joyce8/EMBER2024-capa huggingface dataset:
Function at 0x580f40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret

Function at 0x582340
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov esi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x582362
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x582397
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x5823b0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov ecx, esi
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00582470
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x582466
call fcn.006a5890
lea ecx, [ebp - 0xb0]
push eax
push 2
push 0x265
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.006a5a40
lea eax, [ebp - 0xa8]
push 0x10
push str.CreateDirectory
push eax
call fcn.005b72e0
add esp, 0xc
mov edi, eax
movsx eax, byte [esi + 0xb]
test eax, eax
jns 0x582404
mov eax, dword [esi + 4]
mov esi, dword [esi]
test eax, eax
js 0x58246d
sete cl
test esi, esi
setne dl
or dl, cl
je 0x58246d
lea ebx, [ebp - 0xbc]
push eax
push esi
push ebx
call fcn.005d89d0
add esp, 0xc
movsx eax, byte [ebx + 0xb]
test eax, eax
jns 0x582439
mov eax, dword [ebp - 0xb8]
mov ebx, dword [ebp - 0xbc]
push eax
push ebx
push edi
call fcn.005b72e0
add esp, 0xc
cmp byte [ebp - 0xb1], 0
jns 0x58245b
push dword [ebp - 0xbc]
call fcn.006507ee
add esp, 4
lea ecx, [ebp - 0xb0]
call fcn.006a5aa0
xor ebx, ebx
jmp 0x582399
ud2
Function at 0x582470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov esi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x582492
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x58251d
mov bl, 1
test al, 0x10
je 0x5824bb
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x582519
lea edi, [ebp - 0xb0]
mov ecx, edi
push 2
push 0x255
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.0053b2e0
lea eax, [ebp - 0xa8]
push 0x12
push str.GetFileAttributes
push eax
call fcn.005b72e0
add esp, 0xc
push esi
push eax
call fcn.006a6a80
add esp, 8
push 0x11
push str.:_not_a_directory
push eax
call fcn.005b72e0
add esp, 0xc
mov ecx, edi
call fcn.0053b7a0
xor ebx, ebx
jmp 0x5824a4
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x582519
call fcn.006a5890
lea edi, [ebp - 0xb0]
mov ecx, edi
push eax
push 2
push 0x251
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.006a5a40
lea eax, [ebp - 0xa8]
push 0x12
push str.GetFileAttributes
push eax
call fcn.005b72e0
add esp, 0xc
push esi
push eax
call fcn.006a6a80
add esp, 8
mov ecx, edi
call fcn.006a5aa0
jmp 0x582519
Function at 0x5835b0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.00582600
mov eax, dword [esi]
test eax, eax
je 0x583603
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x58360a
lea ecx, [ebp - 0x14]
call fcn.00582ed0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x5835e5
cmp dword [ebx + 0x50], 0
jne 0x583629
cmp byte [ebx + 0x1b], 0
js 0x58361b
lea eax, [ebx + 0x10]
jmp 0x58361e
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x58362e
add ebx, 0x58
jmp 0x5835e1
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x583654
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.006e1f00
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x583629
mov ecx, dword [ebp + 8]
push ebx
call fcn.006e1dd0
mov ecx, eax
jmp 0x58364c

Function at 0x583670
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.00582600
mov eax, dword [esi]
test eax, eax
je 0x5836c3
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x5836ca
lea ecx, [ebp - 0x14]
call fcn.00582ed0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x5836a5
cmp dword [ebx + 0x50], 2
jne 0x5836e9
cmp byte [ebx + 0x1b], 0
js 0x5836db
lea eax, [ebx + 0x10]
jmp 0x5836de
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x5836ee
add ebx, 0x58
jmp 0x5836a1
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x583714
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.006e1f00
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x5836e9
mov ecx, dword [ebp + 8]
push ebx
call fcn.006e1dd0
mov ecx, eax
jmp 0x58370c
Function at 0x5893b0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 0xb], 0
jns 0x5893c9
mov edx, dword [edx]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x5893e1
cmp byte [esi + 0x28], 1
je 0x589452
or ebx, 0x20000000
test bl, 8
jne 0x58945a
mov dword [ebp - 0x10], 0
cmp byte [esi + 0x30], 0
mov eax, 0
je 0x5893fb
mov eax, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x589409
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x18], eax
cmp byte [esi + 0x1c], 1
je 0x5894ac
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 1
je 0x5894c2
test ecx, ecx
jne 0x58947f
xor ecx, ecx
inc ecx
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x589476
test esi, esi
sete al
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
or ebx, 0x80000000
jmp 0x5893e1
cmp byte [esi + 0x34], 1
jne 0x58946b
or ebx, 0x40000000
jmp 0x5893e6
or ebx, 0x10000000
jmp 0x5893e6
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x589443
cmp ecx, 4
jne 0x58948b
mov ecx, 6
jmp 0x58942c
mov esi, ecx
add ecx, 0xfffffffe
cmp ecx, 2
jae 0x58949c
mov ecx, 7
jmp 0x58942c
cmp esi, 1
jne 0x5894a8
mov ecx, 4
jmp 0x58942c
xor ecx, ecx
jmp 0x58942c
lea ecx, [esi + 0x10]
mov dword [ebp - 0x14], edx
call fcn.0052bdf0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x589416
mov ecx, esi
mov esi, edx
call fcn.0052bdf0
mov ecx, dword [ebp + 0xc]
mov edx, esi
jmp 0x589425

Function at 0x5894e0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x58950a
cmp byte [esi + 0x28], 1
je 0x589590
or ebx, 0x20000000
test bl, 8
jne 0x58959b
xor eax, eax
cmp byte [esi + 0x30], 0
mov ecx, 0
je 0x589523
mov ecx, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x589531
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0x1c], 1
je 0x5895b7
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 1
je 0x5895cd
mov ecx, dword [ebp + 8]
cmp edx, 4
jne 0x58957f
mov edx, 6
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x5895c4
test esi, esi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov esi, edx
add edx, 0xfffffffe
cmp edx, 2
jae 0x5895dd
mov edx, 7
jmp 0x589559
or ebx, 0x80000000
jmp 0x58950a
cmp byte [esi + 0x34], 1
jne 0x5895ac
or ebx, 0x40000000
jmp 0x589513
or ebx, 0x10000000
jmp 0x589513
lea ecx, [esi + 0x10]
call fcn.0052bdf0
jmp 0x58953a
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x589570
mov ecx, esi
mov esi, edx
call fcn.0052bdf0
mov edx, esi
jmp 0x58954c
test esi, esi
jne 0x5895e9
xor edx, edx
inc edx
jmp 0x589559
cmp esi, 1
jne 0x5895f8
mov edx, 4
jmp 0x589559
xor edx, edx
jmp 0x589559
Function at 0x58aa60
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x7c2170]
mov ecx, dword [0x7ad2c4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x58abdb
mov esi, dword [0x7c2160]
lea eax, [esi + 0xc]
mov dword [ebp - 0x20], eax
push eax
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x58ac11
mov edi, esi
mov esi, dword [esi + 0x18]
test esi, esi
je 0x58ab9c
imul eax, dword [ebp + 8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0x6f47a654
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
mov ebx, edi
add ebx, 0x14
and edx, 0xf0f0f0f
imul edi, edx, 0x1010101
shr edi, 0x18
cmp edi, 1
jbe 0x58abd1
mov edx, ecx
cmp ecx, esi
jb 0x58ab39
mov eax, ecx
xor edx, edx
div esi
mov dword [ebp - 0x24], ebx
mov eax, dword [ebx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x58ab9c
mov ebx, dword [eax]
test ebx, ebx
je 0x58ab9c
cmp edi, 2
jb 0x58ac41
mov eax, dword [ebx + 4]
cmp eax, ecx
jne 0x58abb7
mov eax, dword [ebp + 8]
cmp dword [ebx + 8], eax
jne 0x58abc9
lea edi, [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
push ebx
push edi
call fcn.0058b2e0
mov esi, dword [edi]
mov dword [edi], 0
test esi, esi
je 0x58ab9c
cmp byte [ebp - 0x14], 1
jne 0x58ab93
mov eax, dword [esi + 0xc]
test eax, eax
je 0x58ab93
lock dec dword [eax + 4]
je 0x58ac1e
push esi
call fcn.006507ee
add esp, 4
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, edx
cmp eax, esi
jb 0x58abc3
xor edx, edx
div esi
mov eax, edx
mov edx, edi
cmp eax, edi
jne 0x58ab9c
mov ebx, dword [ebx]
test ebx, ebx
jne 0x58ab54
jmp 0x58ab9c
lea edx, [esi - 1]
and edx, ecx
jmp 0x58ab39
push 0x7c2170
call fcn.00650831
add esp, 4
cmp dword [0x7c2170], 0xffffffff
jne 0x58aa94
mov ecx, 0x7c2138
call fcn.0058ac60
push 0x7c2170
call fcn.006508ab
add esp, 4
jmp 0x58aa94
mov ecx, dword [ebp - 0x20]
call fcn.005d0790
jmp 0x58aaaf
push eax
call fcn.005d7070
add esp, 4
jmp 0x58ab93
and eax, esi
cmp eax, edx
jne 0x58ab9c
mov ebx, dword [ebx]
test ebx, ebx
jne 0x58ac42
jmp 0x58ab9c
dec esi
mov eax, dword [ebx + 4]
cmp eax, ecx
jne 0x58ac2c
mov eax, dword [ebp + 8]
cmp dword [ebx + 8], eax
je 0x58ab63
jmp 0x58ac36
Function at 0x59e470
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x59e481
test eax, eax
jne 0x59e4da
test eax, eax
sete al
mov ecx, dword [0x7c2210]
test ecx, ecx
setne dl
and dl, al
cmp dl, 1
jne 0x59e4a0
call dword [0x7a29f4]
call ecx
cmp dword [0x7c2208], 0
je 0x59e4da
mov esi, dword [0x7c220c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x59e4e0
test esi, esi
je 0x59e4da
mov ecx, dword [0x7c2208]
call dword [0x7a29f4]
push esi
call ecx
add esp, 4
pop esi
pop edi
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x59e4c8
jmp 0x59e4da

Function at 0x5a1750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x7a9040]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, SysReAllocString
cmp edx, 0x7fffffff
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5a17af
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x5a17ac
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
int3
xor esi, esi
dec esi
jmp 0x5a179a

Function at 0x5a17c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x7a9040]
xor ecx, ebp
mov esi, SysReAllocString
cmp eax, 0x7fffffff
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push edx
mov edi, ebx
push ebx
mov esi, ecx
call ecx
test eax, eax
je 0x5a1843
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x5a182d
cmp ebx, 0xffffffff
je 0x5a1840
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x5a1855
mov ebx, dword [ebp - 0x14]
jmp 0x5a1819
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x5a1819
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov ecx, esi
mov esi, dword [ebp - 0x18]
jmp 0x5a17f6
Function at 0x5a1ca0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xa4
mov esi, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.005a1b90
add esp, 0x10
or edx, eax
jne 0x5a1cd7
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x5a1ced
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0xa4
pop esi
pop ebx
pop ebp
ret
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x5a1d37
call fcn.006a5890
lea esi, [ebp - 0xac]
mov ecx, esi
push eax
push 2
push 0xfc
push str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
call fcn.006a5a40
lea eax, [ebp - 0xa4]
push 0xc
push 0x793bda
push eax
call fcn.005b72e0
add esp, 0xc
mov ecx, esi
call fcn.006a5aa0
xor ebx, ebx
jmp 0x5a1cd7
Function at 0x5a7cc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x7c2c34]
mov ecx, dword [0x7ad2c4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x5a7d2a
mov ecx, 0x7c2c2c
call fcn.00564540
test eax, eax
jne 0x5a7d1d
push 4
call fcn.006507be
add esp, 4
mov edi, eax
mov dword [eax], 0
mov ecx, 0x7c2c2c
call fcn.00564540
mov esi, eax
mov ecx, 0x7c2c2c
push edi
call fcn.005645e0
test esi, esi
jne 0x5a7d6d
mov ecx, 0x7c2c2c
pop esi
pop edi
pop ebp
jmp fcn.00564540
push 0x7c2c34
call fcn.00650831
add esp, 4
cmp dword [0x7c2c34], 0xffffffff
jne 0x5a7ce2
xor eax, eax
mov dword [0x7c2c30], eax
mov dword [0x7c2c2c], eax
mov ecx, 0x7c2c2c
push 0x47e340
call fcn.00564620
push 0x7c2c34
call fcn.006508ab
add esp, 4
jmp 0x5a7ce2
push esi
call fcn.006507ee
add esp, 4
jmp 0x5a7d1d
Function at 0x5b1fb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x80
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 8], eax
cmp byte [ecx + 0xb], 0
js 0x5b204e
je 0x5b203b
xorps xmm0, xmm0
movups xmmword [ebp - 0x18], xmm0
movups xmmword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x38], xmm0
movups xmmword [ebp - 0x48], xmm0
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x5c], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x5c]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x5b203b
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call esi
sub esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00650d60
add esp, 0x80
pop esi
pop ebp
ret
cmp dword [ecx + 4], 0
je 0x5b203b
xorps xmm0, xmm0
movups xmmword [ebp - 0x18], xmm0
movups xmmword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x38], xmm0
movups xmmword [ebp - 0x48], xmm0
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x5c], 0x44
mov ecx, dword [ecx]
jmp 0x5b1fee

Function at 0x5b20b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push eax
push ecx
push 0x5b2130
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x5b20ee
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00650d60
add esp, 0x18
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x20]
push 0x1b
push str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
push str.Start
push edi
call fcn.005e4620
add esp, 0x10
lea esi, [ebp - 0x10]
push edi
push esi
call fcn.006a7d20
add esp, 8
mov ecx, esi
push 0x78a8dc
call fcn.00686250
mov ecx, esi
call fcn.006a7dc0
jmp 0x5b20dd
Function at 0x5c4a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x5c4ade
movq xmm4, qword [0x73b0c0]
movdqa xmm5, xmmword [0x73b0d0]
nop word cs:[eax + eax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm6
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
movdqu xmm6, xmmword [ecx]
pxor xmm0, xmm6
movdqu xmm6, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm6, xmmword [ecx + 0x20]
pxor xmm2, xmm6
movdqu xmm6, xmmword [ecx + 0x30]
pxor xmm1, xmm6
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x5c4a60
movq xmm4, qword [0x73b0e0]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
pmovzxdq xmm3, qword [0x73b120]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x5c4b63
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x5c4b3c
pmovzxdq xmm1, qword [0x73b120]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x73b0f0], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x73b100], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x73b110], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret
Function at 0x5c6380
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x5c63b5
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x5c63bc
lea eax, [ebx + 1]
cmp eax, 2
jb 0x5c63ae
mov dword [esi], ebx
call fcn.005e4650
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005e4650
push dword [esi]
call fcn.005cf200
add esp, 4
mov dword [esi], 0
jmp 0x5c639f
Function at 0x5cf0b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x7b2470]
mov ecx, dword [0x7ad2c4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x5cf100
mov esi, dword [0x7b246c]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x7b2470
call fcn.00650831
add esp, 4
cmp dword [0x7b2470], 0xffffffff
jne 0x5cf0e3
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.006547d0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x58
call fcn.006507be
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x7b24a0]
mov ecx, dword [0x7ad2c4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x5cf1a9
mov ecx, esi
push ebx
push 0x7b247c
push edi
call fcn.00525660
mov dword [0x7b246c], esi
push 0x7b2470
call fcn.006508ab
add esp, 4
jmp 0x5cf0e3
push 0x7b24a0
call fcn.00650831
add esp, 4
cmp dword [0x7b24a0], 0xffffffff
jne 0x5cf183
xorps xmm0, xmm0
movups xmmword [0x7b248c], xmm0
movups xmmword [0x7b247c], xmm0
mov dword [0x7b249c], 0
push 0x7b247c
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x7b24a0
call fcn.006508ab
add esp, 4
jmp 0x5cf183