joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489dd7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
xor ebx, ebx
cmp dword [0x4f41dc], 0xffffffff
mov dword [ebp - 4], ebx
jne 0x489e47
push 2
call fcn.00432780
pop ecx
test al, al
je 0x489e23
push 2
push 0x30b
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea ecx, [ebp - 0xb4]
call fcn.00431700
add eax, 8
push str.not_connected
push eax
call fcn.00415b8c
pop ecx
pop ecx
inc ebx
test bl, 1
je 0x489e33
lea ecx, [ebp - 0xb4]
call fcn.00431880
push 0xffff7003
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x489e4f
push dword [ebp + 8]
call fcn.0048adfe
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48a2cc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 4]
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push eax
push edi
mov dword [ebp - 0x14], ebx
call fcn.00489cab
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
lea eax, [ebp - 0x10]
pop ecx
pop ecx
push ebx
push ebx
push ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 8], 1
call esi
push ebx
push ebx
mov dword [0x4f41dc], eax
lea eax, [ebp - 0x10]
push ebx
push eax
call esi
push ebx
push ebx
mov dword [0x4f41e0], eax
lea eax, [ebp - 0x10]
push ebx
push eax
call esi
mov dword [0x4f41e4], eax
call fcn.00489c79
call fcn.0048a1dd
push 0x90
call fcn.0049d3c0
mov edx, eax
pop ecx
test edx, edx
je 0x48a374
mov eax, dword [ebp - 4]
or esi, 0xffffffff
push ecx
mov ecx, esp
push edi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
mov dword [ecx], eax
mov ecx, edx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00489b07
mov ecx, eax
jmp 0x48a379
mov esi, dword [ebp - 4]
mov ecx, ebx
cmp byte [ebp + 0x24], bl
je 0x48a404
push ebx
push ebx
push ecx
push 0x489c38
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 0x24], eax
lea ecx, [edi + 0x18]
lea eax, [ebp + 0x24]
push eax
call fcn.0048b0d6
cmp dword [edi + 0x18], ebx
jne 0x48a400
push 2
pop edi
push edi
call fcn.00432780
pop ecx
test al, al
je 0x48a3e5
call sub.KERNEL32.dll_GetLastError
push eax
push edi
push 0x270
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea ecx, [ebp - 0xcc]
call fcn.00431820
add eax, 0x10
push 0x4de764
push eax
call fcn.00415b8c
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x48a3e8
mov eax, dword [ebp - 0x14]
test al, 1
je 0x48a3f7
lea ecx, [ebp - 0xcc]
call fcn.00431af0
mov eax, 0x4f69c4
xchg dword [eax], edi
jmp 0x48a411
mov bl, 1
jmp 0x48a411
push ecx
mov eax, esp
mov dword [eax], ecx
call fcn.0048a428
pop ecx
mov bl, al
cmp esi, 0xffffffff
je 0x48a41d
push esi
call fcn.0048bdd2
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x48adfe
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call fcn.00489c56
push 2
pop esi
cmp eax, esi
jne 0x48ae54
push esi
call fcn.00432780
pop ecx
test al, al
je 0x48ae4c
push esi
push 0x80
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea ecx, [ebp - 0xb4]
call fcn.00431700
add eax, 8
push str.crash_server_failed_to_launch__self_terminating
push eax
call fcn.00415b8c
pop ecx
pop ecx
inc ebx
test bl, 1
jmp 0x48aed6
xor eax, eax
mov ecx, 0x4f69e0
inc eax
lock xadd dword [ecx], eax
inc eax
cmp eax, 1
jle 0x48ae6f
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SleepEx]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [0x4f41dc]
mov dword [0x4f69b0], eax
mov eax, dword [ebp + 8]
cdq
mov dword [0x4f69a8], eax
mov dword [0x4f69ac], edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.00432780
pop ecx
test al, al
je 0x48aed3
push esi
push 0xac
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea ecx, [ebp - 0xb4]
call fcn.00431700
add eax, 8
push str.crash_server_did_not_respond__self_terminating
push eax
call fcn.00415b8c
pop ecx
pop ecx
mov ebx, esi
test bl, 2
je 0x48aee3
lea ecx, [ebp - 0xb4]
call fcn.00431880
push 0xffff7001
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x48c0e9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x48c15a
push 2
call fcn.00432780
pop ecx
test al, al
je 0x48c143
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xf2
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpadutil_file_file_io_win.cc
lea ecx, [ebp - 0xc0]
call fcn.00431820
add eax, 0x10
push 0x4deb74
push eax
call fcn.00415b8c
pop ecx
pop ecx
inc ebx
test bl, 1
je 0x48c153
lea ecx, [ebp - 0xc0]
call fcn.00431af0
or edx, 0xffffffff
mov eax, edx
jmp 0x48c160
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48c4f7
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
xor ebx, ebx
lea eax, [ebp - 0x10]
push ebx
push eax
xorps xmm0, xmm0
mov dword [ebp - 4], ebx
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x48c574
push 2
call fcn.00432780
pop ecx
test al, al
je 0x48c562
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xd9
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpadutil_file_file_io_win.cc
lea ecx, [ebp - 0xc8]
call fcn.00431820
add eax, 0x10
push 0x4deb44
push eax
call fcn.00415b8c
pop ecx
pop ecx
push 2
pop ebx
test bl, 2
je 0x48c57c
lea ecx, [ebp - 0xc8]
call fcn.00431af0
jmp 0x48c57c
mov eax, dword [ebp - 0x10]
or eax, dword [ebp - 0xc]
je 0x48c580
xor al, al
jmp 0x48c5d0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x48c5ce
push 2
call fcn.00432780
pop ecx
test al, al
je 0x48c5c9
xor ebx, ebx
inc ebx
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xe3
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpadutil_file_file_io_win.cc
lea ecx, [ebp - 0xc8]
call fcn.00431820
add eax, 0x10
push 0x4deb58
push eax
call fcn.00415b8c
pop ecx
pop ecx
test bl, 1
jmp 0x48c565
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48c704
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
test esi, esi
je 0x48c768
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x48c748
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x48c768
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x48c75d
or eax, 0xffffffff
jmp 0x48c76a
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x48c760
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x48c768
mov eax, dword [ebp + 0xc]
add ebx, eax
add edi, eax
sub esi, eax
jne 0x48c716
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x48c76f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 4]
push 0
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x48c79a
or eax, 0xffffffff
jmp 0x48c7dc
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
je 0x48c7d9
push str.bytes_written__size_dword
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00431550
add esp, 0xc
test eax, eax
je 0x48c7d9
push eax
push 0x74
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpadutil_file_file_io_win.cc
lea ecx, [ebp - 0xb8]
call fcn.00431750
lea ecx, [ebp - 0xb8]
call fcn.00431880
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x48cbcc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
cmp ecx, 6
jb 0x48cbfa
jne 0x48cbe6
shr eax, 8
cmp al, 1
jbe 0x48cbfa
push 0x10000000
push 0
push dword [ebp + 8]
call fcn.0048cafd
add esp, 0xc
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, 1
pop ebp
ret

Function at 0x48ee83
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ebx
mov dword [esi + 8], edi
call fcn.0048f026
mov byte [esi + 0x5d], al
pop ecx
test al, al
je 0x48eeaf
mov byte [esi + 0x5c], bl
jmp 0x48eec4
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x28], 9
sete al
mov byte [esi + 0x5c], al
cmp byte [esi + 0x5c], bl
je 0x48ef16
push 2
call fcn.00432780
pop ecx
test al, al
je 0x48eeff
push 2
push 0x218
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpadutilwinprocess_info.cc
lea ecx, [ebp - 0xd8]
call fcn.00431700
add eax, 8
push str.Reading_x64_process_from_x86_process_not_supported
push eax
call fcn.00415b8c
pop ecx
xor ebx, ebx
pop ecx
inc ebx
test bl, 1
je 0x48ef0f
lea ecx, [ebp - 0xd8]
call fcn.00431880
xor al, al
jmp 0x48f019
lea eax, [esi + 0x30]
push eax
lea ecx, [esi + 0x28]
push ecx
push esi
push ebx
push edi
call fcn.0048d400
add esp, 0x14
test al, al
jne 0x48ef68
push 2
call fcn.00432780
pop ecx
test al, al
je 0x48ef63
push 2
push 0x226
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpadutilwinprocess_info.cc
lea ecx, [ebp - 0xd8]
call fcn.00431700
add eax, 8
push str.GetProcessBasicInformation_failed
push eax
call fcn.00415b8c
pop ecx
pop ecx
push 2
pop ebx
test bl, 2
jmp 0x48ef02
push esi
push dword [esi + 0x2c]
push dword [esi + 0x28]
push edi
cmp byte [esi + 0x5c], bl
je 0x48ef7c
call fcn.0048d851
jmp 0x48ef81
call fcn.0048d614
add esp, 0x10
test al, al
jne 0x48efc6
push 2
call fcn.00432780
pop ecx
test al, al
je 0x48efbe
push 2
push 0x22f
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpadutilwinprocess_info.cc
lea ecx, [ebp - 0xd8]
call fcn.00431700
add eax, 8
push str.ReadProcessData_failed
push eax
call fcn.00415b8c
pop ecx
pop ecx
push 4
pop ebx
test bl, 4
jmp 0x48ef02
movzx eax, byte [esi + 0x5c]
push esi
push eax
push edi
call fcn.0048f408
add esp, 0xc
test al, al
jne 0x48f017
push 2
call fcn.00432780
pop ecx
test al, al
je 0x48f00f
push 2
push 0x234
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpadutilwinprocess_info.cc
lea ecx, [ebp - 0xd8]
call fcn.00431700
add eax, 8
push str.ReadMemoryInfo_failed
push eax
call fcn.00415b8c
pop ecx
pop ecx
push 8
pop ebx
test bl, 8
jmp 0x48ef02
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48fbd3
Capabilities:
Check os version
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov bl, byte [ebp + 0xc]
push esi
xor esi, esi
test bl, bl
je 0x48fc10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x48fc10
push edi
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea esi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], 0x4dfb94
mov dword [ebp - 4], 1
pop edi
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 8
jb 0x48fc1b
mov ecx, dword [ecx]
push esi
push 0
mov eax, 0x200
test bl, bl
push eax
push eax
push 2
push 6
push 3
pop eax
mov edx, 0x80003
cmovne eax, edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4912c8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4f4284]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], ebx
lea ecx, [edi + 0x18]
call fcn.004c6297
lea ecx, [ebp - 0x44]
push ecx
push ebx
push 0x40
push edx
push eax
mov ecx, edi
call fcn.00492d25
test al, al
jne 0x491361
push 1
call fcn.00432780
pop ecx
test al, al
je 0x49134a
push 1
push 0x119
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea ecx, [ebp - 0x104]
call fcn.00431700
push edi
add eax, 8
push str.could_not_read_dos_header_from
push eax
call fcn.00415b8c
pop ecx
pop ecx
push eax
call fcn.00415a50
pop ecx
pop ecx
inc ebx
test bl, 1
je 0x49135a
lea ecx, [ebp - 0x104]
call fcn.00431880
xor al, al
jmp 0x49148b
mov eax, 0x5a4d
cmp word [ebp - 0x44], ax
je 0x4913b0
push 1
call fcn.00432780
pop ecx
test al, al
je 0x4913ab
push 1
push 0x11f
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea ecx, [ebp - 0x104]
call fcn.00431700
push edi
add eax, 8
push str.invalid_e_magic_in_dos_header_of
push eax
call fcn.00415b8c
pop ecx
pop ecx
push eax
call fcn.00415a50
pop ecx
pop ecx
push 2
pop ebx
test bl, 2
jmp 0x49134d
lea ecx, [edi + 0x18]
call fcn.004c6297
mov ecx, eax
mov esi, edx
mov eax, dword [ebp - 8]
cdq
add eax, ecx
mov ecx, edi
mov dword [ebp - 0x54], eax
adc edx, esi
mov esi, dword [ebp - 0x4c]
push esi
push ebx
push 0x108
push edx
push eax
mov dword [ebp - 0x48], edx
call fcn.00492d25
test al, al
jne 0x491428
push 1
call fcn.00432780
pop ecx
test al, al
je 0x491420
push 1
push 0x127
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea ecx, [ebp - 0x104]
call fcn.00431700
push edi
add eax, 8
push str.could_not_read_nt_headers_from
push eax
call fcn.00415b8c
pop ecx
pop ecx
push eax
call fcn.00415a50
pop ecx
pop ecx
push 4
pop ebx
test bl, 4
jmp 0x49134d
cmp dword [esi], 0x4550
je 0x491477
push 1
call fcn.00432780
pop ecx
test al, al
je 0x49146f
push 1
push 0x12d
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea ecx, [ebp - 0x104]
call fcn.00431700
push edi
add eax, 8
push str.invalid_signature_in_nt_headers_of
push eax
call fcn.00415b8c
pop ecx
pop ecx
push eax
call fcn.00415a50
pop ecx
pop ecx
push 8
pop ebx
test bl, 8
jmp 0x49134d
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x491489
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x48]
mov dword [eax + 4], ecx
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d8a1
mov esp, ebp
pop ebp
ret 8
Function at 0x49149e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4f4284]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], ebx
lea ecx, [edi + 0x18]
call fcn.004c6297
lea ecx, [ebp - 0x44]
push ecx
push ebx
push 0x40
push edx
push eax
mov ecx, edi
call fcn.00492d25
test al, al
jne 0x491537
push 1
call fcn.00432780
pop ecx
test al, al
je 0x491520
push 1
push 0x119
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea ecx, [ebp - 0x104]
call fcn.00431700
push edi
add eax, 8
push str.could_not_read_dos_header_from
push eax
call fcn.00415b8c
pop ecx
pop ecx
push eax
call fcn.00415a50
pop ecx
pop ecx
inc ebx
test bl, 1
je 0x491530
lea ecx, [ebp - 0x104]
call fcn.00431880
xor al, al
jmp 0x491661
mov eax, 0x5a4d
cmp word [ebp - 0x44], ax
je 0x491586
push 1
call fcn.00432780
pop ecx
test al, al
je 0x491581
push 1
push 0x11f
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea ecx, [ebp - 0x104]
call fcn.00431700
push edi
add eax, 8
push str.invalid_e_magic_in_dos_header_of
push eax
call fcn.00415b8c
pop ecx
pop ecx
push eax
call fcn.00415a50
pop ecx
pop ecx
push 2
pop ebx
test bl, 2
jmp 0x491523
lea ecx, [edi + 0x18]
call fcn.004c6297
mov ecx, eax
mov esi, edx
mov eax, dword [ebp - 8]
cdq
add eax, ecx
mov ecx, edi
mov dword [ebp - 0x54], eax
adc edx, esi
mov esi, dword [ebp - 0x4c]
push esi
push ebx
push 0xf8
push edx
push eax
mov dword [ebp - 0x48], edx
call fcn.00492d25
test al, al
jne 0x4915fe
push 1
call fcn.00432780
pop ecx
test al, al
je 0x4915f6
push 1
push 0x127
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea ecx, [ebp - 0x104]
call fcn.00431700
push edi
add eax, 8
push str.could_not_read_nt_headers_from
push eax
call fcn.00415b8c
pop ecx
pop ecx
push eax
call fcn.00415a50
pop ecx
pop ecx
push 4
pop ebx
test bl, 4
jmp 0x491523
cmp dword [esi], 0x4550
je 0x49164d
push 1
call fcn.00432780
pop ecx
test al, al
je 0x491645
push 1
push 0x12d
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea ecx, [ebp - 0x104]
call fcn.00431700
push edi
add eax, 8
push str.invalid_signature_in_nt_headers_of
push eax
call fcn.00415b8c
pop ecx
pop ecx
push eax
call fcn.00415a50
pop ecx
pop ecx
push 8
pop ebx
test bl, 8
jmp 0x491523
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x49165f
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x48]
mov dword [eax + 4], ecx
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d8a1
mov esp, ebp
pop ebp
ret 8
Function at 0x491c5a
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword fs:[0x18]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [eax + 0x24]
mov dword [ebp - 4], ebx
cmp dword [esi + 0x2d0], eax
jne 0x491c9b
cmp dword [esi + 0x2d4], ebx
jne 0x491c9b
push esi
mov dword [esi + 0x2f8], ebx
call fcn.0048bc90
pop ecx
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x491cfb
push 2
call fcn.00432780
pop ecx
test al, al
je 0x491ce7
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x8e
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
lea ecx, [ebp - 0xbc]
call fcn.00431820
add eax, 0x10
push 0x4e01f0
push eax
call fcn.00415b8c
pop ecx
xor ebx, ebx
pop ecx
inc ebx
test bl, 1
je 0x491cf7
lea ecx, [ebp - 0xbc]
call fcn.00431af0
xor al, al
jmp 0x491c95
xor eax, eax
cmp byte [ebp + 0x10], 1
push 0x2cc
sete al
sub ecx, eax
push ebx
push esi
mov dword [esi + 0x2f8], ecx
call fcn.004a0ee0
add esp, 0xc
mov dword [esi], 0x1003f
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x491d7b
push 2
call fcn.00432780
pop ecx
test al, al
je 0x491d6b
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xa7
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
lea ecx, [ebp - 0x174]
call fcn.00431820
add eax, 0x10
push 0x4e0200
push eax
call fcn.00415b8c
pop ecx
pop ecx
push 2
pop ebx
test bl, 2
je 0x491cf7
lea ecx, [ebp - 0x174]
jmp 0x491cf2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x491c93
push 2
call fcn.00432780
pop ecx
test al, al
je 0x491dc8
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xad
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
lea ecx, [ebp - 0x22c]
call fcn.00431820
add eax, 0x10
push 0x4e0214
push eax
call fcn.00415b8c
pop ecx
pop ecx
push 4
pop ebx
test bl, 4
je 0x491cf7
lea ecx, [ebp - 0x22c]
jmp 0x491cf2
Function at 0x4baf80
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004badfd

Function at 0x4bf443
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bf0dd

Function at 0x4c4f60
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4f4284]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
mov eax, 0x1400
cmp ax, di
je 0x4c5009
push 9
lea eax, [ebp - 0x18]
mov ebx, edi
push eax
push 0x59
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x4c5009
mov ecx, dword [ebp - 0x1c]
dec eax
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0041b79d
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4c4fc4
mov eax, dword [esi]
jmp 0x4c4fc6
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov eax, 0x400
cmp di, ax
jb 0x4c4ff6
push 9
lea eax, [ebp - 0x18]
push eax
push 0x5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, 1
jle 0x4c4ff6
dec eax
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0041b79d
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049d8a1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d8a1
mov esp, ebp
pop ebp
ret

Function at 0x4c531c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4f4284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 3
jne 0x4c53ae
push 0x4c53ee
push 0x4f7bf8
call fcn.004c53be
cmp dword [0x4f7bf4], 0
pop ecx
pop ecx
jne 0x4c53ae
push ebx
push dword [0x4f7bf0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x4c53ad
push esi
push edi
push 0x4f7bc8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, 0x4f7be0
lea edi, [ebp - 0x14]
push 0x4f7bc8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, ebx
lea eax, [ebp - 0x14]
xor esi, esi
sub edi, eax
mov ecx, dword [ebp + esi*4 - 0x14]
test ecx, ecx
je 0x4c539e
lea eax, [edi + esi*4]
push dword [ebp + eax - 0x14]
call ecx
pop ecx
inc esi
cmp esi, 4
jb 0x4c538c
push ebx
call fcn.00431240
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049d8a1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ca027
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
push esi
push 0x4ca091
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x4ca07b
call sub.KERNEL32.dll_GetLastError
push eax
push 3
push 0x19
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpadutil_thread_thread_win.cc
lea ecx, [ebp - 0xbc]
call fcn.00431820
add eax, 0x10
push str.Check_failed:_platform_thread_.
push eax
call fcn.00415b8c
pop ecx
pop ecx
inc ebx
pop esi
test bl, 1
pop ebx
je 0x4ca08d
lea ecx, [ebp - 0xbc]
call fcn.00431af0
mov esp, ebp
pop ebp
ret

Function at 0x4cf9e5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
lea eax, [ebp - 0x28]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x14]
mov esi, 0xff
cmp ecx, esi
seta al
test al, al
je 0x4cfa57
push 1
call fcn.00432780
pop ecx
test al, al
je 0x4cfa44
push 1
push 0xa1
push str.c:_bc_bwin_archive_src_third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
lea ecx, [ebp - 0xd8]
call fcn.00431700
add eax, 8
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.00415b8c
pop ecx
pop ecx
inc ebx
test bl, 1
je 0x4cfa54
lea ecx, [ebp - 0xd8]
call fcn.00431880
mov ecx, dword [ebp - 0x14]
cmp ecx, esi
mov byte [ebp - 4], 0
seta byte [ebp - 3]
push dword [ebp - 4]
push ecx
call fcn.004cf8f1
pop ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret