joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011af30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, ecx
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0x48], eax
mov eax, dword [0x102ce838]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1011b127
mov edi, dword [esi + 0x14]
mov eax, dword [0x101bac5c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
and eax, 0xfffffffc
je 0x1011b047
mov ecx, dword [0x102ce830]
mov dword [eax + ecx*8], edi
mov ecx, dword [0x102ce834]
mov edx, dword [0x102ce830]
mov dword [eax + edx*8 + 4], ecx
cmp byte [esi + 0x10], 0
je 0x1011b00c
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [0x101bac60]
call dword [section..00cfg]
lea eax, [esp + 0x38]
mov dword [esp], eax
call ecx
mov ecx, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
sub eax, ecx
sbb edi, ebx
seto dl
mov ecx, edi
sar ecx, 0x1f
test dl, dl
cmovne eax, ecx
add ecx, 0x80000000
test dl, dl
cmove ecx, edi
cmp eax, 0xfa0
sbb ecx, 0
jl 0x1011b00c
test byte [0x101bb204], 0x19
jne 0x1011b059
mov eax, dword [esi + 0x14]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x101c1e84]
bt edx, ecx
jae 0x1011b02d
mov dword [esp], eax
call fcn.10069280
mov dword [esi + 0x14], 0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.101465a3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
test edi, edi
je 0x1011afa0
call fcn.1007a6e0
jmp 0x1011af87
mov dword [esp + 0x34], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor eax, dword [0x101be248]
mov ecx, dword [esi + 0x28]
xor ecx, eax
mov dword [esp + 0x20], ecx
mov ecx, dword [0x101be24c]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x44], ebx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x40], eax
movsd xmm0, qword [esp + 0x40]
movsd qword [esp], xmm0
lea edi, [esp + 0x20]
lea edx, [esp + 0x34]
mov ecx, edi
call fcn.1011b470
test byte [0x101bb204], 0x19
je 0x1011b00c
movsd xmm0, qword [esp + 0x38]
movsd qword [esp + 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor eax, dword [0x101be248]
mov ecx, dword [0x101be24c]
mov edx, dword [esi + 0x28]
xor edx, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
movsd xmm0, qword [esp + 0x18]
movsd qword [esp + 0x40], xmm0
movsd xmm0, qword [esp + 0x40]
movsd qword [esp + 0x10], xmm0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x1019dfb6
mov dword [esp + 4], 0x101bb204
mov dword [esp], 0x45
call fcn.1003beb0
jmp 0x1011b00c
mov dword [esp], 0x102ce838
call fcn.10145c47
cmp dword [0x102ce838], 0xffffffff
jne 0x1011af6a
mov dword [0x102ce834], 0
mov dword [0x102ce830], 0xffffffff
mov dword [esp], 0
mov ecx, 0x102ce830
call fcn.1007a5a0
sub esp, 4
mov dword [esp], 0x102ce838
call fcn.10145cbd
jmp 0x1011af6a
Function at 0x1011b710
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x102ce858]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1011b809
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x1011b75f
mov ecx, dword [0x102ce850]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x102ce854]
jne 0x1011b75f
cmp dword [eax + ecx*8], 0
jne 0x1011b7d0
push 4
call fcn.10145ba4
add esp, 4
mov esi, eax
mov dword [eax], 0
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
and eax, 0xfffffffc
je 0x1011b799
mov ecx, dword [0x102ce850]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [0x102ce854]
jne 0x1011b799
mov edi, dword [eax + ecx*8]
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x1011b7fe
mov ecx, dword [0x102ce850]
mov dword [eax + ecx*8], esi
mov ecx, dword [0x102ce854]
mov edx, dword [0x102ce850]
mov dword [eax + edx*8 + 4], ecx
test edi, edi
je 0x1011b7d0
push edi
call fcn.10145bd4
add esp, 4
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
xor eax, eax
and ecx, 0xfffffffc
je 0x1011b7fa
mov edx, dword [0x102ce850]
mov esi, dword [ecx + edx*8 + 4]
cmp esi, dword [0x102ce854]
jne 0x1011b7fa
mov eax, dword [ecx + edx*8]
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x1011b7c3
call fcn.1007a6e0
jmp 0x1011b7aa
push 0x102ce858
call fcn.10145c47
add esp, 4
cmp dword [0x102ce858], 0xffffffff
jne 0x1011b736
mov dword [0x102ce854], 0
mov dword [0x102ce850], 0xffffffff
mov ecx, 0x102ce850
push 0x100c8250
call fcn.1007a5a0
push 0x102ce858
call fcn.10145cbd
add esp, 4
jmp 0x1011b736
Function at 0x1011bb10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
cmp dword [ecx + 8], 0
jne 0x1011bbd4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 8], eax
mov eax, dword [0x102cf518]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1011bbd8
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and eax, 0xfffffffc
je 0x1011bb7c
mov edx, dword [0x102cf510]
mov edi, dword [eax + edx*8 + 4]
cmp edi, dword [0x102cf514]
jne 0x1011bb7c
mov eax, dword [eax + edx*8]
test eax, eax
je 0x1011bb7c
mov ecx, dword [eax]
mov dword [esi + 0xc], ecx
mov eax, dword [0x102cf508]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1011bc24
push dword [0x101bac5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, 0xffffffff
and eax, 0xfffffffc
je 0x1011bbd1
mov edx, dword [0x102cf500]
mov edi, dword [eax + edx*8 + 4]
cmp edi, dword [0x102cf504]
jne 0x1011bbd1
mov eax, dword [eax + edx*8]
test eax, eax
je 0x1011bbd1
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
pop esi
pop edi
pop ebp
ret
push 0x102cf518
call fcn.10145c47
add esp, 4
cmp dword [0x102cf518], 0xffffffff
jne 0x1011bb4b
mov dword [0x102cf514], 0
mov dword [0x102cf510], 0xffffffff
mov ecx, 0x102cf510
push 0
call fcn.1007a5a0
push 0x102cf518
call fcn.10145cbd
add esp, 4
jmp 0x1011bb4b
push 0x102cf508
call fcn.10145c47
add esp, 4
cmp dword [0x102cf508], 0xffffffff
jne 0x1011bba0
mov dword [0x102cf504], 0
mov dword [0x102cf500], 0xffffffff
mov ecx, 0x102cf500
push 0
call fcn.1007a5a0
push 0x102cf508
call fcn.10145cbd
add esp, 4
jmp 0x1011bba0
Function at 0x1011d486
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0x10
push ecx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1011d4b9
movzx eax, word [esi + 6]
and eax, 0xfff
or eax, 0x4000
mov word [esi + 6], ax
mov al, byte [esi + 8]
and al, 0x3f
or al, 0x80
mov byte [esi + 8], al
mov al, 1
pop esi
pop ebp
ret
int3

Function at 0x1011d59c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x2d0
mov esi, dword [ebp + 8]
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0x2c8], eax
lea edi, [esp + 0x138]
push 0x190
push 0xff
push edi
call fcn.10149430
add esp, 0xc
push edi
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x1011d609
mov ecx, esi
push 0x1019d59a
call fcn.100349a0
mov ecx, dword [esp + 0x2c8]
xor ecx, ebp
call fcn.101465a3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, 0x100
lea edi, [esp + 0x38]
push ebx
push 0
push edi
call fcn.10149430
add esp, 0xc
push ebx
push edi
call sub.WS2_32.dll_gethostname
cmp eax, 0xffffffff
je 0x1011d5e5
push edi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x1011d5e5
xorps xmm0, xmm0
lea ebx, [esp + 0x10]
movaps xmmword [ebx + 0x10], xmm0
movaps xmmword [ebx], xmm0
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
push eax
call sub.WS2_32.dll_inet_ntoa
push eax
push ebx
call fcn.10163550
add esp, 8
mov edi, esp
mov ecx, edi
push ebx
call fcn.10035a6a
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1011d67a
mov edi, dword [esp]
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [esi + 8], ecx
mov dword [esi], ecx
mov dword [esi + 4], ecx
push esi
push eax
push edi
call fcn.10078c10
add esp, 0xc
cmp byte [esp + 0xb], 0
jns 0x1011d5f1
push dword [esp]
call fcn.10145bd4
add esp, 4
jmp 0x1011d5f1
Function at 0x1011deb6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc0
mov edi, dword [ebp + 8]
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0xb8], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1011dee0
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1011df0c
mov ebx, eax
cmp byte [ebp + 0xc], 0
jne 0x1011df01
mov eax, ebx
and eax, 0x400
jne 0x1011dfa4
and ebx, 0x10
shr ebx, 4
jmp 0x1011dfa6
cmp dword [0x101bee4c], 2
jg 0x1011dfa4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push eax
push 2
push 0x82
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.10066f30
lea eax, [esp + 0x18]
push 0x12
push str.GetFileAttributes
push eax
call fcn.10034b83
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1011df58
mov eax, dword [edi + 4]
mov edi, dword [edi]
xor ecx, ecx
mov ebx, esp
mov dword [ebx + 4], ecx
mov dword [ebx], ecx
mov dword [ebx + 8], ecx
push ebx
push eax
push edi
call fcn.10078390
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1011df7e
mov eax, dword [esp + 4]
mov ebx, dword [esp]
push eax
push ebx
push esi
call fcn.10034b83
add esp, 0xc
cmp byte [esp + 0xb], 0
jns 0x1011df9b
push dword [esp]
call fcn.10145bd4
add esp, 4
lea ecx, [esp + 0x10]
call fcn.100670a0
xor ebx, ebx
mov ecx, dword [esp + 0xb8]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1011dfbe
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc0
mov edi, dword [ebp + 8]
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0xb8], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1011dfe8
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1011e16f
cmp byte [ebp + 0x10], 0
je 0x1011e0c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1011e0c9
push 1
push edi
call fcn.1011deb6
add esp, 8
test al, al
jne 0x1011e16f
cmp dword [0x101bee4c], 2
jg 0x1011e16d
mov ecx, esp
push 2
push 0x5d
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.100661d0
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1011e053
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea esi, [esp + 8]
xor ecx, ecx
lea ebx, [esp + 0xa8]
mov dword [ebx + 4], ecx
mov dword [ebx], ecx
mov dword [ebx + 8], ecx
push ebx
push eax
push edi
call fcn.10078390
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1011e089
mov eax, dword [esp + 0xac]
mov ebx, dword [esp + 0xa8]
push eax
push ebx
push esi
call fcn.10034b83
add esp, 0xc
push 0x10
push str._not_a_directory
push eax
call fcn.10034b83
add esp, 0xc
cmp byte [esp + 0xb3], 0
jns 0x1011e0bd
push dword [esp + 0xa8]
call fcn.10145bd4
add esp, 4
mov ecx, esp
call fcn.10066600
jmp 0x1011e16d
cmp dword [0x101bee4c], 2
jg 0x1011e16d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esp
push eax
push 2
push 0x62
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.10066f30
lea eax, [esp + 8]
push 0x10
push str.CreateDirectory
push eax
call fcn.10034b83
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1011e110
mov eax, dword [edi + 4]
mov edi, dword [edi]
xor ecx, ecx
lea ebx, [esp + 0xa8]
mov dword [ebx + 4], ecx
mov dword [ebx], ecx
mov dword [ebx + 8], ecx
push ebx
push eax
push edi
call fcn.10078390
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1011e142
mov eax, dword [esp + 0xac]
mov ebx, dword [esp + 0xa8]
push eax
push ebx
push esi
call fcn.10034b83
add esp, 0xc
cmp byte [esp + 0xb3], 0
jns 0x1011e166
push dword [esp + 0xa8]
call fcn.10145bd4
add esp, 4
mov ecx, esp
call fcn.100670a0
xor ebx, ebx
mov ecx, dword [esp + 0xb8]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1011e187
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc0
mov edi, dword [ebp + 8]
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0xb8], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1011e1b1
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1011e1ca
test eax, 0x410
sete bl
jmp 0x1011e261
cmp dword [0x101bee4c], 2
jg 0x1011e25f
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push eax
push 2
push 0x75
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.10066f30
lea eax, [esp + 0x18]
push 0x12
push str.GetFileAttributes
push eax
call fcn.10034b83
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1011e213
mov eax, dword [edi + 4]
mov edi, dword [edi]
xor ecx, ecx
mov ebx, esp
mov dword [ebx + 4], ecx
mov dword [ebx], ecx
mov dword [ebx + 8], ecx
push ebx
push eax
push edi
call fcn.10078390
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1011e239
mov eax, dword [esp + 4]
mov ebx, dword [esp]
push eax
push ebx
push esi
call fcn.10034b83
add esp, 0xc
cmp byte [esp + 0xb], 0
jns 0x1011e256
push dword [esp]
call fcn.10145bd4
add esp, 4
lea ecx, [esp + 0x10]
call fcn.100670a0
xor ebx, ebx
mov ecx, dword [esp + 0xb8]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1011e279
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc0
mov esi, dword [ebp + 8]
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0xb8], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1011e2a3
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1011e2d7
and eax, 0x410
cmp eax, 0x410
jne 0x1011e2d7
mov ecx, dword [esp + 0xb8]
xor ecx, ebp
call fcn.101465a3
mov ecx, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.1011e3a4
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1011e2e1
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x1011e38c
cmp dword [0x101bee4c], 2
jg 0x1011e38a
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push eax
push 2
push 0x95
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.10066f30
lea eax, [esp + 0x18]
push 0xb
push str.DeleteFile
push eax
call fcn.10034b83
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1011e33e
mov eax, dword [esi + 4]
mov esi, dword [esi]
xor ecx, ecx
mov ebx, esp
mov dword [ebx + 4], ecx
mov dword [ebx], ecx
mov dword [ebx + 8], ecx
push ebx
push eax
push esi
call fcn.10078390
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1011e364
mov eax, dword [esp + 4]
mov ebx, dword [esp]
push eax
push ebx
push edi
call fcn.10034b83
add esp, 0xc
cmp byte [esp + 0xb], 0
jns 0x1011e381
push dword [esp]
call fcn.10145bd4
add esp, 4
lea ecx, [esp + 0x10]
call fcn.100670a0
xor ebx, ebx
mov ecx, dword [esp + 0xb8]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1011e3a4
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov edi, ecx
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0xc0], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1011e3cd
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x1011e47c
cmp dword [0x101bee4c], 2
jg 0x1011e47c
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x18]
push eax
push 2
push 0x30
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.10066f30
lea eax, [esp + 0x20]
push 0x10
push str.RemoveDirectory
push eax
call fcn.10034b83
add esp, 0xc
movzx edx, byte [edi + 0xb]
test dl, dl
mov dword [esp + 4], eax
jns 0x1011e429
mov edx, dword [edi + 4]
mov edi, dword [edi]
xor ecx, ecx
lea ebx, [esp + 8]
mov dword [ebx + 4], ecx
mov dword [ebx], ecx
mov dword [ebx + 8], ecx
push ebx
push edx
push edi
call fcn.10078390
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1011e452
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 8]
push eax
push ebx
push dword [esp + 0xc]
call fcn.10034b83
add esp, 0xc
cmp byte [esp + 0x13], 0
jns 0x1011e473
push dword [esp + 8]
call fcn.10145bd4
add esp, 4
lea ecx, [esp + 0x18]
call fcn.100670a0
test esi, esi
setne bl
mov ecx, dword [esp + 0xc0]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1011ea10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x101b9014]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, 0x7fffffff
cmp edx, esi
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1011ea59
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
jne 0x1011ea5c
int3
xor esi, esi
dec esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.101465a3
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
Function at 0x1011ea6e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x101b9014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov esi, 0x7fffffff
cmp eax, esi
cmovb esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], 0xffffffff
push 0
push eax
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1011eae6
mov ecx, dword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, ebx
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x1011eaf8
mov ebx, eax
push eax
mov edi, ecx
call ecx
cmp eax, 3
jne 0x1011eb11
mov dword [ebp - 0x14], 0xffffffff
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov ecx, edi
jne 0x1011eab3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x1011eafd
cmp ebx, 0xffffffff
je 0x1011eb16
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp - 0x14]
jmp 0x1011eafd
int3

Function at 0x1011f0a0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov esi, dword [ebp + 8]
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.1011efb5
add esp, 0x10
or edx, eax
jne 0x1011f11f
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
jne 0x1011f11f
cmp dword [0x101bee4c], 2
jg 0x1011f11d
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0xfb
push str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
call fcn.10066f30
lea eax, [ebp - 0xac]
push 0xc
push 0x101aea9e
push eax
call fcn.10034b83
add esp, 0xc
mov ecx, esi
call fcn.100670a0
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.101465a3
mov eax, ebx
add esp, 0xac
pop esi
pop ebx
pop ebp
ret
Function at 0x101222b8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push eax
push ecx
push 0x10122340
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x101222f6
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.101465a3
add esp, 8
pop esi
pop edi
pop ebp
ret
lea esi, [ebp - 0x10]
push 0x1b
push str....._third_partycrashpadcrashpadutil_thread_thread_win.cc
push esi
call fcn.100d84a0
add esp, 0xc
mov esi, dword [esi]
lea eax, [esi + 8]
push 0xc
push 0x101ad375
push eax
call fcn.10034b83
add esp, 0xc
test esi, esi
je 0x101222e5
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 1
call edi
jmp 0x101222e5
Function at 0x1012cfd1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1008
call fcn.10146cc0
mov esi, ecx
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea edi, [ebp - 0x1014]
mov dword [edi], eax
mov ecx, edi
call fcn.100105a6
mov ecx, edi
call fcn.10010d7a
xor ebx, ebx
lea edi, [ebp - 0x1010]
push 0x1000
push ebx
push edi
call fcn.10149430
add esp, 0xc
push ebx
push 0x1c
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x1014]
call fcn.100106c4
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.100349a0
mov ecx, esi
push 0xe
push str.2345Explorer_
call fcn.1005725a
lea ecx, [ebp - 0x1014]
call fcn.1001061c
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101465a3
mov eax, esi
add esp, 0x1008
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1012e490
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 8], eax
push 0x102cf5a0
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1012e4cc
cmp byte [0x102cf5a4], 0
je 0x1012e4df
mov eax, dword [0x102cf5b4]
mov ecx, dword [0x102cf5b0]
jmp 0x1012e549
mov ecx, 0x102cf5a0
call fcn.100acfa0
cmp byte [0x102cf5a4], 0
jne 0x1012e4bf
xorps xmm0, xmm0
movups xmmword [0x102cf5a8], xmm0
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
mov esi, esp
push 8
push esi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1012e5bf
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [0x102cf5ac], ecx
mov dword [0x102cf5a8], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
push 8
push esi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1012e5c2
mov ecx, dword [esp]
mov eax, dword [esp + 4]
mov byte [0x102cf5a4], 1
mov edx, dword [0x102cf5a8]
mov ebx, dword [0x102cf5ac]
mov esi, ebx
shld esi, edx, 0x17
mov edi, edx
shl edi, 0x17
xor edi, edx
xor esi, ebx
mov ebx, esi
shld ebx, edi, 0xf
mov edx, eax
shld edx, ecx, 6
xor edx, ecx
xor edx, edi
xor edx, ebx
mov edi, eax
shr edi, 0x1a
xor edi, eax
xor edi, esi
shr esi, 0x11
xor esi, edi
mov dword [0x102cf5a8], ecx
mov dword [0x102cf5ac], eax
mov dword [0x102cf5b0], edx
add edx, ecx
mov dword [0x102cf5b4], esi
adc esi, eax
push 0x102cf5a0
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, dword [esp + 8]
xor ecx, ebp
call fcn.101465a3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
int3
int3