joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003f370
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea rdi, [rsp + 0x68]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r9
mov rax, qword [0x140114038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
call fcn.14005f4d0
mov rcx, qword [rax]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdi, [0x140123c50]
mov r8d, 0x400
mov rdx, rdi
mov r9, rsi
call fcn.14008aa30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140087640
nop
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x14003ffa0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rsi, rcx
mov rax, qword [0x140114038]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140089770
mov word [rdi], 0
lea rcx, str.PROGRAMFILES
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14004002c
mov ebx, eax
sub rbx, 1
jb 0x14004002c
cmp word [rsp + rbx*2 + 0x20], 0x5c
je 0x14003fffc
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140040016
mov rcx, qword [rsi]
lea r8, [rbx + 1]
lea rdx, [rsp + 0x20]
call fcn.1400a0f34
test eax, eax
je 0x1400400ff
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMFILES_X86_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140040086
mov ebx, eax
sub rbx, 1
jb 0x140040086
cmp word [rsp + rbx*2 + 0x20], 0x5c
je 0x140040056
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140040070
mov rcx, qword [rsi]
lea r8, [rbx + 1]
lea rdx, [rsp + 0x20]
call fcn.1400a0f34
test eax, eax
je 0x140040131
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMW6432
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400400e0
mov ebx, eax
sub rbx, 1
jb 0x1400400e0
cmp word [rsp + rbx*2 + 0x20], 0x5c
je 0x1400400b0
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400400ca
mov rcx, qword [rsi]
lea r8, [rbx + 1]
lea rdx, [rsp + 0x20]
call fcn.1400a0f34
test eax, eax
je 0x140040166
xor edi, edi
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.140087640
mov eax, edi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
ret
movzx eax, byte [rsi + 0x17]
mov rcx, rax
test al, al
jns 0x14004010e
mov rcx, qword [rsi + 8]
dec rcx
mov dil, 1
cmp rcx, rbx
je 0x1400400e2
mov rcx, rsi
test al, al
jns 0x140040123
mov rcx, qword [rsi]
cmp word [rcx + rbx*2 + 2], 0x5c
jne 0x14004002c
jmp 0x1400400e2
movzx eax, byte [rsi + 0x17]
mov rcx, rax
test al, al
jns 0x140040140
mov rcx, qword [rsi + 8]
dec rcx
mov dil, 1
cmp rcx, rbx
je 0x1400400e2
mov rcx, rsi
test al, al
jns 0x140040155
mov rcx, qword [rsi]
cmp word [rcx + rbx*2 + 2], 0x5c
jne 0x140040086
jmp 0x1400400e2
movzx eax, byte [rsi + 0x17]
mov rcx, rax
test al, al
jns 0x140040175
mov rcx, qword [rsi + 8]
dec rcx
mov dil, 1
cmp rcx, rbx
je 0x1400400e2
test al, al
jns 0x14004018b
mov rsi, qword [rsi]
cmp word [rsi + rbx*2 + 2], 0x5c
jne 0x1400400e0
jmp 0x1400400e2
Function at 0x140047700
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov esi, r8d
mov r14, rdx
mov r15, rcx
mov rax, qword [0x140114038]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x50]
mov qword [rdi + 0x50], r12
movaps xmm0, xmmword [0x1400faa70]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x88
call fcn.140077670
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400776a0
test esi, esi
js 0x140047808
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], 0
call fcn.14007be90
test al, al
jne 0x14004780f
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8d, esi
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [rdi]
lea rcx, [rsp + 0x30]
call fcn.14007bf20
lea rcx, [rsp + 0x50]
call fcn.140077700
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140087640
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x1400477db
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.1400e10e0
jmp 0x1400477a2
Function at 0x1400479a0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r15d, r8d
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x140114038]
xor rax, rsp
mov qword [rsp + 0xc0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x50], rax
movaps xmm0, xmmword [0x1400faa70]
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
lea rdx, str.DoInitialize
lea r8, str..._.._base_files_file_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r9d, 0x160
call fcn.140077670
mov rcx, rbp
mov rdx, rdi
xor r8d, r8d
call fcn.1400776a0
mov eax, r15d
and eax, 1
neg eax
and eax, 3
test r15b, 2
mov edx, 1
cmove edx, eax
test r15b, 4
mov ecx, 4
cmovne edx, ecx
test r15b, 8
mov ebp, 2
cmove ebp, edx
test r15b, 0x10
mov eax, 5
cmove eax, ebp
test eax, eax
je 0x140047c03
mov edx, r15d
and edx, 0x40
shl edx, 0x18
test r15b, 0x80
cmove ecx, edx
mov edx, r15d
rol edx, 0x1a
mov edi, r15d
shl edi, 0xb
and edi, 0x20000000
mov esi, r15d
shr esi, 4
and esi, 0x10000
and edx, 0x80000100
or edx, edi
or edx, esi
or edx, ecx
mov ecx, r15d
shr ecx, 8
and ecx, 3
mov r8d, r15d
shr r8d, 0xd
and r8d, 4
or r8d, ecx
xor r8d, 3
mov edi, r15d
and edi, 0x400
mov ecx, edi
shl ecx, 0x14
mov ebp, r15d
shr ebp, 3
and ebp, 0x100
or ebp, ecx
mov ecx, r15d
shr ecx, 0xb
and ecx, 2
or ecx, ebp
mov ebp, r15d
shl ebp, 0xd
and ebp, 0x4000000
or ebp, ecx
mov ecx, r15d
shl ecx, 8
mov esi, ecx
and esi, 0x2000000
or esi, ebp
and ecx, 0x8000000
or ecx, esi
cmp byte [rbx + 0x17], 0
jns 0x140047b15
mov rbx, qword [rbx]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov rcx, rbx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp qword [r14], rax
je 0x140047b71
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [r14]
inc rax
cmp rax, 2
jae 0x140047bea
mov rax, rbx
inc rax
cmp rax, 2
jb 0x140047b66
mov qword [r14], rbx
call fcn.140077690
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [r14]
inc rbx
cmp rbx, 2
jb 0x140047b9c
shr edi, 0xa
mov dword [r14 + 0x24], 0
mov byte [r14 + 0x29], dil
test r15b, 4
jne 0x140047bd8
test r15b, 0xa
je 0x140047bad
mov byte [r14 + 0x28], 1
jmp 0x140047bad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140047830
mov dword [r14 + 0x24], eax
lea rcx, [rsp + 0x60]
call fcn.140077700
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140087640
nop
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [r14 + 0x28]
jmp 0x140047bad
call fcn.140077690
mov rcx, qword [r14]
call fcn.140077a40
mov qword [r14], 0
jmp 0x140047b52
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [r14 + 0x24], 0xffffffff
jmp 0x140047bad
Function at 0x140047e10
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400476d0
mov qword [rsi], 0
test rax, rax
je 0x140047e63
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140047e97
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140047e5b
mov qword [rsi], rbx
call fcn.140077690
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.140068c50
lea rcx, [rsi + 0x20]
call fcn.14007beb0
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.140077690
mov rcx, qword [rsi]
call fcn.140077a40
mov qword [rsi], 0
jmp 0x140047e49
Function at 0x140049610
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, [0x1400fa198]
mov qword [rcx], rax
add rcx, 8
call fcn.140070e30
lea rcx, [rsi + 0x10]
call fcn.140070e30
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.140070e30
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
movups xmmword [rsi + 0xd0], xmm6
mov qword [rsi + 0xe0], rbx
mov ebp, 0x3f800000
mov dword [rsi + 0xe8], ebp
mov dword [rsi + 0xf0], ebx
movups xmmword [rsi + 0xf8], xmm6
movups xmmword [rsi + 0x108], xmm6
mov dword [rsi + 0x118], ebp
movups xmmword [rsi + 0x120], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x140], ebp
movups xmmword [rsi + 0x148], xmm6
movups xmmword [rsi + 0x158], xmm6
mov dword [rsi + 0x168], ebp
movups xmmword [rsi + 0x170], xmm6
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebp
mov qword [rsi + 0x1b0], rbx
movups xmmword [rsi + 0x198], xmm6
mov dword [rsi + 0x1a8], ebx
mov eax, dword [0x140103e7c]
mov dword [rsi + 0x1b8], eax
lea rcx, [rsi + 0x1c0]
call fcn.1400567c0
lea rcx, [rsi + 0x310]
movups xmmword [rsi + 0x2f8], xmm6
mov qword [rsi + 0x308], rbx
xor edx, edx
call fcn.140053bc0
lea rcx, [rsi + 0x318]
xor edx, edx
call fcn.140053bc0
lea rcx, [rsi + 0x320]
xor edx, edx
call fcn.140053bc0
movups xmmword [rsi + 0x328], xmm6
movups xmmword [rsi + 0x338], xmm6
mov dword [rsi + 0x348], ebp
movups xmmword [rsi + 0x350], xmm6
movups xmmword [rsi + 0x360], xmm6
movups xmmword [rsi + 0x370], xmm6
mov byte [rsi + 0x380], bl
mov dword [rsi + 0x384], edi
mov byte [rsi + 0x388], bl
movups xmmword [rsi + 0x390], xmm6
movups xmmword [rsi + 0x3a0], xmm6
call fcn.140019e90
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x1a8], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x1a0], rax
mov rcx, rsi
call fcn.140049840
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x14004982b
call fcn.140055f00
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.140055fb0
mov qword [0x140124a18], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x140130008]
jmp 0x1400497f9
Function at 0x14004d670
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x140114038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x14004d6a4
mov rax, qword [r12 + 8]
test rax, rax
je 0x14004d79c
mov eax, ebx
not eax
test eax, 0x300
je 0x14004d79c
cmp edi, 2
lea rax, [0x140124cc0]
lea rcx, [0x140124ec0]
cmove rcx, rax
cmp word [rcx], 0
jne 0x14004d79c
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x14004d79c
cmp byte [0x140124cb0], 0
setne al
bt ebx, 8
jb 0x14004d79c
shr ebx, 9
and ebx, 1
or bl, al
je 0x14004d79c
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
movzx r13d, byte [r12 + 0x17]
test r13b, r13b
jns 0x14004d7f7
mov rbx, qword [r12]
mov r13, qword [r12 + 8]
mov r14d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov rdi, qword [rsi + 8]
mov rbp, r13
sub rbp, rdi
jb 0x14004d789
mov rdx, qword [rsi]
mov rcx, rbx
mov r8, rdi
call fcn.1400a0f34
test eax, eax
je 0x14004d7bb
add rsi, 0x28
inc r15
cmp r15, r14
jb 0x14004d76b
cmp dword [rsp + 0x2c], 0
jne 0x14004d7ff
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140087640
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, word [rbx + rdi*2]
cmp cx, 0x5c
je 0x14004d7ca
test cx, cx
jne 0x14004d789
lea rax, [rbx + rdi*2]
mov edx, dword [rsi + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x14004d827
cmp dword [rsp + 0x2c], 2
jne 0x14004d838
lea rdx, str.WOW6432Node
mov qword [rsp + 0x38], rdx
mov rdx, rax
mov qword [rsp + 0x30], rax
jmp 0x14004d838
mov rbx, r12
jmp 0x14004d74c
cmp byte [r12 + 0x17], 0
js 0x14004d867
mov rax, r12
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, r12
mov r8, qword [rsp + 0x38]
call fcn.140033410
jmp 0x14004d79c
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rbx
cmp cx, 0x5c
jne 0x14004d851
lea rbx, [rax + 2]
dec rbp
cmp word [rax + 2], 0x5c
mov rax, rbx
je 0x14004d83e
jmp 0x14004d854
mov rbx, rax
mov r14, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
xor r15d, r15d
mov r13, rbp
jmp 0x14004d790
mov rax, qword [r12]
jmp 0x14004d80a
Function at 0x14004f750
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140114038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x14004f777
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14004f7b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14004f7d0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140087640
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.14004f890
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140087640
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140069cb0
test al, al
jne 0x14004f7e2
xor esi, esi
jmp 0x14004f7b4
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x265
mov r9d, 2
call fcn.1400d4d70
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400b97e0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14006d130
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14004f861
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1400b97e0
cmp byte [rsp + 0x4f], 0
jns 0x14004f87d
mov rcx, qword [rsp + 0x38]
call fcn.140086158
lea rcx, [rsp + 0x50]
call fcn.1400d4df0
jmp 0x14004f7de
Function at 0x14004f890
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x140114038]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x14004f8b7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004f8e9
mov dil, 1
test al, 0x10
je 0x14004f9a2
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140087640
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140069cb0
test al, al
je 0x14004f9b0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x250
mov r9d, 2
call fcn.1400d4d70
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400b97e0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x38]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.14006d130
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14004f97a
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.1400b97e0
cmp byte [rsp + 0x5f], 0
jns 0x14004f996
mov rcx, qword [rsp + 0x48]
call fcn.140086158
lea rcx, [rsp + 0x60]
call fcn.1400d4df0
jmp 0x14004f9b0
mov ecx, 2
call fcn.140069cb0
test al, al
jne 0x14004f9b7
xor edi, edi
jmp 0x14004f8cd
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x254
mov r9d, 2
call fcn.140037c10
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400b97e0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.14006d130
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14004fa2d
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.1400b97e0
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1400b97e0
cmp byte [rsp + 0x5f], 0
jns 0x14004fa5e
mov rcx, qword [rsp + 0x48]
call fcn.140086158
lea rcx, [rsp + 0x60]
call fcn.1400380b0
jmp 0x14004f9b0
Function at 0x140051a90
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rax, qword [0x140114038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 0x17]
test al, al
mov rcx, qword [r8]
cmovns rcx, r8
lea rdx, [rsp + 0x60]
mov qword [rdx], rcx
cmovs rax, qword [r8 + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.14006cde0
cmp byte [rsi + 0x17], 0
jns 0x140051aeb
mov rsi, qword [rsp + 0x70]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.14006cde0
cmp byte [rdi + 0x17], 0
jns 0x140051b10
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [rsp + 0x5f], 0
jns 0x140051b2f
mov rcx, qword [rsp + 0x48]
call fcn.140086158
cmp byte [rsp + 0x87], 0
jns 0x140051b43
mov rcx, qword [rsp + 0x70]
call fcn.140086158
test esi, esi
setne bl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140087640
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x140051bf0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x140114038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.14006cde0
cmp byte [rdi + 0x17], 0
jns 0x140051c31
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x6f], 0
jns 0x140051c52
mov rcx, qword [rsp + 0x58]
call fcn.140086158
test r14, r14
je 0x140051cf9
test edi, edi
je 0x140051cf9
mov ecx, edi
add rcx, rcx
call fcn.14008618c
mov rbx, rax
movups xmm0, xmmword [rsi]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x58]
mov rcx, rsi
call fcn.14006cde0
cmp byte [rsi + 0x17], 0
jns 0x140051c93
mov rsi, qword [rsp + 0x58]
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x6f], 0
jns 0x140051cb3
mov rcx, qword [rsp + 0x58]
call fcn.140086158
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x140051d17
mov rcx, rbx
call fcn.1400a5a90
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.14006d130
cmp byte [r14 + 0x17], 0
js 0x140051d1a
mov rax, qword [rsp + 0x68]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r14], xmm0
mov rcx, rbx
call fcn.140086194
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140087640
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
mov rcx, qword [r14]
call fcn.140086158
jmp 0x140051cdf
Function at 0x140052050
Capabilities:
Create pipe

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x188
mov rsi, rcx
mov rax, qword [0x140114038]
xor rax, rsp
mov qword [rsp + 0x180], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1400faa70]
movaps xmmword [rsp + 0x40], xmm0
test dl, dl
je 0x14005213b
lea r14, [rsp + 0x6c]
xor ebx, ebx
mov r8d, 0x110
mov rcx, r14
xor edx, edx
call fcn.140089770
mov dword [r14 - 0xc], 0x11c
mov rdi, qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov edx, 2
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 1
mov r8b, 3
call rdi
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rdi
mov qword [r14 - 8], 6
mov word [r14 + 0x108], 0
lea rcx, [rsp + 0x60]
mov edx, 0x23
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov edi, 0x80003
test eax, eax
je 0x140052142
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov dword [rbx], 0x18
xor ecx, ecx
call fcn.1400521a0
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x140052142
mov edi, 3
xor ebx, ebx
cmp byte [rsi + 0x17], 0
jns 0x14005214b
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140087640
mov rax, rsi
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r14
ret