joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58bf30
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x12c
mov esi, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov ecx, dword [0x7aa024]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor ecx, ecx
dec ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], ecx
test al, al
je 0x58c00b
lea ebx, [ebp - 0x120]
xor edi, edi
push 0x110
push edi
push ebx
call fcn.00650600
add esp, 0xc
mov dword [ebx - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x746ae0]
movups xmmword [esp], xmm0
mov ebx, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call ebx
mov ecx, 3
push ecx
push 1
push edx
push eax
call ebx
mov ecx, 3
push ecx
push 0x20
push edx
push eax
call ebx
lea ecx, [ebp - 0x120]
mov dword [ecx - 8], 6
mov dword [ecx - 4], edi
mov word [ecx + 0x108], 0
lea ecx, [ebp - 0x12c]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ebx, 0x80003
test eax, eax
je 0x58c012
lea edi, [ebp - 0x138]
mov dword [edi], 0xc
push 0
call fcn.0058c060
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], 1
jmp 0x58c012
xor edi, edi
mov ebx, 3
cmp byte [esi + 0xb], 0
jns 0x58c01a
mov esi, dword [esi]
sub esp, 0x20
mov dword [esp + 0x1c], edi
movaps xmm0, xmmword [0x796380]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
add esp, 0x12c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x58e560
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret

Function at 0x58f6e0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, ecx
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x58f702
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x58f737
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x58f750
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0058f800
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.005e42f0
add esp, 4
test al, al
jne 0x58f762
xor ebx, ebx
jmp 0x58f739
call fcn.006a2ff0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x265
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.006a3120
lea eax, [ebp - 0xb0]
push 0x10
push str.CreateDirectory
push eax
call fcn.0067fe70
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x58f7a4
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.005ee4b0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x58f7c9
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.0067fe70
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x58f7eb
push dword [ebp - 0xc4]
call fcn.0064cd6e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.006a3180
jmp 0x58f75e
Function at 0x58f800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, ecx
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x58f822
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x58f84f
mov bl, 1
test al, 0x10
je 0x58f8f7
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.005e42f0
add esp, 4
test al, al
je 0x58f905
call fcn.006a2ff0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x250
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.006a3120
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0067fe70
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x58f8a3
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.005ee4b0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x58f8c8
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.0067fe70
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x58f8ea
push dword [ebp - 0xc4]
call fcn.0064cd6e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.006a3180
jmp 0x58f905
push 2
call fcn.005e42f0
add esp, 4
test al, al
jne 0x58f90c
xor ebx, ebx
jmp 0x58f838
lea ecx, [ebp - 0xb8]
push 2
push 0x254
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.005417e0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0067fe70
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x58f948
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.005ee4b0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x58f96d
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.0067fe70
add esp, 0xc
push 0x11
push str.:_not_a_directory
push eax
call fcn.0067fe70
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x58f99f
push dword [ebp - 0xc4]
call fcn.0064cd6e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00541c20
jmp 0x58f905
Function at 0x590bf0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.0058fa30
mov eax, dword [esi]
test eax, eax
je 0x590c43
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x590c4a
lea ecx, [ebp - 0x14]
call fcn.00590470
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x590c25
mov eax, dword [ebp + 8]
add eax, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebx + 0x50], 0
je 0x590c62
add ebx, 0x58
cmp ebx, edi
je 0x590c25
jmp 0x590c53
cmp byte [ebx + 0x1b], 0
jns 0x590c6d
mov eax, dword [ebx + 0x10]
jmp 0x590c70
lea eax, [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x590c59
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
je 0x590ca3
mov edx, ecx
mov ecx, dword [ebp - 0x1c]
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.005914d0
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x590c59
mov ecx, dword [ebp + 8]
push ebx
call fcn.006e3b90
jmp 0x590c59

Function at 0x590cb0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.0058fa30
mov eax, dword [esi]
test eax, eax
je 0x590d03
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x590d0a
lea ecx, [ebp - 0x14]
call fcn.00590470
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x590ce5
mov eax, dword [ebp + 8]
add eax, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebx + 0x50], 2
jne 0x590d58
cmp byte [ebx + 0x1b], 0
jns 0x590d24
mov eax, dword [ebx + 0x10]
jmp 0x590d27
lea eax, [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x590d58
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
je 0x590d61
mov edx, ecx
mov ecx, dword [ebp - 0x1c]
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.005914d0
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
add ebx, 0x58
cmp ebx, edi
je 0x590ce5
jmp 0x590d13
mov ecx, dword [ebp + 8]
push ebx
call fcn.006e3b90
jmp 0x590d58
Function at 0x591e00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, ecx
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0x48], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x451
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp dword [esi + 0x60], eax
je 0x591e63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0x60]
inc eax
cmp eax, 2
jae 0x591ff3
mov eax, edi
inc eax
cmp eax, 2
jb 0x591e59
mov dword [esi + 0x60], edi
call fcn.005e42e0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi + 0x60]
inc edi
cmp edi, 2
jb 0x59200f
lea edi, [esi + 8]
mov ecx, edi
push 1
call fcn.00576630
test al, al
je 0x59200f
mov eax, dword [esi + 0x60]
lea edx, [esp + 0x44]
mov dword [edx], eax
mov ecx, edi
push 4
push edx
push 0x20002
call fcn.005766e0
mov ebx, eax
test al, al
je 0x591fdc
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov dword [edi + 0x20], 0xffffffff
mov ecx, edi
push eax
call fcn.0053cf50
mov ecx, edi
push ebx
push 8
push str.database
call fcn.0053dae0
lea ebx, [esp + 0x14]
push esi
push ebx
call fcn.005eb0c0
add esp, 8
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x591efa
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, edi
push eax
push ebx
push 0x12
push str.exception_pointers
call fcn.0053df70
cmp byte [esp + 0x1f], 0
js 0x592013
lea edi, [esp + 0x14]
push dword [esi + 0x60]
push edi
call fcn.005eb0c0
add esp, 8
movzx eax, byte [edi + 0xb]
test al, al
jns 0x591f35
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push eax
push edi
push 7
push 0x74d629
call fcn.0053df70
cmp byte [esp + 0x1f], 0
js 0x592024
xor eax, eax
dec eax
lea ebx, [esp + 0x14]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea ecx, [esp + 0x20]
push ebx
call fcn.0053e4f0
mov ecx, ebx
push str.___thread
call fcn.0053be70
lea edi, [esi + 0x54]
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x591f8a
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea eax, [ebx + eax*2]
mov ecx, edi
push eax
push ebx
call fcn.00592050
mov word [esp + 0x12], 0
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x58]
sub ecx, eax
cmp ecx, 0xffffffbf
ja 0x592035
lea eax, [esp + 0x12]
mov ecx, edi
push eax
push 0x20
call fcn.00551c90
mov ebx, dword [esp + 0xc]
cmp byte [esp + 0x1f], 0
jns 0x591fd3
push dword [esp + 0x14]
call fcn.0064cd6e
add esp, 4
lea ecx, [esp + 0x20]
call fcn.0053d090
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.005e42e0
push dword [esi + 0x60]
call fcn.005f2830
add esp, 4
mov dword [esi + 0x60], 0
jmp 0x591e49
xor ebx, ebx
jmp 0x591fdc
push dword [esp + 0x14]
call fcn.0064cd6e
add esp, 4
jmp 0x591f15
push dword [esp + 0x14]
call fcn.0064cd6e
add esp, 4
jmp 0x591f52
add eax, ecx
add eax, 0x40
mov dword [esi + 0x58], eax
jmp 0x591fbc
Function at 0x596470
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
call fcn.00572330
mov byte [esi + 4], 0
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi], 0x740fa0
mov dword [esi + 0xc], eax
movaps xmm0, xmmword [0x798300]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
cmp dword [esi + 0xc], eax
je 0x5964da
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0xc]
inc eax
cmp eax, 2
jae 0x5964e4
lea eax, [edi + 1]
cmp eax, 2
jb 0x5964ce
mov dword [esi + 0xc], edi
call fcn.005e42e0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005e42e0
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call fcn.005f2830
mov dword [esi + 0xc], 0
jmp 0x5964be
Function at 0x59b350
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7be630]
mov ecx, dword [0x7ae174]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x59b37b
mov ecx, 0x7be628
pop ebp
jmp fcn.005494f0
push 0x7be630
call fcn.0064cde7
add esp, 4
cmp dword [0x7be630], 0xffffffff
jne 0x59b370
xor eax, eax
mov dword [0x7be62c], eax
mov dword [0x7be628], eax
mov ecx, 0x7be628
push eax
call fcn.00549590
push 0x7be630
call fcn.0064ce5d
add esp, 4
jmp 0x59b370
Function at 0x5a1750
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x7be698]
mov ecx, dword [0x7ae174]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x5a18c8
mov esi, dword [0x7be688]
lea eax, [esi + 0xc]
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x5a1908
mov edi, esi
mov esi, dword [esi + 0x18]
test esi, esi
je 0x5a18ad
imul eax, dword [ebp + 8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0x6f47a654
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, 0x33333333
mov ebx, eax
and ebx, edx
shr eax, 2
and eax, edx
add eax, ebx
mov edx, eax
shr edx, 4
add edx, eax
add edi, 0x14
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
jbe 0x5a18fe
mov edx, ecx
cmp ecx, esi
jb 0x5a1828
mov eax, ecx
xor edx, edx
div esi
mov dword [ebp - 0x2c], edi
mov eax, dword [edi]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x5a18ad
mov ebx, dword [eax]
test ebx, ebx
je 0x5a18ad
lea edi, [esi - 1]
mov eax, dword [ebx + 4]
cmp eax, ecx
jne 0x5a184e
mov eax, dword [ebp + 8]
cmp dword [ebx + 8], eax
je 0x5a1878
jmp 0x5a1870
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x28], 1
jbe 0x5a1929
mov edi, edx
cmp eax, esi
jb 0x5a1867
xor edx, edx
div esi
mov eax, edx
mov edx, edi
cmp eax, edi
mov edi, dword [ebp - 0x20]
jne 0x5a18ad
mov ebx, dword [ebx]
test ebx, ebx
jne 0x5a183d
jmp 0x5a18ad
lea edi, [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
push ebx
push edi
call fcn.004d1650
mov esi, dword [edi]
mov dword [edi], 0
test esi, esi
je 0x5a18ad
cmp byte [ebp - 0x14], 0
je 0x5a18a4
mov eax, dword [esi + 0xc]
test eax, eax
je 0x5a18a4
lock dec dword [eax + 4]
je 0x5a1915
push esi
call fcn.0064cd6e
add esp, 4
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x7be698
call fcn.0064cde7
add esp, 4
cmp dword [0x7be698], 0xffffffff
jne 0x5a1784
mov ecx, 0x7be660
call fcn.005a1940
push 0x7be698
call fcn.0064ce5d
add esp, 4
jmp 0x5a1784
lea edx, [esi - 1]
and edx, ecx
jmp 0x5a1828
mov ecx, dword [ebp - 0x24]
call fcn.005f1f90
jmp 0x5a179f
add eax, 4
add eax, 0xfffffffc
push eax
call fcn.005eeaf0
add esp, 4
jmp 0x5a18a4
mov edi, edx
and eax, dword [ebp - 0x20]
jmp 0x5a1867
Function at 0x5aaae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x7aa024]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, SysReAllocString
cmp edx, esi
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5aab38
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x5aab3d
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
xor esi, esi
dec esi
jmp 0x5aab26
int3

Function at 0x5aab40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x7aa024]
xor ecx, ebp
mov esi, SysReAllocString
cmp eax, esi
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push edx
mov edi, ebx
push ebx
call ecx
test eax, eax
je 0x5aabb8
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x5aaba5
cmp ebx, 0xffffffff
je 0x5aabca
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x5aabcd
mov ebx, dword [ebp - 0x14]
jmp 0x5aab91
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x5aab91
int3
mov edx, dword [ebp + 0xc]
jmp 0x5aab67

Function at 0x5aaff0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov esi, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.005aaf00
add esp, 0x10
or edx, eax
jne 0x5ab027
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x5ab03d
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0064d372
mov eax, ebx
add esp, 0xac
pop esi
pop ebx
pop ebp
ret
push 2
call fcn.005e42f0
add esp, 4
test al, al
jne 0x5ab04f
xor ebx, ebx
jmp 0x5ab027
call fcn.006a2ff0
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0xfb
push str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
call fcn.006a3120
lea eax, [ebp - 0xac]
push 0xc
push 0x79c23a
push eax
call fcn.0067fe70
add esp, 0xc
mov ecx, esi
call fcn.006a3180
jmp 0x5ab04b
Function at 0x5b62f0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, edx
cmp edx, 4
jb 0x5b6328
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x5b6302
cmp edx, 1
je 0x5b6349
cmp edx, 2
je 0x5b6340
cmp edx, 3
jne 0x5b6354
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 8

Function at 0x5b96d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x7beb10]
mov ecx, dword [0x7ae174]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x5b973a
mov ecx, 0x7beb08
call fcn.005494f0
test eax, eax
jne 0x5b972d
push 4
call fcn.0064cd3e
add esp, 4
mov edi, eax
mov dword [eax], 0
mov ecx, 0x7beb08
call fcn.005494f0
mov esi, eax
mov ecx, 0x7beb08
push edi
call fcn.005ef190
test esi, esi
jne 0x5b977d
mov ecx, 0x7beb08
pop esi
pop edi
pop ebp
jmp fcn.005494f0
push 0x7beb10
call fcn.0064cde7
add esp, 4
cmp dword [0x7beb10], 0xffffffff
jne 0x5b96f2
xor eax, eax
mov dword [0x7beb0c], eax
mov dword [0x7beb08], eax
mov ecx, 0x7beb08
push 0x4a4d10
call fcn.00549590
push 0x7beb10
call fcn.0064ce5d
add esp, 4
jmp 0x5b96f2
push esi
call fcn.0064cd6e
add esp, 4
jmp 0x5b972d
Function at 0x5c21f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0x80], eax
cmp byte [ecx + 0xb], 0
js 0x5c223d
je 0x5c22bd
xorps xmm0, xmm0
movaps xmmword [esp + 0x70], xmm0
movups xmmword [esp + 0x60], xmm0
movups xmmword [esp + 0x50], xmm0
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x30], xmm0
mov dword [esp + 0x2c], 0x44
jmp 0x5c2269
cmp dword [ecx + 4], 0
je 0x5c22bd
xorps xmm0, xmm0
movaps xmmword [esp + 0x70], xmm0
movups xmmword [esp + 0x60], xmm0
movups xmmword [esp + 0x50], xmm0
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x30], xmm0
mov dword [esp + 0x2c], 0x44
mov ecx, dword [ecx]
lea eax, [esp + 0x70]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x5c22bd
mov eax, dword [esp + 0x74]
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
sub esp, 4
mov eax, dword [esp + 0x70]
mov dword [esp], eax
call esi
sub esp, 4
mov ecx, dword [esp + 0x80]
xor ecx, ebp
call fcn.0064d372
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x5c2310
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
push eax
push eax
push ecx
push 0x5c2380
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x5c234c
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0064d372
add esp, 8
pop esi
pop ebp
ret
lea esi, [ebp - 0xc]
push 0x1b
push str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
push esi
call fcn.006d01c0
add esp, 0xc
mov ecx, esi
call fcn.006d0100
push 0xc
push 0x7926fa
push eax
call fcn.0067fe70
add esp, 0xc
mov ecx, esi
call fcn.006d0110
jmp 0x5c233c
Function at 0x5d7f10
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x5d7f25
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, edx
cmp edx, 4
jb 0x5d7f56
nop dword [eax]
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x5d7f30
cmp edx, 1
je 0x5d7f79
cmp edx, 3
je 0x5d7f67
cmp edx, 2
jne 0x5d7f84
jmp 0x5d7f70
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4