joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486180
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x534008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x4861e3
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x4861e3
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4861be
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4861e3
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004b5f6c
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004b5f6c
add esp, 8
ret 4

Function at 0x4862e0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x48638e
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push 1
push 0
push 0
movlpd qword [esp + 0x28], xmm0
call fcn.00486200
test al, al
je 0x48638e
mov edi, dword [ebp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0
push edi
push dword [ebp + 8]
xorps xmm0, xmm0
mov ecx, esi
movlpd qword [esp + 0x20], xmm0
call fcn.00486200
test al, al
je 0x48638e
mov eax, dword [ebp + 8]
xor bl, bl
cmp dword [esp + 0x10], eax
jne 0x486364
cmp dword [esp + 0x14], edi
jne 0x486364
mov eax, dword [esi]
test eax, eax
jne 0x486351
xor bl, bl
jmp 0x486364
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x48634d
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne bl
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
push 0
push dword [esp + 0x24]
mov ecx, esi
movlpd qword [esp + 0x1c], xmm0
push dword [esp + 0x24]
call fcn.00486200
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x486c30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e501f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x534008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
lea esi, [edi + 0x94]
cmp esi, ebx
je 0x486c93
push esi
mov ecx, edi
call fcn.00488220
add esi, 0x94
add edi, 0x94
cmp esi, ebx
jne 0x486c73
mov edi, dword [ebp - 0x10]
mov ebx, dword [edi + 4]
jmp 0x486c95
mov edi, eax
lea esi, [ebx - 0x94]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.0040a900
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.0040a900
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.0040a900
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.0040a900
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.0040a900
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040a900
mov eax, dword [ebp - 0x14]
add dword [edi + 4], 0xffffff6c
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x487920
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e526f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x534008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.0040a900
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.0040a900
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.0040a900
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.0040a900
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.0040a900
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040a900
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48b8a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x534008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x48b922
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x48b922
test ecx, ecx
je 0x48b91e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x48b8e0
xor eax, eax
jmp 0x48b927
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x48b931
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b5f6c
add esp, 0xc
ret 0xc
Function at 0x48dfe0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x534008]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 1
mov esi, ecx
call fcn.004b5f7d
mov dword [esi], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov dword [esp + 4], 0x11c
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x48e03c
cmp dword [esp + 8], 6
mov ecx, dword [esi]
setae dl
mov byte [ecx], dl
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
call fcn.004b5f6c
add esp, 0x120
ret
Function at 0x490e20
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6528
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x534008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp esi, 0xffffffff
jne 0x490e58
xor al, al
jmp 0x490ed7
and esi, 0xffffb1af
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x490e68
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push eax
call ebx
test eax, eax
je 0x490e7a
mov al, 1
jmp 0x490ed7
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.00491590
test al, al
je 0x490ec4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
test eax, eax
je 0x490ec4
mov bl, 1
jmp 0x490ec6
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a900
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b5f6c
mov esp, ebp
pop ebp
ret

Function at 0x490f00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6528
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x534008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x490f36
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x490f9a
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00491590
test al, al
je 0x490f8b
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a900
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b5f6c
mov esp, ebp
pop ebp
ret
Function at 0x490fc0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6570
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x534008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x490ff7
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x49100b
mov al, 1
jmp 0x491192
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x491015
mov edx, dword [esi]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x491040
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040a960
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00490f00
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a900
cmp ebx, 0xffffffff
jne 0x491088
xor al, al
jmp 0x491192
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x491092
mov edx, dword [esi]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4910c0
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040a960
mov dword [ebp - 4], 1
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.00490e20
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a900
test bl, bl
je 0x491081
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x491109
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x491004
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00491590
test al, al
je 0x491153
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x491153
mov bl, 1
jmp 0x491181
cmp dword [esi + 0x14], 8
jb 0x49115b
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x44]
call fcn.0040a040
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
call fcn.00490e20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.0040a900
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a900
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b5f6c
mov esp, ebp
pop ebp
ret
Function at 0x4911b0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x624]
sub esp, 0x624
push 0xffffffffffffffff
push 0x4e65a8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x534008]
xor eax, ebp
mov dword [ebp + 0x620], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
lea ecx, [ebp - 0x10]
call fcn.0040fc00
mov eax, dword [0x539934]
mov dword [ebp - 0x10], 0x539934
test eax, eax
je 0x491208
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov edx, dword [0x534580]
test edx, edx
je 0x491266
cmp esi, 0x534570
je 0x49123d
cmp dword [0x534584], 8
mov eax, 0x534570
push edx
cmovae eax, dword [0x534570]
mov ecx, esi
push eax
call fcn.0040a960
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49125f
mov eax, dword [eax]
test eax, eax
je 0x491258
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], 0
mov al, 1
jmp 0x491380
push 0x20c
lea eax, [ebp + 0x414]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp + 0x414]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x49135c
xor eax, eax
push 0x412
push eax
mov word [ebp + 0x61e], ax
lea eax, [ebp]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp]
push 0x208
push eax
lea eax, [ebp + 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x491300
test eax, eax
je 0x491300
add eax, eax
cmp eax, 0x412
jae 0x4913a1
xor ecx, ecx
mov word [ebp + eax], cx
lea ecx, [ebp]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4912f0
lea eax, [ebp]
jmp 0x491321
lea ecx, [ebp + 0x414]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x491310
lea eax, [ebp + 0x414]
sub ecx, edx
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040a960
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49125f
mov eax, dword [eax]
test eax, eax
je 0x491258
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], 0
mov al, 1
jmp 0x491380
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49137e
mov eax, dword [eax]
test eax, eax
je 0x491377
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x620]
xor ecx, ebp
call fcn.004b5f6c
lea esp, [ebp + 0x624]
pop ebp
ret
call fcn.004b65d5
int3
Function at 0x495410
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x534008]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x4954a7
cmp dword [esp + 8], 6
jb 0x4954a7
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.004b5f6c
add esp, 0x118
ret

Function at 0x4954c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6b90
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x534008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xc
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push 0x510328
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0040a960
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.00485760
mov ecx, eax
call fcn.00485820
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040a900
push 0xb
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x40]
push 0x510344
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.0040a960
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.00485760
mov ecx, eax
call fcn.00485820
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040a900
test ebx, ebx
je 0x49561d
test esi, esi
je 0x49561d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x498f70
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e515f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x534008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, dword [ebp + 8]
mov ecx, edi
push esi
mov dword [ebp - 0x10], edi
call fcn.004107f0
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.004107f0
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.004107f0
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.004107f0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.004107f0
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.004107f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49adc0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x534008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x49ae25
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49ae00
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x49ae25
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004b5f6c
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004b5f6c
add esp, 8
ret 4
Function at 0x49afd0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e77a8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x534008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x49b019
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x49b16b
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x49b136
test eax, eax
je 0x49b136
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x49b139
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x49b0bb
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49b0af
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x49b0bb
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x49b0c9
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.004107f0
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x49b136
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x49b074
jmp 0x49b139
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x49b162
test edx, edx
je 0x49b15e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x49b030
mov al, 1
jmp 0x49b16d
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x49b16b
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b5f6c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b1961
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
mov edi, ecx
cmp dword [edi + 0x64], 0
je 0x4b1978
push dword [edi + 0x64]
call esi
cmp dword [edi + 0x70], 0
je 0x4b1983
push dword [edi + 0x70]
call esi
xor ebp, ebp
cmp dword [edi + 0x78], ebp
je 0x4b1a71
push 0x539918
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x78]
test al, 1
je 0x4b19ac
push dword [edi + 0x7c]
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov eax, dword [edi + 0x78]
test al, 2
je 0x4b19c0
push dword [edi + 0x80]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler]
mov eax, dword [edi + 0x78]
pop ecx
test al, 4
je 0x4b19d1
push dword [edi + 0x84]
call dword [sym.imp.VCRUNTIME140.dll__set_purecall_handler]
pop ecx
mov ebx, dword [0x539914]
mov eax, dword [ebx + 4]
add eax, 0xfffffffc
cmp dword [eax], edi
jne 0x4b19e6
mov dword [ebx + 4], eax
jmp 0x4b1a37
push str.warning:_removing_Breakpad_handler_out_of_order_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
pop ecx
push eax
call fcn.004ae820
mov ebx, dword [0x539914]
pop ecx
pop ecx
mov esi, dword [ebx]
mov eax, dword [ebx + 4]
cmp esi, eax
je 0x4b1a37
lea ebp, [esi + 4]
cmp dword [esi], edi
jne 0x4b1a28
mov eax, dword [ebx + 4]
sub eax, ebp
push eax
push ebp
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
add dword [ebx + 4], 0xfffffffc
jmp 0x4b1a2e
add esi, 4
add ebp, 4
mov eax, dword [ebx + 4]
cmp esi, eax
jne 0x4b1a0e
xor ebp, ebp
mov ecx, dword [ebx]
cmp ecx, eax
jne 0x4b1a66
test ecx, ecx
je 0x4b1a56
mov edx, dword [ebx + 8]
sub edx, ecx
and edx, 0xfffffffc
call fcn.0040b940
mov dword [ebx], ebp
mov dword [ebx + 4], ebp
mov dword [ebx + 8], ebp
push 0xc
push ebx
call fcn.004b622a
pop ecx
pop ecx
mov dword [0x539914], ebp
push 0x539918
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp dword [edi + 0xc], ebp
jne 0x4b1ab7
push 1
push dword [edi + 0x88]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0x88]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea eax, [edi + 0x90]
mov dword [edi + 0x88], ebp
push eax
call ebx
push dword [edi + 0xa8]
call esi
push dword [edi + 0xac]
call esi
push 0x539930
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4b1acd
push 0x539918
call ebx
lea ecx, [edi + 0xc0]
call fcn.004b242a
lea ecx, [edi + 0x40]
call fcn.0040a900
lea ecx, [edi + 0x28]
call fcn.0040a900
lea ecx, [edi + 0x10]
call fcn.0040a900
mov ecx, dword [edi + 0xc]
pop edi
pop esi
pop ebp
pop ebx
test ecx, ecx
je 0x4b1b01
push ecx
call fcn.004b2463
ret