joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c60710
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov edi, dword [ebp + 0x14]
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
mov dword [esp + 0x64], 0xffffffff
mov dword [esp + 0x60], 0xffffffff
lea ebx, [esp + 0x10]
push 0x3e
push str..._.._base_files_file_win.cc
push str.Read
push ebx
call fcn.01c4fd90
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push ebx
call fcn.01c5f810
test edi, edi
js 0x1c607f3
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.01c5bd70
call fcn.01c6c5f0
test al, al
je 0x1c607af
lea ecx, [esp + 0x28]
push 0
push edi
push esi
push str.File::Read
call fcn.01c6c670
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push ebx
push eax
push edi
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c607fa
mov ebx, dword [esp + 0xc]
jmp 0x1c6080a
mov ebx, 0xffffffff
jmp 0x1c60813
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
lea ecx, [esp + 0x28]
call fcn.01c6c650
lea ecx, [esp + 0x30]
call fcn.01c5f880
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01c8ff11
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x1c60840
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea ebx, [esp + 0x10]
push 0x57
push str..._.._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.01c4fd90
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.01c5f810
test edi, edi
js 0x1c60905
mov ebx, dword [ebp + 8]
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.01c5bd70
call fcn.01c6c5f0
test al, al
je 0x1c608e2
lea ecx, [esp + 0x10]
push 0
push edi
push esi
push str.File::ReadAtCurrentPos
call fcn.01c6c670
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c6090c
mov ebx, dword [esp + 0xc]
jmp 0x1c6091c
mov ebx, 0xffffffff
jmp 0x1c60925
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
lea ecx, [esp + 0x10]
call fcn.01c6c650
lea ecx, [esp + 0x20]
call fcn.01c5f880
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01c8ff11
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c60950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov edi, dword [ebp + 0x14]
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
mov dword [esp + 0x64], 0xffffffff
mov dword [esp + 0x60], 0xffffffff
lea ebx, [esp + 0x10]
push 0x73
push str..._.._base_files_file_win.cc
push str.Write
push ebx
call fcn.01c4fd90
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push ebx
call fcn.01c5f810
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.01c5bd70
call fcn.01c6c5f0
test al, al
je 0x1c609ef
mov eax, edi
sar eax, 0x1f
lea ecx, [esp + 0x28]
push eax
push edi
push esi
push str.File::Write
call fcn.01c6c670
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push ebx
push eax
push edi
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.01c6c650
lea ecx, [esp + 0x30]
call fcn.01c5f880
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.01c8ff11
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x1c60a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea ebx, [esp + 0x10]
push 0x88
push str..._.._base_files_file_win.cc
push str.WriteAtCurrentPos
push ebx
call fcn.01c4fd90
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push ebx
call fcn.01c5f810
test edi, edi
js 0x1c60b34
mov ebx, dword [ebp + 8]
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.01c5bd70
call fcn.01c6c5f0
test al, al
je 0x1c60b05
lea ecx, [esp + 0x10]
push 0
push edi
push esi
push str.File::WriteAtCurrentPos
call fcn.01c6c670
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
call fcn.01c6c650
jmp 0x1c60b39
mov esi, 0xffffffff
lea ecx, [esp + 0x20]
call fcn.01c5f880
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01c8ff11
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c60c10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x50], 0xffffffff
lea esi, [esp + 0x10]
push 0x15a
push str..._.._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.01c4fd90
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push esi
call fcn.01c5f810
mov eax, ebx
and eax, 1
neg eax
and eax, 3
test bl, 2
mov ecx, 1
cmove ecx, eax
test bl, 4
mov edx, 4
cmovne ecx, edx
test bl, 8
mov esi, 2
cmove esi, ecx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x1c60ddc
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov ecx, ebx
and ecx, 0x40
shl ecx, 0x18
test bl, bl
cmovns edx, ecx
mov ecx, ebx
rol ecx, 0x1a
mov esi, ebx
shl esi, 0xb
and esi, 0x20000000
mov edi, ebx
shr edi, 4
and edi, 0x10000
and ecx, 0x80000100
or ecx, esi
or ecx, edi
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
mov esi, ebx
and esi, 0x400
mov eax, ebx
mov dword [esp + 0xc], esi
mov ebx, esi
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov esi, eax
shl esi, 0xd
and esi, 0x4000000
or esi, edi
mov edi, eax
shl edi, 8
mov ebx, edi
and ebx, 0x2000000
or ebx, esi
and edi, 0x8000000
or edi, ebx
mov esi, dword [ebp + 8]
xor edx, 3
cmp byte [esi + 0xb], 0
jns 0x1c60d62
mov esi, dword [esi]
mov ebx, dword [esp + 8]
mov eax, dword [esp + 4]
push 0
push edi
push eax
push 0
push edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov eax, dword [ebx]
cmp eax, edi
je 0x1c60dc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
add eax, 1
cmp eax, 2
jb 0x1c60da8
call fcn.01c4fdc0
push dword [ebx]
call fcn.01c4fdd0
add esp, 4
mov dword [ebx], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x1c60db7
mov dword [ebx], edi
call fcn.01c4fdc0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebx]
add eax, 1
cmp eax, 2
jae 0x1c60ded
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01c60b60
add esp, 4
mov dword [ebx + 0x14], eax
jmp 0x1c60e1e
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [edi + 0x14], 0xffffffff
jmp 0x1c60e1e
mov eax, dword [esp + 0xc]
shr eax, 0xa
mov dword [ebx + 0x14], 0
mov byte [ebx + 0x19], al
mov eax, dword [ebp + 0xc]
test al, 4
jne 0x1c60e0f
test al, 0xa
je 0x1c60e1e
mov byte [ebx + 0x18], 1
jmp 0x1c60e1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [ebx + 0x18]
lea ecx, [esp + 0x20]
call fcn.01c5f880
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.01c8ff11
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c616d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [esp + 0x158], eax
mov eax, dword [0x1cf29d0]
mov ecx, dword [0x1cf1960]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c61725
mov ecx, dword [esp + 0x158]
xor ecx, ebp
call fcn.01c8ff11
mov eax, 0x1cf29cc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1cf29d0
call fcn.01c8ff57
add esp, 4
cmp dword [0x1cf29d0], 0xffffffff
jne 0x1c6170a
lea eax, [esp + 0x40]
push 0x118
push 0
push eax
call fcn.01c93b00
add esp, 0xc
mov dword [esp + 0x3c], 0x11c
lea edi, [esp + 0x3c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push dword [esp + 0x50]
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x50
call fcn.01c8fea0
add esp, 4
mov esi, eax
mov ebx, dword [esp + 0xc]
mov eax, dword [0x1cf29f8]
mov ecx, dword [0x1cf1960]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c617d4
mov ecx, esi
push ebx
push 0x1cf29d4
push edi
call fcn.01c61930
mov dword [0x1cf29cc], esi
push 0x1cf29d0
call fcn.01c8ffcd
add esp, 4
jmp 0x1c6170a
push 0x1cf29f8
call fcn.01c8ff57
add esp, 4
cmp dword [0x1cf29f8], 0xffffffff
jne 0x1c617ae
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x30]
mov dword [0x1cf29f4], eax
movaps xmm0, xmmword [esp + 0x10]
movaps xmm1, xmmword [esp + 0x20]
movups xmmword [0x1cf29e4], xmm1
movups xmmword [0x1cf29d4], xmm0
push 0x1cf29f8
call fcn.01c8ffcd
add esp, 4
jmp 0x1c617ae

Function at 0x1c61850
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [esp + 0x30], eax
mov eax, dword [0x1cf29f8]
mov ecx, dword [0x1cf1960]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c618c4
movzx eax, word [0x1cf29d4]
cmp eax, 0xc
ja case.0x1c61890.1
xor esi, esi
jmp dword [eax*4 + 0x1cbfc14]
mov esi, 2
jmp case.0x1c61890.0
mov esi, 4
jmp case.0x1c61890.0
mov esi, 1
jmp case.0x1c61890.0
mov esi, 3
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.01c8ff11
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x1cf29f8
call fcn.01c8ff57
add esp, 4
cmp dword [0x1cf29f8], 0xffffffff
jne 0x1c61882
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov dword [esp + 0x20], 0
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x20]
mov dword [0x1cf29f4], eax
movaps xmm0, xmmword [esp]
movaps xmm1, xmmword [esp + 0x10]
movups xmmword [0x1cf29e4], xmm1
movups xmmword [0x1cf29d4], xmm0
push 0x1cf29f8
call fcn.01c8ffcd
add esp, 4
jmp 0x1c61882
Function at 0x1c66850
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 0xc]
movzx edx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test dl, dl
mov dword [ebp - 0x10], ecx
lea ecx, [eax + ecx]
mov dword [ebp - 0x20], edx
lea edx, [esi + edx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
jb 0x1c668bd
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1c66890
cmp edx, 1
jne 0x1c668c6
jmp 0x1c668e2
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x1c668e2
cmp edx, 2
je 0x1c668d9
cmp edx, 3
jne 0x1c668ed
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx + 4]
xor ecx, ecx
test edi, edi
je 0x1c66a48
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ebx, eax
shr ebx, 0xf
xor ebx, eax
mov eax, edi
shr eax, 1
and eax, 0x55555555
mov edx, edi
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
ja 0x1c66954
lea edx, [edi - 1]
and edx, ebx
jmp 0x1c66960
mov edx, ebx
cmp ebx, edi
jb 0x1c66960
mov eax, ebx
xor edx, edx
div edi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x24], edx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x1c66a48
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
mov ebx, dword [eax]
test ebx, ebx
je 0x1c66a48
mov eax, dword [ebp - 0x18]
add eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x10]
cmovns eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x1c669b6
and eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jne 0x1c66a46
mov ebx, dword [ebx]
test ebx, ebx
je 0x1c66a46
mov eax, dword [ebx + 4]
cmp eax, dword [ebp - 0x14]
jne 0x1c66a10
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x1c669cb
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x1c669ac
lea ecx, [ebx + 8]
mov edx, dword [ecx]
test al, al
cmovs ecx, edx
js 0x1c66a28
cmp dword [ebp - 0x10], 0
je 0x1c66a42
cmp byte [esi], dl
jne 0x1c669ac
add eax, 0xffffffff
xor ecx, ecx
nop dword [eax + eax]
cmp eax, ecx
je 0x1c66a42
movzx edx, byte [ebx + ecx + 9]
lea edi, [ecx + 1]
cmp dl, byte [esi + ecx + 1]
mov ecx, edi
je 0x1c669f0
jmp 0x1c669ac
cmp dword [ebp - 0x28], 1
jbe 0x1c669a0
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x1c669a3
xor edx, edx
div ecx
mov eax, edx
jmp 0x1c669a3
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1c66a42
push eax
push esi
push ecx
call fcn.01c9266d
add esp, 0xc
test eax, eax
jne 0x1c669ac
mov ecx, ebx
jmp 0x1c66a48
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c672a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x1c673ae
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x301
mov dword [esp + 0x54], ecx
mov eax, dword [eax]
mov dword [esp + 0x60], eax
sar eax, 0x1f
mov dword [esp + 0x64], eax
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.01c50080
mov eax, dword [0x1cc1048]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
lea ebx, [esp + 0x50]
mov dword [esp + 0x3c], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x1cb95e0]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.01c746a0
sub esp, 0x44
mov al, byte [esp + 0x50]
test al, al
je 0x1c673ae
xor esi, esi
jmp 0x1c6738a
add esi, 1
movzx ecx, al
cmp esi, ecx
jae 0x1c673ae
cmp byte [esp + esi + 0x51], 8
jne 0x1c67380
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x1c67380
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
movzx eax, byte [esp + 0x50]
jmp 0x1c67380
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.01c8ff11
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c673d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x1c674de
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x701
mov dword [esp + 0x54], ecx
cmp byte [eax + 0xb], 0
jns 0x1c6741f
mov eax, dword [eax]
mov dword [esp + 0x60], eax
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.01c50080
mov eax, dword [0x1cc1048]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
lea ebx, [esp + 0x50]
mov dword [esp + 0x3c], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x1cb95e0]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.01c746a0
sub esp, 0x44
mov al, byte [esp + 0x50]
test al, al
je 0x1c674de
xor esi, esi
jmp 0x1c674ba
add esi, 1
movzx ecx, al
cmp esi, ecx
jae 0x1c674de
cmp byte [esp + esi + 0x51], 8
jne 0x1c674b0
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x1c674b0
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
movzx eax, byte [esp + 0x50]
jmp 0x1c674b0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.01c8ff11
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c67500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x1c6760e
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x301
mov dword [esp + 0x54], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x60], xmm0
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.01c50080
mov eax, dword [0x1cc1048]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
lea ebx, [esp + 0x50]
mov dword [esp + 0x3c], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
xorps xmm0, xmm0
movups xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x1cb95e0]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.01c746a0
sub esp, 0x44
mov al, byte [esp + 0x50]
test al, al
je 0x1c6760e
xor esi, esi
jmp 0x1c675ea
add esi, 1
movzx ecx, al
cmp esi, ecx
jae 0x1c6760e
cmp byte [esp + esi + 0x51], 8
jne 0x1c675e0
mov ecx, dword [esp + esi*8 + 0x60]
test ecx, ecx
je 0x1c675e0
mov eax, dword [ecx]
mov dword [esp], 1
call dword [eax]
sub esp, 4
movzx eax, byte [esp + 0x50]
jmp 0x1c675e0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.01c8ff11
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c6782a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, dword [ebp + 8]
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1c6784d
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c67876
mov ebx, eax
bt eax, 0xa
jae 0x1c6786b
cmp byte [ebp + 0xc], 0
je 0x1c6791c
and ebx, 0x10
shr ebx, 4
jmp 0x1c6791e
push 2
call fcn.01c55c50
add esp, 4
test al, al
je 0x1c6791c
call fcn.01c56670
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x81
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.01c56810
lea eax, [ebp - 0xb4]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01c23784
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1c678ca
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc8]
push eax
push edi
push ebx
call fcn.01c44c80
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c678ef
mov eax, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xc8]
push eax
push ebx
push esi
call fcn.01c23784
add esp, 0xc
cmp byte [ebp - 0xbd], 0
jns 0x1c67911
push dword [ebp - 0xc8]
call fcn.01c8fed0
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.01c568c0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8ff11
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret