joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400335a0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140125038]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdx, qword [0x140138350]
test rdx, rdx
jne 0x1400336b7
mov ecx, 0x18
call fcn.140089b6c
mov rbx, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [0x140138350], rax
mov ecx, 0x18
call fcn.140089b6c
mov r14, rax
movups xmmword [rax], xmm6
mov qword [rax + 0x10], r15
mov qword [0x140138358], rax
call fcn.140030f80
mov rax, qword [rax + 8]
mov r15, qword [rax + 0x10]
lea rdx, str.user_data_dir
lea r12, [rsp + 0x38]
mov rcx, r12
call fcn.1400bd1d0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r13, [rsp + 0x20]
mov rcx, r13
mov rdx, rax
call fcn.1400bd1d0
lea rbp, [rsp + 0x50]
mov rcx, rbp
mov rdx, r13
mov r8, r12
call fcn.140031490
mov rcx, rbp
mov rdx, r15
mov r8, rbx
mov r9, r14
call fcn.140033000
mov ebx, eax
cmp byte [rbp + 0x17], 0
jns 0x140033686
mov rcx, qword [rsp + 0x50]
call fcn.140089ba8
cmp byte [rsp + 0x37], 0
jns 0x140033697
mov rcx, qword [rsp + 0x20]
call fcn.140089ba8
cmp byte [rsp + 0x4f], 0
jns 0x1400336a8
mov rcx, qword [rsp + 0x38]
call fcn.140089ba8
test bl, bl
je 0x14003379e
mov rdx, qword [0x140138350]
cmp rdx, rdi
je 0x1400336e2
cmp byte [rdi + 0x17], 0
movzx r8d, byte [rdx + 0x17]
js 0x140033760
test r8b, r8b
jns 0x140033740
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, rdi
mov rdx, rax
call fcn.140028500
mov dil, 1
test rsi, rsi
je 0x140033718
mov rdx, qword [0x140138358]
cmp rdx, rsi
je 0x140033718
cmp byte [rsi + 0x17], 0
movzx r8d, byte [rdx + 0x17]
js 0x14003376e
test r8b, r8b
jns 0x140033750
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, rsi
mov rdx, rax
call fcn.140028500
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14008b000
mov eax, edi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rdx + 0x10]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rdi], xmm0
jmp 0x1400336e2
mov rax, qword [rdx + 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
jmp 0x140033718
test r8b, r8b
jns 0x14003377c
mov r8, qword [rdx + 8]
mov rdx, qword [rdx]
jmp 0x140033780
test r8b, r8b
jns 0x14003378d
mov r8, qword [rdx + 8]
mov rdx, qword [rdx]
jmp 0x140033791
and r8d, 0x7f
mov rcx, rdi
call fcn.140028410
jmp 0x1400336e2
and r8d, 0x7f
mov rcx, rsi
call fcn.140028410
jmp 0x140033718
xor edi, edi
jmp 0x140033718
Function at 0x14003d530
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
je 0x14003d56f
test r15, r15
je 0x14003d65d
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x14003d5b9
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.14008ca80
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x14003d54d
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x14003d689
lea rcx, [r12*8]
call fcn.140089b6c
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x14003d62d
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
mov r10, rcx
add r10, r9
je 0x14003d65d
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x14003d615
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x14003d54d
mov rcx, r14
call fcn.140089ba8
mov r15, qword [rsi + 0x10]
jmp 0x14003d54d
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.1400bdb10
call fcn.1400bd2e0
int3
Function at 0x14003d9c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140125038]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x50]
mov qword [r14 + 0x50], r12
movaps xmm0, xmmword [0x140109be0]
movaps xmmword [r14 + 0x40], xmm0
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, [0x14010f4f8]
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x93
call fcn.14006fe10
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14006fe40
test esi, esi
js 0x14003dacf
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], 0
call fcn.14007bb90
test al, al
jne 0x14003dad6
lea r14, [rsp + 0x2c]
mov dword [r14], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [r14]
lea rcx, [rsp + 0x30]
call fcn.14007bc20
lea rcx, [rsp + 0x50]
call fcn.14006fea0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14008b000
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14003daa2
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1400e5070
jmp 0x14003da67
Function at 0x14003dc70
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140125038]
xor rax, rsp
mov qword [rsp + 0xc0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x50], rax
movaps xmm0, xmmword [0x140109be0]
movaps xmmword [r14 + 0x40], xmm0
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.DoInitialize
lea r8, [0x14010f4f8]
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x16f
call fcn.14006fe10
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14006fe40
mov eax, edi
and eax, 1
neg eax
and eax, 3
test dil, 2
mov edx, 1
cmove edx, eax
test dil, 4
mov ecx, 4
cmovne edx, ecx
test dil, 8
mov r8d, 2
cmove r8d, edx
test dil, 0x10
mov eax, 5
cmove eax, r8d
test eax, eax
je 0x14003ded7
mov edx, edi
and edx, 0x40
shl edx, 0x18
test dil, 0x80
cmove ecx, edx
mov edx, edi
rol edx, 0x1a
mov r8d, edi
shl r8d, 0xb
and r8d, 0x20000000
mov r9d, edi
shr r9d, 4
and r9d, 0x10000
and edx, 0x80000100
or edx, r8d
or edx, r9d
or edx, ecx
mov ecx, edi
shr ecx, 8
and ecx, 3
mov r8d, edi
shr r8d, 0xd
and r8d, 4
or r8d, ecx
xor r8d, 3
mov r14d, edi
and r14d, 0x400
mov ecx, r14d
shl ecx, 0x14
mov r9d, edi
shr r9d, 3
and r9d, 0x100
or r9d, ecx
mov ecx, edi
shr ecx, 0xb
and ecx, 2
or ecx, r9d
mov r9d, edi
shl r9d, 0xd
and r9d, 0x4000000
or r9d, ecx
mov ecx, edi
shl ecx, 8
and ecx, 0xa000000
or ecx, r9d
cmp byte [rbx + 0x17], 0
jns 0x14003ddec
mov rbx, qword [rbx]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov rcx, rbx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp qword [rsi], rax
je 0x14003de48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003debe
mov rax, rbx
inc rax
cmp rax, 2
jb 0x14003de3d
mov qword [rsi], rbx
call fcn.14006fe30
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsi]
inc rbx
cmp rbx, 2
jb 0x14003de9b
shr r14d, 0xa
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x29], r14b
test dil, 4
jne 0x14003dead
test dil, 0xa
je 0x14003de70
mov byte [rsi + 0x28], 1
lea rcx, [rsp + 0x60]
call fcn.14006fea0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14008b000
nop
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003db00
mov dword [rsi + 0x24], eax
jmp 0x14003de70
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [rsi + 0x28]
jmp 0x14003de70
call fcn.14006fe30
mov rcx, qword [rsi]
call fcn.140071160
mov qword [rsi], 0
jmp 0x14003de29
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsi + 0x24], 0xffffffff
jmp 0x14003de70
Function at 0x14003e0e0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.14003d990
mov qword [rsi], 0
test rax, rax
je 0x14003e133
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003e167
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14003e12b
mov qword [rsi], rbx
call fcn.14006fe30
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.140064b70
lea rcx, [rsi + 0x20]
call fcn.14007bbb0
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.14006fe30
mov rcx, qword [rsi]
call fcn.140071160
mov qword [rsi], 0
jmp 0x14003e119
Function at 0x14003f390
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [rcx], 0
je 0x14003f39d
mov ecx, dword [rcx + 4]
jmp fcn.14004f1c0
ret

Function at 0x14003f760
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r12d, dword [rsp + 0xc0]
mov rax, qword [0x140125038]
xor rax, rsp
mov qword [rsp + 0x58], rax
shl ebp, 0x10
mov ecx, 0x18
call fcn.140089b6c
mov rsi, rax
mov rax, qword [0x140127720]
and rax, r15
cmp rax, qword [0x140127708]
je 0x14003f824
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r12d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x14003fc50]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14003f82e
test r14, r14
je 0x14003f879
mov qword [r14], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14008b000
mov eax, ebx
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, r15
call fcn.140069eb0
jmp 0x14003f7bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x14003f847
mov ebp, eax
cmp eax, 0x5af
je 0x14003f847
cmp ebp, 0xe
jne 0x14003f887
mov rcx, rbx
call fcn.1400dd4f0
test rsi, rsi
je 0x14003f800
mov rcx, qword [rsi]
mov rax, qword [0x140127720]
and rax, rcx
cmp rax, qword [0x140127708]
jne 0x14003f86f
call fcn.14006a000
mov rcx, rsi
call fcn.140089ba8
jmp 0x14003f800
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003f800
mov eax, dword [0x1401385f0]
mov ecx, dword [0x140134f3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003f8ff
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov edx, ebp
call fcn.14003e280
movzx eax, byte [rbx + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rbx]
cmovns rax, rbx
cmovs rcx, qword [rbx + 8]
lea rdx, [rsp + 0x48]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, qword [0x1401385e8]
call fcn.14007ae00
cmp byte [rbx + 0x17], 0
jns 0x14003f84f
mov rcx, qword [rsp + 0x30]
call fcn.140089ba8
jmp 0x14003f84f
lea rcx, [0x1401385f0]
call fcn.140089cc0
cmp dword [0x1401385f0], 0xffffffff
jne 0x14003f8a8
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.14004d9e0
mov qword [0x1401385e8], rax
lea rcx, [0x1401385f0]
call fcn.140089d58
jmp 0x14003f8a8
Function at 0x140040240
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, [0x140109268]
mov qword [rcx], rax
add rcx, 8
call fcn.140069e30
lea rcx, [rsi + 0x10]
call fcn.140069e30
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.140069e30
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
mov qword [rsi + 0xc0], rbx
movups xmmword [rsi + 0xc8], xmm6
movups xmmword [rsi + 0xd8], xmm6
mov ebp, 0x3f800000
mov dword [rsi + 0xe8], ebp
mov dword [rsi + 0xf0], ebx
movups xmmword [rsi + 0xf8], xmm6
movups xmmword [rsi + 0x108], xmm6
mov dword [rsi + 0x118], ebp
movups xmmword [rsi + 0x120], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x140], ebp
movups xmmword [rsi + 0x148], xmm6
movups xmmword [rsi + 0x158], xmm6
mov dword [rsi + 0x168], ebp
movups xmmword [rsi + 0x170], xmm6
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebp
mov qword [rsi + 0x1b0], rbx
movups xmmword [rsi + 0x198], xmm6
mov dword [rsi + 0x1a8], ebx
mov eax, dword [0x140113cfc]
mov dword [rsi + 0x1b8], eax
lea rcx, [rsi + 0x1c0]
call fcn.140050750
lea rcx, [rsi + 0x310]
movups xmmword [rsi + 0x2f8], xmm6
mov qword [rsi + 0x308], rbx
xor edx, edx
call fcn.14004cd20
lea rcx, [rsi + 0x320]
xor edx, edx
call fcn.14004cd20
lea rcx, [rsi + 0x330]
xor edx, edx
call fcn.14004cd20
movups xmmword [rsi + 0x340], xmm6
movups xmmword [rsi + 0x350], xmm6
mov dword [rsi + 0x360], ebp
movups xmmword [rsi + 0x368], xmm6
movups xmmword [rsi + 0x378], xmm6
movups xmmword [rsi + 0x388], xmm6
mov byte [rsi + 0x398], bl
mov dword [rsi + 0x39c], edi
mov byte [rsi + 0x3a0], bl
movups xmmword [rsi + 0x3a8], xmm6
movups xmmword [rsi + 0x3b8], xmm6
call fcn.140019c10
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x1a8], eax
mov eax, eax
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x1a0], rax
mov rcx, rsi
call fcn.140040470
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x14004045b
call fcn.140050310
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.1400503c0
mov qword [0x1401389d8], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x14014b008]
jmp 0x140040429
Function at 0x140042050
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov edi, 2
cmp rdx, 1
jne 0x140042080
mov rbx, qword [rsi + 8]
cmp rdi, rbx
jbe 0x14004208e
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14003c540
lea rax, [rdx - 1]
test rdx, rax
jne 0x1400420a4
mov rdi, rdx
jmp 0x140042065
jae 0x140042191
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x1400420b1
cvtsi2ss xmm0, rax
jmp 0x1400420c6
mov rcx, rdx
call fcn.140061a00
mov rdi, rax
jmp 0x140042065
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.1400bc870
cvttss2si rax, xmm0
mov rcx, rax
subss xmm0, dword [0x14010a8cc]
cvttss2si rdx, xmm0
sar rcx, 0x3f
and rdx, rcx
or rdx, rax
cmp rbx, 3
jb 0x140042179
mov rax, rbx
shr rax, 1
movabs rcx, 0x5555555555555555
and rcx, rax
mov rax, rbx
sub rax, rcx
movabs rcx, 0x3333333333333333
mov r8, rax
shr r8, 2
and rax, rcx
and r8, rcx
add r8, rax
mov rax, r8
shr rax, 4
add rax, r8
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rax
movabs rax, 0x101010101010101
imul rax, rcx
shr rax, 0x38
cmp eax, 1
ja 0x140042179
lea rax, [rdx - 1]
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
cmp rdx, 2
cmovb rax, rdx
jmp 0x140042181
mov rcx, rdx
call fcn.140061a00
cmp rdi, rax
cmovbe rdi, rax
cmp rdi, rbx
jb 0x14004206e
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140044980
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x140125038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x1400449b3
mov rax, qword [rsi + 8]
test rax, rax
je 0x140044aab
mov eax, ebx
not eax
test eax, 0x300
je 0x140044aab
cmp edi, 2
lea rax, [0x14013bfe0]
lea rcx, [0x14013c1e0]
cmove rcx, rax
cmp word [rcx], 0
jne 0x140044aab
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [r14], 0
je 0x140044aab
cmp byte [0x14013bfd0], 0
setne al
bt ebx, 8
jb 0x140044aab
shr ebx, 9
and ebx, 1
or bl, al
je 0x140044aab
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea r12, str.SOFTWARE
cmove r12, rax
movzx ebp, byte [rsi + 0x17]
test bpl, bpl
jns 0x140044b07
mov r14, qword [rsi]
mov rbp, qword [rsi + 8]
mov edi, 1
xor ebx, ebx
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov r15, qword [r12 + 8]
mov r13, rbp
sub r13, r15
jb 0x140044a98
mov rdx, qword [r12]
mov rcx, r14
mov r8, r15
call fcn.1400a4bb4
test eax, eax
je 0x140044aca
add r12, 0x28
inc rbx
cmp rbx, rdi
jb 0x140044a78
cmp dword [rsp + 0x2c], 0
jne 0x140044b0f
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14008b000
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, word [r14 + r15*2]
cmp ecx, 0x5c
je 0x140044ad8
test ecx, ecx
jne 0x140044a98
lea rax, [r14 + r15*2]
mov edx, dword [r12 + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x140044b38
cmp dword [rsp + 0x2c], 2
jne 0x140044b49
lea rdx, str.WOW6432Node
mov qword [rsp + 0x38], rdx
mov rdx, rax
mov qword [rsp + 0x30], rax
jmp 0x140044b49
mov r14, rsi
jmp 0x140044a5b
cmp byte [rsi + 0x17], 0
mov rax, rsi
jns 0x140044b1b
mov rax, qword [rsi]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, rsi
mov r8, qword [rsp + 0x38]
call fcn.1400d40f0
jmp 0x140044aab
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r14
cmp cx, 0x5c
jne 0x140044b62
lea r14, [rax + 2]
dec r13
cmp word [rax + 2], 0x5c
mov rax, r14
je 0x140044b4f
jmp 0x140044b65
mov r14, rax
mov rdi, qword [r12 + 0x20]
mov r12, qword [r12 + 0x18]
xor ebx, ebx
mov rbp, r13
jmp 0x140044a9f
Function at 0x140046b80
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140125038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140046ba7
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140046be1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140046c00
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14008b000
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140046cd0
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14008b000
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14006efc0
test al, al
jne 0x140046c12
xor esi, esi
jmp 0x140046be4
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x266
mov r9d, 2
call fcn.1400dacd0
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400bd2f0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140067fe0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140046c98
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
jmp 0x140046c9c
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.1400bd2f0
cmp byte [rsp + 0x4f], 0
jns 0x140046cb8
mov rcx, qword [rsp + 0x38]
call fcn.140089ba8
lea rcx, [rsp + 0x50]
call fcn.1400dad50
jmp 0x140046c0e
Function at 0x140046cd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x140125038]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x140046cf7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140046d29
mov dil, 1
test al, 0x10
je 0x140046dc8
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14008b000
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14006efc0
test al, al
je 0x140046dd6
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x251
mov r9d, 2
call fcn.1400dacd0
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400bd2f0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x38]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.140067fe0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140046e5a
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
jmp 0x140046e5e
mov ecx, 2
call fcn.14006efc0
test al, al
jne 0x140046ddd
xor edi, edi
jmp 0x140046d0d
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x255
mov r9d, 2
call fcn.14003b420
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400bd2f0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.140067fe0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140046e89
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
jmp 0x140046e8d
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.1400bd2f0
cmp byte [rsp + 0x5f], 0
jns 0x140046e7a
mov rcx, qword [rsp + 0x48]
call fcn.140089ba8
lea rcx, [rsp + 0x60]
call fcn.1400dad50
jmp 0x140046dd6
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.1400bd2f0
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1400bd2f0
cmp byte [rsp + 0x5f], 0
jns 0x140046ebe
mov rcx, qword [rsp + 0x48]
call fcn.140089ba8
lea rcx, [rsp + 0x60]
call fcn.14003b910
jmp 0x140046dd6