joyce8/EMBER2024-capa huggingface dataset:
Function at 0x560930
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x30]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x20]
push 0x7e
push str....._base_files_file_util_win.cc
push str.DoCopyFile
push esi
call fcn.004cfec0
add esp, 0x10
mov ecx, ebx
mov ebx, edi
push 0
push esi
call fcn.004da750
mov ecx, edi
call fcn.004cf5f0
test al, al
jne 0x5609aa
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.004cf5f0
test al, al
je 0x5609ca
xor ebx, ebx
lea ecx, [esp + 0x30]
call fcn.004da7d0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0050dc12
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebx + 0xb], 0
jns 0x5609d9
cmp dword [ebx + 4], 0x103
ja 0x5609aa
cmp byte [edi + 0xb], 0
jns 0x5609e8
cmp dword [edi + 4], 0x103
ja 0x5609aa
mov dword [esp + 8], ebx
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x8b
push str....._base_files_file_util_win.cc
push str.DoCopyFile
push esi
call fcn.004cfec0
add esp, 0x10
mov ecx, ebx
push 0x5fa064
push esi
mov esi, edi
call fcn.0048a8e0
cmp byte [edi + 0xb], 0
jns 0x560a2b
mov esi, dword [esi]
mov ecx, dword [esp + 8]
mov al, byte [ebp + 8]
movzx eax, al
cmp byte [ecx + 0xb], 0
jns 0x560a3d
mov ecx, dword [ecx]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x560a80
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x560a6c
mov eax, edi
and eax, 1
je 0x560a6c
mov eax, edi
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
setne bl
lea ecx, [esp + 0x20]
call fcn.0048aa00
jmp 0x5609ac
xor ebx, ebx
jmp 0x560a72
Function at 0x560a90
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov edi, dword [ebp + 8]
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x10]
push 0x438
push str....._base_files_file_util_win.cc
push str.MoveUnsafe
push ebx
call fcn.004cfec0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004da750
mov al, byte [edi + 0xb]
test al, al
jns 0x560b1b
cmp dword [edi + 4], 0x103
jbe 0x560b1b
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.004da7d0
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0050dc12
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0xc]
mov dl, byte [esi + 0xb]
test dl, dl
jns 0x560b2e
cmp dword [esi + 4], 0x103
ja 0x560afb
mov ecx, esi
test dl, dl
jns 0x560b36
mov ecx, dword [esi]
mov edx, edi
test al, al
jns 0x560b3e
mov edx, dword [edi]
push 3
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x560afd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
push edi
call fcn.00464bd0
add esp, 4
test al, al
jne 0x560b71
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x560afb
push esi
push edi
call fcn.00560b90
add esp, 8
test al, al
jne 0x560afd
jmp 0x560b65
Function at 0x561cd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x561d42
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x561d46
cmp byte [ebp + 0xc], 0
je 0x561d22
cmp byte [esi + 4], 0
je 0x561d97
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, esi
push edi
call fcn.00468950
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050dc12
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [esi]
jmp 0x561cf4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x561d6c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x561d70
xor ebx, ebx
jmp 0x561d2c
mov eax, dword [esi]
jmp 0x561d58
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x561d9e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x561d22
mov edi, dword [ebp - 0x14]
jmp 0x561d22
mov eax, dword [esi]
jmp 0x561d16
mov eax, dword [esi]
jmp 0x561d83
Function at 0x579a90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp esi, ebx
je 0x579ae2
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.00579450
test al, al
jne 0x579acf
add esi, 0x58
cmp esi, ebx
jne 0x579aba
mov esi, ebx
mov eax, dword [ebp - 0x24]
cmp esi, dword [eax + 0x2c]
je 0x579ae2
cmp byte [esi + 0x1b], 0
jns 0x579af9
mov eax, dword [esi + 0x10]
jmp 0x579afc
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050dc12
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x579ae5
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x579ae5

Function at 0x579c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp edi, ebx
je 0x579cad
mov dword [ebp - 0x24], ecx
lea esi, [ebp - 0x20]
mov ecx, edi
push esi
call fcn.00579450
test al, al
jne 0x579c8f
add edi, 0x58
cmp edi, ebx
jne 0x579c7a
mov edi, ebx
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x24]
cmp edi, dword [esi + 0x2c]
je 0x579cb0
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x579cc4
cmp byte [edi + 0x1b], 0
jns 0x579cd2
mov eax, dword [edi + 0x10]
jmp 0x579cd5
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050dc12
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
jmp 0x579cb0
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x579cb0
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x579cb0
mov byte [esi + 0x24], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor ebx, ebx
jmp 0x579cb0
Function at 0x58dfe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x5f3024]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov edi, dword [ecx + eax*4]
mov ebx, dword [edi + 0x28]
mov ecx, edi
lea eax, [ebp - 0x1c]
push eax
call fcn.00553fc0
mov ecx, esi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.005096a0
mov ecx, eax
xor ecx, dword [esi + 8]
mov eax, ecx
mov edx, 0x7f4a7c15
mul edx
imul eax, ecx, 0x9e3779b9
add eax, edx
mov edx, dword [esi + 4]
dec edx
and edx, eax
mov ecx, esi
push edi
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.0058dbb0
mov edi, ebx
test ebx, ebx
jne 0x58dfff
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050dc12
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x58e060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x5f3024]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx]
lea edx, [ebp - 0x14]
mov dword [edx], eax
mov dword [ebp - 0x24], ecx
add ecx, 4
mov dword [ebp - 0x28], ecx
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0x18]
lea ebx, [ebp - 0x20]
push ebx
call fcn.00553fc0
mov ecx, edi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.005096a0
mov ecx, eax
xor ecx, dword [edi + 8]
mov eax, ecx
mov edx, 0x7f4a7c15
mul edx
imul eax, ecx, 0x9e3779b9
add eax, edx
mov edx, dword [edi + 4]
dec edx
and edx, eax
mov ecx, edi
push esi
push edx
push ebx
call fcn.0058dbb0
lea ecx, [ebp - 0x14]
call fcn.004789d0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jne 0x58e08f
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x58e0ee
cmp dword [edi + 0x14], 0
je 0x58e102
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050dc12
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, esi
push dword [esi + 4]
call fcn.0058d870
push esi
call fcn.0050d60e
add esp, 4
jmp 0x58e0ee
Function at 0x592af0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x592b13
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x592b38
mov ebx, eax
cmp byte [ebp + 0xc], 0
jne 0x592b30
mov eax, ebx
and eax, 0x400
jne 0x592b46
and ebx, 0x10
shr ebx, 4
jmp 0x592b48
push 2
call fcn.004cff00
add esp, 4
test al, al
jne 0x592b5f
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050dc12
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0055ae80
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x82
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0055afc0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0053f2f0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x592ba3
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x592ba6
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.004d9bb0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x592bcd
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x592bd0
and eax, 0x7f
push eax
push ebx
push esi
call fcn.0053f2f0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x592bf2
push dword [ebp - 0xc4]
call fcn.0050d60e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0055b020
jmp 0x592b46
Function at 0x592c10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x592c33
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
je 0x592c59
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050dc12
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp + 0x10], 0
je 0x592c6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x592cbf
push 2
call fcn.004cff00
add esp, 4
test al, al
jne 0x592c7e
xor ebx, ebx
jmp 0x592c42
call fcn.0055ae80
lea ecx, [ebp - 0xc4]
push eax
push 2
push 0x62
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0055afc0
lea eax, [ebp - 0xbc]
push 0x10
push str.CreateDirectory
push eax
call fcn.0053f2f0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x592d03
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x592d06
push 1
push edi
call fcn.00592af0
add esp, 8
test al, al
jne 0x592c42
push 2
call fcn.004cff00
add esp, 4
test al, al
je 0x592c7a
lea ecx, [ebp - 0xc4]
push 2
push 0x5d
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00458910
movzx eax, byte [edi + 0xb]
test al, al
jns 0x592d53
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x592d56
and eax, 0x7f
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.004d9bb0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x592d24
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
jmp 0x592d27
and eax, 0x7f
push eax
push ebx
push esi
call fcn.0053f2f0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x592d43
push dword [ebp - 0x1c]
call fcn.0050d60e
add esp, 4
lea ecx, [ebp - 0xc4]
call fcn.0055b020
jmp 0x592c7a
and eax, 0x7f
lea esi, [ebp - 0xbc]
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.004d9bb0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x592d7a
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
jmp 0x592d7d
and eax, 0x7f
push eax
push ebx
push esi
call fcn.0053f2f0
add esp, 0xc
push 0x10
push str._not_a_directory
push eax
call fcn.0053f2f0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x592da9
push dword [ebp - 0x1c]
call fcn.0050d60e
add esp, 4
lea ecx, [ebp - 0xc4]
call fcn.00458d50
jmp 0x592c7a
Function at 0x592dc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x592de3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x592e0e
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050dc12
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004cff00
add esp, 4
test al, al
jne 0x592e20
xor ebx, ebx
jmp 0x592df7
call fcn.0055ae80
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x75
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0055afc0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.0053f2f0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x592e61
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x592e64
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.004d9bb0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x592e8b
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x592e8e
and eax, 0x7f
push eax
push ebx
push esi
call fcn.0053f2f0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x592eb0
push dword [ebp - 0xc4]
call fcn.0050d60e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0055b020
jmp 0x592e1c
Function at 0x592ec0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, dword [ebp + 8]
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x592ee3
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x592efb
and eax, 0x410
cmp eax, 0x410
je 0x592f3b
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x592f05
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
je 0x592f29
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050dc12
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004cff00
add esp, 4
test al, al
jne 0x592f56
xor ebx, ebx
jmp 0x592f12
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050dc12
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00593000
call fcn.0055ae80
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x95
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0055afc0
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.0053f2f0
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x592f9a
mov eax, dword [esi + 4]
mov esi, dword [esi]
jmp 0x592f9d
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.004d9bb0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x592fc4
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x592fc7
and eax, 0x7f
push eax
push ebx
push edi
call fcn.0053f2f0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x592fe9
push dword [ebp - 0xc4]
call fcn.0050d60e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0055b020
jmp 0x592f37
Function at 0x593000
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, ecx
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x593022
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x59303d
push 2
call fcn.004cff00
add esp, 4
test al, al
jne 0x593059
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050dc12
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0055ae80
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x30
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0055afc0
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.0053f2f0
add esp, 0xc
movzx ecx, byte [edi + 0xb]
test cl, cl
mov dword [ebp - 0xc8], eax
jns 0x59309e
mov ecx, dword [edi + 4]
mov edi, dword [edi]
jmp 0x5930a1
and ecx, 0x7f
lea ebx, [ebp - 0xc4]
push ecx
push edi
push ebx
call fcn.004d9bb0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x5930c8
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x5930cb
and eax, 0x7f
mov ecx, dword [ebp - 0xc8]
push eax
push ebx
push ecx
call fcn.0053f2f0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x5930f3
push dword [ebp - 0xc4]
call fcn.0050d60e
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0055b020
jmp 0x59303d

Function at 0x595a70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, edx
mov edi, ecx
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x18], eax
add esi, edi
cmp edi, esi
jae 0x595aca
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, esi
sub eax, edi
push ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete dl
mov ecx, dword [ebp - 0x14]
test ecx, ecx
sete al
or al, dl
jne 0x595ac4
mov ebx, ecx
add edi, ebx
cmp al, 1
jne 0x595a94
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050dc12
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x59d2e0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00592ec0
Function at 0x59f710
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
lea edi, [ebp - 0x18]
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [eax], 4
push eax
push edi
push esi
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x59f75a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050dc12
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x59f800
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [esp + 0xdc], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov dword [esi + 0x20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x14], 0x100
jb 0x59f855
push 1
call fcn.004cff00
add esp, 4
test al, al
jne 0x59f880
mov eax, dword [esp + 0xc4]
cmp eax, 0x100
mov ebx, 0xff
cmovb ebx, eax
mov ecx, dword [esp + 0xdc]
xor ecx, ebp
call fcn.0050dc12
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
lea esi, [esp + 0xc]
mov ecx, esi
push 1
push 0x114
push str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
call fcn.00458910
lea eax, [esp + 0x14]
push 0x2c
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.0053f2f0
add esp, 0xc
mov ecx, esi
call fcn.00458d50
jmp 0x59f855
Function at 0x5a9920
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov ebx, ecx
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.0053f170
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.005ad9f0
test al, al
je 0x5a99df
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x5a9a0d
mov ecx, edi
call fcn.0053f170
mov edi, eax
mov eax, dword [esp + 0xec]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0x108
push esi
push edi
call fcn.005ad9f0
test al, al
je 0x5a9a42
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x5a9a74
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x5a99f3
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x5a99f3
push 1
call fcn.004cff00
add esp, 4
test al, al
jne 0x5a9aaa
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.0050dc12
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.004cff00
add esp, 4
test al, al
je 0x5a99f1
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.00458910
lea eax, [esp + 0x14]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x5a9acc
push 1
call fcn.004cff00
add esp, 4
test al, al
je 0x5a99f1
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.00458910
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x5a9acc
push 1
call fcn.004cff00
add esp, 4
test al, al
je 0x5a99f1
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.00458910
lea eax, [esp + 0x14]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x5a9acc
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.00458910
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.0053f2f0
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x5a9ae4
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
jmp 0x5a9ae7
and ecx, 0x7f
push ecx
push ebx
push eax
call fcn.0053f2f0
add esp, 0xc
mov ecx, edi
call fcn.00458d50
jmp 0x5a99f1