joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5572c0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [ebp - 0x14]
mov dword [eax], ebx
mov ecx, 0x20019
or ecx, dword [esi + 4]
push eax
push ecx
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
je 0x55730e
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
mov dword [eax], ebx
mov ecx, dword [ebp - 0x14]
sub esp, 0x30
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
movups xmmword [esp + 4], xmm0
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x5572f8
mov edi, 0x91
cmp dword [ebp - 0x18], 0
jne 0x5572f8
push 0
push dword [esi + 4]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov edi, eax
jmp 0x5572f8

Function at 0x55b7a0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x208
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x210]
push 0x200
push 0xff
push edi
call fcn.00508060
add esp, 0xc
lea esi, [ebp - 0x214]
mov dword [esi], 0x100
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
sete cl
mov eax, dword [esi]
test eax, eax
sete bl
or bl, cl
jne 0x55b819
mov esi, dword [ebp + 8]
mov ecx, esi
push eax
call fcn.00442df0
mov ecx, esi
push 0x2e
push 1
call fcn.004432c0
mov eax, dword [ebp - 0x214]
dec eax
mov ecx, esi
push eax
push edi
call fcn.004db260
xor bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
add esp, 0x208
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x561f70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
xor eax, eax
mov ecx, 0xedb88320
mov edx, eax
shr edx, 1
mov esi, eax
and esi, 1
neg esi
and esi, ecx
xor esi, edx
shr esi, 1
and edx, 1
neg edx
and edx, ecx
xor edx, esi
shr edx, 1
and esi, 1
neg esi
and esi, ecx
xor esi, edx
shr esi, 1
and edx, 1
neg edx
and edx, ecx
xor edx, esi
shr edx, 1
and esi, 1
neg esi
and esi, ecx
xor esi, edx
shr esi, 1
and edx, 1
neg edx
and edx, ecx
xor edx, esi
shr edx, 1
and esi, 1
neg esi
and esi, ecx
xor esi, edx
shr esi, 1
and edx, 1
neg edx
and edx, ecx
xor edx, esi
mov dword [eax*4 + 0x6071bc], edx
inc eax
cmp eax, 0x100
jne 0x561f7b
mov eax, 0xffffe400
mov ecx, dword [eax + 0x608dbc]
movzx edx, cl
shr ecx, 8
xor ecx, dword [edx*4 + 0x6071bc]
mov dword [eax + 0x6091bc], ecx
add eax, 4
jne 0x561feb
mov eax, 0x57b940
mov dword [0x6091bc], eax
mov dword [0x6071b8], eax
mov dword [0x6091c0], 0x57b9f0
call fcn.0057bc00
test eax, eax
jne 0x562035
mov dword [0x6071b8], 0x57b9f0
pop esi
pop ebp
ret

Function at 0x563940
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov eax, esp
push 0x16c
push str..._.._base_win_shortcut.cc
push 0x5e9710
push eax
call fcn.004dea80
add esp, 0x10
xor ebx, ebx
mov ecx, esi
push ebx
lea eax, [esp + 4]
push eax
call fcn.004e60a0
cmp byte [edi + 0xb], 0
jns 0x5639a6
mov edi, dword [edi]
push ebx
push ebx
push ebx
push edi
push str.taskbarpin
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x21
setge bl
mov ecx, esi
call fcn.004e6100
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5639e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov eax, esp
push 0x175
push str..._.._base_win_shortcut.cc
push str.UnpinShortcutFromTaskbar
push eax
call fcn.004dea80
add esp, 0x10
xor ebx, ebx
mov ecx, esi
push ebx
lea eax, [esp + 4]
push eax
call fcn.004e60a0
cmp byte [edi + 0xb], 0
jns 0x563a46
mov edi, dword [edi]
push ebx
push ebx
push ebx
push edi
push str.taskbarunpin
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x21
setge bl
mov ecx, esi
call fcn.004e6100
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x569d40
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x569d55
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, edx
cmp edx, 4
jb 0x569d82
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x569d5c
cmp edx, 2
je 0x569d9c
cmp edx, 3
je 0x569d93
cmp edx, 1
jne 0x569db0
jmp 0x569da5
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4

Function at 0x570fb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, 5
pop ebp
jmp fcn.00570fd0

Function at 0x570fd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x218
mov ebx, edx
mov edi, ecx
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.00508060
add esp, 0xc
mov word [esi - 2], 0
lea esi, [ebp - 0x218]
xor eax, eax
push esi
push eax
push eax
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test eax, eax
js 0x57104b
push esi
call fcn.0051f544
add esp, 4
mov edx, esi
lea esi, [ebp - 0x224]
mov ecx, esi
push eax
push edx
call fcn.004dd130
mov ecx, ebx
push esi
call fcn.004dd210
mov ecx, esi
call fcn.004dd1f0
test edi, edi
setns bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5710d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, 0xd
pop ebp
jmp fcn.00570fd0

Function at 0x5710f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, 0x27
pop ebp
jmp fcn.00570fd0

Function at 0x571110
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, 0xe
pop ebp
jmp fcn.00570fd0
Function at 0x571d90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [ecx + 0x1c]
mov ebx, dword [ecx + 0x20]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp esi, ebx
je 0x571de2
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.00571500
test al, al
jne 0x571dcf
add esi, 0x58
cmp esi, ebx
jne 0x571dba
mov esi, ebx
mov eax, dword [ebp - 0x24]
cmp esi, dword [eax + 0x20]
je 0x571de2
cmp byte [esi + 0x1b], 0
jns 0x571df9
mov eax, dword [esi + 0x10]
jmp 0x571dfc
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x571de5
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x571de5

Function at 0x571f50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x1c]
mov ebx, dword [ecx + 0x20]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp edi, ebx
je 0x571fad
mov dword [ebp - 0x24], ecx
lea esi, [ebp - 0x20]
mov ecx, edi
push esi
call fcn.00571500
test al, al
jne 0x571f8f
add edi, 0x58
cmp edi, ebx
jne 0x571f7a
mov edi, ebx
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x24]
cmp edi, dword [esi + 0x20]
je 0x571fb0
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x571fc4
cmp byte [edi + 0x1b], 0
jns 0x571fd2
mov eax, dword [edi + 0x10]
jmp 0x571fd5
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
jmp 0x571fb0
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x571fb0
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x571fb0
mov byte [esi + 0x18], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor ebx, ebx
jmp 0x571fb0
Function at 0x57f420
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
lea edi, [ecx + 0xc]
lea eax, [ecx + 0x10]
push 0x228
push 0
push eax
call fcn.00508060
add esp, 0xc
mov dword [esi + 0xc], 0x22c
cmp byte [esi + 8], 0
je 0x57f45c
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
pop esi
pop edi
pop ebp
ret
mov byte [esi + 8], 1
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32FirstW
jmp 0x57f453

Function at 0x5858c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x5858e3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x585921
mov ebx, eax
cmp byte [ebp + 0xc], 0
jne 0x5859c8
mov eax, ebx
and eax, 0x400
je 0x5859c8
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004deac0
add esp, 4
test al, al
je 0x585908
call fcn.00551fb0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x81
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.005520e0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.004d4870
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x585971
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.004e4b90
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x585996
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push esi
call fcn.004d4870
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x5859b8
push dword [ebp - 0xc4]
call fcn.00503da5
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00552140
jmp 0x585908
and ebx, 0x10
shr ebx, 4
jmp 0x58590a
Function at 0x5859e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x585a03
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
je 0x585a29
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp + 0x10], 0
je 0x585a40
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x585adb
push 2
call fcn.004deac0
add esp, 4
test al, al
je 0x585ad4
call fcn.00551fb0
lea ecx, [ebp - 0xc4]
push eax
push 2
push 0x61
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.005520e0
lea eax, [ebp - 0xbc]
push 0x10
push str.CreateDirectory
push eax
call fcn.004d4870
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x585a91
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.004e4b90
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x585aad
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
push eax
push ebx
push esi
call fcn.004d4870
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x585ac9
push dword [ebp - 0x1c]
call fcn.00503da5
add esp, 4
lea ecx, [ebp - 0xc4]
call fcn.00552140
xor ebx, ebx
jmp 0x585a12
push 1
push edi
call fcn.005858c0
add esp, 8
test al, al
jne 0x585a12
push 2
call fcn.004deac0
add esp, 4
test al, al
je 0x585ad4
lea ecx, [ebp - 0xc4]
push 2
push 0x5c
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.00454e90
movzx eax, byte [edi + 0xb]
test al, al
jns 0x585b1d
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea esi, [ebp - 0xbc]
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.004e4b90
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x585b3f
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
push eax
push ebx
push esi
call fcn.004d4870
add esp, 0xc
push 0x10
push str._not_a_directory
push eax
call fcn.004d4870
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x585b6b
push dword [ebp - 0x1c]
call fcn.00503da5
add esp, 4
lea ecx, [ebp - 0xc4]
call fcn.00455270
jmp 0x585ad4
Function at 0x585b80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x585ba3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x585bce
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004deac0
add esp, 4
test al, al
je 0x585c71
call fcn.00551fb0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x74
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.005520e0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.004d4870
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x585c1f
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push eax
push edi
push ebx
call fcn.004e4b90
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x585c44
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push esi
call fcn.004d4870
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x585c66
push dword [ebp - 0xc4]
call fcn.00503da5
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00552140
xor ebx, ebx
jmp 0x585bb7

Function at 0x585c80
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, dword [ebp + 8]
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x585ca3
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x585cbf
and eax, 0x410
cmp eax, 0x410
je 0x585d9a
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x585cc9
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
je 0x585ced
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004deac0
add esp, 4
test al, al
je 0x585d93
call fcn.00551fb0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x94
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.005520e0
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.004d4870
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x585d41
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.004e4b90
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x585d66
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.004d4870
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x585d88
push dword [ebp - 0xc4]
call fcn.00503da5
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00552140
xor ebx, ebx
jmp 0x585cd6
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00585dc0
Function at 0x585dc0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, ecx
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x585de2
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
je 0x585e0b
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004deac0
add esp, 4
test al, al
je 0x585def
call fcn.00551fb0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x2f
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.005520e0
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.004d4870
add esp, 0xc
movzx ecx, byte [edi + 0xb]
test cl, cl
mov dword [ebp - 0xc8], eax
jns 0x585e5c
mov ecx, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc4]
push ecx
push edi
push ebx
call fcn.004e4b90
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x585e81
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push dword [ebp - 0xc8]
call fcn.004d4870
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x585ea8
push dword [ebp - 0xc4]
call fcn.00503da5
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.00552140
jmp 0x585def

Function at 0x5871e0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00585c80
Function at 0x5a2570
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edx, dword [ebp + 0xc]
cmp edx, 0x40
jb 0x5a25bd
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0x4d
jne 0x5a25bd
cmp byte [ecx + 1], 0x5a
jne 0x5a25bd
mov esi, dword [ecx + 0x3c]
xor eax, eax
cmp esi, 0x40
jb 0x5a25bf
mov edi, esi
and edi, 7
jne 0x5a25bf
cmp esi, edx
jae 0x5a25bf
mov edi, edx
sub edi, esi
cmp edi, 0x18
jb 0x5a25bf
cmp byte [ecx + esi], 0x50
jne 0x5a25bd
cmp byte [ecx + esi + 1], 0x45
jne 0x5a25bd
cmp byte [ecx + esi + 2], 0
je 0x5a25c3
xor eax, eax
pop esi
pop edi
pop ebp
ret
cmp byte [ecx + esi + 3], 0
jne 0x5a25bd
add esi, 0x18
xor eax, eax
sub edx, esi
jbe 0x5a25bf
cmp edx, 2
jb 0x5a25bf
movzx eax, word [ebp + 0x10]
cmp word [ecx + esi], ax
sete al
jmp 0x5a25bf
Function at 0x5a7490
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0xdc], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov dword [esi + 0x20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x14], 0x100
jb 0x5a7517
push 1
call fcn.004deac0
add esp, 4
test al, al
je 0x5a7517
lea esi, [esp + 0xc]
mov ecx, esi
push 1
push 0xb2
push str..._.._third_party_crashpad_crashpad_snapshot_win_system_snapshot_win.cc
call fcn.00454e90
lea eax, [esp + 0x14]
push 0x2c
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, esi
call fcn.00455270
mov eax, dword [esp + 0xc4]
cmp eax, 0x100
mov ebx, 0xff
cmovb ebx, eax
mov ecx, dword [esp + 0xdc]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
Function at 0x5b0f50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov ebx, ecx
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.00534790
mov ecx, ebx
push esi
push 0
push 0x40
push edx
push eax
call fcn.005b37a0
test al, al
je 0x5b100f
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x5b1083
mov ecx, edi
call fcn.00534790
mov edi, eax
mov eax, dword [esp + 0xec]
mov esi, eax
sar esi, 0x1f
add edi, eax
adc esi, edx
mov ecx, ebx
push dword [ebp + 8]
push 0
push 0x108
push esi
push edi
call fcn.005b37a0
test al, al
je 0x5b10b5
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x5b10ea
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x5b1069
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x5b1069
push 1
call fcn.004deac0
add esp, 4
test al, al
je 0x5b1067
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x154
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.00454e90
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.004d4870
add esp, 0xc
movzx ecx, byte [ebx + 0xb]
test cl, cl
jns 0x5b1055
mov ecx, dword [ebx + 4]
mov ebx, dword [ebx]
push ecx
push ebx
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, edi
call fcn.00455270
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.00504596
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.004deac0
add esp, 4
test al, al
je 0x5b1067
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x15a
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.00454e90
lea eax, [esp + 0x14]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x5b103f
push 1
call fcn.004deac0
add esp, 4
test al, al
je 0x5b1067
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x162
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.00454e90
lea eax, [esp + 0x14]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x5b103f
push 1
call fcn.004deac0
add esp, 4
test al, al
je 0x5b1067
lea edi, [esp + 0xc]
mov ecx, edi
push 1
push 0x168
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.00454e90
lea eax, [esp + 0x14]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x5b103f