joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6430b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 0xc]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x20]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x10]
push 0x3ed
push str....._base_files_file_util_win.cc
push 0x791c21
push ebx
call fcn.005613a0
add esp, 0x10
xor eax, eax
mov ecx, esi
push eax
push ebx
call fcn.005546a0
mov dword [ebx], 0xffffffff
cmp byte [edi + 0xb], 0
jns 0x643115
mov edi, dword [edi]
mov esi, dword [ebp + 8]
sub esp, 0x1c
xor ebx, ebx
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x791ae0]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x14], 0x8000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea edi, [esp + 0x10]
mov dword [edi], ebx
mov ecx, edi
push eax
call fcn.005375e0
mov eax, dword [edi]
lea ecx, [eax + 1]
cmp ecx, 1
ja 0x643192
xor ecx, ecx
mov byte [esi], cl
mov byte [esi + 8], cl
inc eax
cmp eax, 2
jb 0x643174
call fcn.005613d0
push dword [esp + 0x10]
call fcn.0054cbb0
add esp, 4
lea ecx, [esp + 0x20]
call fcn.00554710
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
test edx, edx
js 0x6431d5
lea edi, [esp + 0xc]
mov dword [edi], 0xffffffff
push 0
push edi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x6431ce
mov eax, dword [esp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], 0
mov al, 1
mov byte [esi + 8], al
mov eax, dword [esp + 0x10]
jmp 0x64315d
mov byte [esi], 0
xor eax, eax
jmp 0x6431c5
int3
Function at 0x643200
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp], edx
mov esi, ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0x8a
push str....._base_files_file_util_win.cc
push str.DoCopyFile
push edi
call fcn.005613a0
add esp, 0x10
mov ecx, ebx
push 0
mov ebx, edi
push edi
mov edi, esi
call fcn.005546a0
mov ecx, esi
call fcn.00563ce0
test al, al
jne 0x643284
mov esi, dword [esp]
mov ecx, esi
call fcn.00563ce0
test al, al
jne 0x643284
cmp byte [edi + 0xb], 0
jns 0x6432b1
cmp dword [edi + 4], 0x103
jbe 0x6432b1
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.00554710
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
lea ecx, [esp + 4]
call fcn.004d66e0
jmp 0x643286
cmp byte [esi + 0xb], 0
jns 0x6432c0
cmp dword [esi + 4], 0x103
ja 0x643284
xor eax, eax
dec eax
lea esi, [esp + 4]
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi], eax
push 0x97
push str....._base_files_file_util_win.cc
push str.DoCopyFile
push ebx
call fcn.005613a0
add esp, 0x10
mov ecx, esi
mov esi, dword [esp]
push 0x8153e0
push ebx
call fcn.004d65d0
cmp byte [esi + 0xb], 0
jns 0x6432ff
mov esi, dword [esi]
movzx eax, byte [ebp + 8]
cmp byte [edi + 0xb], 0
jns 0x64330b
mov edi, dword [edi]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x6432a4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
sete cl
test al, 1
sete dl
or dl, cl
jne 0x6432a6
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bl, 1
jmp 0x6432a6

Function at 0x643920
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00563ce0
test al, al
jne 0x64393e
mov ecx, esi
call fcn.00563ce0
test al, al
je 0x643943
xor eax, eax
pop esi
pop ebp
ret
pop esi
pop ebp
jmp fcn.00643350
Function at 0x646560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x815498], 0
je 0x646598
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x81549c]
test esi, esi
jne 0x646638
push 0xc
call fcn.005c8b59
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.005cced0
add esp, 0xc
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.005372d0
movsx eax, byte [esi + 0xb]
mov ecx, esi
test eax, eax
jns 0x6465fb
mov eax, dword [esi + 4]
mov ecx, dword [esi]
test eax, eax
je 0x646624
add eax, eax
test eax, eax
je 0x646624
lea edx, [eax - 2]
cmp word [ecx + eax - 2], 0x5c
mov eax, edx
jne 0x646601
cmp edx, 0xfffffffe
je 0x646624
sar edx, 1
inc edx
mov ecx, esi
push 0xffffffffffffffff
push edx
call fcn.00537460
mov ecx, esi
push 9
push str.debug.log
call fcn.0054b480
mov dword [0x81549c], esi
test byte [0x8105bc], 1
je 0x646581
cmp byte [esi + 0xb], 0
jns 0x64664d
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x792800]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x815498], eax
inc eax
cmp eax, 1
ja 0x646581
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.005cced0
add esp, 0xc
mov word [esi - 2], 0
lea esi, [ebp - 0x218]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jb 0x646761
mov ecx, dword [0x81549c]
push esi
call fcn.004a4310
mov ecx, dword [0x81549c]
movsx eax, byte [ecx + 0xb]
test eax, eax
js 0x646768
test al, al
je 0x646776
mov edx, ecx
cmp word [edx + eax*2 - 2], 0x5c
je 0x646707
push 1
push 0x780cf4
call fcn.0054b480
mov ecx, dword [0x81549c]
push 9
push str.debug.log
call fcn.0054b480
mov eax, dword [0x81549c]
cmp byte [eax + 0xb], 0
jns 0x646720
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x792800]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x815498], eax
inc eax
cmp eax, 1
ja 0x646581
mov dword [0x815498], 0
xor ebx, ebx
jmp 0x646581
mov eax, dword [ecx + 4]
test eax, eax
je 0x646776
mov edx, dword [ecx]
jmp 0x6466ed
ud2
Function at 0x64ba70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp edx, eax
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebp - 0x14], edx
cmovb ebx, edx
xor eax, eax
test ebx, ebx
je 0x64bad5
xor esi, esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov edx, dword [edi + esi*4]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + esi*4]
mov ebx, ecx
xor ebx, edx
mov edi, ecx
sub edi, edx
lea edx, [ebx - 1]
xor edi, ecx
or edi, ebx
not ebx
and edx, ebx
mov ebx, dword [ebp - 0x1c]
xor edi, ecx
mov ecx, dword [ebp - 0x18]
sar edx, 0x1f
sar edi, 0x1f
or edi, 1
xor eax, edi
and eax, edx
xor eax, edi
mov edi, dword [ebp + 8]
inc esi
cmp ebx, esi
jne 0x64ba9a
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
cmp edx, esi
jb 0x64bae9
ja 0x64bb03
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
or ecx, dword [edi + edx*4]
inc edx
cmp esi, edx
jne 0x64baeb
mov edx, ecx
not edx
dec ecx
and ecx, edx
sar ecx, 0x1f
not ecx
or eax, ecx
jmp 0x64bae1
mov edx, ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
or esi, dword [edx + ecx*4]
inc ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], ecx
jne 0x64bb07
mov ecx, esi
not ecx
dec esi
and esi, ecx
sar esi, 0x1f
xor eax, 1
and eax, esi
xor eax, 1
jmp 0x64bae1

Function at 0x64bbb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 4]
mov esi, dword [eax + 4]
xor edx, edx
cmp edi, esi
jge 0x64bbd6
mov eax, dword [eax]
xor edx, edx
mov ebx, edi
or edx, dword [eax + ebx*4]
inc ebx
cmp esi, ebx
jne 0x64bbce
cmp esi, edi
jge 0x64bbe6
mov eax, dword [ecx]
mov ebx, esi
or edx, dword [eax + ebx*4]
inc ebx
cmp edi, ebx
jne 0x64bbde
cmp edi, esi
cmovl esi, edi
test esi, esi
jle 0x64bc05
mov edi, dword [ecx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
xor eax, eax
mov ecx, dword [ebx + eax*4]
xor ecx, dword [edi + eax*4]
or edx, ecx
inc eax
cmp esi, eax
jne 0x64bbf8
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
xor ecx, dword [eax + 0xc]
xor eax, eax
or ecx, edx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x64fc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
test ecx, ecx
jle 0x64fd36
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor esi, esi
xor eax, eax
xor edi, edi
xor edx, edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax + ecx*4]
mov ecx, edx
shl ecx, 0x10
mov eax, ecx
not eax
dec ecx
and ecx, eax
sar ecx, 0x1f
mov dword [ebp - 0x24], ecx
mov eax, edx
shr eax, 0x10
xor eax, edx
and eax, ecx
xor eax, edx
mov esi, eax
shl esi, 0x18
mov ecx, esi
dec esi
not ecx
and esi, ecx
mov ecx, eax
shr ecx, 8
sar esi, 0x1f
mov dword [ebp - 0x20], esi
xor ecx, eax
and ecx, esi
xor ecx, eax
mov eax, ecx
shl eax, 0x1c
mov esi, eax
not esi
dec eax
and eax, esi
sar eax, 0x1f
mov edi, ecx
shr edi, 4
mov esi, eax
xor edi, ecx
and edi, eax
xor edi, ecx
mov ecx, edi
shl ecx, 0x1e
mov eax, ecx
dec ecx
not eax
and ecx, eax
mov eax, edi
shr eax, 2
sar ecx, 0x1f
mov ebx, ecx
xor eax, edi
and eax, ecx
lea ecx, [edx - 1]
not edx
and ecx, edx
xor eax, edi
shl eax, 0x1f
mov edx, eax
not edx
dec eax
and eax, edx
mov edx, dword [ebp - 0x24]
and edx, 0x10
shr eax, 0x1f
or eax, edx
mov edx, dword [ebp - 0x20]
and edx, 8
or eax, edx
and esi, 4
or eax, esi
mov esi, dword [ebp - 0x28]
sar ecx, 0x1f
and ebx, 2
or eax, ebx
mov edx, ecx
not edx
mov edi, dword [ebp - 0x1c]
or ecx, edi
or edx, edi
add eax, esi
not ecx
and ecx, eax
mov eax, dword [ebp - 0x2c]
or eax, ecx
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 0x10]
add esi, 0x20
mov edi, edx
mov edx, dword [ebp - 0x10]
cmp ecx, edx
jne 0x64fc47
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x64fd2e
Function at 0x658e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00567f90

Function at 0x664490
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00643d20
add esp, 4
test al, al
je 0x6644a8
pop ebp
jmp fcn.004acd50
mov al, 1
pop ebp
ret
Function at 0x6af130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
cmp esi, ebx
je 0x6af173
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.006b0890
test al, al
jne 0x6af16d
add esi, 0x58
cmp esi, ebx
jne 0x6af15a
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax + 0x2c]
cmp esi, ebx
je 0x6af1aa
cmp byte [esi + 0x1b], 0
js 0x6af182
lea eax, [esi + 0x10]
jmp 0x6af185
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x6af1ad
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x6af1ad
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6af2f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov edi, dword [ecx + 0x28]
mov esi, dword [ecx + 0x2c]
cmp edi, esi
je 0x6af333
mov dword [ebp - 0x24], ecx
lea ebx, [ebp - 0x20]
mov ecx, edi
push ebx
call fcn.006b0890
test al, al
jne 0x6af32d
add edi, 0x58
cmp edi, esi
jne 0x6af31a
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx + 0x2c]
xor ebx, ebx
inc ebx
cmp edi, esi
je 0x6af383
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x6af377
cmp byte [edi + 0x1b], 0
js 0x6af34f
mov esi, ecx
lea eax, [edi + 0x10]
jmp 0x6af354
mov esi, ecx
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6af383
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x6af383
mov eax, dword [ebp + 0xc]
mov byte [esi + 0x24], 1
mov dword [eax], edi
xor ebx, ebx
jmp 0x6af383
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6af4c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc8
mov esi, ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0xb8]
mov dword [edi], 0xffffffff
mov edx, edi
call fcn.004d2890
mov ebx, dword [edi]
test ebx, ebx
je 0x6af586
mov dword [ebp - 0xd0], esi
mov esi, dword [ebp + 8]
xor eax, eax
dec eax
lea ecx, [ebp - 0xc4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
call fcn.00561680
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0xb4], xmm0
mov esi, dword [ebx + 0x28]
mov edi, dword [ebx + 0x2c]
cmp esi, edi
je 0x6af550
mov dword [ebp - 0xc8], ebx
lea ebx, [ebp - 0xb4]
mov ecx, esi
push ebx
call fcn.006b0890
test al, al
jne 0x6af547
add esi, 0x58
cmp esi, edi
jne 0x6af534
mov ebx, dword [ebp - 0xc8]
mov edi, dword [ebx + 0x2c]
cmp esi, edi
jne 0x6af58d
xor esi, esi
inc esi
lea ecx, [ebp - 0xc4]
call fcn.005617f0
lea ecx, [ebp - 0xb8]
call fcn.004d3170
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0xc8
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x6af562
lea eax, [esi + 0x10]
lea ecx, [ebp - 0xc4]
push eax
call fcn.00561810
mov ecx, dword [ebx + 0x2c]
cmp ecx, esi
je 0x6af70d
mov dword [ebp - 0xc8], ebx
lea eax, [ebx + 0x28]
mov dword [ebp - 0xcc], eax
lea eax, [esi + 0x58]
mov edx, esi
cmp eax, ecx
je 0x6af5cc
mov edi, esi
mov dword [ebp - 0xd4], ecx
jmp 0x6af684
sub edx, esi
add edx, esi
mov ecx, dword [ebp - 0xcc]
call fcn.006b0320
mov eax, dword [ebp - 0xc8]
mov byte [eax + 0x24], 1
cmp byte [ebp - 0xb9], 0
lea eax, [ebp - 0xc4]
jns 0x6af5fa
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov ecx, dword [ebp - 0xd0]
je 0x6af6a5
push dword [ebp + 8]
call fcn.006d8ef0
xor esi, esi
jmp 0x6af557
push dword [ebx]
call fcn.005c8b90
add esp, 4
mov eax, dword [edi + 0x7c]
mov dword [ebx + 8], eax
movsd xmm0, qword [edi + 0x74]
movsd qword [ebx], xmm0
xor eax, eax
mov byte [edi + 0x7f], al
mov byte [edi + 0x74], al
movups xmm0, xmmword [edi + 0x80]
movups xmm1, xmmword [edi + 0x90]
movups xmmword [edi + 0x28], xmm0
movups xmmword [edi + 0x38], xmm1
movsd xmm0, qword [edi + 0xa0]
movsd qword [edi + 0x48], xmm0
mov eax, dword [edi + 0xa8]
mov dword [edi + 0x50], eax
lea edx, [edi + 0x58]
add edi, 0xb0
mov ecx, dword [ebp - 0xd4]
cmp edi, ecx
mov edi, edx
je 0x6af5cc
movups xmm0, xmmword [edi + 0x58]
movups xmmword [edi], xmm0
lea ecx, [edi + 0x10]
lea eax, [edi + 0x68]
push eax
call fcn.00561870
lea ebx, [edi + 0x1c]
cmp byte [edi + 0x27], 0
jns 0x6af628
jmp 0x6af61e
mov esi, 2
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x6af557
call fcn.00646ae0
lea edi, [ebp - 0xb4]
mov ecx, edi
push eax
push 2
push 0x36f
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.00646c90
lea eax, [ebp - 0xac]
push 0xb
push str.DeleteFile
push eax
call fcn.00535510
add esp, 0xc
lea ecx, [ebp - 0xc4]
push ecx
push eax
call fcn.00647a40
add esp, 8
mov ecx, edi
call fcn.00646cf0
jmp 0x6af557
ud2
Function at 0x6b2cd0
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x24]
mov edx, dword [0x80e040]
xor edx, ebp
mov dword [ebp - 0x10], edx
test ecx, ecx
je 0x6b2cf4
mov ecx, dword [ebp + 0x20]
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
test eax, eax
je 0x6b2d04
mov eax, dword [ebp + 0x18]
xor ebx, ebx
dec ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi], ebx
push 0x10000000
push ecx
push eax
push edi
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi], 0x77a4a0
mov dword [esi + 4], eax
mov byte [esi + 8], 0
mov dword [ebp - 0x130], eax
test eax, eax
je 0x6b2e36
lea ebx, [ebp - 0x120]
push 0x110
push 0
push ebx
call fcn.005cced0
add esp, 0xc
mov dword [ebx - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x785be0]
movups xmmword [esp], xmm0
mov edi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call edi
mov esi, 3
xor ecx, ecx
inc ecx
push esi
push ecx
push edx
push eax
call edi
push esi
mov esi, dword [ebp + 8]
push 0x20
push edx
push eax
call edi
mov dword [ebx - 8], 6
xor ecx, ecx
inc ecx
mov dword [ebx - 4], ecx
mov word [ebx + 0x108], 0
lea ecx, [ebp - 0x12c]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x6b2e36
push 0x110
push 0
push ebx
call fcn.005cced0
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x785be0]
movups xmmword [esp], xmm0
call edi
mov ebx, 3
push ebx
push 1
push edx
push eax
call edi
push ebx
push 0x20
push edx
push eax
call edi
lea edi, [ebp - 0x12c]
mov dword [ebp - 0x128], 6
mov dword [ebp - 0x124], ebx
mov word [ebp - 0x18], 0
push edx
push eax
push 0x23
push edi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x6b2e36
mov dword [ebp - 0x12c], 0xa80
push 4
push edi
push 0x54
push dword [ebp - 0x130]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b4950
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx ebx, byte [ecx + 0x88]
movsx eax, byte [ecx + 0xa7]
test eax, eax
js 0x6b4a00
lea ecx, [esi + 0x9c]
test eax, eax
sete dl
test ecx, ecx
setne dh
or dh, dl
je 0x6b4a15
shl ebx, 0x17
or ebx, 0x100
lea edi, [ebp - 0x1c]
push eax
push ecx
push edi
call fcn.004a8850
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x6b49b3
mov edi, dword [ebp - 0x1c]
xor eax, eax
push ebx
push eax
push eax
push eax
push edi
push dword [esi + 0xa8]
push dword [esi + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov esi, dword [ebp + 8]
mov dword [esi], 0x77a4a0
mov dword [esi + 4], eax
mov byte [esi + 8], 0
cmp byte [ebp - 0x11], 0
jns 0x6b49ea
push dword [ebp - 0x1c]
call fcn.005c8b90
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [esi + 0xa0]
test eax, eax
js 0x6b4a15
mov ecx, dword [esi + 0x9c]
jmp 0x6b4981
ud2

Function at 0x6b4e40
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [ecx + 0x20], 0
je 0x6b4ec6
mov esi, ecx
mov eax, dword [ecx + 0xd0]
mov ecx, dword [ecx + 0xd4]
mov edx, ecx
sub edx, eax
cmp edx, 0x3fff
jbe 0x6b4e85
cmp edx, 0x4000
je 0x6b4ea4
add edx, 0xffffc000
dec ecx
cmp edx, ecx
ja 0x6b4ece
lea ecx, [eax + 0x4000]
mov dword [esi + 0xd4], ecx
jmp 0x6b4ea8
lea ecx, [esi + 0xd0]
mov eax, 0x4000
sub eax, edx
push eax
call fcn.005459f0
mov eax, dword [esi + 0xd0]
mov ecx, dword [esi + 0xd4]
cmp eax, ecx
je 0x6b4ece
sub ecx, eax
push 0
push ecx
push eax
push dword [esi + 0x20]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x6b4ecb
pop esi
pop ebp
jmp fcn.006115f0
mov eax, 0x800704c7
pop esi
pop ebp
ret
ud2
Function at 0x6da1b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov edi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x6da1d3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6da1f7
mov ebx, eax
mov al, byte [ebp + 0xc]
mov ecx, ebx
shr ecx, 0xa
xor al, 1
test cl, al
jne 0x6da24b
and ebx, 0x10
shr ebx, 4
jmp 0x6da24d
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x6da24b
call fcn.00646ae0
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0x80
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00646c90
lea eax, [ebp - 0xac]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00535510
add esp, 0xc
push edi
push eax
call fcn.00647a40
add esp, 8
mov ecx, esi
call fcn.00646cf0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6da270
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov edi, dword [ebp + 8]
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x6da293
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x6da308
cmp byte [ebp + 0x10], 0
je 0x6da2b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x6da31f
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x6da306
call fcn.00646ae0
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0x61
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00646c90
lea eax, [ebp - 0xac]
push 0x10
push str.CreateDirectory
push eax
call fcn.00535510
add esp, 0xc
push edi
push eax
call fcn.00647a40
add esp, 8
mov ecx, esi
call fcn.00646cf0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
push edi
call fcn.006da1b0
add esp, 8
test al, al
jne 0x6da308
push 2
call fcn.00560ca0
add esp, 4
test al, al
je 0x6da306
lea esi, [ebp - 0xb4]
mov ecx, esi
push 2
push 0x5c
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.004ba0e0
lea eax, [ebp - 0xac]
push edi
push eax
call fcn.00647a40
add esp, 8
push 0x10
push str._not_a_directory
push eax
call fcn.00535510
add esp, 0xc
mov ecx, esi
call fcn.004ba5c0
jmp 0x6da306