joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140050079
Capabilities:
Check for software breakpoints

Disassembly:
cmp byte [rsp + 0x18], 0x2c
lea rax, [rax + 0x50195a9f]
setns r14b
and r13w, r8w
neg dx
jns 0x1400af674
je 0x1400b2b86
mov qword [rsp + 0x28], r8
test qword [rsp + rdx - 0x79a0f407], 0x780e670e
xchg qword [rsp + 0x50], rax
mov r8, qword [rsp + r14*2 + 0x48]
jno 0x14000a290
out 0x80, al
and al, 0x7f
xchg edi, eax
jne 0x140050109
imul ebx, dword [rbx - 0x5f6832a8], 0x59
test eax, 0x92a58712
and edx, ebx
jo 0x140050102
and eax, 0xffc8c2df
invalid
xor ch, byte [rcx]
movabs byte [0xc0c4bbea51dd2c8e], al
cli
out dx, al
test rbx, rdx
add rax, 0xffffffff8b0c785e
push rbp
nop
cmpsb byte [rsi], byte [rdi]
xchg esi, eax
sub eax, 0x8adbf49d
fiadd dword [rbp + 0x37fd4794]
xchg ebx, eax
pop rbp
invalid
invalid

Function at 0x140070fa7
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x28]
ret
shr r12d, 0xf
add qword [rsp], 0xffffffffbfff6489
mov r8, rbx
movabs rbp, 0xec01ab3ac9846307
shr bl, 0x2c
lea rcx, [rcx + 0x1e282899]
shr r12, 0xb5
mov qword [rsp + 0x18], r9
sub r12d, r12d
js 0x14000fe4f
call fcn.140069206
insd dword [rdi], dx
invalid

Function at 0x140075e41
Capabilities:
Encode data using xor

Disassembly:
not qword [rsp + 0x38]
call fcn.140087cf2
mov r10, qword [rsp + r10 + 0x663904b8]
sub qword [rsp + 0x58], 0x560f399b
jae 0x14006e542
fst qword [rdi - 0x61506e60]
pop rbx
xchg ebp, eax
add dl, bh
int 0xd4
and al, 0xd7
enter 0x7eff, 0xffffffffffffff8e
cmp eax, 0x749daaa8
cmpsb byte [rsi], byte [rdi]
lahf
movsd dword [rdi], dword [rsi]
outsb dx, byte [rsi]
sti
mov dword [rdi + rbp*8 + 0x1dd48449], ebx
sbb eax, 0x26db8568
mov ebp, 0x11000a07
or eax, 0x24fd4408
adc dword [0x16504a298], ecx
jge 0x140075e8a
cmc
invalid

Function at 0x14008a496
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rax + r13*2 - 0x2a5e294c]
call fcn.1400a9eec
and al, 8
mov rbp, qword [rsp + 0x48]
add dword [rsp + 0x48], 0xd9afffb5
mov rdx, qword [rsp + rdi - 0x7db013f6]
xor word [rsp + 0x48], 0xcf2a
or byte [rsp + 0x48], bh
jbe 0x1400a2064
bswap ebx
mov rbx, qword [rsp + rdi - 0x7db0140e]
and rbp, 0xffffffffffb0d48f
and dil, 0xb1
not byte [rsp + 0x48]
call fcn.140009bc7
xchg esp, eax
cld
adc dl, cl
lodsb al, byte [rsi]
jne 0x14008a489
push 0xffffffff8f0885bb
test r8, r13
jle 0x140094674
add qword [rsp + 0x10], 0x24e3f
push r8
movsx r8d, r13b
and r8b, byte [rsp + rbx - 0x4e8f0885]
movzx r13, r8b
push r13
shr qword [rsp + 8], 0xbe
push r11
mov rax, qword [rsp + r13*8 - 0x408]
mov rax, qword [rax]
mov qword [rsp + rbx - 0x4e8f085d], rbx
xor r8d, 0x3f102f8d
movsx bx, byte [rsp + rbx - 0x4e8f085a]
jle 0x1400abafe
setb r13b
jle 0x140087b84
add qword [rsp + r13 - 0x6e], 0xfffffffffffac11e
lea rax, [rax + rbx*2 - 0x66000108]
call fcn.1400ad5b4
Function at 0x1400aa589
Capabilities:
Encode data using xor

Disassembly:
neg r14b
xor r12d, 0x49373727
or r14, 0xfffffffff92dffba
call fcn.14000cd0a
add qword [rsp + r11 - 0x1f1c], 0xffffffffbffb1f34
movabs rax, 0x1d164cbf53264d38
shl r11w, 0x21
add al, al
xor r11d, 0x660ddaad
test r11, 0xffffffffdc178113
setae al
mov rax, qword [rsp + 8]
mov rax, qword [rax + r11 - 0x660de495]
mov qword [rsp + r11 - 0x660de48d], r11
not byte [rsp + r11 - 0x660de48d]
test qword [rsp + r11 - 0x660de48d], r11
bswap r11
lea rax, [rax + 0x71c419b]
lea r11, [r11 + r11*2 - 0x3548ef7b]
je 0x140055c26
neg r11b
add r11b, byte [rsp + 0xc]
xchg qword [rsp + 0x20], rax
mov r11, qword [rsp + 0x18]
ja 0x14005aa41
add r8d, r8d

Function at 0x1400addf7
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
invalid
xchg qword [rsp + rcx - 0x56164a59], rdx
mov rbx, qword [rsp + rcx - 0x56164a89]
sub word [rsp + rcx - 0x56164a69], cx
call fcn.14000d495
xchg esi, eax
imul ebx, edi, 0xffffff97
fidivr word [rbx + 0x4775e053]
jo 0x1400addea
cmp dword [rdx - 0x21], ecx
add eax, 0xb04bbb32
and eax, 0xf9093007
cli
outsd dx, dword [rsi]
invalid

Function at 0x1400bcd8d
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rbx]
test rdi, rdi
je 0x140024f0c
lea rax, [rdi + 0xb00]
jmp 0x140024efb
cmp dword [rdi + 0xc], 0
je 0x140024eee
lea rcx, [rdi + 0x10]
push rbp
call fcn.14002c906
mov rax, qword [rbx]
add rdi, 0x58
add rax, 0xb00
cmp rdi, rax
jb 0x140024ede
mov rcx, qword [rbx]
call fcn.140021968
and qword [rbx], 0
lea rax, [0x14003da00]
add rbx, 8
cmp rbx, rax
jl 0x140024ecd
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
and r14, 0x7718b1be
add qword [rsp + 0x48], 0xfffffffffff61102
and r11b, 0xa8
movabs rsi, 0x6f1fb90c4d184cb0
jbe 0x14008583b
sete r11b
sub r8b, 0x1d
xor si, 0x143f
movsx r12d, r11b
js 0x140024ee8
jg 0x140082432
sbb dh, byte [rcx]
invalid
Function at 0x140018d40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x150], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov r9, rcx
lea r8, [0x140018e10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x140018de7
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 4
lea r9d, [rdi + 0x1b]
lea r8, str................._artifacts_sentry0.4.186crashpadutil_thread_thread_win.cc
lea rdx, str.void___cdecl_crashpad::Thread::Start_void_
lea rcx, [rsp + 0x30]
call fcn.14000d7d0
nop
mov edi, 2
mov dword [rsp + 0x150], edi
lea rdx, str.Check_failed:_platform_thread_
mov rcx, rax
call fcn.140001010
mov rcx, rax
lea rdx, [0x14006bcdc]
call fcn.140001010
mov rcx, rax
lea rdx, [0x14006cdf8]
call fcn.140001010
nop
test dil, 2
je 0x140018df7
lea rcx, [rsp + 0x30]
call fcn.14000dae0
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret

Function at 0x14001a360
Capabilities:
Write file on windows

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14001b480
push rbx
sub rsp, 0x130
xor eax, eax
mov ebx, 0xffffffff
cmp r8, rbx
cmova r8d, ebx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14001b4be
mov rax, 0xffffffffffffffff
add rsp, 0x130
pop rbx
ret
mov dword [rsp + 0x158], ebx
cmp dword [rsp + 0x150], ebx
jne 0x14001b51c
lea r8, str.bytes_written___static_cast_DWORD___1_
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x150]
call fcn.140011e70
test rax, rax
je 0x14001b51c
mov qword [rsp + 0x20], rax
mov r9d, 0x65
lea r8, str................._artifacts_sentry0.4.186crashpadutil_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::internal::NativeWriteFile_void__const_void__unsigned___int64_
lea rcx, [rsp + 0x30]
call fcn.14000d6c0
lea rcx, [rsp + 0x30]
call fcn.14000d850
mov eax, dword [rsp + 0x150]
add rsp, 0x130
pop rbx
ret

Function at 0x14001a3f0
Capabilities:
Check os version
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
xor edi, edi
movzx esi, dl
mov rbx, rcx
test dl, dl
je 0x14001a43b
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x14001a43b
xor ecx, ecx
mov qword [rsp + 0x40], 0x18
mov dword [rsp + 0x54], edi
call fcn.14001a490
mov qword [rsp + 0x48], rax
lea rdi, [rsp + 0x40]
mov dword [rsp + 0x50], 1
cmp qword [rbx + 0x18], 8
jb 0x14001a445
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov r9d, 2
mov edx, esi
mov dword [rsp + 0x30], 0
shl edx, 0x13
mov rcx, rbx
or edx, 3
mov dword [rsp + 0x28], 0x200
lea r8d, [r9 + 4]
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x14001b2c0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x140
mov rbx, rcx
mov dword [rax + 0x10], 0
xor r9d, r9d
lea r8, [rax + 0x18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14001b348
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0xf1
lea r8, str................._artifacts_sentry0.4.186crashpadutil_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::LoggingSeekFile_void____int64_int_
lea rcx, [rsp + 0x30]
call fcn.14000d7d0
nop
mov dword [rsp + 0x158], 4
lea rdx, [0x14006ea78]
mov rcx, rax
call fcn.140001010
nop
lea rcx, [rsp + 0x30]
call fcn.14000dae0
xor al, al
add rsp, 0x140
pop rbx
ret
cmp qword [rsp + 0x160], 0
jne 0x14001b3b5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14001b3c0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0xfb
lea r8, str................._artifacts_sentry0.4.186crashpadutil_file_file_io_win.cc
lea rdx, str.bool___cdecl_crashpad::LoggingTruncateFile_void__
lea rcx, [rsp + 0x30]
call fcn.14000d7d0
nop
mov dword [rsp + 0x158], 1
lea rdx, [0x14006ea90]
mov rcx, rax
call fcn.140001010
nop
lea rcx, [rsp + 0x30]
call fcn.14000dae0
xor al, al
add rsp, 0x140
pop rbx
ret
mov al, 1
add rsp, 0x140
pop rbx
ret

Function at 0x14001b480
Capabilities:
Write file on windows

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14001b480
push rbx
sub rsp, 0x130
xor eax, eax
mov ebx, 0xffffffff
cmp r8, rbx
cmova r8d, ebx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14001b4be
mov rax, 0xffffffffffffffff
add rsp, 0x130
pop rbx
ret
mov dword [rsp + 0x158], ebx
cmp dword [rsp + 0x150], ebx
jne 0x14001b51c
lea r8, str.bytes_written___static_cast_DWORD___1_
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x150]
call fcn.140011e70
test rax, rax
je 0x14001b51c
mov qword [rsp + 0x20], rax
mov r9d, 0x65
lea r8, str................._artifacts_sentry0.4.186crashpadutil_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::internal::NativeWriteFile_void__const_void__unsigned___int64_
lea rcx, [rsp + 0x30]
call fcn.14000d6c0
lea rcx, [rsp + 0x30]
call fcn.14000d850
mov eax, dword [rsp + 0x150]
add rsp, 0x130
pop rbx
ret
Function at 0x14001b5a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x130
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
xor ebp, ebp
mov r14d, 0xffffffff
mov qword [rsp + 0x20], rbp
cmp r8, r14
lea r9, [rsp + 0x160]
cmova edi, r14d
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001b68c
mov dword [rsp + 0x168], r14d
cmp dword [rsp + 0x160], r14d
je 0x14001b602
mov rax, rbp
jmp 0x14001b61e
lea r8, str.bytes_read___static_cast_DWORD___1_
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x160]
call fcn.140011e70
test rax, rax
je 0x14001b650
mov r9d, 0x7e
mov qword [rsp + 0x20], rax
lea r8, str................._artifacts_sentry0.4.186crashpadutil_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::ReadFile_void__void__unsigned___int64_
lea rcx, [rsp + 0x30]
call fcn.14000d6c0
lea rcx, [rsp + 0x30]
call fcn.14000d850
cmp dword [rsp + 0x160], 0
jne 0x14001b6b2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x14001b6b2
lea r9, [rsp + 0x160]
mov qword [rsp + 0x20], rbp
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14001b5f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x6d
neg eax
sbb rax, rax
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov eax, dword [rsp + 0x160]
jmp 0x14001b69a
Function at 0x14001fc50
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x140090030]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x14001fc80
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14001fc93
mov al, 1
jmp 0x14001fda5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14001fd9d
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001fcb1
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14000ea50
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x265
lea r8, str................._artifacts_sentry0.4.186crashpadclientcrash_report_database_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::CreateDirectoryIfNecessary_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.14000d7d0
nop
mov dword [rsp + 0x30], 3
lea rdx, str.CreateDirectory
mov rcx, rax
call fcn.140001010
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001fd3b
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140001640
nop
lea rcx, [rsp + 0x50]
call fcn.14000dae0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x14001fd99
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fd94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001fd94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140058888
xor al, al
jmp 0x14001fda5
mov rcx, rbx
call fcn.140020020
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140058920
add rsp, 0x180
pop rbx
ret
Function at 0x140020020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x140090030]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x140020050
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002015b
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14002006c
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14000ea50
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x250
lea r8, str................._artifacts_sentry0.4.186crashpadclientcrash_report_database_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.14000d7d0
nop
mov dword [rsp + 0x30], 3
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.140001010
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400200f6
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140001640
nop
lea rcx, [rsp + 0x50]
call fcn.14000dae0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x14002025e
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020259
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020259
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test al, 0x10
jne 0x140020262
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140020170
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14000ea50
mov rbx, rax
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x20], 2
mov r9d, 0x254
lea r8, str................._artifacts_sentry0.4.186crashpadclientcrash_report_database_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.14000d640
nop
mov dword [rsp + 0x30], 0xc
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.140001010
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400201f1
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140001640
lea rdx, str.:_not_a_directory
mov rcx, rax
call fcn.140001010
nop
lea rcx, [rsp + 0x50]
call fcn.14000d850
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x14002025e
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020259
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020259
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140058888
xor al, al
jmp 0x140020264
mov al, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140058920
add rsp, 0x180
pop rbx
ret
Function at 0x140020280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebp, edx
mov rsi, qword [rcx + 0x58]
mov rbx, qword [rcx + 0x50]
cmp rbx, rsi
je 0x1400202fb
cmp dword [rbx + 0x78], ebp
jne 0x1400202f2
cmp qword [rbx + 0x28], 8
lea rcx, [rbx + 0x10]
jb 0x1400202b9
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400202f2
test al, 0x10
jne 0x1400202f2
mov rax, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x1400202e4
mov rdx, rbx
mov rcx, rax
call fcn.14001eb70
add qword [rdi + 8], 0x78
jmp 0x1400202f2
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.14001e3d0
sub rbx, 0xffffffffffffff80
cmp rbx, rsi
jne 0x1400202a6
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140020320
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
movups xmm0, xmmword [rdx]
mov rdi, qword [rcx + 0x58]
mov r14, r9
mov rbx, qword [rcx + 0x50]
mov ebp, r8d
movaps xmmword [rsp + 0x20], xmm0
mov rsi, rcx
cmp rbx, rdi
je 0x14002037a
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000f4f0
test al, al
jne 0x14002037a
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x140020360
cmp rbx, qword [rsi + 0x58]
jne 0x140020387
mov eax, 1
jmp 0x1400203d3
mov eax, dword [rbx + 0x78]
cmp eax, ebp
jne 0x1400203b7
cmp qword [rbx + 0x28], 8
lea rcx, [rbx + 0x10]
jb 0x14002039c
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov edx, 1
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
cmove ecx, edx
jmp 0x1400203c6
mov ecx, 1
mov edx, 4
cmp eax, ecx
cmove ecx, edx
test ecx, ecx
jne 0x1400203d1
mov byte [rsi + 0x48], 1
mov qword [r14], rbx
mov eax, ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140020b70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, r8
mov rbx, rdx
lea rdx, [rsp + 0x68]
call fcn.14001f0a0
mov rsi, qword [rax]
mov qword [rax], 0
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x68]
call fcn.14001ede0
test rsi, rsi
jne 0x140020bb7
lea edi, [rsi + 3]
jmp 0x140020c36
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x30], xmm0
mov rdi, qword [rsi + 0x58]
mov rbx, qword [rsi + 0x50]
cmp rbx, rdi
je 0x140020bea
nop dword [rax]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000f4f0
test al, al
jne 0x140020bea
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x140020bd0
cmp rbx, qword [rsi + 0x58]
jne 0x140020bf7
mov edi, 1
jmp 0x140020c36
lea rcx, [rbx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x140020c05
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140020c19
mov edi, 1
jmp 0x140020c21
shr edi, 3
and edi, 2
je 0x140020c26
mov rbx, qword [rsp + 0x68]
test edi, edi
jne 0x140020c36
mov rdx, rbx
mov rcx, rbp
call fcn.14001ef90
nop
lea rcx, [rsp + 0x20]
call fcn.14001ede0
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140025f70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rdi, rcx
mov dword [rsp + 0x148], 0
mov rax, qword [0x1400921a8]
nop
mov ebx, 1
test rax, rax
jne 0x140025fb5
nop dword [rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x1400921a8]
nop
test rax, rax
je 0x140025fa0
cmp eax, 2
jne 0x140025ff9
mov dword [rsp + 0x20], eax
mov r9d, 0x90
lea r8, str................._artifacts_sentry0.4.186crashpadclientcrashpad_client_win.cc
lea rdx, str.long___cdecl_crashpad::_anonymous_namespace::UnhandledExceptionHandler_struct__EXCEPTION_POINTERS__
lea rcx, [rsp + 0x30]
call fcn.14000d640
nop
mov dword [rsp + 0x148], ebx
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov rcx, rax
call fcn.140001010
nop
jmp 0x14002609f
mov rax, qword [0x140092190]
test rax, rax
je 0x140026012
mov rcx, rdi
call rax
test al, al
jne 0x1400260bd
lock xadd qword [0x1400921d8], rbx
lea rax, [rbx + 1]
cmp rax, 1
jle 0x140026032
xor edx, edx
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140092188], eax
mov qword [0x140092180], rdi
mov rcx, qword [0x140090010]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 2
mov r9d, 0xc0
lea r8, str................._artifacts_sentry0.4.186crashpadclientcrashpad_client_win.cc
lea rdx, str.long___cdecl_crashpad::_anonymous_namespace::UnhandledExceptionHandler_struct__EXCEPTION_POINTERS__
lea rcx, [rsp + 0x30]
call fcn.14000d640
nop
mov dword [rsp + 0x148], 2
lea rdx, str.crash_server_did_not_respond__self_terminating
mov rcx, rax
call fcn.140001010
nop
lea rcx, [rsp + 0x30]
call fcn.14000d850
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xffff7001
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
Function at 0x14004a1f0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x160
mov dword [rsp + 0x178], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
mov ebx, 0xff
cmp eax, ebx
jbe 0x14004a26c
mov dword [rsp + 0x20], 1
lea r9d, [rbx + 0xb]
lea r8, str................._artifacts_sentry0.4.186crashpad_snapshotwin_system_snapshot_win.cc
lea rdx, str.unsigned_char___cdecl_crashpad::internal::SystemSnapshotWin::CPUCount_void__const
lea rcx, [rsp + 0x60]
call fcn.14000d640
nop
mov dword [rsp + 0x178], 1
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov rcx, rax
call fcn.140001010
nop
lea rcx, [rsp + 0x60]
call fcn.14000d850
mov eax, dword [rsp + 0x50]
cmp eax, ebx
movzx ecx, al
cmovbe ebx, ecx
movzx eax, bl
add rsp, 0x160
pop rbx
ret