joyce8/EMBER2024-capa huggingface dataset:
Function at 0x560850
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x30]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x20]
push 0x7e
push str....._base_files_file_util_win.cc
push str.DoCopyFile
push esi
call fcn.004cfde0
add esp, 0x10
mov ecx, ebx
mov ebx, edi
push 0
push esi
call fcn.004da670
mov ecx, edi
call fcn.004cf510
test al, al
jne 0x5608ca
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.004cf510
test al, al
je 0x5608ea
xor ebx, ebx
lea ecx, [esp + 0x30]
call fcn.004da6f0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebx + 0xb], 0
jns 0x5608f9
cmp dword [ebx + 4], 0x103
ja 0x5608ca
cmp byte [edi + 0xb], 0
jns 0x560908
cmp dword [edi + 4], 0x103
ja 0x5608ca
mov dword [esp + 8], ebx
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x8b
push str....._base_files_file_util_win.cc
push str.DoCopyFile
push esi
call fcn.004cfde0
add esp, 0x10
mov ecx, ebx
push 0x5fa054
push esi
mov esi, edi
call fcn.0048a760
cmp byte [edi + 0xb], 0
jns 0x56094b
mov esi, dword [esi]
mov ecx, dword [esp + 8]
mov al, byte [ebp + 8]
movzx eax, al
cmp byte [ecx + 0xb], 0
jns 0x56095d
mov ecx, dword [ecx]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x5609a0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x56098c
mov eax, edi
and eax, 1
je 0x56098c
mov eax, edi
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
setne bl
lea ecx, [esp + 0x20]
call fcn.0048a880
jmp 0x5608cc
xor ebx, ebx
jmp 0x560992
Function at 0x5609b0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov edi, dword [ebp + 8]
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x10]
push 0x438
push str....._base_files_file_util_win.cc
push str.MoveUnsafe
push ebx
call fcn.004cfde0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004da670
mov al, byte [edi + 0xb]
test al, al
jns 0x560a3b
cmp dword [edi + 4], 0x103
jbe 0x560a3b
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.004da6f0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0xc]
mov dl, byte [esi + 0xb]
test dl, dl
jns 0x560a4e
cmp dword [esi + 4], 0x103
ja 0x560a1b
mov ecx, esi
test dl, dl
jns 0x560a56
mov ecx, dword [esi]
mov edx, edi
test al, al
jns 0x560a5e
mov edx, dword [edi]
push 3
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x560a1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
push edi
call fcn.00464af0
add esp, 4
test al, al
jne 0x560a91
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x560a1b
push esi
push edi
call fcn.00560ab0
add esp, 8
test al, al
jne 0x560a1d
jmp 0x560a85
Function at 0x561bf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x561c62
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x561c66
cmp byte [ebp + 0xc], 0
je 0x561c42
cmp byte [esi + 4], 0
je 0x561cb7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, esi
push edi
call fcn.00468870
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [esi]
jmp 0x561c14
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x561c8c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x561c90
xor ebx, ebx
jmp 0x561c4c
mov eax, dword [esi]
jmp 0x561c78
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x561cbe
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x561c42
mov edi, dword [ebp - 0x14]
jmp 0x561c42
mov eax, dword [esi]
jmp 0x561c36
mov eax, dword [esi]
jmp 0x561ca3
Function at 0x5799b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp esi, ebx
je 0x579a02
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.00579370
test al, al
jne 0x5799ef
add esi, 0x58
cmp esi, ebx
jne 0x5799da
mov esi, ebx
mov eax, dword [ebp - 0x24]
cmp esi, dword [eax + 0x2c]
je 0x579a02
cmp byte [esi + 0x1b], 0
jns 0x579a19
mov eax, dword [esi + 0x10]
jmp 0x579a1c
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x579a05
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x579a05

Function at 0x579b70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp edi, ebx
je 0x579bcd
mov dword [ebp - 0x24], ecx
lea esi, [ebp - 0x20]
mov ecx, edi
push esi
call fcn.00579370
test al, al
jne 0x579baf
add edi, 0x58
cmp edi, ebx
jne 0x579b9a
mov edi, ebx
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x24]
cmp edi, dword [esi + 0x2c]
je 0x579bd0
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x579be4
cmp byte [edi + 0x1b], 0
jns 0x579bf2
mov eax, dword [edi + 0x10]
jmp 0x579bf5
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
jmp 0x579bd0
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x579bd0
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x579bd0
mov byte [esi + 0x24], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor ebx, ebx
jmp 0x579bd0
Function at 0x58df00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x5f3024]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov edi, dword [ecx + eax*4]
mov ebx, dword [edi + 0x28]
mov ecx, edi
lea eax, [ebp - 0x1c]
push eax
call fcn.00553ee0
mov ecx, esi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.005095c0
mov ecx, eax
xor ecx, dword [esi + 8]
mov eax, ecx
mov edx, 0x7f4a7c15
mul edx
imul eax, ecx, 0x9e3779b9
add eax, edx
mov edx, dword [esi + 4]
dec edx
and edx, eax
mov ecx, esi
push edi
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.0058dad0
mov edi, ebx
test ebx, ebx
jne 0x58df1f
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x58df80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x5f3024]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx]
lea edx, [ebp - 0x14]
mov dword [edx], eax
mov dword [ebp - 0x24], ecx
add ecx, 4
mov dword [ebp - 0x28], ecx
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0x18]
lea ebx, [ebp - 0x20]
push ebx
call fcn.00553ee0
mov ecx, edi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.005095c0
mov ecx, eax
xor ecx, dword [edi + 8]
mov eax, ecx
mov edx, 0x7f4a7c15
mul edx
imul eax, ecx, 0x9e3779b9
add eax, edx
mov edx, dword [edi + 4]
dec edx
and edx, eax
mov ecx, edi
push esi
push edx
push ebx
call fcn.0058dad0
lea ecx, [ebp - 0x14]
call fcn.00478850
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jne 0x58dfaf
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x58e00e
cmp dword [edi + 0x14], 0
je 0x58e022
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, esi
push dword [esi + 4]
call fcn.0058d790
push esi
call fcn.0050d52e
add esp, 4
jmp 0x58e00e
Function at 0x592a10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x592a33
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x592a58
mov ebx, eax
cmp byte [ebp + 0xc], 0
jne 0x592a50
mov eax, ebx
and eax, 0x400
jne 0x592a66
and ebx, 0x10
shr ebx, 4
jmp 0x592a68
push 2
call fcn.004cfe20
add esp, 4
test al, al
jne 0x592a7f
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0055ada0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x82
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0055aee0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0053f210
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x592ac3
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x592ac6
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.004d9ad0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x592aed
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x592af0
and eax, 0x7f
push eax
push ebx
push esi
call fcn.0053f210
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x592b12
push dword [ebp - 0xc4]
call fcn.0050d52e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0055af40
jmp 0x592a66
Function at 0x592b30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x592b53
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
je 0x592b79
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp + 0x10], 0
je 0x592b8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x592bdf
push 2
call fcn.004cfe20
add esp, 4
test al, al
jne 0x592b9e
xor ebx, ebx
jmp 0x592b62
call fcn.0055ada0
lea ecx, [ebp - 0xc4]
push eax
push 2
push 0x62
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0055aee0
lea eax, [ebp - 0xbc]
push 0x10
push str.CreateDirectory
push eax
call fcn.0053f210
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x592c23
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x592c26
push 1
push edi
call fcn.00592a10
add esp, 8
test al, al
jne 0x592b62
push 2
call fcn.004cfe20
add esp, 4
test al, al
je 0x592b9a
lea ecx, [ebp - 0xc4]
push 2
push 0x5d
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00458830
movzx eax, byte [edi + 0xb]
test al, al
jns 0x592c73
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x592c76
and eax, 0x7f
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.004d9ad0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x592c44
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
jmp 0x592c47
and eax, 0x7f
push eax
push ebx
push esi
call fcn.0053f210
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x592c63
push dword [ebp - 0x1c]
call fcn.0050d52e
add esp, 4
lea ecx, [ebp - 0xc4]
call fcn.0055af40
jmp 0x592b9a
and eax, 0x7f
lea esi, [ebp - 0xbc]
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.004d9ad0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x592c9a
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
jmp 0x592c9d
and eax, 0x7f
push eax
push ebx
push esi
call fcn.0053f210
add esp, 0xc
push 0x10
push str._not_a_directory
push eax
call fcn.0053f210
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x592cc9
push dword [ebp - 0x1c]
call fcn.0050d52e
add esp, 4
lea ecx, [ebp - 0xc4]
call fcn.00458c70
jmp 0x592b9a
Function at 0x592ce0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x592d03
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x592d2e
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004cfe20
add esp, 4
test al, al
jne 0x592d40
xor ebx, ebx
jmp 0x592d17
call fcn.0055ada0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x75
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0055aee0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0053f210
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x592d81
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x592d84
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.004d9ad0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x592dab
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x592dae
and eax, 0x7f
push eax
push ebx
push esi
call fcn.0053f210
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x592dd0
push dword [ebp - 0xc4]
call fcn.0050d52e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0055af40
jmp 0x592d3c
Function at 0x592de0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, dword [ebp + 8]
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x592e03
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x592e1b
and eax, 0x410
cmp eax, 0x410
je 0x592e5b
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x592e25
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
je 0x592e49
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004cfe20
add esp, 4
test al, al
jne 0x592e76
xor ebx, ebx
jmp 0x592e32
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00592f20
call fcn.0055ada0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x95
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0055aee0
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.0053f210
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x592eba
mov eax, dword [esi + 4]
mov esi, dword [esi]
jmp 0x592ebd
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.004d9ad0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x592ee4
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x592ee7
and eax, 0x7f
push eax
push ebx
push edi
call fcn.0053f210
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x592f09
push dword [ebp - 0xc4]
call fcn.0050d52e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0055af40
jmp 0x592e57
Function at 0x592f20
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, ecx
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x592f42
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x592f5d
push 2
call fcn.004cfe20
add esp, 4
test al, al
jne 0x592f79
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0055ada0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x30
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0055aee0
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.0053f210
add esp, 0xc
movzx ecx, byte [edi + 0xb]
test cl, cl
mov dword [ebp - 0xc8], eax
jns 0x592fbe
mov ecx, dword [edi + 4]
mov edi, dword [edi]
jmp 0x592fc1
and ecx, 0x7f
lea ebx, [ebp - 0xc4]
push ecx
push edi
push ebx
call fcn.004d9ad0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x592fe8
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x592feb
and eax, 0x7f
mov ecx, dword [ebp - 0xc8]
push eax
push ebx
push ecx
call fcn.0053f210
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x593013
push dword [ebp - 0xc4]
call fcn.0050d52e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0055af40
jmp 0x592f5d

Function at 0x595990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, edx
mov edi, ecx
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x18], eax
add esi, edi
cmp edi, esi
jae 0x5959ea
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, esi
sub eax, edi
push ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete dl
mov ecx, dword [ebp - 0x14]
test ecx, ecx
sete al
or al, dl
jne 0x5959e4
mov ebx, ecx
add edi, ebx
cmp al, 1
jne 0x5959b4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x59d200
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00592de0
Function at 0x59f630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
lea edi, [ebp - 0x18]
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [eax], 4
push eax
push edi
push esi
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x59f67a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x59f720
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [esp + 0xdc], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov dword [esi + 0x20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x14], 0x100
jb 0x59f775
push 1
call fcn.004cfe20
add esp, 4
test al, al
jne 0x59f7a0
mov eax, dword [esp + 0xc4]
cmp eax, 0x100
mov ebx, 0xff
cmovb ebx, eax
mov ecx, dword [esp + 0xdc]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
lea esi, [esp + 0xc]
mov ecx, esi
push 1
push 0x114
push str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
call fcn.00458830
lea eax, [esp + 0x14]
push 0x2c
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.0053f210
add esp, 0xc
mov ecx, esi
call fcn.00458c70
jmp 0x59f775
Function at 0x5a9840
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov ebx, ecx
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.0053f090
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.005ad910
test al, al
je 0x5a98ff
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x5a992d
mov ecx, edi
call fcn.0053f090
mov edi, eax
mov eax, dword [esp + 0xec]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0x108
push esi
push edi
call fcn.005ad910
test al, al
je 0x5a9962
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x5a9994
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x5a9913
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x5a9913
push 1
call fcn.004cfe20
add esp, 4
test al, al
jne 0x5a99ca
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.004cfe20
add esp, 4
test al, al
je 0x5a9911
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.00458830
lea eax, [esp + 0x14]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x5a99ec
push 1
call fcn.004cfe20
add esp, 4
test al, al
je 0x5a9911
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.00458830
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x5a99ec
push 1
call fcn.004cfe20
add esp, 4
test al, al
je 0x5a9911
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.00458830
lea eax, [esp + 0x14]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x5a99ec
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.00458830
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.0053f210
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x5a9a04
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
jmp 0x5a9a07
and ecx, 0x7f
push ecx
push ebx
push eax
call fcn.0053f210
add esp, 0xc
mov ecx, edi
call fcn.00458c70
jmp 0x5a9911