joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422ff0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
push edi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x42303e
mov ebx, eax
xor eax, eax
dec eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
cmp ebx, 0x7ffffff0
jae 0x423100
cmp ebx, 4
ja 0x42304b
lea edi, [ebp - 0x1c]
mov byte [edi + 0xb], bl
jmp 0x423071
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [esi + 8], edi
jmp 0x4230ec
lea esi, [ebx + 8]
and esi, 0xfffffff8
lea eax, [esi + esi]
push eax
call fcn.0046acad
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], eax
or esi, 0x80000000
mov dword [ebp - 0x14], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], ebx
mov eax, ebx
add eax, ebx
push eax
push 0
push edi
call fcn.0046e590
add esp, 0xc
mov word [edi + ebx*2], 0
cmp byte [ebp - 0x11], 0
jns 0x423092
mov eax, dword [ebp - 0x1c]
jmp 0x423095
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movzx ecx, byte [ebp - 0x11]
test eax, eax
je 0x4230d3
mov edx, ecx
test cl, cl
jns 0x4230b2
mov edx, dword [ebp - 0x18]
cmp eax, edx
jae 0x4230d3
lea edi, [ebp - 0x1c]
mov ecx, edi
push 0
push eax
call fcn.0044b340
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
movsd xmm0, qword [edi]
movsd qword [esi], xmm0
jmp 0x4230ec
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], eax
test cl, cl
jns 0x4230ec
push dword [ebp - 0x1c]
call fcn.0046acdd
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x1c]
call fcn.004a96f0
int3
Function at 0x423660
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp + 0xc]
mov dword [ebp - 0x14], edi
call fcn.00446190
mov ebx, 0x4e77c8
push edi
push 0
push esi
push 0x400
push ebx
push dword [eax + 4]
push dword [eax]
call fcn.0046f717
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x423cd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov esi, dword [ebp + 8]
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x216]
push 0x206
push 0xff
push edi
call fcn.0046e590
add esp, 0xc
mov word [edi - 2], 0
lea eax, [ebp - 0x218]
push 0x104
push eax
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x423d64
mov edi, eax
sub edi, 1
jb 0x423d64
cmp word [ebp + eax*2 - 0x21a], 0x5c
mov eax, edi
je 0x423d2c
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x423d48
mov eax, dword [esi]
lea ecx, [edi + 1]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0047f8a2
add esp, 0xc
test eax, eax
je 0x423e43
mov word [ebp - 0x218], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.PROGRAMFILES_X86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x423dc9
mov edi, eax
sub edi, 1
jb 0x423dc9
cmp word [ebp + eax*2 - 0x21a], 0x5c
mov eax, edi
je 0x423d91
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x423dad
mov eax, dword [esi]
lea ecx, [edi + 1]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0047f8a2
add esp, 0xc
test eax, eax
je 0x423e71
mov word [ebp - 0x218], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.PROGRAMW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x423e2a
mov edi, eax
sub edi, 1
jb 0x423e2a
cmp word [ebp + eax*2 - 0x21a], 0x5c
mov eax, edi
je 0x423df6
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x423e12
mov eax, dword [esi]
lea ecx, [edi + 1]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0047f8a2
add esp, 0xc
test eax, eax
je 0x423e9f
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [esi + 0xb]
mov ecx, eax
test al, al
jns 0x423e50
mov ecx, dword [esi + 4]
mov edx, edi
sub edx, ecx
mov bl, 1
cmp edx, 0xffffffff
je 0x423e2c
mov ecx, esi
test al, al
jns 0x423e63
mov ecx, dword [esi]
cmp word [ecx + edi*2 + 2], 0x5c
jne 0x423d64
jmp 0x423e2c
movzx eax, byte [esi + 0xb]
mov ecx, eax
test al, al
jns 0x423e7e
mov ecx, dword [esi + 4]
mov edx, edi
sub edx, ecx
mov bl, 1
cmp edx, 0xffffffff
je 0x423e2c
mov ecx, esi
test al, al
jns 0x423e91
mov ecx, dword [esi]
cmp word [ecx + edi*2 + 2], 0x5c
jne 0x423dc9
jmp 0x423e2c
movzx eax, byte [esi + 0xb]
mov ecx, eax
test al, al
jns 0x423eac
mov ecx, dword [esi + 4]
mov edx, edi
sub edx, ecx
mov bl, 1
cmp edx, 0xffffffff
je 0x423e2c
test al, al
jns 0x423ec1
mov esi, dword [esi]
cmp word [esi + edi*2 + 2], 0x5c
jne 0x423e2a
jmp 0x423e2c
Function at 0x42bd60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x88
push str..._.._base_files_file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.004568b0
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.004568f0
cmp dword [ebp + 0xc], 0
js 0x42be27
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.0045de90
test al, al
jne 0x42be2c
lea ebx, [esp + 0xc]
mov dword [ebx], 0xffffffff
push 0
push ebx
push dword [ebp + 0xc]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [ebx]
lea ecx, [esp + 0x10]
call fcn.0045df30
lea ecx, [esp + 0x20]
call fcn.00456950
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0046b8b5
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor esi, esi
dec esi
jmp 0x42be07
lea ecx, [esp + 0x10]
push 0
push dword [ebp + 0xc]
push esi
push str.File::WriteAtCurrentPos
call fcn.004b6ec0
jmp 0x42bddc
Function at 0x42bf90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x160
push str..._.._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.004568b0
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.004568f0
mov eax, ebx
and eax, 1
neg eax
and eax, 3
xor ecx, ecx
inc ecx
test bl, 2
cmove ecx, eax
test bl, 4
mov edx, 4
cmovne ecx, edx
test bl, 8
mov esi, 2
cmove esi, ecx
test bl, 0x10
mov eax, 5
cmove eax, esi
mov dword [esp + 4], eax
test eax, eax
je 0x42c1ab
mov ecx, ebx
and ecx, 0x40
shl ecx, 0x18
test bl, 0x80
cmove edx, ecx
mov ecx, ebx
rol ecx, 0x1a
mov esi, ebx
shl esi, 0xb
and esi, 0x20000000
mov edi, ebx
shr edi, 4
and edi, 0x10000
and ecx, 0x80000100
or ecx, esi
or ecx, edi
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
mov esi, ebx
and esi, 0x400
mov eax, ebx
mov dword [esp + 0xc], esi
mov ebx, esi
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov esi, eax
shl esi, 0xd
and esi, 0x4000000
or esi, edi
shl eax, 8
mov ebx, eax
and ebx, 0x2000000
or ebx, esi
and eax, 0x8000000
or eax, ebx
mov esi, dword [ebp + 8]
xor edx, 3
cmp byte [esi + 0xb], 0
jns 0x42c0cf
mov esi, dword [esi]
xor ebx, ebx
push ebx
push eax
push dword [esp + 0xc]
push ebx
push edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov esi, dword [esp + 8]
cmp dword [esi], eax
je 0x42c15f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
mov ebx, dword [ebp + 0xc]
jae 0x42c189
mov ecx, edi
inc ecx
cmp ecx, 2
jb 0x42c113
mov dword [esi], edi
mov edi, eax
call fcn.004568e0
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi]
inc edi
cmp edi, 2
jb 0x42c164
mov eax, dword [esp + 0xc]
shr eax, 0xa
mov dword [esi + 0x14], 0
mov byte [esi + 0x19], al
test bl, 4
jne 0x42c178
test bl, 0xa
je 0x42c141
mov byte [esi + 0x18], 1
lea ecx, [esp + 0x20]
call fcn.00456950
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.0046b8b5
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ebx, dword [ebp + 0xc]
jmp 0x42c11c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042be50
add esp, 4
mov dword [esi + 0x14], eax
jmp 0x42c141
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [esi + 0x18]
jmp 0x42c141
mov dword [esp + 4], eax
call fcn.004568e0
push dword [esi]
call fcn.00456c80
mov eax, dword [esp + 8]
add esp, 4
mov dword [esi], 0
jmp 0x42c100
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 8]
mov dword [eax + 0x14], 0xffffffff
jmp 0x42c141
Function at 0x42c350
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00456a80
mov dword [esi], 0
test eax, eax
je 0x42c397
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x42c3c9
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x42c390
mov dword [esi], ebx
mov ebx, eax
call fcn.004568e0
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.0044bd40
lea ecx, [esi + 0x10]
call fcn.0045dec0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.004568e0
push dword [esi]
call fcn.00456c80
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
jmp 0x42c37d
Function at 0x42d930
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x42d967
mov eax, dword [0x4e3eb8]
cmp eax, 0xffffffff
je 0x42d9f4
mov ebx, 0x100000
test eax, eax
jne 0x42d967
mov ebx, 0x80000
push 0xc
call fcn.0046acad
add esp, 4
mov esi, eax
mov dword [eax], 0
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x4ea044]
bt ecx, eax
jae 0x42d9e6
push edi
call fcn.00450630
add esp, 4
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
xor eax, eax
push eax
push 0x10000
push esi
push 0x42dcc0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x42da18
test edi, edi
je 0x42da76
mov dword [edi], eax
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x4f2044], 1
jmp 0x42d998
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x4e3eb8
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x42dae5
mov eax, dword [0x4e3eb8]
jmp 0x42d959
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x42da34
mov edi, eax
cmp eax, 0x5af
je 0x42da34
cmp edi, 0xe
jne 0x42da86
push ebx
call fcn.004b0c40
add esp, 4
test esi, esi
mov eax, dword [ebp - 0x20]
je 0x42d9cd
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x4ea044]
bt edx, ecx
jae 0x42da65
push eax
call fcn.00450710
add esp, 4
push esi
call fcn.0046acdd
add esp, 4
mov eax, dword [ebp - 0x20]
jmp 0x42d9cd
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x42d9cd
mov eax, dword [0x4f2958]
mov ecx, dword [0x4e5e14]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42daf4
lea ebx, [ebp - 0x1c]
push edi
push ebx
call fcn.0042c4c0
add esp, 8
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x42dabe
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push eax
push ebx
push dword [0x4f2954]
call fcn.0045e410
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x42da3d
push dword [ebp - 0x1c]
call fcn.0046acdd
jmp 0x42da3a
mov dword [0x4e3eb8], 0
jmp 0x42d962
push 0x4f2958
call fcn.0046ad57
add esp, 4
cmp dword [0x4f2958], 0xffffffff
jne 0x42daa3
push 0x20
push str.create_thread_last_error
call fcn.0043b560
add esp, 8
mov dword [0x4f2954], eax
push 0x4f2958
call fcn.0046adcd
add esp, 4
jmp 0x42daa3
Function at 0x42f8f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x42f9e2
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x301
mov dword [esp + 0x54], ecx
mov eax, dword [eax]
mov dword [esp + 0x60], eax
sar eax, 0x1f
mov dword [esp + 0x64], eax
xor eax, eax
dec eax
lea ecx, [esp + 0x48]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [esp], ecx
call fcn.004562c0
mov eax, dword [0x4f2b60]
mov ecx, dword [0x4e5e14]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42fa5e
mov dword [esp], str.__metadata
call fcn.004570f0
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
xor ebx, ebx
mov dword [esp + 0x40], ebx
mov dword [esp], edi
lea edi, [esp + 0x50]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x4cfbc0]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.0043c240
sub esp, 0x44
cmp byte [edi], 0
jne 0x42fa46
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0046b8b5
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + ebx*8 + 0x60]
test esi, esi
je 0x42fa52
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov dword [esp], 1
mov ecx, esi
call edi
sub esp, 4
mov al, byte [esp + ebx + 0x51]
jmp 0x42fa4e
mov esi, dword [esp + ebx*8 + 0x60]
test esi, esi
je 0x42fa52
lea ecx, [esi + 0x5c]
call fcn.004467d0
lea ecx, [esi + 0x28]
call fcn.00445b90
mov ecx, esi
call fcn.00446950
mov dword [esp], esi
call fcn.0046acdd
jmp 0x42fa52
mov al, byte [esp + ebx + 0x51]
cmp al, 8
je 0x42f9f5
cmp al, 9
je 0x42fa1d
inc ebx
movzx eax, byte [esp + 0x50]
cmp ebx, eax
jae 0x42f9e2
jmp 0x42fa46
mov dword [esp], 0x4f2b60
call fcn.0046ad57
cmp dword [0x4f2b60], 0xffffffff
jne 0x42f97c
mov dword [esp], 0
mov ecx, 0x4f2960
call fcn.0042e0c0
sub esp, 4
mov dword [esp], 0x4f2b60
call fcn.0046adcd
jmp 0x42f97c
Function at 0x42faa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x42fb91
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x701
mov dword [esp + 0x54], ecx
cmp byte [eax + 0xb], 0
jns 0x42faef
mov eax, dword [eax]
mov ebx, dword [ebp + 8]
mov dword [esp + 0x60], eax
xor eax, eax
dec eax
lea ecx, [esp + 0x48]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [esp], ecx
call fcn.004562c0
mov eax, dword [0x4f2b60]
mov ecx, dword [0x4e5e14]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42fc0d
mov dword [esp], str.__metadata
call fcn.004570f0
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
xor ebx, ebx
mov dword [esp + 0x40], ebx
mov dword [esp], edi
lea edi, [esp + 0x50]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x4cfbc0]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.0043c240
sub esp, 0x44
cmp byte [edi], 0
jne 0x42fbf5
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0046b8b5
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + ebx*8 + 0x60]
test esi, esi
je 0x42fc01
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov dword [esp], 1
mov ecx, esi
call edi
sub esp, 4
mov al, byte [esp + ebx + 0x51]
jmp 0x42fbfd
mov esi, dword [esp + ebx*8 + 0x60]
test esi, esi
je 0x42fc01
lea ecx, [esi + 0x5c]
call fcn.004467d0
lea ecx, [esi + 0x28]
call fcn.00445b90
mov ecx, esi
call fcn.00446950
mov dword [esp], esi
call fcn.0046acdd
jmp 0x42fc01
mov al, byte [esp + ebx + 0x51]
cmp al, 8
je 0x42fba4
cmp al, 9
je 0x42fbcc
inc ebx
movzx eax, byte [esp + 0x50]
cmp ebx, eax
jae 0x42fb91
jmp 0x42fbf5
mov dword [esp], 0x4f2b60
call fcn.0046ad57
cmp dword [0x4f2b60], 0xffffffff
jne 0x42fb2b
mov dword [esp], 0
mov ecx, 0x4f2960
call fcn.0042e0c0
sub esp, 4
mov dword [esp], 0x4f2b60
call fcn.0046adcd
jmp 0x42fb2b
Function at 0x431fe0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [esp + 0x48], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x432009
mov eax, dword [ecx + 4]
test eax, eax
je 0x432177
mov eax, ebx
not eax
test eax, 0x300
je 0x432177
cmp edi, 2
mov eax, 0x4f45ae
mov ecx, 0x4f47ae
cmove ecx, eax
cmp word [ecx], 0
jne 0x432177
xorps xmm0, xmm0
lea esi, [esp + 0x20]
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x432177
cmp byte [0x4f45ac], 0
setne al
bt ebx, 8
jb 0x432177
shr ebx, 9
and ebx, 1
or bl, al
je 0x432177
cmp edi, 2
mov eax, 0x4d6ac0
mov edx, 0x4d6ad4
cmove edx, eax
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
test cl, cl
jns 0x43218a
mov ecx, dword [eax]
mov dword [esp + 4], ecx
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
mov dword [esp + 0x18], ecx
xor esi, esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0
mov edi, dword [edx + 4]
mov ebx, eax
sub ebx, edi
jb 0x4320f7
push edi
push dword [edx]
push dword [esp + 0xc]
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], eax
call fcn.0047f8a2
mov edx, dword [esp + 0x28]
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x14]
je 0x432103
add edx, 0x14
inc esi
cmp esi, dword [esp + 0x18]
jb 0x4320cb
jmp 0x432170
mov eax, dword [esp + 4]
movzx ecx, word [eax + edi*2]
mov eax, dword [esp + 0x14]
cmp cx, 0x5c
jne 0x4321b8
mov eax, dword [esp + 4]
lea eax, [eax + edi*2]
mov esi, dword [edx + 8]
cmp esi, 2
jne 0x432136
mov dword [esp + 0xc], str.WOW6432Node
mov dword [esp + 8], eax
jmp 0x43213f
cmp esi, 1
je 0x4321cd
cmp cx, 0x5c
mov dword [esp + 0x10], esi
jne 0x43215c
lea ecx, [eax + 2]
dec ebx
cmp word [eax + 2], 0x5c
mov dword [esp + 4], ecx
mov eax, ecx
je 0x432149
jmp 0x432160
mov dword [esp + 4], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x18], eax
mov edx, dword [edx + 0xc]
xor esi, esi
mov eax, ebx
jmp 0x4320fb
cmp dword [esp + 0x10], 0
jne 0x432195
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0046b8b5
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
mov eax, ecx
jmp 0x4320aa
mov eax, dword [ebp + 8]
cmp byte [eax + 0xb], 0
js 0x4321c6
mov eax, dword [ebp + 8]
mov edx, dword [esp + 8]
sub edx, eax
sar edx, 1
mov ecx, dword [ebp + 8]
push dword [esp + 0xc]
push edx
call fcn.0041c1a0
jmp 0x432177
test cx, cx
jne 0x4320f7
jmp 0x432119
mov eax, dword [ebp + 8]
mov eax, dword [eax]
jmp 0x4321a1
mov dword [esp + 0xc], str.WOW6432Node_
mov edi, dword [esp + 4]
mov dword [esp + 8], edi
jmp 0x43213f
Function at 0x434050
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, ecx
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x434072
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4340a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4340c0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00434170
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004552c0
add esp, 4
test al, al
jne 0x4340d2
xor ebx, ebx
jmp 0x4340a9
call fcn.004af950
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x271
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.004afa80
lea eax, [ebp - 0xb0]
push 0x10
push str.CreateDirectory
push eax
call fcn.00494230
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x434114
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.0044f100
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x434139
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.00494230
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x43415b
push dword [ebp - 0xc4]
call fcn.0046acdd
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004afae0
jmp 0x4340ce