joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46cc90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
js 0x46cc9d
jmp 0x490020
xor eax, eax
ret
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x18]
xor ecx, ecx
test edx, edx
je 0x4900ff
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x4900ff
mov edi, eax
mov esi, eax
and edi, 3
shr esi, 2
je 0x490085
mov ecx, eax
mov ebx, edx
and ecx, 0xfffffffc
mov dword [esp], ecx
nop word cs:[eax + eax]
nop
movzx ebp, word [ebx]
add ebp, eax
movzx eax, word [ebx + 2]
add ebx, 4
mov ecx, ebp
shl ecx, 0x10
xor ecx, ebp
shl eax, 0xb
xor ecx, eax
mov eax, ecx
shr eax, 0xb
add eax, ecx
dec esi
jg 0x490060
add edx, dword [esp]
cmp edi, 1
je 0x4900ae
cmp edi, 2
je 0x4900c0
cmp edi, 3
jne 0x4900d3
movzx ecx, word [edx]
add eax, ecx
movsx ecx, byte [edx + 2]
shl ecx, 0x12
xor ecx, eax
shl eax, 0x10
xor ecx, eax
mov eax, ecx
shr eax, 0xb
jmp 0x4900d1
movsx ecx, byte [edx]
add eax, ecx
mov ecx, eax
shl ecx, 0xa
xor ecx, eax
mov eax, ecx
shr eax, 1
jmp 0x4900d1
movzx ecx, word [edx]
add eax, ecx
mov ecx, eax
shl ecx, 0xb
xor ecx, eax
mov eax, ecx
shr eax, 0x11
add eax, ecx
lea ecx, [eax*8]
xor ecx, eax
mov eax, ecx
shr eax, 5
add eax, ecx
mov ecx, eax
shl ecx, 4
xor ecx, eax
mov eax, ecx
shr eax, 0x11
add eax, ecx
mov edx, eax
shl edx, 0x19
xor edx, eax
mov ecx, edx
shr ecx, 6
add ecx, edx
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x476b16
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
mov esi, dword [eax]
push esi
call fcn.0051c1f0
add esp, 4
test eax, eax
je 0x476b48
mov ecx, 0x811c9dc5
movzx edx, byte [esi]
inc esi
xor edx, ecx
imul ecx, edx, 0x1000193
dec eax
jne 0x476b31
and ecx, 0x7fffffff
jmp 0x476b4d
mov ecx, 0x11c9dc5
push 0x1f31d
push ecx
call fcn.0051ae6b
add esp, 8
imul ecx, edx, 0x41a7
imul edx, eax, 0xfffff4ec
lea eax, [ecx + edx + 0x7fffffff]
add ecx, edx
cmovns eax, ecx
pop esi
pop ebp
ret 4

Function at 0x47ce8d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe0
mov eax, dword [0x582e50]
mov esi, ecx
xor eax, ebp
mov dword [esp + 0xd8], eax
mov eax, ecx
cmp dword [ecx + 0x14], 7
jbe 0x47ceb6
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x47cf79
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x47cef4
mov ecx, esi
call fcn.0047cf91
mov ecx, dword [esp + 0xd8]
mov ebx, eax
xor ecx, ebp
call fcn.004ed5a1
mov eax, ebx
jmp 0x47cf89
push 2
call fcn.00419f10
add esp, 4
test al, al
je 0x47cf77
call fcn.0041abf0
mov ecx, esp
push eax
push 2
push 0x239
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.0041afa0
lea eax, [esp + 0x10]
push str.CreateDirectory
push eax
call fcn.004014ea
add esp, 8
mov ebx, eax
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 7
jbe 0x47cf3a
mov esi, dword [esi]
lea edi, [esp + 0xc0]
push eax
push esi
push edi
call fcn.00427330
add esp, 0xc
mov eax, dword [edi + 0x10]
cmp dword [edi + 0x14], 0xf
mov ecx, edi
jbe 0x47cf5e
mov ecx, dword [esp + 0xc0]
push eax
push ecx
push ebx
call fcn.00402d83
add esp, 0xc
mov ecx, edi
call fcn.00401ade
mov ecx, esp
call fcn.0041b0c0
xor ebx, ebx
mov ecx, dword [esp + 0xd8]
xor ecx, ebp
call fcn.004ed5a1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47cf91
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe0
mov eax, dword [0x582e50]
mov esi, ecx
xor eax, ebp
mov dword [esp + 0xd8], eax
mov eax, ecx
cmp dword [ecx + 0x14], 7
jbe 0x47cfba
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x47d068
mov bl, 1
test al, 0x10
jne 0x47d0ed
push 2
call fcn.00419f10
add esp, 4
test al, al
je 0x47d0eb
mov ecx, esp
push 2
push 0x227
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.00419fa0
lea eax, [esp + 8]
push str.GetFileAttributes
push eax
call fcn.004014ea
add esp, 8
mov ebx, eax
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 7
jbe 0x47d018
mov esi, dword [esi]
lea edi, [esp + 0xc0]
push eax
push esi
push edi
call fcn.00427330
add esp, 0xc
mov eax, dword [edi + 0x10]
cmp dword [edi + 0x14], 0xf
mov ecx, edi
jbe 0x47d03c
mov ecx, dword [esp + 0xc0]
push eax
push ecx
push ebx
call fcn.00402d83
add esp, 0xc
push str.:_not_a_directory
push eax
call fcn.004014ea
add esp, 8
mov ecx, edi
call fcn.00401ade
mov ecx, esp
call fcn.00419550
jmp 0x47d0eb
push 2
call fcn.00419f10
add esp, 4
test al, al
je 0x47d0eb
call fcn.0041abf0
mov ecx, esp
push eax
push 2
push 0x223
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.0041afa0
lea eax, [esp + 0x10]
push str.GetFileAttributes
push eax
call fcn.004014ea
add esp, 8
mov ebx, eax
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 7
jbe 0x47d0ae
mov esi, dword [esi]
lea edi, [esp + 0xc0]
push eax
push esi
push edi
call fcn.00427330
add esp, 0xc
mov eax, dword [edi + 0x10]
cmp dword [edi + 0x14], 0xf
mov ecx, edi
jbe 0x47d0d2
mov ecx, dword [esp + 0xc0]
push eax
push ecx
push ebx
call fcn.00402d83
add esp, 0xc
mov ecx, edi
call fcn.00401ade
mov ecx, esp
call fcn.0041b0c0
xor ebx, ebx
mov ecx, dword [esp + 0xd8]
xor ecx, ebp
call fcn.004ed5a1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47f23a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [ecx + 0x60]
cmp eax, edx
jne 0x47f24c
cmp dword [ecx + 0x24], 7
jbe 0x47f259
mov ecx, dword [ecx + 0x10]
jmp fcn.0047f25c
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [ecx + ecx*2 + 1]
ret
add ecx, 0x10
Function at 0x487a9e
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [0x582e50]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0x2c], 0
je 0x487bad
mov esi, ecx
lea edx, [ecx + 0x24]
lea eax, [ebp - 0x58]
lea edi, [ebp - 0x5c]
mov ecx, edi
push eax
push 2
call fcn.00487bcd
add esp, 8
mov edx, dword [edi]
test edx, edx
je 0x487bb4
cmp dword [edx], 0
mov dword [ebp - 0x68], esi
je 0x487ba0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x60], edx
lea eax, [eax + 0x18]
mov dword [ebp - 0x6c], eax
xor eax, eax
test dword [edx + eax*8 + 8], 0xc0000020
mov dword [ebp - 0x64], eax
jne 0x487b94
cmp dword [ebp + 8], 0
je 0x487b54
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [eax + 4], ecx
je 0x487b54
xor ebx, ebx
xor edi, edi
mov eax, dword [ebp - 0x64]
add ecx, ebx
mov esi, dword [edx + eax*8 + 4]
call fcn.004883a0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov edx, dword [ebp - 0x60]
test eax, eax
jne 0x487b94
mov eax, dword [ebp + 8]
inc edi
add ebx, 0x44
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 2
imul eax, eax, 0xf0f0f0f1
cmp edi, eax
jb 0x487b1c
mov eax, dword [ebp - 0x64]
lea edi, [ebp - 0x54]
mov ecx, edi
push dword [edx + eax*8 + 4]
call fcn.004880e0
mov esi, dword [ebp - 0x68]
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x20]
cmp edx, eax
je 0x487b87
mov ebx, 0x44
push ebx
push edi
push eax
call fcn.0050b3c0
add esp, 0xc
add dword [esi + 0x1c], ebx
jmp 0x487b91
mov ecx, dword [ebp - 0x6c]
push edi
push edx
call fcn.00466a4a
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x64]
inc eax
cmp eax, dword [edx]
jb 0x487af7
push edx
call fcn.004ed59c
add esp, 4
xor esi, esi
jmp 0x487bb7
mov esi, 0x3f0
jmp 0x487bb7
mov esi, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed5a1
mov eax, esi
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x48b5e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
call fcn.0046e640
test al, al
je 0x48b604
push 0x32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea edi, [esi + 0x20]
mov ecx, edi
push 0
call fcn.0048b652
lea ecx, [esi + 0x30]
call fcn.004669dc
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x48b628
push eax
call fcn.00431330
add esp, 4
mov ecx, edi
call fcn.0048b676
lea ecx, [esi + 0x18]
call fcn.004024e0
lea ecx, [esi + 0x14]
call fcn.004024e0
lea ecx, [esi + 0x10]
call fcn.004024e0
mov ecx, esi
pop esi
pop edi
pop ebp
jmp fcn.0046e550
Function at 0x48ba3e
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x582e50]
mov edi, ecx
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
lea ebx, [edi + 0x18]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [edx + ecx]
xor ecx, ecx
push ecx
push eax
push ecx
push 0x8000004
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, ebx
push eax
call fcn.00402488
mov esi, dword [edi + 0x18]
xor ecx, ecx
inc ecx
lea eax, [esi + 1]
cmp eax, ecx
ja 0x48baad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov ebx, 0x19
mov dword [ecx], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed5a1
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov dword [ebp - 0x20], edi
mov edi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
lea ecx, [ebp - 0x14]
push edx
push edx
push 7
push ecx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x48bbd2
xor eax, eax
push eax
push eax
push eax
push 6
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, dword [ebp + 0x18]
test eax, eax
je 0x48bbe5
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
test ebx, ebx
je 0x48bb30
test ecx, ecx
je 0x48bb30
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
lea edi, [edx + eax]
push ecx
push ebx
push edi
call fcn.0050b3c0
add esp, 0xc
mov eax, 0xffffff00
mov ecx, dword [edi + eax + 0x100]
test ecx, ecx
je 0x48bb2b
sub ecx, ebx
mov dword [edi + eax + 0x100], ecx
add eax, 4
jne 0x48bb17
mov eax, dword [ebp - 0x14]
mov dword [0x588f6c], eax
sub esp, 0xc
mov edi, dword [ebp - 0x20]
mov dword [esp + 8], 4
mov dword [esp + 4], 0x588f6c
mov ecx, edi
call fcn.0048b9e0
test eax, eax
mov dword [0x588f6c], 0
jne 0x48bbc3
mov eax, dword [ebp + 0x10]
mov dword [0x5899bc], eax
sub esp, 0xc
mov ecx, edi
mov dword [esp + 8], 4
mov dword [esp + 4], 0x5899bc
call fcn.0048b9e0
test eax, eax
mov dword [0x5899bc], 0
jne 0x48bbc3
mov eax, dword [ebp + 0x14]
mov dword [0x5899c0], eax
sub esp, 0xc
mov ecx, edi
mov dword [esp + 8], 4
mov dword [esp + 4], 0x5899c0
call fcn.0048b9e0
test eax, eax
mov dword [0x5899c0], 0
je 0x48bbf7
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x48ba97
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov ebx, 0x1a
jmp 0x48ba95
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov ebx, 0x1b
jmp 0x48ba97
mov esi, dword [ebp + 8]
lea eax, [edi + 0x20]
mov dword [ebp - 0x1c], eax
push 0x1c
call fcn.004ed52c
add esp, 4
mov ebx, eax
mov ecx, eax
push esi
push dword [edi + 0x24]
push dword [edi + 8]
push dword [edi]
call fcn.004bafec
mov ecx, dword [ebp - 0x1c]
push ebx
call fcn.0048b652
mov ecx, dword [edi + 0x20]
push 0x400
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call fcn.004bb0cc
mov ebx, 4
test al, al
je 0x48ba97
mov ecx, edi
call fcn.0046e7d0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x48ba97
Function at 0x49014c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + 0x3c]
movzx edx, word [ecx + eax + 6]
test edx, edx
je 0x490195
add eax, ecx
mov esi, dword [esp + 0x14]
xor ebx, ebx
movzx edi, word [eax + 0x14]
lea edi, [eax + edi + 0x18]
xor eax, eax
test edi, edi
je 0x49019b
mov ebp, dword [edi + 0xc]
test ebp, ebp
je 0x490184
add ebp, ecx
cmp ebp, esi
jbe 0x490186
jmp 0x49018d
xor ebp, ebp
add ebp, dword [edi + 8]
cmp ebp, esi
ja 0x490199
inc ebx
add edi, 0x28
cmp ebx, edx
jb 0x490171
xor eax, eax
jmp 0x49019b
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x490248
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x49032a
mov eax, dword [ecx + 4]
mov ebx, ecx
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x49032a
cmp word [eax + edx + 0x14], 0x68
jb 0x49032a
mov esi, dword [ebx]
mov ecx, ebx
push dword [eax + edx + 0x78]
call dword [esi + 4]
test eax, eax
je 0x49032a
mov esi, eax
mov eax, dword [ebp + 8]
cmp eax, 0xffff
ja 0x4902a2
mov word [edi], ax
jmp 0x490357
mov eax, dword [ebx]
mov ecx, ebx
push dword [esi + 0x20]
call dword [eax + 4]
mov edx, eax
mov eax, dword [esi + 0x18]
lea ecx, [eax*4]
test ecx, ecx
je 0x49032a
mov dword [ebp - 0x18], esi
lea esi, [edx + eax*4]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov ebx, edx
mov dword [ebp - 0x14], edx
inc eax
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ecx, dword [ebp - 0x10]
sub edi, ebx
mov eax, edi
shr edi, 0x1f
sar eax, 2
add edi, eax
mov eax, dword [ecx]
and edi, 0x7ffffffe
push dword [ebx + edi*2]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x490308
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x49030a
mov cl, byte [edx]
inc eax
inc edx
test cl, cl
jne 0x4902fc
xor ecx, ecx
movzx eax, byte [eax]
movzx ecx, cl
lea edi, [ebx + edi*2]
sub ecx, eax
je 0x490336
test ecx, ecx
lea eax, [edi + 4]
cmovle esi, edi
cmovg ebx, eax
xor eax, eax
cmp ebx, esi
jne 0x4902d1
jmp 0x49032c
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
mov eax, dword [ecx]
push dword [esi + 0x24]
call dword [eax + 4]
sub edi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
sar edi, 1
movzx eax, word [eax + edi]
add ax, word [esi + 0x10]
mov word [ecx], ax
mov al, 1
jmp 0x49032c
Function at 0x495201
Capabilities:
Check os version
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x582e50]
mov bl, byte [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
xor eax, ebp
test bl, bl
mov dword [ebp - 0x10], eax
je 0x495247
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
cmp eax, 6
jb 0x495247
lea edi, [ebp - 0x1c]
mov dword [edi], 0xc
mov dword [edi + 4], 0x542be0
mov dword [edi + 8], 1
movzx eax, bl
shl eax, 0x13
or eax, 3
cmp dword [esi + 0x14], 7
jbe 0x495258
mov esi, dword [esi]
mov ecx, 0x200
push edi
push 0
push ecx
push ecx
push 2
push 6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
xor ecx, ebp
call fcn.004ed5a1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x495284
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov eax, dword [0x582e50]
mov esi, dword [ebp + 8]
xor eax, ebp
mov dword [esp + 0xc4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x495334
and eax, 0xfeff
cmp eax, 6
je 0x495334
mov eax, dword [0x589b1c]
mov ecx, dword [0x5875cc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x18]
jg 0x495354
push 0x10000000
push 0
push esi
call dword [0x589b18]
mov bl, 1
test eax, eax
jne 0x49533d
push 2
call fcn.00419f10
add esp, 4
test al, al
je 0x495330
call fcn.0041abf0
mov esi, esp
mov ecx, esi
push eax
push 2
push 0x21
push str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
call fcn.0041afa0
lea eax, [esp + 0x10]
push str.InitializeCriticalSectionEx
push eax
call fcn.004014ea
add esp, 8
mov ecx, esi
call fcn.0041b0c0
xor ebx, ebx
jmp 0x49533d
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov bl, 1
mov ecx, dword [esp + 0xc4]
xor ecx, ebp
call fcn.004ed5a1
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
push 0x589b1c
call fcn.004ed5e7
add esp, 4
mov eax, dword [0x589b1c]
cmp eax, 0xffffffff
jne 0x4952dd
push 1
push str.::InitializeCriticalSectionEx
push 0x532d60
call fcn.00495468
add esp, 0xc
mov dword [0x589b18], eax
push 0x589b1c
call fcn.004ed639
add esp, 4
jmp 0x4952dd
Function at 0x4984ac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov esi, dword [0x582e50]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, 0x7fffffff
xor esi, ebp
cmp edx, edi
mov dword [esp + 0xc4], esi
lea esi, [esp + 4]
cmovb edi, edx
push 0
push esi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x498534
xor eax, eax
dec eax
cmp dword [esp + 4], eax
mov dword [esp + 8], eax
jne 0x49852e
lea eax, [esp + 8]
push str.bytes_written___static_cast_DWORD___1_
push eax
push esi
call fcn.0041b450
add esp, 0xc
test eax, eax
je 0x49852e
lea esi, [esp + 8]
mov ecx, esi
push eax
push 0x64
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
call fcn.0041a440
mov ecx, esi
call fcn.00419550
mov esi, dword [esp + 4]
jmp 0x498537
xor esi, esi
dec esi
mov ecx, dword [esp + 0xc4]
xor ecx, ebp
call fcn.004ed5a1
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret

Function at 0x49854e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov ecx, dword [0x582e50]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, 0x7fffffff
xor ecx, ebp
cmp eax, edi
cmovb edi, eax
lea eax, [esp + 4]
mov dword [esp + 0xc0], ecx
push 0
jmp 0x4985de
mov ebx, dword [esp + 4]
xor eax, eax
dec eax
mov dword [esp + 8], eax
cmp ebx, eax
jne 0x4985c8
push str.bytes_read___static_cast_DWORD___1_
lea ebx, [esp + 0xc]
push ebx
lea eax, [esp + 0xc]
push eax
call fcn.0041b450
add esp, 0xc
test eax, eax
je 0x4985c4
mov ecx, ebx
push eax
push 0x7d
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
call fcn.0041a440
mov ecx, ebx
call fcn.00419550
mov ebx, dword [esp + 4]
test ebx, ebx
jne 0x498604
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x498600
push 0
lea eax, [esp + 8]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x498584
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x498604
mov ebx, dword [esp + 4]
mov ecx, dword [esp + 0xc0]
xor ecx, ebp
call fcn.004ed5a1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x498b3c
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov eax, dword [0x582e50]
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, ebp
mov dword [esp + 0xc4], eax
push ebx
push ebx
push ebx
push esi
call fcn.00498a66
add esp, 0x10
or edx, eax
jne 0x498bbe
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
jne 0x498bbe
push 2
call fcn.00419f10
add esp, 4
test al, al
je 0x498bbc
call fcn.0041abf0
mov esi, esp
mov ecx, esi
push eax
push 2
push 0xf3
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
call fcn.0041afa0
lea eax, [esp + 0x10]
push 0x5436b6
push eax
call fcn.004014ea
add esp, 8
mov ecx, esi
call fcn.0041b0c0
xor ebx, ebx
mov ecx, dword [esp + 0xc4]
xor ecx, ebp
call fcn.004ed5a1
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret

Function at 0x4a0b28
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov eax, dword [0x582e50]
mov esi, ecx
xor eax, ebp
mov dword [esp + 0xc0], eax
xor eax, eax
push eax
push eax
push ecx
push 0x4a0bc0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 4], eax
jne 0x4a0b9d
call fcn.0041abf0
mov esi, esp
mov ecx, esi
push eax
push 3
push 0x19
push str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
call fcn.0041afa0
lea eax, [esp + 0x10]
push str.Check_failed:_platform_thread_.
push eax
call fcn.004014ea
add esp, 8
push 0x540072
push eax
call fcn.004014ea
add esp, 8
mov ecx, esi
call fcn.0041b0c0
mov ecx, dword [esp + 0xc0]
xor ecx, ebp
call fcn.004ed5a1
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x4a18c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov ecx, dword [0x582e50]
mov eax, dword [ebp + 0xc]
xor ecx, ebp
cmp eax, 3
mov dword [ebp - 0xc], ecx
jne 0x4a1954
push 0x4a1970
push 0x589dec
call fcn.004a1870
add esp, 8
cmp dword [0x589df0], 0
jne 0x4a1954
push dword [0x589df4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a1954
mov esi, eax
mov edi, 0x589df8
push edi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [0x589e04]
movsd xmm0, qword [0x589dfc]
mov dword [ebp - 0x10], eax
movsd qword [ebp - 0x18], xmm0
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov edi, 0xfffffff4
mov eax, dword [ebp + edi - 0xc]
test eax, eax
je 0x4a1946
push dword [esi + edi + 0xc]
call eax
add esp, 4
add edi, 4
jne 0x4a1935
push esi
call fcn.004a1839
add esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004ed5a1
add esp, 0x10
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x4b816e
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [0x582e50]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x2c]
mov esi, 5
xor ecx, ebp
cmp eax, 3
mov dword [ebp - 0x10], ecx
mov dword [edx], 0xffffffff
jne 0x4b8206
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x28]
mov edx, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
cmp dword [edi + 0x14], 7
jbe 0x4b81b2
mov edi, dword [edi]
mov ebx, dword [ebx]
push 0
push esi
push edx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
je 0x4b81f3
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
lea ecx, [ebp - 0x14]
push 3
push edi
push edi
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
lea eax, [ebp - 0x14]
sbb edi, edi
or edi, dword [eax]
jmp 0x4b81f6
xor edi, edi
dec edi
mov eax, dword [ebp + 0x2c]
mov dword [eax], edi
xor eax, eax
cmp edi, 0xffffffff
sete al
lea esi, [eax + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed5a1
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret