joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x4e8024]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x439a21
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x701
mov dword [esp + 0x54], ecx
cmp byte [eax + 0xb], 0
jns 0x43997f
mov eax, dword [eax]
mov ebx, dword [ebp + 8]
mov dword [esp + 0x60], eax
xor eax, eax
dec eax
lea ecx, [esp + 0x48]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [esp], ecx
call fcn.004606c0
mov eax, dword [0x4fb160]
mov ecx, dword [0x4ebde8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x439a9d
mov dword [esp], 0x4d70a1
call fcn.00461230
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
xor ebx, ebx
mov dword [esp + 0x40], ebx
mov dword [esp], edi
lea edi, [esp + 0x50]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x4d51f0]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.004414c0
sub esp, 0x44
cmp byte [edi], 0
jne 0x439a85
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0046f8c3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + ebx*8 + 0x60]
test esi, esi
je 0x439a91
lea ecx, [esi + 0x5c]
call fcn.0044e470
lea ecx, [esi + 0x28]
call fcn.0044b460
mov ecx, esi
call fcn.0044e5f0
mov dword [esp], esi
call fcn.0046ecdd
jmp 0x439a91
mov esi, dword [esp + ebx*8 + 0x60]
test esi, esi
je 0x439a91
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov dword [esp], 1
mov ecx, esi
call edi
sub esp, 4
mov al, byte [esp + ebx + 0x51]
jmp 0x439a8d
mov al, byte [esp + ebx + 0x51]
cmp al, 8
je 0x439a5d
cmp al, 9
je 0x439a34
inc ebx
movzx eax, byte [esp + 0x50]
cmp ebx, eax
jae 0x439a21
jmp 0x439a85
mov dword [esp], 0x4fb160
call fcn.0046ed57
cmp dword [0x4fb160], 0xffffffff
jne 0x4399bb
mov dword [esp], 0
mov ecx, 0x4faf60
call fcn.00437f50
sub esp, 4
mov dword [esp], 0x4fb160
call fcn.0046edcd
jmp 0x4399bb
Function at 0x43b870
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x4e8024]
xor eax, ebp
mov dword [esp + 0x48], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x43b899
mov eax, dword [ecx + 4]
test eax, eax
je 0x43ba07
mov eax, ebx
not eax
test eax, 0x300
je 0x43ba07
cmp edi, 2
mov eax, 0x4fb3ba
mov ecx, 0x4fb5ba
cmove ecx, eax
cmp word [ecx], 0
jne 0x43ba07
xorps xmm0, xmm0
lea esi, [esp + 0x20]
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x43ba07
cmp byte [0x4fb3b8], 0
setne al
bt ebx, 8
jb 0x43ba07
shr ebx, 9
and ebx, 1
or bl, al
je 0x43ba07
cmp edi, 2
mov eax, 0x4dc460
mov edx, 0x4dc474
cmove edx, eax
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
test cl, cl
jns 0x43ba1a
mov ecx, dword [eax]
mov dword [esp + 4], ecx
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
mov dword [esp + 0x18], ecx
xor esi, esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0
mov edi, dword [edx + 4]
mov ebx, eax
sub ebx, edi
jb 0x43b987
push edi
push dword [edx]
push dword [esp + 0xc]
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], eax
call fcn.00485464
mov edx, dword [esp + 0x28]
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x14]
je 0x43b993
add edx, 0x14
inc esi
cmp esi, dword [esp + 0x18]
jb 0x43b95b
jmp 0x43ba00
mov eax, dword [esp + 4]
movzx ecx, word [eax + edi*2]
mov eax, dword [esp + 0x14]
cmp cx, 0x5c
jne 0x43ba48
mov eax, dword [esp + 4]
lea eax, [eax + edi*2]
mov esi, dword [edx + 8]
cmp esi, 2
jne 0x43b9c6
mov dword [esp + 0xc], str.WOW6432Node
mov dword [esp + 8], eax
jmp 0x43b9cf
cmp esi, 1
je 0x43ba5d
cmp cx, 0x5c
mov dword [esp + 0x10], esi
jne 0x43b9ec
lea ecx, [eax + 2]
dec ebx
cmp word [eax + 2], 0x5c
mov dword [esp + 4], ecx
mov eax, ecx
je 0x43b9d9
jmp 0x43b9f0
mov dword [esp + 4], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x18], eax
mov edx, dword [edx + 0xc]
xor esi, esi
mov eax, ebx
jmp 0x43b98b
cmp dword [esp + 0x10], 0
jne 0x43ba25
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0046f8c3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
mov eax, ecx
jmp 0x43b93a
mov eax, dword [ebp + 8]
cmp byte [eax + 0xb], 0
js 0x43ba56
mov eax, dword [ebp + 8]
mov edx, dword [esp + 8]
sub edx, eax
sar edx, 1
mov ecx, dword [ebp + 8]
push dword [esp + 0xc]
push edx
call fcn.00423b50
jmp 0x43ba07
test cx, cx
jne 0x43b987
jmp 0x43b9a9
mov eax, dword [ebp + 8]
mov eax, dword [eax]
jmp 0x43ba31
mov dword [esp + 0xc], str.WOW6432Node_
mov edi, dword [esp + 4]
mov dword [esp + 8], edi
jmp 0x43b9cf
Function at 0x43c1b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x4e8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43c223
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x43c20d
cmp dword [ebp - 0x18], 4
jne 0x43c20d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046f8c3
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x43c20d

Function at 0x43c230
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.004704c0
mov esi, ecx
mov eax, dword [0x4e8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x800
lea edi, [ebp - 0x810]
push ebx
push 0xff
push edi
call fcn.00472db0
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], ebx
push ecx
push edi
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43c2bf
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x43c2c3
mov ecx, esi
push edi
call fcn.00423810
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046f8c3
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x43c2a6
cmp eax, 2
jne 0x43c30c
lea ebx, [ebp - 0x1010]
push 0x800
push 0xff
push ebx
call fcn.00472db0
add esp, 0xc
push 0x400
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x43c305
mov ecx, esi
push ebx
jmp 0x43c29f
mov esi, 0xea
jmp 0x43c2a6
mov esi, 0x3f4
jmp 0x43c2a6
Function at 0x43da30
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, ecx
mov eax, dword [0x4e8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x43da52
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43da87
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43daa0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046f8c3
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0043db50
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046f8c3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00454820
add esp, 4
test al, al
jne 0x43dab2
xor ebx, ebx
jmp 0x43da89
call fcn.004b6090
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x265
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.004b61c0
lea eax, [ebp - 0xb0]
push 0x10
push str.CreateDirectory
push eax
call fcn.0049a9f0
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x43daf4
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.004574c0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x43db19
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.0049a9f0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x43db3b
push dword [ebp - 0xc4]
call fcn.0046ecdd
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004b6220
jmp 0x43daae
Function at 0x43db50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, ecx
mov eax, dword [0x4e8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x43db72
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43db9f
mov bl, 1
test al, 0x10
je 0x43dc47
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046f8c3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00454820
add esp, 4
test al, al
je 0x43dc55
call fcn.004b6090
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x250
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.004b61c0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0049a9f0
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x43dbf3
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.004574c0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x43dc18
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.0049a9f0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x43dc3a
push dword [ebp - 0xc4]
call fcn.0046ecdd
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004b6220
jmp 0x43dc55
push 2
call fcn.00454820
add esp, 4
test al, al
jne 0x43dc5c
xor ebx, ebx
jmp 0x43db88
lea ecx, [ebp - 0xb8]
push 2
push 0x254
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.004278f0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0049a9f0
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x43dc98
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.004574c0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x43dcbd
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.0049a9f0
add esp, 0xc
push 0x11
push str.:_not_a_directory
push eax
call fcn.0049a9f0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x43dcef
push dword [ebp - 0xc4]
call fcn.0046ecdd
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00427cd0
jmp 0x43dc55
Function at 0x43fe70
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x12c
mov esi, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov ecx, dword [0x4e8024]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor ecx, ecx
dec ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], ecx
test al, al
je 0x43ff4b
lea ebx, [ebp - 0x120]
xor edi, edi
push 0x110
push edi
push ebx
call fcn.00472db0
add esp, 0xc
mov dword [ebx - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x4de020]
movups xmmword [esp], xmm0
mov ebx, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call ebx
mov ecx, 3
push ecx
push 1
push edx
push eax
call ebx
mov ecx, 3
push ecx
push 0x20
push edx
push eax
call ebx
lea ecx, [ebp - 0x120]
mov dword [ecx - 8], 6
mov dword [ecx - 4], edi
mov word [ecx + 0x108], 0
lea ecx, [ebp - 0x12c]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ebx, 0x80003
test eax, eax
je 0x43ff52
lea edi, [ebp - 0x138]
mov dword [edi], 0xc
push 0
call fcn.0043ffa0
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], 1
jmp 0x43ff52
xor edi, edi
mov ebx, 3
cmp byte [esi + 0xb], 0
jns 0x43ff5a
mov esi, dword [esi]
sub esp, 0x20
mov dword [esp + 0x1c], edi
movaps xmm0, xmmword [0x4de030]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046f8c3
mov eax, esi
add esp, 0x12c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4405d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret
Function at 0x440870
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x4e8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4fb9dc]
mov ecx, dword [0x4ebde8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4408bd
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046f8c3
mov eax, 0x4fb9d8
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4fb9dc
call fcn.0046ed57
add esp, 4
cmp dword [0x4fb9dc], 0xffffffff
jne 0x4408a3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.00472db0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.0046ecad
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x4fba0c]
mov ecx, dword [0x4ebde8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x440966
mov ecx, esi
push ebx
push 0x4fb9e8
push edi
call fcn.00440a80
mov dword [0x4fb9d8], esi
push 0x4fb9dc
call fcn.0046edcd
add esp, 4
jmp 0x4408a3
push 0x4fba0c
call fcn.0046ed57
add esp, 4
cmp dword [0x4fba0c], 0xffffffff
jne 0x440940
xorps xmm0, xmm0
movups xmmword [0x4fb9f8], xmm0
movups xmmword [0x4fb9e8], xmm0
mov dword [0x4fba08], 0
push 0x4fb9e8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x4fba0c
call fcn.0046edcd
add esp, 4
jmp 0x440940

Function at 0x4409d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4fba0c]
mov ecx, dword [0x4ebde8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x440a02
movzx ecx, word [0x4fb9e8]
cmp cx, 9
jne 0x440a4d
xor eax, eax
inc eax
pop ebp
ret
push 0x4fba0c
call fcn.0046ed57
add esp, 4
cmp dword [0x4fba0c], 0xffffffff
jne 0x4409f0
xorps xmm0, xmm0
movups xmmword [0x4fb9f8], xmm0
movups xmmword [0x4fb9e8], xmm0
mov dword [0x4fba08], 0
push 0x4fb9e8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x4fba0c
call fcn.0046edcd
add esp, 4
jmp 0x4409f0
xor eax, eax
test cx, cx
je 0x440a00
cmp cx, 6
jne 0x440a61
mov eax, 2
jmp 0x440a00
cmp cx, 0xc
jne 0x440a6e
mov eax, 3
jmp 0x440a00
mov eax, 4
jmp 0x440a00

Function at 0x4410d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4ebd54]
cmp eax, 0xffffffff
je 0x4410f0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
jmp 0x4410ee
Function at 0x441100
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x4ebd54]
cmp eax, 0xffffffff
je 0x4411c7
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x4411c7
mov eax, dword [0x4fc618]
mov ecx, dword [0x4ebde8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4411d1
mov edi, dword [0x4fc614]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x441216
mov ecx, dword [0x4fba10]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x4fba14], 0
jne 0x441222
lea eax, [eax*4 + 0x4fba14]
mov dword [eax], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x4fba18], ecx
mov dword [0x4fba10], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x4fba1c]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x441234
cmp eax, 0x100
jge 0x441237
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00441240
jmp 0x441125
push 0x4fc618
call fcn.0046ed57
add esp, 4
cmp dword [0x4fc618], 0xffffffff
jne 0x441146
push 4
call fcn.0046ecad
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.0045ab90
mov dword [0x4fc614], edi
push 0x4fc618
call fcn.0046edcd
add esp, 4
jmp 0x441146
mov ecx, edi
call fcn.0045aba0
jmp 0x44115b
inc edx
cmp edx, 0x100
jne 0x441164
jmp 0x4411ab
int3
int3

Function at 0x441240
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x4e8024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x814], 0xffffffff
mov ecx, dword [0x4ebd54]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x4412ed
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x441336
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.00472db0
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.00446280
add esp, 8
push edi
call fcn.0046ed13
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.004722b0
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.00446280
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046f8c3
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.00446260
add esp, 4
test al, al
je 0x441339
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x44133c
xor eax, eax
dec eax
lock cmpxchg dword [0x4ebd54], ecx
je 0x441271
push ecx
call fcn.004c7ac0
add esp, 4
mov ecx, dword [0x4ebd54]
mov dword [ebp - 0x814], ecx
jmp 0x441271
int3
int3
push esi
call fcn.00446260
add esp, 4
test al, al
je 0x441364
cmp dword [ebp - 0x814], 0xffffffff
je 0x441364
push 0xffffffffffffffff
call fcn.004c7ac0
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x44130b
int3
Function at 0x444f80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x4e8024]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, 0x7fffffff
cmp edx, esi
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x444fd8
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x444fdd
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046f8c3
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
xor esi, esi
dec esi
jmp 0x444fc6
int3

Function at 0x444fe0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x4e8024]
xor ecx, ebp
mov esi, 0x7fffffff
cmp eax, esi
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push edx
mov edi, ebx
push ebx
call ecx
test eax, eax
je 0x445058
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x445045
cmp ebx, 0xffffffff
je 0x44506a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046f8c3
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x44506d
mov ebx, dword [ebp - 0x14]
jmp 0x445031
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x445031
int3
mov edx, dword [ebp + 0xc]
jmp 0x445007

Function at 0x4454a0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov esi, dword [ebp + 8]
mov eax, dword [0x4e8024]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.004453b0
add esp, 0x10
or edx, eax
jne 0x4454d7
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x4454ed
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0046f8c3
mov eax, ebx
add esp, 0xac
pop esi
pop ebx
pop ebp
ret
push 2
call fcn.00454820
add esp, 4
test al, al
jne 0x4454ff
xor ebx, ebx
jmp 0x4454d7
call fcn.004b6090
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0xfb
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
call fcn.004b61c0
lea eax, [ebp - 0xac]
push 0xc
push 0x4defea
push eax
call fcn.0049a9f0
add esp, 0xc
mov ecx, esi
call fcn.004b6220
jmp 0x4454fb
Function at 0x448f70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x4e8024]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x448fa0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046f8c3
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x449090
push 0
push eax
push 0x448f50
push 0x4fc77c
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x44907f
cmp dword [0x4fc780], 0
jne 0x448f8c
push dword [0x4fc784]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x448f8c
mov esi, eax
mov eax, 0x4fc788
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov ebx, dword [0x4fc78c]
mov edi, dword [0x4fc790]
mov eax, dword [0x4fc794]
mov dword [ebp - 0x18], eax
mov eax, dword [0x4fc798]
mov dword [ebp - 0x1c], eax
mov eax, 0x4fc788
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test ebx, ebx
je 0x44902c
mov eax, dword [esi]
mov dword [ebp - 0x20], eax
mov ecx, ebx
call dword [section..00cfg]
push dword [ebp - 0x20]
call ebx
add esp, 4
test edi, edi
je 0x449041
mov ebx, dword [esi + 4]
mov ecx, edi
call dword [section..00cfg]
push ebx
call edi
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x449059
mov edi, dword [esi + 8]
mov ecx, dword [ebp - 0x18]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x449071
mov edi, dword [esi + 0xc]
mov ecx, dword [ebp - 0x1c]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
push esi
call fcn.0046c170
add esp, 4
jmp 0x448f8c
call fcn.00483ab0
int3

Function at 0x44f690
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x44f6a5
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, edx
cmp edx, 4
jb 0x44f6d6
nop dword [eax]
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x44f6b0
cmp edx, 1
je 0x44f6f9
cmp edx, 3
je 0x44f6e7
cmp edx, 2
je 0x44f6f0
jmp 0x44f704
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4