joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400afc30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov dword [rsp + 0x30], 0
xor eax, eax
cmp eax, 1
je 0x1400afc76
mov rax, qword [rsp + 0x2a0]
cmp qword [rax + 8], 0
je 0x1400afc64
mov dword [rsp + 0x38], 1
jmp 0x1400afc6c
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x3c], eax
jmp 0x1400afc7e
mov dword [rsp + 0x3c], 0
cmp dword [rsp + 0x3c], 0
jne 0x1400afc8a
jmp 0x1400afd19
lea rcx, [rsp + 0x34]
call fcn.140004910
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x18
lea r8, [0x1401842e0]
lea rdx, [0x140184368]
lea rcx, [rsp + 0x80]
call fcn.1400b5f40
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x48]
call fcn.140004910
lea rdx, str.Check_failed:__platform_thread_
mov rcx, rax
call fcn.140003dd0
lea rdx, [0x1401842b0]
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.140004830
nop
mov eax, dword [rsp + 0x30]
and eax, 1
test eax, eax
je 0x1400afd36
and dword [rsp + 0x30], 0xfffffffe
lea rcx, [rsp + 0x80]
call fcn.1400b60e0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x2a0]
lea r8, [0x1400b0080]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x2a0]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x2a0]
cmp qword [rax + 8], 0
je 0x1400afd80
jmp 0x1400afe27
lea rcx, [rsp + 0x35]
call fcn.140004910
mov qword [rsp + 0x78], rax
call fcn.1400b5d50
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 4
mov r9d, 0x1b
lea r8, [0x1401843e0]
lea rdx, str.void___cdecl_crashpad::Thread::Start_void_
lea rcx, [rsp + 0x180]
call fcn.1400b67e0
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x30]
or eax, 2
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x68]
call fcn.140004910
lea rdx, [0x1401843a8]
mov rcx, rax
call fcn.140003dd0
lea rdx, [0x1401842d8]
mov rcx, rax
call fcn.140003dd0
lea rdx, [0x140184398]
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call fcn.140004830
nop
mov eax, dword [rsp + 0x30]
and eax, 2
test eax, eax
je 0x1400afe44
and dword [rsp + 0x30], 0xfffffffd
lea rcx, [rsp + 0x180]
call fcn.1400b6840
add rsp, 0x298
ret
Function at 0x1400b29c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x288
lea rdx, [0x140185830]
lea rcx, [rsp + 0x2a0]
call fcn.140007690
mov eax, dword [rax]
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400b2a29
mov rax, 0xffffffffffffffff
jmp 0x1400b2b29
mov dword [rsp + 0x38], 0xffffffff
lea r8, str.bytes_written___static_cast_DWORD___1_
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.1400b41b0
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x1400b2aa0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x65
lea r8, [0x140185b90]
lea rdx, [0x140185c40]
lea rcx, [rsp + 0x78]
call fcn.1400b5fe0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140004910
nop
lea rcx, [rsp + 0x78]
call fcn.1400b60e0
xor eax, eax
cmp eax, 1
je 0x1400b2b25
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x60], rax
lea r8, str.static_cast_size_t__bytes_written____write_size
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x60]
call fcn.1400a3f30
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1400b2b25
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x66
lea r8, [0x140185ca0]
lea rdx, str.__int64___cdecl_crashpad::internal::NativeWriteFile_void__const_void__unsigned___int64_
lea rcx, [rsp + 0x178]
call fcn.1400b5fe0
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.140004910
nop
lea rcx, [rsp + 0x178]
call fcn.1400b60e0
mov eax, dword [rsp + 0x30]
add rsp, 0x288
ret
Function at 0x1400b39a0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov dword [rsp + 0x30], 0
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x170]
call fcn.1400b3750
test rax, rax
je 0x1400b39d2
xor al, al
jmp 0x1400b3a9d
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400b3a9b
call fcn.1400b3ed0
cmp eax, 2
jle 0x1400b39f7
jmp 0x1400b3a7d
lea rcx, [rsp + 0x34]
call fcn.140004910
mov qword [rsp + 0x50], rax
call fcn.1400b5d50
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0xfb
lea r8, [0x1401867f0]
lea rdx, str.bool___cdecl_crashpad::LoggingTruncateFile_void__
lea rcx, [rsp + 0x58]
call fcn.1400b67e0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x40]
call fcn.140004910
lea rdx, [0x1401867d8]
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call fcn.140004830
nop
mov eax, dword [rsp + 0x30]
and eax, 1
test eax, eax
je 0x1400b3a97
and dword [rsp + 0x30], 0xfffffffe
lea rcx, [rsp + 0x58]
call fcn.1400b6840
xor al, al
jmp 0x1400b3a9d
mov al, 1
add rsp, 0x168
ret
Function at 0x1400b60e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
mov rax, qword [0x1401c00d8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x30], rax
lea rdx, [0x1400b6c30]
mov rcx, qword [rsp + 0x30]
call fcn.1400b6c90
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
call fcn.1400129b0
cmp qword [0x1401c39c0], 0
je 0x1400b61b8
mov rax, qword [0x1401c39c0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xf0]
mov r9, qword [rax + 0xf0]
mov rax, qword [rsp + 0xf0]
mov r8d, dword [rax + 0xf8]
mov rax, qword [rsp + 0xf0]
mov rdx, qword [rax + 0xe8]
mov rax, qword [rsp + 0xf0]
mov ecx, dword [rax + 0xfc]
call qword [rsp + 0x40]
movzx eax, al
test eax, eax
je 0x1400b61b8
lea rcx, [rsp + 0x80]
call fcn.140009160
jmp 0x1400b629a
mov eax, dword [0x1401c0010]
and eax, 4
test eax, eax
je 0x1400b620e
lea rcx, [rsp + 0x80]
call fcn.14000f820
mov qword [rsp + 0x48], rax
mov ecx, 2
call fcn.1400d2250
mov qword [rsp + 0x50], rax
mov r8, qword [rsp + 0x48]
lea rdx, [0x14018707c]
mov rcx, qword [rsp + 0x50]
call fcn.140013220
mov ecx, 2
call fcn.1400d2250
mov rcx, rax
call fcn.1400e0380
mov eax, dword [0x1401c0010]
and eax, 2
test eax, eax
je 0x1400b6279
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
call fcn.140007a10
lea rcx, [rsp + 0x60]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xa0]
call fcn.1400b7650
mov rcx, rax
call fcn.14000f840
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0xa0]
call fcn.140009190
mov rax, qword [rsp + 0xf0]
cmp dword [rax + 0xfc], 4
jne 0x1400b628d
int3
lea rcx, [rsp + 0x80]
call fcn.140009160
mov rax, qword [rsp + 0xf0]
mov rcx, rax
call fcn.14000a6c0
nop
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400cb890
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x1400b8080
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov dword [rsp + 0x34], 0
cmp qword [rsp + 0x188], 0
jne 0x1400b80a9
jmp 0x1400b81fa
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x188], 0
jbe 0x1400b81fa
call fcn.140010f60
mov eax, eax
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x188]
call fcn.140007690
mov eax, dword [rax]
mov dword [rsp + 0x3c], eax
mov edx, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x40]
call sub.ADVAPI32.dll_SystemFunction036
movzx eax, al
test eax, eax
je 0x1400b8105
mov byte [rsp + 0x30], 1
jmp 0x1400b810a
mov byte [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x31], al
movzx eax, byte [rsp + 0x31]
test eax, eax
je 0x1400b8121
jmp 0x1400b81ad
lea rcx, [rsp + 0x38]
call fcn.140004910
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x7d
lea r8, str.C:JenkinswACVSMainACVS_Main_NoWIP_WinACVSSoftwareExternalLibraries_sentry_nativeexternalcrashpad_third_partymini_chromiummini_chromium_base_rand_util.cc
lea rdx, str.void___cdecl_base::RandBytes_void__unsigned___int64_
lea rcx, [rsp + 0x70]
call fcn.1400b5f40
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x34]
or eax, 1
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x58]
call fcn.140004910
lea rdx, str.Check_failed:_success
mov rcx, rax
call fcn.140003dd0
lea rdx, [0x140187a3c]
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.140004830
nop
mov eax, dword [rsp + 0x34]
and eax, 1
test eax, eax
je 0x1400b81c7
and dword [rsp + 0x34], 0xfffffffe
lea rcx, [rsp + 0x70]
call fcn.1400b60e0
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x188]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x188], rax
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1400b80b6
add rsp, 0x178
ret
Function at 0x1400cc3c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400cc40e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400cc40e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400cc40e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400cc40e
cmp dword [rcx + 0x84], 0xe
jbe 0x1400cc40e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400cc410
xor al, al
add rsp, 0x28
ret

Function at 0x1400e6518
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400e6308
Function at 0x1400f0ffc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400f102c
xor eax, eax
jmp 0x1400f10ef
mov rbp, rbx
cmp word [rax], si
je 0x1400f1051
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400f1038
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400f1034
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400ed390
movsxd r14, eax
test eax, eax
jne 0x1400f108f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400f1025
mov rcx, r14
call fcn.1400eaebc
mov rdi, rax
test rax, rax
jne 0x1400f10a8
xor ecx, ecx
call fcn.1400e998c
jmp 0x1400f1084
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400ed390
test eax, eax
jne 0x1400f10d9
mov rcx, rdi
call fcn.1400e998c
jmp 0x1400f10e3
xor ecx, ecx
call fcn.1400e998c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400f110c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400f1193
mov rsi, rbx
cmp word [rax], bp
je 0x1400f1152
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400f113c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400f1138
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400eaebc
mov rdi, rax
test rax, rax
je 0x1400f1180
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400cc590
mov rbp, rdi
xor ecx, ecx
call fcn.1400e998c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f77b0
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400d8db4
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400f783a
cmp byte [rbp - 0x21], r15b
je 0x1400f7835
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400f7870
call fcn.1400ea25c
test eax, eax
jne 0x1400f785c
cmp byte [rbp - 0x21], r15b
je 0x1400f7854
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400f7870
cmp byte [rbp - 0x21], r15b
je 0x1400f786d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400d8b1c
test eax, eax
jne 0x1400f7910
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400d8db4
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400f78af
cmp byte [rbp - 0x21], r15b
je 0x1400f78e4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400f78e4
call fcn.1400ea25c
test eax, eax
jne 0x1400f78d0
cmp byte [rbp - 0x21], r15b
je 0x1400f78c9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400f78e4
cmp byte [rbp - 0x21], r15b
je 0x1400f78e1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400d8b1c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400f7910
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400f7913
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400f7921
mov rcx, rdi
call fcn.1400e998c
cmp byte [rbp + 0x3f], r15b
je 0x1400f7930
mov rcx, qword [rbp + 0x27]
call fcn.1400e998c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400fc2e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
add rax, 0x10
mov rcx, rax
call fcn.140004910
mov rcx, rax
call fcn.14000f840
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x1400fc31d
mov eax, 1
jmp 0x1400fc33e
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
je 0x1400fc332
mov dword [rsp + 0x24], 2
jmp 0x1400fc33a
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret
Function at 0x1400fdeb0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x1d8
mov rax, qword [0x1401c00d8]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x1f0]
call fcn.140004910
mov rcx, rax
call fcn.14000f840
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400fdf03
mov al, 1
jmp 0x1400fe081
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400fe074
call fcn.1400f95b0
cmp eax, 2
jle 0x1400fdf23
jmp 0x1400fe035
lea rcx, [rsp + 0x34]
call fcn.140004910
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x1f0]
call fcn.140004910
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call fcn.14001b780
lea rcx, [rsp + 0x80]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x1a8]
call fcn.1400b75a0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
call fcn.1400b5d50
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x266
lea r8, [0x14019a7b0]
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::CreateDirectoryIfNecessary_const_class_base::FilePath__
lea rcx, [rsp + 0xa0]
call fcn.1400b67e0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x30]
or eax, 2
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x58]
call fcn.140004910
lea rdx, [0x14019a2e8]
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.140003a20
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call fcn.140004830
nop
mov eax, dword [rsp + 0x30]
and eax, 2
test eax, eax
je 0x1400fe053
and dword [rsp + 0x30], 0xfffffffd
lea rcx, [rsp + 0xa0]
call fcn.1400b6840
nop
mov eax, dword [rsp + 0x30]
and eax, 1
test eax, eax
je 0x1400fe070
and dword [rsp + 0x30], 0xfffffffe
lea rcx, [rsp + 0x1a8]
call fcn.140009160
xor al, al
jmp 0x1400fe081
mov rcx, qword [rsp + 0x1f0]
call fcn.1400fdb20
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.1400cb890
add rsp, 0x1d8
pop rdi
pop rsi
ret
Function at 0x140112d70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x1e8
mov rax, qword [0x1401c00d8]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x200]
call fcn.140004910
mov rcx, rax
call fcn.14000f840
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0xffffffff
jne 0x140112f2b
call fcn.140113880
cmp eax, 2
jle 0x140112dd4
jmp 0x140112eec
lea rcx, [rsp + 0x34]
call fcn.140004910
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x200]
call fcn.140004910
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call fcn.14001b780
lea rcx, [rsp + 0x90]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x1b8]
call fcn.1400b75a0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
call fcn.1400b5d50
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x75
lea r8, [0x1401a3180]
lea rdx, str.bool___cdecl_crashpad::IsRegularFile_const_class_base::FilePath__
lea rcx, [rsp + 0xb0]
call fcn.1400b67e0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x30]
or eax, 2
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x60]
call fcn.140004910
lea rdx, [0x1401a2c28]
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call fcn.140003a20
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call fcn.140004830
nop
mov eax, dword [rsp + 0x30]
and eax, 2
test eax, eax
je 0x140112f0a
and dword [rsp + 0x30], 0xfffffffd
lea rcx, [rsp + 0xb0]
call fcn.1400b6840
nop
mov eax, dword [rsp + 0x30]
and eax, 1
test eax, eax
je 0x140112f27
and dword [rsp + 0x30], 0xfffffffe
lea rcx, [rsp + 0x1b8]
call fcn.140009160
xor al, al
jmp 0x140112f49
mov eax, dword [rsp + 0x38]
and eax, 0x10
test eax, eax
jne 0x140112f43
mov eax, dword [rsp + 0x38]
and eax, 0x400
test eax, eax
je 0x140112f47
xor al, al
jmp 0x140112f49
mov al, 1
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.1400cb890
add rsp, 0x1e8
pop rdi
pop rsi
ret
Function at 0x140112f70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x1e8
mov rax, qword [0x1401c00d8]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x200]
call fcn.140004910
mov rcx, rax
call fcn.14000f840
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0xffffffff
jne 0x14011312f
call fcn.140113880
cmp eax, 2
jle 0x140112fd8
jmp 0x1401130f0
lea rcx, [rsp + 0x34]
call fcn.140004910
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x200]
call fcn.140004910
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call fcn.14001b780
lea rcx, [rsp + 0x90]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x1b8]
call fcn.1400b75a0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
call fcn.1400b5d50
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x82
lea r8, [0x1401a3260]
lea rdx, str.bool___cdecl_crashpad::IsDirectory_const_class_base::FilePath__bool_
lea rcx, [rsp + 0xb0]
call fcn.1400b67e0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x30]
or eax, 2
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x60]
call fcn.140004910
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.140003dd0
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call fcn.140003a20
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call fcn.140004830
nop
mov eax, dword [rsp + 0x30]
and eax, 2
test eax, eax
je 0x14011310e
and dword [rsp + 0x30], 0xfffffffd
lea rcx, [rsp + 0xb0]
call fcn.1400b6840
nop
mov eax, dword [rsp + 0x30]
and eax, 1
test eax, eax
je 0x14011312b
and dword [rsp + 0x30], 0xfffffffe
lea rcx, [rsp + 0x1b8]
call fcn.140009160
xor al, al
jmp 0x14011316e
movzx eax, byte [rsp + 0x208]
test eax, eax
jne 0x14011314c
mov eax, dword [rsp + 0x38]
and eax, 0x400
test eax, eax
je 0x14011314c
xor al, al
jmp 0x14011316e
mov eax, dword [rsp + 0x38]
and eax, 0x10
test eax, eax
je 0x140113161
mov dword [rsp + 0x3c], 1
jmp 0x140113169
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.1400cb890
add rsp, 0x1e8
pop rdi
pop rsi
ret