joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440159
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0xc
add eax, dword [ebp + 0x10]
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
push edi
push eax
push edi
push 0x8000004
push edi
push 0xffffffffffffffff
lea esi, [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
mov ecx, esi
call fcn.004103f0
push dword [esi]
call fcn.0040fe30
pop ecx
test al, al
jne 0x440198
push 0x19
jmp 0x4401b7
push edi
push edi
push 7
lea eax, [ebp - 8]
push eax
push dword [ebx]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x4401bd
push 0x1a
pop esi
jmp 0x440280
push edi
push edi
push edi
push 6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x4401d5
push 0x1b
jmp 0x4401b7
add eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
test esi, esi
je 0x44020b
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x44020b
push ecx
push esi
push eax
call fcn.004562a0
mov edx, dword [ebp - 4]
add esp, 0xc
mov eax, edi
mov ecx, dword [edx + eax*4]
test ecx, ecx
je 0x440205
sub ecx, esi
mov dword [edx + eax*4], ecx
inc eax
cmp eax, 0x40
jb 0x4401f9
mov eax, dword [ebp - 8]
mov ecx, ebx
push 4
push 0x4ac00c
push str.g_shared_section
mov dword [0x4ac00c], eax
call fcn.0044030e
mov esi, eax
mov dword [0x4ac00c], edi
test esi, esi
jne 0x440280
mov eax, dword [ebp + 0x10]
mov ecx, ebx
push 4
push 0x4ac080
push str.g_shared_IPC_size
mov dword [0x4ac080], eax
call fcn.0044030e
mov esi, eax
mov dword [0x4ac080], edi
test esi, esi
jne 0x440280
mov eax, dword [ebp + 0x14]
mov ecx, ebx
push 4
push 0x4ac084
push str.g_shared_policy_size
mov dword [0x4ac084], eax
call fcn.0044030e
mov esi, eax
mov dword [0x4ac084], edi
test esi, esi
je 0x44028f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, esi
jmp 0x4402ed
push 0x1c
call fcn.004521ed
pop ecx
test eax, eax
je 0x4402af
push dword [ebp + 8]
mov ecx, eax
push dword [ebx + 0x24]
push dword [ebx + 8]
push dword [ebx]
call fcn.00443414
mov edi, eax
lea esi, [ebx + 0x20]
mov eax, dword [esi]
mov dword [esi], edi
test eax, eax
je 0x4402c2
push eax
mov ecx, esi
call fcn.0043fdf7
mov ecx, dword [esi]
push 0x400
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call fcn.00443623
test al, al
jne 0x4402dd
push 4
pop eax
jmp 0x4402ed
mov ecx, ebx
call fcn.00425270
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x444110
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4ab09c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00444095
pop ecx
test al, al
je 0x444139
mov eax, 0x1126
jmp 0x4442a5
and dword [ebp - 0xc], 0
xor eax, eax
push ebx
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push edi
push eax
push esi
mov dword [ebp - 8], 7
call fcn.0044400a
mov bh, al
lea eax, [ebp - 0x1c]
push eax
call fcn.00444746
mov bl, al
lea eax, [ebp - 0x1c]
push eax
push eax
call fcn.00443f74
add esp, 0x14
test bl, bl
jne 0x444184
test al, al
jne 0x444184
test bh, bh
jne 0x444184
push 0x7b
pop esi
jmp 0x444295
xor bh, bh
or edi, 0xffffffff
test bl, bl
jne 0x4441d7
push 0x4855dc
lea ecx, [ebp - 0x4c]
call fcn.004029b0
push edi
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.00406280
push eax
lea ecx, [ebp - 0x34]
call fcn.00402980
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004097b0
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00404170
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.00404170
inc bh
mov eax, edi
xor bl, bl
and dword [ebp - 0x24], 0
xor ecx, ecx
push eax
push ecx
lea eax, [ebp - 0x1c]
mov word [ebp - 0x34], cx
push eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 7
call fcn.004043a0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004097b0
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00404170
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
jne 0x444269
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x444270
cmp esi, 3
je 0x444270
cmp esi, 0x7b
je 0x444270
test bl, bl
je 0x444295
test bh, bh
je 0x444295
push 1
push edi
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x5c
push eax
lea ecx, [ebp - 0x1c]
call fcn.004041e0
cmp eax, 3
jne 0x444295
mov esi, 0x1126
jmp 0x444295
test eax, 0x400
jne 0x444293
push 1
push edi
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x5c
push eax
lea ecx, [ebp - 0x1c]
mov bl, 1
call fcn.004041e0
cmp eax, 2
ja 0x4441db
jmp 0x444262
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00404170
pop edi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0045248d
mov esp, ebp
pop ebp
ret
Function at 0x445162
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4ab09c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 0x60], eax
mov ebx, ecx
cmp byte [ebp + 8], al
jne 0x44518e
cmp dword [ebx + 8], eax
jne 0x4451b9
jmp 0x4452a7
push eax
push 0x44a657
push edi
push str.NtMapViewOfSection
mov esi, 0x4857e8
push esi
call fcn.00444bb6
push edi
push 0x44a77b
push edi
push str.NtUnmapViewOfSection
push esi
mov ecx, ebx
call fcn.00444bb6
mov eax, dword [ebx]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0x2000
mov eax, dword [eax]
push 0x10000
push 0
push eax
mov dword [ebp - 0x58], eax
call edi
mov esi, eax
mov eax, dword [ebx + 8]
shl eax, 6
add eax, 0x50
push eax
mov dword [ebp - 0x5c], eax
call fcn.00444dcc
pop ecx
mov ecx, eax
mov edx, 0xfffff000
and ecx, edx
and eax, 0xfff
add esi, ecx
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x5c]
push 0x40
push 0x1000
add ecx, 0xfff
and ecx, edx
push ecx
push esi
push dword [ebp - 0x58]
call edi
mov ecx, eax
test ecx, ecx
jne 0x445222
mov byte [0], al
mov edi, dword [ebp - 0x64]
mov esi, dword [ebp - 0x5c]
add edi, ecx
and dword [ebp - 0x48], 0
push 0xa4
push 0
push 0x4ac0a0
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], 0x10
call fcn.00456820
add esp, 0xc
lea eax, [ebp - 0x54]
mov ecx, ebx
push eax
push esi
push edi
call fcn.00444f1c
test eax, eax
jne 0x4452a7
lea eax, [ebp - 0x60]
push eax
push 0x10
lea eax, [ebp - 0x54]
push eax
push edi
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4452a4
cmp dword [ebp - 0x60], 0x10
jne 0x4452a4
lea eax, [ebp - 0x68]
push eax
push 0x20
push esi
push edi
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebx]
push 0xa4
push 0x4ac0a0
push str.g_originals
call fcn.0044030e
jmp 0x4452a7
push 0x2a
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045248d
mov esp, ebp
pop ebp
ret 4
Function at 0x44873b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x34]
push esi
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4487d3
cmp dword [ebp + 0xc], 0
mov ecx, 0x101c01
push edi
push 1
push 0
mov edi, 0x1fffff
mov eax, edi
cmove eax, ecx
push eax
push esi
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x4487a5
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4487d2
cmp dword [ebp + 0xc], 0
lea eax, [esi + 4]
push 1
push 0
mov ecx, 0x100c43
cmove edi, ecx
push edi
push eax
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
ret

Function at 0x448885
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
jne 0x4488b1
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push 3
push 0
push 0
push dword [ebp + 0x20]
push dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
neg eax
pop esi
sbb eax, eax
and eax, 0xfffffffb
add eax, 5
pop ebp
ret

Function at 0x44ff51
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push dword [ebp + 8]
push edi
push 0x8000004
push edi
mov dword [esi], edi
push 0xffffffffffffffff
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
mov ecx, esi
call fcn.004103f0
push dword [esi]
call fcn.0040fe30
pop ecx
test al, al
je 0x44ff98
push dword [ebp + 8]
push edi
push edi
push 6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x467948
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004677c7

Function at 0x46a71c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046a3dc
Function at 0x47209f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x4ab09c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x20], ebx
cmp dword [edi + 0x14], 8
jb 0x4720c7
mov eax, dword [edi]
jmp 0x4720c9
mov eax, edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4720dd
mov al, 1
jmp 0x47217a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x472173
push 2
call fcn.00401e30
pop ecx
test al, al
je 0x47214b
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x232
push str.c:_nwjs_src_third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea ecx, [ebp - 0xd8]
call fcn.00402680
push ecx
push ecx
mov ecx, esp
mov esi, eax
push edi
call fcn.004096e0
lea eax, [ebp - 0x1c]
push eax
call fcn.00413640
add esp, 0xc
push eax
lea eax, [esi + 0x10]
push str.CreateDirectory
push eax
call fcn.00406a20
pop ecx
pop ecx
push eax
call fcn.00406c70
pop ecx
pop ecx
push 3
pop ebx
test bl, 2
je 0x47215e
lea ecx, [ebp - 0xd8]
and ebx, 0xfffffffd
call fcn.004026b0
test bl, 1
je 0x47216f
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00404530
xor al, al
jmp 0x47217a
push edi
call fcn.00472311
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045248d
mov esp, ebp
pop ebp
ret
Function at 0x472311
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x4ab09c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x20], ebx
cmp dword [edi + 0x14], 8
jb 0x472339
mov eax, dword [edi]
jmp 0x47233b
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4723d3
push 2
call fcn.00401e30
pop ecx
test al, al
je 0x4723a8
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x21c
push str.c:_nwjs_src_third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea ecx, [ebp - 0xd8]
call fcn.00402680
push ecx
push ecx
mov ecx, esp
mov esi, eax
push edi
call fcn.004096e0
lea eax, [ebp - 0x1c]
push eax
call fcn.00413640
add esp, 0xc
push eax
lea eax, [esi + 0x10]
push str.GetFileAttributes
push eax
call fcn.00406a20
pop ecx
pop ecx
push eax
call fcn.00406c70
pop ecx
pop ecx
push 3
pop ebx
test bl, 2
je 0x4723bb
lea ecx, [ebp - 0xd8]
and ebx, 0xfffffffd
call fcn.004026b0
test bl, 1
je 0x4723cc
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00404530
xor al, al
jmp 0x472458
test al, 0x10
jne 0x472456
push 2
call fcn.00401e30
pop ecx
test al, al
je 0x47243b
push 2
push 0x220
push str.c:_nwjs_src_third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea ecx, [ebp - 0xd0]
call fcn.00401ea0
push str.:_not_a_directory
push ecx
push ecx
mov ecx, esp
mov esi, eax
push edi
call fcn.004096e0
lea eax, [ebp - 0x1c]
push eax
call fcn.00413640
add esp, 0xc
push eax
lea eax, [esi + 8]
push str.GetFileAttributes
push eax
call fcn.00406a20
pop ecx
pop ecx
push eax
call fcn.00406c70
pop ecx
pop ecx
push eax
call fcn.00406a20
pop ecx
pop ecx
push 0xc
pop ebx
test bl, 8
je 0x47244e
lea ecx, [ebp - 0xd0]
and ebx, 0xfffffff7
call fcn.00401f60
test bl, 4
jmp 0x4723be
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045248d
mov esp, ebp
pop ebp
ret

Function at 0x473160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0x10
cmp dword [eax + 0x14], 8
jb 0x473171
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x473182
xor eax, eax
inc eax
pop ebp
ret
shr eax, 3
and eax, 2
pop ebp
ret
Function at 0x475752
Capabilities:
Check os version
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4ab09c]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, byte [ebp + 0xc]
and dword [ebp - 0x34], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov byte [ebp - 0x2d], cl
xor edi, edi
mov dword [ebp - 0x34], esi
test cl, cl
je 0x4757dc
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x4757d9
push 0xa
pop ecx
push 0
lea eax, [ebp - 0x38]
mov esi, str.S:_ML_____S_1_16_0_
push eax
push 1
lea eax, [ebp - 0x2c]
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
push eax
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x4757ae
mov byte [0], al
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x34]
call fcn.00476617
mov esi, dword [ebp - 0x34]
lea edi, [ebp - 0x44]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x38]
lea edi, [ebp - 0x44]
and dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 0xc
mov dword [ebp - 0x40], eax
mov cl, byte [ebp - 0x2d]
cmp dword [ebx + 0x14], 8
jb 0x4757e4
mov ebx, dword [ebx]
push edi
push 0
mov eax, 0x200
test cl, cl
push eax
push eax
push 2
push 6
push 3
pop eax
mov edx, 0x80003
cmovne eax, edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov edi, eax
test esi, esi
je 0x475814
push esi
call fcn.0047c7f4
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045248d
mov esp, ebp
pop ebp
ret
Function at 0x47a7e5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ebx
mov dword [esi + 8], edi
call fcn.0047a988
mov byte [esi + 0x5d], al
pop ecx
test al, al
je 0x47a811
mov byte [esi + 0x5c], bl
jmp 0x47a826
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x28], 9
sete al
mov byte [esi + 0x5c], al
cmp byte [esi + 0x5c], bl
je 0x47a878
push 2
call fcn.00401e30
pop ecx
test al, al
je 0x47a861
push 2
push 0x207
push str.c:_nwjs_src_third_partycrashpadcrashpadutilwinprocess_info.cc
lea ecx, [ebp - 0xd8]
call fcn.00401ea0
add eax, 8
push str.Reading_x64_process_from_x86_process_not_supported
push eax
call fcn.00406a20
pop ecx
xor ebx, ebx
pop ecx
inc ebx
test bl, 1
je 0x47a871
lea ecx, [ebp - 0xd8]
call fcn.00401f60
xor al, al
jmp 0x47a97b
lea eax, [esi + 0x30]
push eax
lea ecx, [esi + 0x28]
push ecx
push esi
push ebx
push edi
call fcn.00478e58
add esp, 0x14
test al, al
jne 0x47a8ca
push 2
call fcn.00401e30
pop ecx
test al, al
je 0x47a8c5
push 2
push 0x215
push str.c:_nwjs_src_third_partycrashpadcrashpadutilwinprocess_info.cc
lea ecx, [ebp - 0xd8]
call fcn.00401ea0
add eax, 8
push str.GetProcessBasicInformation_failed
push eax
call fcn.00406a20
pop ecx
pop ecx
push 2
pop ebx
test bl, 2
jmp 0x47a864
push esi
push dword [esi + 0x2c]
push dword [esi + 0x28]
push edi
cmp byte [esi + 0x5c], bl
je 0x47a8de
call fcn.0047924b
jmp 0x47a8e3
call fcn.0047900e
add esp, 0x10
test al, al
jne 0x47a928
push 2
call fcn.00401e30
pop ecx
test al, al
je 0x47a920
push 2
push 0x21e
push str.c:_nwjs_src_third_partycrashpadcrashpadutilwinprocess_info.cc
lea ecx, [ebp - 0xd8]
call fcn.00401ea0
add eax, 8
push str.ReadProcessData_failed
push eax
call fcn.00406a20
pop ecx
pop ecx
push 4
pop ebx
test bl, 4
jmp 0x47a864
movzx eax, byte [esi + 0x5c]
push esi
push eax
push edi
call fcn.0047ad1b
add esp, 0xc
test al, al
jne 0x47a979
push 2
call fcn.00401e30
pop ecx
test al, al
je 0x47a971
push 2
push 0x223
push str.c:_nwjs_src_third_partycrashpadcrashpadutilwinprocess_info.cc
lea ecx, [ebp - 0xd8]
call fcn.00401ea0
add eax, 8
push str.ReadMemoryInfo_failed
push eax
call fcn.00406a20
pop ecx
pop ecx
push 8
pop ebx
test bl, 8
jmp 0x47a864
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47c269
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
xor ebx, ebx
lea eax, [ebp - 0x10]
push ebx
push eax
xorps xmm0, xmm0
mov dword [ebp - 4], ebx
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x47c2e6
push 2
call fcn.00401e30
pop ecx
test al, al
je 0x47c2d4
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xd9
push str.c:_nwjs_src_third_partycrashpadcrashpadutil_file_file_io_win.cc
lea ecx, [ebp - 0xc8]
call fcn.00402680
add eax, 0x10
push 0x4a4440
push eax
call fcn.00406a20
pop ecx
pop ecx
push 4
pop ebx
test bl, 4
je 0x47c2ee
lea ecx, [ebp - 0xc8]
call fcn.004026b0
jmp 0x47c2ee
mov eax, dword [ebp - 0x10]
or eax, dword [ebp - 0xc]
je 0x47c2f2
xor al, al
jmp 0x47c342
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x47c340
push 2
call fcn.00401e30
pop ecx
test al, al
je 0x47c33b
xor ebx, ebx
inc ebx
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xe3
push str.c:_nwjs_src_third_partycrashpadcrashpadutil_file_file_io_win.cc
lea ecx, [ebp - 0xc8]
call fcn.00402680
add eax, 0x10
push 0x4a4454
push eax
call fcn.00406a20
pop ecx
pop ecx
test bl, 1
jmp 0x47c2d7
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47c47c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
test esi, esi
je 0x47c4e5
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47c4c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x47c4e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x47c4da
or eax, 0xffffffff
jmp 0x47c4e7
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x47c4dd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x47c4e5
mov eax, dword [ebp + 0x10]
add ebx, eax
add edi, eax
sub esi, eax
jne 0x47c493
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47c986
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
push esi
push 0x47c9b6
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x47c9b0
mov byte [0], bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4010a0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x40111e
lea eax, [esp + 8]
mov dword [esp + 8], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401117
mov edi, dword [esp + 0x134]
lea ecx, [esp + 0x2c]
push edi
push ecx
call fcn.00414250
add esp, 8
test eax, eax
je 0x401109
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x401117
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.00414250
add esp, 8
test eax, eax
jne 0x4010e8
pop edi
mov eax, 1
pop esi
add esp, 0x128
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x128
ret

Function at 0x401130
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x30
lea eax, [esp]
mov dword [esp + 4], 0x10
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x401167
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x78
sete cl
mov eax, ecx
add esp, 0x30
ret
lea edx, [esp + 8]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x40118e
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x30
ret
mov edx, dword [esp + 8]
xor ecx, ecx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
lea edx, [esp + 0x20]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x18], eax
push ecx
mov ecx, dword [esp + 4]
push edx
lea eax, [esp + 0x18]
push 0x10
push eax
push 0
push ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4011f3
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x30
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add esp, 0x30
ret