joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d51a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 8]
push esi
mov esi, dword [ecx + 0x38]
push edi
movups xmm0, xmmword [eax]
mov edi, dword [ecx + 0x3c]
mov dword [ebp - 0x14], ecx
movups xmmword [ebp - 0x10], xmm0
cmp esi, edi
je 0x4d51f1
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00504b60
test al, al
jne 0x4d51ee
add esi, 0x70
cmp esi, edi
jne 0x4d51d8
mov ecx, dword [ebp - 0x14]
cmp esi, dword [ecx + 0x3c]
jne 0x4d5206
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
cmp dword [esi + 0x24], 8
lea eax, [esi + 0x10]
jb 0x4d5211
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4d51f6
shr eax, 3
and eax, 2
jne 0x4d522a
mov ecx, dword [ebp - 0x18]
mov dword [ecx], esi
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8

Function at 0x4d5240
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebx + 0x10]
mov edx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 8]
push esi
mov esi, dword [edx + 0x38]
push edi
movups xmm0, xmmword [eax]
mov edi, dword [edx + 0x3c]
mov dword [ebp - 0x14], edx
movups xmmword [ebp - 0x10], xmm0
cmp esi, edi
je 0x4d5299
nop word [eax + eax]
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00504b60
test al, al
jne 0x4d5296
add esi, 0x70
cmp esi, edi
jne 0x4d5280
mov edx, dword [ebp - 0x14]
cmp esi, dword [edx + 0x3c]
jne 0x4d52ae
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
mov ecx, dword [esi + 0x68]
cmp ecx, dword [ebx + 0xc]
jne 0x4d52e2
cmp dword [esi + 0x24], 8
lea eax, [esi + 0x10]
jb 0x4d52c1
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4d52d7
mov edx, dword [ebp - 0x14]
mov eax, 1
jmp 0x4d52f1
mov edx, dword [ebp - 0x14]
shr eax, 3
and eax, 2
jmp 0x4d52f1
mov eax, 1
mov edi, 4
cmp ecx, eax
cmove eax, edi
test eax, eax
jne 0x4d52fe
mov ecx, dword [ebp - 0x18]
mov byte [edx + 0x34], 1
mov dword [ecx], esi
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x4d8df0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x38]
lea esi, [edi + 0x10]
mov dword [edi + 4], vtable.crashpad::CrashReportUploadThread.1.0
mov dword [edi], vtable.crashpad::CrashReportUploadThread.0
mov eax, dword [ebx]
mov dword [edi + 8], eax
mov dword [esi + 0x24], 0
test ecx, ecx
je 0x4d8e2d
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
push dword [ebp - 4]
lea ecx, [edi + 0x38]
call fcn.004152a0
cmp byte [ebx + 3], 0
lea ecx, [edi + 0x50]
je 0x4d8e4b
movsd xmm0, qword [0x599808]
jmp 0x4d8e53
movsd xmm0, qword [0x5945c8]
push edi
sub esp, 8
movsd qword [esp], xmm0
call fcn.005035d0
lea ecx, [edi + 0x74]
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
call fcn.0050d0f0
mov eax, dword [ebp + 8]
push 0
mov dword [edi + 0x8c], eax
call fcn.0052659e
mov edx, eax
mov dword [edi + 0x1414], 0xffffffff
add esp, 4
mov dword [edi + 0x94], edx
mov ecx, 1
lea esi, [edi + 0x98]
nop
mov eax, edx
lea esi, [esi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
inc ecx
mov dword [esi - 4], edx
cmp ecx, 0x270
jb 0x4d8eb0
mov ecx, dword [ebp + 0x38]
mov dword [edi + 0x90], 0x270
mov dword [edi + 0x1418], 1
mov dword [edi + 0x141c], 0x64
mov byte [edi + 0x1420], 0
test ecx, ecx
je 0x4d8f0b
mov esi, dword [ecx]
lea eax, [ebp + 0x14]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x34
Function at 0x4d8f80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x4d8fde
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x4d8fa0
mov eax, dword [edi]
jmp 0x4d90c9
cmp eax, 0x4e0
jb 0x4d90c9
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4d9000
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4d9050
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4da800
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov dword [ebp - 8], ecx
push edi
nop dword [eax]
mov edi, dword [ecx]
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x4da866
lea eax, [edi + 8]
mov esi, 0x270
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x4da826
mov eax, dword [edi]
jmp 0x4da948
cmp eax, 0x4e0
jb 0x4da948
mov eax, dword [edi + 0x9c4]
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4da882
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4da8d0
mov edi, dword [ebp - 4]
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
mov ecx, dword [ebp - 8]
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [ecx + 8]
ja 0x4da810
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f39b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xff
jbe 0x4f3a06
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push 1
push 0x10a
push str..._.._.._snapshot_win_system_snapshot_win.cc
push str.unsigned_char___thiscall_crashpad::internal::SystemSnapshotWin::CPUCount_void__const
lea ecx, [ebp - 0xd0]
call fcn.0050c270
push eax
call fcn.00439550
add esp, 8
lea ecx, [ebp - 0xd0]
call fcn.0050c3e0
mov ecx, dword [ebp - 0x14]
mov al, 0
mov word [ebp - 4], 0x100
dec al
cmp ecx, 0xff
movzx eax, al
setbe dl
movzx ecx, cl
test dl, dl
cmovne eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x4f3a30
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x1c]
cmp edx, 0xff
jbe 0x4f3a86
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push 1
push 0x10a
push str..._.._.._snapshot_win_system_snapshot_win.cc
push str.unsigned_char___thiscall_crashpad::internal::SystemSnapshotWin::CPUCount_void__const
lea ecx, [ebp - 0xd8]
call fcn.0050c270
push eax
call fcn.00439550
add esp, 8
lea ecx, [ebp - 0xd8]
call fcn.0050c3e0
mov edx, dword [ebp - 0x1c]
cmp edx, 0xff
mov word [ebp - 4], 0x100
push ebx
setbe al
xor ecx, ecx
test al, al
mov ecx, 0xff
push esi
cmovne ecx, edx
xor esi, esi
movzx eax, cl
xor ecx, ecx
push edi
xor edi, edi
mov dword [ebp - 4], ecx
lea ebx, [eax + eax*2]
shl ebx, 3
test eax, eax
je 0x4f3b08
cmp ebx, 0x1000
jb 0x4f3aeb
lea eax, [ebx + 0x23]
cmp eax, ebx
jbe 0x4f3be4
push eax
call fcn.004b9130
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4f3bdf
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x4f3af4
push ebx
call fcn.004b9130
add esp, 4
mov esi, eax
push ebx
push 0
push eax
lea edi, [ebx + esi]
mov dword [ebp - 4], edi
call fcn.00518890
add esp, 0xc
push ebx
push esi
push 0
push 0
push 0xb
call sub.POWRPROF.dll_CallNtPowerInformation
test eax, eax
je 0x4f3b39
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov edx, dword [ebp - 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [ebp - 0xc]
jmp 0x4f3b8a
mov eax, esi
cmp esi, edi
je 0x4f3b56
lea edx, [esi + 0x18]
cmp edx, edi
je 0x4f3b56
mov ecx, dword [eax + 8]
cmp ecx, dword [edx + 8]
cmovb eax, edx
add edx, 0x18
cmp edx, edi
jne 0x4f3b46
mov eax, dword [eax + 8]
mov ebx, 0xf4240
mov ecx, dword [ebp + 8]
mul ebx
mov dword [ecx], eax
mov eax, esi
mov dword [ecx + 4], edx
cmp esi, edi
je 0x4f3b85
lea edx, [esi + 0x18]
cmp edx, edi
je 0x4f3b85
mov ecx, dword [eax + 4]
cmp ecx, dword [edx + 4]
cmovb eax, edx
add edx, 0x18
cmp edx, edi
jne 0x4f3b75
mov eax, dword [eax + 4]
mul ebx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x4f3bd6
mov ecx, dword [ebp - 4]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
shl ecx, 3
cmp ecx, 0x1000
jb 0x4f3bcc
mov edx, dword [esi - 4]
add ecx, 0x23
sub esi, edx
lea eax, [esi - 4]
cmp eax, 0x1f
ja 0x4f3bdf
mov esi, edx
push ecx
push esi
call fcn.004b9160
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0051bb5f
call fcn.0041fa60
int3
Function at 0x4f9960
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x5cc9b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x48], eax
lea ecx, [edi + 0x18]
call fcn.00507350
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0x40
push edx
push eax
mov ecx, edi
call fcn.004fbde0
test al, al
jne 0x4f99fe
push str.could_not_read_dos_header_from
push 1
push 0x154
push str..._.._.._snapshot_win_pe_image_reader.cc
push str.bool___thiscall_crashpad::PEImageReader::ReadNtHeaders_struct__IMAGE_NT_HEADERS64__struct__IMAGE_NT_HEADERS64__unsigned___int64___const
lea ecx, [ebp - 0xf8]
call fcn.0050c270
push eax
call fcn.00439550
mov ecx, dword [edi + 0x10]
add esp, 8
cmp dword [edi + 0x14], 0x10
jb 0x4f99d3
mov edi, dword [edi]
push ecx
push edi
push eax
call fcn.0049d120
add esp, 0xc
lea ecx, [ebp - 0xf8]
call fcn.0050c3e0
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00514f0c
mov esp, ebp
pop ebp
ret 8
mov eax, 0x5a4d
cmp word [ebp - 0x44], ax
je 0x4f9a17
push str.invalid_e_magic_in_dos_header_of
push 1
push 0x15a
jmp 0x4f99aa
lea ecx, [edi + 0x18]
call fcn.00507350
mov ecx, eax
mov esi, edx
mov eax, dword [ebp - 8]
cdq
add eax, ecx
mov ecx, edi
mov dword [ebp - 0x4c], eax
adc edx, esi
mov esi, dword [ebp - 0x48]
push esi
push 0
push 0x108
push edx
push eax
mov dword [ebp - 0x50], edx
call fcn.004fbde0
test al, al
jne 0x4f9a5a
push str.could_not_read_nt_headers_from
push 1
push 0x162
jmp 0x4f99aa
cmp dword [esi], 0x4550
je 0x4f9a98
push str.invalid_signature_in_nt_headers_of
push 1
push 0x168
push str..._.._.._snapshot_win_pe_image_reader.cc
push str.bool___thiscall_crashpad::PEImageReader::ReadNtHeaders_struct__IMAGE_NT_HEADERS64__struct__IMAGE_NT_HEADERS64__unsigned___int64___const
lea ecx, [ebp - 0xf8]
call fcn.0050c270
push eax
call fcn.00439550
push edi
push eax
call fcn.0049cf90
add esp, 0x10
jmp 0x4f99de
test ebx, ebx
je 0x4f9aa7
mov eax, dword [ebp - 0x4c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x50]
mov dword [ebx + 4], eax
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00514f0c
mov esp, ebp
pop ebp
ret 8
Function at 0x4f9ac0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x5cc9b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x48], eax
lea ecx, [edi + 0x18]
call fcn.00507350
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0x40
push edx
push eax
mov ecx, edi
call fcn.004fbde0
test al, al
jne 0x4f9b5e
push str.could_not_read_dos_header_from
push 1
push 0x154
push str..._.._.._snapshot_win_pe_image_reader.cc
push str.bool___thiscall_crashpad::PEImageReader::ReadNtHeaders_struct__IMAGE_NT_HEADERS__struct__IMAGE_NT_HEADERS__unsigned___int64___const
lea ecx, [ebp - 0xf8]
call fcn.0050c270
push eax
call fcn.00439550
mov ecx, dword [edi + 0x10]
add esp, 8
cmp dword [edi + 0x14], 0x10
jb 0x4f9b33
mov edi, dword [edi]
push ecx
push edi
push eax
call fcn.0049d120
add esp, 0xc
lea ecx, [ebp - 0xf8]
call fcn.0050c3e0
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00514f0c
mov esp, ebp
pop ebp
ret 8
mov eax, 0x5a4d
cmp word [ebp - 0x44], ax
je 0x4f9b77
push str.invalid_e_magic_in_dos_header_of
push 1
push 0x15a
jmp 0x4f9b0a
lea ecx, [edi + 0x18]
call fcn.00507350
mov ecx, eax
mov esi, edx
mov eax, dword [ebp - 8]
cdq
add eax, ecx
mov ecx, edi
mov dword [ebp - 0x4c], eax
adc edx, esi
mov esi, dword [ebp - 0x48]
push esi
push 0
push 0xf8
push edx
push eax
mov dword [ebp - 0x50], edx
call fcn.004fbde0
test al, al
jne 0x4f9bba
push str.could_not_read_nt_headers_from
push 1
push 0x162
jmp 0x4f9b0a
cmp dword [esi], 0x4550
je 0x4f9bf8
push str.invalid_signature_in_nt_headers_of
push 1
push 0x168
push str..._.._.._snapshot_win_pe_image_reader.cc
push str.bool___thiscall_crashpad::PEImageReader::ReadNtHeaders_struct__IMAGE_NT_HEADERS__struct__IMAGE_NT_HEADERS__unsigned___int64___const
lea ecx, [ebp - 0xf8]
call fcn.0050c270
push eax
call fcn.00439550
push edi
push eax
call fcn.0049cf90
add esp, 0x10
jmp 0x4f9b3e
test ebx, ebx
je 0x4f9c07
mov eax, dword [ebp - 0x4c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x50]
mov dword [ebx + 4], eax
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00514f0c
mov esp, ebp
pop ebp
ret 8
Function at 0x4fdb10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov cx, ax
shr cx, 8
cmp al, 6
jb 0x4fdba0
jne 0x4fdb32
cmp cx, 1
jbe 0x4fdba0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x7c2908]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x7c27e0]
cmp eax, dword [ecx + 0x34]
jg 0x4fdbaf
push 0x10000000
push 0
push dword [ebp + 8]
call dword [0x7c27dc]
test eax, eax
jne 0x4fdba9
push 0x5a0654
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x21
push str..._.._.._util_win_critical_section_with_debug_info.cc
push str.bool___cdecl_crashpad::_anonymous_namespace::CrashpadInitializeCriticalSectionEx_struct__RTL_CRITICAL_SECTION__unsigned_long_unsigned_long_
lea ecx, [ebp - 0xb0]
call fcn.0050c390
push eax
call fcn.00439550
add esp, 8
lea ecx, [ebp - 0xb0]
call fcn.0050c5b0
xor al, al
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, 1
mov esp, ebp
pop ebp
ret
push 0x7c27e0
call fcn.00513f0a
add esp, 4
cmp dword [0x7c27e0], 0xffffffff
jne 0x4fdb4e
push 1
push str.::InitializeCriticalSectionEx
push 0x560ad8
call fcn.004fdbf0
push 0x7c27e0
mov dword [0x7c27dc], eax
call fcn.00513ec0
add esp, 0x10
jmp 0x4fdb4e

Function at 0x4fe0d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x18]
mov ecx, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
cmp eax, dword [ecx + 0x24]
sete al
ret
Function at 0x500ed0
Capabilities:
Check os version
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov bl, byte [ebp + 0xc]
push esi
xor esi, esi
test bl, bl
je 0x500f08
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x500f08
push esi
mov dword [ebp - 0xc], 0xc
call fcn.00500f50
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
lea esi, [ebp - 0xc]
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 8
jb 0x500f13
mov ecx, dword [ecx]
push esi
push 0
push 0x200
push 0x200
push 2
movzx eax, bl
shl eax, 0x13
push 6
or eax, 3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x501180
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x50119f
mov eax, dword [edi]
push 0
push 0x110000
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x501231
call ebx
cmp eax, 0xe7
jne 0x501220
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x5011d2
mov eax, dword [edi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x501195
push str.WaitNamedPipe
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x6c
push str..._.._.._util_win_registration_protocol_win.cc
push str.bool___cdecl_crashpad::SendToCrashHandlerServer_const_class_std::basic_string_wchar_t_struct_std::char_traits_wchar_t__class_std::allocator_wchar_t_____const_struct_crashpad::ClientToServerMessage__union_crashpad::ServerToClientMessage__
lea ecx, [ebp - 0xb4]
call fcn.0050c390
push eax
call fcn.00439550
add esp, 8
lea ecx, [ebp - 0xb4]
call fcn.0050c5b0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5a1e7c
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x67
jmp 0x5011ee
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x501288
push 0x5a1f8c
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x75
push str..._.._.._util_win_registration_protocol_win.cc
push str.bool___cdecl_crashpad::SendToCrashHandlerServer_const_class_std::basic_string_wchar_t_struct_std::char_traits_wchar_t__class_std::allocator_wchar_t_____const_struct_crashpad::ClientToServerMessage__union_crashpad::ServerToClientMessage__
lea ecx, [ebp - 0xb4]
call fcn.0050c390
push eax
call fcn.00439550
add esp, 8
lea ecx, [ebp - 0xb4]
call fcn.0050c5b0
jmp 0x50131a
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0xc
push dword [ebp + 0x10]
push 0x24
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
jne 0x5012be
push 0x5a1fa4
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x83
jmp 0x50125a
cmp dword [ebp + 8], 0xc
je 0x50132a
push str.TransactNamedPipe:_expected
push 2
push 0x87
push str..._.._.._util_win_registration_protocol_win.cc
push str.bool___cdecl_crashpad::SendToCrashHandlerServer_const_class_std::basic_string_wchar_t_struct_std::char_traits_wchar_t__class_std::allocator_wchar_t_____const_struct_crashpad::ClientToServerMessage__union_crashpad::ServerToClientMessage__
lea ecx, [ebp - 0xac]
call fcn.0050c270
push eax
call fcn.00439550
add esp, 8
mov ecx, eax
push str.__observed
push 0xc
call fcn.004c51d0
push eax
call fcn.00439550
add esp, 8
mov ecx, eax
push dword [ebp + 8]
call fcn.004f1150
lea ecx, [ebp - 0xac]
call fcn.0050c3e0
xor bl, bl
cmp esi, 0xffffffff
jne 0x50132c
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, 1
push esi
call fcn.004fd1d0
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x503f10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x503f6e
push 0x5a31b8
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x10a
push str..._.._.._util_file_file_io_win.cc
push str.__int64___cdecl_crashpad::LoggingFileSizeByHandle_void__
lea ecx, [ebp - 0xb8]
call fcn.0050c390
push eax
call fcn.00439550
add esp, 8
lea ecx, [ebp - 0xb8]
call fcn.0050c5b0
or eax, 0xffffffff
or edx, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x5043f0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push 0
xorps xmm0, xmm0
lea eax, [ebp - 0x10]
push eax
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x504438
push 0x5a3130
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xf1
push str..._.._.._util_file_file_io_win.cc
push str.__int64___cdecl_crashpad::LoggingSeekFile_void____int64_int_
jmp 0x504469
mov eax, dword [ebp - 0x10]
or eax, dword [ebp - 0xc]
jne 0x504488
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x50448e
push 0x5a3144
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xfb
push str..._.._.._util_file_file_io_win.cc
push str.bool___cdecl_crashpad::LoggingTruncateFile_void__
lea ecx, [ebp - 0xc0]
call fcn.0050c390
push eax
call fcn.00439550
add esp, 8
lea ecx, [ebp - 0xc0]
call fcn.0050c5b0
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x504520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
lea eax, [ebp - 4]
mov ecx, 0x7fffffff
push 0
push eax
mov eax, dword [ebp + 0x10]
cmp eax, ecx
cmova eax, ecx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x504554
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], 0xffffffff
mov dword [ebp + 0x10], 0xffffffff
jne 0x50459d
push str.bytes_written___static_cast_DWORD___1_
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push eax
call fcn.004f0080
add esp, 0xc
test eax, eax
je 0x50459d
push eax
push 0x65
push str..._.._.._util_file_file_io_win.cc
push str.long___cdecl_crashpad::internal::NativeWriteFile_void__const_void__unsigned_int_
lea ecx, [ebp - 0xac]
call fcn.0050c2c0
lea ecx, [ebp - 0xac]
call fcn.0050c3e0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret