joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49897b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
add ecx, 0x10
cmp dword [ecx + 0x14], 8
jb 0x498986
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x498996
xor eax, eax
inc eax
ret
shr eax, 3
and eax, 2
ret

Function at 0x49899d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x20], ebx
cmp dword [esi + 0x14], 8
jb 0x4989c4
mov eax, dword [esi]
jmp 0x4989c6
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x498a62
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x498a37
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
push 0x222
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xd8], eax
call fcn.0044bca0
push ecx
push ecx
mov ecx, esp
push esi
call fcn.0041ad80
lea ecx, [ebp - 0x1c]
call fcn.00437c30
pop ecx
pop ecx
mov edx, str.GetFileAttributes
lea ecx, [ebp - 0xc8]
mov esi, eax
call fcn.0041cec3
mov edx, esi
mov ecx, eax
call fcn.0041d02e
push 3
pop ebx
test bl, 2
je 0x498a4a
lea ecx, [ebp - 0xd8]
and ebx, 0xfffffffd
call fcn.0044c710
test bl, 1
je 0x498a5b
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0041baed
xor al, al
jmp 0x498ae2
test al, 0x10
jne 0x498ae0
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x498ac5
push ecx
push 0x226
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea ecx, [ebp - 0xd0]
call fcn.0044bca0
push ecx
push ecx
mov ecx, esp
mov edi, eax
push esi
call fcn.0041ad80
lea ecx, [ebp - 0x1c]
call fcn.00437c30
pop ecx
pop ecx
lea ecx, [edi + 8]
mov edx, str.GetFileAttributes
mov esi, eax
call fcn.0041cec3
mov edx, esi
mov ecx, eax
call fcn.0041d02e
mov edx, str.:_not_a_directory
mov ecx, eax
call fcn.0041cec3
push 0xc
pop ebx
test bl, 8
je 0x498ad8
lea ecx, [ebp - 0xd0]
and ebx, 0xfffffff7
call fcn.0044bd90
test bl, 4
jmp 0x498a4d
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret
Function at 0x498af3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
cmp dword [esi + 0x14], 8
jb 0x498b19
mov eax, dword [esi]
jmp 0x498b1b
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x498b2f
mov al, 1
jmp 0x498bd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x498bc9
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x498ba1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
push 0x238
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xd8], eax
call fcn.0044bca0
push ecx
push ecx
mov ecx, esp
push esi
call fcn.0041ad80
lea ecx, [ebp - 0x1c]
call fcn.00437c30
pop ecx
pop ecx
mov edx, str.CreateDirectory
lea ecx, [ebp - 0xc8]
mov esi, eax
call fcn.0041cec3
mov edx, esi
mov ecx, eax
call fcn.0041d02e
push 3
pop ebx
test bl, 2
je 0x498bb4
lea ecx, [ebp - 0xd8]
and ebx, 0xfffffffd
call fcn.0044c710
test bl, 1
je 0x498bc5
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0041baed
xor al, al
jmp 0x498bd0
mov ecx, esi
call fcn.0049899d
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret
Function at 0x49a957
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x54], eax
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x4c], ebx
cmp byte [esi + 0x30], bl
je 0x49a98a
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
jmp 0x49a98f
mov eax, dword [esi + 0x18]
mov ecx, ebx
lea edx, [ebp - 0x48]
push edx
push ebx
push 0x40
push ecx
push eax
mov ecx, esi
call fcn.0049c6c1
test al, al
jne 0x49a9f5
xor ecx, ecx
inc ecx
call fcn.0044bc30
test al, al
je 0x49a9de
push ecx
push 0x119
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea ecx, [ebp - 0x108]
call fcn.0044bca0
mov edx, str.could_not_read_dos_header_from
lea ecx, [eax + 8]
call fcn.0041cec3
mov edx, esi
mov ecx, eax
call fcn.0041d02e
xor ebx, ebx
inc ebx
test bl, 1
je 0x49a9ee
lea ecx, [ebp - 0x108]
call fcn.0044bd90
xor al, al
jmp 0x49ab26
mov eax, 0x5a4d
cmp word [ebp - 0x48], ax
je 0x49aa40
xor ecx, ecx
inc ecx
call fcn.0044bc30
test al, al
je 0x49aa3b
push ecx
push 0x11f
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea ecx, [ebp - 0x108]
call fcn.0044bca0
mov edx, str.invalid_e_magic_in_dos_header_of
lea ecx, [eax + 8]
call fcn.0041cec3
mov edx, esi
mov ecx, eax
call fcn.0041d02e
push 2
pop ebx
test bl, 2
jmp 0x49a9e1
cmp byte [esi + 0x30], bl
je 0x49aa53
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x50], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x4c], eax
jmp 0x49aa5c
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ebx
push dword [ebp - 0x54]
mov eax, dword [ebp - 0xc]
cdq
add eax, dword [ebp - 0x50]
mov ecx, edx
push ebx
adc ecx, dword [ebp - 0x4c]
push 0x108
push ecx
mov dword [ebp - 0x4c], ecx
mov ecx, esi
push eax
mov dword [ebp - 0x50], eax
call fcn.0049c6c1
test al, al
jne 0x49aac7
xor ecx, ecx
inc ecx
call fcn.0044bc30
test al, al
je 0x49aabf
push ecx
push 0x127
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea ecx, [ebp - 0x108]
call fcn.0044bca0
mov edx, str.could_not_read_nt_headers_from
lea ecx, [eax + 8]
call fcn.0041cec3
mov edx, esi
mov ecx, eax
call fcn.0041d02e
push 4
pop ebx
test bl, 4
jmp 0x49a9e1
mov eax, dword [ebp - 0x54]
cmp dword [eax], 0x4550
je 0x49ab15
xor ecx, ecx
inc ecx
call fcn.0044bc30
test al, al
je 0x49ab0d
push ecx
push 0x12d
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea ecx, [ebp - 0x108]
call fcn.0044bca0
mov edx, str.invalid_signature_in_nt_headers_of
lea ecx, [eax + 8]
call fcn.0041cec3
mov edx, esi
mov ecx, eax
call fcn.0041d02e
push 8
pop ebx
test bl, 8
jmp 0x49a9e1
test edi, edi
je 0x49ab24
mov eax, dword [ebp - 0x50]
mov dword [edi], eax
mov eax, dword [ebp - 0x4c]
mov dword [edi + 4], eax
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret 8
Function at 0x49ab39
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x54], eax
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x4c], ebx
cmp byte [esi + 0x30], bl
je 0x49ab6c
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
jmp 0x49ab71
mov eax, dword [esi + 0x18]
mov ecx, ebx
lea edx, [ebp - 0x48]
push edx
push ebx
push 0x40
push ecx
push eax
mov ecx, esi
call fcn.0049c6c1
test al, al
jne 0x49abd7
xor ecx, ecx
inc ecx
call fcn.0044bc30
test al, al
je 0x49abc0
push ecx
push 0x119
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea ecx, [ebp - 0x108]
call fcn.0044bca0
mov edx, str.could_not_read_dos_header_from
lea ecx, [eax + 8]
call fcn.0041cec3
mov edx, esi
mov ecx, eax
call fcn.0041d02e
xor ebx, ebx
inc ebx
test bl, 1
je 0x49abd0
lea ecx, [ebp - 0x108]
call fcn.0044bd90
xor al, al
jmp 0x49ad08
mov eax, 0x5a4d
cmp word [ebp - 0x48], ax
je 0x49ac22
xor ecx, ecx
inc ecx
call fcn.0044bc30
test al, al
je 0x49ac1d
push ecx
push 0x11f
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea ecx, [ebp - 0x108]
call fcn.0044bca0
mov edx, str.invalid_e_magic_in_dos_header_of
lea ecx, [eax + 8]
call fcn.0041cec3
mov edx, esi
mov ecx, eax
call fcn.0041d02e
push 2
pop ebx
test bl, 2
jmp 0x49abc3
cmp byte [esi + 0x30], bl
je 0x49ac35
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x50], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x4c], eax
jmp 0x49ac3e
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ebx
push dword [ebp - 0x54]
mov eax, dword [ebp - 0xc]
cdq
add eax, dword [ebp - 0x50]
mov ecx, edx
push ebx
adc ecx, dword [ebp - 0x4c]
push 0xf8
push ecx
mov dword [ebp - 0x4c], ecx
mov ecx, esi
push eax
mov dword [ebp - 0x50], eax
call fcn.0049c6c1
test al, al
jne 0x49aca9
xor ecx, ecx
inc ecx
call fcn.0044bc30
test al, al
je 0x49aca1
push ecx
push 0x127
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea ecx, [ebp - 0x108]
call fcn.0044bca0
mov edx, str.could_not_read_nt_headers_from
lea ecx, [eax + 8]
call fcn.0041cec3
mov edx, esi
mov ecx, eax
call fcn.0041d02e
push 4
pop ebx
test bl, 4
jmp 0x49abc3
mov eax, dword [ebp - 0x54]
cmp dword [eax], 0x4550
je 0x49acf7
xor ecx, ecx
inc ecx
call fcn.0044bc30
test al, al
je 0x49acef
push ecx
push 0x12d
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea ecx, [ebp - 0x108]
call fcn.0044bca0
mov edx, str.invalid_signature_in_nt_headers_of
lea ecx, [eax + 8]
call fcn.0041cec3
mov edx, esi
mov ecx, eax
call fcn.0041d02e
push 8
pop ebx
test bl, 8
jmp 0x49abc3
test edi, edi
je 0x49ad06
mov eax, dword [ebp - 0x50]
mov dword [edi], eax
mov eax, dword [ebp - 0x4c]
mov dword [edi + 4], eax
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret 8
Function at 0x49c374
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword fs:[0x18]
push ebx
push esi
mov esi, edx
xor ebx, ebx
mov eax, dword [eax + 0x24]
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x2d0], eax
jne 0x49c3b8
cmp dword [esi + 0x2d4], ebx
jne 0x49c3b8
push esi
mov dword [esi + 0x2f8], ebx
call fcn.004ca370
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x49c41c
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x49c408
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
push 0x97
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xc0], eax
call fcn.0044bca0
mov edx, 0x50c730
lea ecx, [ebp - 0xb0]
call fcn.0041cec3
xor ebx, ebx
inc ebx
test bl, 1
je 0x49c418
lea ecx, [ebp - 0xc0]
call fcn.0044c710
xor al, al
jmp 0x49c3b1
xor eax, eax
cmp byte [ebp + 8], 1
push 0x2cc
sete al
sub ecx, eax
push ebx
push esi
mov dword [esi + 0x2f8], ecx
call fcn.004cda10
add esp, 0xc
mov dword [esi], 0x1003f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x49c4a0
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x49c490
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
push 0xb0
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x178], eax
call fcn.0044bca0
mov edx, 0x50c71c
lea ecx, [ebp - 0x168]
call fcn.0041cec3
push 2
pop ebx
test bl, 2
je 0x49c418
lea ecx, [ebp - 0x178]
jmp 0x49c413
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x49c3af
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x49c4f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
push 0xb6
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x230], eax
call fcn.0044bca0
mov edx, 0x50c70c
lea ecx, [ebp - 0x220]
call fcn.0041cec3
push 4
pop ebx
test bl, 4
je 0x49c418
lea ecx, [ebp - 0x230]
jmp 0x49c413
Function at 0x4afbe0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
mov eax, 0x1400
cmp ax, di
je 0x4afc85
push 9
lea eax, [ebp - 0x18]
mov ebx, edi
push eax
push 0x59
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x4afc85
mov ecx, dword [ebp - 0x1c]
dec eax
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0041b8e7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4afc40
mov eax, dword [esi]
jmp 0x4afc42
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov eax, 0x400
cmp di, ax
jb 0x4afc72
push 9
lea eax, [ebp - 0x18]
push eax
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x4afc72
dec eax
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0041b8e7
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret

Function at 0x4b01d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov edx, ebx
push esi
push edi
mov edi, ecx
push 0xffffffffffffffff
lea esi, [edi + 4]
mov ecx, esi
call fcn.00433f20
add esp, 4
test al, al
jne 0x4b0242
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x4b0236
cmp eax, 0x21
je 0x4b0236
cmp eax, 5
jne 0x4b0211
mov eax, 0x3e8
pop edi
pop esi
pop ebx
pop ebp
ret 4
cmp dword [esi + 0x14], 8
jb 0x4b0219
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
lea eax, [ecx*2 + 0x3e9]
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, 0x3ea
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x20], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4b9fb0
Capabilities:
Check os version
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov bl, dl
xor edi, edi
mov esi, ecx
test bl, bl
je 0x4b9fed
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x4b9fed
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0xc
lea edi, [ebp - 0xc]
mov dword [ebp - 8], 0x5103f4
mov dword [ebp - 4], 1
cmp dword [esi + 0x14], 8
jb 0x4b9ff5
mov esi, dword [esi]
push edi
push 0
mov eax, 0x200
test bl, bl
push eax
push eax
push 2
push 6
push 3
pop eax
mov ecx, 0x80003
cmovne eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4badcc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 8], ebx
mov dword [esi + 8], edi
call fcn.004ba569
mov byte [esi + 0x5d], al
test al, al
je 0x4badf8
mov byte [esi + 0x5c], bl
jmp 0x4bae0d
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x2c], 9
sete al
mov byte [esi + 0x5c], al
cmp byte [esi + 0x5c], bl
je 0x4bae5b
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x4bae44
push ecx
push 0x21f
push str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea ecx, [ebp - 0xdc]
call fcn.0044bca0
mov edx, str.Reading_x64_process_from_x86_process_not_supported
lea ecx, [eax + 8]
call fcn.0041cec3
xor ebx, ebx
inc ebx
test bl, 1
je 0x4bae54
lea ecx, [ebp - 0xdc]
call fcn.0044bd90
xor al, al
jmp 0x4baf50
lea eax, [esi + 0x30]
push eax
lea ecx, [esi + 0x28]
push ecx
push esi
mov ecx, edi
call fcn.004bba7c
add esp, 0xc
test al, al
jne 0x4baea9
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x4baea4
push ecx
push 0x22d
push str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea ecx, [ebp - 0xdc]
call fcn.0044bca0
mov edx, str.GetProcessBasicInformation_failed
lea ecx, [eax + 8]
call fcn.0041cec3
push 2
pop ebx
test bl, 2
jmp 0x4bae47
mov edx, esi
mov ecx, edi
push dword [esi + 0x2c]
push dword [esi + 0x28]
cmp byte [esi + 0x5c], bl
je 0x4baebf
call fcn.004bbb87
jmp 0x4baec4
call fcn.004bbd8c
pop ecx
pop ecx
test al, al
jne 0x4baf04
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x4baefc
push ecx
push 0x236
push str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea ecx, [ebp - 0xdc]
call fcn.0044bca0
mov edx, str.ReadProcessData_failed
lea ecx, [eax + 8]
call fcn.0041cec3
push 4
pop ebx
test bl, 4
jmp 0x4bae47
mov dl, byte [esi + 0x5c]
mov ecx, edi
push esi
call fcn.004ba71d
pop ecx
test al, al
jne 0x4baf4e
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x4baf46
push ecx
push 0x23b
push str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea ecx, [ebp - 0xdc]
call fcn.0044bca0
mov edx, str.ReadMemoryInfo_failed
lea ecx, [eax + 8]
call fcn.0041cec3
push 8
pop ebx
test bl, 8
jmp 0x4bae47
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4bd2df
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x10]
push ebx
push eax
xorps xmm0, xmm0
mov dword [ebp - 4], ebx
movlpd qword [ebp - 8], xmm0
mov esi, ecx
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4bd363
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x4bd351
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
push 0xe9
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xc8], eax
call fcn.0044bca0
mov edx, 0x5112ac
lea ecx, [ebp - 0xb8]
call fcn.0041cec3
push 2
pop ebx
test bl, 2
je 0x4bd36b
lea ecx, [ebp - 0xc8]
call fcn.0044c710
jmp 0x4bd36b
mov eax, dword [ebp - 0x10]
or eax, dword [ebp - 0xc]
je 0x4bd36f
xor al, al
jmp 0x4bd3c3
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4bd3c1
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x4bd3bc
xor ebx, ebx
inc ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
push 0xf3
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xc8], eax
call fcn.0044bca0
mov edx, 0x5112c0
lea ecx, [ebp - 0xb8]
call fcn.0041cec3
test bl, 1
jmp 0x4bd354
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bd6ec
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc8
push ebx
push esi
lea eax, [esp + 8]
xor ebx, ebx
push eax
push ecx
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4bd75d
push 2
pop ecx
call fcn.0044bc30
test al, al
je 0x4bd74a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
push 0x102
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], eax
call fcn.0044bca0
mov edx, 0x5112d0
lea ecx, [esp + 0x28]
call fcn.0041cec3
inc ebx
test bl, 1
je 0x4bd758
lea ecx, [esp + 0x18]
call fcn.0044c710
or esi, 0xffffffff
jmp 0x4bd761
mov esi, dword [esp + 8]
mov eax, dword [0x51ef30]
test eax, eax
jne 0x4bd786
push ecx
push 0x32
push 0x1400000
xor edx, edx
mov ecx, str.Crashpad.CrashReportSize
call fcn.004385d0
add esp, 0xc
mov dword [0x51ef30], eax
mov edx, dword [eax]
mov ecx, eax
push esi
call dword [edx + 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c1b7d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
push esi
push 0x4c1c40
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x4c1bc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 3
push 0x19
push str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xc0], eax
call fcn.0044bca0
inc ebx
test bl, 1
je 0x4c1bd7
lea ecx, [ebp - 0xc0]
call fcn.0044c710
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c8730
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xdc
push ebx
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x20]
cmp ecx, 0xff
seta al
test al, al
je 0x4c87a6
xor ecx, ecx
inc ecx
call fcn.0044bc30
test al, al
je 0x4c8791
push ecx
push 0xa1
push str..._.._third_party_crashpad_crashpad_snapshot_win_system_snapshot_win.cc
lea ecx, [esp + 0x3c]
call fcn.0044bca0
mov edx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
lea ecx, [eax + 8]
call fcn.0041cec3
xor eax, eax
inc eax
jmp 0x4c8795
mov eax, dword [esp + 8]
test al, 1
je 0x4c87a2
lea ecx, [esp + 0x30]
call fcn.0044bd90
mov ecx, dword [esp + 0x20]
mov ax, bx
mov word [esp + 8], bx
shr ax, 8
test al, al
jne 0x4c87be
mov word [esp + 8], bx
or bl, 0xff
cmp ecx, 0xff
movzx ecx, cl
seta al
test al, al
movzx eax, bl
pop ebx
sete dl
test dl, dl
cmovne eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x4c9bdf
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.RtlInitUnicodeString
push esi
call edi
push str.NtCreateKey
push esi
mov dword [0x51b000], eax
call edi
push str.NtDeleteKey
push esi
mov dword [0x51b004], eax
call edi
push str.NtOpenKeyEx
push esi
mov dword [0x51b008], eax
call edi
push str.NtClose
push esi
mov dword [0x51b00c], eax
call edi
push str.NtQueryValueKey
push esi
mov dword [0x51b010], eax
call edi
push str.NtSetValueKey
push esi
mov dword [0x51b014], eax
call edi
cmp dword [0x51b000], 0
mov dword [0x51b018], eax
je 0x4c9d55
cmp dword [0x51b004], 0
je 0x4c9d55
cmp dword [0x51b00c], 0
je 0x4c9d55
cmp dword [0x51b008], 0
je 0x4c9d55
cmp dword [0x51b010], 0
je 0x4c9d55
cmp dword [0x51b014], 0
je 0x4c9d55
test eax, eax
je 0x4c9d55
push str.RtlFormatCurrentUserKeyPath
push esi
call edi
push str.RtlFreeUnicodeString
push esi
mov ebx, eax
call edi
mov esi, eax
test ebx, ebx
je 0x4c9d55
test esi, esi
je 0x4c9d55
lea eax, [ebp - 8]
push eax
call ebx
test eax, eax
js 0x4c9d55
mov ebx, 0xff
mov edi, 0x51b020
push ebx
push dword [ebp - 4]
push edi
call fcn.004da9ef
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c9cf5
sub ecx, edx
mov eax, ebx
sar ecx, 1
sub eax, ecx
push eax
push 0x4ff620
push edi
call fcn.004da9ef
push 0x5c
push dword [ebp - 4]
call fcn.004cd3e7
add eax, 2
push ebx
push eax
push 0x51b220
call fcn.004daa6e
add esp, 0x20
lea eax, [ebp - 8]
push eax
call esi
call fcn.004c9d5e
mov byte [0x51b01d], al
call fcn.004c9e0c
mov byte [0x51b01e], al
mov al, 1
mov byte [0x51b01c], 1
jmp 0x4c9d57
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c9d5e
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x51a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004cda10
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4c9dca
cmp eax, ebx
jae 0x4c9dca
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.004daa34
add esp, 0xc
test eax, eax
jne 0x4c9dca
mov al, 1
jmp 0x4c9dfc
push ebx
lea eax, [ebp - 0x20c]
push eax
push str.PROGRAMFILES_X86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4c9dfa
cmp eax, ebx
jae 0x4c9dfa
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.004daa34
add esp, 0xc
test eax, eax
je 0x4c9dc6
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb8a3
mov esp, ebp
pop ebp
ret