joyce8/EMBER2024-capa huggingface dataset:
Function at 0x533b80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov esi, dword [ebp + 8]
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x21a]
push 0x20a
push 0
push edi
call fcn.004d5a00
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x5840d0]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x533c51
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push edi
call fcn.004d00f2
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.004cae90
lea edi, [ebp - 0x228]
push edi
call fcn.00533cd0
add esp, 4
xor ebx, ebx
mov ecx, edi
push str.YandexYandexBrowser
push ebx
call fcn.0041f270
mov ecx, dword [eax + 8]
mov dword [ebp - 0x22c], ecx
movsd xmm0, qword [eax]
movsd qword [ebp - 0x234], xmm0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax], ebx
cmp byte [edi + 0xb], 0
jns 0x533c38
push dword [ebp - 0x228]
call fcn.004cf0d6
add esp, 4
movzx eax, byte [ebp - 0x229]
test al, al
jns 0x533c6f
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x230]
jmp 0x533c75
mov ecx, esi
call fcn.0041a390
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, esi
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [ebp - 0x234]
mov bl, byte [ebp + 0xc]
mov ecx, esi
push eax
push edx
push edi
call fcn.00411970
mov ecx, esi
push edi
call fcn.00411710
mov ecx, edi
call fcn.004c5e70
cmp byte [ebp - 0x229], 0
jns 0x533ca8
push dword [ebp - 0x234]
call fcn.004cf0d6
add esp, 4
test bl, bl
je 0x533c58
push esi
call fcn.0042fa90
add esp, 4
test al, al
jne 0x533c58
push esi
call fcn.0040a6a0
add esp, 4
jmp 0x533c58

Function at 0x53ca00
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.004d29f0
mov esi, ecx
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0xff
push ebx
call fcn.004d5a00
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], edi
push ecx
push ebx
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x53ca79
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, edi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 2
je 0x53ca9d
mov edi, 0x3f4
cmp eax, 1
jne 0x53ca60
mov ecx, esi
push ebx
call fcn.00414d50
xor edi, edi
jmp 0x53ca60
lea edi, [ebp - 0x1010]
push 0x800
push 0xff
push edi
call fcn.004d5a00
add esp, 0xc
push 0x400
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
dec eax
mov edi, 0xea
cmp eax, 0x3ff
ja 0x53ca60
mov ecx, esi
lea eax, [ebp - 0x1010]
push eax
jmp 0x53ca94
Function at 0x53d1e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x28], edx
mov edi, ecx
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x53d202
mov eax, dword [edi]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
xor ebx, ebx
test eax, eax
je 0x53d2d1
mov esi, eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
test eax, eax
js 0x53d2e5
push esi
call fcn.004cf0a6
add esp, 4
mov dword [ebp - 0x1c], eax
mov edi, esi
add edi, eax
mov dword [ebp - 0x14], edi
xor ebx, ebx
push esi
push ebx
mov dword [ebp - 0x2c], eax
push eax
call fcn.004d5a00
add esp, 0xc
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x30]
cmp byte [eax + 0xb], 0
jns 0x53d25b
mov eax, dword [eax]
mov edi, dword [ebp - 0x2c]
push edi
push esi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x53d2c5
xor eax, eax
lea esi, [ebp - 0x20]
mov dword [esi], eax
lea ecx, [ebp - 0x24]
mov dword [ecx], eax
push esi
push ecx
push 0x57d690
push edi
call sub.VERSION.dll_VerQueryValueW
mov ecx, dword [esi]
test eax, eax
je 0x53d2b1
cmp ecx, 0x34
jb 0x53d2b1
mov edx, dword [ebp - 0x24]
mov esi, dword [edx + 0x30]
mov edi, dword [ebp - 0x28]
mov dword [edi + 0x30], esi
movups xmm0, xmmword [edx + 0x20]
movups xmmword [edi + 0x20], xmm0
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
movups xmmword [edi + 0x10], xmm1
movups xmmword [edi], xmm0
cmp ecx, 0x33
seta cl
test eax, eax
setne bl
and bl, cl
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x53d2d1
mov dword [ebp - 0x18], edi
push edi
call fcn.004cf0d6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x1c]
call fcn.004ff350
int3
Function at 0x53d640
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esp + 0x18], eax
lea eax, [ecx + 0x10]
xor edi, edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
mov dword [ecx + 4], edi
mov dword [ecx], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 0x10], edi
mov dword [esp + 4], eax
push eax
call fcn.004d00f2
add esp, 4
cmp eax, 0x7ffffff0
jae 0x53d734
mov ebx, eax
cmp eax, 5
jb 0x53d724
lea edi, [ebx + 8]
and edi, 0xfffffff8
lea eax, [edi + edi]
push eax
call fcn.004cf0a6
add esp, 4
lea ecx, [esp + 8]
mov dword [ecx], eax
or edi, 0x80000000
mov dword [ecx + 8], edi
mov dword [esp], ecx
mov dword [ecx + 4], ebx
mov ecx, ebx
add ecx, ebx
push ecx
push dword [esp + 8]
push eax
mov edi, eax
call fcn.004d4f00
mov eax, edi
add esp, 0xc
mov word [eax + ebx*2], 0
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.0053d740
mov eax, dword [esp]
cmp byte [eax + 0xb], 0
jns 0x53d708
push dword [esp + 8]
call fcn.004cf0d6
add esp, 4
mov ecx, esi
call fcn.0053d7f0
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.004d25a3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 8]
mov byte [eax + 0xb], bl
mov dword [esp], eax
test ebx, ebx
jne 0x53d6cb
jmp 0x53d6e1
lea ecx, [esp + 8]
call fcn.004fc800
int3

Function at 0x53d740
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esp + 0x14], eax
xor eax, eax
lea edi, [esp + 8]
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
mov edx, edi
call fcn.004427a0
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x53d77e
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x53d7a6
mov dword [esp + 4], 0
test al, al
jns 0x53d792
mov edi, dword [esp + 8]
lea eax, [esp + 4]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
jne 0x53d7ca
mov al, byte [esp + 0x13]
test al, al
jns 0x53d7b6
push dword [esp + 8]
call fcn.004cf0d6
add esp, 4
mov ecx, dword [esp + 0x14]
xor ecx, ebp
call fcn.004d25a3
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret 4
mov edi, eax
mov ecx, esi
push eax
push dword [esp + 8]
call fcn.0053da30
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x53d7a2
Function at 0x543050
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov esi, esp
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esi + 0x70], eax
push 8
call fcn.004cf0a6
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], esp
push eax
mov edi, esp
lea ebx, [esi + 0x18]
push ebx
call fcn.005423b0
add esp, 4
mov ecx, ebx
mov edx, 0x543030
call fcn.00542b60
mov dword [edi], 0
test eax, eax
je 0x5430cb
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov eax, dword [edi]
inc eax
cmp eax, 2
jae 0x543176
lea eax, [ebx + 1]
cmp eax, 2
jb 0x5430c2
mov dword [edi], ebx
call fcn.004bafe0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 8]
mov edi, dword [esi]
mov ecx, edi
call fcn.00521240
mov esp, dword [esi + 8]
cmp byte [esi + 0x23], 0
jns 0x5430eb
push dword [esi + 0x18]
call fcn.004cf0d6
add esp, 4
cmp dword [edi], 0
je 0x543106
mov dword [ebx], edi
mov ecx, dword [esi + 0x70]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esi + 0xc]
push eax
push edi
call fcn.00501dd0
add esp, 8
lea ecx, [esi + 0x18]
push edi
push 0x1dd
push str.InitNewCommandFormatEvent
push 1
call fcn.00501b30
lea ecx, [esi + 0x54]
push 0x589a06
push str.Cannot_create_service_update__new_commands_format__event
call fcn.004fc970
lea ecx, [esi + 0x18]
call fcn.00501b70
cmp byte [edi + 0xb], 0
jns 0x543159
push dword [esi + 0xc]
call fcn.004cf0d6
add esp, 4
mov dword [ebx], 0
mov edi, dword [esi]
mov ecx, edi
call fcn.004c1b60
push edi
call fcn.004cf0d6
add esp, 4
jmp 0x5430f2
call fcn.004bafe0
push dword [edi]
call fcn.004c1b90
add esp, 4
mov dword [edi], 0
jmp 0x5430b3

Function at 0x5438f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, 5
pop ebp
jmp fcn.0054ff60

Function at 0x543910
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, 0xd
pop ebp
jmp fcn.0054ff60

Function at 0x543930
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, 0x27
pop ebp
jmp fcn.0054ff60

Function at 0x543950
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, 0xe
pop ebp
jmp fcn.0054ff60
Function at 0x5445c0
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [esp + 0x68], eax
push dword [ecx + 0x14]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
test eax, eax
je 0x544604
push 0
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004d25a3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [esp + 4]
push eax
push ebx
call fcn.00501dd0
add esp, 8
lea edi, [esp + 0x10]
mov ecx, edi
push ebx
push 0x155
push str.Reconnect
push 1
call fcn.00501b30
lea ecx, [esp + 0x4c]
push 0x58a84d
push str.DisconnectNamedPipe_fail
call fcn.004fc970
mov ecx, edi
call fcn.00501b70
cmp byte [ebx + 0xb], 0
jns 0x5445e6
push dword [esp + 4]
call fcn.004cf0d6
add esp, 4
jmp 0x5445e6

Function at 0x547d00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret
Function at 0x54a2d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
lea edi, [ecx + 0xc]
lea eax, [ecx + 0x10]
push 0x228
push 0
push eax
call fcn.004d5a00
add esp, 0xc
mov dword [esi + 0xc], 0x22c
cmp byte [esi + 8], 0
je 0x54a30c
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
pop esi
pop edi
pop ebp
ret
mov byte [esi + 8], 1
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_Process32FirstW
jmp 0x54a303

Function at 0x54a7a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, dword [ebp + 8]
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x54a7c3
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
je 0x54a7e9
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp + 0x10], 0
je 0x54a800
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x54a89b
push 2
call fcn.004cb810
add esp, 4
test al, al
je 0x54a894
call fcn.00501800
lea ecx, [ebp - 0xc8]
push eax
push 2
push 0x61
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.00501810
lea eax, [ebp - 0xc0]
push 0x10
push str.CreateDirectory
push eax
call fcn.004b7fc0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x54a851
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.00412900
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x54a86d
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
push eax
push ebx
push esi
call fcn.004b7fc0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x54a889
push dword [ebp - 0x1c]
call fcn.004cf0d6
add esp, 4
lea ecx, [ebp - 0xc8]
call fcn.005018c0
xor ebx, ebx
jmp 0x54a7d2
push 1
push edi
call fcn.0054aef0
add esp, 8
test al, al
jne 0x54a7d2
push 2
call fcn.004cb810
add esp, 4
test al, al
je 0x54a894
lea ecx, [ebp - 0xc8]
push 2
push 0x5c
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.00408a90
movzx eax, byte [edi + 0xb]
test al, al
jns 0x54a8dd
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea esi, [ebp - 0xc0]
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.00412900
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x54a8ff
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
push eax
push ebx
push esi
call fcn.004b7fc0
add esp, 0xc
push 0x10
push str._not_a_directory
push eax
call fcn.004b7fc0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x54a92b
push dword [ebp - 0x1c]
call fcn.004cf0d6
add esp, 4
lea ecx, [ebp - 0xc8]
call fcn.00408d50
jmp 0x54a894
Function at 0x54aef0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, dword [ebp + 8]
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x54af13
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x54af4e
mov ebx, eax
bt eax, 0xa
jae 0x54aff5
cmp byte [ebp + 0xc], 0
jne 0x54aff5
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004cb810
add esp, 4
test al, al
je 0x54af35
call fcn.00501800
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x81
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.00501810
lea eax, [ebp - 0xb4]
push 0x12
push str.GetFileAttributes
push eax
call fcn.004b7fc0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x54af9e
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc8]
push eax
push edi
push ebx
call fcn.00412900
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x54afc3
mov eax, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xc8]
push eax
push ebx
push esi
call fcn.004b7fc0
add esp, 0xc
cmp byte [ebp - 0xbd], 0
jns 0x54afe5
push dword [ebp - 0xc8]
call fcn.004cf0d6
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.005018c0
jmp 0x54af35
and ebx, 0x10
shr ebx, 4
jmp 0x54af37

Function at 0x54bae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x30], xmm0
mov esi, dword [ecx + 0x1c]
mov ebx, dword [ecx + 0x20]
movups xmmword [ebp - 0x20], xmm0
cmp esi, ebx
je 0x54bb36
mov dword [ebp - 0x34], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.0054bb80
test al, al
jne 0x54bb23
add esi, 0x58
cmp ebx, esi
jne 0x54bb0e
mov esi, ebx
mov eax, dword [ebp - 0x34]
cmp esi, dword [eax + 0x20]
je 0x54bb36
cmp byte [esi + 0x1b], 0
jns 0x54bb4d
mov eax, dword [esi + 0x10]
jmp 0x54bb50
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, edi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x54bb39
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x54bb39
Function at 0x54bd30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x30], xmm0
mov edi, dword [ecx + 0x1c]
mov ebx, dword [ecx + 0x20]
movups xmmword [ebp - 0x20], xmm0
cmp edi, ebx
je 0x54bd91
mov dword [ebp - 0x34], ecx
lea esi, [ebp - 0x20]
mov ecx, edi
push esi
call fcn.0054bb80
test al, al
jne 0x54bd73
add edi, 0x58
cmp ebx, edi
jne 0x54bd5e
mov edi, ebx
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x34]
cmp edi, dword [esi + 0x20]
je 0x54bd94
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x54bda8
cmp byte [edi + 0x1b], 0
jns 0x54bdb6
mov eax, dword [edi + 0x10]
jmp 0x54bdb9
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
jmp 0x54bd94
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x54bd94
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x54bd94
mov byte [esi + 0x18], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor ebx, ebx
jmp 0x54bd94

Function at 0x54c440
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov esi, dword [ebp + 8]
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x54c463
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x54c47f
and eax, 0x410
cmp eax, 0x410
je 0x54c55a
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x54c489
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
je 0x54c4ad
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004cb810
add esp, 4
test al, al
je 0x54c553
call fcn.00501800
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x94
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.00501810
lea eax, [ebp - 0xb4]
push 0xb
push str.DeleteFile
push eax
call fcn.004b7fc0
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x54c501
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc8]
push eax
push esi
push ebx
call fcn.00412900
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x54c526
mov eax, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xc8]
push eax
push ebx
push edi
call fcn.004b7fc0
add esp, 0xc
cmp byte [ebp - 0xbd], 0
jns 0x54c548
push dword [ebp - 0xc8]
call fcn.004cf0d6
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.005018c0
xor ebx, ebx
jmp 0x54c496
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov ecx, esi
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00550600
Function at 0x54cca0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, dword [ebp + 8]
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x54ccc3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x54ccee
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004cb810
add esp, 4
test al, al
je 0x54cd91
call fcn.00501800
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x74
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.00501810
lea eax, [ebp - 0xb4]
push 0x12
push str.GetFileAttributes
push eax
call fcn.004b7fc0
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x54cd3f
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc8]
push eax
push edi
push ebx
call fcn.00412900
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x54cd64
mov eax, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xc8]
push eax
push ebx
push esi
call fcn.004b7fc0
add esp, 0xc
cmp byte [ebp - 0xbd], 0
jns 0x54cd86
push dword [ebp - 0xc8]
call fcn.004cf0d6
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.005018c0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
xor eax, eax
jmp 0x54cce3

Function at 0x54d010
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054c440
Function at 0x54ff60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x218
mov ebx, edx
mov edi, ecx
mov eax, dword [0x5c4738]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.004d5a00
add esp, 0xc
mov word [esi - 2], 0
lea esi, [ebp - 0x218]
xor eax, eax
push esi
push eax
push eax
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test eax, eax
js 0x54ffdb
push esi
call fcn.004d00f2
add esp, 4
mov edx, esi
lea esi, [ebp - 0x224]
mov ecx, esi
push eax
push edx
call fcn.004cae90
mov ecx, ebx
push esi
call fcn.00411710
mov ecx, esi
call fcn.004c5e70
test edi, edi
setns bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d25a3
mov eax, ebx
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x550220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, edx
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x5502b0
mov edi, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x5502b0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5502b0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x5502b0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
test eax, eax
js 0x5502ba
push eax
mov ebx, eax
call fcn.004cf0a6
add esp, 4
mov edi, eax
mov eax, ebx
add ebx, edi
push eax
push 0
push edi
call fcn.004d5a00
add esp, 0xc
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
call fcn.004d4f00
add esp, 0xc
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.004ff350
int3