [ebp + 0x38]
push edx
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0xe]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00521b00
mov ecx, eax
call fcn.005396d0
lea ecx, [ebp - 0x2c]
call fcn.00520cc0
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x1c
call fcn.00544ca0
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0043c550
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x20]
call fcn.0043c550
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x40]
call fcn.0053e660
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x60
Function at 0x544f20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x544f43
xor eax, eax
jmp 0x544ff3
mov edx, dword [ebp - 0xc]
push edx
call fcn.005e5678
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x544f5f
xor eax, eax
jmp 0x544ff3
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
push 0x687c20
mov eax, dword [ebp - 8]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x544fe2
cmp dword [ebp - 0x14], 0x34
jb 0x544fe2
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
and edx, 0xffff
mov eax, dword [ebp + 0x18]
mov word [eax], dx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
mov eax, dword [ebp + 0x14]
mov word [eax], dx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
and edx, 0xffff
mov eax, dword [ebp + 0x10]
mov word [eax], dx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
shr edx, 0x10
and edx, 0xffff
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
push ecx
call fcn.005e5673
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x54ad90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6625dc
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6fc0c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x54adc9
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x14], eax
jmp 0x54add0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00572050
mov dword [ebp - 4], 0
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 4
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 4]
mov eax, dword [edx + 0x94]
call eax
push 0
push 0
push 0
push 2
mov ecx, dword [ebp - 0x10]
add ecx, 4
call dword [sym.imp.soui.dll_public:_long_int___thiscall_SOUI::SWindow::SSendMessage_unsigned_int__unsigned_int__long_int__int__]
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x30c], 0
je 0x54ae6f
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x30c]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 0x74]
call eax
mov ecx, eax
call dword [sym.imp.soui.dll_public:_int___thiscall_SOUI::SMessageLoop::RemoveMessageFilter_struct_SOUI::IMessageFilter__]
call dword [sym.imp.soui.dll_public:_static_class_SOUI::SApplication____cdecl_SOUI::SSingleton_class_SOUI::SApplication_::getSingleton_void_]
mov ecx, eax
call dword [sym.imp.soui.dll_public:_struct_SOUI::IToolTipFactory____thiscall_SOUI::SApplication::GetToolTipFactory_void_]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x30c]
push edx
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x30c], 0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x258], 0
je 0x54ae9d
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x258]
call dword [sym.imp.soui.dll_public:_int___thiscall_SOUI::CSimpleWnd::IsWindow_void_]
test eax, eax
je 0x54ae9d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x258]
call dword [sym.imp.soui.dll_public:_int___thiscall_SOUI::CSimpleWnd::DestroyWindow_void_]
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x314
call fcn.00573450
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x310
call fcn.005733e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.005732e0
call fcn.00585290
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x54efa0
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x662c5e
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x6fc0c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x80], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x28]
call fcn.00446a90
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.00469af0
mov ecx, eax
call fcn.0046c290
movzx edx, al
test edx, edx
jne 0x54f030
mov dword [ebp - 0x68], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0043c550
mov eax, dword [ebp - 0x68]
jmp 0x54f196
mov byte [ebp - 0x59], 1
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.004424a0
add esp, 8
mov dword [ebp - 0x6c], eax
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x70], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x70]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.00452500
add esp, 8
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
call fcn.0043d1b0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x40]
call fcn.0043c550
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0043c550
lea edx, [ebp - 0x28]
push edx
call fcn.00452450
add esp, 4
movzx eax, al
test eax, eax
je 0x54f0f4
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x8c], esp
push 0x688b58
call fcn.00446a20
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x90], ecx
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x94], esp
lea edx, [ebp - 0x28]
push edx
call fcn.004468a0
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 0
call fcn.00455900
add esp, 0x34
mov byte [ebp - 0x5a], al
movzx eax, byte [ebp - 0x5a]
test eax, eax
je 0x54f0f4
jmp 0x54f12c
call fcn.0045eb30
push 1
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.0043d1b0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x20
jbe 0x54f120
jmp 0x54f12c
mov byte [ebp - 0x59], 0
xor ecx, ecx
jne 0x54f034
mov ecx, 0x7078e4
call fcn.0043d1b0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
movzx edx, byte [ebp - 0x59]
test edx, edx
je 0x54f177
push 0
mov ecx, dword [ebp - 0x80]
add ecx, 0x23c
call dword [sym.imp.soui.dll_public:_int___thiscall_SOUI::CSimpleWnd::ShowWindow_int_]
mov dword [ebp - 0x84], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0043c550
mov eax, dword [ebp - 0x84]
jmp 0x54f196
mov dword [ebp - 0x88], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0043c550
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bcdb6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x552680
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6633a9
mov eax, dword fs:[0]
push eax
mov eax, 0x8c4c
call fcn.005bdf80
mov eax, dword [0x6fc0c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8c44], ecx
mov eax, dword [ebp - 0x8c44]
cmp dword [eax + 0x3b0], 0
je 0x5526c9
jmp 0x552832
mov ecx, dword [ebp - 0x8c44]
mov dword [ecx + 0x3b0], 1
mov edx, 1
test edx, edx
je 0x552822
lea ecx, [ebp - 0x445c]
call fcn.00512500
push 1
lea eax, [ebp - 0x445c]
push eax
call fcn.00469af0
mov ecx, eax
call fcn.0046ca20
movzx ecx, al
test ecx, ecx
jne 0x552712
jmp 0x552822
cmp dword [ebp - 0x2c0], 0
jne 0x55271d
jmp 0x5526d9
lea edx, [ebp - 0x445c]
push edx
lea ecx, [ebp - 0x8c40]
call fcn.00511760
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x8c44]
mov ecx, dword [eax + 0x248]
push ecx
lea ecx, [ebp - 0x8c40]
call fcn.0050f220
cmp dword [ebp - 0x2bc], 1
jne 0x552786
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0x8c44]
add ecx, 0x23c
call dword [sym.imp.soui.dll_public:_int___thiscall_SOUI::CSimpleWnd::PostMessageW_unsigned_int__unsigned_int__long_int_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c40]
call fcn.005117f0
jmp 0x552822
cmp dword [ebp - 0x2bc], 0xffffffff
jne 0x55280b
call fcn.00585290
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x8c4c], esp
push 0x68a078
call fcn.00446a20
mov dword [ebp - 0x8c48], eax
mov edx, dword [ebp - 0x8c48]
mov dword [ebp - 0x8c50], edx
mov byte [ebp - 4], 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x8c54], esp
push 0x70795c
call fcn.004468a0
mov dword [ebp - 0x8c58], eax
mov byte [ebp - 4], 0
call fcn.00455900
add esp, 0x34
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c40]
call fcn.005117f0
jmp 0x552822
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c40]
call fcn.005117f0
jmp 0x5526d9
mov eax, dword [ebp - 0x8c44]
mov dword [eax + 0x3b0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bcdb6
mov esp, ebp
pop ebp
ret
Function at 0x580920
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov byte [ebp - 1], 1
mov dword [ebp - 8], 0
push str.YsNetToolInitialize
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x580954
mov ecx, dword [ebp - 8]
mov dword [0x707a94], ecx
jmp 0x58097e
mov byte [ebp - 1], 0
push 0x68bc44
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x68bc70
push str.dll_not_found_api____YsNetToolInitialize_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0xffffffffffffffff
call fcn.0060c33d
push str.YsNetToolUnInitialize
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5809a0
mov eax, dword [ebp - 8]
mov dword [0x707a98], eax
jmp 0x5809ca
mov byte [ebp - 1], 0
push 0x68bce4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x68bc70
push str.dll_not_found_api____YsNetToolUnInitialize_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0xffffffffffffffff
call fcn.0060c33d
push str.YsNetGetToolHandler
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5809ed
mov edx, dword [ebp - 8]
mov dword [0x707a9c], edx
jmp 0x580a17
mov byte [ebp - 1], 0
push 0x68bd7c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x68bc70
push str.dll_not_found_api____YsNetGetToolHandler_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0xffffffffffffffff
call fcn.0060c33d
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x586560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66820b
mov eax, dword fs:[0]
push eax
sub esp, 0x290
mov eax, dword [0x6fc0c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x27c], 0
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.005d6120
add esp, 0xc
push 0
push 0x23
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x5865e2
push 0
push 0x1a
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x58664e
push 0x68c8f0
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x230]
call fcn.00446a20
mov dword [ebp - 0x280], eax
mov edx, dword [ebp - 0x280]
mov dword [ebp - 0x284], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x284]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00444050
add esp, 0xc
mov edx, dword [ebp - 0x27c]
or edx, 1
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0043c550
mov eax, dword [ebp + 8]
jmp 0x586771
lea eax, [ebp - 0x218]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x5866d0
push str.TMTemp
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x248]
call fcn.00446a20
mov dword [ebp - 0x288], eax
mov edx, dword [ebp - 0x288]
mov dword [ebp - 0x28c], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x28c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00444050
add esp, 0xc
mov edx, dword [ebp - 0x27c]
or edx, 1
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.0043c550
mov eax, dword [ebp + 8]
jmp 0x586771
push str.Temp
push 0
lea eax, [ebp - 0x278]
push eax
call fcn.00450680
add esp, 8
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x290]
mov dword [ebp - 0x294], ecx
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x294]
push edx
lea eax, [ebp - 0x260]
push eax
call fcn.00452500
add esp, 8
mov dword [ebp - 0x298], eax
mov ecx, dword [ebp - 0x298]
mov dword [ebp - 0x29c], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x29c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00444050
add esp, 0xc
mov ecx, dword [ebp - 0x27c]
or ecx, 1
mov dword [ebp - 0x27c], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x260]
call fcn.0043c550
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.0043c550
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bcdb6
mov esp, ebp
pop ebp
ret
Function at 0x592400
Capabilities:
Get common file path
Print debug messages
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66a306
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x6fc0c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x707550], 0
jne 0x592440
mov dword [ebp - 0x268], 1
jmp 0x59244a
mov dword [ebp - 0x268], 0
mov al, byte [ebp - 0x268]
mov byte [ebp - 0x261], al
cmp dword [0x707550], 0
jne 0x592595
mov ecx, dword [0x6fbff8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor edx, edx
mov word [ebp - 0x218], dx
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.005d6120
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x230]
call fcn.00446a20
mov dword [ebp - 4], 0
push str.mbcef73mb.dll
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x260]
push ecx
call fcn.0045fcb0
add esp, 0xc
mov byte [ebp - 4], 1
push str.mbcef73
lea edx, [ebp - 0x230]
push edx
lea eax, [ebp - 0x248]
push eax
call fcn.0045fcb0
add esp, 0xc
lea ecx, [ebp - 0x230]
call fcn.0043d1b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x260]
call fcn.0043d1b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x248]
call fcn.0043d1b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x248]
call fcn.0043d1b0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 8
push 0
lea ecx, [ebp - 0x260]
call fcn.0043d1b0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x707550], eax
lea ecx, [ebp - 0x230]
call fcn.0043d1b0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x248]
call fcn.0043c550
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x260]
call fcn.0043c550
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0043c550
push str.mbInit
mov ecx, dword [0x707550]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jne 0x5925ba
xor al, al
jmp 0x5925d6
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x26c]
movzx eax, byte [ebp - 0x261]
test eax, eax
je 0x5925d4
call fcn.0058fe00
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bcdb6
mov esp, ebp
pop ebp
ret
Function at 0x5a5960
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x6fc0c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
push str.Unspecified_error.
call fcn.0059bf80
add esp, 4
push 0x44
push 0
lea eax, [ebp - 0x268]
push eax
call fcn.005d6120
add esp, 0xc
mov dword [ebp - 0x268], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x224]
push ecx
call fcn.005d6120
add esp, 0xc
mov dx, word [0x67fa84]
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.005d6120
add esp, 0xc
push 0x686f8c
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00608f06
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x210]
add ecx, 0x9c
call fcn.0059ec80
push eax
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00608f06
add esp, 0xc
push 0x69f1fc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00608f06
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00608f06
add esp, 0xc
push 0x686f8c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00608f06
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x268]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x210]
add ecx, 0x9c
call fcn.005ad910
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x220], 0
je 0x5a5ac4
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x220], 0
cmp dword [ebp - 0x214], 0
jne 0x5a5ae1
push str.Error_creating_CrashSender_process.
call fcn.0059bf80
add esp, 4
mov eax, 1
jmp 0x5a5b35
cmp dword [ebp + 0xc], 0
je 0x5a5afc
push 0xffffffffffffffff
mov edx, dword [ebp - 0x210]
mov eax, dword [edx + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x10], 0
je 0x5a5b0f
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x224]
mov dword [ecx], edx
jmp 0x5a5b26
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x224], 0
push str.Success.
call fcn.0059bf80
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bcdb6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5b6350
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66b823
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x6fc0c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
call fcn.005b7ba0
push 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x5b63ae
mov eax, 1
jmp 0x5b63fc
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x228]
call fcn.0059e290
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x224], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x224]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.005ad520
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.0059e4d0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bcdb6
mov esp, ebp
pop ebp
ret