joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d2e10
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb4
mov esi, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x4d2e32
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4d2e67
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4d2e80
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov ecx, esi
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004d2f40
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4d2f36
call fcn.00642ea0
lea ecx, [ebp - 0xb4]
push eax
push 2
push 0x265
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.00642eb0
lea eax, [ebp - 0xac]
push 0x10
push str.CreateDirectory
push eax
call fcn.00533f70
add esp, 0xc
mov edi, eax
movsx eax, byte [esi + 0xb]
test eax, eax
jns 0x4d2ed4
mov eax, dword [esi + 4]
mov esi, dword [esi]
test eax, eax
js 0x4d2f3d
sete cl
test esi, esi
setne dl
or dl, cl
je 0x4d2f3d
lea ebx, [ebp - 0xc0]
push eax
push esi
push ebx
call fcn.005559f0
add esp, 0xc
movsx eax, byte [ebx + 0xb]
test eax, eax
jns 0x4d2f09
mov eax, dword [ebp - 0xbc]
mov ebx, dword [ebp - 0xc0]
push eax
push ebx
push edi
call fcn.00533f70
add esp, 0xc
cmp byte [ebp - 0xb5], 0
jns 0x4d2f2b
push dword [ebp - 0xc0]
call fcn.005c57c0
add esp, 4
lea ecx, [ebp - 0xb4]
call fcn.00642f10
xor ebx, ebx
jmp 0x4d2e69
ud2

Function at 0x4d2f40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov esi, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x4d2f62
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4d2fed
mov bl, 1
test al, 0x10
je 0x4d2f8b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4d2fe9
lea edi, [ebp - 0xb4]
mov ecx, edi
push 2
push 0x255
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.004ba430
lea eax, [ebp - 0xac]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00533f70
add esp, 0xc
push esi
push eax
call fcn.00643c60
add esp, 8
push 0x11
push str.:_not_a_directory
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, edi
call fcn.004ba910
xor ebx, ebx
jmp 0x4d2f74
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4d2fe9
call fcn.00642ea0
lea edi, [ebp - 0xb4]
mov ecx, edi
push eax
push 2
push 0x251
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.00642eb0
lea eax, [ebp - 0xac]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00533f70
add esp, 0xc
push esi
push eax
call fcn.00643c60
add esp, 8
mov ecx, edi
call fcn.00642f10
jmp 0x4d2fe9
Function at 0x4d4090
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.004d30d0
mov eax, dword [esi]
test eax, eax
je 0x4d40e3
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x4d40ea
lea ecx, [ebp - 0x14]
call fcn.004d39b0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x4d40c5
cmp dword [ebx + 0x50], 0
jne 0x4d4109
cmp byte [ebx + 0x1b], 0
js 0x4d40fb
lea eax, [ebx + 0x10]
jmp 0x4d40fe
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x4d410e
add ebx, 0x58
jmp 0x4d40c1
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x4d4134
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.006ac520
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x4d4109
mov ecx, dword [ebp + 8]
push ebx
call fcn.006ac3f0
mov ecx, eax
jmp 0x4d412c

Function at 0x4d4150
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x14]
mov dword [esi], 0xffffffff
mov edx, esi
call fcn.004d30d0
mov eax, dword [esi]
test eax, eax
je 0x4d41a3
mov ebx, dword [eax + 0x28]
mov edi, dword [eax + 0x2c]
xor esi, esi
cmp ebx, edi
jne 0x4d41aa
lea ecx, [ebp - 0x14]
call fcn.004d39b0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x4d4185
cmp dword [ebx + 0x50], 2
jne 0x4d41c9
cmp byte [ebx + 0x1b], 0
js 0x4d41bb
lea eax, [ebx + 0x10]
jmp 0x4d41be
mov eax, dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x4d41ce
add ebx, 0x58
jmp 0x4d4181
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jae 0x4d41f4
push ebx
mov dword [ebp - 0x18], edx
push edx
call fcn.006ac520
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 0x50
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x4d41c9
mov ecx, dword [ebp + 8]
push ebx
call fcn.006ac3f0
mov ecx, eax
jmp 0x4d41ec
Function at 0x4d52a0
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
jns 0x4d52b9
mov ecx, dword [ecx]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x14], edx
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, dword [esi]
cmp ebx, eax
je 0x4d52ff
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4d5359
lea eax, [edi + 1]
cmp eax, 2
jb 0x4d52f6
mov dword [esi], edi
call fcn.0055fb70
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [esi]
lea eax, [ebx + 1]
cmp eax, 2
jae 0x4d5313
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov esi, dword [ebp - 0x10]
mov eax, esi
add eax, 1
mov edx, dword [ebp - 0x14]
mov ecx, edx
adc ecx, 0x80000000
cmp eax, 2
sbb ecx, 0
jae 0x4d5349
xor eax, eax
test edx, edx
setns al
neg eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
sete al
jmp 0x4d5309
push 0
push 0x3e8
push edx
push esi
call fcn.005f2060
jmp 0x4d5337
call fcn.0055fb70
push dword [esi]
call fcn.0054ae70
add esp, 4
mov dword [esi], 0
jmp 0x4d52e7

Function at 0x4da650
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x4da729
cmp dword [esi], 0
jne 0x4da729
cmp dword [esi + 0xc], 0
jne 0x4da729
xor eax, eax
cmp dword [esi + 4], 0
jne 0x4da729
mov ebx, dword [edi]
cmp eax, ebx
je 0x4da6b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x4da6f9
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4da6a9
mov dword [esi], ebx
call fcn.0055fb70
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x4da6e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x4da710
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4da6dc
mov dword [esi + 4], ebx
call fcn.0055fb70
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0055fb70
push dword [esi]
call fcn.0054ae70
add esp, 4
mov dword [esi], 0
jmp 0x4da69a
call fcn.0055fb70
push dword [esi + 4]
call fcn.0054ae70
add esp, 4
mov dword [esi + 4], 0
jmp 0x4da6cc
mov ecx, esi
call fcn.006b4650
mov eax, dword [esi]
jmp 0x4da684
Function at 0x4e8650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [ecx + 0x15bc]
mov ebx, dword [ecx + 0x15c0]
add ebx, eax
mov eax, dword [ecx + 0x15b4]
mov ecx, ebx
sub ecx, eax
cmp ecx, 0x40000001
jb 0x4e8686
push dword [ebp + 8]
call fcn.0050f390
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [esp + 0xc]
test eax, eax
mov ecx, 0x40000000
mov edi, 0xaf000000
cmove edi, ecx
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x54], 0x343677
mov dword [esp + 0x50], 0x6f777369
lea eax, [esp + 0x50]
push eax
call fcn.00410a30
add esp, 4
cmp ebx, edi
jbe 0x4e86e6
push ebx
call fcn.0050f3c0
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x44], 0x657a69
mov dword [esp + 0x40], 0x735f6176
lea eax, [esp + 0x40]
push eax
call fcn.00410a30
add esp, 4
mov eax, dword [esi + 0x15c4]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], 0x20200063
mov dword [esp + 0x30], 0x6f6c6c61
lea eax, [esp + 0x30]
push eax
call fcn.00410a30
add esp, 4
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov eax, dword [esi + 0x15b4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0x20007469
mov dword [esp + 0x10], 0x6d6d6f63
lea eax, [esp + 0x10]
push eax
call fcn.00410a30
add esp, 4
mov esi, dword [ebp + 8]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0x20202000
mov dword [esp + 0x20], 0x657a6973
lea eax, [esp + 0x20]
push eax
call fcn.00410a30
add esp, 4
mov ecx, dword [0x81ee30]
test ecx, ecx
je 0x4e87b9
call dword [0x8010bc]
push esi
call ecx
add esp, 4
push esi
call fcn.004d79d0
int3
Function at 0x4efe20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x808040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x4efe50
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x4eff60
push 0
push eax
push 0x4efdb0
push 0x81c300
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4eff58
cmp dword [0x81c304], 0
jne 0x4efe3c
push dword [0x81c308]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4efe3c
mov esi, eax
mov eax, 0x81c30c
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x81c310]
mov ebx, dword [0x81c314]
mov eax, dword [0x81c318]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x81c31c]
mov dword [ebp - 0x20], eax
mov eax, dword [0x81c320]
mov dword [ebp - 0x24], eax
mov eax, 0x81c30c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
jne 0x4eff3e
test ebx, ebx
jne 0x4eff2b
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x4eff07
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
jne 0x4efef6
test ebx, ebx
jne 0x4eff18
push esi
call fcn.004bfb50
add esp, 4
jmp 0x4efe3c
mov edi, dword [esi + 0xc]
call dword [0x8010bc]
push edi
call ecx
add esp, 4
jmp 0x4efee4
mov edi, dword [esi + 8]
call dword [0x8010bc]
push edi
call ecx
add esp, 4
jmp 0x4efeda
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [0x8010bc]
push edi
call ebx
add esp, 4
jmp 0x4efee8
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [0x8010bc]
push edi
call ebx
add esp, 4
jmp 0x4efed3
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [0x8010bc]
push dword [ebp - 0x18]
call edi
add esp, 4
jmp 0x4efecf
call fcn.005dae09
int3
Function at 0x4eff80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x4eff60
push 0
push eax
push 0x4efdb0
push 0x81c300
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4f0048
mov esi, dword [ebp + 0xc]
cmp dword [0x81c304], 0
jne 0x4f0056
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x81c308]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x4f000b
push 0x14
push 1
call fcn.004bfce0
add esp, 8
test eax, eax
je 0x4f0056
mov edi, eax
push eax
push dword [0x81c308]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4f004d
mov ebx, dword [ebp + 8]
mov esi, 0x81c30c
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x81c310], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005dae09
push edi
call fcn.004bfb50
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [0x8010bc]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x4f0034

Function at 0x4f17a0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea edx, [ebp - 0x18]
mov dword [edx], eax
mov dword [edx + 4], eax
push 6
push edx
push ecx
call fcn.00567410
add esp, 0xc
xor esi, esi
test eax, eax
je 0x4f17fd
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
movzx eax, byte [0x79dfe9]
cmp ebx, eax
jne 0x4f1811
mov esi, 0x79dfdc
test al, al
je 0x4f17fd
push ebx
push 0x79dfe0
push edi
call fcn.005c7efd
add esp, 0xc
test eax, eax
jne 0x4f1811
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [0x79e111]
cmp ebx, eax
jne 0x4f1838
mov esi, 0x79e104
test al, al
je 0x4f17fd
push ebx
push 0x79e108
push edi
call fcn.005c7efd
add esp, 0xc
test eax, eax
je 0x4f17fd
movzx eax, byte [0x79e07d]
cmp ebx, eax
jne 0x4f185f
mov esi, 0x79e070
test al, al
je 0x4f17fd
push ebx
push 0x79e074
push edi
call fcn.005c7efd
add esp, 0xc
test eax, eax
je 0x4f17fd
movzx eax, byte [0x79e23d]
cmp ebx, eax
jne 0x4f1893
mov esi, 0x79e230
test al, al
je 0x4f17fd
push ebx
push 0x79e234
push edi
call fcn.005c7efd
add esp, 0xc
test eax, eax
je 0x4f17fd
jmp 0x4f1893
xor esi, esi
jmp 0x4f17fd
movzx eax, byte [0x79e1a5]
cmp ebx, eax
jne 0x4f188c
mov esi, 0x79e198
test al, al
je 0x4f17fd
push ebx
push 0x79e19c
push edi
call fcn.005c7efd
add esp, 0xc
test eax, eax
je 0x4f17fd
jmp 0x4f188c
Function at 0x4f76e0
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov edi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movaps xmm0, xmmword [0x799750]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4f7710
mov eax, dword [edi]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x110000
call ebx
cmp eax, 0xffffffff
je 0x4f77a6
mov esi, eax
lea eax, [ebp - 0xb8]
mov dword [eax], 2
xor edi, edi
push edi
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x4f7898
lea eax, [ebp - 0xbc]
mov dword [eax], edi
push edi
push eax
push 0xc
push dword [ebp + 0x10]
push 0x24
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x4f785c
mov bl, 1
cmp dword [ebp - 0xbc], 0xc
jne 0x4f78e6
push esi
call fcn.004f7e20
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x4f780e
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4f77bd
mov eax, dword [edi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
movaps xmm0, xmmword [0x799750]
jne 0x4f7706
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4f7855
call fcn.00642ea0
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0x71
push 0x799780
call fcn.00642eb0
lea eax, [ebp - 0xac]
push 0xd
push str.WaitNamedPipe
jmp 0x4f7845
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4f7855
call fcn.00642ea0
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0x6c
push 0x799780
call fcn.00642eb0
lea eax, [ebp - 0xac]
push 0xa
push 0x7997ca
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, esi
call fcn.00642f10
xor ebx, ebx
jmp 0x4f778f
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4f78df
call fcn.00642ea0
lea edi, [ebp - 0xb4]
mov ecx, edi
push eax
push 2
push 0x88
push 0x799780
call fcn.00642eb0
lea eax, [ebp - 0xac]
push 0x11
push 0x7997fb
jmp 0x4f78cf
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4f78df
call fcn.00642ea0
lea edi, [ebp - 0xb4]
mov ecx, edi
push eax
push 2
push 0x7a
push 0x799780
call fcn.00642eb0
lea eax, [ebp - 0xac]
push 0x17
push 0x7997e3
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, edi
call fcn.00642f10
xor ebx, ebx
jmp 0x4f7786
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4f78df
lea edi, [ebp - 0xb4]
mov ecx, edi
push 2
push 0x8c
push 0x799780
call fcn.004ba430
lea eax, [ebp - 0xac]
push 0x1c
push str.TransactNamedPipe:_expected
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, eax
push 0xc
call fcn.00533160
push 0xb
push str.__observed
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, eax
push dword [ebp - 0xbc]
call fcn.004114c0
mov ecx, edi
call fcn.004ba910
jmp 0x4f78df
Function at 0x4f7960
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x12c
mov esi, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov ecx, dword [0x808040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor ecx, ecx
dec ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], ecx
test al, al
je 0x4f7a3b
lea ebx, [ebp - 0x120]
xor edi, edi
push 0x110
push edi
push ebx
call fcn.005c9b00
add esp, 0xc
mov dword [ebx - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x77fb40]
movups xmmword [esp], xmm0
mov ebx, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call ebx
mov ecx, 3
push ecx
push 1
push edx
push eax
call ebx
mov ecx, 3
push ecx
push 0x20
push edx
push eax
call ebx
lea ecx, [ebp - 0x120]
mov dword [ecx - 8], 6
mov dword [ecx - 4], edi
mov word [ecx + 0x108], 0
lea ecx, [ebp - 0x12c]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ebx, 0x80003
test eax, eax
je 0x4f7a42
lea edi, [ebp - 0x138]
mov dword [edi], 0xc
push 0
call fcn.004f7a90
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], 1
jmp 0x4f7a42
xor edi, edi
mov ebx, 3
cmp byte [esi + 0xb], 0
jns 0x4f7a4a
mov esi, dword [esi]
sub esp, 0x20
mov dword [esp + 0x1c], edi
movaps xmm0, xmmword [0x799760]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 0x12c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4f8020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret

Function at 0x4f88e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x808040]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, SysReAllocString
cmp edx, 0x7fffffff
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4f893f
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x4f893c
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
int3
xor esi, esi
dec esi
jmp 0x4f892a
Function at 0x4f8950
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x808040]
xor ecx, ebp
mov esi, SysReAllocString
cmp eax, 0x7fffffff
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push edx
mov edi, ebx
push ebx
mov esi, ecx
call ecx
test eax, eax
je 0x4f89d3
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4f89bd
cmp ebx, 0xffffffff
je 0x4f89d0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x4f89e5
mov ebx, dword [ebp - 0x14]
jmp 0x4f89a9
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x4f89a9
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov ecx, esi
mov esi, dword [ebp - 0x18]
jmp 0x4f8986

Function at 0x4f8e10
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xa8
mov esi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.004f8d20
add esp, 0x10
or edx, eax
jne 0x4f8e47
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x4f8e5d
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xa8
pop esi
pop ebx
pop ebp
ret
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x4f8ea7
call fcn.00642ea0
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0xfb
push str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
call fcn.00642eb0
lea eax, [ebp - 0xa8]
push 0xc
push 0x79a7f1
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, esi
call fcn.00642f10
xor ebx, ebx
jmp 0x4f8e47