joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bda90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.14017026c]
mov rdi, rax
test rax, rax
jne 0x1400bdad2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400bdb15
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov ebp, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400bdb72
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400bdb30
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400bdbb3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, str.6debug
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140422ffb]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400bdb80
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400c6f30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r12, r9
mov r15, r8
mov r14, rdx
mov rbx, rcx
call fcn.140146434
xor esi, esi
xor edx, edx
mov rcx, r15
mov dword [rax], esi
lea r8d, [rsi + 2]
call fcn.140176f44
call fcn.140146434
mov rcx, r15
mov edi, dword [rax]
call fcn.140179f7c
movsxd rbp, eax
call fcn.140146434
xor r8d, r8d
xor edx, edx
mov rcx, r15
or edi, dword [rax]
call fcn.140176f44
call fcn.140146434
or edi, dword [rax]
jne 0x1400c7088
test ebp, ebp
js 0x1400c7088
jne 0x1400c6fca
xor edx, edx
mov r8d, 0x170
mov rcx, rbx
call fcn.140137f50
mov dword [rbx + 0x40], 3
jmp 0x1400c709f
test r12, r12
je 0x1400c6ff0
cmp rbp, r12
jbe 0x1400c6ff0
xor edx, edx
mov r8d, 0x170
mov rcx, rbx
call fcn.140137f50
mov dword [rbx + 0x40], 6
jmp 0x1400c709f
mov rcx, rbp
call fcn.14017026c
mov qword [r14], rax
test rax, rax
jne 0x1400c701c
xor edx, edx
mov r8d, 0x170
mov rcx, rbx
call fcn.140137f50
mov dword [rbx + 0x40], 7
jmp 0x1400c709f
test ebp, ebp
jle 0x1400c7045
mov eax, ebp
movsxd rcx, esi
add rcx, qword [r14]
sub eax, esi
movsxd r8, eax
mov r9, r15
mov edx, 1
call fcn.140176ae4
test rax, rax
je 0x1400c704d
add esi, eax
cmp esi, ebp
jl 0x1400c7020
mov qword [r14 + 8], rbp
mov al, 1
jmp 0x1400c70bb
xor edx, edx
mov r8d, 0x170
mov rcx, rbx
call fcn.140137f50
mov dword [rbx + 0x20], 1
mov qword [rbx + 0x78], 0xffffffffffffffff
mov qword [rbx + 0x80], 0xffffffffffffffff
mov dword [rbx + 0x40], 2
mov rcx, qword [r14]
call fcn.140170264
jmp 0x1400c70b9
xor edx, edx
mov r8d, 0x170
mov rcx, rbx
call fcn.140137f50
mov dword [rbx + 0x40], 2
mov qword [rbx + 0x80], 0xffffffffffffffff
mov qword [rbx + 0x78], 0xffffffffffffffff
mov dword [rbx + 0x20], 1
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400d25a0
Capabilities:
Delete directory
Delete file

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1406fe698]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [rcx + 0xc], 0
mov rbx, rcx
je 0x1400d262b
mov ecx, dword [rcx + 8]
xor edx, edx
mov qword [rsp + 0x78], rdi
lea r8d, [rdx + 1]
call fcn.140184058
mov ecx, dword [rbx + 8]
call fcn.140183de4
mov rdi, qword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi]
call fcn.14017cb08
test eax, eax
jne 0x1400d260f
movzx eax, word [rsp + 0x26]
mov ecx, 0xf000
and ax, cx
mov ecx, 0x4000
cmp ax, cx
jne 0x1400d260f
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1400d2622
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400d2622
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x78]
mov byte [rbx + 0xc], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140134a90
add rsp, 0x60
pop rbx
ret
Function at 0x1400d2730
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rcx, qword [rcx]
mov rsi, rdx
lea rdx, [0x140423dcc]
mov rbx, r8
call fcn.1401795fc
mov rbp, rax
test rax, rax
jne 0x1400d276f
lea eax, [rbp + 1]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
test rbx, rbx
je 0x1400d27ba
mov qword [rsp + 0x30], rdi
nop dword [rax]
mov r9, rbp
mov r8, rbx
mov edx, 1
mov rcx, rsi
call fcn.1401771f4
mov rdi, rax
test rax, rax
jne 0x1400d27a5
call fcn.140146434
cmp dword [rax], 0x16
je 0x1400d27b0
cmp rdi, rbx
jb 0x1400d27b5
add rsi, rdi
sub rbx, rdi
test rbx, rbx
jne 0x1400d2780
mov rdi, qword [rsp + 0x30]
mov rcx, rbp
call fcn.140176498
mov rcx, rbp
call fcn.1401761e4
mov rbp, qword [rsp + 0x40]
xor eax, eax
test rbx, rbx
mov rbx, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x1400d2920
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
xor esi, esi
mov qword [rsp + 0x38], r14
mov rbx, 0xffffffffffffffff
mov r14, rcx
cmp word [rax + rbx*2 + 2], si
lea rbx, [rbx + 1]
jne 0x1400d2943
lea rbx, [rbx*2 + 2]
mov qword [rsp + 0x30], rbp
mov rcx, rbx
call fcn.1400c36b0
mov rdx, qword [r14]
mov r8, rbx
mov rcx, rax
mov rdi, rax
call fcn.1401378a0
movzx eax, word [rdi]
mov rbx, rdi
mov r14, qword [rsp + 0x38]
test ax, ax
je 0x1400d29d6
mov ebp, reloc.SHELL32.dll_PathGetShortPath
nop dword [rax]
cmp ax, bp
je 0x1400d299b
cmp ax, 0x2f
jne 0x1400d29c9
cmp rbx, rdi
je 0x1400d29c9
cmp word [rbx - 2], 0x3a
je 0x1400d29c9
xor edx, edx
mov word [rbx], si
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400d29c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400d2a1b
mov word [rbx], bp
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x1400d2990
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400d29fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov esi, 1
cmp eax, 0xb7
cmovne ecx, esi
mov esi, ecx
mov rcx, rdi
call fcn.1400c36a0
mov rbp, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov esi, 1
jmp 0x1400d29fc
Function at 0x1400d3170
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x60
mov rax, qword [0x1406fe698]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, rdx
mov rbx, rcx
mov rcx, qword [rcx]
lea rdx, [0x140423dbc]
call fcn.1401795fc
mov rbp, rax
test rax, rax
je 0x1400d3268
mov rcx, qword [rbx]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x98], rdi
call fcn.14017cb08
test eax, eax
jne 0x1400d328a
movzx eax, word [rsp + 0x26]
mov ecx, 0xf000
and ax, cx
mov ecx, 0x8000
cmp ax, cx
jne 0x1400d328a
movsxd rdi, dword [rsp + 0x34]
test rdi, rdi
je 0x1400d328a
mov qword [rsp + 0x90], rsi
cmp rdi, 0x8000000
ja 0x1400d327e
lea rcx, [rdi + 1]
call fcn.1400c36b0
mov rsi, rax
test rax, rax
je 0x1400d327e
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
lea rcx, [rbx + rsi]
mov r9, rbp
mov r8, rdi
mov edx, 1
call fcn.140176ae4
test rax, rax
je 0x1400d3241
add rbx, rax
sub rdi, rax
jne 0x1400d3220
mov rcx, rbp
mov byte [rbx + rsi], 0
call fcn.1401761e4
test r14, r14
je 0x1400d3255
mov qword [r14], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140134a90
add rsp, 0x60
pop r14
pop rbp
pop rbx
ret
mov rcx, rbp
call fcn.1401761e4
xor eax, eax
jmp 0x1400d3258
mov rcx, rbp
call fcn.1401761e4
mov ecx, 1
call fcn.1400c36b0
mov byte [rax], 0
test r14, r14
je 0x1400d3260
xor ebx, ebx
mov qword [r14], rbx
jmp 0x1400d3260

Function at 0x1400d32b0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1406fe698]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx]
call fcn.14017cb08
test eax, eax
jne 0x1400d3315
movzx eax, word [rsp + 0x26]
mov ecx, 0xf000
and ax, cx
mov ecx, 0x4000
cmp ax, cx
jne 0x1400d3315
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400d3345
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140134a90
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400d3345
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
setne cl
mov eax, ecx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140134a90
add rsp, 0x60
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140134a90
add rsp, 0x60
pop rbx
ret
Function at 0x1400d33a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rcx, qword [rcx]
mov rsi, rdx
lea rdx, [0x140423dc4]
mov rbx, r8
call fcn.1401795fc
mov rbp, rax
test rax, rax
jne 0x1400d33df
lea eax, [rbp + 1]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
test rbx, rbx
je 0x1400d342a
mov qword [rsp + 0x30], rdi
nop dword [rax]
mov r9, rbp
mov r8, rbx
mov edx, 1
mov rcx, rsi
call fcn.1401771f4
mov rdi, rax
test rax, rax
jne 0x1400d3415
call fcn.140146434
cmp dword [rax], 0x16
je 0x1400d3420
cmp rdi, rbx
jb 0x1400d3425
add rsi, rdi
sub rbx, rdi
test rbx, rbx
jne 0x1400d33f0
mov rdi, qword [rsp + 0x30]
mov rcx, rbp
call fcn.140176498
mov rcx, rbp
call fcn.1401761e4
mov rbp, qword [rsp + 0x40]
xor eax, eax
test rbx, rbx
mov rbx, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x1400d34a0
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x1406fe698]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov qword [r11 + 0x10], rbp
mov rsi, rcx
mov qword [r11 + 0x18], rdi
xor r12d, r12d
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
jne 0x1400d3557
mov rax, qword [rsi + 8]
mov rbx, 0xffffffffffffffff
mov rcx, qword [rax]
nop dword [rax]
cmp word [rcx + rbx*2 + 2], r12w
lea rbx, [rbx + 1]
jne 0x1400d34f0
lea rcx, [rbx*2 + 6]
call fcn.1400c36b0
mov rbp, rax
test rax, rax
je 0x1400d35b7
mov rdx, qword [rsi + 8]
lea rdi, [rbx + rbx]
mov r8, rdi
mov rcx, rax
mov rdx, qword [rdx]
call fcn.1401378a0
lea rdx, [rsp + 0x20]
mov dword [rdi + rbp], 0x2a005c
mov rcx, rbp
mov word [rbp + rbx*2 + 4], r12w
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rbp
mov qword [rsi], rax
call fcn.1400c36a0
cmp qword [rsi], 0xffffffffffffffff
jmp 0x1400d3564
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400d35b7
movzx ecx, word [rsp + 0x4c]
movzx eax, word [rsp + 0x4e]
cmp cx, 0x2e
jne 0x1400d3595
test ax, ax
je 0x1400d34d2
cmp cx, cx
jne 0x1400d3595
cmp ax, cx
jne 0x1400d3595
cmp word [rsp + 0x50], r12w
je 0x1400d34d2
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x1400d35a3
call fcn.1400d3680
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x4c]
call fcn.1400d2fc0
mov qword [rsi + 0x10], rax
jmp 0x1400d35b9
xor eax, eax
mov rdi, qword [rsp + 0x2c0]
mov rbp, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140134a90
add rsp, 0x280
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret

Function at 0x1400d36b0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.1400d2e50
test al, al
je 0x1400d3702
mov rcx, rdi
mov qword [rsp + 0x30], rbx
call fcn.1400d2f30
mov rcx, rax
mov rbx, rax
call fcn.1400d34a0
test rax, rax
je 0x1400d36f5
nop
mov rcx, rax
call fcn.1400d36b0
mov rcx, rbx
call fcn.1400d34a0
test rax, rax
jne 0x1400d36e0
mov rcx, rbx
call fcn.1400d3460
mov rbx, qword [rsp + 0x30]
mov rcx, rdi
add rsp, 0x20
pop rdi
jmp fcn.1400d32b0
Function at 0x1400d54e0
Capabilities:
Delete directory
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
call fcn.1400d36b0
mov rcx, qword [rbx + 0x20]
add rsp, 0x20
pop rbx
jmp fcn.1400d25a0
Function at 0x1400da400
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x14070a900], 0
mov rbx, rdx
mov rdi, rcx
jne 0x1400da45b
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400da44b
lea rdx, [0x1404248b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14070a8f8], rax
mov byte [0x14070a900], 1
jmp 0x1400da462
mov rax, qword [0x14070a8f8]
mov byte [0x14070a900], 1
jmp 0x1400da462
mov rax, qword [0x14070a8f8]
test rax, rax
je 0x1400da47f
mov edx, ebx
mov rcx, rdi
call rax
test al, al
je 0x1400da47f
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400db0a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x20
xor ebp, ebp
mov r14, rdx
mov eax, ebp
mov rdi, rcx
lock xadd dword [rcx + 0x74], eax
test eax, eax
jne 0x1400db0d6
lea rdx, str.trying_to_shut_down_non_running_thread
lea ecx, [rbp + 1]
call fcn.1400d2490
xor eax, eax
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov qword [rsp + 0x48], rbx
lea rdx, str.shutting_down_background_worker_thread
mov ecx, 0xffffffff
mov qword [rsp + 0x58], rsi
call fcn.1400d2490
mov r9, rdi
lea rdx, [0x1400db5b0]
xor r8d, r8d
mov rcx, rdi
call fcn.1400db2c0
cmp qword [0x14070a910], rbp
jne 0x1400db12d
lea rcx, [0x14070a910]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
cmp qword [0x14070a910], rbp
jne 0x1400db12d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
jmp 0x1400db14a
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
imul rax, qword [rsp + 0x40], 0x3e8
cqo
idiv qword [0x14070a910]
lea rcx, [rdi + 0x20]
xor r9d, r9d
lea rbx, [rcx + 8]
mov rsi, rax
mov r8, rbx
lea rdx, [0x1400db590]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rdi + 0x50], rbp
jne 0x1400db182
mov eax, ebp
lock xadd dword [rdi + 0x74], eax
test eax, eax
je 0x1400db1e9
cmp qword [0x14070a910], rbp
jne 0x1400db1a9
lea rcx, [0x14070a910]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
cmp qword [0x14070a910], rbp
jne 0x1400db1a9
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
jmp 0x1400db1c6
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
imul rax, qword [rsp + 0x50], 0x3e8
cqo
idiv qword [0x14070a910]
cmp rax, rsi
jbe 0x1400db1d3
sub rax, rsi
cmp rax, r14
ja 0x1400db205
lea rcx, [rdi + 0x18]
mov r8d, 0xfa
lea rdx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
jmp 0x1400db171
lea rcx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
jmp 0x1400db228
xchg dword [rdi + 0x74], ebp
lea rcx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rdx, str.background_thread_failed_to_shut_down_cleanly_within_timeout
mov ecx, 1
call fcn.1400d2490
mov eax, 1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400dbab0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edx, edx
mov rsi, rcx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test eax, eax
jne 0x1400dbad7
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
mov qword [rsp + 0x30], rbx
call fcn.1400c36b0
mov r9, rax
mov r8d, edi
xor edx, edx
mov rcx, rsi
mov rbx, rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x1400dbb15
mov rcx, rbx
call fcn.1400c36a0
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400df0e0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1406fe698]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x1400df110
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400df123
mov al, 1
jmp 0x1400df22e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400df226
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400df141
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.1400feb60
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x266
lea r8, str.D:3party_code_sentry_nativeexternalcrashpadclientcrash_report_database_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::CreateDirectoryIfNecessary_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.1400fd6c0
nop
mov dword [rsp + 0x30], 3
lea rdx, str.CreateDirectory
mov rcx, rax
call fcn.1400dbf30
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400df1cc
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1400dc8b0
nop
lea rcx, [rsp + 0x50]
call fcn.1400fd990
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x1400df222
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400df21d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400df247
call fcn.140133e68
xor al, al
jmp 0x1400df22e
mov rcx, rbx
call fcn.1400df4a0
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140134a90
add rsp, 0x180
pop rbx
ret
call fcn.1401462a8
int3
Function at 0x1400df4a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1406fe698]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x1400df4d0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400df5d9
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400df4ec
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.1400feb60
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x251
lea r8, str.D:3party_code_sentry_nativeexternalcrashpadclientcrash_report_database_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.1400fd6c0
nop
mov dword [rsp + 0x30], 3
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.1400dbf30
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400df577
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1400dc8b0
nop
lea rcx, [rsp + 0x50]
call fcn.1400fd990
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x1400df6d5
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400df6d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400df6fa
jmp 0x1400df6d0
test al, 0x10
jne 0x1400df6d9
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400df5ee
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.1400feb60
mov rbx, rax
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x20], 2
mov r9d, 0x255
lea r8, str.D:3party_code_sentry_nativeexternalcrashpadclientcrash_report_database_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.1400fd530
nop
mov dword [rsp + 0x30], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.1400dbf30
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400df670
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1400dc8b0
lea rdx, str.:_not_a_directory
mov rcx, rax
call fcn.1400dbf30
nop
lea rcx, [rsp + 0x50]
call fcn.1400fd740
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x1400df6d5
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400df6d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400df6f4
call fcn.140133e68
xor al, al
jmp 0x1400df6db
mov al, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140134a90
add rsp, 0x180
pop rbx
ret
call fcn.1401462a8
int3
call fcn.1401462a8
int3
Function at 0x1400df700
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebp, edx
mov rsi, qword [rcx + 0x58]
mov rbx, qword [rcx + 0x50]
cmp rbx, rsi
je 0x1400df77b
cmp dword [rbx + 0x78], ebp
jne 0x1400df772
cmp qword [rbx + 0x28], 8
lea rcx, [rbx + 0x10]
jb 0x1400df739
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400df772
test al, 0x10
jne 0x1400df772
mov rax, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x1400df764
mov rdx, rbx
mov rcx, rax
call fcn.1400dd520
add qword [rdi + 8], 0x78
jmp 0x1400df772
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.1400dc3d0
sub rbx, 0xffffffffffffff80
cmp rbx, rsi
jne 0x1400df726
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400df7a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
movups xmm0, xmmword [rdx]
mov rdi, qword [rcx + 0x58]
mov r14, r9
mov rbx, qword [rcx + 0x50]
mov ebp, r8d
movaps xmmword [rsp + 0x20], xmm0
mov rsi, rcx
cmp rbx, rdi
je 0x1400df7fa
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400f2540
test al, al
jne 0x1400df7fa
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x1400df7e0
cmp rbx, qword [rsi + 0x58]
jne 0x1400df807
mov eax, 1
jmp 0x1400df853
mov eax, dword [rbx + 0x78]
cmp eax, ebp
jne 0x1400df837
cmp qword [rbx + 0x28], 8
lea rcx, [rbx + 0x10]
jb 0x1400df81c
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov edx, 1
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
cmove ecx, edx
jmp 0x1400df846
mov ecx, 1
mov edx, 4
cmp eax, ecx
cmove ecx, edx
test ecx, ecx
jne 0x1400df851
mov byte [rsi + 0x48], 1
mov qword [r14], rbx
mov eax, ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret