joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002fc80
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm6
cmp byte [0x140045c78], 0
je 0x14002fc9f
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rax, qword [0x140045c70]
test rax, rax
jne 0x14002fc95
pxor xmm6, xmm6
movdqu xmmword [0x140045c58], xmm6
movdqu xmmword [0x140045c48], xmm6
movdqu xmmword [0x140045c38], xmm6
movdqu xmmword [0x140045c28], xmm6
mov qword [0x140045c68], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [0x140045c28], rax
lea rcx, str.dbghelp.dll
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_LoadLibraryExW
mov qword [0x140045c30], rax
test rax, rax
je 0x14002fe8c
lea rdx, str.ImagehlpApiVersionEx
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140045c38], rax
mov rcx, qword [0x140045c30]
lea rdx, str.SymInitialize
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140045c40], rax
mov rcx, qword [0x140045c30]
lea rdx, str.SymSetOptions
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140045c48], rax
mov rcx, qword [0x140045c30]
lea rdx, str.SymGetOptions
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140045c50], rax
mov rcx, qword [0x140045c30]
lea rdx, str.SymLoadModule64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140045c58], rax
mov rcx, qword [0x140045c30]
lea rdx, str.SymGetModuleInfo64
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140045c60], rax
mov rcx, qword [0x140045c30]
lea rdx, str.SymFromName
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x140045c68], rax
mov qword [rsp + 0x28], 0xc
mov rdx, qword [0x140045c38]
movdqu xmm0, xmmword [0x140045c58]
movq xmm1, rdx
movq xmm2, qword [0x140045c40]
punpcklqdq xmm2, xmm1
pcmpeqd xmm0, xmm6
pshufd xmm1, xmm0, 0xb1
pand xmm1, xmm0
pcmpeqd xmm2, xmm6
pshufd xmm0, xmm2, 0xb1
pand xmm0, xmm2
packssdw xmm0, xmm1
movmskps ecx, xmm0
test ecx, ecx
jne 0x14002fe72
test rax, rax
je 0x14002fe72
lea rcx, [rsp + 0x28]
call rdx
cmp word [rsp + 0x28], 0xc
jb 0x14002fe72
mov rcx, qword [0x140045c28]
xor edx, edx
xor r8d, r8d
call qword [0x140045c40]
test eax, eax
je 0x14002fe72
mov rax, qword [0x140045c50]
test rax, rax
je 0x14002fe5a
cmp qword [0x140045c48], 0
je 0x14002fe5a
call rax
and eax, 0xffffd8f8
lea ecx, [rax + 0x2704]
call qword [0x140045c48]
lea rax, [0x140045c28]
mov qword [0x140045c70], rax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rcx, qword [0x140045c30]
mov byte [0x140045c78], 1
test rcx, rcx
je 0x14002fe93
call sub.KERNEL32.dll_FreeLibrary
jmp 0x14002fe93
mov byte [0x140045c78], 1
xorps xmm0, xmm0
movups xmmword [0x140045c58], xmm0
movups xmmword [0x140045c48], xmm0
movups xmmword [0x140045c38], xmm0
mov qword [0x140045c68], 0
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140030370
Capabilities:
Parse pe header

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
test rcx, rcx
je 0x1400303b0
movzx eax, word [rsi]
cmp eax, 0x5a4d
jne 0x1400303c4
movsxd rdi, dword [rsi + 0x3c]
cmp dword [rsi + rdi], 0x4550
jne 0x1400303d2
cmp word [rsi + rdi + 0x14], 0
je 0x1400303e0
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov esi, dword [rsi + rdi + 0x50]
jmp 0x1400303ec
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov rsi, rax
movzx eax, word [rsi]
cmp eax, 0x5a4d
je 0x14003038e
xor esi, esi
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x1400303ec
xor esi, esi
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
jmp 0x1400303ec
xor esi, esi
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
mov eax, esi
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x140030420
Capabilities:
Parse pe header

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rdx, [rbp - 0x30]
mov r8d, 0x30
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x14003049d
cmp dword [rbp - 0x10], 0x1000
jne 0x140030491
mov eax, dword [rbp - 0xc]
cmp al, 1
je 0x140030491
and eax, 0x100
jne 0x140030491
mov rsi, qword [rbp - 0x28]
movzx eax, word [rsi]
cmp eax, 0x5a4d
jne 0x1400304b3
movsxd rax, dword [rsi + 0x3c]
cmp dword [rsi + rax], 0x4550
jne 0x1400304bf
cmp word [rsi + rax + 0x14], 0
je 0x1400304cb
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
jmp 0x1400304a9
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x1400304a7
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor esi, esi
mov rax, rsi
add rsp, 0x58
pop rsi
pop rbp
ret
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x1400304a7
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
jmp 0x1400304a7
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
jmp 0x1400304a7
Function at 0x140030700
Capabilities:
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov rbx, r9
mov qword [rbp], r8
mov rdi, rdx
mov r14, rcx
test rcx, rcx
je 0x140030866
movzx eax, word [r14]
cmp eax, 0x5a4d
jne 0x14003087f
movsxd rax, dword [r14 + 0x3c]
cmp dword [r14 + rax], 0x4550
jne 0x14003088d
cmp word [r14 + rax + 0x14], 0
je 0x14003089b
mov edx, dword [r14 + rax + 0x90]
mov rcx, r14
call fcn.1400306f0
test rax, rax
jne 0x14003079a
xor esi, esi
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
jmp 0x1400308d5
test rbx, rbx
je 0x140030792
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call rbx
mov rax, qword [rbp - 8]
add rax, 0x14
mov r12d, dword [rax]
test r12d, r12d
je 0x1400308a9
mov qword [rbp - 8], rax
mov edx, dword [rax + 0xc]
mov rcx, r14
call fcn.1400306f0
mov rsi, rax
test rax, rax
je 0x1400308c9
mov rcx, r14
mov edx, r12d
call fcn.1400306f0
mov r12, rax
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0x10]
mov rcx, r14
call fcn.1400306f0
mov r13, rax
mov rcx, qword [rax]
call fcn.140030420
cmp qword [rbp], 0
je 0x140030804
mov rcx, rdi
mov rdx, rax
mov r8, rsi
call qword [rbp]
test eax, eax
je 0x1400308b0
test r12, r12
je 0x140030792
xor esi, esi
jmp 0x140030812
inc esi
mov r15d, esi
mov rdx, qword [r12 + r15*8]
test rdx, rdx
je 0x140030780
js 0x140030840
add edx, 2
mov rcx, r14
call fcn.1400306f0
xor edx, edx
test rbx, rbx
jne 0x14003084a
jmp 0x140030810
movzx edx, dx
xor eax, eax
test rbx, rbx
je 0x140030810
lea r9, [r15*8]
add r9, r13
mov rcx, rdi
mov r8, rax
call rbx
test eax, eax
jne 0x140030810
jmp 0x140030785
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov r14, rax
movzx eax, word [r14]
cmp eax, 0x5a4d
je 0x14003073a
xor esi, esi
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x1400308d5
xor esi, esi
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
jmp 0x1400308d5
xor esi, esi
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
jmp 0x1400308d5
cmp qword [rbp], 0
je 0x1400308bb
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [rbp]
mov esi, 1
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
jmp 0x1400308d5
xor esi, esi
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400309c0
Capabilities:
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
test rcx, rcx
je 0x140030a8a
movzx eax, word [rsi]
cmp eax, 0x5a4d
jne 0x140030aa2
movsxd rax, dword [rsi + 0x3c]
cmp dword [rsi + rax], 0x4550
jne 0x140030aae
add rax, rsi
movzx ecx, word [rax + 0x14]
test rcx, rcx
je 0x140030ac6
add rax, 4
lea r14, [rax + rcx]
add r14, 0x14
movzx r15d, word [rax + 2]
xor r12d, r12d
lea rdi, str..detour
nop dword [rax]
cmp r12d, r15d
jae 0x140030aba
mov eax, r12d
lea rax, [rax + rax*4]
lea rbx, [r14 + rax*8]
mov rcx, rbx
mov rdx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
inc r12d
test eax, eax
jne 0x140030a30
mov eax, dword [rbx + 0xc]
test rax, rax
je 0x140030aba
cmp dword [rbx + 0x10], 0
je 0x140030aba
mov ecx, dword [rsi + rax]
cmp ecx, 0x40
jb 0x140030aba
add rsi, rax
cmp dword [rsi + 4], 0x727444
jne 0x140030aba
cmp dword [rsi + 8], 0
jne 0x140030a81
mov dword [rsi + 8], ecx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
jmp 0x140030ad2
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov rsi, rax
movzx eax, word [rsi]
cmp eax, 0x5a4d
je 0x1400309ed
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
jmp 0x140030ad0
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
jmp 0x140030ad0
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
jmp 0x140030ad0
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret

Function at 0x140030c50
Capabilities:
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
xorps xmm6, xmm6
lea r14, [rsp + 0x20]
add rbx, 0x10000
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
jmp 0x140030c9a
mov rbx, qword [rsp + 0x20]
add rbx, qword [rsp + 0x38]
mov r8d, 0x30
mov rcx, rbx
mov rdx, r14
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x140030d07
cmp dword [rsp + 0x40], 0x1000
jne 0x140030c90
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x140030c90
and eax, 0x100
jne 0x140030c90
movzx eax, word [rbx]
cmp eax, 0x5a4d
jne 0x140030c90
mov eax, dword [rbx + 0x3c]
cmp rax, 0x40
jb 0x140030c90
cmp qword [rsp + 0x38], rax
jb 0x140030c90
cdqe
cmp dword [rbx + rax], 0x4550
jne 0x140030c90
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140030b00
test rax, rax
je 0x140030c6e
jmp 0x140030d13
mov ecx, 0x7e
call sub.KERNEL32.dll_SetLastError
xor eax, eax
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14003255c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140032596
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14003259b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400325e4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140035dc0]
cmp byte [rcx + rax], 0
je 0x1400325e4
dec r8
sub rdx, 1
jne 0x1400325ca
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140032860
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400328aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400328aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400328aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400328aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400328aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400328ac
xor al, al
add rsp, 0x28
ret
Function at 0x1400273e0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x14008c3d8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rdx
lea r8, str..._.._.._.._src_3rdparty_chromium_base_files_file_util_win.cc
mov rdi, rcx
lea rdx, str.CreateDirectoryAndGetError
lea rcx, [rsp + 0x20]
mov r9d, 0x281
call fcn.140030680
mov rdx, rax
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.140032460
cmp qword [rdi + 0x18], 8
mov rsi, rdi
jb 0x140027445
mov rsi, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002747b
test al, 0x10
je 0x14002745e
mov bl, 1
jmp 0x14002755d
test rbx, rbx
je 0x140027469
mov dword [rbx], 0xfffffff7
mov ecx, 0x50
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor bl, bl
jmp 0x14002755d
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.14002b4d0
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x140027498
mov rcx, qword [rdi]
cmp qword [rsp + 0xa8], 8
lea r8, [rsp + 0x90]
mov rdx, qword [rsp + 0xa0]
cmovae r8, qword [rsp + 0x90]
cmp rdx, qword [rdi + 0x10]
jne 0x1400274f6
test rdx, rdx
je 0x1400274e4
sub r8, rcx
nop dword [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400274f6
add rcx, 2
sub rdx, 1
jne 0x1400274d0
test rbx, rbx
je 0x1400274ef
mov dword [rbx], 0xfffffffc
mov ecx, 2
jmp 0x140027548
mov rdx, rbx
lea rcx, [rsp + 0x90]
call fcn.1400273e0
test al, al
je 0x14002754e
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140027534
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0xb7
jne 0x140027538
mov rcx, rdi
call fcn.140027590
test al, al
je 0x140027538
mov bl, 1
jmp 0x140027550
test rbx, rbx
je 0x140027546
mov ecx, esi
call fcn.140031720
mov dword [rbx], eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor bl, bl
lea rcx, [rsp + 0x90]
call fcn.14002ac50
lea rcx, [rsp + 0x40]
call fcn.140032540
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400717b0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140027590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x90
mov rbx, rcx
lea r8, str..._.._.._.._src_3rdparty_chromium_base_files_file_util_win.cc
lea rcx, [rsp + 0x20]
mov r9d, 0x1f7
lea rdx, str.DirectoryExists
call fcn.140030680
mov rdx, rax
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.140032460
cmp qword [rbx + 0x18], 8
jb 0x1400275d4
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400275ec
shr ebx, 4
and bl, 1
jmp 0x1400275ee
xor bl, bl
lea rcx, [rsp + 0x40]
call fcn.140032540
movzx eax, bl
add rsp, 0x90
pop rbx
ret
Function at 0x140027610
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2e0
mov rax, qword [0x14008c3d8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rdi, rcx
lea r8, str..._.._.._.._src_3rdparty_chromium_base_files_file_util_win.cc
lea rcx, [rsp + 0x80]
mov r9d, 0x3a8
lea rdx, [0x140075f98]
call fcn.140030680
mov rdx, rax
lea rcx, [rsp + 0x30]
xor r8d, r8d
call fcn.140032460
xor ebx, ebx
lea rdx, [rsp + 0xc0]
mov ecx, 0x104
mov word [rsp + 0xc0], bx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x103
ja 0x140027722
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0xc0]
cmp word [rsp + 0xc0], bx
je 0x1400276bd
nop dword [rax]
inc rbx
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x1400276b0
mov qword [rsp + 0x28], rbx
lea rdx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x80]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.14002ab80
mov rcx, rax
lea rdx, [rsp + 0xa0]
call fcn.14002d300
mov rdx, rax
mov rcx, rdi
call fcn.14002acb0
lea rcx, [rsp + 0xa0]
call fcn.14002ac50
lea rcx, [rsp + 0x80]
call fcn.14002ac50
lea rcx, [rsp + 0x30]
call fcn.140032540
mov al, 1
jmp 0x14002772e
lea rcx, [rsp + 0x30]
call fcn.140032540
xor al, al
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1400717b0
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2e0
pop rdi
ret

Function at 0x140027750
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x14008c3d8]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor r9d, r9d
lea rax, [rsp + 0x60]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x28]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400277dc
cmp word [rsp + 0x60], 0
je 0x1400277dc
lea rax, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x60]
nop word [rax + rax]
inc rcx
lea rdx, [rdx + 2]
cmp word [rdx], 0
jne 0x1400277b0
mov qword [rsp + 0x38], rcx
lea rdx, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x30]
mov rcx, rbx
movdqa xmmword [rsp + 0x30], xmm0
call fcn.14002ab80
jmp 0x140027845
lea rcx, [rsp + 0x40]
call fcn.14002ac30
lea rcx, [rsp + 0x40]
call fcn.140027870
test al, al
je 0x140027803
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14002ab30
jmp 0x14002783b
lea rax, [0x140075f60]
xor ecx, ecx
mov qword [rsp + 0x30], rax
inc rcx
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x140027811
mov qword [rsp + 0x38], rcx
lea rdx, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x30]
mov rcx, rbx
movdqa xmmword [rsp + 0x30], xmm0
call fcn.14002ab80
lea rcx, [rsp + 0x40]
call fcn.14002ac50
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400717b0
add rsp, 0x280
pop rbx
ret
Function at 0x140027870
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x14008c3d8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x14002791c
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x70]
cmp word [rsp + 0x70], dx
je 0x1400278cd
nop
inc rdx
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x1400278c0
mov qword [rsp + 0x28], rdx
lea rcx, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.14002ab80
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.14002d300
mov rdx, rax
mov rcx, rbx
call fcn.14002acb0
lea rcx, [rsp + 0x30]
call fcn.14002ac50
lea rcx, [rsp + 0x50]
call fcn.14002ac50
mov al, 1
jmp 0x14002791e
xor al, al
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400717b0
add rsp, 0x290
pop rbx
ret

Function at 0x140027ca0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x90
mov rbx, rcx
lea r8, str..._.._.._.._src_3rdparty_chromium_base_files_file_util_win.cc
lea rcx, [rsp + 0x20]
mov r9d, 0x1cf
lea rdx, str.PathExists
call fcn.140030680
mov rdx, rax
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.140032460
cmp qword [rbx + 0x18], 8
jb 0x140027ce4
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea rcx, [rsp + 0x40]
setne bl
call fcn.140032540
movzx eax, bl
add rsp, 0x90
pop rbx
ret
Function at 0x140028a90
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x14008c3d8]
xor rax, rsp
mov qword [rsp + 0x250], rax
cmp qword [0x14009ec70], 0
jne 0x140028cfa
mov rbx, qword [0x14009ec68]
xor esi, esi
lea rdi, [rsi - 1]
test rbx, rbx
jne 0x140028bbb
lea ecx, [rsi + 0x20]
call fcn.1400716c0
mov rbx, rax
test rax, rax
je 0x140028bb1
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0x40]
mov qword [rbx], rsi
mov r8, rdi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
inc r8
cmp word [rax + r8*2], si
jne 0x140028b16
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1400265b0
mov r9, qword [rbx + 0x18]
mov rdx, rbx
mov r8, qword [rbx + 0x10]
cmp r9, 8
jb 0x140028b41
mov rdx, qword [rbx]
test r8, r8
je 0x140028b9a
lea rcx, [r8 - 1]
mov rax, r8
cmp rcx, r8
cmovb rax, rcx
cmp word [rdx + rax*2], 0x5c
lea rcx, [rdx + rax*2]
je 0x140028b6f
nop
cmp rcx, rdx
je 0x140028b9a
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x140028b60
sub rcx, rdx
sar rcx, 1
cmp rcx, rdi
je 0x140028b9a
inc rcx
cmp r8, rcx
jb 0x140028d21
mov qword [rbx + 0x10], rcx
mov rax, rbx
cmp r9, 8
jb 0x140028b96
mov rax, qword [rbx]
mov word [rax + rcx*2], si
mov r8d, 9
lea rdx, str.debug.log
mov rcx, rbx
call fcn.140027d10
jmp 0x140028bb4
mov rbx, rsi
mov qword [0x14009ec68], rbx
test byte [0x14008b040], 1
je 0x140028cfa
cmp qword [rbx + 0x18], 8
jb 0x140028bd2
mov rbx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov rcx, rbx
mov dword [rsp + 0x20], 4
lea edx, [r9 + 4]
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14009ec70], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x140028cfa
lea rdx, [rsp + 0x40]
mov word [rsp + 0x40], si
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x103
ja 0x140028cf6
lea rax, [rsp + 0x40]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], si
jne 0x140028c40
mov rcx, qword [0x14009ec68]
lea rdx, [rsp + 0x40]
mov r8, rdi
call fcn.1400265b0
mov rcx, qword [0x14009ec68]
mov rdx, rcx
cmp qword [rcx + 0x18], 8
jb 0x140028c71
mov rdx, qword [rcx]
mov rax, qword [rcx + 0x10]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x140028c96
mov r8d, 1
lea rdx, [0x140075ff4]
call fcn.140027d10
mov rcx, qword [0x14009ec68]
mov r8d, 9
lea rdx, str.debug.log
call fcn.140027d10
mov rcx, qword [0x14009ec68]
cmp qword [rcx + 0x18], 8
jb 0x140028cb9
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
lea edx, [r9 + 4]
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14009ec70], rax
dec rax
cmp rax, 0xfffffffffffffffd
jbe 0x140028cfa
mov qword [0x14009ec70], rsi
xor al, al
jmp 0x140028cfc
mov al, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400717b0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.14001d5c0
int3
Function at 0x1400301c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140030371
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140030090
mov rcx, qword [rsi + 8]
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140030336
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400302b0
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140030325
mov rax, qword [r11 + 8]
mov r8d, dword [rcx + 0x10]
cmp r8d, dword [rax + 0x10]
jne 0x1400302ed
mov r8, qword [rax]
cmp r8, rcx
je 0x1400302e7
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140030325
cmp r9, rax
je 0x140030301
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
je 0x14003034b
cmp r9, rax
jne 0x1400302f2
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140030260
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140030325
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3