joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bba60
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push 0x800
push 0
push 0x5947cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x4bbadc
push str.IsWow64Process2
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4bbadc
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x4bbad8
movzx ecx, word [ebp - 4]
cmp ecx, 0x14c
je 0x4bbb1b
cmp ecx, 0x8664
je 0x4bbb14
xor edx, edx
mov eax, 3
cmp ecx, 0xaa64
cmovne eax, edx
jmp 0x4bbb20
xor eax, eax
jmp 0x4bbb20
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x2c]
push eax
movups xmmword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [ebp - 0x2c]
test ecx, ecx
je 0x4bbb1b
cmp ecx, 9
je 0x4bbb14
xor edx, edx
mov eax, 3
cmp ecx, 0xc
cmovne eax, edx
jmp 0x4bbb20
mov eax, 2
jmp 0x4bbb20
mov eax, 1
mov ecx, dword [ebp + 8]
pop esi
cmp eax, ecx
jne 0x4bbb2e
mov al, 1
mov esp, ebp
pop ebp
ret
cmp ecx, 2
jne 0x4bbb79
cmp eax, 3
jne 0x4bbb79
push 0x800
push 0
push 0x5947cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x4bbb79
push str.IsWow64GuestMachineSupported
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4bbb79
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push ecx
push 0x8664
call eax
test eax, eax
jne 0x4bbb79
cmp dword [ebp + 8], eax
jne 0x4bbb28
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4c6ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
test ebx, ebx
je 0x4c7047
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x24]
xor ecx, ecx
movzx edx, byte [eax + edi]
mov eax, edx
and edx, 0x3f
shr eax, 6
lea esi, [esi + eax*8]
xor eax, eax
bts eax, edx
cmp edx, 0x20
cmovae ecx, eax
xor eax, ecx
cmp edx, 0x40
cmovae ecx, eax
or dword [esi], eax
or dword [esi + 4], ecx
inc edi
cmp edi, ebx
jne 0x4c7010
mov ecx, dword [ebp - 4]
mov ebx, dword [ecx + 4]
mov eax, dword [ebp + 0x10]
cmp ebx, eax
cmovb eax, ebx
cmp eax, ebx
je 0x4c7097
mov ecx, dword [ecx]
mov dword [ebp + 0x10], ecx
nop dword [eax + eax]
movzx edi, byte [ecx + eax]
xor esi, esi
mov ecx, edi
xor edx, edx
and ecx, 0x3f
bts esi, ecx
cmp ecx, 0x20
cmovae edx, esi
xor esi, edx
cmp ecx, 0x40
cmovae edx, esi
shr edi, 6
and esi, dword [ebp + edi*8 - 0x24]
and edx, dword [ebp + edi*8 - 0x20]
or esi, edx
je 0x4c709a
inc eax
cmp eax, ebx
je 0x4c7097
mov ecx, dword [ebp + 0x10]
jmp 0x4c7060
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c70e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
push edi
mov edx, ecx
xor edi, edi
mov dword [ebp - 4], edx
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
test ebx, ebx
je 0x4c7139
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x24]
xor ecx, ecx
movzx edx, byte [eax + edi]
mov eax, edx
and edx, 0x3f
shr eax, 6
lea esi, [esi + eax*8]
xor eax, eax
bts eax, edx
cmp edx, 0x20
cmovae ecx, eax
xor eax, ecx
cmp edx, 0x40
cmovae ecx, eax
or dword [esi], eax
or dword [esi + 4], ecx
inc edi
cmp edi, ebx
jne 0x4c7102
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
cmp dword [edx + 4], eax
cmovb eax, dword [edx + 4]
dec eax
cmp eax, 0xffffffff
je 0x4c7183
mov ebx, dword [edx]
nop dword [eax + eax]
movzx edi, byte [ebx + eax]
xor esi, esi
mov ecx, edi
xor edx, edx
and ecx, 0x3f
bts esi, ecx
cmp ecx, 0x20
cmovae edx, esi
xor esi, edx
cmp ecx, 0x40
cmovae edx, esi
shr edi, 6
and esi, dword [ebp + edi*8 - 0x24]
and edx, dword [ebp + edi*8 - 0x20]
or esi, edx
je 0x4c7186
dec eax
cmp eax, 0xffffffff
jne 0x4c7150
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c9240
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
mov dword [ebp - 4], ecx
lea ecx, [eax + 8]
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, ecx
jb 0x4c9262
mov edi, dword [ecx]
xor edx, edx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x4c9281
nop dword [eax]
movzx ecx, byte [edx + edi]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, ebx
jb 0x4c9270
mov ebx, dword [ebp - 4]
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and edx, esi
mov esi, dword [ecx + edx*8]
cmp dword [ecx + edx*8 + 4], eax
jne 0x4c92ae
cmp esi, eax
jne 0x4c92a5
mov eax, dword [ebx + 4]
mov dword [ecx + edx*8], eax
mov dword [ecx + edx*8 + 4], eax
jmp 0x4c92b7
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x4c92b7
cmp esi, eax
jne 0x4c92ba
mov eax, dword [eax]
mov dword [ecx + edx*8], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
dec dword [ebx + 8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 8]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
call fcn.004168c0
push 0x38
push dword [ebp + 0xc]
call fcn.004b9160
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ca820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x54ea25
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x4ca84d
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x4ca872
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x4ca860
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00439940
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4ca892
mov eax, dword [ebp + 8]
mov dword [eax], ecx
xor cl, cl
jmp 0x4ca94f
cmp dword [ebx + 8], 0x71c71c7
je 0x4ca965
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.004b9130
add esp, 4
mov dword [ebp - 0x18], eax
add eax, 8
mov ecx, eax
mov dword [ebp + 0xc], eax
push edi
call fcn.004152a0
mov eax, dword [edi + 0x18]
mov edi, dword [ebp + 0xc]
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x557d40]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x557d40]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x4ca936
mov ecx, ebx
call fcn.004ca240
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00439940
mov ecx, dword [eax]
jmp 0x4ca939
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push esi
mov ecx, ebx
call fcn.0041f910
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov cl, 1
mov eax, dword [ebp + 8]
pop edi
mov byte [eax + 4], cl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00515695
int3
Function at 0x4cc6f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
xorps xmm0, xmm0
push 0xffffffffffffffff
push 0x5484fd
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 4]
push eax
mov dword [edi], vtable.std::exception.0
movq qword [eax], xmm0
lea eax, [esi + 4]
push eax
call fcn.00518213
add esp, 8
mov dword [edi], vtable.boost::system::system_error.0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [edi + 0x10], ecx
lea ecx, [edi + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.004152a0
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov dword [edi + 0x2c], vtable.boost::exception.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4cc950
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5487b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xorps xmm0, xmm0
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 4]
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [edi + 4]
push eax
call fcn.00518213
add esp, 8
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x14]
mov dword [esi + 0x10], ecx
lea ecx, [esi + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.004152a0
mov dword [esi], vtable.boost::lock_error.0
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [ebp - 4], 1
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x4cc9d8
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4cd290
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54eb95
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x5cc61c]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], 0
cmp eax, 0xffffffff
je 0x4cd2cc
push eax
call esi
test eax, eax
jne 0x4cd2e2
call fcn.004ce140
mov eax, dword [0x5cc61c]
cmp eax, 0xffffffff
jne 0x4cd2df
xor eax, eax
jmp 0x4cd2e2
push eax
call esi
mov edi, dword [ebp + 0x10]
add eax, 0x10
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
test edi, edi
je 0x4cd2fe
lea eax, [edi + 4]
lock inc dword [eax]
lock inc dword [eax]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x24], ebx
or ebx, 0xffffffff
mov byte [ebp - 4], 1
test edi, edi
je 0x4cd32f
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x4cd32f
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, ebx
lock xadd dword [edi + 8], eax
jne 0x4cd32f
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], esi
mov esi, edi
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
call fcn.004cc5f0
mov ecx, dword [eax + 8]
movq xmm0, qword [eax]
movq qword [ebp - 0x38], xmm0
cmp byte [ecx + 0xd], 0
jne 0x4cd37f
mov eax, dword [ebp + 8]
cmp eax, dword [ecx + 0x10]
jae 0x4cd3dd
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0x7ffffff
je 0x4cd443
mov esi, dword [eax]
mov dword [ebp - 0x1c], eax
push 0x20
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], 0
call fcn.004b9130
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x1c], ecx
mov ecx, dword [ebp - 0x10]
push eax
push dword [ebp - 0x34]
mov dword [eax + 0x18], edi
push dword [ebp - 0x38]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov word [eax + 0xc], 0
call fcn.004529f0
xor esi, esi
mov byte [ebp - 4], 6
test esi, esi
je 0x4cd405
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x4cd405
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x4cd405
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], 8
test esi, esi
je 0x4cd432
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x4cd432
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x4cd432
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00452cf0
int3
Function at 0x4ce6a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x54ec7d
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x5cc61c]
push ebx
cmp eax, 0xffffffff
jne 0x4ce6cd
xor ebx, ebx
mov dword [ebp - 0x14], ebx
jmp 0x4ce6d9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x4ce72a
push esi
push edi
nop dword [eax]
cmp dword [ebx + 0x14], 0
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
jne 0x4ce739
test esi, esi
jne 0x4ce740
push esi
call fcn.004ce830
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x4ce728
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4ce780
nop dword [eax]
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x4ce76d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x4ce740
mov edi, dword [ebx + 0x10]
lea eax, [ebx + 0x10]
mov dword [ebp - 0x18], eax
mov esi, dword [edi]
mov dword [ebp - 0x10], esi
cmp esi, edi
je 0x4ce6f0
mov ebx, eax
lea ecx, [ebp - 0x10]
call fcn.00449640
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x4ce7b4
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x4ce7b4
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
mov ecx, ebx
call fcn.004cd200
mov esi, dword [ebp - 0x10]
cmp esi, edi
jne 0x4ce798
mov ebx, dword [ebp - 0x14]
jmp 0x4ce6f0
Function at 0x4ce8d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ec9d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5cc61c]
or ebx, 0xffffffff
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], edi
cmp eax, ebx
je 0x4cea0d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp + 8], eax
test eax, eax
je 0x4cea0d
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [eax + 0x10]
call fcn.004cc5f0
mov esi, dword [ebp - 0x14]
cmp byte [esi + 0xd], 0
jne 0x4ce940
cmp edi, dword [esi + 0x10]
jb 0x4ce940
mov eax, dword [ebp + 8]
jmp 0x4ce946
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x10]
cmp esi, dword [eax + 0x10]
je 0x4cea0d
add esi, 0x14
je 0x4cea0d
cmp byte [ebp + 0x18], 0
je 0x4ce971
mov ecx, dword [esi]
test ecx, ecx
je 0x4ce971
mov edx, dword [esi + 8]
test edx, edx
je 0x4ce971
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4ce9ca
cmp dword [ebp + 0x14], ecx
jne 0x4ce9ca
mov eax, dword [0x5cc61c]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp + 8], edi
cmp eax, 0xffffffff
je 0x4ce997
push eax
call esi
test eax, eax
jne 0x4ce9bc
call fcn.004ce140
mov eax, dword [0x5cc61c]
cmp eax, 0xffffffff
jne 0x4ce9b9
xor eax, eax
lea ecx, [eax + 0x10]
lea eax, [ebp + 8]
push eax
call fcn.004cd660
jmp 0x4cea3a
push eax
call esi
lea ecx, [eax + 0x10]
lea eax, [ebp + 8]
push eax
call fcn.004cd660
jmp 0x4cea3a
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4ce9d5
lock inc dword [eax + 4]
mov edi, dword [esi + 4]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov byte [ebp - 4], 1
test edi, edi
je 0x4cea05
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x4cea05
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, ebx
lock xadd dword [edi + 8], eax
jne 0x4cea05
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov eax, dword [ebp + 0x14]
mov dword [esi + 8], eax
jmp 0x4cea3a
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
test ecx, ecx
jne 0x4cea1b
test eax, eax
je 0x4cea3a
push eax
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
test ecx, ecx
je 0x4cea31
lock inc dword [ecx + 4]
push edi
call fcn.004cd290
add esp, 0x10
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], 2
test esi, esi
je 0x4cea67
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x4cea67
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x4cea67
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cea80
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x18]
push eax
push 4
push edx
push 0x4ceae0
push 0
push 0
call fcn.00525a00
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x4ceaa9
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x4ceac7
cmp eax, 0xffffffff
je 0x4ceac7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x4d4d10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x5cc9b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4d4d31
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4d4d4f
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00514f0c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4d4def
sub esp, 8
mov eax, esi
cmp dword [esi + 0x14], 8
mov ecx, esp
jb 0x4d4d6f
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0050d0c0
add esp, 0xc
mov esi, eax
push str.CreateDirectory
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x266
push str..._.._.._client_crash_report_database_win.cc
push str.bool___cdecl_crashpad::_anonymous_namespace::CreateDirectoryIfNecessary_const_class_base::FilePath__
lea ecx, [ebp - 0xcc]
call fcn.0050c390
push eax
call fcn.00439550
mov ecx, dword [esi + 0x10]
add esp, 8
cmp dword [esi + 0x14], 0x10
jb 0x4d4dc0
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.0049d120
add esp, 0xc
lea ecx, [ebp - 0xcc]
call fcn.0050c5b0
lea ecx, [ebp - 0x1c]
call fcn.004166b0
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00514f0c
mov esp, ebp
pop ebp
ret
push esi
call fcn.004d4fc0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop esi
call fcn.00514f0c
mov esp, ebp
pop ebp
ret
Function at 0x4d4fc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x5cc9b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4d4fe1
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4d5080
sub esp, 8
mov eax, esi
cmp dword [esi + 0x14], 8
mov ecx, esp
jb 0x4d5000
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0050d0c0
add esp, 0xc
mov esi, eax
push str.GetFileAttributes
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x251
push str..._.._.._client_crash_report_database_win.cc
push str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea ecx, [ebp - 0xcc]
call fcn.0050c390
push eax
call fcn.00439550
mov ecx, dword [esi + 0x10]
add esp, 8
cmp dword [esi + 0x14], 0x10
jb 0x4d5051
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.0049d120
add esp, 0xc
lea ecx, [ebp - 0xcc]
call fcn.0050c5b0
lea ecx, [ebp - 0x1c]
call fcn.004166b0
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00514f0c
mov esp, ebp
pop ebp
ret
test al, 0x10
jne 0x4d511c
sub esp, 8
mov eax, esi
cmp dword [esi + 0x14], 8
mov ecx, esp
jb 0x4d5097
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0050d0c0
add esp, 0xc
lea ecx, [ebp - 0xc4]
mov esi, eax
push str.GetFileAttributes
push 2
push 0x255
push str..._.._.._client_crash_report_database_win.cc
push str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
call fcn.0050c270
push eax
call fcn.00439550
mov ecx, dword [esi + 0x10]
add esp, 8
cmp dword [esi + 0x14], 0x10
jb 0x4d50e2
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.0049d120
push str.:_not_a_directory
push eax
call fcn.00439550
add esp, 0x14
lea ecx, [ebp - 0xc4]
call fcn.0050c3e0
lea ecx, [ebp - 0x1c]
call fcn.004166b0
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00514f0c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00514f0c
mov esp, ebp
pop ebp
ret

Function at 0x4d5130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ecx + 0x3c]
push esi
mov esi, dword [ecx + 0x38]
cmp esi, ebx
je 0x4d518f
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x68], eax
jne 0x4d5187
cmp dword [esi + 0x24], 8
lea eax, [esi + 0x10]
jb 0x4d5156
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4d5184
test al, 0x10
jne 0x4d5184
mov eax, dword [edi + 4]
push esi
cmp eax, dword [edi + 8]
je 0x4d517c
mov ecx, eax
call fcn.004d3f80
add dword [edi + 4], 0x68
jmp 0x4d5184
push eax
mov ecx, edi
call fcn.004d3af0
mov eax, dword [ebp + 8]
add esi, 0x70
cmp esi, ebx
jne 0x4d5146
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8