joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6da380
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov edi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x6da3a3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6da3ce
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x6da41f
call fcn.00646ae0
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0x73
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00646c90
lea eax, [ebp - 0xac]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00535510
add esp, 0xc
push edi
push eax
call fcn.00647a40
add esp, 8
mov ecx, esi
call fcn.00646cf0
xor ebx, ebx
jmp 0x6da3b7

Function at 0x6da430
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov esi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x6da453
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
sete cl
not eax
test eax, 0x410
setne al
or al, cl
je 0x6da4f6
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x6da47c
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x6da4df
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x6da4dd
call fcn.00646ae0
lea edi, [ebp - 0xb4]
mov ecx, edi
push eax
push 2
push 0x93
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00646c90
lea eax, [ebp - 0xac]
push 0xb
push str.DeleteFile
push eax
call fcn.00535510
add esp, 0xc
push esi
push eax
call fcn.00647a40
add esp, 8
mov ecx, edi
call fcn.00646cf0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov ecx, esi
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.006da520
Function at 0x6da520
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov esi, ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x6da542
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
je 0x6da56b
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x6da54f
call fcn.00646ae0
lea ebx, [ebp - 0xb4]
mov ecx, ebx
push eax
push 2
push 0x2f
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00646c90
lea eax, [ebp - 0xac]
push 0x10
push str.RemoveDirectory
push eax
call fcn.00535510
add esp, 0xc
push esi
push eax
call fcn.00647a40
add esp, 8
mov ecx, ebx
call fcn.00646cf0
jmp 0x6da54f
Function at 0x6e7e40
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [edi], eax
push eax
push edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov esi, 0x80004005
cmovne esi, ecx
cmp esi, 0x8007007a
je 0x6e7ea5
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
dec eax
lea esi, [ebp - 0x20]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x14]
shr eax, 1
mov ecx, esi
push eax
call fcn.00606260
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x6e7f0b
push 0
push edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x6e7f1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov esi, 0x80004005
cmovne esi, ecx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6e7e91
mov ecx, dword [ebp - 0x1c]
cmp ecx, eax
je 0x6e7f0d
add ecx, 0xfffffffe
jne 0x6e7f02
ud2
mov dword [ebp - 0x1c], eax
push eax
call fcn.005c8b90
add esp, 4
jmp 0x6e7e91
mov eax, dword [ebp - 0x14]
test al, 1
jne 0x6e7f4e
mov esi, dword [ebp + 0x14]
shr eax, 1
lea edi, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.0049cbf0
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov edi, edx
sub edi, eax
sar edi, 1
mov ecx, esi
push edi
push edx
push eax
call fcn.006062c0
xor esi, esi
jmp 0x6e7ef8
int3

Function at 0x6e7f60
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov esi, dword [0x80e040]
xor esi, ebp
mov dword [ebp - 0xc], esi
mov esi, 0x20000000
or esi, dword [ebp + 0xc]
lea edi, [ebp - 0x10]
mov dword [edi], 4
push 0
push edi
push edx
push ecx
push esi
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
xor esi, esi
test eax, eax
jne 0x6e7fbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov esi, 0x80004005
cmovne esi, ecx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret
Function at 0x703650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5c
mov edi, dword [ebp + 0x24]
mov ebx, dword [ebp + 0x20]
mov esi, dword [ebp + 0xc]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
jne 0x703677
call fcn.00651ea0
mov ebx, eax
test edi, edi
cmove edi, ebx
push ebx
call fcn.004c0d10
add esp, 4
lea ecx, [eax*2 + 2]
cmp ecx, esi
ja 0x7036b0
mov dword [ebp - 0x68], edi
lea edx, [eax + eax]
mov edi, esi
mov esi, edx
not esi
lea ecx, [edi + esi]
dec ecx
cmp ecx, dword [ebp + 0x14]
jae 0x7036db
push 0x6a
push str....._third_party_boringssl_srccrypto_rsa_extra_rsa_crypt.c
push 0x72
jmp 0x7036b9
push 0x64
push str....._third_party_boringssl_srccrypto_rsa_extra_rsa_crypt.c
push 0x7e
push 0
push 4
call fcn.006be890
add esp, 0x14
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, edi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [edi - 1]
mov dword [ebp - 0x60], ecx
cmp ecx, edx
ja 0x7036f8
push 0x6f
jmp 0x7036b2
xor ebx, ebx
xor edi, edi
push ebx
call fcn.00565f50
add esp, 4
jmp 0x7036c7
mov edx, dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
mov byte [edi], 0
mov dword [ebp - 0x5c], eax
add eax, edi
inc eax
xor ecx, ecx
push ecx
push ebx
push ecx
mov dword [ebp - 0x58], eax
push eax
push edx
push dword [ebp + 0x18]
call fcn.004c0d20
add esp, 0x18
test eax, eax
je 0x7036e9
mov ebx, dword [ebp - 0x60]
mov ecx, dword [ebp + 0x14]
sub ebx, ecx
add esi, ebx
mov edx, dword [ebp - 0x5c]
je 0x703747
mov eax, dword [ebp - 0x58]
add eax, edx
push esi
push 0
push eax
mov esi, edx
call fcn.005cced0
mov edx, esi
mov ecx, dword [ebp + 0x14]
add esp, 0xc
mov eax, edx
not eax
add ebx, dword [ebp - 0x58]
mov byte [eax + ebx], 1
lea eax, [edi + 1]
mov dword [ebp - 0x54], eax
test ecx, ecx
mov esi, edx
je 0x703779
mov eax, edi
add eax, esi
add eax, dword [ebp + 0xc]
sub eax, ecx
sub eax, esi
push ecx
push dword [ebp + 0x10]
push eax
call fcn.005cc950
mov esi, dword [ebp - 0x5c]
add esp, 0xc
push esi
push dword [ebp - 0x54]
call fcn.00566f90
add esp, 8
test eax, eax
je 0x7036e9
mov edi, dword [ebp - 0x60]
sub edi, esi
push edi
call fcn.00565eb0
add esp, 4
test eax, eax
je 0x7036e9
mov ebx, eax
push dword [ebp - 0x68]
push esi
push dword [ebp - 0x54]
mov dword [ebp - 0x64], edi
push edi
push eax
call fcn.004c2a20
add esp, 0x14
test eax, eax
je 0x7036eb
cmp dword [ebp - 0x60], esi
mov esi, dword [ebp - 0x58]
je 0x7037df
mov eax, dword [ebp - 0x64]
cmp eax, 1
adc eax, 0
xor ecx, ecx
mov dl, byte [ebx + ecx]
xor byte [esi + ecx], dl
inc ecx
cmp eax, ecx
jne 0x7037d4
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x50]
movdqu xmmword [eax + 0x30], xmm0
movdqu xmmword [eax + 0x20], xmm0
movdqu xmmword [eax + 0x10], xmm0
movdqu xmmword [eax], xmm0
push dword [ebp - 0x68]
push dword [ebp - 0x64]
push esi
mov esi, dword [ebp - 0x5c]
push esi
push eax
call fcn.004c2a20
add esp, 0x14
test eax, eax
je 0x7036eb
xor edi, edi
inc edi
test esi, esi
je 0x7036ed
mov edx, esi
xor eax, eax
mov esi, dword [ebp - 0x54]
mov cl, byte [ebp + eax - 0x50]
xor byte [esi + eax], cl
inc eax
cmp edx, eax
jne 0x703827
jmp 0x7036ed
Function at 0x706570
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.006da430

Function at 0x7090a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [0x8252a4]
mov ecx, dword [0x813560]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x7090f5
cmp edi, esi
je 0x7090f1
xor eax, eax
dec eax
mov cl, byte [edi]
xor cl, al
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x824ea4]
inc edi
cmp edi, esi
jne 0x7090d1
not eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x7090e9
push 0x8252a4
call fcn.005c8bdd
add esp, 4
cmp dword [0x8252a4], 0xffffffff
jne 0x7090ca
push 0x400
push 0xff
push 0x824ea4
call fcn.005cced0
add esp, 0xc
xor eax, eax
mov ecx, eax
shr eax, 1
mov edx, ecx
mov dword [ebp - 0x10], ecx
and edx, 1
neg edx
mov ebx, 0xedb88320
and edx, ebx
xor edx, eax
mov eax, edx
shr eax, 1
mov ebx, ecx
shl ebx, 0x1e
sar ebx, 0x1f
mov ecx, 0xedb88320
and ebx, ecx
xor ebx, eax
mov ecx, dword [ebp - 0x10]
shl ecx, 0x1d
sar ecx, 0x1f
and ecx, 0x76dc419
mov eax, dword [ebp - 0x10]
shl eax, 0x1c
sar eax, 0x1f
and eax, 0xedb8832
xor eax, ecx
mov ecx, dword [ebp - 0x10]
shl ecx, 0x1b
sar ecx, 0x1f
and ecx, 0x1db71064
xor ecx, eax
mov eax, dword [ebp - 0x10]
shl eax, 0x1a
sar eax, 0x1f
and eax, 0x3b6e20c8
xor eax, ecx
mov ecx, ebx
shr ecx, 6
xor eax, ecx
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
xor edx, eax
shl ebx, 0x1a
sar ebx, 0x1f
mov eax, 0xedb88320
and ebx, eax
xor ebx, edx
mov ecx, dword [ebp - 0x10]
mov dword [ecx*4 + 0x824ea4], ebx
inc ecx
mov eax, ecx
cmp ecx, 0x100
jne 0x709124
push 0x8252a4
call fcn.005c8c57
add esp, 4
jmp 0x7090ca
Function at 0x7149b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov dword [ecx], fcn.00713090
mov eax, dword [ecx + 0x84]
test eax, eax
je 0x7149e9
mov ecx, dword [esi + 0x88]
cmp ecx, eax
je 0x7149da
add ecx, 0xfffffffe
jne 0x7149cc
jmp 0x714a7c
mov dword [esi + 0x88], eax
push eax
call fcn.005c8b90
add esp, 4
mov eax, dword [esi + 0x78]
test eax, eax
je 0x714a0a
mov ecx, dword [esi + 0x7c]
cmp ecx, eax
je 0x7149fe
add ecx, 0xfffffffe
jne 0x7149f3
jmp 0x714a7c
mov dword [esi + 0x7c], eax
push eax
call fcn.005c8b90
add esp, 4
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x714a29
mov ecx, dword [esi + 0x70]
mov edx, ecx
sub edx, eax
dec ecx
cmp edx, ecx
ja 0x714a7c
mov dword [esi + 0x70], eax
push eax
call fcn.005c8b90
add esp, 4
mov eax, dword [esi + 0x60]
test eax, eax
je 0x714a48
mov ecx, dword [esi + 0x64]
mov edx, ecx
sub edx, eax
dec ecx
cmp edx, ecx
ja 0x714a7c
mov dword [esi + 0x64], eax
push eax
call fcn.005c8b90
add esp, 4
mov eax, dword [esi + 0x50]
test eax, eax
je 0x714a69
mov ecx, dword [esi + 0x54]
cmp ecx, eax
je 0x714a5d
add ecx, 0xfffffffe
jne 0x714a52
jmp 0x714a7c
mov dword [esi + 0x54], eax
push eax
call fcn.005c8b90
add esp, 4
mov eax, dword [esi + 0x44]
test eax, eax
je 0x714a8a
mov ecx, dword [esi + 0x48]
cmp ecx, eax
je 0x714a7e
add ecx, 0xfffffffe
jne 0x714a73
ud2
mov dword [esi + 0x48], eax
push eax
call fcn.005c8b90
add esp, 4
mov eax, dword [esi + 0x38]
test eax, eax
je 0x714aa9
mov ecx, dword [esi + 0x3c]
mov edx, ecx
sub edx, eax
dec ecx
cmp edx, ecx
ja 0x714a7c
mov dword [esi + 0x3c], eax
push eax
call fcn.005c8b90
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x714aca
mov ecx, dword [esi + 0x2c]
cmp ecx, eax
je 0x714abe
add ecx, 0xfffffffe
jne 0x714ab3
jmp 0x714a7c
mov dword [esi + 0x2c], eax
push eax
call fcn.005c8b90
add esp, 4
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x714aeb
mov ecx, dword [esi + 0x20]
cmp ecx, eax
je 0x714adf
add ecx, 0xfffffffe
jne 0x714ad4
jmp 0x714a7c
mov dword [esi + 0x20], eax
push eax
call fcn.005c8b90
add esp, 4
mov eax, dword [esi + 0x10]
test eax, eax
je 0x714b0e
mov ecx, dword [esi + 0x14]
mov edx, ecx
sub edx, eax
dec ecx
cmp edx, ecx
ja 0x714a7c
mov dword [esi + 0x14], eax
push eax
call fcn.005c8b90
add esp, 4
mov eax, dword [esi + 4]
test eax, eax
je 0x714b32
mov ecx, dword [esi + 8]
cmp ecx, eax
je 0x714b26
add ecx, 0xfffffffc
jne 0x714b18
jmp 0x714a7c
mov dword [esi + 8], eax
push eax
call fcn.005c8b90
add esp, 4
pop esi
pop ebp
ret
Function at 0x7249b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe4
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0x50]
movdqu xmmword [esi + 0x30], xmm0
movdqu xmmword [esi + 0x20], xmm0
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi], xmm0
push esi
push 0x20
push dword [ebp + 0x10]
call fcn.006520b0
add esp, 0xc
and byte [esi], 0xf8
mov al, byte [esi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
lea edi, [ebp - 0xf0]
push 0xa0
push 0xff
push edi
call fcn.005cced0
add esp, 0xc
push 0x7a8e28
push esi
push edi
call fcn.005adce0
add esp, 0xc
mov esi, dword [ebp + 8]
mov ecx, esi
mov edx, edi
call fcn.00728170
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [ebx + 0x10], xmm1
movups xmmword [ebx], xmm0
movups xmm0, xmmword [esi]
movups xmm1, xmmword [esi + 0x10]
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x30], xmm1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
add esp, 0xe4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x73a010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 4]
pop ebp
jmp fcn.00755e10
Function at 0x73d600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x14]
mov dword [esi], eax
lea edi, [ebp - 0x18]
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [eax], 4
push eax
push edi
push esi
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x73d64a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x73d6f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xc8
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0xc], eax
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0x30]
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi], xmm0
mov dword [esi + 0x20], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esi + 0x14], 0x100
jb 0x73d770
push 1
call fcn.00560ca0
add esp, 4
test al, al
je 0x73d770
lea esi, [ebp - 0xd0]
mov ecx, esi
push 1
push 0x10a
push str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
call fcn.004ba0e0
lea eax, [ebp - 0xc8]
push 0x2c
push str.dwNumberOfProcessors_exceeds_uint8_t_storage
push eax
call fcn.00535510
add esp, 0xc
mov ecx, esi
call fcn.004ba5c0
mov eax, dword [ebp - 0x1c]
cmp eax, 0x100
mov ebx, 0xff
cmovb ebx, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xc8
pop esi
pop ebx
pop ebp
ret
Function at 0x752520
Capabilities:
Decompress data using quicklz

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ecx]
mov eax, esi
and eax, 0xf800d000
xor eax, 0xf0008000
mov edi, esi
not edi
test edi, 0x3c00000
setne bl
mov edi, edx
and edi, 1
or edi, eax
sete ah
lea edi, [edx + 0x100000]
cmp edi, 0x200000
setb al
and al, bl
and al, ah
cmp al, 1
jne 0x7525ae
mov edi, edx
shl edi, 6
and edi, 0x4000000
mov ebx, edx
shl ebx, 4
and ebx, 0x3f0000
or ebx, edi
mov edi, edx
shr edi, 5
and edi, 0x2000
or edi, ebx
mov ebx, edx
shr edx, 8
and edx, 0x800
or edx, edi
shr ebx, 1
and ebx, 0x7ff
or edx, ebx
and esi, 0xf3c08000
or edx, esi
mov dword [ecx], edx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x7525c0
Capabilities:
Decompress data using quicklz

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
test al, 1
jne 0x7525f1
mov ecx, dword [ebp + 0xc]
mov edx, ecx
and edx, 0xf800d000
cmp edx, 0xf0008000
setne dl
mov esi, ecx
not esi
test esi, 0x3c00000
sete dh
or dh, dl
je 0x7525f7
xor eax, eax
pop esi
pop edi
pop ebp
ret
mov edx, ecx
shr edx, 4
and edx, 0x3f000
mov esi, ecx
and esi, 0x7ff
lea edx, [edx + esi*2]
mov esi, ecx
shr esi, 6
and esi, 0x100000
mov edi, ecx
shl edi, 8
and edi, 0x80000
or edi, esi
shl ecx, 5
and ecx, 0x40000
or ecx, edi
or ecx, edx
shl ecx, 0xb
sar ecx, 0xb
add eax, ecx
add eax, 4
mov ecx, dword [ebp + 0x10]
and eax, 0xfffffffe
mov dword [ecx], eax
mov al, 1
jmp 0x7525f3
Function at 0x75dc10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe8
mov esi, ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0x50]
movdqu xmmword [ebx + 0x30], xmm0
movdqu xmmword [ebx + 0x20], xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.005fdca0
mov ecx, esi
push ebx
push 0
push 0x40
push edx
push eax
call fcn.0076a610
test al, al
je 0x75dd02
cmp word [ebp - 0x50], 0x5a4d
jne 0x75dcc8
mov ebx, dword [ebp + 8]
mov ecx, edi
call fcn.005fdca0
mov ecx, dword [ebp - 0x14]
mov edi, ecx
sar edi, 0x1f
add eax, ecx
adc edi, edx
mov ecx, esi
push ebx
push 0
push 0x108
push edi
mov dword [ebp - 0xf4], eax
push eax
call fcn.0076a610
test al, al
je 0x75dd79
cmp dword [ebx], 0x4550
jne 0x75ddaf
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x75dd60
mov ecx, dword [ebp - 0xf4]
mov dword [eax], ecx
mov dword [eax + 4], edi
jmp 0x75dd60
push 1
call fcn.00560ca0
add esp, 4
test al, al
je 0x75dd5e
lea edi, [ebp - 0xf0]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004ba0e0
lea eax, [ebp - 0xe8]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x75dd36
push 1
call fcn.00560ca0
add esp, 4
test al, al
je 0x75dd5e
lea edi, [ebp - 0xf0]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004ba0e0
lea eax, [ebp - 0xe8]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.00535510
add esp, 0xc
movsx ecx, byte [esi + 0xb]
test ecx, ecx
jns 0x75dd4c
mov ecx, dword [esi + 4]
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.00535510
add esp, 0xc
mov ecx, edi
call fcn.004ba5c0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xe8
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.00560ca0
add esp, 4
test al, al
je 0x75dd5e
lea edi, [ebp - 0xf0]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004ba0e0
lea eax, [ebp - 0xe8]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x75dd36
push 1
call fcn.00560ca0
add esp, 4
test al, al
je 0x75dd5e
lea edi, [ebp - 0xf0]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004ba0e0
lea eax, [ebp - 0xe8]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x75dd36
Function at 0x75ddf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe8
mov esi, ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0x50]
movdqu xmmword [ebx + 0x30], xmm0
movdqu xmmword [ebx + 0x20], xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.005fdca0
mov ecx, esi
push ebx
push 0
push 0x40
push edx
push eax
call fcn.0076a610
test al, al
je 0x75dee2
cmp word [ebp - 0x50], 0x5a4d
jne 0x75dea8
mov ebx, dword [ebp + 8]
mov ecx, edi
call fcn.005fdca0
mov ecx, dword [ebp - 0x14]
mov edi, ecx
sar edi, 0x1f
add eax, ecx
adc edi, edx
mov ecx, esi
push ebx
push 0
push 0xf8
push edi
mov dword [ebp - 0xf4], eax
push eax
call fcn.0076a610
test al, al
je 0x75df59
cmp dword [ebx], 0x4550
jne 0x75df8f
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x75df40
mov ecx, dword [ebp - 0xf4]
mov dword [eax], ecx
mov dword [eax + 4], edi
jmp 0x75df40
push 1
call fcn.00560ca0
add esp, 4
test al, al
je 0x75df3e
lea edi, [ebp - 0xf0]
mov ecx, edi
push 1
push 0x15a
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004ba0e0
lea eax, [ebp - 0xe8]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x75df16
push 1
call fcn.00560ca0
add esp, 4
test al, al
je 0x75df3e
lea edi, [ebp - 0xf0]
mov ecx, edi
push 1
push 0x154
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004ba0e0
lea eax, [ebp - 0xe8]
push 0x1f
push str.could_not_read_dos_header_from
push eax
call fcn.00535510
add esp, 0xc
movsx ecx, byte [esi + 0xb]
test ecx, ecx
jns 0x75df2c
mov ecx, dword [esi + 4]
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.00535510
add esp, 0xc
mov ecx, edi
call fcn.004ba5c0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xe8
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 1
call fcn.00560ca0
add esp, 4
test al, al
je 0x75df3e
lea edi, [ebp - 0xf0]
mov ecx, edi
push 1
push 0x162
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004ba0e0
lea eax, [ebp - 0xe8]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x75df16
push 1
call fcn.00560ca0
add esp, 4
test al, al
je 0x75df3e
lea edi, [ebp - 0xf0]
mov ecx, edi
push 1
push 0x168
push str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
call fcn.004ba0e0
lea eax, [ebp - 0xe8]
push 0x23
push str.invalid_signature_in_nt_headers_of
jmp 0x75df16