joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140094ab0
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r8
mov r14, rdx
mov rdi, rcx
cmp qword [rcx + 0x10], 0
jne 0x140094ae3
mov rcx, qword [rsp + 0x70]
mov rdx, r9
call fcn.1400e2b90
mov qword [rdi + 0x10], rax
test rax, rax
je 0x140094bf2
mov esi, dword [rsp + 0x78]
lea rcx, [0x1403b50f0]
lea rdx, [0x140098b70]
call fcn.14018b320
lea rax, [0x1403b50f8]
mov qword [rdi + 0x18], rax
mov rcx, qword [rdi + 0x10]
cmp esi, 1
jne 0x140094bf6
call fcn.1400e2ec0
test eax, eax
je 0x140094bf2
test rbx, rbx
je 0x140094b38
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
call fcn.1400e35d0
test eax, eax
je 0x140094bf2
mov rax, qword [rdi + 0x10]
mov rax, qword [rax]
test esi, esi
je 0x140094c00
add rax, 0x38
cmp qword [rax], 0
je 0x140094bca
test rbx, rbx
je 0x140094c09
cmp qword [rdi], rbx
je 0x140094b83
mov ecx, dword [rbx + 0x2c]
call fcn.14018af30
test rax, rax
je 0x140094c29
mov rsi, rax
mov rcx, qword [rdi + 8]
call fcn.14018af70
mov qword [rdi + 8], rsi
mov qword [rdi], rbx
mov rax, qword [rbx + 0x10]
lea rcx, [0x1402431b0]
cmp rax, rcx
jne 0x140094be7
mov rax, qword [rdi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x14033b1d0]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x14033b1e0]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov ebx, 1
test r14, r14
je 0x140094bdb
mov rax, qword [rdi + 0x10]
mov qword [r14], rax
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rdi
call qword [0x1403de008]
jmp 0x140094bca
xor ebx, ebx
jmp 0x140094bdb
call fcn.140299970
jmp 0x140094b17
add rax, 0x28
jmp 0x140094b4b
mov dword [rsp + 0x20], 0x6d
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduledigestsigndigestsign.c
xor ebx, ebx
mov ecx, 6
xor edx, edx
mov r8d, 0x77
jmp 0x140094c47
mov dword [rsp + 0x20], 0xd2
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduledigestdigest.c
xor ebx, ebx
mov ecx, 0x1d
xor edx, edx
mov r8d, 0x41
call fcn.140299620
jmp 0x140094bdb
Function at 0x140094d20
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov rsi, r8
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x98], rax
xorps xmm0, xmm0
lea rdi, [rsp + 0x50]
movups xmmword [rdi + 0x34], xmm0
movups xmmword [rdi + 0x28], xmm0
movups xmmword [rdi + 0x18], xmm0
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi - 8], xmm0
movaps xmm0, xmmword [0x14033b1d0]
movups xmmword [rdi - 0x28], xmm0
movaps xmm0, xmmword [0x14033b1e0]
movups xmmword [rdi - 0x18], xmm0
mov dword [rdi + 0x44], 0x20
test rdx, rdx
je 0x140094dde
mov rbx, rdx
mov r14, rcx
lea eax, [rdx*8]
mov rcx, rdx
shr rcx, 0x1d
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x48], eax
cmp rdx, 0x40
jb 0x140094dc8
mov r8, rbx
shr r8, 6
lea rcx, [rsp + 0x28]
mov rdx, r14
call fcn.1400138c0
mov r8, rbx
and r8, 0x3f
je 0x140094dde
and rbx, 0xffffffffffffffc0
add r14, rbx
jmp 0x140094dcb
mov r8, rbx
mov dword [rsp + 0x90], r8d
mov rcx, rdi
mov rdx, r14
call fcn.1401bcb50
mov eax, dword [rsp + 0x90]
lea rcx, [rax + 1]
mov r14d, dword [rsp + 0x48]
mov ebp, dword [rsp + 0x4c]
mov byte [rsp + rax + 0x50], 0x80
cmp rax, 0x38
jae 0x140094ea7
cmp rcx, 0x38
je 0x140094e1a
mov r8d, 0x38
sub r8, rcx
add rcx, rdi
xor edx, edx
call fcn.1401bd200
bswap ebp
lea rbx, [rsp + 0x28]
mov dword [rbx + 0x60], ebp
bswap r14d
mov dword [rbx + 0x64], r14d
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call fcn.1400138c0
xorps xmm0, xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
mov dword [rdi + 0x40], 0
mov eax, dword [rbx + 0x6c]
lea ecx, [rax - 0x21]
cmp ecx, 0xffffffe3
jb 0x140094e77
shr rax, 2
xor ecx, ecx
mov edx, dword [rsp + rcx*4 + 0x28]
bswap edx
mov dword [rsi + rcx*4], edx
inc rcx
cmp rax, rcx
jne 0x140094e66
lea rcx, [rsp + 0x28]
mov edx, 0x70
call fcn.14018afb0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401bb0d0
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
cmp eax, 0x3f
je 0x140094ebf
mov r8d, 0x3f
sub r8, rax
add rcx, rdi
xor edx, edx
call fcn.1401bd200
lea rcx, [rsp + 0x28]
mov r8d, 1
mov rdx, rdi
call fcn.1400138c0
xor ecx, ecx
jmp 0x140094e07
Function at 0x1400976c0
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm8
movaps xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0x28], r9
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov esi, 1
test rdx, rdx
je 0x14009788a
mov r13, r8
mov rdi, rdx
mov rbx, rcx
mov r14, qword [rsp + 0x150]
mov r12d, dword [r14 + 4]
xor r15d, r15d
movaps xmm8, xmmword [0x14033b1d0]
movaps xmm7, xmmword [0x14033b1e0]
lea rsi, [rsp + 0x30]
mov eax, r15d
bswap eax
mov dword [rsp + 0x5c], eax
cmp qword [rsp + 0x30], r14
je 0x140097783
mov ecx, dword [r14 + 0x2c]
call fcn.14018af30
test rax, rax
je 0x1400978ed
mov rbp, rax
mov rcx, qword [rsp + 0x38]
call fcn.14018af70
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r14
mov rax, qword [r14 + 0x10]
lea rcx, [0x1402431b0]
cmp rax, rcx
jne 0x1400978dd
mov rax, qword [rsp + 0x38]
movups xmmword [rax + 0x5c], xmm6
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax], xmm8
movups xmmword [rax + 0x10], xmm7
mov dword [rax + 0x6c], 0x20
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov rcx, rsi
mov rdx, r13
mov r8, qword [rsp + 0x28]
call qword [0x1403de008]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov r8d, 4
mov rcx, rsi
lea rdx, [rsp + 0x5c]
call qword [0x1403de008]
cmp rdi, r12
jb 0x140097833
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
mov rcx, rsi
mov rdx, rbx
call qword [0x1403de008]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov edx, dword [rax + 0x2c]
call fcn.14018afb0
add rbx, r12
inc r15d
sub rdi, r12
jne 0x14009774a
jmp 0x140097885
movaps xmm0, xmmword [0x14032f5c0]
lea rsi, [rsp + 0x60]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rbp, [rsp + 0x30]
mov rax, qword [rbp]
mov rax, qword [rax + 0x20]
mov rcx, rbp
mov rdx, rsi
call qword [0x1403de008]
mov rax, qword [rbp]
mov rcx, qword [rbp + 8]
mov edx, dword [rax + 0x2c]
call fcn.14018afb0
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.1401bcb50
mov esi, 1
mov rcx, qword [rsp + 0x38]
call fcn.14018af70
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x140097915
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xb0]
movaps xmm7, xmmword [rsp + 0xc0]
movaps xmm8, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x30]
call qword [0x1403de008]
jmp 0x1400977bf
mov dword [rsp + 0x20], 0xd2
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduledigestdigest.c
xor esi, esi
mov ecx, 0x1d
xor edx, edx
mov r8d, 0x41
call fcn.140299620
jmp 0x14009788a
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [0x1403de008]
jmp 0x14009789e
Function at 0x14009c670
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r8d, edx
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp edx, 0x921
jg 0x14009c6b3
cmp r8d, 0x692
je 0x14009c6ce
cmp r8d, 0x7da
jne 0x14009c6f3
lea rdi, [0x14033db90]
jmp 0x14009c6de
cmp r8d, 0x922
je 0x14009c6d7
cmp r8d, 0xdf0
jne 0x14009c6f3
lea rdi, [0x14033dbb0]
jmp 0x14009c6de
lea rdi, [0x14033db80]
jmp 0x14009c6de
lea rdi, [0x14033dba0]
call fcn.14008c060
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x10]
movsxd rax, dword [rax + 8]
mov r8d, dword [rdi + rax*4]
mov rcx, qword [0x1403b5578]
test rcx, rcx
je 0x14009c72b
mov rax, qword [rcx]
mov rax, qword [rax + 8]
mov rdx, rsi
call qword [0x1403de008]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401bb0d0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
movsxd rbx, r8d
call fcn.14024cea0
add rbx, qword [rax + 0x30]
mov rax, rbx
shr rax, 0x20
jne 0x14009c873
mov r14, qword [0x1403b1cc8]
mov eax, ebx
shr eax, 4
inc eax
movzx edx, ax
mov r8d, 6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14009c70f
mov r15, rax
mov rcx, r14
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14009c70f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14009c70f
mov rdi, rax
mov rcx, r14
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
setne cl
and ebx, 0xf
je 0x14009c7df
test eax, eax
je 0x14009c7df
mov ecx, eax
mov rax, rdi
add rax, rcx
dec ebx
movzx ecx, word [rdi]
lea rdi, [rdi + rcx*2]
add rdi, 2
cmp rdi, rax
setb cl
add ebx, 0xffffffff
jae 0x14009c7df
cmp rdi, rax
jb 0x14009c7c4
test cl, cl
je 0x14009c70f
movzx ebx, word [rdi]
test rbx, rbx
je 0x14009c70f
test rdi, rdi
je 0x14009c70f
add rdi, 2
cmp bx, 0xa
ja 0x14009c811
lea r14, [rsp + 0x20]
mov byte [r14 + 0x17], bl
jmp 0x14009c839
lea r15d, [rbx + 8]
and r15d, 0xfffffff8
lea rcx, [r15 + r15]
call fcn.1401b9cac
mov r14, rax
mov qword [rsp + 0x20], rax
bts r15, 0x3f
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rbx
lea r8, [rbx + rbx]
mov rcx, r14
mov rdx, rdi
call fcn.1401bcb50
mov word [r14 + rbx*2], 0
cmp byte [rsi + 0x17], 0
jns 0x14009c85d
mov rcx, qword [rsi]
call fcn.1401b9ce8
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
jmp 0x14009c70f
int3
Function at 0x14009d530
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x238], rax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.14009be20
test al, al
je 0x14009d65c
mov rcx, rsi
call fcn.14009d690
test al, al
je 0x14009d59c
call fcn.14008c060
mov rax, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov rcx, rdi
mov rdx, rsi
xor r9d, r9d
call fcn.1400a1970
test al, al
jne 0x14009d65c
lea rbx, [rsp + 0x30]
mov r8d, 0x200
mov rcx, rbx
mov dl, 0xaa
call fcn.1401bd200
lea rdx, [rsp + 0x2c]
mov dword [rdx], 0x100
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14009d61f
mov edx, dword [rsp + 0x2c]
test edx, edx
je 0x14009d61f
mov rcx, rsi
call fcn.14005cdf0
mov edx, 1
mov rcx, rsi
mov r8w, 0x2e
call fcn.14005d2e0
mov r8d, dword [rsp + 0x2c]
dec r8d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14015cb00
call fcn.14008c060
mov rax, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov rcx, rdi
mov rdx, rsi
xor r9d, r9d
call fcn.1400a1970
test al, al
jne 0x14009d65c
cmp byte [rsi + 0x17], 0
jns 0x14009d67a
mov rax, qword [rsi]
mov qword [rsi + 8], 0
mov word [rax], 0
call fcn.14008c060
mov rax, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov rcx, rdi
mov rdx, rsi
xor r9d, r9d
call fcn.1400a1970
test al, al
jne 0x14009d65c
mov rcx, rsi
call fcn.14009d690
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.1401bb0d0
mov rax, rsi
add rsp, 0x240
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x17], 0
mov rax, rsi
jmp 0x14009d630
Function at 0x1400ad640
Capabilities:
Prepare http request

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx ebp, byte [rcx + 0xd0]
shl ebp, 0x17
or ebp, 0x100
lea rax, [rcx + 0xf8]
movzx ebx, byte [rcx + 0x10f]
mov ecx, ebx
and ecx, 0x7f
test bl, bl
cmovs rax, qword [rdi + 0xf8]
mov rsi, rdx
lea rdx, [rsp + 0x38]
mov qword [rdx], rax
cmovs rcx, qword [rdi + 0x100]
mov qword [rdx + 8], rcx
lea rbx, [rsp + 0x48]
mov rcx, rbx
call fcn.1402ada50
cmp byte [rbx + 0x17], 0
jns 0x1400ad6b6
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rdi + 0x28]
mov rdx, qword [rdi + 0x110]
mov dword [rsp + 0x30], ebp
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
lea rcx, [0x1403276f8]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov byte [rsi + 0x10], 0
cmp byte [rsp + 0x5f], 0
jns 0x1400ad6fc
mov rcx, qword [rsp + 0x48]
call fcn.1401b9ce8
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401bb0d0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400ad930
Capabilities:
Receive http response

Disassembly:
push rsi
push rdi
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x180], rax
xorps xmm0, xmm0
lea r9, [rsp + 0x160]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], 0
mov rcx, qword [rcx + 0x40]
mov edx, 0x80000016
xor r8d, r8d
call fcn.1400f3d50
lea rcx, str.....componentswinhttp_network_fetcher.cc
mov edx, 0x2c
call fcn.140160690
cmp eax, 3
jge 0x1400ad9f1
mov rcx, qword [rsi + 0x40]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x1400ad9a8
mov dword [rsi + 0x140], 0
jmp 0x1400ad9bf
call fcn.1400f3d20
mov dword [rsi + 0x140], eax
test eax, eax
jns 0x1400ad9bf
mov rcx, rsi
call fcn.1400aca70
cmp byte [rsp + 0x177], 0
jns 0x1400ad9d6
mov rcx, qword [rsp + 0x160]
call fcn.1401b9ce8
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1401bb0d0
nop
add rsp, 0x188
pop rdi
pop rsi
ret
lea rdx, str.....componentswinhttp_network_fetcher.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x114
mov r9d, 0xfffffffd
call fcn.140076020
lea rcx, [rsp + 0x38]
lea rdx, str.request_headers:
mov r8d, 0x11
call fcn.1401f9cc0
lea rdx, [rsp + 0x160]
mov rcx, rax
call fcn.140076a50
mov rcx, rdi
call fcn.140076510
jmp 0x1400ad98c
Function at 0x1400ada50
Capabilities:
Receive http response

Disassembly:
push rsi
push rdi
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x180], rax
xorps xmm0, xmm0
lea r9, [rsp + 0x160]
movaps xmmword [r9], xmm0
mov qword [r9 + 0x10], 0
mov rcx, qword [rcx + 0x40]
mov edx, 0x16
xor r8d, r8d
call fcn.1400f3d50
lea rcx, str.....componentswinhttp_network_fetcher.cc
mov edx, 0x2c
call fcn.140160690
cmp eax, 3
jge 0x1400adbf7
lea r9, [rsi + 0x160]
mov rcx, qword [rsi + 0x40]
mov edx, 0x13
xor r8d, r8d
call fcn.1400f40c0
mov dword [rsi + 0x140], eax
test eax, eax
js 0x1400adbbd
lea r9, [rsp + 0x24]
mov dword [r9], 0
mov rcx, qword [rsi + 0x40]
mov edx, 5
xor r8d, r8d
call fcn.1400f40c0
mov dword [rsi + 0x140], eax
test eax, eax
js 0x1400adbbd
movsxd r8, dword [rsp + 0x24]
mov edx, dword [rsi + 0x160]
mov rcx, qword [rsi + 0x1d0]
lea rdi, [rsp + 0x28]
mov qword [rdi], rcx
mov qword [rsi + 0x1d0], 0
mov rax, qword [rcx + 8]
call qword [0x1403de008]
mov rcx, rdi
call fcn.14015d760
mov rdx, qword [rsi + 0x148]
mov r8, qword [rsi + 0x150]
mov rax, r8
sub rax, rdx
cmp rax, 0x3fff
ja 0x1400adb78
lea rcx, [rsi + 0x148]
mov edx, 0x4000
sub rdx, rax
call fcn.14004c450
mov rdx, qword [rsi + 0x148]
mov r8, qword [rsi + 0x150]
jmp 0x1400adb8e
cmp rax, 0x4000
je 0x1400adb8e
lea r8, [rdx + 0x4000]
mov qword [rsi + 0x150], r8
sub r8d, edx
mov rcx, qword [rsi + 0x40]
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1400adbae
mov dword [rsi + 0x140], 0
jmp 0x1400adbc5
call fcn.1400f3d20
mov dword [rsi + 0x140], eax
test eax, eax
jns 0x1400adbc5
mov rcx, rsi
call fcn.1400aca70
cmp byte [rsp + 0x177], 0
jns 0x1400adbdc
mov rcx, qword [rsp + 0x160]
call fcn.1401b9ce8
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1401bb0d0
nop
add rsp, 0x188
pop rdi
pop rsi
ret
lea rdx, str.....componentswinhttp_network_fetcher.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x128
mov r9d, 0xfffffffd
call fcn.140076020
lea rcx, [rsp + 0x38]
lea rdx, str.response_headers:
mov r8d, 0x12
call fcn.1401f9cc0
lea rdx, [rsp + 0x160]
mov rcx, rax
call fcn.140076a50
mov rcx, rdi
call fcn.140076510
jmp 0x1400adab0
Function at 0x1400aebd0
Capabilities:
Initialize winhttp library

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x158
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x150], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x10], rax
mov dword [rsp + 0x20], 0x10000000
mov rcx, rdx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rdi, rax
lea rax, [0x1403276f8]
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov byte [rsi + 0x10], 0
test rdi, rdi
je 0x1400aed48
lea rbx, [rsp + 0x3c]
mov r8d, 0x110
mov rcx, rbx
xor edx, edx
call fcn.1401bd200
mov dword [rbx - 0xc], 0x11c
mov r14, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
movabs rcx, 0x100000006
mov qword [rbx - 8], rcx
mov word [rbx + 0x108], 0
lea rcx, [rsp + 0x30]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x1400aed48
lea rbx, [rsp + 0x3c]
mov r8d, 0x110
mov rcx, rbx
xor edx, edx
call fcn.1401bd200
mov dword [rbx - 0xc], 0x11c
xor ecx, ecx
mov edx, 2
mov r8b, 3
call r14
mov rcx, rax
mov edx, 1
mov r8b, 3
call r14
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call r14
movabs rcx, 0x300000006
mov qword [rbx - 8], rcx
mov word [rbx + 0x108], 0
lea rcx, [rsp + 0x30]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x1400aed48
lea r8, [rsp + 0x30]
mov dword [r8], 0xa80
mov rcx, rdi
mov edx, 0x54
mov r9d, 4
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401bb0d0
mov rax, rsi
add rsp, 0x158
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400c5b30
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x1400c5b57
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400c5b91
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400c5bb0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401bb0d0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.1400c5c80
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140160660
test al, al
jne 0x1400c5bc2
xor esi, esi
jmp 0x1400c5b94
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x266
mov r9d, 2
call fcn.140224610
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1401f9cc0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14016a3b0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400c5c48
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
jmp 0x1400c5c4c
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.1401f9cc0
cmp byte [rsp + 0x4f], 0
jns 0x1400c5c68
mov rcx, qword [rsp + 0x38]
call fcn.1401b9ce8
lea rcx, [rsp + 0x50]
call fcn.140224690
jmp 0x1400c5bbe
Function at 0x1400c5c80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x1400c5ca7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400c5cd9
mov dil, 1
test al, 0x10
je 0x1400c5d78
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140160660
test al, al
je 0x1400c5d86
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x251
mov r9d, 2
call fcn.140224610
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401f9cc0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x38]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.14016a3b0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400c5e0a
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
jmp 0x1400c5e0e
mov ecx, 2
call fcn.140160660
test al, al
jne 0x1400c5d8d
xor edi, edi
jmp 0x1400c5cbd
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x255
mov r9d, 2
call fcn.140076020
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401f9cc0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.14016a3b0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400c5e39
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
jmp 0x1400c5e3d
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.1401f9cc0
cmp byte [rsp + 0x5f], 0
jns 0x1400c5e2a
mov rcx, qword [rsp + 0x48]
call fcn.1401b9ce8
lea rcx, [rsp + 0x60]
call fcn.140224690
jmp 0x1400c5d86
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.1401f9cc0
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1401f9cc0
cmp byte [rsp + 0x5f], 0
jns 0x1400c5e6e
mov rcx, qword [rsp + 0x48]
call fcn.1401b9ce8
lea rcx, [rsp + 0x60]
call fcn.140076510
jmp 0x1400c5d86