joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025980
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r8
mov r15, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x140025a25
mov rsi, r14
test r14, r14
jle 0x140025a9c
mov rsi, r14
nop
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140025a00
mov rax, qword [rbx + 0x58]
movsxd rdi, dword [rax]
test rdi, rdi
jle 0x140025a00
cmp rsi, rdi
cmovle rdi, rsi
mov rdx, r15
mov r8, rdi
call fcn.14005ece0
add r15, rdi
sub rsi, rdi
mov rax, qword [rbx + 0x58]
sub dword [rax], edi
mov rax, qword [rbx + 0x40]
movsxd rcx, edi
add qword [rax], rcx
jmp 0x140025a1e
movzx edx, byte [r15]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140025a9c
add r15, 1
add rsi, 0xffffffffffffffff
test rsi, rsi
jg 0x1400259b0
jmp 0x140025a9c
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140025a75
test r14, r14
jle 0x140025a75
mov rax, qword [rbx + 0x58]
mov eax, dword [rax]
test eax, eax
jle 0x140025a75
movsxd rdi, eax
cmp rdi, r14
cmovg rdi, r14
mov rdx, r15
mov r8, rdi
call fcn.14005ece0
add r15, rdi
mov rsi, r14
sub rsi, rdi
mov rax, qword [rbx + 0x58]
sub dword [rax], edi
mov rax, qword [rbx + 0x40]
movsxd rcx, edi
add qword [rax], rcx
test rsi, rsi
jg 0x140025a7d
jmp 0x140025a9c
mov rsi, r14
test rsi, rsi
jle 0x140025a9c
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x140025a9c
mov edx, 1
mov rcx, r15
mov r8, rsi
call fcn.1400696b0
sub rsi, rax
sub r14, rsi
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140025ab0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov ebx, r9d
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r13, [rcx + 0x70]
cmp r9d, 1
jne 0x140025af6
mov rax, qword [rdi + 0x38]
cmp qword [rax], r13
jne 0x140025af6
cmp qword [rdi + 0x68], 1
sbb r14, 0
cmp qword [rdi + 0x80], 0
je 0x140025b95
cmp qword [rdi + 0x68], 0
je 0x140025b60
cmp byte [rdi + 0x71], 0
je 0x140025b60
mov rax, qword [rdi]
mov rcx, rdi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140025b95
mov rcx, qword [rdi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea r15, [rsp + 0x30]
mov r8, r15
call qword [r10 + 0x40]
test eax, eax
je 0x140025c05
cmp eax, 1
je 0x140025c09
cmp eax, 3
jne 0x140025b95
cmp ebx, 1
jne 0x140025b6a
test r14, r14
je 0x140025b80
mov rcx, qword [rdi + 0x80]
mov rdx, r14
mov r8d, ebx
call fcn.140065ed0
test eax, eax
jne 0x140025b95
mov rcx, qword [rdi + 0x80]
lea rdx, [rsp + 0x30]
call fcn.140068bc0
test eax, eax
je 0x140025bc3
mov qword [rsi], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005aa40
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rdi + 0x18]
cmp qword [rax], r13
jne 0x140025beb
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rdi + 0x74]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], rcx
jmp 0x140025ba3
mov byte [rdi + 0x71], 0
mov r12, qword [rsp + 0x28]
sub r12, r15
je 0x140025c35
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8, r12
call fcn.1400696b0
cmp r12, rax
jne 0x140025b95
cmp byte [rdi + 0x71], 0
jne 0x140025b95
jmp 0x140025b60
Function at 0x140025c50
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [r8 + 8]
add rax, qword [r8]
mov rsi, rdx
mov qword [rsp + 0x30], rax
cmp qword [rcx + 0x80], 0
je 0x140025d2e
mov rbx, r8
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x140025d19
cmp byte [rdi + 0x71], 0
je 0x140025d19
mov rax, qword [rdi]
mov rcx, rdi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140025d2e
mov rcx, qword [rdi + 0x68]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r14, [rsp + 0x40]
mov r8, r14
call qword [r10 + 0x40]
test eax, eax
je 0x140025ce7
cmp eax, 1
je 0x140025ceb
cmp eax, 3
je 0x140025d19
jmp 0x140025d2e
mov byte [rdi + 0x71], 0
mov r15, qword [rsp + 0x38]
sub r15, r14
je 0x140025d13
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x40]
mov edx, 1
mov r8, r15
call fcn.1400696b0
cmp r15, rax
jne 0x140025d2e
cmp byte [rdi + 0x71], 0
jne 0x140025d2e
mov rcx, qword [rdi + 0x80]
lea rdx, [rsp + 0x30]
call fcn.140069190
test eax, eax
je 0x140025d58
mov qword [rsi], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14005aa40
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x74], rax
mov rcx, qword [rdi + 0x18]
lea rdx, [rdi + 0x70]
cmp qword [rcx], rdx
jne 0x140025d90
mov eax, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rcx], rdx
mov rcx, qword [rdi + 0x38]
mov qword [rcx], rdx
sub eax, edx
mov rcx, qword [rdi + 0x50]
mov dword [rcx], eax
mov rax, qword [rdi + 0x74]
mov rcx, qword [rsp + 0x30]
mov qword [rsi], rcx
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], rax
jmp 0x140025d3c

Function at 0x140026240
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebp, r9d
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rdx, str.Write
lea r8, str..._.._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x72
call fcn.140021a10
lea rcx, [rsp + 0x68]
xor esi, esi
mov rdx, r15
xor r8d, r8d
call fcn.140021c90
lea rcx, [rsp + 0x30]
call fcn.140020560
call fcn.140042af0
test al, al
je 0x1400262ca
movsxd r9, ebp
lea rdx, str.File::Write
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.140042b90
mov rax, rdi
shr rax, 0x20
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x54], eax
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x30]
call fcn.140042b60
lea rcx, [rsp + 0x68]
call fcn.140021dc0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005aa40
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140028390
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x1400a5258]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x1400284ff
jp 0x1400284ff
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ebp, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1400a5268]
mov ecx, dword [0x1400a5148]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002851e
mov eax, dword [0x1400a5278]
mov ecx, dword [0x1400a5148]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002855a
rdtsc
mov rdi, rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rsi, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rsi, qword [0x1400a5270]
movq xmm1, rsi
punpckldq xmm1, xmmword [0x14007eb20]
subpd xmm1, xmmword [0x14007eb30]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addpd xmm0, xmm1
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x20]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x14007ff40]
ucomisd xmm1, xmm0
ja 0x1400284ff
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x1400a5260]
movq xmm1, rdi
punpckldq xmm1, xmmword [0x14007eb20]
subpd xmm1, xmmword [0x14007eb30]
movapd xmm6, xmm1
unpckhpd xmm6, xmm1
addpd xmm6, xmm1
divsd xmm6, xmm0
movsd qword [0x1400a5258], xmm6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14005aa40
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x1400a5268]
call fcn.14005a860
mov eax, dword [0x1400a5268]
cmp eax, 0xffffffff
jne 0x140028411
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1400a5260], rdx
lea rcx, [0x1400a5268]
call fcn.14005a8d0
jmp 0x140028411
lea rcx, [0x1400a5278]
call fcn.14005a860
mov eax, dword [0x1400a5278]
cmp eax, 0xffffffff
jne 0x140028436
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [0x1400a5270], rax
lea rcx, [0x1400a5278]
call fcn.14005a8d0
jmp 0x140028436
Function at 0x140029ef0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r12, r8
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
jbe 0x140029f12
mov r12, qword [r12]
movabs rbx, 0xcbf29ce484222325
mov rbp, r15
sub rbp, 1
mov qword [rsp + 0x20], rdx
jae 0x140029f32
mov rdx, rbx
jmp 0x140029fc7
movabs rax, 0x100000001b3
mov r8d, r15d
and r8d, 3
cmp rbp, 3
jae 0x140029f4d
xor esi, esi
jmp 0x140029f9c
mov rbp, r15
sub rbp, r8
xor esi, esi
nop word cs:[rax + rax]
nop
movzx edx, byte [r12 + rsi]
xor rdx, rbx
imul rdx, rax
movzx ebx, byte [r12 + rsi + 1]
xor rbx, rdx
imul rbx, rax
movzx edx, byte [r12 + rsi + 2]
xor rdx, rbx
imul rdx, rax
movzx ebx, byte [r12 + rsi + 3]
xor rbx, rdx
imul rbx, rax
add rsi, 4
cmp rbp, rsi
jne 0x140029f60
mov rdx, rbx
test r8, r8
je 0x140029fc7
add rsi, r12
xor ebp, ebp
nop dword [rax]
movzx edx, byte [rsi + rbp]
xor rdx, rbx
imul rdx, rax
add rbp, 1
mov rbx, rdx
cmp r8, rbp
jne 0x140029fb0
and rdx, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
mov r13, qword [rcx + 0x18]
mov rax, rdx
shl rax, 4
mov rbp, qword [r13 + rax]
lea r14, [rdx + rdx]
add r14, 1
mov rdi, rbp
cmp rbp, rbx
jne 0x14002a008
jmp 0x14002a030
mov rdi, qword [rdi]
cmp rbp, rbx
je 0x14002a030
mov rax, qword [r13 + r14*8]
mov rax, qword [rax]
cmp rax, rdi
je 0x14002a068
cmp qword [rdi + 0x20], r15
jne 0x14002a000
cmp qword [rdi + 0x28], 0xf
jbe 0x14002a040
mov rsi, qword [rdi + 0x10]
jmp 0x14002a044
mov rax, rbx
cmp rax, rdi
jne 0x14002a015
jmp 0x14002a068
lea rsi, [rdi + 0x10]
mov rcx, rsi
mov rdx, r12
mov r8, r15
call fcn.14005ebe0
test eax, eax
jne 0x14002a000
mov rcx, r12
mov rdx, rsi
mov r8, r15
call fcn.14005ebe0
test eax, eax
je 0x14002a081
mov rax, qword [rsp + 0x20]
mov qword [rax], rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x20]
mov qword [rax], rdi
jmp 0x14002a070

Function at 0x14002ea00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, r8
mov r9, rax
sar r9, 2
test rax, rax
je 0x14002ea81
xor r11d, r11d
lea r10, [0x140081300]
mov edx, r9d
nop word cs:[rax + rax]
nop
mov eax, dword [r8 + r11*4]
mov esi, eax
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 8
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 0x10
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
movzx esi, dl
shr eax, 0x18
xor eax, esi
shr edx, 8
xor edx, dword [r10 + rax*4]
add r11, 1
cmp r11, r9
jb 0x14002ea30
jmp 0x14002ea84
mov edx, r9d
cmp edx, dword [rcx + 0x18]
sete al
pop rsi
ret
Function at 0x14002ea90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, r8
mov r9, rax
sar r9, 2
test rax, rax
je 0x14002eb11
xor r11d, r11d
lea r10, [0x140081300]
mov edx, r9d
nop word cs:[rax + rax]
nop
mov eax, dword [r8 + r11*4]
mov esi, eax
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 8
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 0x10
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
movzx esi, dl
shr eax, 0x18
xor eax, esi
shr edx, 8
xor edx, dword [r10 + rax*4]
add r11, 1
cmp r11, r9
jb 0x14002eac0
jmp 0x14002eb14
mov edx, r9d
mov dword [rcx + 0x18], edx
pop rsi
ret
Function at 0x140035390
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x78], rax
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x40], xmm0
lea rbx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140016be0
cmp qword [rsp + 0x70], 7
jbe 0x1400353db
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
mov rax, qword [rsp + 0x70]
cmp rax, 8
jb 0x140035433
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14003542e
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400355f6
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14005a6e0
test ebp, ebp
je 0x1400354fe
mov r14b, 1
test rsi, rsi
je 0x1400355d8
mov ecx, ebp
add rcx, rcx
call fcn.14005a6f0
mov rbx, rax
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x30], xmm0
lea rdi, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140016be0
cmp qword [rsp + 0x70], 7
jbe 0x14003547d
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
mov rdx, rbx
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rax, qword [rsp + 0x70]
cmp rax, 8
jb 0x1400354d4
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1400354cf
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400355f6
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.14005a6e0
mov qword [rsp + 0x20], rbx
cmp word [rbx], 0
je 0x140035506
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400354f0
jmp 0x140035508
xor r14d, r14d
jmp 0x1400355d8
xor eax, eax
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0x58]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140017080
mov rax, qword [rsi + 0x18]
cmp rdi, rsi
je 0x14003558f
cmp rax, 0x10
jb 0x140035562
mov rcx, qword [rsi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003555d
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x1400355f6
add rax, 0x28
mov rdx, rax
mov rcx, rbp
call fcn.14005a6e0
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
jmp 0x1400355c7
cmp rax, 0x10
jb 0x1400355c7
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400355c2
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x1400355f6
add rax, 0x28
mov rdx, rax
mov rcx, rbp
call fcn.14005a6e0
mov qword [rsp + 0x70], 0xf
mov rcx, rbx
call fcn.14005a6e0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14005aa40
mov eax, r14d
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140066430
ud2
Function at 0x140035880
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x1400358a9
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x140035997
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400358eb
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14005aa40
mov rcx, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
jmp fcn.1400359c0
mov ecx, 2
call fcn.1400230d0
test al, al
je 0x140035995
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x239
mov r9d, 2
call fcn.1400245c0
lea rcx, [rsp + 0x50]
lea rdx, str.CreateDirectory
call fcn.14000d630
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x140035947
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.140016fd0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14003597d
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.14000e890
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.140024700
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14005aa40
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400359c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rsi, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x188], rax
cmp qword [rcx + 0x18], 7
jbe 0x1400359e9
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140035ab8
mov dil, 1
test al, 0x10
jne 0x140035b64
mov ecx, 2
call fcn.1400230d0
test al, al
je 0x140035b62
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov r8d, 0x227
mov r9d, 2
call fcn.140023180
lea rcx, [rsp + 0x58]
lea rdx, str.GetFileAttributes
call fcn.14000d630
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x140035a56
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x168]
mov rcx, rsi
call fcn.140016fd0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140035a8c
mov rdx, qword [rsp + 0x168]
mov rcx, rbx
call fcn.14000e890
lea rdx, str.:_not_a_directory
mov rcx, rax
call fcn.14000d630
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.140023620
jmp 0x140035b62
mov ecx, 2
call fcn.1400230d0
test al, al
je 0x140035b62
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov r8d, 0x223
mov r9d, 2
call fcn.1400245c0
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
call fcn.14000d630
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x140035b14
mov rax, qword [rsi]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x168]
mov rcx, rsi
call fcn.140016fd0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140035b4a
mov rdx, qword [rsp + 0x168]
mov rcx, rbx
call fcn.14000e890
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.140024700
xor edi, edi
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14005aa40
mov eax, edi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
Function at 0x140037fd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x70]
cmp eax, edx
jne 0x140037fe8
cmp qword [rcx + 0x28], 7
jbe 0x140037ff8
mov rcx, qword [rcx + 0x10]
jmp 0x140037ffc
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
add eax, 1
jmp 0x140038015
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret
Function at 0x140039520
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [r8 + 0x10], 0
je 0x140039577
mov r12, r8
mov ebx, edx
mov edi, ecx
bt edx, 8
jae 0x14003955c
mov eax, ebx
and eax, 0x200
jne 0x140039577
cmp edi, 2
lea rax, [0x1400a5790]
lea rcx, [0x1400a5990]
cmove rcx, rax
cmp word [rcx], 0
je 0x140039596
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14005aa40
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x140039577
cmp byte [0x1400a5780], 0
setne al
bt ebx, 8
jb 0x140039577
shr ebx, 9
and ebx, 1
or bl, al
je 0x140039577
cmp edi, 2
lea rax, str.p_b_
lea rsi, str.SOFTWARE
cmove rsi, rax
cmp qword [r12 + 0x18], 8
mov rdi, r12
jb 0x1400395f6
mov rdi, qword [r12]
mov rbp, qword [r12 + 0x10]
mov r13d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
jmp 0x140039692
movzx edx, word [rdi + rbx*2]
cmp dx, 0x5c
je 0x14003962f
test dx, dx
jne 0x1400396b4
lea rax, [rdi + rbx*2]
mov ebp, dword [rsi + 0x10]
lea rcx, str.WOW6432Node_
cmp ebp, 1
je 0x14003965d
cmp ebp, 2
jne 0x140039653
mov rdi, rax
lea rcx, str.WOW6432Node
jmp 0x14003965d
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp dx, 0x5c
mov dword [rsp + 0x2c], ebp
jne 0x140039675
dec r14
cmp word [rax + 2], 0x5c
lea rax, [rax + 2]
je 0x140039667
mov r13, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
mov rbp, r14
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov rdi, rax
jmp 0x1400396bb
mov rbx, qword [rsi + 8]
mov r14, rbp
sub r14, rbx
jb 0x1400396b4
mov rdx, qword [rsi]
mov rcx, rdi
mov r8, rbx
call fcn.140066ff0
test eax, eax
je 0x14003961c
add rsi, 0x28
inc r15
cmp r15, r13
jb 0x140039692
cmp dword [rsp + 0x2c], 0
je 0x140039577
cmp qword [r12 + 0x18], 8
mov rax, r12
jb 0x1400396da
mov rax, qword [r12]
mov rdi, qword [rsp + 0x30]
sub rdi, rax
sar rdi, 1
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call fcn.14006e7d0
mov rcx, r12
mov rdx, rdi
mov r8, rsi
mov r9, rax
call fcn.140020130
jmp 0x140039577