joyce8/EMBER2024-capa huggingface dataset:
Function at 0x539c30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov ebx, edx
mov dword [esp + 8], ecx
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [esp + 0xa8], eax
mov dword [esp + 0x20], 0xa
mov eax, dword [0x5a6cc4]
mov al, byte [eax + 0xa]
test al, al
jne 0x539e5f
xor edi, edi
dec edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
lea esi, [esp + 0x50]
mov ecx, ebx
push esi
call fcn.00454650
cmp byte [esi + 0xb], 0
mov dword [esp + 0xc], ebx
js 0x539d1d
mov eax, dword [esp + 0x58]
mov dword [esp + 0xa0], eax
movq xmm0, qword [esp + 0x50]
movq qword [esp + 0x98], xmm0
lea ebx, [esp + 0x50]
mov ecx, ebx
call fcn.004bcaf0
lea esi, [esp + 0x8c]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov ecx, dword [esp + 0xc]
push esi
call fcn.00540960
pxor xmm0, xmm0
movq qword [ebx + 0x34], xmm0
pxor xmm0, xmm0
movdqu xmmword [ebx + 0x24], xmm0
mov dword [ebx], 0x3c
mov dword [ebx + 4], 0x40
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0x59ed94
cmp byte [esp + 0xa3], 0
js 0x539d33
lea ecx, [esp + 0x98]
jmp 0x539d3a
lea ecx, [esp + 0x98]
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.004a9620
jmp 0x539cb7
mov ecx, dword [esp + 0x98]
mov edi, dword [esp + 8]
mov al, byte [ebp + 8]
mov dword [esp + 0x60], ecx
cmp byte [esp + 0x97], 0
jns 0x539d56
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x64], esi
xor esi, esi
mov dword [esp + 0x68], esi
xor al, 1
movzx eax, al
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], esi
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x539ddb
cmp byte [ebp + 0xc], 0
je 0x539dd4
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0xa5
push str....._baseprocesslaunch_win.cc
push str.LaunchElevatedProcess
push esi
call fcn.004bbec0
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.004b1470
push 0xffffffffffffffff
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, ebx
lea ebx, [esp + 0x50]
call fcn.004b14e0
mov esi, dword [esp + 0x88]
mov ecx, edi
push esi
call fcn.0043f350
cmp byte [esp + 0x97], 0
jns 0x539dfc
push dword [esp + 0x8c]
call fcn.004f193e
add esp, 4
cmp byte [esp + 0xa3], 0
jns 0x539e15
push dword [esp + 0x98]
call fcn.004f193e
add esp, 4
mov dword [esp + 0x20], 0xa
mov eax, dword [0x5a6cc4]
mov al, byte [eax + 0xa]
test al, al
jne 0x539e41
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.004f1eb0
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, al
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x20]
push 2
push ebx
push ecx
push eax
call fcn.004a52f0
add esp, 0x10
jmp 0x539e29
movzx eax, al
lea ecx, [esp + 0x50]
mov dword [ecx], str.LaunchElevatedProcess
lea edx, [esp + 0x20]
push 1
push ecx
push edx
push eax
call fcn.004a4950
add esp, 0x10
jmp 0x539c6b
Function at 0x53afc0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x1cd
push str....._base_files_file_util_win.cc
push str.DeleteFileAfterReboot
push ebx
call fcn.004bbec0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004b1470
mov al, byte [edi + 0xb]
test al, al
jns 0x53b028
cmp dword [edi + 4], 0x103
jbe 0x53b028
xor ebx, ebx
jmp 0x53b03e
test al, al
jns 0x53b02e
mov edi, dword [edi]
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
lea ecx, [esp + 0x10]
call fcn.004b14e0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x53b460
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp], edx
mov esi, ecx
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0x88
push str....._base_files_file_util_win.cc
push str.DoCopyFile
push edi
call fcn.004bbec0
add esp, 0x10
mov ecx, ebx
push 0
mov ebx, edi
push edi
mov edi, esi
call fcn.004b1470
mov ecx, esi
call fcn.004be340
test al, al
jne 0x53b4e4
mov esi, dword [esp]
mov ecx, esi
call fcn.004be340
test al, al
jne 0x53b4e4
cmp byte [edi + 0xb], 0
jns 0x53b511
cmp dword [edi + 4], 0x103
jbe 0x53b511
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.004b14e0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
lea ecx, [esp + 4]
call fcn.00462de0
jmp 0x53b4e6
cmp byte [esi + 0xb], 0
jns 0x53b520
cmp dword [esi + 4], 0x103
ja 0x53b4e4
xor eax, eax
dec eax
lea esi, [esp + 4]
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi], eax
push 0x95
push str....._base_files_file_util_win.cc
push str.DoCopyFile
push ebx
call fcn.004bbec0
add esp, 0x10
mov ecx, esi
mov esi, dword [esp]
push 0x5c8718
push ebx
call fcn.00462cd0
cmp byte [esi + 0xb], 0
jns 0x53b55f
mov esi, dword [esi]
movzx eax, byte [ebp + 8]
cmp byte [edi + 0xb], 0
jns 0x53b56b
mov edi, dword [edi]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x53b504
mov edi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
je 0x53b506
mov ecx, eax
and ecx, 1
je 0x53b506
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bl, 1
jmp 0x53b506
Function at 0x53b5b0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x10]
push 0x4d3
push str....._base_files_file_util_win.cc
push str.MoveUnsafe
push ebx
call fcn.004bbec0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004b1470
mov al, byte [edi + 0xb]
test al, al
jns 0x53b636
cmp dword [edi + 4], 0x103
jbe 0x53b636
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.004b14e0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0xc]
mov dl, byte [esi + 0xb]
test dl, dl
jns 0x53b649
cmp dword [esi + 4], 0x103
ja 0x53b616
mov ecx, esi
test dl, dl
jns 0x53b651
mov ecx, dword [esi]
mov edx, edi
test al, al
jns 0x53b659
mov edx, dword [edi]
push 3
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x53b618
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
push edi
call fcn.00443340
add esp, 4
test al, al
jne 0x53b68c
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x53b616
push esi
push edi
call fcn.0053b6a0
add esp, 8
test al, al
jne 0x53b618
jmp 0x53b680

Function at 0x53b860
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.004be340
test al, al
jne 0x53b87e
mov ecx, esi
call fcn.004be340
test al, al
je 0x53b883
xor eax, eax
pop esi
pop ebp
ret
pop esi
pop ebp
jmp fcn.0053b5b0
Function at 0x53e690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x5c87ec], 0
je 0x53e6c8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x5c87f0]
test esi, esi
je 0x53e762
test byte [0x5c34bc], 1
je 0x53e6b1
cmp byte [esi + 0xb], 0
jns 0x53e6e7
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x5a9e00]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x5c87ec], eax
inc eax
cmp eax, 1
ja 0x53e6b1
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.004f5920
add esp, 0xc
mov word [esi - 2], 0
lea esi, [ebp - 0x218]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x53e7fb
xor ebx, ebx
jmp 0x53e6b1
push 0xc
call fcn.004f190e
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.004f5920
add esp, 0xc
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.00416000
movsx eax, byte [esi + 0xb]
mov ecx, esi
test eax, eax
jns 0x53e7b7
mov eax, dword [esi + 4]
mov ecx, dword [esi]
test eax, eax
jne 0x53e7d4
mov ecx, esi
push 9
push str.debug.log
call fcn.004a97c0
mov dword [0x5c87f0], esi
jmp 0x53e6d6
add eax, eax
test eax, eax
je 0x53e7bb
lea edx, [eax - 2]
cmp word [ecx + eax - 2], 0x5c
mov eax, edx
jne 0x53e7d6
cmp edx, 0xfffffffe
je 0x53e7bb
sar edx, 1
inc edx
mov ecx, esi
push 0xffffffffffffffff
push edx
call fcn.004a6820
jmp 0x53e7bb
mov ecx, dword [0x5c87f0]
push esi
call fcn.0043af80
mov ecx, dword [0x5c87f0]
call fcn.00537210
cmp word [eax], 0x5c
je 0x53e82a
mov ecx, dword [0x5c87f0]
push 1
push 0x59b470
call fcn.004a97c0
mov ecx, dword [0x5c87f0]
push 9
push str.debug.log
call fcn.004a97c0
mov eax, dword [0x5c87f0]
cmp byte [eax + 0xb], 0
jns 0x53e849
mov eax, dword [eax]
movaps xmm0, xmmword [0x5a9e00]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x5c87ec], eax
inc eax
cmp eax, 1
ja 0x53e6b1
mov dword [0x5c87ec], 0
jmp 0x53e75b
Function at 0x553fe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
cmp esi, ebx
je 0x55405a
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.00553970
test al, al
jne 0x55401f
add esi, 0x58
cmp esi, ebx
jne 0x55400a
mov esi, ebx
mov eax, dword [ebp - 0x24]
cmp esi, dword [eax + 0x2c]
je 0x55405a
cmp byte [esi + 0x1b], 0
js 0x554032
lea eax, [esi + 0x10]
jmp 0x554035
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x55405d
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x55405d
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5541a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov edi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
cmp edi, ebx
je 0x554231
mov dword [ebp - 0x24], ecx
lea esi, [ebp - 0x20]
mov ecx, edi
push esi
call fcn.00553970
test al, al
jne 0x5541df
add edi, 0x58
cmp edi, ebx
jne 0x5541ca
mov edi, ebx
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x24]
cmp edi, dword [esi + 0x2c]
je 0x554234
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
je 0x554200
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
jmp 0x554234
cmp byte [edi + 0x1b], 0
js 0x55420b
lea eax, [edi + 0x10]
jmp 0x55420e
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x554234
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x554234
mov byte [esi + 0x24], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor ebx, ebx
jmp 0x554234
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x566fc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov edi, dword [ebp + 8]
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x566fe3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x56701e
mov ebx, eax
bt eax, 0xa
jae 0x567016
cmp byte [ebp + 0xc], 0
jne 0x567016
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, 0x10
shr ebx, 4
jmp 0x566fff
push 2
call fcn.004bb790
add esp, 4
test al, al
je 0x566ffd
call fcn.0053eb80
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0x80
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0053ed50
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00499a00
add esp, 0xc
push edi
push eax
call fcn.0053fb40
add esp, 8
mov ecx, esi
call fcn.0053edb0
jmp 0x566ffd

Function at 0x567080
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov edi, dword [ebp + 8]
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x5670a3
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x567118
cmp byte [ebp + 0x10], 0
je 0x5670c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x56712f
push 2
call fcn.004bb790
add esp, 4
test al, al
je 0x567116
call fcn.0053eb80
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0x61
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0053ed50
lea eax, [ebp - 0xb0]
push 0x10
push str.CreateDirectory
push eax
call fcn.00499a00
add esp, 0xc
push edi
push eax
call fcn.0053fb40
add esp, 8
mov ecx, esi
call fcn.0053edb0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
push edi
call fcn.00566fc0
add esp, 8
test al, al
jne 0x567118
push 2
call fcn.004bb790
add esp, 4
test al, al
je 0x567116
lea esi, [ebp - 0xb8]
mov ecx, esi
push 2
push 0x5c
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0044fd30
lea eax, [ebp - 0xb0]
push edi
push eax
call fcn.0053fb40
add esp, 8
push 0x10
push str._not_a_directory
push eax
call fcn.00499a00
add esp, 0xc
mov ecx, esi
call fcn.00450200
jmp 0x567116
Function at 0x567190
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov edi, dword [ebp + 8]
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x5671b3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5671de
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004bb790
add esp, 4
test al, al
je 0x56722f
call fcn.0053eb80
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0x73
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0053ed50
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00499a00
add esp, 0xc
push edi
push eax
call fcn.0053fb40
add esp, 8
mov ecx, esi
call fcn.0053edb0
xor ebx, ebx
jmp 0x5671c7

Function at 0x567240
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov esi, dword [ebp + 8]
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x567263
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x56727f
and eax, 0x410
cmp eax, 0x410
je 0x567303
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x567289
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x5672ec
push 2
call fcn.004bb790
add esp, 4
test al, al
je 0x5672ea
call fcn.0053eb80
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 2
push 0x93
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0053ed50
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.00499a00
add esp, 0xc
push esi
push eax
call fcn.0053fb40
add esp, 8
mov ecx, edi
call fcn.0053edb0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov ecx, esi
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00567320
Function at 0x567320
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov esi, ecx
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x567342
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
je 0x56736b
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.004bb790
add esp, 4
test al, al
je 0x56734f
call fcn.0053eb80
lea ebx, [ebp - 0xb8]
mov ecx, ebx
push eax
push 2
push 0x2f
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.0053ed50
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.00499a00
add esp, 0xc
push esi
push eax
call fcn.0053fb40
add esp, 8
mov ecx, ebx
call fcn.0053edb0
jmp 0x56734f

Function at 0x572260
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00567240
Function at 0x5749e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
lea edi, [ebp - 0x18]
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [eax], 4
push eax
push edi
push esi
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x574a2a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x574ad0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xcc
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0xc], eax
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0x30]
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi], xmm0
mov dword [esi + 0x20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x14], 0x100
jb 0x574b50
push 1
call fcn.004bb790
add esp, 4
test al, al
je 0x574b50
lea esi, [ebp - 0xd4]
mov ecx, esi
push 1
push 0x117
push str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
call fcn.0044fd30
lea eax, [ebp - 0xcc]
push 0x2c
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.00499a00
add esp, 0xc
mov ecx, esi
call fcn.00450200
mov eax, dword [ebp - 0x1c]
cmp eax, 0x100
mov ebx, 0xff
cmovb ebx, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0xcc
pop esi
pop ebx
pop ebp
ret
Function at 0x583ee0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xec
mov esi, ecx
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0x50]
movdqu xmmword [ebx + 0x30], xmm0
movdqu xmmword [ebx + 0x20], xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.00522070
mov ecx, esi
push ebx
push 0
push 0x40
push edx
push eax
call fcn.005887d0
test al, al
je 0x583fd5
movzx eax, word [ebp - 0x50]
cmp eax, 0x5a4d
jne 0x583f9b
mov ebx, dword [ebp + 8]
mov ecx, edi
call fcn.00522070
mov ecx, dword [ebp - 0x14]
mov edi, ecx
sar edi, 0x1f
add eax, ecx
adc edi, edx
mov ecx, esi
push ebx
push 0
push 0x108
push edi
mov dword [ebp - 0xf8], eax
push eax
call fcn.005887d0
test al, al
je 0x58404c
cmp dword [ebx], 0x4550
jne 0x584082
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x584033
mov ecx, dword [ebp - 0xf8]
mov dword [eax], ecx
mov dword [eax + 4], edi
jmp 0x584033
push 1
call fcn.004bb790
add esp, 4
test al, al
je 0x584031
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044fd30
lea eax, [ebp - 0xec]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x584009
push 1
call fcn.004bb790
add esp, 4
test al, al
je 0x584031
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044fd30
lea eax, [ebp - 0xec]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.00499a00
add esp, 0xc
movsx ecx, byte [esi + 0xb]
test ecx, ecx
jns 0x58401f
mov ecx, dword [esi + 4]
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.00499a00
add esp, 0xc
mov ecx, edi
call fcn.00450200
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1eb0
mov eax, ebx
add esp, 0xec
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.004bb790
add esp, 4
test al, al
je 0x584031
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044fd30
lea eax, [ebp - 0xec]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x584009
push 1
call fcn.004bb790
add esp, 4
test al, al
je 0x584031
lea edi, [ebp - 0xf4]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.0044fd30
lea eax, [ebp - 0xec]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x584009