joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477960
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov esi, ecx
mov eax, dword [0x5c7040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x477982
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4779b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4779d0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f5620
mov ecx, esi
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00477ab0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f5620
mov eax, ebx
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004b90d0
add esp, 4
test al, al
je 0x477a86
call fcn.005427c0
lea ecx, [ebp - 0xb0]
push eax
push 2
push 0x265
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.00542990
lea eax, [ebp - 0xa8]
push 0x10
push str.CreateDirectory
push eax
call fcn.00493c00
add esp, 0xc
mov edi, eax
movsx eax, byte [esi + 0xb]
test eax, eax
jns 0x477a24
mov eax, dword [esi + 4]
mov esi, dword [esi]
test eax, eax
js 0x477a8d
sete cl
test esi, esi
setne dl
or dl, cl
je 0x477a94
lea ebx, [ebp - 0xbc]
push eax
push esi
push ebx
call fcn.004af540
add esp, 0xc
movsx eax, byte [ebx + 0xb]
test eax, eax
jns 0x477a59
mov eax, dword [ebp - 0xb8]
mov ebx, dword [ebp - 0xbc]
push eax
push ebx
push edi
call fcn.00493c00
add esp, 0xc
cmp byte [ebp - 0xb1], 0
jns 0x477a7b
push dword [ebp - 0xbc]
call fcn.004f50ae
add esp, 4
lea ecx, [ebp - 0xb0]
call fcn.005429f0
xor ebx, ebx
jmp 0x4779b9
push str....._third_partylibc_srcinclude_string_view:318:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
jmp 0x477a99
push str....._third_partylibc_srcinclude_string_view:320:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
push 0x59f83f
call fcn.00526860
int3
Function at 0x477ab0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov esi, ecx
mov eax, dword [0x5c7040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x477ad2
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x477b5d
mov bl, 1
test al, 0x10
je 0x477afb
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f5620
mov eax, ebx
add esp, 0xa4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004b90d0
add esp, 4
test al, al
je 0x477b59
lea edi, [ebp - 0xb0]
mov ecx, edi
push 2
push 0x255
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.0044e430
lea eax, [ebp - 0xa8]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00493c00
add esp, 0xc
push esi
push eax
call fcn.00543790
add esp, 8
push 0x11
push str.:_not_a_directory
push eax
call fcn.00493c00
add esp, 0xc
mov ecx, edi
call fcn.0044e910
xor ebx, ebx
jmp 0x477ae4
push 2
call fcn.004b90d0
add esp, 4
test al, al
je 0x477b59
call fcn.005427c0
lea edi, [ebp - 0xb0]
mov ecx, edi
push eax
push 2
push 0x251
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.00542990
lea eax, [ebp - 0xa8]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00493c00
add esp, 0xc
push esi
push eax
call fcn.00543790
add esp, 8
mov ecx, edi
call fcn.005429f0
jmp 0x477b59
Function at 0x478c80
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x5c7040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.00477c40
mov eax, dword [esi]
test eax, eax
je 0x478cd3
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x478cda
lea ecx, [ebp - 0x14]
call fcn.00478540
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f5620
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x478cb5
cmp dword [ebx + 0x50], 0
jne 0x478cf9
cmp byte [ebx + 0x1b], 0
js 0x478ceb
lea eax, [ebx + 0x10]
jmp 0x478cee
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x478cfe
add ebx, 0x58
jmp 0x478cb1
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x478d24
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.00558f00
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x478cf9
mov ecx, dword [ebp + 8]
push ebx
call fcn.00558de0
mov ecx, eax
jmp 0x478d1c

Function at 0x478d40
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x5c7040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.00477c40
mov eax, dword [esi]
test eax, eax
je 0x478d93
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x478d9a
lea ecx, [ebp - 0x14]
call fcn.00478540
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f5620
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x478d75
cmp dword [ebx + 0x50], 2
jne 0x478db9
cmp byte [ebx + 0x1b], 0
js 0x478dab
lea eax, [ebx + 0x10]
jmp 0x478dae
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x478dbe
add ebx, 0x58
jmp 0x478d71
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x478de4
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.00558f00
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x478db9
mov ecx, dword [ebp + 8]
push ebx
call fcn.00558de0
mov ecx, eax
jmp 0x478ddc
Function at 0x479cf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x5c7040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x479d20
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f5620
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x479e30
push 0
push eax
push 0x479cd0
push 0x5dbb84
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x479e28
cmp dword [0x5dbb88], 0
jne 0x479d0c
push dword [0x5dbb8c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x479d0c
mov esi, eax
mov eax, 0x5dbb90
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x5dbb94]
mov ebx, dword [0x5dbb98]
mov eax, dword [0x5dbb9c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x5dbba0]
mov dword [ebp - 0x20], eax
mov eax, dword [0x5dbba4]
mov dword [ebp - 0x24], eax
mov eax, 0x5dbb90
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
jne 0x479e0e
test ebx, ebx
jne 0x479de8
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x479dc6
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
jne 0x479dd7
test ebx, ebx
jne 0x479dfb
push esi
call fcn.004be590
add esp, 4
jmp 0x479d0c
mov edi, dword [esi + 8]
call dword [0x5c0d2c]
push edi
call ecx
add esp, 4
jmp 0x479daa
mov edi, dword [esi + 0xc]
call dword [0x5c0d2c]
push edi
call ecx
add esp, 4
jmp 0x479db4
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [0x5c0d2c]
push edi
call ebx
add esp, 4
jmp 0x479da3
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [0x5c0d2c]
push edi
call ebx
add esp, 4
jmp 0x479db8
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [0x5c0d2c]
push dword [ebp - 0x18]
call edi
add esp, 4
jmp 0x479d9f
call fcn.005090b7
int3
Function at 0x479e50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x5c7040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x479e30
push 0
push eax
push 0x479cd0
push 0x5dbb84
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x479f18
mov esi, dword [ebp + 0xc]
cmp dword [0x5dbb88], 0
jne 0x479f26
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x5dbb8c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x479edb
push 0x14
push 1
call fcn.004be630
add esp, 8
test eax, eax
je 0x479f26
mov edi, eax
push eax
push dword [0x5dbb8c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x479f1d
mov ebx, dword [ebp + 8]
mov esi, 0x5dbb90
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x5dbb94], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f5620
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005090b7
push edi
call fcn.004be590
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [0x5c0d2c]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x479f04
Function at 0x47a860
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x5ca950]
cmp eax, 0xffffffff
je 0x47a921
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x47a921
mov eax, dword [0x5dcbd4]
mov ecx, dword [0x5cacb4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x47a92b
mov edi, dword [0x5dcbd0]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x47a973
mov ecx, dword [0x5dbbc8]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x5dbbcc], 0
jne 0x47a97f
lea ecx, [ebx + 0x5dbbcc]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x5dcbcc]
inc edx
mov dword [0x5dcbcc], edx
mov dword [ecx + 0xc], edx
mov dword [0x5dbbc8], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x47a970
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0047a9a0
jmp 0x47a885
push 0x5dcbd4
call fcn.004f50f1
add esp, 4
cmp dword [0x5dcbd4], 0xffffffff
jne 0x47a8a6
push 4
call fcn.004f507e
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.004a7a40
mov dword [0x5dcbd0], edi
push 0x5dcbd4
call fcn.004f516b
add esp, 4
jmp 0x47a8a6
int3
mov ecx, edi
call fcn.004a7a50
jmp 0x47a8bb
inc edx
cmp edx, 0x100
jne 0x47a8c4
jmp 0x47a90b

Function at 0x47a9a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x5c7040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x814], 0xffffffff
mov ecx, dword [0x5ca950]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x47aa4d
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x47aa96
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.004f9090
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.0048dc60
add esp, 8
push edi
call fcn.004f50e3
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.004f8b10
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.0048dc60
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f5620
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.0048dc40
add esp, 4
test al, al
je 0x47aa99
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x47aa9c
xor eax, eax
dec eax
lock cmpxchg dword [0x5ca950], ecx
je 0x47a9d1
push ecx
call fcn.0056d1c0
add esp, 4
mov ecx, dword [0x5ca950]
mov dword [ebp - 0x814], ecx
jmp 0x47a9d1
int3
int3
push esi
call fcn.0048dc40
add esp, 4
test al, al
je 0x47aac4
cmp dword [ebp - 0x814], 0xffffffff
je 0x47aac4
push 0xffffffffffffffff
call fcn.0056d1c0
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x47aa6b
int3
Function at 0x47aad0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edi, ecx
mov eax, dword [0x5c7040]
xor eax, ebp
mov dword [esp + 0x1c], eax
push dword [0x5ca950]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
je 0x47ab15
xor esi, esi
and eax, 0xfffffffc
je 0x47ab58
mov ecx, dword [edi]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [edi + 4]
jne 0x47ab58
mov esi, dword [eax + ecx*8]
jmp 0x47ab58
mov dword [esp + 0x14], 0x14
mov dword [esp + 0x10], 0x1dd76000
mov esi, esp
push 0x1fb
push str....._base_threading_thread_local_storage.cc
push 0x5b5d39
push esi
call fcn.004b97c0
add esp, 4
movsd xmm0, qword [esp + 0x1c]
movsd qword [esp + 4], xmm0
mov dword [esp], esi
call fcn.00543f80
add esp, 0xc
xor esi, esi
mov ecx, dword [esp + 0x1c]
xor ecx, ebp
call fcn.004f5620
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret

Function at 0x47b300
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 0xb], 0
jns 0x47b319
mov edx, dword [edx]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x47b331
cmp byte [esi + 0x28], 1
je 0x47b3a2
or ebx, 0x20000000
test bl, 8
jne 0x47b3aa
mov dword [ebp - 0x10], 0
cmp byte [esi + 0x30], 0
mov eax, 0
je 0x47b34b
mov eax, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x47b359
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x18], eax
cmp byte [esi + 0x1c], 1
je 0x47b3fc
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 1
je 0x47b412
test ecx, ecx
jne 0x47b3cf
xor ecx, ecx
inc ecx
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x47b3c6
test esi, esi
sete al
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
or ebx, 0x80000000
jmp 0x47b331
cmp byte [esi + 0x34], 1
jne 0x47b3bb
or ebx, 0x40000000
jmp 0x47b336
or ebx, 0x10000000
jmp 0x47b336
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x47b393
cmp ecx, 4
jne 0x47b3db
mov ecx, 6
jmp 0x47b37c
mov esi, ecx
add ecx, 0xfffffffe
cmp ecx, 2
jae 0x47b3ec
mov ecx, 7
jmp 0x47b37c
cmp esi, 1
jne 0x47b3f8
mov ecx, 4
jmp 0x47b37c
xor ecx, ecx
jmp 0x47b37c
lea ecx, [esi + 0x10]
mov dword [ebp - 0x14], edx
call fcn.004416d0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x47b366
mov ecx, esi
mov esi, edx
call fcn.004416d0
mov ecx, dword [ebp + 0xc]
mov edx, esi
jmp 0x47b375
Function at 0x47b430
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x47b45a
cmp byte [esi + 0x28], 1
je 0x47b4e0
or ebx, 0x20000000
test bl, 8
jne 0x47b4eb
xor eax, eax
cmp byte [esi + 0x30], 0
mov ecx, 0
je 0x47b473
mov ecx, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x47b481
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0x1c], 1
je 0x47b507
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 1
je 0x47b51d
mov ecx, dword [ebp + 8]
cmp edx, 4
jne 0x47b4cf
mov edx, 6
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x47b514
test esi, esi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov esi, edx
add edx, 0xfffffffe
cmp edx, 2
jae 0x47b52d
mov edx, 7
jmp 0x47b4a9
or ebx, 0x80000000
jmp 0x47b45a
cmp byte [esi + 0x34], 1
jne 0x47b4fc
or ebx, 0x40000000
jmp 0x47b463
or ebx, 0x10000000
jmp 0x47b463
lea ecx, [esi + 0x10]
call fcn.004416d0
jmp 0x47b48a
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x47b4c0
mov ecx, esi
mov esi, edx
call fcn.004416d0
mov edx, esi
jmp 0x47b49c
test esi, esi
jne 0x47b539
xor edx, edx
inc edx
jmp 0x47b4a9
cmp esi, 1
jne 0x47b548
mov edx, 4
jmp 0x47b4a9
xor edx, edx
jmp 0x47b4a9
Function at 0x47ca10
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x5c7040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5dcc28]
mov ecx, dword [0x5cacb4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x47cb96
mov esi, dword [0x5dcc18]
lea edi, [esi + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x47cbcc
mov ebx, esi
mov esi, dword [esi + 0x18]
test esi, esi
je 0x47cb4d
imul eax, dword [ebp + 8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0x6f47a654
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
add ebx, 0x14
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x20], eax
cmp eax, 1
jbe 0x47cb8c
mov edx, ecx
cmp ecx, esi
jb 0x47cae7
mov eax, ecx
xor edx, edx
div esi
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x47cb4d
mov ebx, dword [eax]
test ebx, ebx
je 0x47cb4d
lea eax, [esi - 1]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 4]
cmp eax, ecx
jne 0x47cb66
mov eax, dword [ebp + 8]
cmp dword [ebx + 8], eax
jne 0x47cb80
mov dword [ebp - 0x20], edi
lea edi, [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
push ebx
push edi
call fcn.0047d250
mov esi, dword [edi]
mov dword [edi], 0
test esi, esi
je 0x47cb4a
cmp byte [ebp - 0x14], 1
jne 0x47cb41
mov eax, dword [esi + 0xc]
test eax, eax
je 0x47cb41
lock dec dword [eax + 4]
je 0x47cbd8
push esi
call fcn.004f50ae
add esp, 4
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f5620
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [ebp - 0x20], 1
mov dword [ebp - 0x24], edx
jbe 0x47cbe6
cmp eax, esi
jb 0x47cb79
xor edx, edx
div esi
mov eax, edx
mov edx, dword [ebp - 0x24]
cmp eax, edx
jne 0x47cb4d
mov ebx, dword [ebx]
test ebx, ebx
jne 0x47caff
jmp 0x47cb4d
lea edx, [esi - 1]
and edx, ecx
jmp 0x47cae7
push 0x5dcc28
call fcn.004f50f1
add esp, 4
cmp dword [0x5dcc28], 0xffffffff
jne 0x47ca44
mov ecx, 0x5dcbf0
call fcn.0047cbf0
push 0x5dcc28
call fcn.004f516b
add esp, 4
jmp 0x47ca44
mov ecx, edi
call fcn.004a7a50
jmp 0x47ca5c
push eax
call fcn.004ad930
add esp, 4
jmp 0x47cb41
and eax, dword [ebp - 0x28]
jmp 0x47cb79
Function at 0x486d80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x486d97
test eax, eax
je 0x486d97
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
sete al
mov ecx, dword [0x5dcc6c]
test ecx, ecx
setne dl
and dl, al
cmp dl, 1
je 0x486dea
cmp dword [0x5dcc64], 0
je 0x486d91
mov esi, dword [0x5dcc68]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x486df4
test esi, esi
je 0x486d91
mov ecx, dword [0x5dcc64]
call dword [0x5c0d2c]
push esi
call ecx
add esp, 4
jmp 0x486d91
call dword [0x5c0d2c]
call ecx
jmp 0x486dae
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x486dd2
Function at 0x48c3c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x5c7040]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, SysReAllocString
cmp edx, 0x7fffffff
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x48c41f
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x48c41c
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f5620
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
int3
xor esi, esi
dec esi
jmp 0x48c40a

Function at 0x48c430
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x5c7040]
xor ecx, ebp
mov esi, SysReAllocString
cmp eax, 0x7fffffff
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push edx
mov edi, ebx
push ebx
mov esi, ecx
call ecx
test eax, eax
je 0x48c4b3
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x48c49d
cmp ebx, 0xffffffff
je 0x48c4b0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f5620
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x48c4c5
mov ebx, dword [ebp - 0x14]
jmp 0x48c489
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x48c489
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov ecx, esi
mov esi, dword [ebp - 0x18]
jmp 0x48c466

Function at 0x48c920
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xa4
mov esi, dword [ebp + 8]
mov eax, dword [0x5c7040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.0048c810
add esp, 0x10
or edx, eax
jne 0x48c957
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x48c96d
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004f5620
mov eax, ebx
add esp, 0xa4
pop esi
pop ebx
pop ebp
ret
push 2
call fcn.004b90d0
add esp, 4
test al, al
je 0x48c9b7
call fcn.005427c0
lea esi, [ebp - 0xac]
mov ecx, esi
push eax
push 2
push 0xfc
push str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
call fcn.00542990
lea eax, [ebp - 0xa4]
push 0xc
push 0x5b7e9a
push eax
call fcn.00493c00
add esp, 0xc
mov ecx, esi
call fcn.005429f0
xor ebx, ebx
jmp 0x48c957