joyce8/EMBER2024-capa huggingface dataset:
Function at 0x524e00
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 0xc]
movzx edx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test dl, dl
mov dword [ebp - 0x10], ecx
lea ecx, [eax + ecx]
mov dword [ebp - 0x20], edx
lea edx, [esi + edx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
jb 0x524e6d
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x524e40
cmp edx, 1
jne 0x524e76
jmp 0x524e92
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x524e92
cmp edx, 2
je 0x524e89
cmp edx, 3
jne 0x524e9d
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx + 4]
xor ecx, ecx
test edi, edi
je 0x524ff8
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ebx, eax
shr ebx, 0xf
xor ebx, eax
mov edx, edi
shr edx, 1
and edx, 0x55555555
mov eax, edi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
ja 0x524f06
lea edx, [edi - 1]
and edx, ebx
jmp 0x524f12
mov edx, ebx
cmp ebx, edi
jb 0x524f12
mov eax, ebx
xor edx, edx
div edi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x24], edx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x524ff8
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
mov ebx, dword [eax]
test ebx, ebx
je 0x524ff8
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x10]
cmovns eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x524f66
and eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jne 0x524ff6
mov ebx, dword [ebx]
test ebx, ebx
je 0x524ff6
mov eax, dword [ebx + 4]
cmp dword [ebp - 0x14], eax
jne 0x524fc0
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x524f7b
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x524f5c
lea ecx, [ebx + 8]
mov edx, dword [ecx]
test al, al
cmovs ecx, edx
js 0x524fd8
cmp dword [ebp - 0x10], 0
je 0x524ff2
cmp byte [esi], dl
jne 0x524f5c
dec eax
xor ecx, ecx
nop dword [eax]
cmp eax, ecx
je 0x524ff2
movzx edx, byte [ebx + ecx + 9]
lea edi, [ecx + 1]
cmp dl, byte [esi + ecx + 1]
mov ecx, edi
je 0x524fa0
jmp 0x524f5c
cmp dword [ebp - 0x28], 1
jbe 0x524f50
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x524f53
xor edx, edx
div ecx
mov eax, edx
jmp 0x524f53
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x524ff2
push eax
push esi
push ecx
call fcn.005de9dd
add esp, 0xc
test eax, eax
jne 0x524f5c
mov ecx, ebx
jmp 0x524ff8
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x5287aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x528886
mov edi, ecx
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x528886
cmp word [eax + edx + 0x14], 0x68
jb 0x528886
mov ecx, edi
push dword [eax + edx + 0x78]
call fcn.00528710
test eax, eax
je 0x528886
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp eax, 0xffff
jbe 0x5288b3
mov ecx, edi
push dword [ebx + 0x20]
call fcn.00528710
mov edx, dword [ebx + 0x18]
lea ecx, [edx*4]
test ecx, ecx
je 0x528886
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], edi
mov edi, eax
lea esi, [eax + edx*4]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edi
mov ebx, esi
sub ebx, edi
mov eax, ebx
sar eax, 2
shr ebx, 0x1f
add ebx, eax
and ebx, 0xfffffffe
mov ecx, dword [ebp - 0x14]
push dword [edi + ebx*2]
call fcn.00528710
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x528864
mov edx, dword [ebp - 0x20]
cmp cl, byte [eax]
jne 0x528866
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x528858
xor ecx, ecx
lea ebx, [edi + ebx*2]
movzx eax, byte [eax]
cmp cl, al
je 0x528892
movzx ecx, cl
cmp ecx, eax
lea eax, [ebx + 4]
cmovg edi, eax
cmovs esi, ebx
xor eax, eax
cmp edi, esi
jne 0x528830
jmp 0x528888
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
push dword [esi + 0x24]
call fcn.00528710
sub ebx, dword [ebp - 0x18]
sar ebx, 1
movzx eax, word [eax + ebx]
add ax, word [esi + 0x10]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov word [esi], ax
mov al, 1
jmp 0x528888

Function at 0x541360
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x6894ac]
cmp esi, 1
ja 0x5413c6
push 0x6894ac
call fcn.004b5ef0
add esp, 4
test al, al
je 0x5413c0
mov dword [0x6894b4], 0
mov dword [0x6894b0], 0
mov esi, 0x6894b0
mov ecx, 0x6894b0
push 0
call fcn.004c3ff0
push 0x6894ac
push 0
push 0x6894b0
push 0x6894ac
call fcn.004b5fd0
add esp, 0x10
jmp 0x5413c6
mov esi, dword [0x6894ac]
mov ecx, esi
pop esi
pop ebp
jmp fcn.004c3f80
Function at 0x541e60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov edi, ecx
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
push edx
push ecx
push esi
call fcn.004c19f0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x541e8e
mov esi, dword [ebp - 0x1c]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
js 0x541eac
cmp dword [ebp + 8], 0
jne 0x541ec1
jmp 0x541f5b
push dword [ebp - 0x1c]
call fcn.005dc756
add esp, 4
cmp dword [ebp + 8], 0
je 0x541f5b
test esi, esi
je 0x541f5b
mov eax, esi
add eax, esi
mov ecx, 0xffffffff
cmovae ecx, eax
push ecx
call fcn.005dc783
add esp, 4
mov ecx, edi
mov edi, eax
mov eax, ebx
lea ebx, [ebp - 0x1c]
push eax
push ecx
push ebx
call fcn.004c19f0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x541efb
mov ebx, dword [ebp - 0x1c]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x541f15
push dword [ebp - 0x1c]
call fcn.005dc756
add esp, 4
test edi, edi
mov ebx, dword [ebp + 8]
je 0x541f74
push edi
call fcn.005f8ba4
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.004c17a0
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x541f43
push dword [ebx]
call fcn.005dc756
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebx], xmm0
push edi
call fcn.005dc78c
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x5425a8
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x12c
mov esi, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov ecx, dword [0x674014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor ecx, ecx
dec ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], ecx
test al, al
je 0x542683
lea ebx, [ebp - 0x120]
xor edi, edi
push 0x110
push edi
push ebx
call fcn.005dfe70
add esp, 0xc
mov dword [ebx - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x62fbd0]
movups xmmword [esp], xmm0
mov ebx, dword [sym.imp.ntdll.dll_VerSetConditionMask]
call ebx
mov ecx, 3
push ecx
push 1
push edx
push eax
call ebx
mov ecx, 3
push ecx
push 0x20
push edx
push eax
call ebx
lea ecx, [ebp - 0x120]
mov dword [ecx - 8], 6
mov dword [ecx - 4], edi
mov word [ecx + 0x108], 0
lea ecx, [ebp - 0x12c]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ebx, 0x80003
test eax, eax
je 0x54268a
lea edi, [ebp - 0x138]
mov dword [edi], 0xc
push 0
call fcn.005426d3
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], 1
jmp 0x54268a
xor edi, edi
mov ebx, 3
cmp byte [esi + 0xb], 0
jns 0x542692
mov esi, dword [esi]
sub esp, 0x20
mov dword [esp + 0x1c], edi
movaps xmm0, xmmword [0x62fbe0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, esi
add esp, 0x12c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x545cd8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret

Function at 0x546230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x674014]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, SysReAllocString
cmp edx, esi
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x546279
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
jne 0x54627c
int3
xor esi, esi
dec esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005dd6f3
mov eax, esi
add esp, 8
pop esi
pop ebp
ret

Function at 0x54628e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x674014]
xor ecx, ebp
mov esi, SysReAllocString
cmp eax, esi
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push ebx
push edi
call ecx
test eax, eax
je 0x546312
mov esi, ebx
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x5462f9
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x546324
mov ebx, esi
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x5462c1
cmp ebx, 0xffffffff
je 0x546329
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x5462fe
mov ebx, dword [ebp - 0x14]
jmp 0x5462fe
int3

Function at 0x546903
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov esi, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.00546814
add esp, 0x10
or edx, eax
jne 0x546986
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
jne 0x546986
push 2
call fcn.004b68d0
add esp, 4
test al, al
je 0x546984
call fcn.004b7210
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0xfb
push str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
call fcn.004b73b0
lea eax, [ebp - 0xac]
push 0xc
push 0x63094a
push eax
call fcn.0041482a
add esp, 0xc
mov ecx, esi
call fcn.004b7460
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0xac
pop esi
pop ebx
pop ebp
ret
Function at 0x54895a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x54897d
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5489a9
mov ebx, eax
cmp byte [ebp + 0xc], 0
jne 0x54899e
mov eax, ebx
and eax, 0x400
jne 0x548a4f
and ebx, 0x10
shr ebx, 4
jmp 0x548a51
push 2
call fcn.004b68d0
add esp, 4
test al, al
je 0x548a4f
call fcn.004b7210
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x82
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.004b73b0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0041482a
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x5489fd
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.004c17a0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x548a22
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push esi
call fcn.0041482a
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x548a44
push dword [ebp - 0xc4]
call fcn.005dc756
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004b7460
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x548a68
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x548a8b
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x548bf3
cmp byte [ebp + 0x10], 0
je 0x548b5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x548b5d
push 1
push edi
call fcn.0054895a
add esp, 8
test al, al
jne 0x548bf3
push 2
call fcn.004b68d0
add esp, 4
test al, al
je 0x548bf1
lea ecx, [ebp - 0xc4]
push 2
push 0x5d
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.004b6940
movzx eax, byte [edi + 0xb]
test al, al
jns 0x548aff
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea esi, [ebp - 0xbc]
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.004c17a0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x548b21
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
push eax
push ebx
push esi
call fcn.0041482a
add esp, 0xc
push 0x10
push str._not_a_directory
push eax
call fcn.0041482a
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x548b4d
push dword [ebp - 0x1c]
call fcn.005dc756
add esp, 4
lea ecx, [ebp - 0xc4]
call fcn.004b6d50
jmp 0x548bf1
push 2
call fcn.004b68d0
add esp, 4
test al, al
je 0x548bf1
call fcn.004b7210
lea ecx, [ebp - 0xc4]
push eax
push 2
push 0x62
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.004b73b0
lea eax, [ebp - 0xbc]
push 0x10
push str.CreateDirectory
push eax
call fcn.0041482a
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x548bae
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.004c17a0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x548bca
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
push eax
push ebx
push esi
call fcn.0041482a
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x548be6
push dword [ebp - 0x1c]
call fcn.005dc756
add esp, 4
lea ecx, [ebp - 0xc4]
call fcn.004b7460
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x548c0a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x548c2d
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x548c46
test eax, 0x410
sete bl
jmp 0x548ceb
push 2
call fcn.004b68d0
add esp, 4
test al, al
je 0x548ce9
call fcn.004b7210
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x75
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.004b73b0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0041482a
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x548c97
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.004c17a0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x548cbc
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push esi
call fcn.0041482a
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x548cde
push dword [ebp - 0xc4]
call fcn.005dc756
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004b7460
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x548d02
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x548d25
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x548d58
and eax, 0x410
cmp eax, 0x410
jne 0x548d58
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00548e32
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x548d62
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x548e1b
push 2
call fcn.004b68d0
add esp, 4
test al, al
je 0x548e19
call fcn.004b7210
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x95
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.004b73b0
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.0041482a
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x548dc7
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.004c17a0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x548dec
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.0041482a
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x548e0e
push dword [ebp - 0xc4]
call fcn.005dc756
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004b7460
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x548e32
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, ecx
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x548e54
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x548f11
push 2
call fcn.004b68d0
add esp, 4
test al, al
je 0x548f11
call fcn.004b7210
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x30
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.004b73b0
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.0041482a
add esp, 0xc
movzx ecx, byte [edi + 0xb]
test cl, cl
mov dword [ebp - 0xc8], eax
jns 0x548eba
mov ecx, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push ecx
push edi
push ebx
call fcn.004c17a0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x548edf
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push dword [ebp - 0xc8]
call fcn.0041482a
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x548f06
push dword [ebp - 0xc4]
call fcn.005dc756
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004b7460
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x54ce1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x78], eax
xor eax, eax
dec eax
lea esi, [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esp + 0xc], ecx
add ecx, 0x30
push esi
call fcn.0054cf96
mov edi, dword [esi]
mov eax, dword [esi + 4]
mov dword [esp + 0x10], eax
cmp edi, eax
je 0x54ceef
lea esi, [esp + 0x20]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov ecx, esi
call fcn.00546d48
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x40]
push esi
push edi
call fcn.004f6740
mov bl, 3
test eax, eax
jne 0x54ceb6
mov ebx, dword [esp + 0xc]
mov ecx, ebx
push esi
call fcn.0054cfe2
mov bl, byte [ebx + 0x28]
xor bl, 1
cmp byte [esp + 0x47], 0
jns 0x54cec9
push dword [esp + 0x3c]
call fcn.005dc756
add esp, 4
lea ecx, [esp + 0x30]
call fcn.004b3910
cmp bl, 3
je 0x54cee2
movzx eax, bl
test eax, eax
jne 0x54cf6d
add edi, 0x10
cmp edi, dword [esp + 0x10]
jne 0x54ce67
mov eax, dword [esp + 0xc]
cmp byte [eax + 0xb], 0
je 0x54cf6d
xor eax, eax
lea edx, [esp + 0x20]
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x40]
push edx
call fcn.004f6880
test eax, eax
jne 0x54cf64
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
cmp ebx, eax
je 0x54cf64
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
cmp edi, esi
je 0x54cf49
mov ecx, edi
push ebx
call fcn.004f7adc
test al, al
jne 0x54cf45
add edi, 0x10
jmp 0x54cf30
cmp edi, esi
jne 0x54cf5b
mov esi, dword [esp + 0xc]
mov ecx, esi
push ebx
call fcn.0054cfe2
cmp byte [esi + 0x28], 0
je 0x54cf64
add ebx, 0x50
cmp ebx, dword [esp + 0x10]
jne 0x54cf28
lea ecx, [esp + 0x20]
call fcn.00415c6a
mov eax, dword [esp + 0x14]
test eax, eax
je 0x54cf82
mov dword [esp + 0x18], eax
push eax
call fcn.005dc756
add esp, 4
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.005dd6f3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x555810
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0x28], eax
mov al, byte [ebp + 0x10]
movzx eax, al
lea ebx, [eax + eax]
add ebx, 4
mov esi, dword [ebp + 0x18]
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test eax, eax
jne 0x555869
call fcn.00442720
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test eax, eax
je 0x5558b6
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0xc], xmm0
movdqa xmmword [esp], xmm0
mov eax, esp
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, dword [esp + 0xc]
sub ecx, edi
add ecx, dword [esp + 4]
test eax, eax
cmove ecx, eax
mov esi, dword [ebp + 8]
mov byte [esi], 1
mov dword [esi + 4], ecx
mov dword [esi + 8], edi
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.005dd6f3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
call fcn.00442720
mov esi, dword [ebp + 8]
mov byte [esi], 0
jmp 0x55589f

Function at 0x558ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ecx + 4]
jmp 0x558ed6
mov eax, dword [eax + 0x8c]
test eax, eax
je 0x558f16
xor edi, edi
xchg dword [eax], edi
test edi, edi
je 0x558ed0
mov dword [ebp - 0x10], eax
nop word cs:[eax + eax]
bsf ecx, edi
mov ebx, 1
shl ebx, cl
mov esi, dword [eax + ecx*4 + 8]
mov ecx, dword [esi + 4]
call dword [section..00cfg]
push esi
call ecx
mov eax, dword [ebp - 0x10]
add esp, 4
xor edi, ebx
jne 0x558ef0
jmp 0x558ed0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret