joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f8c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, dword [ebp + 8]
mov eax, dword [0x4e3014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov edi, esp
push 0x38a
push str....._base_files_file_util_win.cc
push 0x4d31a6
push edi
call fcn.004546a0
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push edi
call fcn.004546e0
cmp byte [esi + 0xb], 0
jns 0x43f924
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x4d30e0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 0xffffffff
test eax, eax
je 0x43f96b
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp edi, 0xffffffff
je 0x43f96f
call fcn.004546d0
jmp 0x43f971
xor edi, edi
jmp 0x43f9b7
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x43f9b7
lea eax, [edi + 1]
cmp eax, 2
jb 0x43f9b7
mov eax, dword [ebp + 0xc]
mov dword [esp], 0xffffffff
push 0
lea ecx, [esp + 4]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp]
cmp ecx, ebx
mov edx, 0xffffffff
cmove edx, ecx
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, edx
lea eax, [edi + 1]
cmp eax, 2
jb 0x43f9cd
call fcn.004546d0
push edi
call fcn.004599d0
add esp, 4
lea ecx, [esp + 0x10]
call fcn.00454760
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00499333
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43f9f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x270
mov eax, dword [0x4e3014]
xor eax, ebp
mov dword [esp + 0x268], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x250], xmm0
movdqa xmmword [esp + 0x240], xmm0
movdqa xmmword [esp + 0x230], xmm0
movdqa xmmword [esp + 0x220], xmm0
lea ebx, [esp + 0x18]
push 0x3c3
push str....._base_files_file_util_win.cc
push 0x4d31b0
push ebx
call fcn.004546a0
add esp, 0x10
lea ecx, [esp + 0x220]
push 0
push ebx
call fcn.004546e0
lea eax, [esp + 0x1a]
push 0x206
push 0xff
push eax
call fcn.0049bea0
add esp, 0xc
mov word [esp + 0x18], 0
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
add esi, 0xfffffefb
cmp esi, 0xfffffefc
jb 0x43fad1
push ebx
call fcn.004b414c
add esp, 4
mov edi, esp
mov ecx, edi
push eax
push ebx
call fcn.00438cb0
lea ebx, [esp + 0xc]
mov ecx, edi
push ebx
call fcn.0043a040
mov ecx, dword [ebp + 8]
push ebx
call fcn.00438da0
mov ecx, ebx
call fcn.00438d60
mov ecx, edi
call fcn.00438d60
cmp esi, 0xfffffefc
setae bl
lea ecx, [esp + 0x220]
call fcn.00454760
mov ecx, dword [esp + 0x268]
xor ecx, ebp
call fcn.00499333
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fb00
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov edi, ecx
mov eax, dword [0x4e3014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x2a4]
push 0x294
push 0xff
push esi
call fcn.0049bea0
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push edi
call fcn.00458ab0
mov dword [ebp - 0x500], 0xffffffff
mov dword [ebp - 0x4fc], 0xffffffff
mov dword [ebp - 0x4f8], 0xffffffff
lea eax, [ebp - 0x500]
mov ecx, esi
push eax
call fcn.00458cb0
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x43fb83
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x43fd05
xor edi, edi
lea ebx, [ebp - 0x4f4]
jmp 0x43fbaa
mov edi, esi
test eax, eax
je 0x43fd07
push 0x250
push 0xff
push ebx
call fcn.0049bea0
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00458c70
mov eax, dword [ebp - 0x4f4]
test al, 1
je 0x43fc20
cmp byte [ebp + 8], 0
jne 0x43fc00
mov ecx, ebx
call fcn.00458a80
test al, al
je 0x43fbfa
mov ecx, ebx
call fcn.00458a80
xor esi, esi
test al, al
je 0x43fc80
jmp 0x43fcc0
mov eax, dword [ebp - 0x4f4]
and eax, 0xfffffffe
cmp byte [ebp - 0x4f5], 0
lea ecx, [ebp - 0x500]
jns 0x43fc18
mov ecx, dword [ebp - 0x500]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, ebx
call fcn.00458a80
test al, al
je 0x43fc80
xor esi, esi
cmp byte [ebp + 8], 0
je 0x43fcc0
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.0043fb00
add esp, 4
mov esi, eax
test eax, eax
jne 0x43fcc0
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x43fc68
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, 0
test eax, eax
jne 0x43fcc0
jmp 0x43fca2
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x43fc95
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
test eax, eax
jne 0x43fcc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor esi, esi
cmp ecx, 2
je 0x43fcc0
mov esi, eax
nop word cs:[eax + eax]
test edi, edi
cmovne esi, edi
mov ecx, ebx
call fcn.00410910
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.00458cb0
lea ecx, [ebp - 0x500]
push ebx
call fcn.00438da0
mov ecx, ebx
call fcn.00438d60
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x43fba0
mov eax, dword [ebp - 0x4fc]
jmp 0x43fba0
xor esi, esi
lea ecx, [ebp - 0x500]
call fcn.00438d60
lea ecx, [ebp - 0x2a4]
call fcn.00458c00
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499333
mov eax, esi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fde0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x43fe30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x43fe1a
call fcn.004546d0
push dword [esi]
call fcn.004599d0
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x43fe29
mov dword [esi], ebx
call fcn.004546d0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x43fe47
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3

Function at 0x440010
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor eax, eax
cmp dword [ebp + 0xc], 0
sete al
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
push 0
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], 0
test eax, eax
je 0x440092
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x440067
call fcn.004546d0
push dword [esi]
call fcn.004599d0
add esp, 4
mov dword [esi], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x440076
mov dword [esi], edi
call fcn.004546d0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 1
inc eax
cmp eax, 1
jbe 0x440099
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov byte [esi + 4], 1
int3
int3

Function at 0x4411b2
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
mov eax, dword [0x4e3014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x441254
mov edi, eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov ecx, ebx
push 0
push edi
call fcn.00427064
cmp byte [ebx + 0xb], 0
jns 0x4411fc
mov ebx, dword [ebp - 0x1c]
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movzx ecx, byte [ebp - 0x11]
test eax, eax
je 0x441239
mov edx, ecx
test cl, cl
jns 0x441218
mov edx, dword [ebp - 0x18]
cmp eax, edx
jae 0x441239
lea edi, [ebp - 0x1c]
mov ecx, edi
push 0
push eax
call fcn.00434144
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
movsd xmm0, qword [edi]
movsd qword [esi], xmm0
jmp 0x44125c
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
test cl, cl
jns 0x44125c
push dword [ebp - 0x1c]
call fcn.0049893c
add esp, 4
jmp 0x44125c
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499333
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441761
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov ebx, dword [ebp + 8]
mov eax, dword [0x4e3014]
xor eax, ebp
mov dword [esp + 0x20], eax
cmp byte [ebx + 0xb], 0
mov esi, ebx
jns 0x441785
mov esi, dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4417b3
test al, 0x10
jne 0x4418a2
push esi
push 0x4d34b4
push str._hs___ls_directory_conflicts_with_an_existing_file.___n
call fcn.004418f0
add esp, 0xc
xor ebx, ebx
jmp 0x4418db
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 0xb]
mov ecx, ebx
test al, al
jns 0x4417d0
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
add eax, eax
test eax, eax
je 0x441825
movzx edx, word [ecx + eax - 2]
add eax, 0xfffffffe
cmp edx, 0x5c
je 0x4417e8
cmp edx, 0x2f
jne 0x4417d2
cmp eax, 0xfffffffe
je 0x441825
sar eax, 1
lea edx, [ebx + 0xc]
lea edi, [esp + 4]
mov ecx, edi
push edx
push eax
push 0
push ebx
call fcn.00433de0
movsd xmm0, qword [edi]
lea eax, [esp + 0x10]
movsd qword [eax], xmm0
mov ecx, dword [edi + 8]
mov dword [eax + 8], ecx
push eax
call fcn.00441761
add esp, 4
test al, al
je 0x4418b9
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x4418c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x441891
mov dword [esp], eax
lea edi, [esp + 4]
mov ecx, edi
push esi
call fcn.00412ea0
cmp byte [edi + 0xb], 0
jns 0x44185e
mov edi, dword [esp + 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne cl
and eax, 0x10
shr eax, 4
and al, cl
cmp byte [esp + 0xf], 0
jns 0x44188a
push dword [esp + 4]
mov edi, eax
call fcn.0049893c
mov eax, edi
add esp, 4
test al, al
mov eax, dword [esp]
jne 0x4418c8
push eax
push esi
push str.Failed_to_create_directory__ls__last_error_is__d_n
call fcn.004418f0
add esp, 0xc
jmp 0x4418c6
push esi
push 0x4d34b4
push str._hs___ls_directory_exists___n
call fcn.004418f0
add esp, 0xc
mov bl, 1
jmp 0x4418db
push str.Failed_to_create_one_of_the_parent_directories
call fcn.004418f0
add esp, 4
xor ebx, ebx
cmp byte [esp + 0x1b], 0
jns 0x4418db
push dword [esp + 0x10]
call fcn.0049893c
add esp, 4
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.00499333
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4418f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [0x4e3014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp + 0xc]
mov dword [ebp - 0x14], edi
call fcn.00414671
mov ebx, 0x4e8b8c
push edi
push 0
push esi
push 0x400
push ebx
push dword [eax + 4]
push dword [eax]
call fcn.0049d1f4
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499333
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441d4b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x4e3014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x216]
push 0x206
push 0xff
push eax
call fcn.0049bea0
add esp, 0xc
mov edi, 0xfffffff4
lea ebx, [ebp - 0x218]
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [edi + 0x4d3644]
mov word [ebp - 0x218], 0
push 0x104
push ebx
push eax
call esi
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x441dbf
push dword [ebp + 8]
push eax
push ebx
call fcn.00441ce9
add esp, 0xc
test al, al
jne 0x441dc8
add edi, 4
jne 0x441d8b
xor ebx, ebx
jmp 0x441dca
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499333
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x442317
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x4e3014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4e938c]
test eax, eax
jne 0x4423fb
mov edi, 0xc
push edi
call fcn.0049890c
add esp, 4
mov esi, eax
xor ebx, ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x4e938c], eax
push edi
call fcn.0049890c
add esp, 4
mov edi, eax
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x4e9390], eax
call fcn.00440c50
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x28]
push str.user_data_dir
call fcn.00412ea0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x34]
push eax
call fcn.00412ea0
lea ebx, [ebp - 0x1c]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.00440e86
add esp, 0xc
push edi
push esi
push dword [ebp - 0x38]
push ebx
call fcn.00441f18
add esp, 0x10
mov byte [ebp - 0x38], al
cmp byte [ebx + 0xb], 0
jns 0x4423ce
push dword [ebp - 0x1c]
call fcn.0049893c
add esp, 4
cmp byte [ebp - 0x29], 0
jns 0x4423df
push dword [ebp - 0x34]
call fcn.0049893c
add esp, 4
cmp byte [ebp - 0x1d], 0
jns 0x4423f0
push dword [ebp - 0x28]
call fcn.0049893c
add esp, 4
cmp byte [ebp - 0x38], 0
je 0x44241c
mov eax, dword [0x4e938c]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
call fcn.004382f0
mov bl, 1
test esi, esi
je 0x44241e
mov ecx, esi
push dword [0x4e9390]
call fcn.004382f0
jmp 0x44241e
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499333
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4457a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x140
mov eax, dword [0x4e3014]
xor eax, ebp
mov dword [esp + 0x138], eax
cmp byte [0x5e93e0], 0
jne 0x445830
mov eax, dword [0x5e93e8]
test eax, eax
jne 0x4457e2
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
mov eax, dword [0x5e93e8]
test eax, eax
je 0x4457d5
cmp eax, 2
jne 0x445849
cmp byte [0x5e93e0], 0
jne 0x445830
push 2
call fcn.00451200
add esp, 4
test al, al
je 0x445830
lea esi, [esp + 0xc]
mov ecx, esi
push 2
push 0xe7
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00451260
lea eax, [esp + 0x14]
push 0x2f
push str.crash_server_failed_to_launch__self_terminating
push eax
call fcn.00414114
add esp, 0xc
mov ecx, esi
call fcn.00451670
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xffff7001
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor esi, esi
jmp 0x44599f
mov dword [esp + 8], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0x120], xmm0
movaps xmmword [esp + 0x110], xmm0
movaps xmmword [esp + 0x100], xmm0
movaps xmmword [esp + 0xf0], xmm0
movaps xmmword [esp + 0xe0], xmm0
movaps xmmword [esp + 0xd0], xmm0
movaps xmmword [esp + 0xc0], xmm0
movaps xmmword [esp + 0xb0], xmm0
mov dword [esp + 4], 0x20
push str.chrome_elf.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetUnhookErrorAndBlockedDlls
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4458d6
mov ecx, eax
call dword [section..00cfg]
lea eax, [esp + 4]
lea edx, [esp + 0xb0]
lea esi, [esp + 8]
push eax
push edx
push esi
call ecx
add esp, 0xc
mov edi, dword [ebp + 8]
xor esi, esi
inc esi
mov eax, esi
lock xadd dword [0x5e9404], eax
test eax, eax
jle 0x4458f4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SleepEx]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x4e93b0], eax
mov dword [0x4e93a8], edi
mov dword [0x4e93ac], 0
call fcn.004456a6
push dword [0x4e4cd0]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xea60
push dword [0x4e4cd4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x44597e
xor esi, esi
mov ebx, 0xffff7001
push 2
call fcn.00451200
add esp, 4
test al, al
je 0x445991
lea edi, [esp + 0xc]
mov ecx, edi
push 2
push 0x120
push str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
call fcn.00451260
lea eax, [esp + 0x14]
push 0x2e
push str.crash_server_did_not_respond__self_terminating
push eax
call fcn.00414114
add esp, 0xc
mov ecx, edi
call fcn.00451670
jmp 0x445991
call fcn.0046cb20
xor ebx, ebx
test edi, edi
je 0x445991
mov eax, dword [edi]
test eax, eax
je 0x445991
mov ebx, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0x138]
xor ecx, ebp
call fcn.00499333
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x449200
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test bl, bl
mov dword [ebp - 0x14], ecx
lea ecx, [eax + ecx]
lea edx, [esi + ebx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
mov dword [ebp - 0x20], ebx
jb 0x44926d
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x449240
cmp edx, 1
jne 0x449276
jmp 0x449292
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x449292
cmp edx, 2
je 0x449289
cmp edx, 3
jne 0x44929d
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x4493fe
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
ja 0x449306
lea edx, [ebx - 1]
and edx, edi
jmp 0x449312
mov edx, edi
cmp edi, ebx
jb 0x449312
mov eax, edi
xor edx, edx
div ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4493fe
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x4493fe
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x14]
cmovns eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x449365
and eax, dword [ebp - 0x1c]
cmp eax, edx
jne 0x4493fc
mov ebx, dword [ebx]
test ebx, ebx
je 0x4493fc
mov eax, dword [ebx + 4]
cmp edi, eax
jne 0x4493c0
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x449379
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x44935b
lea ecx, [ebx + 8]
test al, al
jns 0x449387
mov ecx, dword [ecx]
js 0x4493de
cmp dword [ebp - 0x14], 0
je 0x4493f8
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [ebx + ecx + 8]
cmp dl, byte [esi + ecx]
jne 0x44935b
inc ecx
cmp eax, ecx
jne 0x4493a0
jmp 0x4493f8
cmp dword [ebp - 0x24], 1
mov edx, dword [ebp - 0x10]
jbe 0x449350
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x449353
xor edx, edx
div ecx
mov eax, edx
mov edx, dword [ebp - 0x10]
jmp 0x449353
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4493f8
push eax
push esi
push ecx
call fcn.0049aa0d
add esp, 0xc
test eax, eax
jne 0x44935b
mov ecx, ebx
jmp 0x4493fe
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x44acb0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test bl, bl
mov dword [ebp - 0x14], ecx
lea ecx, [eax + ecx]
lea edx, [esi + ebx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
mov dword [ebp - 0x20], ebx
jb 0x44ad1d
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x44acf0
cmp edx, 1
jne 0x44ad26
jmp 0x44ad42
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x44ad42
cmp edx, 2
je 0x44ad39
cmp edx, 3
jne 0x44ad4d
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x44aeae
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
ja 0x44adb6
lea edx, [ebx - 1]
and edx, edi
jmp 0x44adc2
mov edx, edi
cmp edi, ebx
jb 0x44adc2
mov eax, edi
xor edx, edx
div ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x44aeae
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x44aeae
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x14]
cmovns eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x44ae15
and eax, dword [ebp - 0x1c]
cmp eax, edx
jne 0x44aeac
mov ebx, dword [ebx]
test ebx, ebx
je 0x44aeac
mov eax, dword [ebx + 4]
cmp eax, edi
jne 0x44ae70
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x44ae29
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x44ae0b
lea ecx, [ebx + 8]
test al, al
jns 0x44ae37
mov ecx, dword [ecx]
js 0x44ae8e
cmp dword [ebp - 0x14], 0
je 0x44aea8
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [ebx + ecx + 8]
cmp dl, byte [esi + ecx]
jne 0x44ae0b
inc ecx
cmp eax, ecx
jne 0x44ae50
jmp 0x44aea8
cmp dword [ebp - 0x24], 1
mov edx, dword [ebp - 0x10]
jbe 0x44ae00
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x44ae03
xor edx, edx
div ecx
mov eax, edx
mov edx, dword [ebp - 0x10]
jmp 0x44ae03
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x44aea8
push eax
push esi
push ecx
call fcn.0049aa0d
add esp, 0xc
test eax, eax
jne 0x44ae0b
mov ecx, ebx
jmp 0x44aeae
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8