joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ef320
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x4ef300
push 0
push eax
push 0x4ef150
push 0x822300
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4ef3e8
mov esi, dword [ebp + 0xc]
cmp dword [0x822304], 0
jne 0x4ef3f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x822308]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x4ef3ab
push 0x14
push 1
call fcn.004bf660
add esp, 8
test eax, eax
je 0x4ef3f6
mov edi, eax
push eax
push dword [0x822308]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4ef3ed
mov ebx, dword [ebp + 8]
mov esi, 0x82230c
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x822310], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005de1d9
push edi
call fcn.004bf4d0
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [0x8072c0]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x4ef3d4

Function at 0x4f0ed0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea edx, [ebp - 0x18]
mov dword [edx], eax
mov dword [edx + 4], eax
push 6
push edx
push ecx
call fcn.00568e20
add esp, 0xc
xor esi, esi
test eax, eax
je 0x4f0f2d
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
movzx eax, byte [0x7a4125]
cmp ebx, eax
jne 0x4f0f41
mov esi, 0x7a4118
test al, al
je 0x4f0f2d
push ebx
push 0x7a411c
push edi
call fcn.005cb2cd
add esp, 0xc
test eax, eax
jne 0x4f0f41
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [0x7a424d]
cmp ebx, eax
jne 0x4f0f68
mov esi, 0x7a4240
test al, al
je 0x4f0f2d
push ebx
push 0x7a4244
push edi
call fcn.005cb2cd
add esp, 0xc
test eax, eax
je 0x4f0f2d
movzx eax, byte [0x7a41b9]
cmp ebx, eax
jne 0x4f0f8f
mov esi, 0x7a41ac
test al, al
je 0x4f0f2d
push ebx
push 0x7a41b0
push edi
call fcn.005cb2cd
add esp, 0xc
test eax, eax
je 0x4f0f2d
movzx eax, byte [0x7a4379]
cmp ebx, eax
jne 0x4f0fc3
mov esi, 0x7a436c
test al, al
je 0x4f0f2d
push ebx
push 0x7a4370
push edi
call fcn.005cb2cd
add esp, 0xc
test eax, eax
je 0x4f0f2d
jmp 0x4f0fc3
xor esi, esi
jmp 0x4f0f2d
movzx eax, byte [0x7a42e1]
cmp ebx, eax
jne 0x4f0fbc
mov esi, 0x7a42d4
test al, al
je 0x4f0f2d
push ebx
push 0x7a42d8
push edi
call fcn.005cb2cd
add esp, 0xc
test eax, eax
je 0x4f0f2d
jmp 0x4f0fbc
Function at 0x4f6a30
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov edi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movaps xmm0, xmmword [0x79f820]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4f6a60
mov eax, dword [edi]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x110000
call ebx
cmp eax, 0xffffffff
je 0x4f6af6
mov esi, eax
lea eax, [ebp - 0xb8]
mov dword [eax], 2
xor edi, edi
push edi
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x4f6be8
lea eax, [ebp - 0xbc]
mov dword [eax], edi
push edi
push eax
push 0xc
push dword [ebp + 0x10]
push 0x24
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x4f6bac
mov bl, 1
cmp dword [ebp - 0xbc], 0xc
jne 0x4f6c36
push esi
call fcn.004f7170
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x4f6b5e
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4f6b0d
mov eax, dword [edi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
movaps xmm0, xmmword [0x79f820]
jne 0x4f6a56
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4f6ba5
call fcn.00646ae0
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0x71
push 0x79f850
call fcn.00646c90
lea eax, [ebp - 0xac]
push 0xd
push str.WaitNamedPipe
jmp 0x4f6b95
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4f6ba5
call fcn.00646ae0
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0x6c
push 0x79f850
call fcn.00646c90
lea eax, [ebp - 0xac]
push 0xa
push 0x79f89a
push eax
call fcn.00535510
add esp, 0xc
mov ecx, esi
call fcn.00646cf0
xor ebx, ebx
jmp 0x4f6adf
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4f6c2f
call fcn.00646ae0
lea edi, [ebp - 0xb4]
mov ecx, edi
push eax
push 2
push 0x88
push 0x79f850
call fcn.00646c90
lea eax, [ebp - 0xac]
push 0x11
push 0x79f8cb
jmp 0x4f6c1f
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4f6c2f
call fcn.00646ae0
lea edi, [ebp - 0xb4]
mov ecx, edi
push eax
push 2
push 0x7a
push 0x79f850
call fcn.00646c90
lea eax, [ebp - 0xac]
push 0x17
push 0x79f8b3
push eax
call fcn.00535510
add esp, 0xc
mov ecx, edi
call fcn.00646cf0
xor ebx, ebx
jmp 0x4f6ad6
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4f6c2f
lea edi, [ebp - 0xb4]
mov ecx, edi
push 2
push 0x8c
push 0x79f850
call fcn.004ba0e0
lea eax, [ebp - 0xac]
push 0x1c
push str.TransactNamedPipe:_expected
push eax
call fcn.00535510
add esp, 0xc
mov ecx, eax
push 0xc
call fcn.00534710
push 0xb
push str.__observed
push eax
call fcn.00535510
add esp, 0xc
mov ecx, eax
push dword [ebp - 0xbc]
call fcn.004114c0
mov ecx, edi
call fcn.004ba5c0
jmp 0x4f6c2f
Function at 0x4f6cb0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x12c
mov esi, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov ecx, dword [0x80e040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor ecx, ecx
dec ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], ecx
test al, al
je 0x4f6d8b
lea ebx, [ebp - 0x120]
xor edi, edi
push 0x110
push edi
push ebx
call fcn.005cced0
add esp, 0xc
mov dword [ebx - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x785be0]
movups xmmword [esp], xmm0
mov ebx, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call ebx
mov ecx, 3
push ecx
push 1
push edx
push eax
call ebx
mov ecx, 3
push ecx
push 0x20
push edx
push eax
call ebx
lea ecx, [ebp - 0x120]
mov dword [ecx - 8], 6
mov dword [ecx - 4], edi
mov word [ecx + 0x108], 0
lea ecx, [ebp - 0x12c]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ebx, 0x80003
test eax, eax
je 0x4f6d92
lea edi, [ebp - 0x138]
mov dword [edi], 0xc
push 0
call fcn.004f6de0
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], 1
jmp 0x4f6d92
xor edi, edi
mov ebx, 3
cmp byte [esi + 0xb], 0
jns 0x4f6d9a
mov esi, dword [esi]
sub esp, 0x20
mov dword [esp + 0x1c], edi
movaps xmm0, xmmword [0x79f830]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0x12c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4f7370
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret

Function at 0x4f7c30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x80e040]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, SysReAllocString
cmp edx, 0x7fffffff
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4f7c8f
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x4f7c8c
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
int3
xor esi, esi
dec esi
jmp 0x4f7c7a
Function at 0x4f7ca0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x80e040]
xor ecx, ebp
mov esi, SysReAllocString
cmp eax, 0x7fffffff
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push edx
mov edi, ebx
push ebx
mov esi, ecx
call ecx
test eax, eax
je 0x4f7d23
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4f7d0d
cmp ebx, 0xffffffff
je 0x4f7d20
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x4f7d35
mov ebx, dword [ebp - 0x14]
jmp 0x4f7cf9
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x4f7cf9
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov ecx, esi
mov esi, dword [ebp - 0x18]
jmp 0x4f7cd6

Function at 0x4f8180
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xa8
mov esi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.004f8070
add esp, 0x10
or edx, eax
jne 0x4f81b7
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x4f81cd
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xa8
pop esi
pop ebx
pop ebp
ret
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x4f8217
call fcn.00646ae0
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0xfc
push str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
call fcn.00646c90
lea eax, [ebp - 0xa8]
push 0xc
push 0x7a08b1
push eax
call fcn.00535510
add esp, 0xc
mov ecx, esi
call fcn.00646cf0
xor ebx, ebx
jmp 0x4f81b7
Function at 0x4fdd80
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
cmp edx, 8
ja case.default.0x4fdd91
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
jmp dword [edx*4 + 0x7a2a3c]
mov edx, 0x40
jmp case.0x4fdd91.2
push 0x4000
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4fddca
mov edx, 4
jmp case.0x4fdd91.2
mov edx, 0x20
push edx
push 0x1000
push ecx
push eax
call fcn.004fd6b0
add esp, 0x10
test eax, eax
setne al
pop ebp
ret
int3

Function at 0x4fe000
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x8130c4]
cmp eax, 0xffffffff
je 0x4fe0c1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x4fe0c1
mov eax, dword [0x824da8]
mov ecx, dword [0x813560]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4fe0cb
mov edi, dword [0x824da4]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4fe119
mov ecx, dword [0x823d9c]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x823da0], 0
jne 0x4fe125
lea ecx, [ebx + 0x823da0]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x824da0]
inc edx
mov dword [0x824da0], edx
mov dword [ecx + 0xc], edx
mov dword [0x823d9c], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x4fe116
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004fe140
jmp 0x4fe025
push 0x824da8
call fcn.005c8bdd
add esp, 4
cmp dword [0x824da8], 0xffffffff
jne 0x4fe046
push 4
call fcn.005c8b59
add esp, 4
mov edi, eax
mov dword [eax], 0
mov ecx, eax
call fcn.0054e310
mov dword [0x824da4], edi
push 0x824da8
call fcn.005c8c57
add esp, 4
jmp 0x4fe046
int3
mov ecx, edi
call fcn.0054e320
jmp 0x4fe05b
inc edx
cmp edx, 0x100
jne 0x4fe064
jmp 0x4fe0ab
Function at 0x4fe140
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x8130c4]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x4fe1e3
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x4fe22c
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.005cced0
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.00516c20
add esp, 8
push edi
call fcn.005c8bc3
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.005cc950
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.00516c20
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.00516c00
add esp, 4
test al, al
je 0x4fe22f
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x4fe232
xor eax, eax
dec eax
lock cmpxchg dword [0x8130c4], ecx
je 0x4fe167
push ecx
call fcn.00720d00
add esp, 4
mov ecx, dword [0x8130c4]
mov dword [ebp - 0x814], ecx
jmp 0x4fe167
int3
int3
push esi
call fcn.00516c00
add esp, 4
test al, al
je 0x4fe25a
cmp dword [ebp - 0x814], 0xffffffff
je 0x4fe25a
push 0xffffffffffffffff
call fcn.00720d00
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x4fe201
int3

Function at 0x4fea50
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 0xb], 0
jns 0x4fea69
mov edx, dword [edx]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x4fea81
cmp byte [esi + 0x28], 1
je 0x4feaf2
or ebx, 0x20000000
test bl, 8
jne 0x4feafa
mov dword [ebp - 0x10], 0
cmp byte [esi + 0x30], 0
mov eax, 0
je 0x4fea9b
mov eax, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x4feaa9
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x18], eax
cmp byte [esi + 0x1c], 1
je 0x4feb4c
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 1
je 0x4feb62
test ecx, ecx
jne 0x4feb1f
xor ecx, ecx
inc ecx
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x4feb16
test esi, esi
sete al
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
or ebx, 0x80000000
jmp 0x4fea81
cmp byte [esi + 0x34], 1
jne 0x4feb0b
or ebx, 0x40000000
jmp 0x4fea86
or ebx, 0x10000000
jmp 0x4fea86
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4feae3
cmp ecx, 4
jne 0x4feb2b
mov ecx, 6
jmp 0x4feacc
mov esi, ecx
add ecx, 0xfffffffe
cmp ecx, 2
jae 0x4feb3c
mov ecx, 7
jmp 0x4feacc
cmp esi, 1
jne 0x4feb48
mov ecx, 4
jmp 0x4feacc
xor ecx, ecx
jmp 0x4feacc
lea ecx, [esi + 0x10]
mov dword [ebp - 0x14], edx
call fcn.004ac4b0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x4feab6
mov ecx, esi
mov esi, edx
call fcn.004ac4b0
mov ecx, dword [ebp + 0xc]
mov edx, esi
jmp 0x4feac5
Function at 0x4feb80
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x4febaa
cmp byte [esi + 0x28], 1
je 0x4fec30
or ebx, 0x20000000
test bl, 8
jne 0x4fec3b
xor eax, eax
cmp byte [esi + 0x30], 0
mov ecx, 0
je 0x4febc3
mov ecx, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x4febd1
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0x1c], 1
je 0x4fec57
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 1
je 0x4fec6d
mov ecx, dword [ebp + 8]
cmp edx, 4
jne 0x4fec1f
mov edx, 6
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x4fec64
test esi, esi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov esi, edx
add edx, 0xfffffffe
cmp edx, 2
jae 0x4fec7d
mov edx, 7
jmp 0x4febf9
or ebx, 0x80000000
jmp 0x4febaa
cmp byte [esi + 0x34], 1
jne 0x4fec4c
or ebx, 0x40000000
jmp 0x4febb3
or ebx, 0x10000000
jmp 0x4febb3
lea ecx, [esi + 0x10]
call fcn.004ac4b0
jmp 0x4febda
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4fec10
mov ecx, esi
mov esi, edx
call fcn.004ac4b0
mov edx, esi
jmp 0x4febec
test esi, esi
jne 0x4fec89
xor edx, edx
inc edx
jmp 0x4febf9
cmp esi, 1
jne 0x4fec98
mov edx, 4
jmp 0x4febf9
xor edx, edx
jmp 0x4febf9
Function at 0x500970
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x824e10]
mov ecx, dword [0x813560]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x500aeb
mov esi, dword [0x824e00]
lea eax, [esi + 0xc]
mov dword [ebp - 0x20], eax
push eax
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x500b21
mov edi, esi
mov esi, dword [esi + 0x18]
test esi, esi
je 0x500aac
imul eax, dword [ebp + 8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0x6f47a654
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
mov ebx, edi
add ebx, 0x14
and edx, 0xf0f0f0f
imul edi, edx, 0x1010101
shr edi, 0x18
cmp edi, 1
jbe 0x500ae1
mov edx, ecx
cmp ecx, esi
jb 0x500a49
mov eax, ecx
xor edx, edx
div esi
mov dword [ebp - 0x24], ebx
mov eax, dword [ebx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x500aac
mov ebx, dword [eax]
test ebx, ebx
je 0x500aac
cmp edi, 2
jb 0x500b51
mov eax, dword [ebx + 4]
cmp eax, ecx
jne 0x500ac7
mov eax, dword [ebp + 8]
cmp dword [ebx + 8], eax
jne 0x500ad9
lea edi, [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
push ebx
push edi
call fcn.005011f0
mov esi, dword [edi]
mov dword [edi], 0
test esi, esi
je 0x500aac
cmp byte [ebp - 0x14], 1
jne 0x500aa3
mov eax, dword [esi + 0xc]
test eax, eax
je 0x500aa3
lock dec dword [eax + 4]
je 0x500b2e
push esi
call fcn.005c8b90
add esp, 4
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, edx
cmp eax, esi
jb 0x500ad3
xor edx, edx
div esi
mov eax, edx
mov edx, edi
cmp eax, edi
jne 0x500aac
mov ebx, dword [ebx]
test ebx, ebx
jne 0x500a64
jmp 0x500aac
lea edx, [esi - 1]
and edx, ecx
jmp 0x500a49
push 0x824e10
call fcn.005c8bdd
add esp, 4
cmp dword [0x824e10], 0xffffffff
jne 0x5009a4
mov ecx, 0x824dd8
call fcn.00500b70
push 0x824e10
call fcn.005c8c57
add esp, 4
jmp 0x5009a4
mov ecx, dword [ebp - 0x20]
call fcn.0054e320
jmp 0x5009bf
push eax
call fcn.00554c60
add esp, 4
jmp 0x500aa3
and eax, esi
cmp eax, edx
jne 0x500aac
mov ebx, dword [ebx]
test ebx, ebx
jne 0x500b52
jmp 0x500aac
dec esi
mov eax, dword [ebx + 4]
cmp eax, ecx
jne 0x500b3c
mov eax, dword [ebp + 8]
cmp dword [ebx + 8], eax
je 0x500a73
jmp 0x500b46
Function at 0x5101b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x5101c1
test eax, eax
jne 0x51021a
test eax, eax
sete al
mov ecx, dword [0x824e54]
test ecx, ecx
setne dl
and dl, al
cmp dl, 1
jne 0x5101e0
call dword [0x8072c0]
call ecx
cmp dword [0x824e4c], 0
je 0x51021a
mov esi, dword [0x824e50]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x510220
test esi, esi
je 0x51021a
mov ecx, dword [0x824e4c]
call dword [0x8072c0]
push esi
call ecx
add esp, 4
pop esi
pop edi
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x510208
jmp 0x51021a
Function at 0x5152f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push eax
push ecx
push 0x515370
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x51532e
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005c9f16
add esp, 0x18
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x20]
push 0x1b
push str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
push str.Start
push edi
call fcn.005613a0
add esp, 0x10
lea esi, [ebp - 0x10]
push edi
push esi
call fcn.006495f0
add esp, 8
mov ecx, esi
push 0x799a96
call fcn.00646530
mov ecx, esi
call fcn.00649690
jmp 0x51531d
Function at 0x517910
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x825c60]
mov ecx, dword [0x813560]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x51797a
mov ecx, 0x825c58
call fcn.00588a10
test eax, eax
jne 0x51796d
push 4
call fcn.005c8b59
add esp, 4
mov edi, eax
mov dword [eax], 0
mov ecx, 0x825c58
call fcn.00588a10
mov esi, eax
mov ecx, 0x825c58
push edi
call fcn.004fe260
test esi, esi
jne 0x5179bd
mov ecx, 0x825c58
pop esi
pop edi
pop ebp
jmp fcn.00588a10
push 0x825c60
call fcn.005c8bdd
add esp, 4
cmp dword [0x825c60], 0xffffffff
jne 0x517932
xor eax, eax
mov dword [0x825c5c], eax
mov dword [0x825c58], eax
mov ecx, 0x825c58
push 0x413910
call fcn.004fe2a0
push 0x825c60
call fcn.005c8c57
add esp, 4
jmp 0x517932
push esi
call fcn.005c8b90
add esp, 4
jmp 0x51796d
Function at 0x5375e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x537615
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x53761c
lea eax, [ebx + 1]
cmp eax, 2
jb 0x53760e
mov dword [esi], ebx
call fcn.005613d0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005613d0
push dword [esi]
call fcn.0054cbb0
add esp, 4
mov dword [esi], 0
jmp 0x5375ff