joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401cddc0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1401cddf0
xor eax, eax
jmp 0x1401cdeb3
mov rbp, rbx
cmp word [rax], si
je 0x1401cde15
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1401cddfc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1401cddf8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1401cdce0
movsxd r14, eax
test eax, eax
jne 0x1401cde53
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1401cdde9
mov rcx, r14
call fcn.14009ead0
mov rdi, rax
test rax, rax
jne 0x1401cde6c
xor ecx, ecx
call fcn.1400581d0
jmp 0x1401cde48
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1401cdce0
test eax, eax
jne 0x1401cde9d
mov rcx, rdi
call fcn.1400581d0
jmp 0x1401cdea7
xor ecx, ecx
call fcn.1400581d0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1401cded0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1401cdf57
mov rsi, rbx
cmp word [rax], bp
je 0x1401cdf16
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1401cdf00
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1401cdefc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14009ead0
mov rdi, rax
test rax, rax
je 0x1401cdf44
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1401d8080
mov rbp, rdi
xor ecx, ecx
call fcn.1400581d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401d0504
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401d0524
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401b3878
or eax, 0xffffffff
jmp 0x1401d0526
xor eax, eax
add rsp, 0x28
ret

Function at 0x1401d052c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1401aae84
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1401d05b6
cmp byte [rbp - 0x21], r15b
je 0x1401d05b1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1401d05ec
call fcn.1401c69c4
test eax, eax
jne 0x1401d05d8
cmp byte [rbp - 0x21], r15b
je 0x1401d05d0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1401d05ec
cmp byte [rbp - 0x21], r15b
je 0x1401d05e9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1401b0470
test eax, eax
jne 0x1401d068c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1401aae84
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1401d062b
cmp byte [rbp - 0x21], r15b
je 0x1401d0660
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1401d0660
call fcn.1401c69c4
test eax, eax
jne 0x1401d064c
cmp byte [rbp - 0x21], r15b
je 0x1401d0645
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1401d0660
cmp byte [rbp - 0x21], r15b
je 0x1401d065d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1401b0470
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1401d068c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1401d068f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1401d069d
mov rcx, rdi
call fcn.1400581d0
cmp byte [rbp + 0x3f], r15b
je 0x1401d06ac
mov rcx, qword [rbp + 0x27]
call fcn.1400581d0
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1401d08ec
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x1401d0936
call fcn.1401b3858
mov dword [rax], 0xf
call fcn.14019cacc
mov dword [rax], Ordinal_14
call fcn.1401c8594
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14019f290
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x1401d0941
lea eax, [rbx + 1]
jmp 0x1401d0923
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x1401d0921
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x1401d0923
Function at 0x1401d16a4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x7ff
movzx ecx, word [rcx + 6]
mov esi, edx
shr cx, 4
and cx, bp
cmp cx, bp
jne 0x1401d1705
test byte [rbx + 6], 0xf
jne 0x1401d16f8
xor edi, edi
cmp word [rbx + 4], di
jne 0x1401d16f8
cmp word [rbx + 2], di
jne 0x1401d16f8
cmp word [rbx], di
jne 0x1401d16f8
lea esi, [rdi + 1]
jmp 0x1401d16fd
mov esi, 2
movzx eax, si
jmp 0x1401d18fd
xor edi, edi
test cx, cx
jne 0x1401d1720
mov rcx, rbx
call fcn.1401d699c
movzx ecx, ax
cmp di, ax
jl 0x1401d18fa
movsx edx, cx
test esi, esi
jle 0x1401d1750
sub ebp, edx
cmp ebp, esi
jg 0x1401d1750
movsd xmm0, qword [0x14026ee90]
cmp word [rbx + 6], di
jge 0x1401d1742
xorps xmm0, xmmword [0x14026bf80]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x1401d18fd
movzx r11d, word [rbx + 6]
mov eax, edx
neg eax
cmp eax, esi
jge 0x1401d177d
add si, cx
mov eax, 0x800f
shl si, 4
and r11w, ax
or si, r11w
mov word [rbx + 6], si
or eax, 0xffffffff
jmp 0x1401d18fd
movzx r15d, r11w
lea ebp, [rsi - 1]
and r11w, 0xf
mov r13d, 0x8000
mov r12d, 0x10
and r15w, r13w
or r11w, r12w
add ebp, edx
cmp ebp, 0xffffffcb
jl 0x1401d18ef
test ebp, ebp
jns 0x1401d18ef
lea esi, [r12 - 0xf]
movzx r14d, di
cmp bp, 0xfff0
jg 0x1401d1812
movzx edx, word [rbx + 4]
mov eax, 0xfff0
movzx r8d, word [rbx + 2]
sub ax, bp
shr ax, 4
add ax, si
movzx ecx, ax
movzx eax, cx
shl ax, 4
add bp, ax
test r14w, r14w
mov eax, edi
setne al
movzx r14d, ax
or r14w, word [rbx]
mov word [rbx], r8w
movzx r8d, dx
movzx edx, r11w
mov r11d, edi
sub rcx, rsi
jne 0x1401d17e4
mov word [rbx + 4], dx
mov word [rbx + 2], r8w
neg bp
je 0x1401d1891
movzx r8d, word [rbx]
mov eax, edi
movzx r9d, word [rbx + 2]
movzx edx, r8w
movsx r10d, bp
sub r12d, r10d
mov ecx, r12d
shl dx, cl
test r14w, r14w
movzx r14d, dx
movzx edx, word [rbx + 4]
setne al
or r14w, ax
movzx eax, r9w
shl ax, cl
movzx ecx, bp
shr r8w, cl
mov ecx, r12d
or ax, r8w
mov word [rbx], ax
movzx eax, dx
shl ax, cl
movzx ecx, bp
shr r9w, cl
mov ecx, r12d
or ax, r9w
mov word [rbx + 2], ax
movzx eax, r11w
shl ax, cl
movzx ecx, bp
shr dx, cl
mov ecx, r10d
or ax, dx
mov word [rbx + 4], ax
shr r11w, cl
or r11w, r15w
mov word [rbx + 6], r11w
cmp r13w, r14w
jb 0x1401d18a7
jne 0x1401d18c6
test byte [rbx], sil
je 0x1401d18c6
add word [rbx], si
jne 0x1401d18c6
add word [rbx + 2], si
jne 0x1401d18c6
add word [rbx + 4], si
jne 0x1401d18c6
add r11w, si
mov word [rbx + 6], r11w
jmp 0x1401d1775
cmp r11w, r15w
jne 0x1401d1775
cmp word [rbx + 4], di
jne 0x1401d1775
cmp word [rbx + 2], di
jne 0x1401d1775
movzx eax, word [rbx]
neg ax
sbb ax, ax
jmp 0x1401d18fd
mov word [rbx + 6], r15w
mov dword [rbx + 2], edi
mov word [rbx], di
movzx eax, di
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401d1d94
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1401d1daa
mov al, 1
jmp 0x1401d1e0a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1401d1dbb
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1401d1e08
mov ecx, dword [rcx + 0x18]
nop
call fcn.1401b493c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1401d1e08
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1401d1e08
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1401d1e08
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1401d1e0a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1401e1790
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x1401e17d6
mov r15, rbx
test r15, r15
je 0x1401e18b2
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r12
jbe 0x1401e1832
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x1401e1821
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.1401d8080
mov r14, qword [rsi + 8]
add r15, rbx
mov qword [rsi + 0x10], r15
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x1401e17b2
mov rax, rbx
sub rax, r12
sar rax, 2
cmp rbx, r12
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x1401e18ce
lea rcx, [r13*8]
call fcn.14019ca88
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rbx
mov r15, rcx
sub rdx, r14
je 0x1401e1894
lea r15, [rdx + rcx]
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x1401e18b2
mov r10, qword [r14 + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x1401e187c
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
cmp rbx, r14
je 0x1401e18b4
add rbx, 0xfffffffffffffff8
jne 0x1401e18a7
ud2
test r12, r12
je 0x1401e17b2
mov rcx, r12
call fcn.14019cac4
mov r15, qword [rsi + 0x10]
jmp 0x1401e17b2
call fcn.1401dc2e0
int3
Function at 0x1401eaed0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1401eaf07
movabs rcx, 0xf000000000000000
shl rax, 4
movsx r9, byte [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
inc rdx
cmp rdx, r8
jne 0x1401eaee1
ret

Function at 0x1401eaf80
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1401eafb8
movabs rcx, 0xf000000000000000
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x1401eaf91
ret

Function at 0x1401f1450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x1401f14bd
movzx edx, word [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov word [rsp + 0x20], dx
mov rdx, rsi
mov r8, rdi
call qword [0x1402a7b00]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rsi], rdi
test al, al
jns 0x1401f149f
call fcn.14019cac4
jmp 0x1401f149f
mov rax, qword [r9 + 0x30]
mov qword [rbp - 0x20], rax
lea rcx, [0x1402c8540]
mov qword [rbp - 8], rax
cmp rax, rcx
jne 0x1401f15e7
lea rdx, [0x1402c8718]
lea rcx, [rbp - 0x20]
call fcn.14013dbc0
mov r14, rax
mov rcx, qword [rbp - 8]
lea rax, [0x1402c8540]
cmp rcx, rax
je 0x1401f1517
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x1401f1517
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1402a7b00]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rbp - 0x20]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x140275a70]
movaps xmmword [rbx], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [0x1402a7b00]
movsx rax, byte [rbx + 0x17]
test rax, rax
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
mov r8, rax
cmovs r8, rdx
test r8, r8
je 0x1401f14af
test al, al
mov r14, rbx
cmovs r14, rcx
jmp 0x1401f15bd
xor edi, edi
jmp 0x1401f159b
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
cmp ax, 0xffff
jne 0x1401f1590
xor edi, edi
mov al, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add r14, 2
test al, al
mov r8, rbx
cmovs r8, rcx
movzx r9d, al
cmovs r9, rdx
lea r8, [r8 + r9*2]
cmp r14, r8
je 0x1401f14af
test rdi, rdi
je 0x1401f1579
movzx eax, word [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
jne 0x1401f157d
mov rcx, qword [rdi]
mov r8, qword [rcx + 0x60]
mov rcx, rdi
mov edx, eax
mov rax, r8
call qword [0x1402a7b00]
jmp 0x1401f1588
mov rax, qword [rbp - 8]
lock inc dword [rax + 8]
jmp 0x1401f14d9
Function at 0x1402023b0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 1
je 0x1402023d9
mov rcx, qword [rsi]
jmp 0x1402023e2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140202435
mov dil, 1
test bl, bl
je 0x140202414
cmp byte [rsi + 8], 1
je 0x140202400
mov rcx, qword [rsi]
jmp 0x140202409
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x14020242b
call fcn.14019f290
int3
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 1
jne 0x14020244c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14020244f
mov rcx, qword [rsi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140202462
xor edi, edi
jmp 0x140202414
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 1
je 0x140202475
mov rcx, qword [rsi]
jmp 0x14020247e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
jmp 0x140202414
Function at 0x1402052a0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x1402c9560], 0
je 0x1402052f0
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x1402052e3
call fcn.14019f290
int3
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x1402c9568]
test rdi, rdi
jne 0x1402053bd
mov ecx, Ordinal_26
call fcn.14019ca88
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1401d8720
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x140275a70]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.14013bb50
movsx rax, byte [rdi + 0x17]
mov rcx, rdi
test rax, rax
jns 0x14020536a
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
test rax, rax
je 0x1402053a1
add rax, rax
test rax, rax
je 0x1402053a1
lea rdx, [rax - 2]
cmp word [rcx + rax - 2], 0x5c
mov rax, rdx
jne 0x140205372
cmp rdx, 0xfffffffffffffffe
je 0x1402053a1
sar rdx, 1
inc rdx
mov rcx, rdi
mov r8, 0xffffffffffffffff
call fcn.14010ced0
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rdi
call fcn.140140870
mov qword [0x1402c9568], rdi
test byte [0x1402b96d8], 1
je 0x1402052c9
cmp byte [rdi + 0x17], 0
jns 0x1402053d3
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], Ordinal_133
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1402c9560], rax
inc rax
cmp rax, 1
ja 0x1402052c9
lea rsi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.1401d8720
mov word [rsi], 0
mov ecx, 0x104
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jb 0x14020550b
mov rcx, qword [0x1402c9568]
lea rdx, [rsp + 0x40]
call fcn.14002e870
mov rcx, qword [0x1402c9568]
movsx rax, byte [rcx + 0x17]
test rax, rax
js 0x14020551a
test al, al
je 0x14020552b
mov rdx, rcx
cmp word [rdx + rax*2 - 2], 0x5c
je 0x1402054a1
lea rdx, [0x14027cdd6]
mov r8d, 1
call fcn.140140870
mov rcx, qword [0x1402c9568]
lea rdx, str.debug.log
mov r8d, 9
call fcn.140140870
mov rcx, qword [0x1402c9568]
cmp byte [rcx + 0x17], 0
jns 0x1402054c3
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], Ordinal_133
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1402c9560], rax
inc rax
cmp rax, 1
ja 0x140205512
mov qword [0x1402c9560], 0
xor esi, esi
jmp 0x1402052c9
mov sil, 1
jmp 0x1402052c9
mov rax, qword [rcx + 8]
test rax, rax
je 0x14020552b
mov rdx, qword [rcx]
jmp 0x140205480
ud2
Function at 0x14021ba50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, r8
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x50]
mov r15, qword [rcx + 0x58]
cmp rdi, r15
je 0x14021baa6
mov rbx, rcx
lea r14, [rsp + 0x20]
mov rcx, rdi
mov rdx, r14
call fcn.140232650
test al, al
jne 0x14021baa2
add rdi, 0x70
cmp rdi, r15
jne 0x14021ba8a
mov r15, qword [rbx + 0x58]
cmp rdi, r15
je 0x14021badf
cmp byte [rdi + 0x27], 0
js 0x14021bab7
lea rcx, [rdi + 0x10]
jmp 0x14021babb
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
test eax, eax
jne 0x14021bae4
mov qword [rsi], rdi
xor eax, eax
jmp 0x14021bae4
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x14021bafb
call fcn.14019f290
int3
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14021bc70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r9
mov ebp, r8d
mov rdi, rcx
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rbx, qword [rcx + 0x50]
mov r15, qword [rcx + 0x58]
cmp rbx, r15
je 0x14021bcca
lea r14, [rsp + 0x20]
mov rcx, rbx
mov rdx, r14
call fcn.140232650
test al, al
jne 0x14021bcc6
add rbx, 0x70
cmp rbx, r15
jne 0x14021bcae
mov r15, qword [rdi + 0x58]
mov r14d, 1
cmp rbx, r15
je 0x14021bd1d
mov eax, dword [rbx + 0x68]
cmp eax, ebp
jne 0x14021bd0e
cmp byte [rbx + 0x27], 0
js 0x14021bce8
lea rcx, [rbx + 0x10]
jmp 0x14021bcec
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14021bd1d
shr eax, 3
and eax, 2
mov r14d, eax
jne 0x14021bd1d
mov byte [rdi + 0x48], 1
mov qword [rsi], rbx
xor r14d, r14d
jmp 0x14021bd1d
xor ecx, ecx
cmp eax, 1
sete cl
lea r14d, [rcx + rcx*2]
inc r14d
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x14021bd34
call fcn.14019f290
int3
mov eax, r14d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14021bea0
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0x190], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x48]
mov qword [rbx], rax
mov rdx, rbx
call fcn.140057390
mov r12, qword [rbx]
test r12, r12
je 0x14021bf54
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x50], xmm0
mov r15, qword [r12 + 0x50]
mov rbx, qword [r12 + 0x58]
cmp r15, rbx
je 0x14021bf37
lea r14, [rsp + 0x50]
mov rcx, r15
mov rdx, r14
call fcn.140232650
test al, al
jne 0x14021bf32
add r15, 0x70
cmp r15, rbx
jne 0x14021bf1a
mov rbx, qword [r12 + 0x58]
cmp r15, rbx
jne 0x14021bf93
mov esi, 1
cmp byte [rsp + 0x47], 0
jns 0x14021bf59
mov rcx, qword [rsp + 0x30]
call fcn.14019cac4
jmp 0x14021bf59
mov esi, 3
lea rcx, [rsp + 0x48]
call fcn.140056ae0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x14021bf7d
call fcn.14019f290
int3
mov eax, esi
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [r15 + 0x10]
lea rcx, [rsp + 0x30]
call fcn.140168fb0
mov r13, qword [r12 + 0x58]
cmp r13, r15
je 0x14021c123
lea rax, [r12 + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [r15 + 0x70]
mov rdx, r15
cmp rax, r13
je 0x14021bfcf
xor ebp, ebp
mov rbx, r15
jmp 0x14021c083
sub rdx, r15
add rdx, r15
mov rcx, qword [rsp + 0x28]
call fcn.14021d070
mov byte [r12 + 0x48], 1
cmp byte [rsp + 0x47], 0
lea rcx, [rsp + 0x30]
jns 0x14021bff6
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14021c0ad
mov rcx, rdi
mov rdx, rsi
call fcn.140230820
xor esi, esi
jmp 0x14021bf41
mov rcx, qword [r14]
call fcn.14019cac4
mov rax, qword [rbx + 0xa8]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rbx + 0x98]
movups xmmword [r14], xmm0
mov byte [rbx + 0xaf], bpl
mov byte [rbx + 0x98], bpl
movups xmm0, xmmword [rbx + 0xb0]
movups xmm1, xmmword [rbx + 0xc0]
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm1
mov rax, qword [rbx + 0xd0]
mov qword [rbx + 0x60], rax
mov eax, dword [rbx + 0xd8]
mov dword [rbx + 0x68], eax
lea rdx, [rbx + 0x70]
add rbx, 0xe0
cmp rbx, r13
mov rbx, rdx
je 0x14021bfcf
movups xmm0, xmmword [rbx + 0x70]
movups xmmword [rbx], xmm0
lea rcx, [rbx + 0x10]
lea rdx, [rbx + 0x80]
call fcn.140066ae0
lea r14, [rbx + 0x28]
cmp byte [rbx + 0x3f], 0
jns 0x14021c01e
jmp 0x14021c016
mov esi, 2
mov ecx, 2
call fcn.14019ae60
test al, al
je 0x14021bf41
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x50]
mov esi, 2
mov rcx, rdi
mov r8d, 0x36f
mov r9d, 2
call fcn.140205ad0
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, Ordinal_14
call fcn.140183370
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140206a60
mov rcx, rdi
call fcn.140205b40
jmp 0x14021bf41
ud2