joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c41160
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea esi, [ebp - 0x28]
mov ecx, esi
push str.type
call fcn.01cbdfa0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edi, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.01cbdfa0
push esi
push edi
push ebx
call fcn.01c41210
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x1c411bd
push dword [ebp - 0x34]
call fcn.01c92027
add esp, 4
cmp byte [ebp - 0x1d], 0
js 0x1c411f5
lea esi, [ebp - 0x1c]
mov ecx, esi
call fcn.01c41430
mov dword [0x1d301b8], eax
cmp byte [esi + 0xb], 0
jns 0x1c411e3
push dword [ebp - 0x1c]
call fcn.01c92027
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [ebp - 0x28]
call fcn.01c92027
add esp, 4
jmp 0x1c411c3

Function at 0x1c416b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, dword [ebp + 0xc]
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1c41770
mov edi, eax
xor eax, eax
dec eax
mov ebx, esp
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov ecx, ebx
push 0
push edi
call fcn.01c39190
cmp byte [ebx + 0xb], 0
jns 0x1c416ff
mov ebx, dword [esp]
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
mov ebx, dword [ebp + 8]
je 0x1c41764
movzx ecx, byte [esp + 0xb]
test cl, cl
jns 0x1c4171e
mov ecx, dword [esp + 4]
jmp 0x1c41721
and ecx, 0x7f
cmp eax, ecx
jae 0x1c41764
xor esi, esi
mov edi, esp
mov ecx, edi
push esi
push eax
call fcn.01c70940
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
movsd xmm0, qword [edi]
movsd qword [ebx], xmm0
mov dword [edi + 4], esi
mov dword [edi], esi
mov dword [edi + 8], esi
cmp byte [esp + 0xb], 0
js 0x1c4177f
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx], eax
mov dword [ebx + 8], eax
jmp 0x1c41748
mov eax, dword [ebp + 8]
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov ebx, eax
jmp 0x1c4174f
push dword [esp]
call fcn.01c92027
add esp, 4
jmp 0x1c4174f
Function at 0x1c41b60
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 8]
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [esp + 0x20], eax
cmp byte [esi + 0xb], 0
mov edi, esi
jns 0x1c41b84
mov edi, dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c41bae
test al, 0x10
jne 0x1c41bcb
push edi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_conflicts_with_an_existing_file.___n
call fcn.01c41d20
add esp, 0xc
xor ebx, ebx
jmp 0x1c41c4a
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c41be2
mov ecx, dword [esi]
mov eax, dword [esi + 4]
jmp 0x1c41be7
push edi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_exists___n
call fcn.01c41d20
add esp, 0xc
mov bl, 1
jmp 0x1c41c4a
and eax, 0x7f
mov ecx, esi
add eax, eax
test eax, eax
je 0x1c41c04
movzx edx, word [ecx + eax - 2]
add eax, 0xfffffffe
cmp edx, 0x5c
je 0x1c41bff
cmp edx, 0x2f
jne 0x1c41be9
cmp eax, 0xfffffffe
jne 0x1c41c5f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1c41c37
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0xb7
je 0x1c41cbd
push esi
push edi
push str.Failed_to_create_directory__ls__last_error_is__d_n
call fcn.01c41d20
add esp, 0xc
xor ebx, ebx
cmp byte [esp + 0x1b], 0
jns 0x1c41c4a
push dword [esp + 0x10]
call fcn.01c92027
add esp, 4
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.01c92fe3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
sar eax, 1
lea edx, [esi + 0xc]
lea ecx, [esp + 4]
push edx
push eax
push 0
push esi
call fcn.01c3e680
cmp byte [esp + 0x1b], 0
jns 0x1c41c85
push dword [esp + 0x10]
call fcn.01c92027
add esp, 4
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [ecx + 8], eax
movsd xmm0, qword [esp + 4]
movsd qword [ecx], xmm0
push ecx
call fcn.01c41b60
add esp, 4
test al, al
jne 0x1c41c04
push str.Failed_to_create_one_of_the_parent_directories
call fcn.01c41d20
add esp, 4
jmp 0x1c41c35
lea ecx, [esp + 4]
push edi
call fcn.01cbdfa0
lea eax, [esp + 4]
cmp byte [eax + 0xb], 0
jns 0x1c41cd5
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne cl
and eax, 0x10
shr eax, 4
and al, cl
cmp byte [esp + 0xf], 0
jns 0x1c41d05
push dword [esp + 4]
mov dword [esp + 4], eax
call fcn.01c92027
mov eax, dword [esp + 4]
add esp, 4
test al, al
je 0x1c41c26
jmp 0x1c41c37
Function at 0x1c41d20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp + 0xc]
mov dword [ebp - 0x14], edi
call fcn.01c6b390
mov ebx, 0x1d301bc
push edi
push 0
push esi
push 0x400
push ebx
push dword [eax + 4]
push dword [eax]
call fcn.01c968fb
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c424d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov esi, dword [ebp + 8]
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x216]
push 0x206
push 0xff
push edi
call fcn.01c95850
add esp, 0xc
mov word [edi - 2], 0
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x1d03118
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1c42563
inc eax
cmp eax, 1
je 0x1c42563
lea edi, [eax - 1]
cmp word [ebp + eax*2 - 0x21c], 0x5c
mov eax, edi
je 0x1c4252b
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c4254a
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.01ca8083
add esp, 0xc
test eax, eax
je 0x1c42640
mov word [ebp - 0x218], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.PROGRAMFILES_X86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1c425c7
inc eax
cmp eax, 1
je 0x1c425c7
lea edi, [eax - 1]
cmp word [ebp + eax*2 - 0x21c], 0x5c
mov eax, edi
je 0x1c4258f
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c425ae
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.01ca8083
add esp, 0xc
test eax, eax
je 0x1c4264d
mov word [ebp - 0x218], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.PROGRAMW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1c42627
inc eax
cmp eax, 1
je 0x1c42627
lea edi, [eax - 1]
cmp word [ebp + eax*2 - 0x21c], 0x5c
mov eax, edi
je 0x1c425f3
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c42612
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.01ca8083
add esp, 0xc
test eax, eax
je 0x1c4265a
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c42667
mov eax, dword [esi + 4]
jmp 0x1c4266a
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c42684
mov eax, dword [esi + 4]
jmp 0x1c42687
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c426a1
mov eax, dword [esi + 4]
jmp 0x1c426a4
and eax, 0x7f
mov bl, 1
cmp eax, edi
je 0x1c42629
mov ecx, esi
push edi
call fcn.01ccdaf0
cmp word [eax], 0x5c
jne 0x1c42563
jmp 0x1c42629
and eax, 0x7f
mov bl, 1
cmp eax, edi
je 0x1c42629
mov ecx, esi
push edi
call fcn.01ccdaf0
cmp word [eax], 0x5c
jne 0x1c425c7
jmp 0x1c42629
and eax, 0x7f
mov bl, 1
cmp eax, edi
je 0x1c42629
mov ecx, esi
push edi
call fcn.01ccdaf0
cmp word [eax], 0x5c
jne 0x1c42627
jmp 0x1c42629
Function at 0x1c42c40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d309bc]
test eax, eax
jne 0x1c42d28
mov edi, 0xc
push edi
call fcn.01c91ff7
add esp, 4
mov esi, eax
xor ebx, ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x1d309bc], eax
push edi
call fcn.01c91ff7
add esp, 4
mov edi, eax
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x1d309c0], eax
call fcn.01c41000
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x28]
push str.user_data_dir
call fcn.01cbdfa0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x34]
push eax
call fcn.01cbdfa0
lea ebx, [ebp - 0x1c]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.01c41210
add esp, 0xc
push edi
push esi
push dword [ebp - 0x38]
push ebx
call fcn.01c427e0
add esp, 0x10
mov byte [ebp - 0x38], al
cmp byte [ebx + 0xb], 0
jns 0x1c42cf7
push dword [ebp - 0x1c]
call fcn.01c92027
add esp, 4
cmp byte [ebp - 0x29], 0
jns 0x1c42d08
push dword [ebp - 0x34]
call fcn.01c92027
add esp, 4
cmp byte [ebp - 0x1d], 0
jns 0x1c42d19
push dword [ebp - 0x28]
call fcn.01c92027
add esp, 4
cmp byte [ebp - 0x38], 0
je 0x1c42dd7
mov eax, dword [0x1d309bc]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp eax, ecx
je 0x1c42d4a
cmp byte [ecx + 0xb], 0
movzx edx, byte [eax + 0xb]
js 0x1c42da7
test dl, dl
jns 0x1c42d87
push dword [eax + 4]
push dword [eax]
call fcn.01c3e880
mov bl, 1
test esi, esi
je 0x1c42d73
mov eax, dword [0x1d309c0]
cmp eax, esi
je 0x1c42d73
cmp byte [esi + 0xb], 0
movzx edx, byte [eax + 0xb]
js 0x1c42db2
test dl, dl
jns 0x1c42d97
mov ecx, esi
push dword [eax + 4]
push dword [eax]
call fcn.01c3e880
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x1c42d4a
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
movsd xmm0, qword [eax]
movsd qword [esi], xmm0
jmp 0x1c42d73
test dl, dl
jns 0x1c42dbd
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x1c42dc0
test dl, dl
jns 0x1c42dc9
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x1c42dcc
and edx, 0x7f
push edx
push eax
call fcn.01c3e7b0
jmp 0x1c42d4a
and edx, 0x7f
mov ecx, esi
push edx
push eax
call fcn.01c3e7b0
jmp 0x1c42d73
xor ebx, ebx
jmp 0x1c42d73
Function at 0x1c43170
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1d309f8]
mov ecx, dword [0x1d2e0e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c431a1
movzx eax, word [0x1d309d4]
cmp eax, 9
jne 0x1c431ec
xor eax, eax
inc eax
pop ebp
ret
push 0x1d309f8
call fcn.01c92097
add esp, 4
cmp dword [0x1d309f8], 0xffffffff
jne 0x1c43190
xorps xmm0, xmm0
movups xmmword [0x1d309e4], xmm0
movups xmmword [0x1d309d4], xmm0
mov dword [0x1d309f4], 0
push 0x1d309d4
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d309f8
call fcn.01c9210d
add esp, 4
jmp 0x1c43190
test eax, eax
je 0x1c4319f
cmp eax, 6
jne 0x1c431fc
mov eax, 2
jmp 0x1c4319f
cmp eax, 0xc
jne 0x1c43208
mov eax, 3
jmp 0x1c4319f
mov eax, 4
jmp 0x1c4319f
Function at 0x1c47480
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x1c]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push str.LOCALAPPDATA
push esi
call fcn.01c416b0
add esp, 8
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c474bc
mov eax, dword [ebp - 0x18]
jmp 0x1c474bf
and eax, 0x7f
test eax, eax
jne 0x1c4753b
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1c474f6
cmp byte [ebp - 0x11], 0
jns 0x1c474e2
push dword [ebp - 0x1c]
call fcn.01c92027
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, eax
inc edi
mov ecx, esi
push 0
push edi
call fcn.01c70940
cmp byte [ebp - 0x11], 0
jns 0x1c4750c
mov esi, dword [ebp - 0x1c]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1c4752c
movzx ecx, byte [ebp - 0x11]
test cl, cl
jns 0x1c47525
mov ecx, dword [ebp - 0x18]
jmp 0x1c47528
and ecx, 0x7f
cmp eax, ecx
jb 0x1c47530
xor ebx, ebx
jmp 0x1c474d1
lea ecx, [ebp - 0x1c]
push 0
push eax
call fcn.01c70940
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov edi, dword [ebp - 0x14]
mov dword [esi + 8], edi
movsd xmm0, qword [ebp - 0x1c]
movsd qword [esi], xmm0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c47571
mov eax, dword [esi + 4]
test eax, eax
je 0x1c475c4
mov ecx, dword [esi]
jmp 0x1c47577
mov ecx, esi
test eax, eax
je 0x1c475c4
mov edi, dword [ebp + 0xc]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x1c4758b
mov ecx, esi
push 0x5c
call fcn.01c70660
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1c4759a
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x1c4759d
and eax, 0x7f
mov ecx, esi
push eax
push edi
call fcn.01c3e510
mov ecx, esi
push 0x5c
call fcn.01c70660
mov ecx, esi
push 9
push 0x1d04df0
call fcn.01c3e510
mov bl, 1
jmp 0x1c474d1
push str.string_index_out_of_bounds
push str.__pos___size__
push 0x45b
push str....._buildtools_third_partylibc_trunkinclude_string
push str._s:_d:_assertion__s_failed:__s
call fcn.01cbef30
int3
Function at 0x1c4c130
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x1c4c167
mov eax, dword [0x1d2bde4]
cmp eax, 0xffffffff
je 0x1c4c1f4
mov ebx, 0x100000
test eax, eax
jne 0x1c4c167
mov ebx, 0x80000
push 0x10
call fcn.01c91ff7
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x1d362cc]
bt ecx, eax
jb 0x1c4c1e9
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x1d3e2cc], 1
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push 0x10000
push esi
push 0x1c4c5d0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1c4c218
test edi, edi
je 0x1c4c276
mov dword [edi], eax
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.01c7ade0
add esp, 4
jmp 0x1c4c195
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x1d2bde4
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1c4c2ea
mov eax, dword [0x1d2bde4]
jmp 0x1c4c159
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x1c4c234
mov edi, eax
cmp eax, 0x5af
je 0x1c4c234
cmp edi, 0xe
jne 0x1c4c286
push ebx
call fcn.01cdf7e0
add esp, 4
test esi, esi
mov eax, dword [ebp - 0x20]
je 0x1c4c1d0
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x1d362cc]
bt edx, ecx
jae 0x1c4c265
push eax
call fcn.01c7af00
add esp, 4
push esi
call fcn.01c92027
add esp, 4
mov eax, dword [ebp - 0x20]
jmp 0x1c4c1d0
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1c4c1d0
mov eax, dword [0x1d30ae4]
mov ecx, dword [0x1d2e0e8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c4c2f9
lea ebx, [ebp - 0x1c]
push edi
push ebx
call fcn.01c51c00
add esp, 8
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c4c2c0
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
jmp 0x1c4c2c3
and eax, 0x7f
push eax
push ebx
push dword [0x1d30ae0]
call fcn.01c7bc10
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x1c4c23d
push dword [ebp - 0x1c]
call fcn.01c92027
jmp 0x1c4c23a
mov dword [0x1d2bde4], 0
jmp 0x1c4c162
push 0x1d30ae4
call fcn.01c92097
add esp, 4
cmp dword [0x1d30ae4], 0xffffffff
jne 0x1c4c2a3
push 0x20
push str.create_thread_last_error
call fcn.01c589a0
add esp, 8
mov dword [0x1d30ae0], eax
push 0x1d30ae4
call fcn.01c9210d
add esp, 4
jmp 0x1c4c2a3
Function at 0x1c4eba0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1c4ec13
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x1c4ebfd
cmp dword [ebp - 0x18], 4
jne 0x1c4ebfd
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x1c4ebfd

Function at 0x1c4ec20
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.01c93400
mov esi, ecx
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x800
lea edi, [ebp - 0x810]
push ebx
push 0xff
push edi
call fcn.01c95850
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], ebx
push ecx
push edi
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1c4ecb9
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x1c4ecbd
push edi
call fcn.01cab6f4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.01c3e210
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x1c4eca0
cmp eax, 2
jne 0x1c4ed09
lea ebx, [ebp - 0x1010]
push 0x800
push 0xff
push ebx
call fcn.01c95850
add esp, 0xc
push 0x400
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x1c4ed10
push ebx
call fcn.01cab6f4
add esp, 4
mov ecx, esi
push eax
push ebx
jmp 0x1c4ec99
mov esi, 0x3f4
jmp 0x1c4eca0
mov esi, 0xea
jmp 0x1c4eca0
Function at 0x1c51f20
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, ecx
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1c51f42
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1c51f77
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1c51f90
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.01c52050
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.01c79010
add esp, 4
test al, al
jne 0x1c51fa2
xor ebx, ebx
jmp 0x1c51f79
call fcn.01cde4a0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x266
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.01cde5e0
lea eax, [ebp - 0xb0]
push 0x10
push str.CreateDirectory
push eax
call fcn.01cbe950
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c51fe6
mov eax, dword [esi + 4]
mov esi, dword [esi]
jmp 0x1c51fe9
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.01c70cc0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c52010
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x1c52013
and eax, 0x7f
push eax
push ebx
push edi
call fcn.01cbe950
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1c52035
push dword [ebp - 0xc4]
call fcn.01c92027
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01cde640
jmp 0x1c51f9e
Function at 0x1c52050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, ecx
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1c52072
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c5209b
mov bl, 1
test al, 0x10
je 0x1c520ed
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.01c79010
add esp, 4
test al, al
je 0x1c520fb
call fcn.01cde4a0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x251
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.01cde5e0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cbe950
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c5213d
mov eax, dword [esi + 4]
mov esi, dword [esi]
jmp 0x1c52140
push 2
call fcn.01c79010
add esp, 4
test al, al
jne 0x1c520ff
xor ebx, ebx
jmp 0x1c52084
lea ecx, [ebp - 0xb8]
push 2
push 0x255
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.01c553b0
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cbe950
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c52167
mov eax, dword [esi + 4]
mov esi, dword [esi]
jmp 0x1c5216a
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.01c70cc0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c52191
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x1c52194
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.01c70cc0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c521c6
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x1c521c9
and eax, 0x7f
push eax
push ebx
push edi
call fcn.01cbe950
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1c521b6
push dword [ebp - 0xc4]
call fcn.01c92027
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01cde640
jmp 0x1c520fb
and eax, 0x7f
push eax
push ebx
push edi
call fcn.01cbe950
add esp, 0xc
push 0x11
push str.:_not_a_directory
push eax
call fcn.01cbe950
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1c521fb
push dword [ebp - 0xc4]
call fcn.01c92027
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01c557f0
jmp 0x1c520fb