joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e26f0
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov qword [rsp + 0x48], r8
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x140274038]
xor rax, rsp
mov qword [rsp + 0x270], rax
movzx ebp, word [rcx + 0x28]
movzx esi, word [rcx + 0x2a]
mov r15, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call r15
mov r14d, eax
movzx r13d, word [rdi + 0x2a]
movzx r12d, word [rdi + 0x28]
call r15
mov word [rsp + 0x46], ax
lea r15, [rsp + 0x60]
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.14018f180
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r15
call fcn.1400d24f0
lea r8, [rsp + 0x58]
mov qword [r8], 0
lea r9, [rsp + 0x54]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1401e27f5
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1401e27f5
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x1401e27f5
dec r8d
mov rcx, qword [rsp + 0x48]
call fcn.1401490c0
mov sil, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14018d030
mov eax, esi
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r15, [rsp + 0x60]
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.14018f180
movzx eax, r14w
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r15
call fcn.1400d24f0
lea r8, [rsp + 0x58]
mov qword [r8], 0
lea r9, [rsp + 0x54]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1401e2876
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1401e2876
mov r8d, dword [rsp + 0x54]
test r8d, r8d
jne 0x1401e27bf
lea r14, [rsp + 0x60]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.14018f180
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
call fcn.1400d24f0
lea r8, [rsp + 0x58]
mov qword [r8], 0
lea r9, [rsp + 0x54]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1401e28f7
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1401e28f7
mov r8d, dword [rsp + 0x54]
test r8d, r8d
jne 0x1401e27bf
lea r14, [rsp + 0x60]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.14018f180
movzx eax, word [rsp + 0x46]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
call fcn.1400d24f0
lea r8, [rsp + 0x58]
mov qword [r8], 0
lea r9, [rsp + 0x54]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1401e297c
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1401e297c
mov r8d, dword [rsp + 0x54]
test r8d, r8d
jne 0x1401e27bf
xor esi, esi
jmp 0x1401e27cf
Function at 0x1401e5670
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140274038]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x140286788], 0
je 0x1401e56b6
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.14018d030
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x140286760]
test rdi, rdi
je 0x1401e5757
test byte [reloc.WS2_32.dll_accept], 1
je 0x1401e5699
cmp byte [rdi + 0x17], 0
jns 0x1401e56d8
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140286788], rax
inc rax
cmp rax, 1
ja 0x1401e5699
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14018f180
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1401e5819
xor esi, esi
jmp 0x1401e5699
mov ecx, 0x18
call fcn.14018bb3c
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.14018f180
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x14023d7d0]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.1401c71d0
movzx eax, byte [rdi + 0x17]
mov rcx, rdi
test al, al
jns 0x1401e57bf
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
test rax, rax
jne 0x1401e57e5
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rdi
call fcn.1401445c0
mov qword [0x140286760], rdi
jmp 0x1401e56c6
add rax, rax
test rax, rax
je 0x1401e57c4
lea rdx, [rax - 2]
cmp word [rcx + rax - 2], 0x5c
mov rax, rdx
jne 0x1401e57e8
cmp rdx, 0xfffffffffffffffe
je 0x1401e57c4
sar rdx, 1
inc rdx
mov rcx, rdi
mov r8, 0xffffffffffffffff
call fcn.1401417c0
jmp 0x1401e57c4
mov rcx, qword [0x140286760]
lea rdx, [rsp + 0x40]
call fcn.1400ca460
mov rcx, qword [0x140286760]
call fcn.1401de7a0
cmp word [rax], 0x5c
je 0x1401e5855
mov rcx, qword [0x140286760]
lea rdx, [0x140247448]
mov r8d, 1
call fcn.1401445c0
mov rcx, qword [0x140286760]
lea rdx, str.debug.log
mov r8d, 9
call fcn.1401445c0
mov rcx, qword [0x140286760]
cmp byte [rcx + 0x17], 0
jns 0x1401e587e
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140286788], rax
inc rax
cmp rax, 1
ja 0x1401e5699
mov qword [0x140286788], 0
jmp 0x1401e5750
Function at 0x1401eb1b0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x140274038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x140286b20]
test rax, rax
jne 0x1401eb1f4
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x140286b20]
test rax, rax
je 0x1401eb1e1
cmp eax, 2
jne 0x1401eb24c
mov ecx, 2
call fcn.1401551c0
test al, al
je 0x1401eb2a9
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x90
mov r9d, 2
call fcn.1400db5c0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
call fcn.1401c6fd0
mov rcx, rsi
call fcn.1400dbbb0
jmp 0x1401eb2a9
mov eax, 1
lock xadd qword [0x140286b58], rax
inc rax
cmp rax, 2
jl 0x1401eb270
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140286adc], eax
mov qword [0x140286ad4], rsi
mov rcx, qword [0x140276868]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.1401551c0
test al, al
jne 0x1401eb2d9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14018d030
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xbc
mov r9d, 2
call fcn.1400db5c0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
jmp 0x1401eb23d
Function at 0x1401ee830
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
lea rsi, [rcx + 0x18]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call fcn.14018f180
mov dword [rdi + 0x18], 0x238
cmp byte [rdi + 0x10], 0
je 0x1401ee872
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
mov byte [rdi + 0x10], 1
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1401ee866

Function at 0x1401f05b0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x1401f05f6
mov r14, r12
test r14, r14
je 0x1401f070b
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r15
jbe 0x1401f0658
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x1401f0644
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.14018ead0
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
jmp 0x1401f05d2
mov rax, r12
sub rax, r15
sar rax, 2
cmp r12, r15
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x1401f071e
lea rcx, [r13*8]
call fcn.14018bb3c
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, r12
mov r14, rcx
sub rdx, rbx
je 0x1401f06be
lea r14, [rdx + rcx]
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x1401f070b
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x1401f06a6
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], rdx
cmp r12, rbx
je 0x1401f06de
add r12, 0xfffffffffffffff8
jne 0x1401f06d1
jmp 0x1401f06f8
test r15, r15
je 0x1401f05d2
mov rcx, r15
call fcn.14018bb78
mov r14, qword [rsi + 0x10]
jmp 0x1401f05d2
lea rcx, [0x140242e90]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.1401c7f00
lea rcx, [0x140242e90]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.1401c7f00
call fcn.1401c6fb0
int3
Function at 0x1401f5740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x140274038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov ebx, 1
cmp rdi, r12
je 0x1401f57d4
mov rsi, r8
mov r14, rcx
lea r15, [rsp + 0x20]
mov rcx, rdi
mov rdx, r15
call fcn.1401f4f50
test al, al
jne 0x1401f579c
add rdi, 0x70
cmp rdi, r12
jne 0x1401f5781
mov rdi, r12
cmp rdi, qword [r14 + 0x58]
je 0x1401f57d4
cmp byte [rdi + 0x27], 0
js 0x1401f57ae
lea rcx, [rdi + 0x10]
jmp 0x1401f57b2
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov ebx, 1
cmovne ebx, ecx
test ebx, ebx
jne 0x1401f57d4
mov qword [rsi], rdi
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14018d030
mov eax, ebx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1401f5960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x140274038]
xor rax, rsp
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov r14, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov esi, 1
cmp r14, r12
je 0x1401f59db
mov rdi, r9
mov ebp, r8d
mov rbx, rcx
lea r15, [rsp + 0x20]
mov rcx, r14
mov rdx, r15
call fcn.1401f4f50
test al, al
jne 0x1401f59c0
add r14, 0x70
cmp r14, r12
jne 0x1401f59a5
mov r14, r12
cmp r14, qword [rbx + 0x58]
je 0x1401f59db
mov eax, dword [r14 + 0x68]
cmp eax, ebp
je 0x1401f59f9
xor ecx, ecx
cmp eax, 1
sete cl
lea esi, [rcx + rcx*2]
inc esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14018d030
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp byte [r14 + 0x27], 0
js 0x1401f5a06
lea rcx, [r14 + 0x10]
jmp 0x1401f5a0a
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401f59db
shr eax, 3
and eax, 2
mov esi, eax
jne 0x1401f59db
mov byte [rbx + 0x48], 1
mov qword [rdi], r14
xor esi, esi
jmp 0x1401f59db
Function at 0x1401fa150
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140274038]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x14028b628]
mov ecx, dword [0x140283248]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401fa3d4
mov rax, qword [0x14028b620]
test rax, rax
je 0x1401fa23b
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call qword [0x1402655f0]
test eax, eax
je 0x1401fa1e5
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
je 0x1401fa242
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x1401fa277
mov ecx, 2
call fcn.1401551c0
test al, al
je 0x1401fa23b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4c
mov r9d, 2
call fcn.1401e5eb0
lea rcx, [rsp + 0x40]
lea rdx, [0x140258fc4]
mov r8d, recvfrom
call fcn.1401c6fd0
mov rcx, rbx
call fcn.1401e5f30
mov byte [rsi + 0x81], 0
movaps xmm0, xmmword [0x14023d7d0]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
cmp byte [rsi + 0x81], 0
setne dl
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.1401fa420
test al, al
jne 0x1401fa301
mov ecx, 2
call fcn.1401551c0
test al, al
jne 0x1401fa2c0
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14018d030
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21f
mov r9d, 2
call fcn.1400db5c0
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.1401c6fd0
mov rcx, rsi
call fcn.1400dbbb0
jmp 0x1401fa2a1
cmp byte [rsi + 0x80], 0
mov rdx, qword [rsi + 0x28]
mov rcx, rdi
mov r8, rsi
jne 0x1401fa31b
call fcn.1401face0
jmp 0x1401fa320
call fcn.1401fa660
test al, al
jne 0x1401fa338
mov ecx, 2
call fcn.1401551c0
test al, al
je 0x1401fa2a1
jmp 0x1401fa39d
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.140109060
mov sil, 1
test al, al
jne 0x1401fa2a3
mov ecx, 2
call fcn.1401551c0
test al, al
je 0x1401fa2a1
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22d
mov r9d, 2
call fcn.1400db5c0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, shutdown
jmp 0x1401fa2f2
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x228
mov r9d, 2
call fcn.1400db5c0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, reloc.WS2_32.dll_shutdown
jmp 0x1401fa2f2
lea rcx, [0x14028b628]
call fcn.14018bc90
cmp dword [0x14028b628], 0xffffffff
jne 0x1401fa19b
lea rcx, [0x14024706a]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.14010b110
mov qword [0x14028b620], rax
lea rcx, [0x14028b628]
call fcn.14018bd28
jmp 0x1401fa19b
Function at 0x140209210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140274038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x14020923a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140209259
mov edi, eax
bt eax, 0xa
jae 0x140209251
test bl, bl
je 0x140209267
and edi, 0x10
shr edi, 4
jmp 0x140209269
mov ecx, 2
call fcn.1401551c0
test al, al
jne 0x140209286
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14018d030
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x80
mov r9d, 2
call fcn.1401e5eb0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, shutdown
call fcn.1401c6fd0
mov rcx, rax
mov rdx, rsi
call fcn.1401e6e60
mov rcx, rdi
call fcn.1401e5f30
jmp 0x140209267

Function at 0x1402092e0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x140274038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x14020930b
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14020933f
test bl, bl
je 0x14020932f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1402093b1
mov ecx, 2
call fcn.1401551c0
test al, al
jne 0x14020935c
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14018d030
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x61
mov r9d, 2
call fcn.1401e5eb0
lea rcx, [rsp + 0x38]
lea rdx, str.CreateDirectory
mov r8d, reloc.WS2_32.dll_recv
call fcn.1401c6fd0
mov rcx, rax
mov rdx, rsi
call fcn.1401e6e60
mov rcx, rdi
call fcn.1401e5f30
jmp 0x14020933d
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.140209210
test al, al
jne 0x14020933f
mov ecx, 2
call fcn.1401551c0
test al, al
je 0x14020933d
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x5c
mov r9d, 2
call fcn.1400db5c0
lea rcx, [rsp + 0x38]
mov rdx, rsi
call fcn.1401e6e60
lea rdx, str._not_a_directory
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rax
call fcn.1401c6fd0
mov rcx, rdi
call fcn.1400dbbb0
jmp 0x14020933d
Function at 0x140209430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x140274038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x140209457
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140209487
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14018d030
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1401551c0
test al, al
jne 0x140209499
xor esi, esi
jmp 0x14020946b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, reloc.WS2_32.dll_WSAStartup
mov r9d, 2
call fcn.1401e5eb0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, shutdown
call fcn.1401c6fd0
mov rcx, rax
mov rdx, rsi
call fcn.1401e6e60
mov rcx, rdi
call fcn.1401e5f30
jmp 0x140209495

Function at 0x1402094f0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x140274038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x140209517
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14020952e
and eax, 0x410
cmp eax, 0x410
je 0x140209573
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14020953a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x140209557
mov ecx, 2
call fcn.1401551c0
test al, al
jne 0x140209594
xor edi, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14018d030
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14018d030
mov rcx, rsi
add rsp, 0x178
pop rdi
pop rsi
jmp fcn.1402095f0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x93
mov r9d, 2
call fcn.1401e5eb0
lea rcx, [rsp + 0x40]
lea rdx, str.DeleteFile
mov r8d, recv
call fcn.1401c6fd0
mov rcx, rax
mov rdx, rsi
call fcn.1401e6e60
mov rcx, rdi
call fcn.1401e5f30
jmp 0x140209555
Function at 0x1402095f0
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x140274038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x140209618
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
jne 0x140209632
mov ecx, 2
call fcn.1401551c0
test al, al
jne 0x140209654
test edi, edi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14018d030
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.1401e5eb0
lea rcx, [rsp + 0x38]
lea rdx, str.RemoveDirectory
mov r8d, reloc.WS2_32.dll_recv
call fcn.1401c6fd0
mov rcx, rax
mov rdx, rsi
call fcn.1401e6e60
mov rcx, rbx
call fcn.1401e5f30
jmp 0x140209632

Function at 0x140211c10
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
je 0x140211c23
cmp dword [0x14028d308], ecx
jle 0x140211c2a
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call fcn.140211c70
test edi, edi
je 0x140211c23
cmp byte [rsi + rdi - 1], 0xa
je 0x140211c23
lea rcx, reloc.WS2_32.dll_ioctlsocket
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140211c70

Function at 0x140211c70
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140274038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
lea r14, [rsp + 0x34]
mov r15, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x140211ce7
mov dword [rsp + 0x34], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r15
mov ecx, dword [rsp + 0x34]
test eax, eax
cmovne eax, ecx
je 0x140211ce7
add rdi, rax
test ecx, ecx
jne 0x140211cad
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14018d030
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14021e020
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x140274038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x14021e080
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14018d030
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret