joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c66a80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x1cf3170]
cmp eax, 0xffffffff
je 0x1c66a9d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1c66aa2
call fcn.01c66bc0
mov eax, dword [0x1cf6be4]
mov ecx, dword [0x1cf5970]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c66b75
mov edi, dword [0x1cf6be0]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1c66b69
mov ecx, dword [0x1cf5fdc]
add ecx, 1
mov edx, 0x100
nop word cs:[eax + eax]
movzx ebx, cl
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x1cf5fe0], 0
je 0x1c66b1d
lea eax, [ecx + 1]
movzx ebx, al
lea eax, [ebx + ebx*2]
cmp dword [eax*4 + 0x1cf5fe0], 0
je 0x1c66b1d
add ecx, 2
add edx, 0xfffffffe
jne 0x1c66af0
jmp 0x1c66b4d
lea ecx, [eax*4 + 0x1cf5fe0]
mov dword [ecx], 1
lea eax, [ebx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x1cf5fe4], ecx
mov dword [0x1cf5fdc], ebx
mov dword [esi], ebx
mov eax, dword [eax + eax*2 + 0x1cf5fe8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1c66bba
cmp eax, 0x100
jge 0x1c66bbd
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ecx, edi
call fcn.01c63d80
jmp 0x1c66ad8
push 0x1cf6be4
call fcn.01c92b47
add esp, 4
cmp dword [0x1cf6be4], 0xffffffff
jne 0x1c66ac3
push 4
call fcn.01c92a8c
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.01c63d70
mov dword [0x1cf6be0], edi
push 0x1cf6be4
call fcn.01c92bbd
add esp, 4
jmp 0x1c66ac3
int3
int3

Function at 0x1c66bc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x808
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x810], 0xffffffff
mov eax, dword [0x1cf3170]
mov dword [ebp - 0x810], eax
cmp eax, 0xffffffff
jne 0x1c66c68
lea esi, [ebp - 0x810]
push esi
call fcn.01c74610
add esp, 4
test al, al
je 0x1c66ce9
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x1c66c3f
push esi
call fcn.01c74610
add esp, 4
test al, al
je 0x1c66cec
cmp dword [ebp - 0x810], 0xffffffff
je 0x1c66cec
push 0xffffffffffffffff
call fcn.01c74630
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x1cf3170], ecx
mov eax, dword [ebp - 0x810]
je 0x1c66c68
push eax
call fcn.01c74630
add esp, 4
mov eax, dword [0x1cf3170]
mov dword [ebp - 0x810], eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1c66ce6
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.01c97000
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.01c74640
add esp, 8
push 0x800
call fcn.01c92af3
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.01c96500
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.01c74640
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01c92b01
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebp
ret
int3
int3
int3
Function at 0x1c6cb10
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 0xc]
movzx edx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test dl, dl
mov dword [ebp - 0x10], ecx
lea ecx, [eax + ecx]
mov dword [ebp - 0x20], edx
lea edx, [esi + edx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
jb 0x1c6cb7d
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1c6cb50
cmp edx, 1
jne 0x1c6cb86
jmp 0x1c6cba2
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x1c6cba2
cmp edx, 2
je 0x1c6cb99
cmp edx, 3
jne 0x1c6cbad
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx + 4]
xor ecx, ecx
test edi, edi
je 0x1c6cd08
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ebx, eax
shr ebx, 0xf
xor ebx, eax
mov eax, edi
shr eax, 1
and eax, 0x55555555
mov edx, edi
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
ja 0x1c6cc14
lea edx, [edi - 1]
and edx, ebx
jmp 0x1c6cc20
mov edx, ebx
cmp ebx, edi
jb 0x1c6cc20
mov eax, ebx
xor edx, edx
div edi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x24], edx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x1c6cd08
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
mov ebx, dword [eax]
test ebx, ebx
je 0x1c6cd08
mov eax, dword [ebp - 0x18]
add eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x10]
cmovns eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x1c6cc76
and eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jne 0x1c6cd06
mov ebx, dword [ebx]
test ebx, ebx
je 0x1c6cd06
mov eax, dword [ebx + 4]
cmp dword [ebp - 0x14], eax
jne 0x1c6ccd0
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x1c6cc8b
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x1c6cc6c
lea ecx, [ebx + 8]
mov edx, dword [ecx]
test al, al
cmovs ecx, edx
js 0x1c6cce8
cmp dword [ebp - 0x10], 0
je 0x1c6cd02
cmp byte [esi], dl
jne 0x1c6cc6c
add eax, 0xffffffff
xor ecx, ecx
nop dword [eax + eax]
cmp eax, ecx
je 0x1c6cd02
movzx edx, byte [ebx + ecx + 9]
lea edi, [ecx + 1]
cmp dl, byte [esi + ecx + 1]
mov ecx, edi
je 0x1c6ccb0
jmp 0x1c6cc6c
cmp dword [ebp - 0x28], 1
jbe 0x1c6cc60
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x1c6cc63
xor edx, edx
div ecx
mov eax, edx
jmp 0x1c6cc63
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1c6cd02
push eax
push esi
push ecx
call fcn.01c955ed
add esp, 0xc
test eax, eax
jne 0x1c6cc6c
mov ecx, ebx
jmp 0x1c6cd08
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c6d7a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x158], eax
mov eax, dword [0x1cf6c64]
mov ecx, dword [0x1cf5970]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c6d7f5
mov ecx, dword [esp + 0x158]
xor ecx, ebp
call fcn.01c92b01
mov eax, 0x1cf6c60
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1cf6c64
call fcn.01c92b47
add esp, 4
cmp dword [0x1cf6c64], 0xffffffff
jne 0x1c6d7da
lea eax, [esp + 0x40]
push 0x118
push 0
push eax
call fcn.01c97000
add esp, 0xc
mov dword [esp + 0x3c], 0x11c
lea edi, [esp + 0x3c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push dword [esp + 0x50]
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x50
call fcn.01c92a8c
add esp, 4
mov esi, eax
mov ebx, dword [esp + 0xc]
mov eax, dword [0x1cf6c8c]
mov ecx, dword [0x1cf5970]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c6d8a4
mov ecx, esi
push ebx
push 0x1cf6c68
push edi
call fcn.01c6da00
mov dword [0x1cf6c60], esi
push 0x1cf6c64
call fcn.01c92bbd
add esp, 4
jmp 0x1c6d7da
push 0x1cf6c8c
call fcn.01c92b47
add esp, 4
cmp dword [0x1cf6c8c], 0xffffffff
jne 0x1c6d87e
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x30]
mov dword [0x1cf6c88], eax
movaps xmm0, xmmword [esp + 0x10]
movaps xmm1, xmmword [esp + 0x20]
movups xmmword [0x1cf6c78], xmm1
movups xmmword [0x1cf6c68], xmm0
push 0x1cf6c8c
call fcn.01c92bbd
add esp, 4
jmp 0x1c6d87e

Function at 0x1c6d920
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x30], eax
mov eax, dword [0x1cf6c8c]
mov ecx, dword [0x1cf5970]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c6d994
movzx eax, word [0x1cf6c68]
cmp eax, 0xc
ja case.0x1c6d960.1
xor esi, esi
jmp dword [eax*4 + 0x1cc544c]
mov esi, 2
jmp case.0x1c6d960.0
mov esi, 4
jmp case.0x1c6d960.0
mov esi, 1
jmp case.0x1c6d960.0
mov esi, 3
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.01c92b01
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x1cf6c8c
call fcn.01c92b47
add esp, 4
cmp dword [0x1cf6c8c], 0xffffffff
jne 0x1c6d952
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov dword [esp + 0x20], 0
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x20]
mov dword [0x1cf6c88], eax
movaps xmm0, xmmword [esp]
movaps xmm1, xmmword [esp + 0x10]
movups xmmword [0x1cf6c78], xmm1
movups xmmword [0x1cf6c68], xmm0
push 0x1cf6c8c
call fcn.01c92bbd
add esp, 4
jmp 0x1c6d952
Function at 0x1c6de90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [0x1cda44c]
xor edx, ebp
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x14]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x10]
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1c6def8
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x1c6def8
cmp dword [ebp - 0x14], 4
jne 0x1c6def8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01c92b01
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8

Function at 0x1c6df10
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.01c92f90
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x810]
push 0x800
push 0xff
push ebx
call fcn.01c97000
add esp, 0xc
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x1018], 0x800
lea eax, [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
push eax
push ebx
push ecx
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1c6dfe4
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 2
je 0x1c6df99
mov edi, 0x3f4
cmp eax, 1
jne 0x1c6dfe4
mov ecx, esi
push ebx
jmp 0x1c6dfdd
lea edi, [ebp - 0x1010]
push 0x800
push 0xff
push edi
call fcn.01c97000
add esp, 0xc
push 0x400
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xffffffff
mov edi, 0xea
cmp eax, 0x3ff
ja 0x1c6dfe4
mov ecx, esi
lea eax, [ebp - 0x1010]
push eax
call fcn.01c3fc86
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
mov eax, edi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c6f29a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, dword [ebp + 8]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1c6f2bd
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c6f2e6
mov ebx, eax
bt eax, 0xa
jae 0x1c6f2db
cmp byte [ebp + 0xc], 0
je 0x1c6f38c
and ebx, 0x10
shr ebx, 4
jmp 0x1c6f38e
push 2
call fcn.01c5b690
add esp, 4
test al, al
je 0x1c6f38c
call fcn.01c5bf90
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x81
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.01c5c130
lea eax, [ebp - 0xb4]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01c23734
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1c6f33a
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc8]
push eax
push edi
push ebx
call fcn.01c44f40
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c6f35f
mov eax, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xc8]
push eax
push ebx
push esi
call fcn.01c23734
add esp, 0xc
cmp byte [ebp - 0xbd], 0
jns 0x1c6f381
push dword [ebp - 0xc8]
call fcn.01c92abc
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.01c5c1e0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c6f3a5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, dword [ebp + 8]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1c6f3c8
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c6f3ed
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
mov eax, ebx
jmp 0x1c6f49c
push 2
call fcn.01c5b690
add esp, 4
test al, al
je 0x1c6f490
call fcn.01c5bf90
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x74
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.01c5c130
lea eax, [ebp - 0xb4]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01c23734
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1c6f43e
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc8]
push eax
push edi
push ebx
call fcn.01c44f40
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c6f463
mov eax, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xc8]
push eax
push ebx
push esi
call fcn.01c23734
add esp, 0xc
cmp byte [ebp - 0xbd], 0
jns 0x1c6f485
push dword [ebp - 0xc8]
call fcn.01c92abc
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.01c5c1e0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
xor eax, eax
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c6f4a7
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov esi, dword [ebp + 8]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c6f4ca
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c6f4fd
and eax, 0x410
cmp eax, 0x410
jne 0x1c6f4fd
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
mov ecx, esi
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.01c6f5d7
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c6f507
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x1c6f5c0
push 2
call fcn.01c5b690
add esp, 4
test al, al
je 0x1c6f5be
call fcn.01c5bf90
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x94
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.01c5c130
lea eax, [ebp - 0xb4]
push 0xb
push str.DeleteFile
push eax
call fcn.01c23734
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c6f56c
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc8]
push eax
push esi
push ebx
call fcn.01c44f40
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c6f591
mov eax, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xc8]
push eax
push ebx
push edi
call fcn.01c23734
add esp, 0xc
cmp byte [ebp - 0xbd], 0
jns 0x1c6f5b3
push dword [ebp - 0xc8]
call fcn.01c92abc
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.01c5c1e0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c6f5d7
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc0
mov edi, ecx
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1c6f5f9
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x1c6f6b6
push 2
call fcn.01c5b690
add esp, 4
test al, al
je 0x1c6f6b6
call fcn.01c5bf90
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x2f
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.01c5c130
lea eax, [ebp - 0xb4]
push 0x10
push str.RemoveDirectory
push eax
call fcn.01c23734
add esp, 0xc
movzx ecx, byte [edi + 0xb]
test cl, cl
mov dword [ebp - 0xcc], eax
jns 0x1c6f65f
mov ecx, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc8]
push ecx
push edi
push ebx
call fcn.01c44f40
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c6f684
mov eax, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xc8]
push eax
push ebx
push dword [ebp - 0xcc]
call fcn.01c23734
add esp, 0xc
cmp byte [ebp - 0xbd], 0
jns 0x1c6f6ab
push dword [ebp - 0xc8]
call fcn.01c92abc
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.01c5c1e0
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
mov eax, ebx
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c70604
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x1cda44c]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, 0x7fffffff
cmp edx, esi
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1c7064d
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
jne 0x1c70650
int3
xor esi, esi
dec esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.01c92b01
mov eax, esi
add esp, 8
pop esi
pop ebp
ret

Function at 0x1c70662
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1cda44c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov esi, 0x7fffffff
cmp eax, esi
cmovb esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], 0xffffffff
push 0
push eax
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c706da
mov ecx, dword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, ebx
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x1c706ec
mov ebx, eax
push eax
mov edi, ecx
call ecx
cmp eax, 3
jne 0x1c70705
mov dword [ebp - 0x14], 0xffffffff
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov ecx, edi
jne 0x1c706a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x1c706f1
cmp ebx, 0xffffffff
je 0x1c7070a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92b01
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp - 0x14]
jmp 0x1c706f1
int3

Function at 0x1c70cb9
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xb0
mov esi, dword [ebp + 8]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.01c70bc8
add esp, 0x10
or edx, eax
jne 0x1c70d3c
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
jne 0x1c70d3c
push 2
call fcn.01c5b690
add esp, 4
test al, al
je 0x1c70d3a
call fcn.01c5bf90
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0xf4
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
call fcn.01c5c130
lea eax, [ebp - 0xb0]
push 0xc
push 0x1cc59d7
push eax
call fcn.01c23734
add esp, 0xc
mov ecx, esi
call fcn.01c5c1e0
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01c92b01
mov eax, ebx
add esp, 0xb0
pop esi
pop ebx
pop ebp
ret

Function at 0x1c710d8
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.01c6f4a7
Function at 0x1c71470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov edi, dword [ebp + 0x14]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
mov dword [esp + 0x64], 0xffffffff
mov dword [esp + 0x60], 0xffffffff
lea ebx, [esp + 0x10]
push 0x3e
push str..._.._base_files_file_win.cc
push str.Read
push ebx
call fcn.01c4fd80
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push ebx
call fcn.01c676b0
test edi, edi
js 0x1c7154a
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.01c74680
test al, al
je 0x1c71506
lea ecx, [esp + 0x28]
push 0
push edi
push esi
push str.File::Read
call fcn.01c74700
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push ebx
push eax
push edi
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c71551
mov ebx, dword [esp + 0xc]
jmp 0x1c71561
mov ebx, 0xffffffff
jmp 0x1c7156a
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
lea ecx, [esp + 0x28]
call fcn.01c746e0
lea ecx, [esp + 0x30]
call fcn.01c67720
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01c92b01
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x1c71590
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x1cda44c]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea ebx, [esp + 0x10]
push 0x57
push str..._.._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.01c4fd80
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.01c676b0
test edi, edi
js 0x1c7164c
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.01c74680
test al, al
je 0x1c71629
lea ecx, [esp + 0x10]
push 0
push edi
push esi
push str.File::ReadAtCurrentPos
call fcn.01c74700
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c71653
mov ebx, dword [esp + 0xc]
jmp 0x1c71663
mov ebx, 0xffffffff
jmp 0x1c7166c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
lea ecx, [esp + 0x10]
call fcn.01c746e0
lea ecx, [esp + 0x20]
call fcn.01c67720
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01c92b01
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8