joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434170
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, ecx
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x434192
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4341bf
mov bl, 1
test al, 0x10
je 0x434267
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004552c0
add esp, 4
test al, al
je 0x434275
call fcn.004af950
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x25c
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.004afa80
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00494230
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x434213
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.0044f100
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x434238
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.00494230
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x43425a
push dword [ebp - 0xc4]
call fcn.0046acdd
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.004afae0
jmp 0x434275
push 2
call fcn.004552c0
add esp, 4
test al, al
jne 0x43427c
xor ebx, ebx
jmp 0x4341a8
lea ecx, [ebp - 0xb8]
push 2
push 0x260
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.0042a2a0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00494230
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4342b8
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.0044f100
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4342dd
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
push eax
push ebx
push edi
call fcn.00494230
add esp, 0xc
push 0x11
push str.:_not_a_directory
push eax
call fcn.00494230
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x43430f
push dword [ebp - 0xc4]
call fcn.0046acdd
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.0042a680
jmp 0x434275
Function at 0x435580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov cl, byte [ebp + 0x14]
mov edx, dword [0x4e2024]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov edx, 0x4cfe8c
mov esi, 0x4cfe88
test cl, cl
cmovne esi, edx
push esi
push eax
call fcn.0047fa10
add esp, 8
mov esi, eax
test eax, eax
je 0x43565f
mov edi, dword [ebp + 0xc]
cmp byte [ebp + 0x10], 0
je 0x435608
test edi, edi
je 0x435678
push edi
call fcn.00483176
add esp, 4
lea ebx, [ebp - 0x28]
push eax
push edi
push ebx
call fcn.0044f100
add esp, 0xc
mov eax, dword [ebx + 8]
mov dword [ebp - 0x14], eax
movsd xmm0, qword [ebx]
movsd qword [ebp - 0x1c], xmm0
push esi
push 1
push 3
push 0x4d15c0
call fcn.00481286
add esp, 0x10
jmp 0x435632
test edi, edi
je 0x43567b
push edi
call fcn.00483176
add esp, 4
lea ebx, [ebp - 0x28]
push eax
push edi
push ebx
call fcn.0044f100
add esp, 0xc
mov eax, dword [ebx + 8]
mov dword [ebp - 0x14], eax
movsd xmm0, qword [ebx]
movsd qword [ebp - 0x1c], xmm0
lea eax, [ebp - 0x1c]
mov bl, byte [eax + 0xb]
test bl, bl
mov edi, dword [eax]
cmovs eax, edi
push esi
push eax
call fcn.004810f6
add esp, 8
push esi
call fcn.00480cb3
add esp, 4
test bl, bl
jns 0x43565f
push edi
call fcn.0046acdd
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
int3
int3

Function at 0x435e50
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x4e2024]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movzx ecx, byte [eax + 0xb]
test cl, cl
jns 0x435e74
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov ebx, dword [ebp + 0xc]
lea esi, [ebp - 0x1c]
push ecx
push eax
push esi
call fcn.0044eda0
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x435e8e
mov esi, dword [ebp - 0x1c]
lea edi, [ebp - 0x28]
push ebx
push dword [ebp + 8]
push edi
call fcn.0044eda0
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x435ea7
mov edi, dword [ebp - 0x28]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x1d], 0
jns 0x435ec2
push dword [ebp - 0x28]
call fcn.0046acdd
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x435ed3
push dword [ebp - 0x1c]
call fcn.0046acdd
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x435f60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov edi, ecx
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
push edx
push ecx
push esi
call fcn.0044eda0
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x435f8e
mov esi, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x435fac
push dword [ebp - 0x1c]
call fcn.0046acdd
add esp, 4
cmp dword [ebp + 8], 0
je 0x436044
test esi, esi
je 0x436044
xor eax, eax
dec eax
mov ecx, esi
add ecx, esi
cmovb ecx, eax
push ecx
call fcn.0046ad13
add esp, 4
mov ecx, edi
mov edi, eax
mov eax, ebx
lea ebx, [ebp - 0x1c]
push eax
push ecx
push ebx
call fcn.0044eda0
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x435fee
mov ebx, dword [ebp - 0x1c]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x436008
push dword [ebp - 0x1c]
call fcn.0046acdd
add esp, 4
test edi, edi
mov ebx, dword [ebp + 8]
je 0x43605d
push edi
call fcn.00483176
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.0044f100
add esp, 0xc
cmp byte [ebx + 0xb], 0
js 0x436060
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebx], xmm0
push edi
call fcn.0046ad1c
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
int3
push dword [ebx]
call fcn.0046acdd
add esp, 4
jmp 0x43602c
Function at 0x436690
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x12c
mov esi, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov ecx, dword [0x4e2024]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor ecx, ecx
dec ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], ecx
test al, al
je 0x43676b
lea ebx, [ebp - 0x120]
xor edi, edi
push 0x110
push edi
push ebx
call fcn.0046e590
add esp, 0xc
mov dword [ebx - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x4d8630]
movups xmmword [esp], xmm0
mov ebx, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call ebx
mov ecx, 3
push ecx
push 1
push edx
push eax
call ebx
mov ecx, 3
push ecx
push 0x20
push edx
push eax
call ebx
lea ecx, [ebp - 0x120]
mov dword [ecx - 8], 6
mov dword [ecx - 4], edi
mov word [ecx + 0x108], 0
lea ecx, [ebp - 0x12c]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ebx, 0x80003
test eax, eax
je 0x436772
lea edi, [ebp - 0x138]
mov dword [edi], 0xc
push 0
call fcn.004367c0
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], 1
jmp 0x436772
xor edi, edi
mov ebx, 3
cmp byte [esi + 0xb], 0
jns 0x43677a
mov esi, dword [esi]
sub esp, 0x20
mov dword [esp + 0x1c], edi
movaps xmm0, xmmword [0x4d8640]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, esi
add esp, 0x12c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x436df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret
Function at 0x4371e0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 8]
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
test edi, edi
je 0x4373c3
cmp dword [0x4e4d18], 0xe69e32f3
jne 0x4373c6
mov edx, dword [edi + 8]
lea esi, [edx + 0x1c8]
mov byte [ebp - 0x11], 0xff
cmp byte [edi + 3], 0
mov eax, esi
mov dword [ebp - 0x18], esi
je 0x4373c9
mov edx, 0x20
mov ecx, 0x20
test eax, eax
je 0x43723e
bsr ecx, eax
xor ecx, 0x1f
sub edx, ecx
mov cl, byte [edx + 0x4d6918]
mov esi, eax
shr esi, cl
and esi, 3
and eax, dword [edx*4 + 0x4d693c]
lea ecx, [esi + edx*4]
cmp eax, 1
sbb ecx, 0xffffffff
movzx esi, word [ecx + ecx + 0x4d680c]
shl esi, 5
lea ebx, [edi + esi]
add ebx, 0x48
add edi, 0x40
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4373b2
mov dword [ebp - 0x1c], edi
mov eax, dword [ebx]
mov edi, dword [eax]
test edi, edi
je 0x437358
mov byte [ebp - 0x11], 0
mov ebx, dword [edi]
test ebx, ebx
je 0x4373ab
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + esi + 0x54]
mov edx, ebx
bswap edx
test edx, 0x1fc000
je 0x4373be
mov esi, edx
xor esi, edi
cmp esi, 0x1fffff
ja 0x4373be
not ebx
cmp dword [edi + 4], ebx
jne 0x4373be
prefetcht0 byte [edx]
mov dword [eax], edx
mov ecx, dword [eax + 0xc]
lea edx, [ecx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [eax + 0xc], ecx
mov esi, dword [ebp + 8]
mov eax, dword [eax + 8]
mov ecx, dword [esi + 0x8fc]
add ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x900]
mov dword [esi + 0x8fc], ecx
cmp eax, ecx
cmova ecx, eax
mov dword [esi + 0x900], ecx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, edi
push esi
call fcn.0045b5a0
push edi
push dword [0x4f4bd4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x4e5e14]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x90], edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x11]
mov ecx, ebx
push eax
push 0x4000
push dword [ebp - 0x18]
push 2
mov esi, dword [ebp + 8]
push esi
call fcn.004609e0
test eax, eax
je 0x437418
mov edi, eax
mov ecx, eax
and ecx, 0xffe00000
mov edx, eax
shr edx, 9
and edx, 0xfe0
lea eax, [edx + ecx]
movzx ecx, byte [edx + ecx + 0x101e]
and ecx, 0x3f
shl ecx, 5
sub eax, ecx
add eax, 0x1000
jmp 0x4372ee
xor edx, edx
jmp 0x4372d2
mov ecx, edi
call fcn.0045bf70
jmp 0x437280
call fcn.004b44f0
int3
int3
lea ecx, [edx + 0xc7]
mov eax, esi
cmp ecx, 0x7fefe
ja 0x43722a
xor ecx, ecx
cmp esi, 1
sbb ecx, ecx
or ecx, 0x20
add edx, 0x1c7
je 0x437411
bsr eax, edx
xor eax, 0x1f
sub ecx, eax
xor edx, edx
inc edx
shl edx, cl
mov eax, edx
shr eax, 1
lea eax, [eax + eax*4]
shr eax, 2
cmp eax, dword [ebp - 0x18]
cmovb eax, edx
jmp 0x43722a
mov eax, 0x20
jmp 0x4373f5
xor edi, edi
jmp 0x437311
Function at 0x437430
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4f4c10]
mov ecx, dword [0x4e5e14]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x43747d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, 0x4f4c0c
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4f4c10
call fcn.0046ad57
add esp, 4
cmp dword [0x4f4c10], 0xffffffff
jne 0x437463
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.0046e590
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.0046acad
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x4f4c40]
mov ecx, dword [0x4e5e14]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x437526
mov ecx, esi
push ebx
push 0x4f4c1c
push edi
call fcn.00437640
mov dword [0x4f4c0c], esi
push 0x4f4c10
call fcn.0046adcd
add esp, 4
jmp 0x437463
push 0x4f4c40
call fcn.0046ad57
add esp, 4
cmp dword [0x4f4c40], 0xffffffff
jne 0x437500
xorps xmm0, xmm0
movups xmmword [0x4f4c2c], xmm0
movups xmmword [0x4f4c1c], xmm0
mov dword [0x4f4c3c], 0
push 0x4f4c1c
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x4f4c40
call fcn.0046adcd
add esp, 4
jmp 0x437500

Function at 0x437590
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4f4c40]
mov ecx, dword [0x4e5e14]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4375c2
movzx ecx, word [0x4f4c1c]
cmp cx, 9
jne 0x43760d
xor eax, eax
inc eax
pop ebp
ret
push 0x4f4c40
call fcn.0046ad57
add esp, 4
cmp dword [0x4f4c40], 0xffffffff
jne 0x4375b0
xorps xmm0, xmm0
movups xmmword [0x4f4c2c], xmm0
movups xmmword [0x4f4c1c], xmm0
mov dword [0x4f4c3c], 0
push 0x4f4c1c
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x4f4c40
call fcn.0046adcd
add esp, 4
jmp 0x4375b0
xor eax, eax
test cx, cx
je 0x4375c0
cmp cx, 6
jne 0x437621
mov eax, 2
jmp 0x4375c0
cmp cx, 0xc
jne 0x43762e
mov eax, 3
jmp 0x4375c0
mov eax, 4
jmp 0x4375c0
Function at 0x437d60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x437dd3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x437dbd
cmp dword [ebp - 0x18], 4
jne 0x437dbd
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x437dbd

Function at 0x437de0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.0046c230
mov esi, ecx
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x800
lea edi, [ebp - 0x810]
push ebx
push 0xff
push edi
call fcn.0046e590
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], ebx
push ecx
push edi
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x437e6f
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x437e73
mov ecx, esi
push edi
call fcn.0041bed0
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x437e56
cmp eax, 2
jne 0x437ebc
lea ebx, [ebp - 0x1010]
push 0x800
push 0xff
push ebx
call fcn.0046e590
add esp, 0xc
push 0x400
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x437eb5
mov ecx, esi
push ebx
jmp 0x437e4f
mov esi, 0xea
jmp 0x437e56
mov esi, 0x3f4
jmp 0x437e56

Function at 0x438090
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4e5d2c]
cmp eax, 0xffffffff
je 0x4380b0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
jmp 0x4380ae
Function at 0x4380c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x4e5d2c]
cmp eax, 0xffffffff
je 0x438187
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x438187
mov eax, dword [0x4f5858]
mov ecx, dword [0x4e5e14]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x438191
mov edi, dword [0x4f5854]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4381d6
mov ecx, dword [0x4f4c50]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x4f4c54], 0
jne 0x4381e2
lea eax, [eax*4 + 0x4f4c54]
mov dword [eax], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x4f4c58], ecx
mov dword [0x4f4c50], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x4f4c5c]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4381f4
cmp eax, 0x100
jge 0x4381f7
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00438200
jmp 0x4380e5
push 0x4f5858
call fcn.0046ad57
add esp, 4
cmp dword [0x4f5858], 0xffffffff
jne 0x438106
push 4
call fcn.0046acad
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.004505d0
mov dword [0x4f5854], edi
push 0x4f5858
call fcn.0046adcd
add esp, 4
jmp 0x438106
mov ecx, edi
call fcn.004505e0
jmp 0x43811b
inc edx
cmp edx, 0x100
jne 0x438124
jmp 0x43816b
int3
int3

Function at 0x438200
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x814], 0xffffffff
mov ecx, dword [0x4e5d2c]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x4382ad
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x4382f6
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.0046e590
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.0043eca0
add esp, 8
push edi
call fcn.0046ad13
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.0046e010
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.0043eca0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.0043ec80
add esp, 4
test al, al
je 0x4382f9
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x4382fc
xor eax, eax
dec eax
lock cmpxchg dword [0x4e5d2c], ecx
je 0x438231
push ecx
call fcn.004bc0a0
add esp, 4
mov ecx, dword [0x4e5d2c]
mov dword [ebp - 0x814], ecx
jmp 0x438231
int3
int3
push esi
call fcn.0043ec80
add esp, 4
test al, al
je 0x438324
cmp dword [ebp - 0x814], 0xffffffff
je 0x438324
push 0xffffffffffffffff
call fcn.004bc0a0
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x4382cb
int3
Function at 0x43def0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x4e2024]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, 0x7fffffff
cmp edx, esi
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43df48
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x43df4d
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046b8b5
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
xor esi, esi
dec esi
jmp 0x43df36
int3

Function at 0x43df50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x4e2024]
xor ecx, ebp
mov esi, 0x7fffffff
cmp eax, esi
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push edx
mov edi, ebx
push ebx
call ecx
test eax, eax
je 0x43dfc8
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x43dfb5
cmp ebx, 0xffffffff
je 0x43dfda
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x43dfdd
mov ebx, dword [ebp - 0x14]
jmp 0x43dfa1
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x43dfa1
int3
mov edx, dword [ebp + 0xc]
jmp 0x43df77

Function at 0x43e410
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov esi, dword [ebp + 8]
mov eax, dword [0x4e2024]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.0043e320
add esp, 0x10
or edx, eax
jne 0x43e447
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x43e45d
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0046b8b5
mov eax, ebx
add esp, 0xac
pop esi
pop ebx
pop ebp
ret
push 2
call fcn.004552c0
add esp, 4
test al, al
jne 0x43e46f
xor ebx, ebx
jmp 0x43e447
call fcn.004af950
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0xfb
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
call fcn.004afa80
lea eax, [ebp - 0xac]
push 0xc
push 0x4d96ed
push eax
call fcn.00494230
add esp, 0xc
mov ecx, esi
call fcn.004afae0
jmp 0x43e46b
Function at 0x43eaa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x43eab7
test eax, eax
je 0x43eab7
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
jne 0x43eac5
mov ecx, dword [0x4f5a60]
test ecx, ecx
jne 0x43eb01
cmp dword [0x4f5a58], 0
je 0x43eab1
mov esi, dword [0x4f5a5c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x43eb0b
test esi, esi
je 0x43eab1
mov ecx, dword [0x4f5a58]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x43eab1
call dword [section..00cfg]
call ecx
jmp 0x43eac5
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x43eae9

Function at 0x443920
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x4e2024]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x443950
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046b8b5
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x443a40
push 0
push eax
push 0x443900
push 0x4f666c
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x443a2f
cmp dword [0x4f6670], 0
jne 0x44393c
push dword [0x4f6674]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44393c
mov esi, eax
mov eax, 0x4f6678
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov ebx, dword [0x4f667c]
mov edi, dword [0x4f6680]
mov eax, dword [0x4f6684]
mov dword [ebp - 0x18], eax
mov eax, dword [0x4f6688]
mov dword [ebp - 0x1c], eax
mov eax, 0x4f6678
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test ebx, ebx
je 0x4439dc
mov eax, dword [esi]
mov dword [ebp - 0x20], eax
mov ecx, ebx
call dword [section..00cfg]
push dword [ebp - 0x20]
call ebx
add esp, 4
test edi, edi
je 0x4439f1
mov ebx, dword [esi + 4]
mov ecx, edi
call dword [section..00cfg]
push ebx
call edi
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x443a09
mov edi, dword [esi + 8]
mov ecx, dword [ebp - 0x18]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x443a21
mov edi, dword [esi + 0xc]
mov ecx, dword [ebp - 0x1c]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
push esi
call fcn.00467f00
add esp, 4
jmp 0x44393c
call fcn.0047d100
int3