joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x44b36e
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x701
mov dword [esp + 0x54], ecx
test byte [eax], 1
je 0x44b2a1
mov eax, dword [eax + 8]
jmp 0x44b2a4
add eax, 1
mov dword [esp + 0x60], eax
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.00443a60
mov eax, dword [0x545cc8]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
lea ebx, [esp + 0x50]
mov dword [esp + 0x3c], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x53f380]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.004681e0
sub esp, 0x44
mov al, byte [esp + 0x50]
test al, al
je 0x44b36e
xor esi, esi
jmp 0x44b34a
add esi, 1
movzx ecx, al
cmp esi, ecx
jae 0x44b36e
cmp byte [esp + esi + 0x51], 8
jne 0x44b340
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x44b340
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
movzx eax, byte [esp + 0x50]
jmp 0x44b340
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00512931
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44b390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x44b49e
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x301
mov dword [esp + 0x54], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x60], xmm0
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.00443a60
mov eax, dword [0x545cc8]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
lea ebx, [esp + 0x50]
mov dword [esp + 0x3c], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
xorps xmm0, xmm0
movups xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x53f380]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.004681e0
sub esp, 0x44
mov al, byte [esp + 0x50]
test al, al
je 0x44b49e
xor esi, esi
jmp 0x44b47a
add esi, 1
movzx ecx, al
cmp esi, ecx
jae 0x44b49e
cmp byte [esp + esi + 0x51], 8
jne 0x44b470
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x44b470
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
movzx eax, byte [esp + 0x50]
jmp 0x44b470
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00512931
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x44edf0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044ea50
Function at 0x44f190
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044ee00
Function at 0x45b0b0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x38], eax
xor eax, eax
cmp dword [esi + 4], 0
setne al
mov ebx, ecx
sar ebx, 0x1f
add eax, eax
add eax, 4
push dword [ebp + 0xc]
push ecx
push ebx
mov dword [esp + 0x18], eax
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
test edi, edi
jne 0x45b12d
call fcn.00487ba0
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
test edi, edi
jne 0x45b12d
call fcn.00487ba0
mov eax, dword [ebp + 0x10]
mov edi, dword [eax]
test edi, edi
je 0x45b178
mov esi, dword [ebp + 0x14]
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0x1c], xmm0
movdqa xmmword [esp + 0x10], xmm0
lea eax, [esp + 0x10]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, dword [esp + 0x1c]
sub ecx, edi
add ecx, dword [esp + 0x14]
test eax, eax
cmove ecx, eax
mov dword [esi], ecx
mov bl, 1
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
xor ebx, ebx
jmp 0x45b161

Function at 0x45b8e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x45b959
mov ecx, dword [ebp + 0xc]
cmp ebx, 1
jne 0x45b8fc
xor esi, esi
jmp 0x45b93e
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
nop dword [eax + eax]
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x549318]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x549318]
add esi, 2
cmp ebx, esi
jne 0x45b910
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x45b959
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x549318]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x462a30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, ecx
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov edi, esp
push 0x1a
push str..._.._base_files_memory_mapped_file_win.cc
push str.MapImageToMemory
push edi
call fcn.0042a970
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push edi
call fcn.004391c0
mov ecx, esi
call fcn.0043f530
test al, al
je 0x462b1b
mov ecx, esi
call fcn.0043f540
sub esp, 0x18
movdqa xmm0, xmmword [0x549f30]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp dword [esi + 0x24], eax
je 0x462b13
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0x24]
add eax, 1
cmp eax, 2
jb 0x462af7
call fcn.0042a9a0
push dword [esi + 0x24]
call fcn.00441df0
add esp, 4
mov dword [esi + 0x24], 0
mov eax, edi
add eax, 1
cmp eax, 2
jb 0x462b09
mov dword [esi + 0x24], edi
call fcn.0042a9a0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi + 0x24]
lea eax, [edi + 1]
cmp eax, 2
jae 0x462b3d
xor ebx, ebx
lea ecx, [esp + 0x10]
call fcn.00439230
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
sub esp, 0x14
movdqa xmm0, xmmword [0x540080]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x462b1b
mov dword [esp], 0x549f94
mov dword [esp + 4], eax
mov ecx, esp
call fcn.0048b0ac
mov eax, dword [eax + 0x50]
mov dword [esi + 0x20], eax
mov bl, 1
jmp 0x462b1d
Function at 0x462b80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea edi, [esp + 0x10]
push 0x39
push str..._.._base_files_memory_mapped_file_win.cc
push str.MapFileRegionToMemory
push edi
call fcn.0042a970
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push edi
call fcn.004391c0
mov ecx, esi
call fcn.0043f530
xor ebx, ebx
test al, al
je 0x462ca4
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp eax, 3
ja case.default.0x462c00
jmp dword [eax*4 + 0x549f9c]
mov edi, 2
jmp 0x462c2f
mov edi, 4
jmp 0x462c2f
mov ebx, dword [ecx + 8]
mov edi, 4
jmp 0x462c2f
sub esp, 4
mov ecx, esi
call fcn.00462a30
mov ebx, eax
jmp 0x462ca4
xor edi, edi
mov ecx, esi
call fcn.0043f540
push 0
push ebx
push 0
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
cmp dword [esi + 0x24], eax
je 0x462c9a
mov dword [esp + 4], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 0x24]
add eax, 1
cmp eax, 2
jb 0x462c7a
call fcn.0042a9a0
push dword [esi + 0x24]
call fcn.00441df0
add esp, 4
mov dword [esi + 0x24], 0
mov eax, ebx
add eax, 1
cmp eax, 2
jb 0x462c8c
mov dword [esi + 0x24], ebx
call fcn.0042a9a0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [esi + 0x24]
mov edi, dword [esp + 4]
add ebx, 1
cmp ebx, 2
jae 0x462cc4
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.00439230
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [esp + 0xc], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
push 0x549fb0
call fcn.00462df0
test al, al
je 0x462d01
mov ecx, esi
call fcn.0043fbc0
xor ebx, ebx
cmp eax, 1
mov ecx, edx
sbb ecx, 0
jl 0x462ca4
test edx, edx
jne 0x462ca4
mov dword [esi + 0x20], eax
xor ecx, ecx
xor eax, eax
xor edx, edx
jmp 0x462d5c
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
push ecx
lea eax, [esp + 0x18]
push eax
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
call fcn.00462f90
add esp, 0x18
mov eax, dword [esp + 0x14]
test eax, eax
js 0x462ca2
mov dword [esp + 4], edi
mov edi, dword [ebx + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
add edx, edi
mov dword [esi + 0x20], edi
mov edi, dword [esp + 4]
and edi, 2
add edi, 2
push edx
push ecx
push eax
push edi
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x462ca2
add eax, dword [esp + 0xc]
mov dword [esi + 0x1c], eax
mov bl, 1
jmp 0x462ca4
Function at 0x46e2e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x596ff8]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
jne 0x46e399
mov dword [ebp - 0x14], 0x46e3c0
lea eax, [ebp - 0x14]
push 0
push eax
push 0x46e2c0
push 0x599ce0
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x46e3ad
cmp dword [0x599ce4], 0
jne 0x46e399
push dword [0x599ce8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46e399
mov esi, eax
push 0x599cec
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x599cf0]
mov ebx, dword [0x599cf4]
mov eax, dword [0x599cf8]
mov dword [ebp - 0x18], eax
push 0x599cec
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x46e375
push dword [esi]
call edi
add esp, 4
test ebx, ebx
je 0x46e381
push dword [esi + 4]
call ebx
add esp, 4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x46e390
push dword [esi + 8]
call eax
add esp, 4
push esi
call fcn.0044e270
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
call fcn.00525b7d
int3
Function at 0x481480
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, edx
mov ebx, ecx
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push edx
push ecx
push eax
call fcn.004384d0
add esp, 0xc
test byte [ebp - 0x1c], 1
je 0x4814b0
mov eax, dword [ebp - 0x14]
jmp 0x4814b3
lea eax, [ebp - 0x1a]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test byte [ebp - 0x1c], 1
je 0x4814d1
push dword [ebp - 0x14]
call fcn.005128f8
add esp, 4
cmp dword [ebp + 8], 0
je 0x48159c
test edi, edi
je 0x48159c
mov dword [ebp - 0x20], edi
add edi, edi
mov ecx, 0xffffffff
cmovae ecx, edi
push ecx
call fcn.00512923
add esp, 4
mov edi, eax
push esi
push ebx
lea esi, [ebp - 0x1c]
push esi
call fcn.004384d0
add esp, 0xc
test byte [ebp - 0x1c], 1
je 0x481514
mov eax, dword [ebp - 0x14]
jmp 0x481517
lea eax, [ebp - 0x1a]
push dword [ebp - 0x20]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test byte [ebp - 0x1c], 1
je 0x481533
push dword [ebp - 0x14]
call fcn.005128f8
add esp, 4
cmp word [edi], 0
je 0x48154f
xor ecx, ecx
nop dword [eax + eax]
lea eax, [ecx + 1]
cmp word [edi + ecx*2 + 2], 0
mov ecx, eax
jne 0x481540
jmp 0x481551
xor eax, eax
push eax
push edi
push esi
call fcn.00438930
add esp, 0xc
mov esi, dword [ebp + 8]
test byte [esi], 1
je 0x481581
mov eax, dword [esi + 8]
mov byte [eax], 0
mov dword [esi + 4], 0
test byte [esi], 1
je 0x481581
push dword [esi + 8]
call fcn.005128f8
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [esi], xmm0
push edi
call fcn.0051292c
add esp, 4
mov edi, dword [ebp - 0x20]
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48a9f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp + 0xc], 0
sete al
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
push 0
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], 0
test eax, eax
je 0x48aa7c
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x48aa56
call fcn.0042a9a0
push dword [esi]
call fcn.00441df0
add esp, 4
mov dword [esi], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x48aa65
mov dword [esi], edi
call fcn.0042a9a0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 1
add eax, 1
cmp eax, 1
jbe 0x48aa80
jmp 0x48aaa6
mov byte [esi + 4], 1
lea edi, [ebp - 0x14]
push 0x550940
push 0x20
push str..._.._base_synchronization_waitable_event_win.cc
push edi
call fcn.00423ce0
add esp, 0x10
mov ecx, edi
call fcn.00423d50
mov ecx, edi
call fcn.00423d60
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x48b0f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + 0x3c]
movzx edx, word [ecx + eax + 6]
test edx, edx
je 0x48b13d
add eax, ecx
movzx esi, word [eax + 0x14]
lea edi, [eax + esi]
add edi, 0x18
xor ebx, ebx
xor esi, esi
test edi, edi
je 0x48b13d
mov eax, dword [edi + ebx + 0xc]
test eax, eax
je 0x48b12a
add eax, ecx
cmp eax, dword [ebp + 8]
jbe 0x48b12c
jmp 0x48b135
xor eax, eax
add eax, dword [edi + ebx + 8]
cmp eax, dword [ebp + 8]
ja 0x48b146
inc esi
add ebx, 0x28
cmp esi, edx
jb 0x48b115
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
add edi, ebx
mov eax, edi
jmp 0x48b13f
Function at 0x48b1ea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x48b2cd
mov ebx, ecx
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x48b2cd
cmp word [eax + edx + 0x14], 0x68
jb 0x48b2cd
mov esi, dword [ebx]
mov ecx, ebx
push dword [eax + edx + 0x78]
call dword [esi + 4]
test eax, eax
je 0x48b2cd
mov esi, eax
mov eax, dword [ebp + 8]
cmp eax, 0xffff
ja 0x48b244
mov word [edi], ax
jmp 0x48b2fa
mov eax, dword [ebx]
mov ecx, ebx
push dword [esi + 0x20]
call dword [eax + 4]
mov edx, eax
mov eax, dword [esi + 0x18]
lea ecx, [eax*4]
test ecx, ecx
je 0x48b2cd
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], ebx
lea esi, [edx + eax*4]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edx
mov ebx, edx
mov edi, esi
sub edi, ebx
mov eax, edi
sar eax, 2
shr edi, 0x1f
add edi, eax
and edi, 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
push dword [ebx + edi*2]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x48b2a7
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x48b2a9
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x48b29b
xor ecx, ecx
lea edi, [ebx + edi*2]
movzx ecx, cl
movzx eax, byte [eax]
mov edx, ecx
sub edx, eax
test edx, edx
lea edx, [edi + 4]
cmovg ebx, edx
cmovle esi, edi
cmp ecx, eax
je 0x48b2d9
xor eax, eax
cmp ebx, esi
jne 0x48b273
jmp 0x48b2cf
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov esi, dword [ebp - 0x18]
push dword [esi + 0x24]
call dword [eax + 4]
sub edi, dword [ebp - 0x14]
sar edi, 1
movzx eax, word [eax + edi]
add ax, word [esi + 0x10]
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
mov al, 1
jmp 0x48b2cf

Function at 0x48bdc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x59a190]
mov ecx, dword [0x599af4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x48bdeb
mov ecx, 0x59a188
pop ebp
jmp fcn.0043a480
push 0x59a190
call fcn.00512977
add esp, 4
cmp dword [0x59a190], 0xffffffff
jne 0x48bde0
mov dword [0x59a18c], 0
mov dword [0x59a188], 0
mov ecx, 0x59a188
push 0
call fcn.0043a4f0
push 0x59a190
call fcn.005129ed
add esp, 4
jmp 0x48bde0
Function at 0x495420
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
call fcn.004937a0
mov byte [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi], 0x551130
mov dword [esi + 0xc], 0
lea eax, [esi + 0x10]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0
movaps xmm0, xmmword [0x550f80]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
cmp dword [esi + 0xc], eax
je 0x4954b9
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0xc]
add eax, 1
cmp eax, 2
jb 0x49549d
call fcn.0042a9a0
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call fcn.00441df0
mov dword [esi + 0xc], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x4954ad
mov dword [esi + 0xc], edi
call fcn.0042a9a0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4a6bed
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov esi, ecx
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ecx + 2]
test byte [ecx], 1
mov eax, edi
je 0x4a6c12
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x4a6d02
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4a6c4d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov ecx, esi
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004a6d19
push 2
call fcn.0042ae10
add esp, 4
test al, al
je 0x4a6d00
call fcn.0042b8e0
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x25e
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.0042ba80
lea eax, [ebp - 0xb4]
push 0x10
push str.CreateDirectory
push eax
call fcn.00401c91
add esp, 0xc
mov ebx, eax
movzx eax, byte [esi]
test al, 1
je 0x4a6ca3
mov edi, dword [esi + 8]
mov eax, dword [esi + 4]
jmp 0x4a6ca5
shr eax, 1
lea esi, [ebp - 0xc8]
push eax
push edi
push esi
call fcn.00438930
add esp, 0xc
movzx eax, byte [esi]
test al, 1
je 0x4a6ccb
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc0]
jmp 0x4a6cd3
shr eax, 1
lea ecx, [ebp - 0xc7]
push eax
push ecx
push ebx
call fcn.00401c91
add esp, 0xc
test byte [ebp - 0xc8], 1
je 0x4a6cf5
push dword [ebp - 0xc0]
call fcn.005128f8
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.0042bb30
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4a6d19
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov esi, ecx
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ecx + 2]
test byte [ecx], 1
mov eax, edi
je 0x4a6d3e
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4a6dab
mov bl, 1
test al, 0x10
jne 0x4a6ecf
push 2
call fcn.0042ae10
add esp, 4
test al, al
je 0x4a6ecd
lea ecx, [ebp - 0xbc]
push 2
push 0x24d
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.0042aea0
lea eax, [ebp - 0xb4]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00401c91
add esp, 0xc
mov ebx, eax
movzx eax, byte [esi]
test al, 1
je 0x4a6e60
mov edi, dword [esi + 8]
mov eax, dword [esi + 4]
jmp 0x4a6e62
push 2
call fcn.0042ae10
add esp, 4
test al, al
je 0x4a6ecd
call fcn.0042b8e0
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x249
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.0042ba80
lea eax, [ebp - 0xb4]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00401c91
add esp, 0xc
mov ebx, eax
movzx eax, byte [esi]
test al, 1
je 0x4a6e01
mov edi, dword [esi + 8]
mov eax, dword [esi + 4]
jmp 0x4a6e03
shr eax, 1
lea esi, [ebp - 0xc8]
push eax
push edi
push esi
call fcn.00438930
add esp, 0xc
movzx eax, byte [esi]
test al, 1
je 0x4a6e29
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc0]
jmp 0x4a6e31
shr eax, 1
lea ecx, [ebp - 0xc7]
push eax
push ecx
push ebx
call fcn.00401c91
add esp, 0xc
test byte [ebp - 0xc8], 1
je 0x4a6e53
push dword [ebp - 0xc0]
call fcn.005128f8
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.0042bb30
jmp 0x4a6ecd
shr eax, 1
lea esi, [ebp - 0xc8]
push eax
push edi
push esi
call fcn.00438930
add esp, 0xc
movzx eax, byte [esi]
test al, 1
je 0x4a6e88
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc0]
jmp 0x4a6e90
shr eax, 1
lea ecx, [ebp - 0xc7]
push eax
push ecx
push ebx
call fcn.00401c91
add esp, 0xc
push 0x11
push str.:_not_a_directory
push eax
call fcn.00401c91
add esp, 0xc
test byte [ebp - 0xc8], 1
je 0x4a6ec2
push dword [ebp - 0xc0]
call fcn.005128f8
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.0042b2a0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret