joyce8/EMBER2024-capa huggingface dataset:
Function at 0x564f80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x689640]
mov ecx, dword [0x678164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x564fab
mov ecx, 0x689638
pop ebp
jmp fcn.004c3f80
push 0x689640
call fcn.005dc7c7
add esp, 4
cmp dword [0x689640], 0xffffffff
jne 0x564fa0
mov dword [0x68963c], 0
mov dword [0x689638], 0
mov ecx, 0x689638
push 0
call fcn.004c3ff0
push 0x689640
call fcn.005dc83d
add esp, 4
jmp 0x564fa0

Function at 0x57c3a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
mov eax, dword [ecx]
jne 0x57c3cc
test eax, eax
jne 0x57c3cc
xor eax, eax
cmp dword [esi + 0xc], 0
jne 0x57c3cc
xor eax, eax
cmp dword [esi + 4], 0
mov edx, 0
je 0x57c423
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x57c3eb
call fcn.004b63a0
push dword [esi]
call fcn.004d0370
add esp, 4
mov dword [esi], 0
xor eax, eax
mov ecx, dword [esi + 4]
lea edx, [ecx + 1]
cmp edx, 2
jb 0x57c411
call fcn.004b63a0
push dword [esi + 4]
call fcn.004d0370
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
xor ecx, ecx
mov edx, eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, ecx
mov ebx, dword [edi]
cmp edx, ebx
je 0x57c46a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x57c44e
call fcn.004b63a0
push dword [esi]
call fcn.004d0370
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x57c45d
mov dword [esi], ebx
call fcn.004b63a0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp eax, ebx
je 0x57c4b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jb 0x57c499
call fcn.004b63a0
push dword [esi + 4]
call fcn.004d0370
add esp, 4
mov dword [esi + 4], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x57c4a9
mov dword [esi + 4], ebx
call fcn.004b63a0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x57c5e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x57c670
mov edi, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
mov ebx, eax
call esi
lea ecx, [ebp - 0x14]
push 2
push 0
push 0
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x57c674
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
cmp dword [esi], ebx
je 0x57c681
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jb 0x57c65b
mov dword [ebp - 0x18], eax
call fcn.004b63a0
push dword [esi]
call fcn.004d0370
mov eax, dword [ebp - 0x18]
add esp, 4
mov dword [esi], 0
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x57c67a
mov dword [esi], ebx
mov esi, eax
call fcn.004b63a0
mov eax, esi
jmp 0x57c67a
mov bl, 1
jmp 0x57c686
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x57c7c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
call fcn.0057c570
test al, al
je 0x57c7e5
push 0x32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea edi, [esi + 0x20]
xor ebx, ebx
mov ecx, edi
push ebx
call fcn.0057c860
lea ecx, [esi + 0x30]
call fcn.00527014
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x2c], ebx
test eax, eax
je 0x57c80d
push eax
call fcn.004d2040
add esp, 4
mov eax, dword [esi + 0x24]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x67b000]
bt edx, ecx
jae 0x57c82f
push eax
call fcn.004ba0a0
add esp, 4
xor eax, eax
mov dword [esi + 0x24], eax
mov ecx, edi
push eax
call fcn.0057c860
lea ecx, [esi + 0x18]
call fcn.0041dc60
lea ecx, [esi + 0x14]
call fcn.0041dc60
lea ecx, [esi + 0x10]
call fcn.0041dc60
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.0057c4d0
Function at 0x57ef20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x674014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
jne 0x57f03d
mov dword [ebp - 0x14], 0x57f060
lea eax, [ebp - 0x14]
push 0
push eax
push 0x57ef00
push 0x6896ec
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x57f051
cmp dword [0x6896f0], 0
jne 0x57f03d
push dword [0x6896f4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x57f03d
mov esi, eax
push 0x6896f8
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x6896fc]
mov ebx, dword [0x689700]
mov eax, dword [0x689704]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x689708]
mov dword [ebp - 0x20], eax
mov eax, dword [0x68970c]
mov dword [ebp - 0x24], eax
push 0x6896f8
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x57efdb
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [section..00cfg]
push dword [ebp - 0x18]
call edi
add esp, 4
test ebx, ebx
je 0x57eff0
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x57f006
mov edi, dword [esi + 8]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x57f01f
mov edi, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
test ebx, ebx
je 0x57f034
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
push esi
call fcn.0051b7e0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
call fcn.005f1440
int3

Function at 0x585098
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00548d02

Function at 0x58e728
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
push eax
push eax
push ecx
push 0x58e7a0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x58e764
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005dd6f3
add esp, 8
pop esi
pop ebp
ret
lea esi, [ebp - 0xc]
push 0x1b
push str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
push esi
call fcn.00541fc0
add esp, 0xc
mov ecx, esi
call fcn.00541f80
push 0xc
push 0x62851a
push eax
call fcn.0041482a
add esp, 0xc
mov ecx, esi
call fcn.00541f90
jmp 0x58e754
Function at 0x597b70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x689798]
mov ecx, dword [0x678164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x597be3
mov ecx, 0x689790
call fcn.004c3f80
test eax, eax
jne 0x597bd6
push 4
call fcn.005dc726
add esp, 4
mov edi, eax
mov dword [eax], 0
mov ecx, 0x689790
call fcn.004c3f80
mov esi, eax
mov ecx, 0x689790
push edi
call fcn.004c3fb0
test esi, esi
je 0x597bd6
push esi
call fcn.005dc756
add esp, 4
mov ecx, 0x689790
pop esi
pop edi
pop ebp
jmp fcn.004c3f80
push 0x689798
call fcn.005dc7c7
add esp, 4
cmp dword [0x689798], 0xffffffff
jne 0x597b92
mov dword [0x689794], 0
mov dword [0x689790], 0
mov ecx, 0x689790
push 0x42f5d0
call fcn.004c3ff0
push 0x689798
call fcn.005dc83d
add esp, 4
jmp 0x597b92

Function at 0x59b670
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x59b6a8
mov edx, dword [ebp + 0xc]
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx ebx, byte [edx + esi]
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x635620]
inc esi
cmp ecx, esi
jne 0x59b690
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5a40d4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov ebx, ecx
mov al, byte [ebp + 8]
mov ecx, dword [0x674014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
test al, al
je 0x5a4124
xor edi, edi
inc edi
mov esi, 0x636222
mov ecx, ebx
push 0
push 0x5b6f30
push edi
push str.NtMapViewOfSection
push esi
call fcn.005a3b90
mov ecx, ebx
push edi
push 0x5b7170
push edi
push str.NtUnmapViewOfSection
push esi
call fcn.005a3b90
jmp 0x5a412e
cmp dword [ebx + 0xc], 0
je 0x5a427f
mov eax, dword [ebx]
mov edi, dword [eax]
sub esp, 0x14
movdqa xmm0, xmmword [0x636200]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov esi, dword [ebx + 0xc]
shl esi, 6
lea eax, [esi + 0x50]
mov dword [ebp - 0x70], eax
push eax
call fcn.005a39b8
add esp, 4
mov dword [ebp - 0x74], ebx
mov ebx, eax
mov eax, 0xfffff000
mov ecx, ebx
and ecx, eax
add ecx, dword [ebp - 0x6c]
add esi, 0x104f
and esi, eax
push 0x40
push 0x1000
push esi
push ecx
mov dword [ebp - 0x6c], edi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
je 0x5a4297
mov edi, eax
and ebx, 0xfff
add edi, ebx
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0x60]
movdqu xmmword [esi + 8], xmm0
xor eax, eax
dec eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
movdqu xmmword [esi + 0x38], xmm0
movdqu xmmword [esi + 0x28], xmm0
movdqu xmmword [esi + 0x18], xmm0
mov eax, dword [ebp - 0x70]
mov dword [esi], eax
mov dword [esi + 0xc], 0
mov dword [esi + 4], 0x10
pxor xmm0, xmm0
movdqu xmmword [0x68986c], xmm0
movdqu xmmword [0x68987c], xmm0
movdqu xmmword [0x68988c], xmm0
movdqu xmmword [0x68989c], xmm0
movdqu xmmword [0x6898ac], xmm0
movdqu xmmword [0x6898bc], xmm0
movdqu xmmword [0x6898c8], xmm0
mov ecx, dword [ebp - 0x74]
push esi
push eax
push edi
call fcn.005a44e2
mov ebx, eax
test eax, eax
jne 0x5a4281
lea eax, [ebp - 0x64]
mov dword [eax], 0xffffffff
push eax
push 0x10
push esi
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, 0x2a
test eax, eax
je 0x5a4281
cmp dword [ebp - 0x64], 0x10
jne 0x5a4281
lea eax, [ebp - 0x68]
mov dword [eax], 0xffffffff
push eax
push 0x20
push dword [ebp - 0x70]
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push 0x6c
push 0x68986c
push str.g_originals
call fcn.0057cbdc
mov ebx, eax
jmp 0x5a4281
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3
Function at 0x5a52ce
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0x2c]
mov eax, dword [ebp + 8]
mov ecx, dword [0x674014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov dword [edx], 0xffffffff
mov esi, 5
cmp eax, 3
jne 0x5a536f
mov edx, dword [ebp + 0x28]
mov esi, dword [ebp + 0x10]
cmp byte [esi + 0xb], 0
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
jns 0x5a5312
mov esi, dword [esi]
mov ebx, dword [ebx]
push 0
push edx
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
je 0x5a535c
mov esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
push 3
push edi
push edi
lea ecx, [ebp - 0x14]
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb edi, edi
lea eax, [ebp - 0x14]
or edi, dword [eax]
jmp 0x5a535f
xor edi, edi
dec edi
mov eax, dword [ebp + 0x2c]
mov dword [eax], edi
xor eax, eax
cmp edi, 0xffffffff
sete al
lea esi, [eax + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5aae2a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
lea edi, [ebp - 0x18]
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [eax], 4
push eax
push edi
push esi
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x5aae74
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5aaf20
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0xdc], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov dword [esi + 0x20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x14], 0x100
jb 0x5aafa7
push 1
call fcn.004b68d0
add esp, 4
test al, al
je 0x5aafa7
lea esi, [esp + 0xc]
mov ecx, esi
push 1
push 0x10a
push str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
call fcn.004b6940
lea eax, [esp + 0x14]
push 0x2c
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.0041482a
add esp, 0xc
mov ecx, esi
call fcn.004b6d50
mov eax, dword [esp + 0xc4]
cmp eax, 0x100
mov ebx, 0xff
cmovb ebx, eax
mov ecx, dword [esp + 0xdc]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
Function at 0x5c4a72
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov ebx, ecx
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.004139f8
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.005d03bc
test al, al
je 0x5c4b38
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x5c4b71
mov ecx, edi
call fcn.004139f8
mov edi, eax
mov eax, dword [esp + 0xec]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0x108
push esi
push edi
call fcn.005d03bc
test al, al
je 0x5c4ba7
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x5c4bd9
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x5c4c33
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x5c4c33
push 1
call fcn.004b68d0
add esp, 4
test al, al
je 0x5c4c31
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004b6940
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_dos_header_from
jmp 0x5c4c09
push 1
call fcn.004b68d0
add esp, 4
test al, al
je 0x5c4c31
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004b6940
lea eax, [esp + 0x14]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x5c4c09
push 1
call fcn.004b68d0
add esp, 4
test al, al
je 0x5c4c31
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004b6940
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x5c4c09
push 1
call fcn.004b68d0
add esp, 4
test al, al
je 0x5c4c31
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004b6940
lea eax, [esp + 0x14]
push 0x23
push str.invalid_signature_in_nt_headers_of
push eax
call fcn.0041482a
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x5c4c1f
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
push ecx
push ebx
push eax
call fcn.0041482a
add esp, 0xc
mov ecx, edi
call fcn.004b6d50
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x5c4c4e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov ebx, ecx
mov eax, dword [0x674014]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.004139f8
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.005d03bc
test al, al
je 0x5c4d14
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x5c4d4d
mov ecx, edi
call fcn.004139f8
mov edi, eax
mov eax, dword [esp + 0xec]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0xf8
push esi
push edi
call fcn.005d03bc
test al, al
je 0x5c4d83
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x5c4db5
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x5c4e0f
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x5c4e0f
push 1
call fcn.004b68d0
add esp, 4
test al, al
je 0x5c4e0d
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004b6940
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_dos_header_from
jmp 0x5c4de5
push 1
call fcn.004b68d0
add esp, 4
test al, al
je 0x5c4e0d
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004b6940
lea eax, [esp + 0x14]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x5c4de5
push 1
call fcn.004b68d0
add esp, 4
test al, al
je 0x5c4e0d
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004b6940
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x5c4de5
push 1
call fcn.004b68d0
add esp, 4
test al, al
je 0x5c4e0d
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004b6940
lea eax, [esp + 0x14]
push 0x23
push str.invalid_signature_in_nt_headers_of
push eax
call fcn.0041482a
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x5c4dfb
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
push ecx
push ebx
push eax
call fcn.0041482a
add esp, 0xc
mov ecx, edi
call fcn.004b6d50
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x5cad1e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x20]
mov ebx, dword [ebp + 8]
movups xmm0, xmmword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
xor edx, edx
mov dword [edi], edx
mov ecx, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], eax
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x5cad7d
mov esi, eax
mov ebx, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 3
xor ecx, ecx
push ecx
push ecx
push edi
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [ecx + ecx*4]
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x5d52d2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp edx, 0x33ff
jg 0x5d52fd
add edx, edx
movzx eax, dx
movzx edx, word [ecx]
cmp eax, edx
jbe 0x5d534a
and edx, 1
lea ecx, [ecx + edx*2]
add ecx, 4
jmp 0x5d52eb
mov esi, edx
shr esi, 9
add esi, 0x3400
and esi, 0xfffe
shl edx, 6
xor eax, eax
dec eax
movzx ebx, word [ecx]
cmp esi, ebx
jbe 0x5d5325
and ebx, 1
or ebx, 2
mov edi, ebx
jmp 0x5d5345
mov edi, ebx
and edi, 0x7ffe
cmp esi, edi
jne 0x5d5381
movzx edi, word [ecx + 2]
cmp di, dx
jae 0x5d536b
mov edi, 3
bt ebx, 0xf
jb 0x5d5381
lea ecx, [ecx + edi*2]
jmp 0x5d5314
mov ebx, edx
and ebx, 0x7ffe
cmp eax, ebx
jne 0x5d5366
movzx eax, word [ecx + 2]
test dl, 1
je 0x5d5381
shl eax, 0x10
mov edi, eax
jmp 0x5d537b
xor eax, eax
dec eax
jmp 0x5d5381
xor edx, edi
test edx, 0xffc0
jne 0x5d5381
and edi, 0x3f
shl edi, 0x10
movzx eax, word [ecx + 4]
or eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5ec237
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005ec3da
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x5ec3af
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x5ec3af
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x5ec35e
jg 0x5ec290
test eax, eax
je 0x5ec354
push 1
push 0x1000
call fcn.004d20c0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x5ec2b6
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x5ec34b
push 0x8000
push ebx
call fcn.005f1503
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x5ec2e2
jg 0x5ec2dd
cmp ecx, 0x1000
jb 0x5ec2e2
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.005f4940
add esp, 0x10
cmp eax, 0xffffffff
je 0x5ec327
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x5ec2dd
jl 0x5ec30e
test ecx, ecx
jne 0x5ec2cf
push dword [ebp - 0xc]
push ebx
call fcn.005f1503
push esi
call fcn.004d2040
add esp, 0xc
xor edi, edi
jmp 0x5ec3c0
cmp byte [edi + 0x24], 0
je 0x5ec33e
cmp dword [edi + 0x20], 5
jne 0x5ec33e
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x5ec349
mov edi, dword [edi + 0x18]
jmp 0x5ec34b
xor edi, edi
push esi
call fcn.004d2040
pop ecx
jmp 0x5ec3c0
test ecx, ecx
jg 0x5ec320
jl 0x5ec35e
test eax, eax
jae 0x5ec320
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005fe020
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x5ec381
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x5ec320
jmp 0x5ec3b8
push ebx
call fcn.005ef7ba
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x5ec320
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x5ec3c0
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x5ec3bd
mov edi, dword [edi + 0x18]
jmp 0x5ec3c0
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.005fe020
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret