joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c41320
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea esi, [ebp - 0x28]
mov ecx, esi
push str.type
call fcn.01cbf900
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edi, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.01cbf900
push esi
push edi
push ebx
call fcn.01c413d0
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x1c4137d
push dword [ebp - 0x34]
call fcn.01c92c47
add esp, 4
cmp byte [ebp - 0x1d], 0
js 0x1c413b5
lea esi, [ebp - 0x1c]
mov ecx, esi
call fcn.01c415f0
mov dword [0x1d331d8], eax
cmp byte [esi + 0xb], 0
jns 0x1c413a3
push dword [ebp - 0x1c]
call fcn.01c92c47
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [ebp - 0x28]
call fcn.01c92c47
add esp, 4
jmp 0x1c41383

Function at 0x1c41870
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, dword [ebp + 0xc]
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1c41930
mov edi, eax
xor eax, eax
dec eax
mov ebx, esp
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov ecx, ebx
push 0
push edi
call fcn.01c39350
cmp byte [ebx + 0xb], 0
jns 0x1c418bf
mov ebx, dword [esp]
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
mov ebx, dword [ebp + 8]
je 0x1c41924
movzx ecx, byte [esp + 0xb]
test cl, cl
jns 0x1c418de
mov ecx, dword [esp + 4]
jmp 0x1c418e1
and ecx, 0x7f
cmp eax, ecx
jae 0x1c41924
xor esi, esi
mov edi, esp
mov ecx, edi
push esi
push eax
call fcn.01c711d0
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
movsd xmm0, qword [edi]
movsd qword [ebx], xmm0
mov dword [edi + 4], esi
mov dword [edi], esi
mov dword [edi + 8], esi
cmp byte [esp + 0xb], 0
js 0x1c4193f
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx], eax
mov dword [ebx + 8], eax
jmp 0x1c41908
mov eax, dword [ebp + 8]
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov ebx, eax
jmp 0x1c4190f
push dword [esp]
call fcn.01c92c47
add esp, 4
jmp 0x1c4190f
Function at 0x1c41d20
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 8]
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [esp + 0x20], eax
cmp byte [esi + 0xb], 0
mov edi, esi
jns 0x1c41d44
mov edi, dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c41d6e
test al, 0x10
jne 0x1c41d8b
push edi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_conflicts_with_an_existing_file.___n
call fcn.01c41ee0
add esp, 0xc
xor ebx, ebx
jmp 0x1c41e0a
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c41da2
mov ecx, dword [esi]
mov eax, dword [esi + 4]
jmp 0x1c41da7
push edi
push str.RecursiveDirectoryCreate
push str._hs___ls_directory_exists___n
call fcn.01c41ee0
add esp, 0xc
mov bl, 1
jmp 0x1c41e0a
and eax, 0x7f
mov ecx, esi
add eax, eax
test eax, eax
je 0x1c41dc4
movzx edx, word [ecx + eax - 2]
add eax, 0xfffffffe
cmp edx, 0x5c
je 0x1c41dbf
cmp edx, 0x2f
jne 0x1c41da9
cmp eax, 0xfffffffe
jne 0x1c41e1f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1c41df7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0xb7
je 0x1c41e7d
push esi
push edi
push str.Failed_to_create_directory__ls__last_error_is__d_n
call fcn.01c41ee0
add esp, 0xc
xor ebx, ebx
cmp byte [esp + 0x1b], 0
jns 0x1c41e0a
push dword [esp + 0x10]
call fcn.01c92c47
add esp, 4
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
sar eax, 1
lea edx, [esi + 0xc]
lea ecx, [esp + 4]
push edx
push eax
push 0
push esi
call fcn.01c3e840
cmp byte [esp + 0x1b], 0
jns 0x1c41e45
push dword [esp + 0x10]
call fcn.01c92c47
add esp, 4
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [ecx + 8], eax
movsd xmm0, qword [esp + 4]
movsd qword [ecx], xmm0
push ecx
call fcn.01c41d20
add esp, 4
test al, al
jne 0x1c41dc4
push str.Failed_to_create_one_of_the_parent_directories
call fcn.01c41ee0
add esp, 4
jmp 0x1c41df5
lea ecx, [esp + 4]
push edi
call fcn.01cbf900
lea eax, [esp + 4]
cmp byte [eax + 0xb], 0
jns 0x1c41e95
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne cl
and eax, 0x10
shr eax, 4
and al, cl
cmp byte [esp + 0xf], 0
jns 0x1c41ec5
push dword [esp + 4]
mov dword [esp + 4], eax
call fcn.01c92c47
mov eax, dword [esp + 4]
add esp, 4
test al, al
je 0x1c41de6
jmp 0x1c41df7
Function at 0x1c41ee0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp + 0xc]
mov dword [ebp - 0x14], edi
call fcn.01c6bba0
mov ebx, 0x1d331dc
push edi
push 0
push esi
push 0x400
push ebx
push dword [eax + 4]
push dword [eax]
call fcn.01c9751b
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c42690
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov esi, dword [ebp + 8]
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x216]
push 0x206
push 0xff
push edi
call fcn.01c96470
add esp, 0xc
mov word [edi - 2], 0
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x1d06148
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1c42723
inc eax
cmp eax, 1
je 0x1c42723
lea edi, [eax - 1]
cmp word [ebp + eax*2 - 0x21c], 0x5c
mov eax, edi
je 0x1c426eb
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c4270a
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.01ca99e3
add esp, 0xc
test eax, eax
je 0x1c42800
mov word [ebp - 0x218], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.PROGRAMFILES_X86_
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1c42787
inc eax
cmp eax, 1
je 0x1c42787
lea edi, [eax - 1]
cmp word [ebp + eax*2 - 0x21c], 0x5c
mov eax, edi
je 0x1c4274f
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c4276e
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.01ca99e3
add esp, 0xc
test eax, eax
je 0x1c4280d
mov word [ebp - 0x218], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.PROGRAMW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x1c427e7
inc eax
cmp eax, 1
je 0x1c427e7
lea edi, [eax - 1]
cmp word [ebp + eax*2 - 0x21c], 0x5c
mov eax, edi
je 0x1c427b3
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c427d2
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.01ca99e3
add esp, 0xc
test eax, eax
je 0x1c4281a
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c42827
mov eax, dword [esi + 4]
jmp 0x1c4282a
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c42844
mov eax, dword [esi + 4]
jmp 0x1c42847
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c42861
mov eax, dword [esi + 4]
jmp 0x1c42864
and eax, 0x7f
mov bl, 1
cmp eax, edi
je 0x1c427e9
mov ecx, esi
push edi
call fcn.01ccf450
cmp word [eax], 0x5c
jne 0x1c42723
jmp 0x1c427e9
and eax, 0x7f
mov bl, 1
cmp eax, edi
je 0x1c427e9
mov ecx, esi
push edi
call fcn.01ccf450
cmp word [eax], 0x5c
jne 0x1c42787
jmp 0x1c427e9
and eax, 0x7f
mov bl, 1
cmp eax, edi
je 0x1c427e9
mov ecx, esi
push edi
call fcn.01ccf450
cmp word [eax], 0x5c
jne 0x1c427e7
jmp 0x1c427e9
Function at 0x1c42e00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d339dc]
test eax, eax
jne 0x1c42ee8
mov edi, 0xc
push edi
call fcn.01c92c17
add esp, 4
mov esi, eax
xor ebx, ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x1d339dc], eax
push edi
call fcn.01c92c17
add esp, 4
mov edi, eax
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [0x1d339e0], eax
call fcn.01c411c0
mov eax, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x28]
push str.user_data_dir
call fcn.01cbf900
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x34]
push eax
call fcn.01cbf900
lea ebx, [ebp - 0x1c]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.01c413d0
add esp, 0xc
push edi
push esi
push dword [ebp - 0x38]
push ebx
call fcn.01c429a0
add esp, 0x10
mov byte [ebp - 0x38], al
cmp byte [ebx + 0xb], 0
jns 0x1c42eb7
push dword [ebp - 0x1c]
call fcn.01c92c47
add esp, 4
cmp byte [ebp - 0x29], 0
jns 0x1c42ec8
push dword [ebp - 0x34]
call fcn.01c92c47
add esp, 4
cmp byte [ebp - 0x1d], 0
jns 0x1c42ed9
push dword [ebp - 0x28]
call fcn.01c92c47
add esp, 4
cmp byte [ebp - 0x38], 0
je 0x1c42f97
mov eax, dword [0x1d339dc]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp eax, ecx
je 0x1c42f0a
cmp byte [ecx + 0xb], 0
movzx edx, byte [eax + 0xb]
js 0x1c42f67
test dl, dl
jns 0x1c42f47
push dword [eax + 4]
push dword [eax]
call fcn.01c3ea40
mov bl, 1
test esi, esi
je 0x1c42f33
mov eax, dword [0x1d339e0]
cmp eax, esi
je 0x1c42f33
cmp byte [esi + 0xb], 0
movzx edx, byte [eax + 0xb]
js 0x1c42f72
test dl, dl
jns 0x1c42f57
mov ecx, esi
push dword [eax + 4]
push dword [eax]
call fcn.01c3ea40
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x1c42f0a
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
movsd xmm0, qword [eax]
movsd qword [esi], xmm0
jmp 0x1c42f33
test dl, dl
jns 0x1c42f7d
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x1c42f80
test dl, dl
jns 0x1c42f89
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x1c42f8c
and edx, 0x7f
push edx
push eax
call fcn.01c3e970
jmp 0x1c42f0a
and edx, 0x7f
mov ecx, esi
push edx
push eax
call fcn.01c3e970
jmp 0x1c42f33
xor ebx, ebx
jmp 0x1c42f33
Function at 0x1c43330
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1d33a18]
mov ecx, dword [0x1d31114]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c43361
movzx eax, word [0x1d339f4]
cmp eax, 9
jne 0x1c433ac
xor eax, eax
inc eax
pop ebp
ret
push 0x1d33a18
call fcn.01c92cb7
add esp, 4
cmp dword [0x1d33a18], 0xffffffff
jne 0x1c43350
xorps xmm0, xmm0
movups xmmword [0x1d33a04], xmm0
movups xmmword [0x1d339f4], xmm0
mov dword [0x1d33a14], 0
push 0x1d339f4
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x1d33a18
call fcn.01c92d2d
add esp, 4
jmp 0x1c43350
test eax, eax
je 0x1c4335f
cmp eax, 6
jne 0x1c433bc
mov eax, 2
jmp 0x1c4335f
cmp eax, 0xc
jne 0x1c433c8
mov eax, 3
jmp 0x1c4335f
mov eax, 4
jmp 0x1c4335f
Function at 0x1c47650
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x1c]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push str.LOCALAPPDATA
push esi
call fcn.01c41870
add esp, 8
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c4768c
mov eax, dword [ebp - 0x18]
jmp 0x1c4768f
and eax, 0x7f
test eax, eax
jne 0x1c4770b
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1c476c6
cmp byte [ebp - 0x11], 0
jns 0x1c476b2
push dword [ebp - 0x1c]
call fcn.01c92c47
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, eax
inc edi
mov ecx, esi
push 0
push edi
call fcn.01c711d0
cmp byte [ebp - 0x11], 0
jns 0x1c476dc
mov esi, dword [ebp - 0x1c]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1c476fc
movzx ecx, byte [ebp - 0x11]
test cl, cl
jns 0x1c476f5
mov ecx, dword [ebp - 0x18]
jmp 0x1c476f8
and ecx, 0x7f
cmp eax, ecx
jb 0x1c47700
xor ebx, ebx
jmp 0x1c476a1
lea ecx, [ebp - 0x1c]
push 0
push eax
call fcn.01c711d0
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov edi, dword [ebp - 0x14]
mov dword [esi + 8], edi
movsd xmm0, qword [ebp - 0x1c]
movsd qword [esi], xmm0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c47741
mov eax, dword [esi + 4]
test eax, eax
je 0x1c47794
mov ecx, dword [esi]
jmp 0x1c47747
mov ecx, esi
test eax, eax
je 0x1c47794
mov edi, dword [ebp + 0xc]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x1c4775b
mov ecx, esi
push 0x5c
call fcn.01c70ef0
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1c4776a
mov eax, dword [edi + 4]
mov edi, dword [edi]
jmp 0x1c4776d
and eax, 0x7f
mov ecx, esi
push eax
push edi
call fcn.01c3e6d0
mov ecx, esi
push 0x5c
call fcn.01c70ef0
mov ecx, esi
push 9
push 0x1d07e20
call fcn.01c3e6d0
mov bl, 1
jmp 0x1c476a1
push str.string_index_out_of_bounds
push str.__pos___size__
push 0x45b
push str....._buildtools_third_partylibc_trunkinclude_string
push str._s:_d:_assertion__s_failed:__s
call fcn.01cc0890
int3
Function at 0x1c4c440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x1c4c477
mov eax, dword [0x1d2ede4]
cmp eax, 0xffffffff
je 0x1c4c504
mov ebx, 0x100000
test eax, eax
jne 0x1c4c477
mov ebx, 0x80000
push 0x10
call fcn.01c92c17
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x1d392cc]
bt ecx, eax
jb 0x1c4c4f9
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x1d412cc], 1
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push 0x10000
push esi
push 0x1c4c8e0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1c4c528
test edi, edi
je 0x1c4c586
mov dword [edi], eax
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.01c7b680
add esp, 4
jmp 0x1c4c4a5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x1d2ede4
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1c4c5fa
mov eax, dword [0x1d2ede4]
jmp 0x1c4c469
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x1c4c544
mov edi, eax
cmp eax, 0x5af
je 0x1c4c544
cmp edi, 0xe
jne 0x1c4c596
push ebx
call fcn.01ce1020
add esp, 4
test esi, esi
mov eax, dword [ebp - 0x20]
je 0x1c4c4e0
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x1d392cc]
bt edx, ecx
jae 0x1c4c575
push eax
call fcn.01c7b7a0
add esp, 4
push esi
call fcn.01c92c47
add esp, 4
mov eax, dword [ebp - 0x20]
jmp 0x1c4c4e0
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1c4c4e0
mov eax, dword [0x1d33b04]
mov ecx, dword [0x1d31114]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c4c609
lea ebx, [ebp - 0x1c]
push edi
push ebx
call fcn.01c51f90
add esp, 8
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c4c5d0
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
jmp 0x1c4c5d3
and eax, 0x7f
push eax
push ebx
push dword [0x1d33b00]
call fcn.01c7c4b0
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x1c4c54d
push dword [ebp - 0x1c]
call fcn.01c92c47
jmp 0x1c4c54a
mov dword [0x1d2ede4], 0
jmp 0x1c4c472
push 0x1d33b04
call fcn.01c92cb7
add esp, 4
cmp dword [0x1d33b04], 0xffffffff
jne 0x1c4c5b3
push 0x20
push str.create_thread_last_error
call fcn.01c58fb0
add esp, 8
mov dword [0x1d33b00], eax
push 0x1d33b04
call fcn.01c92d2d
add esp, 4
jmp 0x1c4c5b3
Function at 0x1c4eea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1c4ef13
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x1c4eefd
cmp dword [ebp - 0x18], 4
jne 0x1c4eefd
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x1c4eefd

Function at 0x1c4ef20
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.01c94020
mov esi, ecx
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x800
lea edi, [ebp - 0x810]
push ebx
push 0xff
push edi
call fcn.01c96470
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], ebx
push ecx
push edi
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1c4efb9
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x1c4efbd
push edi
call fcn.01cad054
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.01c3e3d0
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x1c4efa0
cmp eax, 2
jne 0x1c4f009
lea ebx, [ebp - 0x1010]
push 0x800
push 0xff
push ebx
call fcn.01c96470
add esp, 0xc
push 0x400
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x1c4f010
push ebx
call fcn.01cad054
add esp, 4
mov ecx, esi
push eax
push ebx
jmp 0x1c4ef99
mov esi, 0x3f4
jmp 0x1c4efa0
mov esi, 0xea
jmp 0x1c4efa0
Function at 0x1c522b0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, ecx
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1c522d2
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1c52307
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1c52320
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov ecx, esi
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.01c523e0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.01c798d0
add esp, 4
test al, al
jne 0x1c52332
xor ebx, ebx
jmp 0x1c52309
call fcn.01cdfce0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x266
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.01cdfe20
lea eax, [ebp - 0xb0]
push 0x10
push str.CreateDirectory
push eax
call fcn.01cc02b0
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c52376
mov eax, dword [esi + 4]
mov esi, dword [esi]
jmp 0x1c52379
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.01c71560
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c523a0
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x1c523a3
and eax, 0x7f
push eax
push ebx
push edi
call fcn.01cc02b0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1c523c5
push dword [ebp - 0xc4]
call fcn.01c92c47
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01cdfe80
jmp 0x1c5232e
Function at 0x1c523e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov esi, ecx
mov eax, dword [0x1d15014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1c52402
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c5242b
mov bl, 1
test al, 0x10
je 0x1c5247d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c93c03
mov eax, ebx
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.01c798d0
add esp, 4
test al, al
je 0x1c5248b
call fcn.01cdfce0
lea ecx, [ebp - 0xb8]
push eax
push 2
push 0x251
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.01cdfe20
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cc02b0
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c524cd
mov eax, dword [esi + 4]
mov esi, dword [esi]
jmp 0x1c524d0
push 2
call fcn.01c798d0
add esp, 4
test al, al
jne 0x1c5248f
xor ebx, ebx
jmp 0x1c52414
lea ecx, [ebp - 0xb8]
push 2
push 0x255
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.01c55740
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cc02b0
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c524f7
mov eax, dword [esi + 4]
mov esi, dword [esi]
jmp 0x1c524fa
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.01c71560
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c52521
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x1c52524
and eax, 0x7f
lea ebx, [ebp - 0xc4]
push eax
push esi
push ebx
call fcn.01c71560
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c52556
mov eax, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xc4]
jmp 0x1c52559
and eax, 0x7f
push eax
push ebx
push edi
call fcn.01cc02b0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1c52546
push dword [ebp - 0xc4]
call fcn.01c92c47
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01cdfe80
jmp 0x1c5248b
and eax, 0x7f
push eax
push ebx
push edi
call fcn.01cc02b0
add esp, 0xc
push 0x11
push str.:_not_a_directory
push eax
call fcn.01cc02b0
add esp, 0xc
cmp byte [ebp - 0xb9], 0
jns 0x1c5258b
push dword [ebp - 0xc4]
call fcn.01c92c47
add esp, 4
lea ecx, [ebp - 0xb8]
call fcn.01c55b80
jmp 0x1c5248b