joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c7b300
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x26d8]
mov ebx, dword [eax + ecx*4]
xorps xmm0, xmm0
movups xmmword [ebx + 0x8058], xmm0
movups xmmword [ebx + 0x8048], xmm0
mov dword [ebx + 0x8068], 0
mov dword [ebx + 0x8044], 0x28
lea edi, [ebx + 0x40]
push 0x8000
push 0
push edi
call fcn.01cb76e0
add esp, 0xc
mov dword [ebx + 0x8058], edi
lea edi, [ebx + 0x805c]
mov dword [ebx + 0x805c], 0x8000
mov ecx, dword [ebx + 0x8040]
test ecx, ecx
je 0x1c7b37a
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 8]
sub eax, dword [ecx + 0x18]
add eax, 1
jmp 0x1c7b393
mov eax, dword [esi + 0x5d100]
mov ecx, dword [esi + 0x5d104]
and ecx, eax
cmp ecx, 0xffffffff
je 0x1c7b3a2
sub eax, dword [esi + 0x5d110]
cmp eax, 0x8000
mov ecx, 0x8000
cmovl ecx, eax
mov dword [edi], ecx
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x28], 9
mov eax, dword [ebx + 0x20]
cmp dword [eax + 4], 1
jne 0x1c7b3e2
push edi
push dword [ebx + 0x805c]
push dword [ebx + 0x8058]
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1c7b3f9
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
jmp 0x1c7b417
lea eax, [ebx + 0x8044]
push ebx
push 1
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFileExA]
test eax, eax
jne 0x1c7b3d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov al, 1
cmp ecx, 0x3e5
je 0x1c7b417
mov ecx, esi
push dword [ebp + 8]
call fcn.01c7ba00
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x1c7b810
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1040
call fcn.01cb35d0
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0x2480], 0
mov eax, 0x1ce9ee4
mov edi, str.POST
cmove edi, eax
movsd xmm0, qword [0x1ce9f00]
movsd qword [ebp - 0x1018], xmm0
lea eax, [ebp - 0x1010]
push 0x1000
push 0
push eax
call fcn.01cb76e0
add esp, 0xc
mov eax, dword [esi + 0x20]
lea ecx, [eax + 0x1048]
add eax, 0x48
push ecx
push eax
push str._s_s
push 0x7ff
lea eax, [ebp - 0x1010]
push eax
call fcn.01c7c240
add esp, 0x14
xor eax, eax
mov dword [ebp - 0x104c], ebx
cmp dword [ebx + 0x62cb4], 0
setne al
shl eax, 0x13
lea ecx, [eax - 0x7bff3d00]
mov edx, dword [esi + 0x20]
or eax, 0x8480f300
cmp dword [edx + 4], 4
cmovne eax, ecx
lea ecx, [ebp - 0x1018]
push esi
push eax
push ecx
push 0
push str.HTTP_1.1
lea eax, [ebp - 0x1010]
push eax
push edi
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x1c7b9bf
mov ebx, esi
mov dword [ebp - 0x101c], 0x3a98
lea ecx, [ebp - 0x101c]
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
push ecx
push 2
push eax
call esi
mov dword [ebp - 0x1020], 1
lea eax, [ebp - 0x1020]
push 4
push eax
push 0x41
push dword [ebx + 0x1c]
call esi
mov esi, eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x1034], xmm0
movups xmmword [ebp - 0x1044], xmm0
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x1048], 0x28
push 0xa2d0
call fcn.01cb3133
add esp, 4
test eax, eax
je 0x1c7b9c3
mov edi, eax
mov eax, esi
mov esi, ebx
xor ebx, ebx
test eax, eax
setne bl
push 0xa2d0
push 0
push edi
call fcn.01cb76e0
add esp, 0xc
mov ecx, dword [ebp - 0x104c]
push ebx
push 0x5167
push edi
push esi
call fcn.01c7c2a0
mov dword [ebp - 0x1040], edi
push edi
call fcn.01ccde34
add esp, 4
mov dword [ebp - 0x103c], eax
lea eax, [ebp - 0x1048]
push esi
push 1
push 0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
mov esi, eax
push edi
call fcn.01cb313c
add esp, 4
jmp 0x1c7b9da
xor ebx, ebx
jmp 0x1c7b9df
lea eax, [ebp - 0x1048]
push ebx
push 1
push 0
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
mov esi, eax
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov eax, ebx
add esp, 0x1040
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x1c7c0c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [ebp + 8]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [edi + 0x805c]
mov edx, dword [edi + 0x20]
cmp dword [edx + 4], 1
cmove eax, edi
mov esi, ecx
mov ebx, dword [eax]
cmp byte [ecx + 0x26f0], 0
je 0x1c7c17d
mov ecx, esi
call fcn.01c7c8f0
mov edi, dword [edi + 0x8040]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
add eax, dword [edi + 8]
adc ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1c7c1bb
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
add eax, 0x40
lea ecx, [ebp - 0x18]
push 0
push ecx
push ebx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1c7c1c9
cmp dword [ebp - 0x18], ebx
jne 0x1c7c1c9
add dword [edi + 0x18], ebx
adc dword [edi + 0x1c], 0
add dword [esi + 0x5d110], ebx
adc dword [esi + 0x5d114], 0
mov ecx, esi
push ebx
push dword [ebp + 8]
call fcn.01c7cae0
mov ecx, esi
call fcn.01c7c9e0
mov bl, 1
jmp 0x1c7c1cb
mov dword [ebp - 0x14], 0
lea eax, [edi + 0x40]
lea ecx, [ebp - 0x14]
push 0
push ecx
push ebx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1c7c1c9
cmp dword [ebp - 0x14], ebx
jne 0x1c7c1c9
add dword [esi + 0x5d110], ebx
adc dword [esi + 0x5d114], 0
mov ecx, esi
push ebx
push edi
call fcn.01c7cae0
mov bl, 1
jmp 0x1c7c1cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1c7c12c
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x1c7c8f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov esi, ecx
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
lea ebx, [ebp - 0x218]
push 0x208
push 0
push ebx
call fcn.01cb76e0
add esp, 0xc
push 2
push 0
push 0xffffffffffffff96
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edi, [ebp - 0x21c]
push 0
push edi
push 0x6a
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x21c], 0x6a
jne 0x1c7c9c2
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
push ebx
call fcn.01cce713
add esp, 8
test eax, eax
jne 0x1c7c9c2
mov eax, 0xfffffffc
sub eax, dword [ebp - 0x21c]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push eax
push dword [esi + 8]
call ebx
lea eax, [ebp - 0x220]
push 0
push edi
push 4
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x220]
add eax, dword [ebp - 0x21c]
neg eax
push 1
push 0
push eax
push dword [esi + 8]
call ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c7c9e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
mov edi, dword [ecx + 0x26e8]
sub edi, dword [ecx + 0x26e4]
mov eax, edi
sar eax, 2
mov dword [ebp - 0x18], eax
push 2
push 0
push 0
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
je 0x1c7cac0
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x18]
push 0
push eax
push 4
push ecx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x26e4]
cmp dword [esi + 0x26e8], eax
je 0x1c7ca92
mov edi, 1
mov ebx, 0x24
nop word cs:[eax + eax]
nop
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0x20
push dword [eax + edi*4 - 4]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x26e4]
mov ecx, dword [esi + 0x26e8]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x1c7ca97
add ebx, 0x20
add edi, 1
jmp 0x1c7ca60
mov ebx, 4
mov dword [ebp - 0x18], ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ebx, [ebp - 0x14]
push ebx
push 4
lea eax, [ebp - 0x18]
push eax
push dword [esi + 8]
call edi
push 0
push ebx
push 0x6a
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
push dword [esi + 8]
call edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c7cd30
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x44ec
call fcn.01cb35d0
mov esi, dword [ebp + 8]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
call fcn.01ccde34
add esp, 4
mov dword [ebp - 0x44f8], eax
push str.filename
push esi
call fcn.01cb7d3e
add esp, 8
test eax, eax
je 0x1c7cf62
mov edi, eax
cmp word [eax + 0x12], 0x22
jne 0x1c7cd85
add edi, 0x14
push 0x1cea142
jmp 0x1c7cd8d
add edi, 0x12
push 0x1cea146
push edi
call fcn.01cb7d3e
add esp, 8
test eax, eax
je 0x1c7cda2
mov ebx, eax
sub ebx, edi
sar ebx, 1
jmp 0x1c7cdad
push edi
call fcn.01ccde34
add esp, 4
mov ebx, eax
push ebx
push edi
push dword [ebp - 0x44f8]
push esi
call fcn.01cce9c4
add esp, 0x10
mov word [esi + ebx*2], 0
lea edi, [ebp - 0x2464]
push 0x2454
push 0
push edi
call fcn.01cb76e0
add esp, 0xc
lea ebx, [ebp - 0x34ac]
push 0x1048
push 0
push ebx
call fcn.01cb76e0
add esp, 0xc
push esi
push str.http:__127.0.0.1__s
push 0x823
push ebx
call fcn.01c5f7e0
add esp, 0x10
xorps xmm0, xmm0
movups xmmword [ebp - 0x44e8], xmm0
push 0x2454
push 0
push edi
call fcn.01cb76e0
add esp, 0xc
mov dword [ebp - 0x44f4], 0x3c
lea eax, [ebp - 0x245c]
mov dword [ebp - 0x44f0], eax
mov dword [ebp - 0x44ec], 0x20
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x44e4], eax
mov dword [ebp - 0x44e0], 0x100
lea eax, [ebp - 0x241c]
mov dword [ebp - 0x44c8], eax
mov dword [ebp - 0x44c4], 0x800
lea eax, [ebp - 0x141c]
mov dword [ebp - 0x44c0], eax
mov dword [ebp - 0x44bc], 0x800
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x44d8], eax
mov dword [ebp - 0x44d4], 0x80
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x44d0], eax
mov dword [ebp - 0x44cc], 0x80
push ebx
call fcn.01ccde34
add esp, 4
lea edi, [ebp - 0x44f4]
push edi
push 0x10000000
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x1c7cf62
mov eax, dword [ebp - 0x44e8]
cmp eax, 4
ja 0x1c7cf62
mov ecx, 0x1a
bt ecx, eax
jae 0x1c7cf62
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
movzx ecx, word [ebp - 0x44dc]
mov word [ebp - 0x2464], cx
mov dword [ebp - 0x2460], eax
mov dword [ebp - 0x14], 0xffffffff
mov ebx, dword [ebp - 0x44f8]
push ebx
push 0
push esi
call fcn.01cb76e0
add esp, 0xc
push 0x1048
push 0
push edi
call fcn.01cb76e0
add esp, 0xc
lea eax, [ebp - 0x241a]
lea ecx, [ebp - 0x141c]
push ecx
push eax
push str._s_s
push 0x823
push edi
call fcn.01c5f7e0
add esp, 0x14
push edi
push ebx
push esi
call fcn.01cce753
add esp, 0xc
mov bl, 1
jmp 0x1c7cf64
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov eax, ebx
add esp, 0x44ec
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c7d790
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x2d28
call fcn.01cb35d0
mov edi, dword [ebp + 8]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [esp + 0x2d20], eax
xor ecx, ecx
test edi, edi
je 0x1c7d974
cmp dword [ebp + 0xc], 0
je 0x1c7d974
mov eax, dword [ebp + 0xc]
add eax, 0xffffffff
cmp eax, 0x7ffffffd
mov ecx, 0x7ffffffd
cmovb ecx, eax
mov eax, edi
neg eax
mov dword [esp + 8], eax
add ecx, 1
mov dword [esp + 0x10], ecx
xor ebx, ebx
mov cl, 1
jmp 0x1c7d81c
xor edi, edi
mov ebx, dword [esp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
mov edi, dword [ebp + 8]
jne 0x1c7d970
cmp ebx, 0xf
lea eax, [ebx + 1]
setb cl
mov ebx, eax
cmp eax, 0x10
je 0x1c7d974
mov dword [esp + 0xc], ecx
push 0x200
push 0xff
lea esi, [esp + 0x2b28]
push esi
call fcn.01cb76e0
add esp, 0xc
push ebx
push str..PhysicalDrive_d
push 0x200
push esi
call fcn.01c7d280
sub esp, 0xc
movaps xmm0, xmmword [0x1cea230]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1c7d808
mov dword [esp + 4], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
push 0x2710
push 0
lea esi, [esp + 0x418]
mov ebx, eax
push esi
call fcn.01cb76e0
add esp, 0xc
push 0
lea eax, [esp + 0x18]
push eax
push 0x2710
push esi
mov esi, ebx
push 0xc
lea eax, [esp + 0x2c]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1c7d7f0
push 0x3e8
push 0
lea ebx, [esp + 0x30]
push ebx
call fcn.01cb76e0
add esp, 0xc
push ebx
push 1
push dword [esp + 0x430]
lea eax, [esp + 0x41c]
push eax
call fcn.01c90a70
add esp, 0x10
cmp dword [ebp + 0xc], 0
jle 0x1c7d954
xor eax, eax
mov ecx, dword [esp + 8]
mov ebx, dword [esp + 4]
nop dword [eax]
movzx edx, byte [esp + eax + 0x28]
test dl, dl
je 0x1c7d962
mov byte [edi + eax], dl
add ecx, 0xffffffff
add eax, 1
cmp dword [esp + 0x10], eax
jne 0x1c7d920
mov edx, ecx
neg edx
not ecx
mov edi, 1
cmp dword [ebp + 0xc], eax
cmovne ecx, edx
mov byte [ecx], 0
jne 0x1c7d7f6
jmp 0x1c7d95b
mov byte [edi], 0
mov ebx, dword [esp + 4]
xor edi, edi
jmp 0x1c7d7f6
mov byte [edi + eax], 0
mov edi, 1
jmp 0x1c7d7f6
mov ecx, dword [esp + 0xc]
and cl, 1
mov ebx, ecx
mov ecx, dword [esp + 0x2d20]
xor ecx, ebp
call fcn.01cb3141
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c7e100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [esp + 0x158], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x100], xmm0
movdqa xmmword [esp + 0xf0], xmm0
movdqa xmmword [esp + 0xe0], xmm0
movdqa xmmword [esp + 0xd0], xmm0
movdqa xmmword [esp + 0xc0], xmm0
movdqa xmmword [esp + 0xb0], xmm0
movdqa xmmword [esp + 0xa0], xmm0
movdqa xmmword [esp + 0x90], xmm0
movdqa xmmword [esp + 0x80], xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movdqa xmmword [esp + 0x10], xmm0
pxor xmm0, xmm0
movdqa xmmword [esp + 0x110], xmm0
movdqa xmmword [esp + 0x120], xmm0
movdqa xmmword [esp + 0x130], xmm0
movdqa xmmword [esp + 0x140], xmm0
mov byte [esp + 0x110], 0x37
lea eax, [esp + 0x10]
mov dword [esp + 0x114], eax
mov word [esp + 0x118], 0x100
lea esi, [esp + 0x110]
push esi
call sub.NETAPI32.dll_Netbios
test al, al
je 0x1c7e1f9
xor ebx, ebx
jmp 0x1c7e32a
mov bl, byte [esp + 0x11]
pxor xmm0, xmm0
movdqa xmmword [esp + 0x110], xmm0
movdqa xmmword [esp + 0x140], xmm0
movdqa xmmword [esp + 0x120], xmm0
movdqa xmmword [esp + 0x130], xmm0
mov byte [esp + 0x110], 0x32
mov byte [esp + 0x140], bl
push esi
call sub.NETAPI32.dll_Netbios
pxor xmm0, xmm0
movdqa xmmword [esp + 0x110], xmm0
movdqa xmmword [esp + 0x140], xmm0
movdqa xmmword [esp + 0x120], xmm0
movdqa xmmword [esp + 0x130], xmm0
mov byte [esp + 0x110], 0x33
mov byte [esp + 0x140], bl
mov byte [esp + 0x11a], 0x2a
mov word [esp + 0x127], 0x2020
mov dword [esp + 0x123], 0x20202020
mov dword [esp + 0x11f], 0x20202020
mov dword [esp + 0x11b], 0x20202020
mov byte [esp + 0x129], 0
mov dword [esp + 0x114], 0x1d0b92c
mov word [esp + 0x118], 0x258
push esi
call sub.NETAPI32.dll_Netbios
mov ebx, eax
test bl, bl
jne 0x1c7e323
movzx eax, byte [0x1d0b931]
mov dword [esp + 8], eax
movzx ecx, byte [0x1d0b930]
movzx edx, byte [0x1d0b92f]
movzx esi, byte [0x1d0b92e]
movzx edi, byte [0x1d0b92d]
movzx eax, byte [0x1d0b92c]
mov dword [esp + 0xc], eax
push dword [esp + 8]
push ecx
push edx
push esi
push edi
push dword [esp + 0x20]
push str._02X_02X_02X_02X_02X_02X
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01c7e350
add esp, 0x24
test eax, eax
setns al
test bl, bl
sete bl
and bl, al
mov ecx, dword [esp + 0x158]
xor ecx, ebp
call fcn.01cb3141
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c82135
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov esi, ecx
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1c82157
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1c8223a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1c82192
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov ecx, esi
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.01c82251
push 2
call fcn.01c60df0
add esp, 4
test al, al
je 0x1c82238
call fcn.01c618c0
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x25e
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.01c61a60
lea eax, [ebp - 0xb4]
push 0x10
push str.CreateDirectory
push eax
call fcn.01c23924
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c821e6
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc8]
push eax
push esi
push ebx
call fcn.01c47a90
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c8220b
mov eax, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xc8]
push eax
push ebx
push edi
call fcn.01c23924
add esp, 0xc
cmp byte [ebp - 0xbd], 0
jns 0x1c8222d
push dword [ebp - 0xc8]
call fcn.01cb3106
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.01c61b10
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c82251
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov esi, ecx
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1c82273
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c82342
mov bl, 1
test al, 0x10
jne 0x1c823ea
push 2
call fcn.01c60df0
add esp, 4
test al, al
je 0x1c823e8
lea ecx, [ebp - 0xbc]
push 2
push 0x24d
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.01c60e80
lea eax, [ebp - 0xb4]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01c23924
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c822db
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc8]
push eax
push esi
push ebx
call fcn.01c47a90
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c82300
mov eax, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xc8]
push eax
push ebx
push edi
call fcn.01c23924
add esp, 0xc
push 0x11
push str.:_not_a_directory
push eax
call fcn.01c23924
add esp, 0xc
cmp byte [ebp - 0xbd], 0
jns 0x1c82332
push dword [ebp - 0xc8]
call fcn.01cb3106
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.01c61290
jmp 0x1c823e8
push 2
call fcn.01c60df0
add esp, 4
test al, al
je 0x1c823e8
call fcn.01c618c0
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x249
push str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
call fcn.01c61a60
lea eax, [ebp - 0xb4]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01c23924
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c82396
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc8]
push eax
push esi
push ebx
call fcn.01c47a90
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c823bb
mov eax, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xc8]
push eax
push ebx
push edi
call fcn.01c23924
add esp, 0xc
cmp byte [ebp - 0xbd], 0
jns 0x1c823dd
push dword [ebp - 0xc8]
call fcn.01cb3106
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.01c61b10
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c83848
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [ecx + 0x1c]
mov ebx, dword [ecx + 0x20]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp esi, ebx
je 0x1c8389a
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.01c95458
test al, al
jne 0x1c83887
add esi, 0x58
cmp ebx, esi
jne 0x1c83872
mov esi, ebx
mov eax, dword [ebp - 0x24]
cmp esi, dword [eax + 0x20]
je 0x1c8389a
cmp byte [esi + 0x1b], 0
jns 0x1c8389f
mov eax, dword [esi + 0x10]
jmp 0x1c838a2
xor edi, edi
inc edi
jmp 0x1c838c5
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x1c838c5
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c8393a
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ecx + 0x1c]
mov edi, dword [ecx + 0x20]
cmp ebx, edi
je 0x1c83990
mov esi, edx
cmp dword [ebx + 0x50], esi
jne 0x1c83989
cmp byte [ebx + 0x1b], 0
jns 0x1c8395c
mov eax, dword [ebx + 0x10]
jmp 0x1c8395f
lea eax, [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
mov ecx, dword [ebp + 8]
jne 0x1c83989
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x1c83980
mov ecx, dword [ebp + 8]
push ebx
call fcn.01c84aca
jmp 0x1c83989
mov ecx, dword [ebp + 8]
push ebx
call fcn.01c84b38
add ebx, 0x58
cmp edi, ebx
jne 0x1c8394c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c83b28
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x1c]
mov ebx, dword [ecx + 0x20]
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
cmp edi, ebx
je 0x1c83b85
mov dword [ebp - 0x24], ecx
lea esi, [ebp - 0x20]
mov ecx, edi
push esi
call fcn.01c95458
test al, al
jne 0x1c83b67
add edi, 0x58
cmp ebx, edi
jne 0x1c83b52
mov edi, ebx
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x24]
cmp edi, dword [esi + 0x20]
je 0x1c83bbc
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x1c83b8a
cmp byte [edi + 0x1b], 0
jns 0x1c83b98
mov eax, dword [edi + 0x10]
jmp 0x1c83b9b
xor ebx, ebx
inc ebx
jmp 0x1c83bbc
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
jmp 0x1c83bbc
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c83bbc
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x1c83bbc
mov byte [esi + 0x18], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cb3141
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret