joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52a090
Capabilities:
Enumerate pe sections

Disassembly:
je 0x52a693
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.00529e9a
push ebx
add eax, 0xb70f335c
inc edi
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.00529e9a
in al, dx
aas
push esp
push ss
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x52a0f4
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x52a0ee
mov dword [ebp - 8], eax
invalid
invalid

Function at 0x52a200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp eax, 0x88e8458d
pop ebp
call 0xe9b02a5b
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00529eaa
push eax
push esi
push dword [ebp + 8]
call fcn.00529e5f
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
inc ecx

Function at 0x52a2c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00529eaa
push eax
push esi
push dword [ebp + 8]
call fcn.00529e5f
add esp, 0x30
invalid
invalid
dec eax
Function at 0x52ad90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00529e78
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
invalid
Function at 0x52c050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ch, 0x88
stc
invalid
inc eax
or al, 0x8b
jo 0x52c071
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x52c05e
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00529e9a
aas
stc
and dword [ebx + ecx*4], eax
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
push esp
pop es
js 0x52c078
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.00529e9a
jns 0x52c015
xor eax, 0x348b49d6
mov eax, dword [ebx]
idiv dword [eax + 0x50746547]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x52c087
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x52c087
call fcn.00529e9a
cdq
invalid

Function at 0x530f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x591014]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov edi, dword [ecx + eax*4]
mov ebx, dword [edi + 0x28]
mov ecx, edi
lea eax, [ebp - 0x1c]
push eax
call fcn.0049cd80
mov ecx, esi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.004c2e40
mov ecx, eax
xor ecx, dword [esi + 8]
mov eax, ecx
mov edx, 0x7f4a7c15
mul edx
imul eax, ecx, 0x9e3779b9
add eax, edx
mov edx, dword [esi + 4]
dec edx
and edx, eax
mov ecx, esi
push edi
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.00530b10
mov edi, ebx
test ebx, ebx
jne 0x530f5f
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c66e3
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x530fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x591014]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx]
lea edx, [ebp - 0x14]
mov dword [edx], eax
mov dword [ebp - 0x24], ecx
add ecx, 4
mov dword [ebp - 0x28], ecx
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0x18]
lea ebx, [ebp - 0x20]
push ebx
call fcn.0049cd80
mov ecx, edi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.004c2e40
mov ecx, eax
xor ecx, dword [edi + 8]
mov eax, ecx
mov edx, 0x7f4a7c15
mul edx
imul eax, ecx, 0x9e3779b9
add eax, edx
mov edx, dword [edi + 4]
dec edx
and edx, eax
mov ecx, edi
push esi
push edx
push ebx
call fcn.00530b10
lea ecx, [ebp - 0x14]
call fcn.0045ccc0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x28]
jne 0x530fef
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x53104e
cmp dword [edi + 0x14], 0
je 0x531062
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c66e3
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, esi
push dword [esi + 4]
call fcn.005307d0
push esi
call fcn.004c5c98
add esp, 4
jmp 0x53104e
Function at 0x536680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, edx
mov edi, ecx
mov eax, dword [0x591014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x18], eax
add esi, edi
cmp edi, esi
jae 0x5366da
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, esi
sub eax, edi
push ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete dl
mov ecx, dword [ebp - 0x14]
test ecx, ecx
sete al
or al, dl
jne 0x5366d4
mov ebx, ecx
add edi, ebx
cmp al, 1
jne 0x5366a4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c66e3
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x539490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x591014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x5394b3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5394d8
mov ebx, eax
cmp byte [ebp + 0xc], 0
jne 0x5394d0
mov eax, ebx
and eax, 0x400
jne 0x5394e6
and ebx, 0x10
shr ebx, 4
jmp 0x5394e8
push 2
call fcn.004a2710
add esp, 4
test al, al
jne 0x5394ff
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c66e3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0050b630
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x82
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0050b760
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.004f75f0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x539543
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x539546
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.004a8d40
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x53956d
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x539570
and eax, 0x7f
push eax
push ebx
push esi
call fcn.004f75f0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x539592
push dword [ebp - 0xc4]
call fcn.004c5c98
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0050b7c0
jmp 0x5394e6
Function at 0x5395b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x591014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x5395d3
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
je 0x5395f9
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c66e3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp + 0x10], 0
je 0x53960c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x53965f
push 2
call fcn.004a2710
add esp, 4
test al, al
jne 0x53961e
xor ebx, ebx
jmp 0x5395e2
call fcn.0050b630
lea ecx, [ebp - 0xc4]
push eax
push 2
push 0x62
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0050b760
lea eax, [ebp - 0xbc]
push 0x10
push str.CreateDirectory
push eax
call fcn.004f75f0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x5396a3
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x5396a6
push 1
push edi
call fcn.00539490
add esp, 8
test al, al
jne 0x5395e2
push 2
call fcn.004a2710
add esp, 4
test al, al
je 0x53961a
lea ecx, [ebp - 0xc4]
push 2
push 0x5d
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0044bd70
movzx eax, byte [edi + 0xb]
test al, al
jns 0x5396f3
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x5396f6
and eax, 0x7f
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.004a8d40
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x5396c4
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
jmp 0x5396c7
and eax, 0x7f
push eax
push ebx
push esi
call fcn.004f75f0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x5396e3
push dword [ebp - 0x1c]
call fcn.004c5c98
add esp, 4
lea ecx, [ebp - 0xc4]
call fcn.0050b7c0
jmp 0x53961a
and eax, 0x7f
lea esi, [ebp - 0xbc]
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.004a8d40
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x53971a
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
jmp 0x53971d
and eax, 0x7f
push eax
push ebx
push esi
call fcn.004f75f0
add esp, 0xc
push 0x10
push str._not_a_directory
push eax
call fcn.004f75f0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x539749
push dword [ebp - 0x1c]
call fcn.004c5c98
add esp, 4
lea ecx, [ebp - 0xc4]
call fcn.0044c1b0
jmp 0x53961a
Function at 0x539760
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x591014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x539783
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5397ae
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c66e3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004a2710
add esp, 4
test al, al
jne 0x5397c0
xor ebx, ebx
jmp 0x539797
call fcn.0050b630
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x75
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0050b760
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.004f75f0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x539801
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x539804
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.004a8d40
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x53982b
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x53982e
and eax, 0x7f
push eax
push ebx
push esi
call fcn.004f75f0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x539850
push dword [ebp - 0xc4]
call fcn.004c5c98
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0050b7c0
jmp 0x5397bc
Function at 0x539860
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, dword [ebp + 8]
mov eax, dword [0x591014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x539883
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x53989b
and eax, 0x410
cmp eax, 0x410
je 0x5398db
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x5398a5
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
je 0x5398c9
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c66e3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004a2710
add esp, 4
test al, al
jne 0x5398f6
xor ebx, ebx
jmp 0x5398b2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c66e3
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.005399a0
call fcn.0050b630
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x95
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0050b760
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.004f75f0
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x53993a
mov eax, dword [esi + 4]
mov esi, dword [esi]
jmp 0x53993d
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.004a8d40
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x539964
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x539967
and eax, 0x7f
push eax
push ebx
push edi
call fcn.004f75f0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x539989
push dword [ebp - 0xc4]
call fcn.004c5c98
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0050b7c0
jmp 0x5398d7
Function at 0x5399a0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, ecx
mov eax, dword [0x591014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x5399c2
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x5399dd
push 2
call fcn.004a2710
add esp, 4
test al, al
jne 0x5399f9
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c66e3
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0050b630
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x30
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0050b760
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.004f75f0
add esp, 0xc
movzx ecx, byte [edi + 0xb]
test cl, cl
mov dword [ebp - 0xc8], eax
jns 0x539a3e
mov ecx, dword [edi + 4]
mov edi, dword [edi]
jmp 0x539a41
and ecx, 0x7f
lea ebx, [ebp - 0xc4]
push ecx
push edi
push ebx
call fcn.004a8d40
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x539a68
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x539a6b
and eax, 0x7f
mov ecx, dword [ebp - 0xc8]
push eax
push ebx
push ecx
call fcn.004f75f0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x539a93
push dword [ebp - 0xc4]
call fcn.004c5c98
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0050b7c0
jmp 0x5399dd

Function at 0x5418a0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00539860
Function at 0x5438c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x591014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
lea edi, [ebp - 0x18]
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [eax], 4
push eax
push edi
push esi
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x54390a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c66e3
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5439b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov eax, dword [0x591014]
xor eax, ebp
mov dword [esp + 0xdc], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov dword [esi + 0x20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x14], 0x100
jb 0x543a05
push 1
call fcn.004a2710
add esp, 4
test al, al
jne 0x543a30
mov eax, dword [esp + 0xc4]
cmp eax, 0x100
mov ebx, 0xff
cmovb ebx, eax
mov ecx, dword [esp + 0xdc]
xor ecx, ebp
call fcn.004c66e3
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
lea esi, [esp + 0xc]
mov ecx, esi
push 1
push 0x114
push str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
call fcn.0044bd70
lea eax, [esp + 0x14]
push 0x2c
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.004f75f0
add esp, 0xc
mov ecx, esi
call fcn.0044c1b0
jmp 0x543a05
Function at 0x54df70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov ebx, ecx
mov eax, dword [0x591014]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.004f6fb0
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.00551d70
test al, al
je 0x54e02f
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x54e05d
mov ecx, edi
call fcn.004f6fb0
mov edi, eax
mov eax, dword [esp + 0xec]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0x108
push esi
push edi
call fcn.00551d70
test al, al
je 0x54e092
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x54e0c4
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x54e043
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x54e043
push 1
call fcn.004a2710
add esp, 4
test al, al
jne 0x54e0fa
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.004c66e3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.004a2710
add esp, 4
test al, al
je 0x54e041
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044bd70
lea eax, [esp + 0x14]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x54e11c
push 1
call fcn.004a2710
add esp, 4
test al, al
je 0x54e041
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044bd70
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x54e11c
push 1
call fcn.004a2710
add esp, 4
test al, al
je 0x54e041
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044bd70
lea eax, [esp + 0x14]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x54e11c
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044bd70
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.004f75f0
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x54e134
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
jmp 0x54e137
and ecx, 0x7f
push ecx
push ebx
push eax
call fcn.004f75f0
add esp, 0xc
mov ecx, edi
call fcn.0044c1b0
jmp 0x54e041
Function at 0x54e150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov ebx, ecx
mov eax, dword [0x591014]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.004f6fb0
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.00551d70
test al, al
je 0x54e20f
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x54e23d
mov ecx, edi
call fcn.004f6fb0
mov edi, eax
mov eax, dword [esp + 0xec]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0xf8
push esi
push edi
call fcn.00551d70
test al, al
je 0x54e272
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x54e2a4
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x54e223
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x54e223
push 1
call fcn.004a2710
add esp, 4
test al, al
jne 0x54e2da
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.004c66e3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.004a2710
add esp, 4
test al, al
je 0x54e221
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044bd70
lea eax, [esp + 0x14]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x54e2fc
push 1
call fcn.004a2710
add esp, 4
test al, al
je 0x54e221
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044bd70
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x54e2fc
push 1
call fcn.004a2710
add esp, 4
test al, al
je 0x54e221
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044bd70
lea eax, [esp + 0x14]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x54e2fc
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044bd70
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.004f75f0
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x54e314
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
jmp 0x54e317
and ecx, 0x7f
push ecx
push ebx
push eax
call fcn.004f75f0
add esp, 0xc
mov ecx, edi
call fcn.0044c1b0
jmp 0x54e221