joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e0e90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
cmp esi, ebx
je 0x6e0ed3
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.006e0850
test al, al
jne 0x6e0ecd
add esi, 0x58
cmp esi, ebx
jne 0x6e0eba
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax + 0x2c]
cmp esi, ebx
je 0x6e0f0a
cmp byte [esi + 0x1b], 0
js 0x6e0ee2
lea eax, [esi + 0x10]
jmp 0x6e0ee5
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x6e0f0d
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x6e0f0d
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6e1050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov edi, dword [ecx + 0x28]
mov esi, dword [ecx + 0x2c]
cmp edi, esi
je 0x6e1093
mov dword [ebp - 0x24], ecx
lea ebx, [ebp - 0x20]
mov ecx, edi
push ebx
call fcn.006e0850
test al, al
jne 0x6e108d
add edi, 0x58
cmp edi, esi
jne 0x6e107a
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx + 0x2c]
xor ebx, ebx
inc ebx
cmp edi, esi
je 0x6e10e3
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x6e10d7
cmp byte [edi + 0x1b], 0
js 0x6e10af
mov esi, ecx
lea eax, [edi + 0x10]
jmp 0x6e10b4
mov esi, ecx
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6e10e3
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x6e10e3
mov eax, dword [ebp + 0xc]
mov byte [esi + 0x24], 1
mov dword [eax], edi
xor ebx, ebx
jmp 0x6e10e3
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6e1220
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc4
mov esi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0xb4]
mov dword [edi], 0xffffffff
mov edx, edi
call fcn.00582600
mov ebx, dword [edi]
test ebx, ebx
je 0x6e12e6
mov dword [ebp - 0xcc], esi
mov esi, dword [ebp + 8]
xor eax, eax
dec eax
lea ecx, [ebp - 0xc0]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
call fcn.005e5390
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0xb0], xmm0
mov edi, dword [ebx + 0x28]
mov esi, dword [ebx + 0x2c]
cmp edi, esi
je 0x6e12b0
mov dword [ebp - 0xc4], ebx
lea ebx, [ebp - 0xb0]
mov ecx, edi
push ebx
call fcn.006e0850
test al, al
jne 0x6e12a7
add edi, 0x58
cmp edi, esi
jne 0x6e1294
mov ebx, dword [ebp - 0xc4]
mov esi, dword [ebx + 0x2c]
cmp edi, esi
jne 0x6e12ed
xor esi, esi
inc esi
lea ecx, [ebp - 0xc0]
call fcn.005e5500
lea ecx, [ebp - 0xb4]
call fcn.00582ed0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0xc4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x6e12c2
lea eax, [edi + 0x10]
lea ecx, [ebp - 0xc0]
push eax
call fcn.005e5520
mov eax, dword [ebx + 0x2c]
cmp eax, edi
je 0x6e145b
mov dword [ebp - 0xc4], ebx
lea ecx, [ebx + 0x28]
lea ebx, [edi + 0x58]
mov edx, edi
cmp ebx, eax
je 0x6e1335
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 0xd0], eax
jmp 0x6e13d5
add ebx, 0xffffffa8
mov edx, ebx
mov ecx, dword [ebp - 0xc8]
sub edx, edi
add edx, edi
call fcn.006e2070
mov eax, dword [ebp - 0xc4]
mov byte [eax + 0x24], 1
cmp byte [ebp - 0xb5], 0
mov esi, dword [ebp - 0xcc]
lea eax, [ebp - 0xc0]
jns 0x6e1363
mov eax, dword [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x6e13f3
mov ecx, esi
push dword [ebp + 8]
call fcn.006f5250
xor esi, esi
jmp 0x6e12b7
push dword [esi]
call fcn.006507ee
add esp, 4
mov eax, dword [ebx + 0x24]
mov dword [esi + 8], eax
movsd xmm0, qword [ebx + 0x1c]
movsd qword [esi], xmm0
xor eax, eax
mov byte [ebx + 0x27], al
mov byte [ebx + 0x1c], al
movups xmm0, xmmword [ebx + 0x28]
movups xmm1, xmmword [ebx + 0x38]
movups xmmword [ebx - 0x30], xmm0
movups xmmword [ebx - 0x20], xmm1
movsd xmm0, qword [ebx + 0x48]
movsd qword [ebx - 0x10], xmm0
mov eax, dword [ebx + 0x50]
mov dword [ebx - 8], eax
add ebx, 0x58
mov eax, dword [ebp - 0xd0]
cmp ebx, eax
je 0x6e132a
movups xmm0, xmmword [ebx]
movups xmmword [ebx - 0x58], xmm0
lea ecx, [ebx - 0x48]
lea eax, [ebx + 0x10]
push eax
call fcn.005e5580
lea esi, [ebx - 0x3c]
cmp byte [ebx - 0x31], 0
jns 0x6e138d
jmp 0x6e1383
mov esi, 2
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x6e12b7
call fcn.006a5890
lea edi, [ebp - 0xb0]
mov ecx, edi
push eax
push 2
push 0x36f
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.006a5a40
lea eax, [ebp - 0xa8]
push 0xb
push str.DeleteFile
push eax
call fcn.005b72e0
add esp, 0xc
lea ecx, [ebp - 0xc0]
push ecx
push eax
call fcn.006a6a80
add esp, 8
mov ecx, edi
call fcn.006a5aa0
jmp 0x6e12b7
ud2
Function at 0x6f15e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5c
mov edi, dword [ebp + 0x24]
mov ebx, dword [ebp + 0x20]
mov esi, dword [ebp + 0xc]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
jne 0x6f1607
call fcn.006b05d0
mov ebx, eax
test edi, edi
cmove edi, ebx
push ebx
call fcn.004daa30
add esp, 4
lea ecx, [eax*2 + 2]
cmp ecx, esi
ja 0x6f1640
mov dword [ebp - 0x68], edi
lea edx, [eax + eax]
mov edi, esi
mov esi, edx
not esi
lea ecx, [edi + esi]
dec ecx
cmp ecx, dword [ebp + 0x14]
jae 0x6f166b
push 0x6a
push str....._third_party_boringssl_srccrypto_rsa_extra_rsa_crypt.c
push 0x72
jmp 0x6f1649
push 0x64
push str....._third_party_boringssl_srccrypto_rsa_extra_rsa_crypt.c
push 0x7e
push 0
push 4
call fcn.006d2a00
add esp, 0x14
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, edi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [edi - 1]
mov dword [ebp - 0x60], ecx
cmp ecx, edx
ja 0x6f1688
push 0x6f
jmp 0x6f1642
xor ebx, ebx
xor edi, edi
push ebx
call fcn.005fb000
add esp, 4
jmp 0x6f1657
mov edx, dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
mov byte [edi], 0
mov dword [ebp - 0x5c], eax
add eax, edi
inc eax
xor ecx, ecx
push ecx
push ebx
push ecx
mov dword [ebp - 0x58], eax
push eax
push edx
push dword [ebp + 0x18]
call fcn.00547b30
add esp, 0x18
test eax, eax
je 0x6f1679
mov ebx, dword [ebp - 0x60]
mov ecx, dword [ebp + 0x14]
sub ebx, ecx
add esi, ebx
mov edx, dword [ebp - 0x5c]
je 0x6f16d7
mov eax, dword [ebp - 0x58]
add eax, edx
push esi
push 0
push eax
mov esi, edx
call fcn.006547d0
mov edx, esi
mov ecx, dword [ebp + 0x14]
add esp, 0xc
mov eax, edx
not eax
add ebx, dword [ebp - 0x58]
mov byte [eax + ebx], 1
lea eax, [edi + 1]
mov dword [ebp - 0x54], eax
test ecx, ecx
mov esi, edx
je 0x6f1709
mov eax, edi
add eax, esi
add eax, dword [ebp + 0xc]
sub eax, ecx
sub eax, esi
push ecx
push dword [ebp + 0x10]
push eax
call fcn.00654250
mov esi, dword [ebp - 0x5c]
add esp, 0xc
push esi
push dword [ebp - 0x54]
call fcn.005ec1a0
add esp, 8
test eax, eax
je 0x6f1679
mov edi, dword [ebp - 0x60]
sub edi, esi
push edi
call fcn.005faf60
add esp, 4
test eax, eax
je 0x6f1679
mov ebx, eax
push dword [ebp - 0x68]
push esi
push dword [ebp - 0x54]
mov dword [ebp - 0x64], edi
push edi
push eax
call fcn.00549820
add esp, 0x14
test eax, eax
je 0x6f167b
cmp dword [ebp - 0x60], esi
mov esi, dword [ebp - 0x58]
je 0x6f176f
mov eax, dword [ebp - 0x64]
cmp eax, 1
adc eax, 0
xor ecx, ecx
mov dl, byte [ebx + ecx]
xor byte [esi + ecx], dl
inc ecx
cmp eax, ecx
jne 0x6f1764
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x50]
movdqu xmmword [eax + 0x30], xmm0
movdqu xmmword [eax + 0x20], xmm0
movdqu xmmword [eax + 0x10], xmm0
movdqu xmmword [eax], xmm0
push dword [ebp - 0x68]
push dword [ebp - 0x64]
push esi
mov esi, dword [ebp - 0x5c]
push esi
push eax
call fcn.00549820
add esp, 0x14
test eax, eax
je 0x6f167b
xor edi, edi
inc edi
test esi, esi
je 0x6f167d
mov edx, esi
xor eax, eax
mov esi, dword [ebp - 0x54]
mov cl, byte [ebp + eax - 0x50]
xor byte [esi + eax], cl
inc eax
cmp edx, eax
jne 0x6f17b7
jmp 0x6f167d
Function at 0x6f6910
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov edi, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x6f6933
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6f6957
mov ebx, eax
mov al, byte [ebp + 0xc]
mov ecx, ebx
shr ecx, 0xa
xor al, 1
test cl, al
jne 0x6f69ab
and ebx, 0x10
shr ebx, 4
jmp 0x6f69ad
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x6f69ab
call fcn.006a5890
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x80
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.006a5a40
lea eax, [ebp - 0xa8]
push 0x12
push str.GetFileAttributes
push eax
call fcn.005b72e0
add esp, 0xc
push edi
push eax
call fcn.006a6a80
add esp, 8
mov ecx, esi
call fcn.006a5aa0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6f69d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov edi, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x6f69f3
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x6f6a68
cmp byte [ebp + 0x10], 0
je 0x6f6a15
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x6f6a7f
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x6f6a66
call fcn.006a5890
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x61
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.006a5a40
lea eax, [ebp - 0xa8]
push 0x10
push str.CreateDirectory
push eax
call fcn.005b72e0
add esp, 0xc
push edi
push eax
call fcn.006a6a80
add esp, 8
mov ecx, esi
call fcn.006a5aa0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
push edi
call fcn.006f6910
add esp, 8
test al, al
jne 0x6f6a68
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x6f6a66
lea esi, [ebp - 0xb0]
mov ecx, esi
push 2
push 0x5c
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0053b2e0
lea eax, [ebp - 0xa8]
push edi
push eax
call fcn.006a6a80
add esp, 8
push 0x10
push str._not_a_directory
push eax
call fcn.005b72e0
add esp, 0xc
mov ecx, esi
call fcn.0053b7a0
jmp 0x6f6a66
Function at 0x6f6ae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov edi, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x6f6b03
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6f6b2e
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x6f6b7f
call fcn.006a5890
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x73
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.006a5a40
lea eax, [ebp - 0xa8]
push 0x12
push str.GetFileAttributes
push eax
call fcn.005b72e0
add esp, 0xc
push edi
push eax
call fcn.006a6a80
add esp, 8
mov ecx, esi
call fcn.006a5aa0
xor ebx, ebx
jmp 0x6f6b17

Function at 0x6f6b90
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov esi, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x6f6bb3
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
sete cl
not eax
test eax, 0x410
setne al
or al, cl
je 0x6f6c56
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x6f6bdc
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x6f6c3f
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x6f6c3d
call fcn.006a5890
lea edi, [ebp - 0xb0]
mov ecx, edi
push eax
push 2
push 0x93
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.006a5a40
lea eax, [ebp - 0xa8]
push 0xb
push str.DeleteFile
push eax
call fcn.005b72e0
add esp, 0xc
push esi
push eax
call fcn.006a6a80
add esp, 8
mov ecx, edi
call fcn.006a5aa0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov ecx, esi
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.006f6c80
Function at 0x6f6c80
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov esi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x6f6ca2
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
je 0x6f6ccb
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x6f6caf
call fcn.006a5890
lea ebx, [ebp - 0xb0]
mov ecx, ebx
push eax
push 2
push 0x2f
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.006a5a40
lea eax, [ebp - 0xa8]
push 0x10
push str.RemoveDirectory
push eax
call fcn.005b72e0
add esp, 0xc
push esi
push eax
call fcn.006a6a80
add esp, 8
mov ecx, ebx
call fcn.006a5aa0
jmp 0x6f6caf
Function at 0x6ff770
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe4
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0x50]
movdqu xmmword [esi + 0x30], xmm0
movdqu xmmword [esi + 0x20], xmm0
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi], xmm0
push esi
push 0x20
push dword [ebp + 0x10]
call fcn.006b07e0
add esp, 0xc
and byte [esi], 0xf8
mov al, byte [esi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
lea edi, [ebp - 0xf0]
push 0xa0
push 0xff
push edi
call fcn.006547d0
add esp, 0xc
push 0x796e70
push esi
push edi
call fcn.0063d040
add esp, 0xc
mov esi, dword [ebp + 8]
mov ecx, esi
mov edx, edi
call fcn.00702f30
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [ebx + 0x10], xmm1
movups xmmword [ebx], xmm0
movups xmm0, xmmword [esi]
movups xmm1, xmmword [esi + 0x10]
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x30], xmm1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
add esp, 0xe4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x703410
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.006f6b90
Function at 0x70f440
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
lea edi, [ebp - 0x18]
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [eax], 4
push eax
push edi
push esi
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x70f48a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x70f530
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xc4
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0xc], eax
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0x30]
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi], xmm0
mov dword [esi + 0x20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x14], 0x100
jb 0x70f5b0
push 1
call fcn.005e3f20
add esp, 4
test al, al
je 0x70f5b0
lea esi, [ebp - 0xcc]
mov ecx, esi
push 1
push 0x117
push str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
call fcn.0053b2e0
lea eax, [ebp - 0xc4]
push 0x2c
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.005b72e0
add esp, 0xc
mov ecx, esi
call fcn.0053b7a0
mov eax, dword [ebp - 0x1c]
cmp eax, 0x100
mov ebx, 0xff
cmovb ebx, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0xc4
pop esi
pop ebx
pop ebp
ret
Function at 0x71efa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe4
mov esi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0x50]
movdqu xmmword [ebx + 0x30], xmm0
movdqu xmmword [ebx + 0x20], xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.00683680
mov ecx, esi
push ebx
push 0
push 0x40
push edx
push eax
call fcn.00723de0
test al, al
je 0x71f092
cmp word [ebp - 0x50], 0x5a4d
jne 0x71f058
mov ebx, dword [ebp + 8]
mov ecx, edi
call fcn.00683680
mov ecx, dword [ebp - 0x14]
mov edi, ecx
sar edi, 0x1f
add eax, ecx
adc edi, edx
mov ecx, esi
push ebx
push 0
push 0x108
push edi
mov dword [ebp - 0xf0], eax
push eax
call fcn.00723de0
test al, al
je 0x71f109
cmp dword [ebx], 0x4550
jne 0x71f13f
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x71f0f0
mov ecx, dword [ebp - 0xf0]
mov dword [eax], ecx
mov dword [eax + 4], edi
jmp 0x71f0f0
push 1
call fcn.005e3f20
add esp, 4
test al, al
je 0x71f0ee
lea edi, [ebp - 0xec]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0053b2e0
lea eax, [ebp - 0xe4]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x71f0c6
push 1
call fcn.005e3f20
add esp, 4
test al, al
je 0x71f0ee
lea edi, [ebp - 0xec]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0053b2e0
lea eax, [ebp - 0xe4]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.005b72e0
add esp, 0xc
movsx ecx, byte [esi + 0xb]
test ecx, ecx
jns 0x71f0dc
mov ecx, dword [esi + 4]
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.005b72e0
add esp, 0xc
mov ecx, edi
call fcn.0053b7a0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0xe4
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.005e3f20
add esp, 4
test al, al
je 0x71f0ee
lea edi, [ebp - 0xec]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0053b2e0
lea eax, [ebp - 0xe4]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x71f0c6
push 1
call fcn.005e3f20
add esp, 4
test al, al
je 0x71f0ee
lea edi, [ebp - 0xec]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0053b2e0
lea eax, [ebp - 0xe4]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x71f0c6
Function at 0x71f180
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe4
mov esi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0x50]
movdqu xmmword [ebx + 0x30], xmm0
movdqu xmmword [ebx + 0x20], xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.00683680
mov ecx, esi
push ebx
push 0
push 0x40
push edx
push eax
call fcn.00723de0
test al, al
je 0x71f272
cmp word [ebp - 0x50], 0x5a4d
jne 0x71f238
mov ebx, dword [ebp + 8]
mov ecx, edi
call fcn.00683680
mov ecx, dword [ebp - 0x14]
mov edi, ecx
sar edi, 0x1f
add eax, ecx
adc edi, edx
mov ecx, esi
push ebx
push 0
push 0xf8
push edi
mov dword [ebp - 0xf0], eax
push eax
call fcn.00723de0
test al, al
je 0x71f2e9
cmp dword [ebx], 0x4550
jne 0x71f31f
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x71f2d0
mov ecx, dword [ebp - 0xf0]
mov dword [eax], ecx
mov dword [eax + 4], edi
jmp 0x71f2d0
push 1
call fcn.005e3f20
add esp, 4
test al, al
je 0x71f2ce
lea edi, [ebp - 0xec]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0053b2e0
lea eax, [ebp - 0xe4]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x71f2a6
push 1
call fcn.005e3f20
add esp, 4
test al, al
je 0x71f2ce
lea edi, [ebp - 0xec]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0053b2e0
lea eax, [ebp - 0xe4]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.005b72e0
add esp, 0xc
movsx ecx, byte [esi + 0xb]
test ecx, ecx
jns 0x71f2bc
mov ecx, dword [esi + 4]
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.005b72e0
add esp, 0xc
mov ecx, edi
call fcn.0053b7a0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0xe4
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.005e3f20
add esp, 4
test al, al
je 0x71f2ce
lea edi, [ebp - 0xec]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0053b2e0
lea eax, [ebp - 0xe4]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x71f2a6
push 1
call fcn.005e3f20
add esp, 4
test al, al
je 0x71f2ce
lea edi, [ebp - 0xec]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0053b2e0
lea eax, [ebp - 0xe4]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x71f2a6