joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x58a014]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov edi, dword [ecx + eax*4]
mov ebx, dword [edi + 0x28]
mov ecx, edi
lea eax, [ebp - 0x1c]
push eax
call fcn.004fd170
mov ecx, esi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.004b73e0
mov ecx, eax
xor ecx, dword [esi + 8]
mov eax, ecx
mov edx, 0x7f4a7c15
mul edx
imul eax, ecx, 0x9e3779b9
add eax, edx
mov edx, dword [esi + 4]
dec edx
and edx, eax
mov ecx, esi
push edi
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.00529300
mov edi, ebx
test ebx, ebx
jne 0x52974f
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x5297b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x58a014]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx]
lea edx, [ebp - 0x14]
mov dword [edx], eax
mov dword [ebp - 0x24], ecx
add ecx, 4
mov dword [ebp - 0x28], ecx
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0x18]
lea ebx, [ebp - 0x20]
push ebx
call fcn.004fd170
mov ecx, edi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.004b73e0
mov ecx, eax
xor ecx, dword [edi + 8]
mov eax, ecx
mov edx, 0x7f4a7c15
mul edx
imul eax, ecx, 0x9e3779b9
add eax, edx
mov edx, dword [edi + 4]
dec edx
and edx, eax
mov ecx, edi
push esi
push edx
push ebx
call fcn.00529300
lea ecx, [ebp - 0x14]
call fcn.004505f0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jne 0x5297df
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x52983e
cmp dword [edi + 0x14], 0
je 0x529852
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, esi
push dword [esi + 4]
call fcn.00528fc0
push esi
call fcn.004ba1ee
add esp, 4
jmp 0x52983e

Function at 0x52ef20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, edx
mov edi, ecx
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x18], eax
add esi, edi
cmp edi, esi
jae 0x52ef7a
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, esi
sub eax, edi
push ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete dl
mov ecx, dword [ebp - 0x14]
test ecx, ecx
sete al
or al, dl
jne 0x52ef74
mov ebx, ecx
add edi, ebx
cmp al, 1
jne 0x52ef44
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x531570
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x531593
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5315b8
mov ebx, eax
cmp byte [ebp + 0xc], 0
jne 0x5315b0
mov eax, ebx
and eax, 0x400
jne 0x5315c6
and ebx, 0x10
shr ebx, 4
jmp 0x5315c8
push 2
call fcn.00495280
add esp, 4
test al, al
jne 0x5315df
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00502ea0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x82
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00502fe0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.004e90c0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x531623
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x531626
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.0049bff0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x53164d
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x531650
and eax, 0x7f
push eax
push ebx
push esi
call fcn.004e90c0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x531672
push dword [ebp - 0xc4]
call fcn.004ba1ee
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00503040
jmp 0x5315c6
Function at 0x531690
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x5316b3
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
je 0x5316d9
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp + 0x10], 0
je 0x5316ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x53173f
push 2
call fcn.00495280
add esp, 4
test al, al
jne 0x5316fe
xor ebx, ebx
jmp 0x5316c2
call fcn.00502ea0
lea ecx, [ebp - 0xc4]
push eax
push 2
push 0x62
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00502fe0
lea eax, [ebp - 0xbc]
push 0x10
push str.CreateDirectory
push eax
call fcn.004e90c0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x531783
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x531786
push 1
push edi
call fcn.00531570
add esp, 8
test al, al
jne 0x5316c2
push 2
call fcn.00495280
add esp, 4
test al, al
je 0x5316fa
lea ecx, [ebp - 0xc4]
push 2
push 0x5d
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0043f9d0
movzx eax, byte [edi + 0xb]
test al, al
jns 0x5317d3
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x5317d6
and eax, 0x7f
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.0049bff0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x5317a4
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
jmp 0x5317a7
and eax, 0x7f
push eax
push ebx
push esi
call fcn.004e90c0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x5317c3
push dword [ebp - 0x1c]
call fcn.004ba1ee
add esp, 4
lea ecx, [ebp - 0xc4]
call fcn.00503040
jmp 0x5316fa
and eax, 0x7f
lea esi, [ebp - 0xbc]
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.0049bff0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x5317fa
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
jmp 0x5317fd
and eax, 0x7f
push eax
push ebx
push esi
call fcn.004e90c0
add esp, 0xc
push 0x10
push str._not_a_directory
push eax
call fcn.004e90c0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x531829
push dword [ebp - 0x1c]
call fcn.004ba1ee
add esp, 4
lea ecx, [ebp - 0xc4]
call fcn.0043fe10
jmp 0x5316fa
Function at 0x531840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x531863
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x53188e
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00495280
add esp, 4
test al, al
jne 0x5318a0
xor ebx, ebx
jmp 0x531877
call fcn.00502ea0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x75
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00502fe0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.004e90c0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x5318e1
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x5318e4
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.0049bff0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x53190b
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x53190e
and eax, 0x7f
push eax
push ebx
push esi
call fcn.004e90c0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x531930
push dword [ebp - 0xc4]
call fcn.004ba1ee
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00503040
jmp 0x53189c
Function at 0x531940
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, dword [ebp + 8]
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x531963
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x53197b
and eax, 0x410
cmp eax, 0x410
je 0x5319bb
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x531985
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
je 0x5319a9
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00495280
add esp, 4
test al, al
jne 0x5319d6
xor ebx, ebx
jmp 0x531992
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00531a80
call fcn.00502ea0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x95
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00502fe0
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.004e90c0
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x531a1a
mov eax, dword [esi + 4]
mov esi, dword [esi]
jmp 0x531a1d
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.0049bff0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x531a44
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x531a47
and eax, 0x7f
push eax
push ebx
push edi
call fcn.004e90c0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x531a69
push dword [ebp - 0xc4]
call fcn.004ba1ee
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00503040
jmp 0x5319b7
Function at 0x531a80
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, ecx
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x531aa2
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x531abd
push 2
call fcn.00495280
add esp, 4
test al, al
jne 0x531ad9
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00502ea0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x30
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00502fe0
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.004e90c0
add esp, 0xc
movzx ecx, byte [edi + 0xb]
test cl, cl
mov dword [ebp - 0xc8], eax
jns 0x531b1e
mov ecx, dword [edi + 4]
mov edi, dword [edi]
jmp 0x531b21
and ecx, 0x7f
lea ebx, [ebp - 0xc4]
push ecx
push edi
push ebx
call fcn.0049bff0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x531b48
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x531b4b
and eax, 0x7f
mov ecx, dword [ebp - 0xc8]
push eax
push ebx
push ecx
call fcn.004e90c0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x531b73
push dword [ebp - 0xc4]
call fcn.004ba1ee
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00503040
jmp 0x531abd

Function at 0x53ae50
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00531940
Function at 0x53d230
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
lea edi, [ebp - 0x18]
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [eax], 4
push eax
push edi
push esi
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x53d27a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x53d320
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [esp + 0xdc], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov dword [esi + 0x20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x14], 0x100
jb 0x53d375
push 1
call fcn.00495280
add esp, 4
test al, al
jne 0x53d3a0
mov eax, dword [esp + 0xc4]
cmp eax, 0x100
mov ebx, 0xff
cmovb ebx, eax
mov ecx, dword [esp + 0xdc]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
lea esi, [esp + 0xc]
mov ecx, esi
push 1
push 0x114
push str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
call fcn.0043f9d0
lea eax, [esp + 0x14]
push 0x2c
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.004e90c0
add esp, 0xc
mov ecx, esi
call fcn.0043fe10
jmp 0x53d375
Function at 0x547440
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov ebx, ecx
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.004e8c60
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.0054b510
test al, al
je 0x5474ff
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x54752d
mov ecx, edi
call fcn.004e8c60
mov edi, eax
mov eax, dword [esp + 0xec]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0x108
push esi
push edi
call fcn.0054b510
test al, al
je 0x547562
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x547594
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x547513
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x547513
push 1
call fcn.00495280
add esp, 4
test al, al
jne 0x5475ca
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.00495280
add esp, 4
test al, al
je 0x547511
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0043f9d0
lea eax, [esp + 0x14]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x5475ec
push 1
call fcn.00495280
add esp, 4
test al, al
je 0x547511
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0043f9d0
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x5475ec
push 1
call fcn.00495280
add esp, 4
test al, al
je 0x547511
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0043f9d0
lea eax, [esp + 0x14]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x5475ec
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0043f9d0
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.004e90c0
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x547604
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
jmp 0x547607
and ecx, 0x7f
push ecx
push ebx
push eax
call fcn.004e90c0
add esp, 0xc
mov ecx, edi
call fcn.0043fe10
jmp 0x547511
Function at 0x547620
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov ebx, ecx
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.004e8c60
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.0054b510
test al, al
je 0x5476df
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x54770d
mov ecx, edi
call fcn.004e8c60
mov edi, eax
mov eax, dword [esp + 0xec]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0xf8
push esi
push edi
call fcn.0054b510
test al, al
je 0x547742
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x547774
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x5476f3
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x5476f3
push 1
call fcn.00495280
add esp, 4
test al, al
jne 0x5477aa
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.00495280
add esp, 4
test al, al
je 0x5476f1
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0043f9d0
lea eax, [esp + 0x14]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x5477cc
push 1
call fcn.00495280
add esp, 4
test al, al
je 0x5476f1
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0043f9d0
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x5477cc
push 1
call fcn.00495280
add esp, 4
test al, al
je 0x5476f1
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0043f9d0
lea eax, [esp + 0x14]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x5477cc
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0043f9d0
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.004e90c0
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x5477e4
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
jmp 0x5477e7
and ecx, 0x7f
push ecx
push ebx
push eax
call fcn.004e90c0
add esp, 0xc
mov ecx, edi
call fcn.0043fe10
jmp 0x5476f1
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x5c74492
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4df363a9
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, reloc.opengl32.dll_glHint
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x5e0ef1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x5e0f8f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x5e0f8f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5e0f8f
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5e0f8f
mov ebx, dword [eax + 0x34]
mov dword [ebp - 0xc], ebx
mov ebx, dword [eax + 0x50]
mov dword [ebp - 8], ebx
push edi
push 4
push 0x2000
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x122d24b4]
pop edi
test eax, eax
jne 0x5e0f82
push edi
push 4
push 0x2000
push dword [ebp - 8]
push 0
call dword [edi + 0x122d24b4]
pop edi
test eax, eax
je 0x5e0f8f
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x14], eax
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x5e1014
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x14]
mov dword [ebp - 8], ebx
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e10c0
push ecx
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jae 0x5e1055
mov ecx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
push ecx
push edi
push 4
push 0x1000
push dword [ebp - 4]
push eax
call dword [edi + 0x122d24b4]
pop edi
pop ecx
test eax, eax
je 0x5e10b3
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5e1093
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 0xc]
lea eax, [ebx + 0x10]
cmp dword [eax + 4], 0
je 0x5e10a8
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e103c
pop ecx
mov dword [ebp - 0x10], 0
jmp 0x5e10c7
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x5e12e1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e135b
push ecx
mov ecx, dword [ebx + 0xc]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebx + 0x24]
push edx
call fcn.005e1286
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x1245081c]
pop edi
test eax, eax
jne 0x5e1351
pop ecx
jmp 0x5e1362
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e130a
mov dword [ebp - 0x18], 1
popal
mov eax, dword [ebp - 0x18]
leave
ret 4