joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6eaf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov ebx, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebx + 2]
test byte [ebx], 1
mov eax, edi
je 0x4c6ed5
mov eax, dword [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4c6efa
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
jmp 0x4c6fb6
push 2
call fcn.0042ae10
add esp, 4
test al, al
je 0x4c6faa
call fcn.0042b8e0
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x74
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.0042ba80
lea eax, [ebp - 0xb4]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00401c91
add esp, 0xc
mov esi, eax
movzx eax, byte [ebx]
test al, 1
je 0x4c6f4d
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 4]
jmp 0x4c6f4f
shr eax, 1
lea ebx, [ebp - 0xc8]
push eax
push edi
push ebx
call fcn.00438930
add esp, 0xc
movzx eax, byte [ebx]
test al, 1
je 0x4c6f75
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc0]
jmp 0x4c6f7d
shr eax, 1
lea ecx, [ebp - 0xc7]
push eax
push ecx
push esi
call fcn.00401c91
add esp, 0xc
test byte [ebp - 0xc8], 1
je 0x4c6f9f
push dword [ebp - 0xc0]
call fcn.005128f8
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.0042bb30
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
xor eax, eax
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c7dc8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x596ff8]
xor esi, ebp
mov dword [ebp - 0xc], esi
mov esi, 0x7fffffff
cmp edx, esi
cmovb esi, edx
lea edx, [ebp - 0x10]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4c7e4d
xor eax, eax
dec eax
lea edi, [ebp - 0x14]
mov dword [edi], eax
push str.bytes_written___static_cast_DWORD___1_
push eax
push dword [ebp - 0x10]
push edi
call fcn.004c7e63
add esp, 0x10
cmp dword [edi], 0
je 0x4c7e48
lea esi, [ebp - 0x18]
push edi
push 0x65
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
push esi
call fcn.00423d80
add esp, 0x10
mov ecx, esi
call fcn.00423d50
mov ecx, esi
call fcn.00423d60
mov esi, dword [ebp - 0x10]
jmp 0x4c7e50
xor esi, esi
dec esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00512931
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret

Function at 0x4c7ea3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x596ff8]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov edi, 0x7fffffff
cmp eax, edi
cmovb edi, eax
lea eax, [ebp - 0x14]
mov dword [eax], 0xffffffff
push 0
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c7f46
xor eax, eax
dec eax
mov dword [ebp - 0x18], eax
push str.bytes_read___static_cast_DWORD___1_
push eax
push dword [ebp - 0x14]
lea ebx, [ebp - 0x18]
push ebx
call fcn.004c7e63
add esp, 0x10
cmp dword [ebp - 0x18], 0
je 0x4c7f25
push ebx
push 0x7e
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea ebx, [ebp - 0x1c]
push ebx
call fcn.00423d80
add esp, 0x10
mov ecx, ebx
call fcn.00423d50
mov ecx, ebx
call fcn.00423d60
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x4c7f5b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x4c7f58
mov dword [ebp - 0x14], 0xffffffff
push 0
lea eax, [ebp - 0x14]
jmp 0x4c7ed2
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x4c7f5b
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c8550
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xb0
mov esi, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.004c845f
add esp, 0x10
or edx, eax
jne 0x4c85d3
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
jne 0x4c85d3
push 2
call fcn.0042ae10
add esp, 4
test al, al
je 0x4c85d1
call fcn.0042b8e0
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0xf4
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
call fcn.0042ba80
lea eax, [ebp - 0xb0]
push 0xc
push 0x5563a3
push eax
call fcn.00401c91
add esp, 0xc
mov ecx, esi
call fcn.0042bb30
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 0xb0
pop esi
pop ebx
pop ebp
ret

Function at 0x4c89b8
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c6fc1

Function at 0x4d0e34
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
push eax
push eax
push ecx
push 0x4d0eb0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x4d0e96
lea esi, [ebp - 0xc]
push str.platform_thread_
push 0x1b
push str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
push esi
call fcn.00423df0
add esp, 0x10
mov ecx, esi
call fcn.00423d50
push 0xc
push 0x551d62
push eax
call fcn.00401c91
add esp, 0xc
mov ecx, esi
call fcn.00423d60
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00512931
add esp, 8
pop esi
pop ebp
ret
Function at 0x4d3652
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0x2c]
mov eax, dword [ebp + 8]
mov ecx, dword [0x596ff8]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov dword [edx], 0xffffffff
cmp eax, 3
jne 0x4d3693
mov edx, dword [ebp + 0x28]
mov esi, dword [ebp + 0x10]
test byte [esi], 1
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
je 0x4d36a4
mov esi, dword [esi + 8]
jmp 0x4d36a7
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, 5
jmp 0x4d3710
add esi, 2
mov ebx, dword [ebx]
push 0
push edx
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
je 0x4d36f1
mov esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
push 3
push edi
push edi
lea ecx, [ebp - 0x14]
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb edi, edi
lea eax, [ebp - 0x14]
or edi, dword [eax]
jmp 0x4d36f4
xor edi, edi
dec edi
mov eax, dword [ebp + 0x2c]
mov dword [eax], edi
xor eax, eax
cmp edi, 0xffffffff
sete al
lea esi, [eax + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d3a0c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov ecx, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ecx - 5]
mov edi, 5
cmp eax, 1
ja 0x4d3b61
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x54], 0x44
test byte [eax], 1
je 0x4d3a5d
mov eax, dword [eax + 8]
jmp 0x4d3a60
add eax, 2
mov esi, dword [ebp + 0x10]
push eax
call fcn.00527f43
add esp, 4
movzx edx, byte [edi]
test dl, 1
je 0x4d3a7c
mov edx, dword [edi + 4]
mov edi, dword [edi + 8]
jmp 0x4d3a81
add edi, 2
shr edx, 1
mov ebx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
test edx, edx
cmove edi, edx
test byte [esi], 1
je 0x4d3a96
mov esi, dword [esi + 8]
jmp 0x4d3a99
add esi, 2
mov ecx, dword [ecx]
mov dword [ebp - 0x5c], ecx
sub esp, 0x28
mov dword [esp + 0x24], ebx
lea ecx, [ebp - 0x54]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edi
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [ebp - 0x58], eax
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, 5
test eax, eax
je 0x4d3b51
mov eax, dword [ebp + 8]
cmp eax, 6
mov eax, 0x1fffff
mov esi, 0x101c01
cmove esi, eax
mov eax, dword [ebx]
mov dword [ebp - 0x60], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push esi
push ebx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x4d3b48
cmp dword [ebp + 8], 6
mov esi, 0x100c43
mov eax, 0x1fffff
cmove esi, eax
mov edi, dword [ebx + 4]
add ebx, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push esi
push ebx
push dword [ebp - 0x5c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea edi, [ecx + ecx*4]
jmp 0x4d3b51
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x4d3b61
push eax
call fcn.00529c90
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, edi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d3b76
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x20]
mov ebx, dword [ebp + 8]
movups xmm0, xmmword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
xor edx, edx
mov dword [edi], edx
mov ecx, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], eax
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x4d3bd5
mov esi, eax
mov ebx, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 3
xor ecx, ecx
push ecx
push ecx
push edi
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [ecx + ecx*4]
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x4d60b4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov ebx, ecx
mov al, byte [ebp + 8]
mov ecx, dword [0x596ff8]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
test al, al
je 0x4d6104
xor esi, esi
inc esi
mov edi, 0x557452
mov ecx, ebx
push 0
push 0x4e9730
push esi
push str.NtMapViewOfSection
push edi
call fcn.004d5bf6
mov ecx, ebx
push esi
push 0x4e9910
push esi
push str.NtUnmapViewOfSection
push edi
call fcn.004d5bf6
jmp 0x4d610e
cmp dword [ebx + 0xc], 0
je 0x4d625c
mov eax, dword [ebx]
mov edi, dword [eax]
sub esp, 0x14
movdqa xmm0, xmmword [0x5573f0]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x6c], eax
mov esi, dword [ebx + 0xc]
shl esi, 6
lea eax, [esi + 0x50]
mov dword [ebp - 0x70], eax
push eax
call fcn.004d5a90
add esp, 4
mov dword [ebp - 0x74], ebx
mov ebx, eax
mov eax, 0xfffff000
mov ecx, ebx
and ecx, eax
add ecx, dword [ebp - 0x6c]
and ebx, 0xfff
add esi, 0x104f
and esi, eax
push 0x40
push 0x1000
push esi
push ecx
mov dword [ebp - 0x6c], edi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test eax, eax
jne 0x4d61a5
lea esi, [ebp - 0x60]
push str.thunk_base
push 0x184
push str..._.._sandbox_win_src_interception.cc
push esi
call fcn.00423ce0
add esp, 0x10
mov ecx, esi
call fcn.00423d50
mov ecx, esi
call fcn.00423d60
add edi, ebx
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0x60]
movdqu xmmword [esi + 8], xmm0
xor eax, eax
dec eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
movdqu xmmword [esi + 0x38], xmm0
movdqu xmmword [esi + 0x28], xmm0
movdqu xmmword [esi + 0x18], xmm0
mov ebx, dword [ebp - 0x70]
mov dword [esi], ebx
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x10
push 0xa8
push eax
push 0x59a7b8
call fcn.00516da0
add esp, 0xc
mov ecx, dword [ebp - 0x74]
push esi
push ebx
push edi
call fcn.004d64de
mov ebx, eax
test eax, eax
jne 0x4d625e
lea eax, [ebp - 0x64]
mov dword [eax], 0xffffffff
push eax
push 0x10
push esi
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, 0x2a
test eax, eax
je 0x4d625e
cmp dword [ebp - 0x64], 0x10
jne 0x4d625e
lea eax, [ebp - 0x68]
mov dword [eax], 0xffffffff
push eax
push 0x20
push dword [ebp - 0x70]
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push 0xa8
push 0x59a7b8
push str.g_originals
call fcn.004b5648
mov ebx, eax
jmp 0x4d625e
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4d8170
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x59a878]
mov ecx, dword [0x599af4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4d81e5
mov ecx, 0x59a870
call fcn.0043a480
test eax, eax
jne 0x4d81d8
mov edi, esp
push 4
call fcn.00512878
add esp, 4
mov esi, eax
mov dword [eax], 0
mov ecx, 0x59a870
call fcn.0043a480
test eax, eax
je 0x4d81cb
push eax
call fcn.005128f8
add esp, 4
mov ecx, 0x59a870
push esi
call fcn.0043a4b0
mov esp, edi
mov ecx, 0x59a870
pop esi
pop edi
pop ebp
jmp fcn.0043a480
push 0x59a878
call fcn.00512977
add esp, 4
cmp dword [0x59a878], 0xffffffff
jne 0x4d8192
mov dword [0x59a874], 0
mov dword [0x59a870], 0
mov ecx, 0x59a870
push 0x423650
call fcn.0043a4f0
push 0x59a878
call fcn.005129ed
add esp, 4
jmp 0x4d8192
Function at 0x4dbee0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff0
sub esp, 0xe0
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0xdc], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xb0]
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov dword [esi + 0x20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x14], 0x100
jb 0x4dbf67
push 1
call fcn.0042ae10
add esp, 4
test al, al
je 0x4dbf67
lea esi, [esp + 8]
mov ecx, esi
push 1
push 0xb3
push str..._.._third_party_crashpad_crashpad_snapshot_win_system_snapshot_win.cc
call fcn.0042aea0
lea eax, [esp + 0x10]
push 0x2c
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.00401c91
add esp, 0xc
mov ecx, esi
call fcn.0042b2a0
mov eax, dword [esp + 0xc4]
cmp eax, 0x100
mov ebx, 0xff
cmovb ebx, eax
mov ecx, dword [esp + 0xdc]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
Function at 0x4eb6b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x3c]
cmp eax, 9
jbe 0x4eb6dd
xor ebx, ebx
jmp 0x4eb7c7
mov bl, 1
test eax, eax
je 0x4eb7c7
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov esi, edx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.004e61ac
mov edx, esi
mov dword [esi + ebx*4], eax
test eax, eax
je case.0x4eb726.3
mov eax, dword [ebp - 0x18]
mov dword [edi + ebx*4 + 4], eax
dec eax
cmp eax, 5
ja case.0x4eb726.3
jmp dword [eax*4 + 0x55932c]
push 0xc
call fcn.00512878
add esp, 4
mov edi, eax
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp + 8]
push edi
push ebx
call fcn.004e6244
test al, al
je 0x4eb7df
mov edx, esi
mov dword [esi + ebx*4], edi
jmp 0x4eb7b5
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.004e61dc
jmp 0x4eb789
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.004e6210
test al, al
je 0x4eb7db
mov eax, dword [ebp - 0x1c]
mov edx, esi
mov dword [esi + ebx*4], eax
jmp case.0x4eb726.3
mov edi, dword [edx + ebx*4]
test edi, edi
je 0x4eb803
push 8
call fcn.00512878
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, esi
mov dword [eax + 4], edi
mov dword [esi + ebx*4], eax
mov edi, dword [ebp + 0xc]
inc ebx
mov ecx, dword [ebp + 8]
cmp ebx, dword [ecx + 0x3c]
jb 0x4eb6ef
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
push edi
jmp 0x4eb807
xor eax, eax
mov dword [esi + ebx*4], eax
xor ebx, ebx
push esi
push dword [ebp + 0xc]
call fcn.004eb630
add esp, 8
lea ecx, [ebp - 0x18]
mov dword [ecx - 4], ebx
push edi
call fcn.00405bac
jmp 0x4eb6d6
push edx
push dword [ebp + 0xc]
call fcn.004eb630
add esp, 8
jmp 0x4eb6d6
Function at 0x4ef6d2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov esi, ecx
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0xb0]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.004f0096
mov ecx, esi
push ebx
push 0
push 0x40
push edx
push eax
call fcn.004f7baa
test al, al
je 0x4ef79a
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x4ef7d3
mov ecx, edi
call fcn.004f0096
mov ebx, eax
mov eax, dword [esp + 0xec]
mov edi, eax
sar edi, 0x1f
add ebx, eax
adc edi, edx
mov ecx, esi
push dword [ebp + 8]
push 0
push 0x108
push edi
push ebx
call fcn.004f7baa
test al, al
je 0x4ef809
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x4ef83f
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x4ef89f
mov dword [eax], ecx
mov dword [eax + 4], edi
jmp 0x4ef89f
push 1
call fcn.0042ae10
add esp, 4
test al, al
je 0x4ef89d
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x154
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0042aea0
lea eax, [esp + 0x10]
push 0x1f
push str.could_not_read_dos_header_from
jmp 0x4ef86f
push 1
call fcn.0042ae10
add esp, 4
test al, al
je 0x4ef89d
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x15a
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0042aea0
lea eax, [esp + 0x10]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x4ef86f
push 1
call fcn.0042ae10
add esp, 4
test al, al
je 0x4ef89d
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x162
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0042aea0
lea eax, [esp + 0x10]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x4ef86f
push 1
call fcn.0042ae10
add esp, 4
test al, al
je 0x4ef89d
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x168
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0042aea0
lea eax, [esp + 0x10]
push 0x23
push str.invalid_signature_in_nt_headers_of
push eax
call fcn.00401c91
add esp, 0xc
movzx ecx, byte [esi]
test cl, 1
je 0x4ef888
mov ecx, dword [esi + 4]
mov esi, dword [esi + 8]
jmp 0x4ef88b
shr ecx, 1
inc esi
push ecx
push esi
push eax
call fcn.00401c91
add esp, 0xc
mov ecx, edi
call fcn.0042b2a0
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4ef8ba
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov esi, ecx
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0xf8], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0xb0]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.004f0096
mov ecx, esi
push ebx
push 0
push 0x40
push edx
push eax
call fcn.004f7baa
test al, al
je 0x4ef982
movzx eax, word [esp + 0xb0]
cmp eax, 0x5a4d
jne 0x4ef9bb
mov ecx, edi
call fcn.004f0096
mov ebx, eax
mov eax, dword [esp + 0xec]
mov edi, eax
sar edi, 0x1f
add ebx, eax
adc edi, edx
mov ecx, esi
push dword [ebp + 8]
push 0
push 0xf8
push edi
push ebx
call fcn.004f7baa
test al, al
je 0x4ef9f1
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x4efa27
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x4efa87
mov dword [eax], ecx
mov dword [eax + 4], edi
jmp 0x4efa87
push 1
call fcn.0042ae10
add esp, 4
test al, al
je 0x4efa85
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x154
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0042aea0
lea eax, [esp + 0x10]
push 0x1f
push str.could_not_read_dos_header_from
jmp 0x4efa57
push 1
call fcn.0042ae10
add esp, 4
test al, al
je 0x4efa85
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x15a
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0042aea0
lea eax, [esp + 0x10]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x4efa57
push 1
call fcn.0042ae10
add esp, 4
test al, al
je 0x4efa85
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x162
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0042aea0
lea eax, [esp + 0x10]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x4efa57
push 1
call fcn.0042ae10
add esp, 4
test al, al
je 0x4efa85
lea edi, [esp + 8]
mov ecx, edi
push 1
push 0x168
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.0042aea0
lea eax, [esp + 0x10]
push 0x23
push str.invalid_signature_in_nt_headers_of
push eax
call fcn.00401c91
add esp, 0xc
movzx ecx, byte [esi]
test cl, 1
je 0x4efa70
mov ecx, dword [esi + 4]
mov esi, dword [esi + 8]
jmp 0x4efa73
shr ecx, 1
inc esi
push ecx
push esi
push eax
call fcn.00401c91
add esp, 0xc
mov ecx, edi
call fcn.0042b2a0
xor ebx, ebx
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4f6658
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
xor ebx, ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
sub esp, 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
movaps xmm0, xmmword [0x553750]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, esi
push eax
call fcn.00407388
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x4f66a6
push edi
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x534ad1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00534d1a

Function at 0x538c7e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00538c89