joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800790c0
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e8
movaps xmmword [rsp + 0x1d0], xmm12
movaps xmmword [rsp + 0x1c0], xmm11
movaps xmmword [rsp + 0x1b0], xmm10
movaps xmmword [rsp + 0x1a0], xmm9
movaps xmmword [rsp + 0x190], xmm8
movaps xmmword [rsp + 0x180], xmm7
movaps xmmword [rsp + 0x170], xmm6
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x1801df668]
xor rax, rsp
mov qword [rsp + 0x168], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x150], xmm0
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x120], xmm0
cmp r9, 0x40
ja 0x18007915f
lea rcx, [rsp + 0x120]
mov rdx, r8
mov r8, r9
call fcn.1801258c0
jmp 0x1800791ab
movaps xmmword [rsp + 0xb0], xmm0
movaps xmm0, xmmword [0x18018c380]
movaps xmmword [rsp + 0x100], xmm0
movaps xmm0, xmmword [0x18018c390]
movaps xmmword [rsp + 0x110], xmm0
lea rbx, [rsp + 0xb0]
mov rcx, rbx
mov rdx, r8
mov r8, r9
call fcn.1800ae1d0
lea rdx, [rsp + 0x120]
mov rcx, rbx
call fcn.1800ae5d0
movaps xmm0, xmmword [0x18018c3a0]
movaps xmm7, xmmword [rsp + 0x120]
movaps xmm6, xmmword [rsp + 0x130]
movaps xmm9, xmmword [rsp + 0x140]
movaps xmm8, xmmword [rsp + 0x150]
movaps xmm1, xmm7
xorps xmm1, xmm0
movaps xmmword [rsp + 0x120], xmm1
movaps xmm1, xmm6
xorps xmm1, xmm0
movaps xmmword [rsp + 0x130], xmm1
movaps xmm1, xmm9
xorps xmm1, xmm0
movaps xmmword [rsp + 0x140], xmm1
xorps xmm0, xmm8
movaps xmmword [rsp + 0x150], xmm0
xorps xmm10, xmm10
movaps xmmword [rsp + 0xb0], xmm10
movaps xmm11, xmmword [0x18018c380]
movaps xmmword [rsp + 0x100], xmm11
movaps xmm12, xmmword [0x18018c390]
movaps xmmword [rsp + 0x110], xmm12
lea rsi, [rsp + 0xb0]
lea rbx, [rsp + 0x120]
mov r8d, 0x40
mov rcx, rsi
mov rdx, rbx
call fcn.1800ae1d0
mov r8d, 0x40
mov rcx, rsi
mov rdx, rdi
call fcn.1800ae1d0
lea rdi, [rsp + 0x90]
mov rcx, rsi
mov rdx, rdi
call fcn.1800ae5d0
movaps xmm0, xmmword [0x18018c3b0]
xorps xmm7, xmm0
movaps xmmword [rsp + 0x120], xmm7
xorps xmm6, xmm0
movaps xmmword [rsp + 0x130], xmm6
xorps xmm9, xmm0
movaps xmmword [rsp + 0x140], xmm9
xorps xmm8, xmm0
movaps xmmword [rsp + 0x150], xmm8
movaps xmmword [rsp + 0x20], xmm10
movaps xmmword [rsp + 0x70], xmm11
movaps xmmword [rsp + 0x80], xmm12
lea rsi, [rsp + 0x20]
mov r8d, 0x40
mov rcx, rsi
mov rdx, rbx
call fcn.1800ae1d0
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rsi
mov rdx, rdi
call fcn.1800ae1d0
mov rcx, rsi
mov rdx, r14
call fcn.1800ae410
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1800da5d0
movaps xmm6, xmmword [rsp + 0x170]
movaps xmm7, xmmword [rsp + 0x180]
movaps xmm8, xmmword [rsp + 0x190]
movaps xmm9, xmmword [rsp + 0x1a0]
movaps xmm10, xmmword [rsp + 0x1b0]
movaps xmm11, xmmword [rsp + 0x1c0]
movaps xmm12, xmmword [rsp + 0x1d0]
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1800b2350
Capabilities:
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, rcx
mov rax, qword [0x1801df668]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov esi, 1
xor eax, eax
lock cmpxchg dword [0x1801eae20], esi
je 0x1800b23aa
xor ebx, ebx
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax]
xor ecx, ecx
cmp rbx, 0x20
setae cl
call rbp
inc rbx
xor eax, eax
lock cmpxchg dword [0x1801eae20], esi
jne 0x1800b2390
cmp qword [0x1801eae28], 0
je 0x1800b23f7
test rdi, rdi
je 0x1800b2402
mov ecx, dword [0x1801eae40]
mov r14d, 4
test rcx, rcx
je 0x1800b25ae
mov rax, qword [0x1801eae30]
add rax, 0x20
neg rcx
xor ebx, ebx
nop
cmp qword [rax - 0x20], rdi
je 0x1800b243d
add rax, 0x38
dec rbx
cmp rcx, rbx
jne 0x1800b23e0
jmp 0x1800b25ae
mov r14d, 2
jmp 0x1800b25ae
mov eax, dword [0x1801eae40]
test rax, rax
je 0x1800b2435
mov ebx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, qword [0x1801eae30]
xor edi, edi
nop dword [rax + rax]
test byte [rcx + rbx], 2
je 0x1800b24e0
add rbx, 0x38
inc rdi
cmp eax, edi
jne 0x1800b2420
xor r14d, r14d
jmp 0x1800b25ae
cmp ebx, 1
je 0x1800b25ae
mov r14d, 5
test byte [rax], 2
jne 0x1800b25ae
neg rbx
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800b25e0
mov ecx, ebx
call fcn.1800b28b0
mov r14d, eax
mov rdi, qword [rsp + 0x20]
test rdi, rdi
je 0x1800b25ae
mov esi, dword [rsp + 0x2c]
test rsi, rsi
je 0x1800b259c
xor ebp, ebp
mov r15, qword [sym.imp.KERNEL32.dll_OpenThread]
mov r12, qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800b24bc
inc rbp
cmp rsi, rbp
je 0x1800b259c
mov r8d, dword [rdi + rbp*4]
mov ecx, 0x5a
xor edx, edx
call r15
test rax, rax
je 0x1800b24b0
mov rbx, rax
mov rcx, rax
call r12
mov rcx, rbx
call r13
jmp 0x1800b24b0
lea rcx, [rsp + 0x20]
mov edx, 0xffffffff
call fcn.1800b25e0
mov eax, dword [0x1801eae40]
xor r14d, r14d
cmp edi, eax
jae 0x1800b253f
mov rcx, qword [0x1801eae30]
jmp 0x1800b252b
mov rcx, qword [0x1801eae30]
mov eax, dword [0x1801eae40]
inc rdi
mov edx, eax
add rbx, 0x38
cmp rdi, rdx
jae 0x1800b253f
test byte [rcx + rbx], 2
jne 0x1800b251d
mov ecx, edi
call fcn.1800b28b0
test eax, eax
je 0x1800b2510
mov r14d, eax
mov rdi, qword [rsp + 0x20]
test rdi, rdi
je 0x1800b25ae
mov esi, dword [rsp + 0x2c]
test rsi, rsi
je 0x1800b259c
xor ebp, ebp
mov r15, qword [sym.imp.KERNEL32.dll_OpenThread]
mov r12, qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800b2578
inc rbp
cmp rsi, rbp
je 0x1800b259c
mov r8d, dword [rdi + rbp*4]
mov ecx, 0x5a
xor edx, edx
call r15
test rax, rax
je 0x1800b2570
mov rbx, rax
mov rcx, rax
call r12
mov rcx, rbx
call r13
jmp 0x1800b2570
mov rcx, qword [0x1801eae28]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
xchg dword [0x1801eae20], eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800da5d0
mov eax, r14d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1800b28b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword [0x1801df668]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, qword [0x1801eae30]
mov eax, ecx
imul rdi, rax, 0x38
mov rax, qword [rbx + rdi]
movzx ecx, byte [rbx + rdi + 0x20]
xor edx, edx
and ecx, 1
sete dl
lea rdx, [rdx + rdx*4]
lea rsi, [rax + rdx]
add rsi, 0xfffffffffffffffb
lea r14, [rcx + rcx + 5]
lea r9, [rsp + 0x24]
mov rcx, rsi
mov rdx, r14
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800b296f
lea r15, [rbx + rdi]
add r15, 0x20
mov byte [rsi], 0xe9
mov eax, dword [rbx + rdi + 8]
sub eax, esi
add eax, 0xfffffffb
mov dword [rsi + 1], eax
test byte [r15], 1
je 0x1800b293c
add rbx, rdi
mov rax, qword [rbx]
mov word [rax], 0xf9eb
mov r8d, dword [rsp + 0x24]
lea r9, [rsp + 0x24]
mov rcx, rsi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rsi
mov r8, r14
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [r15], 6
xor esi, esi
jmp 0x1800b2974
mov esi, 0xa
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800da5d0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800bb080
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebp, edx
mov rsi, qword [rcx + 0x58]
mov rbx, qword [rcx + 0x50]
cmp rbx, rsi
je 0x1800bb0fb
cmp dword [rbx + 0x78], ebp
jne 0x1800bb0f2
cmp qword [rbx + 0x28], 8
lea rcx, [rbx + 0x10]
jb 0x1800bb0b9
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800bb0f2
test al, 0x10
jne 0x1800bb0f2
mov rax, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x1800bb0e4
mov rdx, rbx
mov rcx, rax
call fcn.1800ba2c0
add qword [rdi + 8], 0x78
jmp 0x1800bb0f2
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.1800bea80
sub rbx, 0xffffffffffffff80
cmp rbx, rsi
jne 0x1800bb0a6
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1800bb120
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
movups xmm0, xmmword [rdx]
mov rdi, qword [rcx + 0x58]
mov r14, r9
mov rbx, qword [rcx + 0x50]
mov ebp, r8d
movaps xmmword [rsp + 0x20], xmm0
mov rsi, rcx
cmp rbx, rdi
je 0x1800bb17a
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800dd970
test al, al
jne 0x1800bb17a
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x1800bb160
cmp rbx, qword [rsi + 0x58]
jne 0x1800bb187
mov eax, 1
jmp 0x1800bb1d3
mov eax, dword [rbx + 0x78]
cmp eax, ebp
jne 0x1800bb1b7
cmp qword [rbx + 0x28], 8
lea rcx, [rbx + 0x10]
jb 0x1800bb19c
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov edx, 1
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
cmove ecx, edx
jmp 0x1800bb1c6
mov ecx, 1
mov edx, 4
cmp eax, ecx
cmove ecx, edx
test ecx, ecx
jne 0x1800bb1d1
mov byte [rsi + 0x48], 1
mov qword [r14], rbx
mov eax, ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1800bc6a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1801df668]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x1800bc6d0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800bc7d9
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800bc6ec
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.1800df490
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x251
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_client_crash_report_database_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.1800dbc60
nop
mov dword [rsp + 0x30], 3
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.1800aac20
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800bc777
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1800ab2d0
nop
lea rcx, [rsp + 0x50]
call fcn.1800dbce0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x1800bc8d5
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800bc8d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800bc8fa
jmp 0x1800bc8d0
test al, 0x10
jne 0x1800bc8d9
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800bc7ee
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.1800df490
mov rbx, rax
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x20], 2
mov r9d, 0x255
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_client_crash_report_database_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.1800daee0
nop
mov dword [rsp + 0x30], select
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.1800aac20
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800bc870
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1800ab2d0
lea rdx, str.:_not_a_directory
mov rcx, rax
call fcn.1800aac20
nop
lea rcx, [rsp + 0x50]
call fcn.1800db070
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x1800bc8d5
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800bc8d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800bc8f4
call fcn.1800c38fc
xor al, al
jmp 0x1800bc8db
mov al, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1800da5d0
add rsp, 0x180
pop rbx
ret
call fcn.180139754
int3
call fcn.180139754
int3
Function at 0x1800bc900
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1801df668]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x1800bc930
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1800bc943
mov al, 1
jmp 0x1800bca4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1800bca46
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800bc961
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.1800df490
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x266
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_client_crash_report_database_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::CreateDirectoryIfNecessary_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.1800dbc60
nop
mov dword [rsp + 0x30], 3
lea rdx, str.CreateDirectory
mov rcx, rax
call fcn.1800aac20
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800bc9ec
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1800ab2d0
nop
lea rcx, [rsp + 0x50]
call fcn.1800dbce0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x1800bca42
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800bca3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800bca67
call fcn.1800c38fc
xor al, al
jmp 0x1800bca4e
mov rcx, rbx
call fcn.1800bc6a0
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1800da5d0
add rsp, 0x180
pop rbx
ret
call fcn.180139754
int3

Function at 0x1800bd250
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rbp, rdx
lea rdx, [rsp + 0x68]
call fcn.1800be2b0
nop
mov rbx, qword [rsp + 0x68]
test rbx, rbx
jne 0x1800bd287
mov ebx, 3
jmp 0x1800bd306
mov rsi, qword [rbx + 0x58]
mov rdi, qword [rbx + 0x50]
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x20], xmm0
cmp rdi, rsi
je 0x1800bd2ba
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1800dd970
test al, al
jne 0x1800bd2ba
sub rdi, 0xffffffffffffff80
cmp rdi, rsi
jne 0x1800bd2a0
cmp rdi, qword [rbx + 0x58]
jne 0x1800bd2c7
mov ebx, 1
jmp 0x1800bd306
lea rcx, [rdi + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x1800bd2d5
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1800bd2e9
mov ebx, 1
jmp 0x1800bd2f1
shr ebx, 3
and ebx, 2
je 0x1800bd2f6
mov rdi, qword [rsp + 0x68]
test ebx, ebx
jne 0x1800bd306
mov rdx, rdi
mov rcx, r14
call fcn.1800ba3c0
nop
lea rcx, [rsp + 0x68]
call fcn.1800bc4b0
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1800c0120
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rdi, rcx
mov dword [rsp + 0x148], 0
mov rax, qword [0x1801e4ce0]
nop
mov ebx, 1
test rax, rax
jne 0x1800c0165
nop dword [rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x1801e4ce0]
nop
test rax, rax
je 0x1800c0150
cmp eax, 2
jne 0x1800c01a9
mov dword [rsp + 0x20], eax
mov r9d, Ordinal_143
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_client_crashpad_client_win.cc
lea rdx, str.long___cdecl_crashpad::_anonymous_namespace::UnhandledExceptionHandler_struct__EXCEPTION_POINTERS__
lea rcx, [rsp + 0x30]
call fcn.1800daee0
nop
mov dword [rsp + 0x148], ebx
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov rcx, rax
call fcn.1800aac20
nop
jmp 0x1800c0236
lock xadd qword [0x1801e4d10], rbx
lea rax, [rbx + 1]
cmp rax, 1
jle 0x1800c01c9
xor edx, edx
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1801e4cc0], eax
mov qword [0x1801e4cb8], rdi
mov rcx, qword [0x1801df040]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 2
mov r9d, 0xb7
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_client_crashpad_client_win.cc
lea rdx, str.long___cdecl_crashpad::_anonymous_namespace::UnhandledExceptionHandler_struct__EXCEPTION_POINTERS__
lea rcx, [rsp + 0x30]
call fcn.1800daee0
nop
mov dword [rsp + 0x148], 2
lea rdx, str.crash_server_did_not_respond__self_terminating
mov rcx, rax
call fcn.1800aac20
nop
lea rcx, [rsp + 0x30]
call fcn.1800db070
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xffff7001
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
Function at 0x1800c60c8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800c614c
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1800c614c
dec r8
sub rdx, 1
jne 0x1800c6132
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1800d66e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1800d6722
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1800d6880
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x138
mov rax, qword [0x1801df668]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, qword [rsp + 0x1a0]
mov rbp, rcx
mov rcx, qword [rcx + 0x18]
mov r15, r8
movsxd r8, edx
xor r13d, r13d
mov rax, r8
mov r12, r9
shl rax, 5
lea rbx, [rcx + 0x230]
mov r14, qword [rcx + r8*8 + 0x1e8]
add rbx, rax
mov rax, qword [rcx + 0x3e8]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x1800d69a3
lea rax, [0x1800d6730]
cmp qword [rcx + r8*8 + 0x210], rax
jne 0x1800d69a3
cmp qword [rbx], r13
je 0x1800d6916
test rdi, rdi
je 0x1800d69a3
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, r14
call fcn.1800f22e0
cmp eax, 0xffffffff
je 0x1800d69a3
test al, 1
je 0x1800d69a3
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1800d696d
mov eax, dword [rbp + 0x6f4]
add eax, eax
movsxd rcx, eax
mov qword [rbx + 8], rcx
call qword [section..data]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x1800d6990
mov rdi, qword [rbx + 8]
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
test rax, rax
je 0x1800d699f
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1800d69a3
add qword [rbx + 0x10], rcx
jmp 0x1800d69a3
mov dword [rsi], reloc.WLDAP32.dll_Ordinal_27
mov rax, 0xffffffffffffffff
jmp 0x1800d6a0e
mov qword [rbx + 8], r13
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
mov dword [rsi], r13d
cmp rbx, 0xffffffffffffffff
jne 0x1800d6a0b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2733
jne 0x1800d69db
mov rbx, r13
mov dword [rsi], 0x51
jmp 0x1800d6a0b
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.18010fd10
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, rbp
call fcn.1800d6520
mov dword [rbp + 0xd8c], edi
mov dword [rsi], gethostname
mov rax, rbx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1800da5d0
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800d7710
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x280], 0
je 0x1800d772d
call fcn.1800d0440
test eax, eax
jne 0x1800d7753
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x1e8]
cmp rcx, 0xffffffffffffffff
je 0x1800d7726
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x1800d7726
mov al, 1
add rsp, 0x28
ret
Function at 0x1800d7ca0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x1c8
mov rax, qword [0x1801df668]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rsi, r8
mov dword [rsp + 0x20], 0x80
mov rbx, rdx
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x80
mov rdi, r9
call fcn.180125f70
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1800d7d27
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.18010fd10
mov r8d, ebx
lea rdx, str.getsockname___failed_with_errno__d:__s
jmp 0x1800d7db0
movzx eax, word [rsp + 0x30]
cmp eax, 2
je 0x1800d7d62
cmp eax, 0x17
jne 0x1800d7d6e
lea rdx, [rsp + 0x38]
mov ecx, eax
mov r8, rsi
mov r9d, reloc.WLDAP32.dll_Ordinal_46
call fcn.1801113e0
test rax, rax
je 0x1800d7d6e
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
jmp 0x1800d7dbb
lea rdx, [rsp + 0x34]
mov ecx, 2
jmp 0x1800d7d3d
mov byte [rsi], 0
mov dword [rdi], 0
call fcn.180137e5c
mov dword [rax], 0x273f
call fcn.180137e5c
mov ebx, dword [rax]
call fcn.180137e5c
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.18010fd10
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rbp
call fcn.1800d6520
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1800da5d0
add rsp, 0x1c8
pop rdi
pop rsi
pop rbp
pop rbx
ret