joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002d560
Capabilities:
Allocate or change rwx memory

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], r9
push rsi
push rdi
push r14
sub rsp, 0x40
mov r9d, 8
lea rax, [r11 + 0x20]
mov rbp, r8
mov qword [r11 - 0x38], rax
mov rdi, rdx
mov rsi, rcx
lea r14d, [r9 + 8]
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor ebx, ebx
test eax, eax
je 0x14002d5ee
lea rax, [rsp + 0x30]
mov r9, r14
mov r8, rbp
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14002d5ca
cmp qword [rsp + 0x30], r14
jne 0x14002d5ca
mov bl, 1
mov r9d, dword [rsp + 0x78]
lea rax, [rsp + 0x78]
mov r8, r14
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
neg eax
sbb al, al
and al, bl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x14002d9f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov qword [rcx + 0x18], r9
mov dword [rcx + 8], eax
lea r9, [rcx + 8]
mov qword [rcx + 0x20], rax
mov r11, r8
mov eax, dword [rsp + 0x50]
mov rbx, rcx
mov qword [rcx], rdx
mov edx, eax
mov qword [rcx + 0x10], r8
mov r8d, 0x40
mov dword [rcx + 0x28], eax
mov byte [rcx + 0x2c], 1
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14002ec9c
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14003cf60], eax
jle 0x14002ecf2
lea rcx, [0x14003cf60]
call fcn.140005c78
cmp dword [0x14003cf60], 0xffffffff
jne 0x14002ecf2
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
lea rcx, [0x14003cf60]
mov dword [0x14003cf70], eax
call fcn.140005c18
mov eax, dword [0x14003cf70]
add rsp, 0x58
ret

Function at 0x14002eefc
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14003c280], eax
jle 0x14002ef52
lea rcx, [0x14003c280]
call fcn.140005c78
cmp dword [0x14003c280], 0xffffffff
jne 0x14002ef52
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
lea rcx, [0x14003c280]
mov dword [0x14003c1a8], eax
call fcn.140005c18
mov eax, dword [0x14003c1a8]
add rsp, 0x58
ret

Function at 0x14002ef60
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.MOZ_ENABLE_HANDLE_VERIFIER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14002ef81
call fcn.14002eab4
test al, al
jne 0x14002ef9f
mov rcx, qword [0x14003c170]
test rcx, rcx
jne 0x14002ef99
call fcn.140002b50
mov rcx, qword [0x14003c170]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp qword [sym.firefox.exe_g_shared_section], 0
jne 0x14002eff2
call fcn.140019568
mov rbx, rax
test rax, rax
je 0x14002eff2
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx]
test eax, eax
jne 0x14002eff2
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rsp + 0x30]
mov dl, 1
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14002efed
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, rbx
jmp 0x14002eff4
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14002effc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, str.MOZ_ENABLE_HANDLE_VERIFIER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor edi, edi
test rax, rax
je 0x14002f023
call fcn.14002eab4
test al, al
jne 0x14002f041
mov rcx, qword [0x14003c170]
test rcx, rcx
jne 0x14002f03b
call fcn.140002b50
mov rcx, qword [0x14003c170]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp qword [sym.firefox.exe_g_shared_section], rdi
je 0x14002f097
mov rbx, qword [0x14003cf00]
test rbx, rbx
jne 0x14002f084
lea rbx, [0x14003cbc0]
mov dword [0x14003cbc8], edi
mov byte [0x14003cbcc], 1
lea rax, [0x140031e98]
mov qword [0x14003cbc0], rax
mov qword [0x14003cf00], rbx
test rbx, rbx
je 0x14002f097
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
test eax, eax
cmovne rbx, rdi
mov rax, rbx
jmp 0x14002f099
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002f9a8
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov dword [0], 0x2df
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 3
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1400010f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
movsxd r10, r8d
test r8d, r8d
jle 0x14000111c
xor r9d, r9d
lea r11, [0x140011390]
movzx r8d, byte [r9 + rdx]
inc r9
movzx eax, cl
xor r8, rax
shr ecx, 8
xor ecx, dword [r11 + r8*4]
cmp r9, r10
jl 0x140001102
mov eax, ecx
ret

Function at 0x140004040
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x10], 0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
je 0x140004067
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, [0x140011d94]
mov qword [rbx], 0
mov rcx, rdi
mov byte [rbx + 0x10], 0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
je 0x1400040f3
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [rbx + 8], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
movsxd rcx, dword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movsxd r8, dword [rbx + 8]
mov r9, rdi
mov rcx, rax
mov qword [rbx], rax
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov al, 1
mov dword [rbx + 0xc], esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000e960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 8
mov r11, rdx
test r8d, r8d
jle 0x14000eb2b
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov esi, 0x7fff
mov qword [rsp], rdi
mov edi, r8d
test byte [rcx + 0x80], 1
je 0x14000e9cd
mov rax, qword [rcx + 0x88]
mov edx, dword [rcx]
shr edx, 0xf
add edx, dword [rcx + 4]
movsx r8d, byte [rdx + rax]
imul r8d, dword [rcx + 0x14]
mov edx, dword [rcx + 0x18]
add edx, dword [rcx]
mov eax, edx
mov dword [rcx], edx
shr eax, 0xf
mov dword [rcx + 0x1c], r8d
cmp eax, dword [rcx + 8]
jb 0x14000e9cd
mov eax, dword [rcx + 0xc]
and edx, esi
mov dword [rcx + 4], eax
mov eax, dword [rcx + 0x10]
mov dword [rcx + 8], eax
mov dword [rcx], edx
movzx eax, byte [rcx + 0x80]
mov ebx, dword [rcx + 0x1c]
shr al, 1
test al, 1
je 0x14000ea1f
mov rax, qword [rcx + 0x88]
mov edx, dword [rcx + 0x20]
shr edx, 0xf
add edx, dword [rcx + 0x24]
movsx r8d, byte [rdx + rax]
imul r8d, dword [rcx + 0x34]
mov edx, dword [rcx + 0x38]
add edx, dword [rcx + 0x20]
mov eax, edx
mov dword [rcx + 0x20], edx
shr eax, 0xf
mov dword [rcx + 0x3c], r8d
cmp eax, dword [rcx + 0x28]
jb 0x14000ea1f
mov eax, dword [rcx + 0x2c]
and edx, esi
mov dword [rcx + 0x24], eax
mov eax, dword [rcx + 0x30]
mov dword [rcx + 0x28], eax
mov dword [rcx + 0x20], edx
movzx eax, byte [rcx + 0x80]
mov r10d, dword [rcx + 0x3c]
shr al, 2
test al, 1
je 0x14000ea73
mov rax, qword [rcx + 0x88]
mov edx, dword [rcx + 0x40]
shr edx, 0xf
add edx, dword [rcx + 0x44]
movsx r8d, byte [rdx + rax]
imul r8d, dword [rcx + 0x54]
mov edx, dword [rcx + 0x58]
add edx, dword [rcx + 0x40]
mov eax, edx
mov dword [rcx + 0x40], edx
shr eax, 0xf
mov dword [rcx + 0x5c], r8d
cmp eax, dword [rcx + 0x48]
jb 0x14000ea73
mov eax, dword [rcx + 0x4c]
and edx, esi
mov dword [rcx + 0x44], eax
mov eax, dword [rcx + 0x50]
mov dword [rcx + 0x48], eax
mov dword [rcx + 0x40], edx
movzx eax, byte [rcx + 0x80]
add r10d, dword [rcx + 0x5c]
shr al, 3
test al, 1
je 0x14000eac7
mov rax, qword [rcx + 0x88]
mov edx, dword [rcx + 0x60]
shr edx, 0xf
add edx, dword [rcx + 0x64]
movsx r8d, byte [rdx + rax]
imul r8d, dword [rcx + 0x74]
mov edx, dword [rcx + 0x78]
add edx, dword [rcx + 0x60]
mov eax, edx
mov dword [rcx + 0x60], edx
shr eax, 0xf
mov dword [rcx + 0x7c], r8d
cmp eax, dword [rcx + 0x68]
jb 0x14000eac7
mov eax, dword [rcx + 0x6c]
and edx, esi
mov dword [rcx + 0x64], eax
mov eax, dword [rcx + 0x70]
mov dword [rcx + 0x68], eax
mov dword [rcx + 0x60], edx
mov eax, dword [rcx + 0x7c]
add eax, ebx
imul edx, eax, 0x2e6
imul eax, r10d, 0x2e6
sar edx, 8
sar eax, 8
cmp edx, 0xffff8000
jge 0x14000eaee
mov edx, 0xffff8000
jmp 0x14000eaf3
cmp edx, esi
cmovg edx, esi
cmp eax, 0xffff8000
jge 0x14000eb01
mov eax, 0xffff8000
jmp 0x14000eb06
cmp eax, esi
cmovg eax, esi
mov word [r11], dx
mov word [r11 + 2], ax
add r11, 4
sub rdi, 1
jne 0x14000e986
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
add rsp, 8
ret
Function at 0x14000f0b0
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14000f186
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
movzx eax, word [rbx + 0xc]
mov edx, 0x10
mov ecx, dword [rbx + 0x10]
mov r10d, 1
mov r9, qword [rbx]
mov word [rsp + 0x36], ax
add ax, ax
movzx r8d, ax
mov eax, r8d
mov word [rsp + 0x40], r8w
imul r8d, dword [rbx + 8]
imul eax, ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x42], dx
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x20], 0x46464952
lea eax, [r8 + 0x24]
mov dword [rsp + 0x28], 0x45564157
lea r8d, [rdx + 0x1c]
mov dword [rsp + 0x2c], 0x20746d66
mov edx, r10d
mov dword [rsp + 0x44], 0x61746164
mov word [rsp + 0x34], r10w
mov dword [rsp + 0x24], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rbx]
xor edx, edx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rbx], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14000fa60
add rsp, 0x60
pop rbx
ret

Function at 0x14000f1a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rax, rdx
movsxd rdi, r8d
mov rbx, rcx
test r9, r9
je 0x14000f1d1
movsxd rdx, dword [rcx + 0xc]
mov r8, rdi
add rdx, rdx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add dword [rbx + 8], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000f230
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
mov rbx, rcx
mov rcx, rdi
lea rdx, [0x140012920]
mov esi, r9d
mov ebp, r8d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rbx], rax
test rax, rax
je 0x14000f297
mov edx, 0x2c
lea rcx, [rsp + 0x20]
mov r9, rax
lea r8d, [rdx - 0x2b]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov al, 1
mov dword [rbx + 0x10], ebp
mov dword [rbx + 0xc], esi
mov dword [rbx + 8], 0
jmp 0x14000f2a8
mov rdx, rdi
lea rcx, str.ERROR:_Unable_to_write_file___s__n
call fcn.140002b00
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14000fa60
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x140010104
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001014e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001014e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001014e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001014e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001014e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140010150
xor al, al
add rsp, 0x28
ret
Function at 0x140013a60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x140013a85
cvtsi2ss xmm0, rdx
jmp 0x140013a9a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x1400df0c0]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140013ac8
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140013ac8
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140013afa
cmp rbx, 0x200
jae 0x140013af7
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x140013afa
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140013780
Function at 0x140018ee0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x1401114a8]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor esi, esi
mov qword [rsp + 0x38], 7
mov rbx, rdx
mov qword [rcx], rsi
mov rdi, rcx
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
lea rdx, [0x1400dfa28]
lea r8d, [rsi + 1]
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rsi
call fcn.140020a60
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x40]
call fcn.14002c450
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140018f9a
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018f95
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018f95
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d4a4c
cmp qword [rsp + 0x58], 8
lea rcx, [rsp + 0x40]
lea rdx, [rbp - 0x80]
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400190a3
cmp word [rbp - 0x54], 0x2e
je 0x14001908e
test byte [rbp - 0x80], 0x10
jne 0x14001908e
mov qword [rsp + 0x20], rsi
lea rax, [rbp - 0x54]
mov qword [rsp + 0x30], rsi
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], 7
inc r8
cmp word [rax + r8*2], si
jne 0x140018ff5
lea rdx, [rbp - 0x54]
lea rcx, [rsp + 0x20]
call fcn.140020a60
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.14002c2f0
mov r8, rax
mov rax, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x14001903b
mov rdx, r8
mov rcx, rax
call fcn.14002c2d0
add qword [rdi + 8], 0x20
jmp 0x140019046
mov rdx, rax
mov rcx, rdi
call fcn.140009e70
lea rcx, [rsp + 0x60]
call fcn.14002c3c0
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001908e
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019089
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400190f4
call fcn.1400d4a4c
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140018fc2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdx, qword [rdi + 8]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, rdx
sub r8, rcx
sar r8, 5
call fcn.140017f60
lea rcx, [rsp + 0x40]
call fcn.14002c3c0
mov rax, rdi
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400d4b20
mov rbx, qword [rsp + 0x310]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400348d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x1b0
mov rax, qword [0x1401114a8]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x1400348f8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400349f2
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x140034914
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.14002c1f0
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._util_file_filesystem_win.cc
mov r9d, 0x75
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::IsRegularFile_const_class_base::FilePath__
lea rcx, [rsp + 0x40]
call fcn.14002db60
mov rcx, rax
lea rdx, str.GetFileAttributes
call fcn.140009610
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14003498d
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.14000a0e0
lea rcx, [rsp + 0x40]
call fcn.14002df10
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x140034a84
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400349e8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400349e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d4a4c
jmp 0x140034a84
test eax, 0x410
jne 0x140034a84
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x140034a0a
mov rcx, qword [rbx]
lea rdx, [rsp + 0x168]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wstat64]
test eax, eax
jne 0x140034a26
mov rax, qword [rsp + 0x180]
jmp 0x140034a86
cmp qword [rbx + 0x18], 8
jb 0x140034a30
mov rbx, qword [rbx]
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._util_file_filesystem_win.cc
mov r9d, 0xac
mov dword [rsp + 0x20], 2
lea rdx, str.unsigned___int64___cdecl_crashpad::GetFileSize_const_class_base::FilePath__
lea rcx, [rsp + 0x40]
call fcn.14002db60
mov rcx, rax
lea rdx, str.stat
call fcn.140009610
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rcx, [rsp + 0x40]
call fcn.14002df10
xor eax, eax
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400d4b20
add rsp, 0x1b0
pop rbx
ret
Function at 0x140034aa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x1401114a8]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 8
movzx edi, dl
mov rbx, rcx
jb 0x140034acf
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140034bc4
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x140034aeb
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.14002c1f0
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._util_file_filesystem_win.cc
mov r9d, 0x82
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::IsDirectory_const_class_base::FilePath__bool_
lea rcx, [rsp + 0x40]
call fcn.14002db60
mov rcx, rax
lea rdx, str.GetFileAttributes
call fcn.140009610
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140034b64
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.14000a0e0
lea rcx, [rsp + 0x40]
call fcn.14002df10
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x140034bcf
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034bbb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140034bbb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d4a4c
xor al, al
jmp 0x140034bd8
test dil, dil
jne 0x140034bd3
bt eax, 0xa
jae 0x140034bd3
xor al, al
jmp 0x140034bd8
shr eax, 4
and al, 1
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400d4b20
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rdi
ret
Function at 0x140034c00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x1401114a8]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x140034c28
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140034d34
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x140034c44
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.14002c1f0
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._util_file_filesystem_win.cc
mov r9d, 0x75
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::IsRegularFile_const_class_base::FilePath__
lea rcx, [rsp + 0x40]
call fcn.14002db60
mov rcx, rax
lea rdx, str.GetFileAttributes
call fcn.140009610
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140034cbd
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.14000a0e0
lea rcx, [rsp + 0x40]
call fcn.14002df10
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x140034d19
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034d14
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140034d14
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d4a4c
xor al, al
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400d4b20
add rsp, 0x170
pop rbx
ret
test eax, 0x410
jne 0x140034d19
mov al, 1
jmp 0x140034d1b