joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8388
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x30], xmm0
mov esi, dword [ecx + 0x1c]
mov ebx, dword [ecx + 0x20]
movups xmmword [ebp - 0x20], xmm0
cmp esi, ebx
je 0x4a83de
mov dword [ebp - 0x34], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.004c6754
test al, al
jne 0x4a83cb
add esi, 0x58
cmp ebx, esi
jne 0x4a83b6
mov esi, ebx
mov eax, dword [ebp - 0x34]
cmp esi, dword [eax + 0x20]
je 0x4a83de
test byte [esi + 0x10], 1
je 0x4a83e3
mov eax, dword [esi + 0x18]
jmp 0x4a83e6
xor edi, edi
inc edi
jmp 0x4a8409
lea eax, [esi + 0x12]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x4a8409
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, edi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4a9782
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x50]
cmp eax, edx
jne 0x4a9797
test byte [ecx + 0x10], 1
je 0x4a97a5
mov ecx, dword [ecx + 0x18]
jmp 0x4a97a8
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [ecx + ecx*2]
inc eax
jmp 0x4a97c2
add ecx, 0x12
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov edx, eax
shr edx, 3
and edx, 2
xor eax, eax
inc eax
cmp ecx, 0xffffffff
cmovne eax, edx
pop ebp
ret
Function at 0x4a9dbc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov ebx, ecx
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x78], eax
xor eax, eax
dec eax
lea esi, [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
add ecx, 0x30
push esi
call fcn.004a9f52
mov edi, dword [esi]
mov eax, dword [esi + 4]
mov dword [esp + 0xc], eax
cmp edi, eax
mov dword [esp + 0x10], ebx
je 0x4a9eab
lea esi, [esp + 0x20]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov ecx, esi
call fcn.004c28a4
mov ecx, dword [ebx + 0x40]
mov eax, dword [ecx]
push esi
push edi
call dword [eax + 0x10]
test eax, eax
je 0x4a9e49
mov ebx, 3
xor esi, esi
jmp 0x4a9e61
mov ecx, ebx
push esi
call fcn.004a9f9e
mov eax, ebx
xor ebx, ebx
cmp byte [eax + 0x28], 0
setne al
mov esi, eax
sete bl
test byte [esp + 0x3c], 1
je 0x4a9e74
push dword [esp + 0x44]
call fcn.005128f8
add esp, 4
lea ecx, [esp + 0x30]
call fcn.00428200
mov eax, esi
test al, al
mov eax, 0
cmovne ebx, eax
cmp ebx, 3
je 0x4a9e96
test ebx, ebx
jne 0x4a9f29
add edi, 0x10
cmp dword [esp + 0xc], edi
mov ebx, dword [esp + 0x10]
lea esi, [esp + 0x20]
jne 0x4a9e09
cmp byte [ebx + 0xb], 0
je 0x4a9f29
xor eax, eax
lea edx, [esp + 0x20]
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x40]
mov eax, dword [ecx]
push edx
call dword [eax + 0x14]
test eax, eax
jne 0x4a9f20
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
cmp ebx, eax
je 0x4a9f20
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
cmp edi, esi
je 0x4a9f05
mov ecx, edi
push ebx
call fcn.004c6754
test al, al
jne 0x4a9f01
add edi, 0x10
cmp esi, edi
jne 0x4a9eec
jmp 0x4a9f05
cmp esi, edi
jne 0x4a9f17
mov esi, dword [esp + 0x10]
mov ecx, esi
push ebx
call fcn.004a9f9e
cmp byte [esi + 0x28], 0
je 0x4a9f20
add ebx, 0x50
cmp ebx, dword [esp + 0xc]
jne 0x4a9ee0
lea ecx, [esp + 0x20]
call fcn.004aa9d0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4a9f3e
mov dword [esp + 0x18], eax
push eax
call fcn.005128f8
add esp, 4
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00512931
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4af544
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0x38], 0
je 0x4af65e
mov ebx, ecx
xor eax, eax
dec eax
lea esi, [ebp - 0x58]
mov dword [esi], eax
lea edi, [ebp - 0x5c]
mov dword [edi], eax
lea edx, [ecx + 0x30]
mov ecx, edi
push esi
push 2
call fcn.004af67e
add esp, 8
mov ecx, dword [edi]
test ecx, ecx
je 0x4af665
mov dword [ebp - 0x68], ebx
cmp dword [ecx], 0
je 0x4af651
mov eax, dword [ebp - 0x68]
add eax, 0x18
mov dword [ebp - 0x6c], eax
xor eax, eax
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x64], eax
test dword [ecx + eax*8 + 8], 0xc0000020
je 0x4af5c1
mov eax, dword [ebp - 0x64]
inc eax
mov ecx, dword [ebp - 0x60]
cmp eax, dword [ecx]
jb 0x4af5a4
jmp 0x4af651
cmp dword [ebp + 8], 0
je 0x4af60d
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [eax + 4], ecx
je 0x4af60d
xor ebx, ebx
xor edi, edi
mov eax, dword [ebp - 0x60]
mov edx, dword [ebp - 0x64]
mov esi, dword [eax + edx*8 + 4]
add ecx, ebx
call fcn.00438a10
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4af5b1
inc edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 2
imul eax, eax, 0xf0f0f0f1
add ebx, 0x44
cmp edi, eax
jb 0x4af5d5
lea ebx, [ebp - 0x54]
mov ecx, ebx
mov eax, dword [ebp - 0x60]
mov edx, dword [ebp - 0x64]
push dword [eax + edx*8 + 4]
call fcn.004afe94
mov esi, dword [ebp - 0x68]
mov edi, dword [esi + 0x1c]
cmp edi, dword [esi + 0x20]
jae 0x4af643
push 0x44
push ebx
push edi
call fcn.005162a0
add esp, 0xc
add edi, 0x44
mov dword [esi + 0x1c], edi
jmp 0x4af5b1
mov ecx, dword [ebp - 0x6c]
push ebx
call fcn.004859a0
jmp 0x4af5b1
push ecx
call fcn.0051292c
add esp, 4
xor esi, esi
jmp 0x4af668
mov esi, 0x3f0
jmp 0x4af668
mov esi, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, esi
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4b0537
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x30], eax
mov ebx, 0x1126
push edi
call fcn.004b026c
add esp, 4
test al, al
jne 0x4b0752
xor eax, eax
lea edx, [esp + 0x18]
mov dword [edx + 4], eax
mov dword [edx], eax
mov dword [edx + 8], eax
mov ecx, edi
mov edi, edx
call fcn.004b0767
mov bh, al
mov ecx, edi
call fcn.004b0819
mov bl, al
mov ecx, edi
mov edx, edi
call fcn.004b0866
mov ecx, ebx
test bh, bh
jne 0x4b05a9
test cl, cl
jne 0x4b05a9
mov ebx, 0x7b
test al, al
je 0x4b073f
mov byte [esp + 7], cl
test cl, cl
jne 0x4b065e
lea edi, [esp + 0xc]
mov ecx, edi
push 0x552bb0
call fcn.0040252c
movzx eax, byte [esp + 0x18]
test al, 1
je 0x4b05d8
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
jmp 0x4b05de
shr eax, 1
lea edx, [esp + 0x1a]
mov ecx, edi
push eax
push edx
call fcn.004219e2
mov bl, byte [eax]
mov ecx, dword [eax + 4]
mov dword [esp + 0x2b], ecx
mov ecx, dword [eax + 1]
mov dword [esp + 0x28], ecx
mov esi, dword [eax + 8]
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax], ecx
mov dword [eax + 8], ecx
test byte [esp + 0x18], 1
je 0x4b062f
mov eax, dword [esp + 0x20]
mov word [eax], 0
mov dword [esp + 0x1c], 0
test byte [esp + 0x18], 1
je 0x4b062f
push dword [esp + 0x20]
call fcn.005128f8
add esp, 4
mov byte [esp + 0x18], bl
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2b]
mov dword [esp + 0x19], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], esi
test byte [esp + 0xc], 1
lea edi, [esp + 0x18]
je 0x4b065e
push dword [esp + 0x14]
call fcn.005128f8
add esp, 4
mov eax, edi
add eax, 2
mov dword [esp + 8], eax
mov bl, 1
xor eax, eax
dec eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x24]
push edx
push eax
push 0
push edi
call fcn.004215e6
test byte [esp + 0x18], 1
jne 0x4b0690
mov eax, dword [esp + 8]
mov word [eax], 0
jmp 0x4b06b4
mov eax, dword [esp + 0x20]
mov word [eax], 0
mov dword [esp + 0x1c], 0
test byte [esp + 0x18], 1
je 0x4b06b4
push dword [esp + 0x20]
call fcn.005128f8
add esp, 4
movsd xmm0, qword [esp + 0xc]
movsd qword [esp + 0x18], xmm0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
test byte [esp + 0x18], 1
cmove eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b06e6
bt eax, 0xa
jae 0x4b06fb
jmp 0x4b0718
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
add eax, 0xfffffffe
cmp eax, 2
jb 0x4b06fb
cmp esi, 0x7b
jne 0x4b071c
mov ecx, edi
push 0xffffffffffffffff
push 0x5c
call fcn.00422198
xor ebx, ebx
cmp eax, 2
ja 0x4b066c
mov ebx, 0x1126
jmp 0x4b073f
xor ebx, ebx
jmp 0x4b073f
mov al, byte [esp + 7]
or al, bl
test al, 1
jne 0x4b073d
lea ecx, [esp + 0x18]
push 0xffffffffffffffff
push 0x5c
call fcn.00422198
mov ebx, 0x1126
cmp eax, 3
je 0x4b073f
mov ebx, esi
test byte [esp + 0x18], 1
je 0x4b0752
push dword [esp + 0x20]
call fcn.005128f8
add esp, 4
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b4dd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
mov eax, dword [ecx]
jne 0x4b4dfc
test eax, eax
jne 0x4b4dfc
xor eax, eax
cmp dword [esi + 0xc], 0
jne 0x4b4dfc
xor eax, eax
cmp dword [esi + 4], 0
mov edx, 0
je 0x4b4e53
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x4b4e1b
call fcn.0042a9a0
push dword [esi]
call fcn.00441df0
add esp, 4
mov dword [esi], 0
xor eax, eax
mov ecx, dword [esi + 4]
lea edx, [ecx + 1]
cmp edx, 2
jb 0x4b4e41
call fcn.0042a9a0
push dword [esi + 4]
call fcn.00441df0
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
xor ecx, ecx
mov edx, eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, ecx
mov ebx, dword [edi]
cmp edx, ebx
je 0x4b4e9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x4b4e80
call fcn.0042a9a0
push dword [esi]
call fcn.00441df0
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4b4e8f
mov dword [esi], ebx
call fcn.0042a9a0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp eax, ebx
je 0x4b4ee7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
add eax, 1
cmp eax, 2
jb 0x4b4ecd
call fcn.0042a9a0
push dword [esi + 4]
call fcn.00441df0
add esp, 4
mov dword [esi + 4], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4b4edd
mov dword [esi + 4], ebx
call fcn.0042a9a0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4b5010
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x4b50a2
mov edi, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
mov ebx, eax
call esi
lea ecx, [ebp - 0x14]
push 2
push 0
push 0
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x4b50a6
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
cmp dword [esi], ebx
je 0x4b50b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jb 0x4b508d
mov dword [ebp - 0x18], eax
call fcn.0042a9a0
push dword [esi]
call fcn.00441df0
mov eax, dword [ebp - 0x18]
add esp, 4
mov dword [esi], 0
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x4b50ac
mov dword [esi], ebx
mov esi, eax
call fcn.0042a9a0
mov eax, esi
jmp 0x4b50ac
mov bl, 1
jmp 0x4b50b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b51ba
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
call fcn.004b4fa0
test al, al
je 0x4b51de
push 0x32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea edi, [esi + 0x20]
mov ecx, edi
push 0
call fcn.004b5240
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4b51fd
mov dword [esi + 0x34], eax
push eax
call fcn.005128f8
add esp, 4
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x2c], 0
test eax, eax
je 0x4b5214
push eax
call fcn.00529c90
add esp, 4
mov ecx, edi
push 0
call fcn.004b5240
lea ecx, [esi + 0x18]
call fcn.004073c4
lea ecx, [esi + 0x14]
call fcn.004073c4
lea ecx, [esi + 0x10]
call fcn.004073c4
mov ecx, esi
pop esi
pop edi
pop ebp
jmp fcn.004b4f00
Function at 0x4b86f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x59a6c0]
mov ecx, dword [0x599af4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4b871b
mov ecx, 0x59a6b8
pop ebp
jmp fcn.0043a480
push 0x59a6c0
call fcn.00512977
add esp, 4
cmp dword [0x59a6c0], 0xffffffff
jne 0x4b8710
mov dword [0x59a6bc], 0
mov dword [0x59a6b8], 0
mov ecx, 0x59a6b8
push 0
call fcn.0043a4f0
push 0x59a6c0
call fcn.005129ed
add esp, 4
jmp 0x4b8710

Function at 0x4baa40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ecx + 4]
jmp 0x4baa56
mov esi, dword [esi + 0x8c]
test esi, esi
je 0x4baa8b
xor edi, edi
xchg dword [esi], edi
test edi, edi
je 0x4baa50
nop word cs:[eax + eax]
nop dword [eax]
bsf ecx, edi
mov ebx, 1
shl ebx, cl
mov eax, dword [esi + ecx*4 + 8]
push eax
call dword [eax + 4]
add esp, 4
xor edi, ebx
jne 0x4baa70
jmp 0x4baa50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4bd370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [esp + 0x78], eax
test byte [0x596b24], 9
je 0x4bd3f1
mov esi, ecx
mov eax, dword [ecx + 8]
mov edi, dword [eax + 4]
call fcn.004231d0
cmp edi, eax
jne 0x4bd3f1
lea edi, [esi + 0x10]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
sub esp, 4
test al, al
je 0x4bd404
mov eax, dword [esi + 0x28]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x6c]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x44], ecx
mov eax, dword [eax + 8]
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x74]
mov dword [esp + 0x38], eax
mov ebx, dword [esi + 0x70]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
sub esp, 4
test byte [0x596b24], 0x19
jne 0x4bd40d
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00512931
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edi
call fcn.00440f10
jmp 0x4bd3b7
mov eax, dword [esp + 0x38]
sub eax, ebx
mov ebx, dword [esp + 0x44]
add ebx, dword [esp + 0x40]
add ebx, dword [esp + 0x3c]
sar eax, 3
imul eax, eax, 0xba2e8ba3
add ebx, eax
mov edi, dword [esi]
call fcn.004231d0
mov esi, eax
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.00443a60
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x301
mov dword [esp + 0x54], 0x53f8d1
mov eax, ebx
sar eax, 0x1f
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], ebx
lea eax, [esp + 0x50]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], esi
pxor xmm0, xmm0
movdqu xmmword [esp + 0xc], xmm0
mov dword [esp + 8], edi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 4], 0x596b24
mov dword [esp], 0x43
call fcn.00449930
mov al, byte [esp + 0x50]
test al, al
je 0x4bd3f1
xor esi, esi
jmp 0x4bd4df
add esi, 1
movzx ecx, al
cmp esi, ecx
jae 0x4bd3f1
cmp byte [esp + esi + 0x51], 8
jne 0x4bd4d1
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x4bd4d1
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
movzx eax, byte [esp + 0x50]
jmp 0x4bd4d1
Function at 0x4c3091
Capabilities:
Check os version
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov esi, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov ecx, dword [0x596ff8]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor ecx, ecx
dec ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
xor edi, edi
mov ebx, 3
test al, al
je 0x4c30f6
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
mov ebx, 0x80003
cmp eax, 6
jb 0x4c30f6
lea edi, [ebp - 0x1c]
mov dword [edi], 0xc
mov dword [esp], 0
call fcn.004c3141
mov dword [edi + 4], eax
mov dword [edi + 8], 1
test byte [esi], 1
je 0x4c3100
mov esi, dword [esi + 8]
jmp 0x4c3103
add esi, 2
mov dword [esp + 0x1c], edi
movaps xmm0, xmmword [0x555460]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
sub esp, 0x20
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4c3434
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov esi, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x4c34f5
and eax, 0xfeff
cmp eax, 6
je 0x4c34f5
mov eax, dword [0x59a728]
mov ecx, dword [0x599af4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4c3515
push 0x10000000
push 0
push esi
call dword [0x59a724]
mov esi, eax
test eax, eax
jne 0x4c34ee
push 2
call fcn.0042ae10
add esp, 4
test al, al
je 0x4c34ee
call fcn.0042b8e0
lea edi, [ebp - 0xbc]
mov ecx, edi
push eax
push 2
push 0x21
push str..._.._third_party_crashpad_crashpad_util_win_critical_section_with_debug_info.cc
call fcn.0042ba80
lea eax, [ebp - 0xb4]
push 0x1b
push str.InitializeCriticalSectionEx
push eax
call fcn.00401c91
add esp, 0xc
mov ecx, edi
call fcn.0042bb30
test esi, esi
setne bl
jmp 0x4c34fe
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x59a728
call fcn.00512977
add esp, 4
cmp dword [0x59a728], 0xffffffff
jne 0x4c3493
push 1
push str.::InitializeCriticalSectionEx
push 0x5444b2
call fcn.004c36c0
add esp, 0xc
mov dword [0x59a724], eax
push 0x59a728
call fcn.005129ed
add esp, 4
jmp 0x4c3493

Function at 0x4c355c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret
Function at 0x4c6bdf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov esi, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [esi + 2]
test byte [esi], 1
mov eax, edi
je 0x4c6c05
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4c6c2e
mov ebx, eax
bt eax, 0xa
jae 0x4c6c23
cmp byte [ebp + 0xc], 0
je 0x4c6ce1
and ebx, 0x10
shr ebx, 4
jmp 0x4c6ce3
push 2
call fcn.0042ae10
add esp, 4
test al, al
je 0x4c6ce1
call fcn.0042b8e0
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x81
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.0042ba80
lea eax, [ebp - 0xb4]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00401c91
add esp, 0xc
mov ebx, eax
movzx eax, byte [esi]
test al, 1
je 0x4c6c84
mov edi, dword [esi + 8]
mov eax, dword [esi + 4]
jmp 0x4c6c86
shr eax, 1
lea esi, [ebp - 0xc8]
push eax
push edi
push esi
call fcn.00438930
add esp, 0xc
movzx eax, byte [esi]
test al, 1
je 0x4c6cac
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc0]
jmp 0x4c6cb4
shr eax, 1
lea ecx, [ebp - 0xc7]
push eax
push ecx
push ebx
call fcn.00401c91
add esp, 0xc
test byte [ebp - 0xc8], 1
je 0x4c6cd6
push dword [ebp - 0xc0]
call fcn.005128f8
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.0042bb30
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c6cfa
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov esi, dword [ebp + 8]
mov eax, dword [0x596ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [esi + 2]
test byte [esi], 1
mov eax, edi
je 0x4c6d20
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x4c6e35
cmp byte [ebp + 0x10], 0
je 0x4c6d95
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4c6d95
push 1
push esi
call fcn.004c6bdf
add esp, 8
test al, al
jne 0x4c6e35
push 2
call fcn.0042ae10
add esp, 4
test al, al
je 0x4c6e33
lea ecx, [ebp - 0xc8]
push 2
push 0x5c
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.0042aea0
movzx eax, byte [esi]
test al, 1
je 0x4c6e4c
mov edi, dword [esi + 8]
mov eax, dword [esi + 4]
jmp 0x4c6e4e
push 2
call fcn.0042ae10
add esp, 4
test al, al
je 0x4c6e33
call fcn.0042b8e0
lea ecx, [ebp - 0xc8]
push eax
push 2
push 0x61
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.0042ba80
lea eax, [ebp - 0xc0]
push 0x10
push str.CreateDirectory
push eax
call fcn.00401c91
add esp, 0xc
mov ebx, eax
movzx eax, byte [esi]
test al, 1
je 0x4c6de8
mov edi, dword [esi + 8]
mov eax, dword [esi + 4]
jmp 0x4c6dea
shr eax, 1
lea esi, [ebp - 0x1c]
push eax
push edi
push esi
call fcn.00438930
add esp, 0xc
movzx eax, byte [esi]
test al, 1
je 0x4c6e07
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
jmp 0x4c6e0c
shr eax, 1
lea ecx, [ebp - 0x1b]
push eax
push ecx
push ebx
call fcn.00401c91
add esp, 0xc
test byte [ebp - 0x1c], 1
je 0x4c6e28
push dword [ebp - 0x14]
call fcn.005128f8
add esp, 4
lea ecx, [ebp - 0xc8]
call fcn.0042bb30
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512931
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
shr eax, 1
lea esi, [ebp - 0xc0]
lea ebx, [ebp - 0x1c]
push eax
push edi
push ebx
call fcn.00438930
add esp, 0xc
movzx eax, byte [ebx]
test al, 1
je 0x4c6e71
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
jmp 0x4c6e76
shr eax, 1
lea ecx, [ebp - 0x1b]
push eax
push ecx
push esi
call fcn.00401c91
add esp, 0xc
push 0x10
push str._not_a_directory
push eax
call fcn.00401c91
add esp, 0xc
test byte [ebp - 0x1c], 1
je 0x4c6ea2
push dword [ebp - 0x14]
call fcn.005128f8
add esp, 4
lea ecx, [ebp - 0xc8]
call fcn.0042b2a0
jmp 0x4c6e33