joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004c21
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
inc edx
je 0x140004c10
add r9, rax
inc r9
mov r10d, 0xab43
nop
movsx r11d, r11b
sub rsp, rdi
mov rbx, rsp
mov dword [rbx], r10d
mov ebx, r11d
xor ebx, r11d
not ebx
and ebx, r10d
xor ebx, r11d
imul r10d, ebx, 0x127aa3
movzx r11d, byte [r9]
inc r9
test r11b, r11b
jne 0x140004c30
cmp r10d, 0x86a98fe0
jne 0x140004c10
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov ecx, dword [r8 + rcx*4]
add rcx, rax
invalid
invalid
in al, dx

Function at 0x140004d18
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea r8, [rdx + rcx]
movzx r9d, word [rdx + rcx + 0x14]
add r8, r9
add r8, 0x18
add rdx, rcx
add rdx, 0x88
mov r9b, 1
jmp 0x140004d43
inc r9b
lea r10d, [r9 - 1]
movzx r10d, r10b
shl r10d, 3
lea r10, [r10 + r10*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r11d, byte [rbp + 0x18]
movzx ebx, byte [rbp - 0x30]
sub rsp, rdi
mov r14, rsp
mov byte [r14], bl
mov r14d, r11d
xor r14b, r11b
not r14b
and r14b, bl
xor r14b, r11b
movzx ebx, r14b
mov r11d, dword [r8 + r10 + 0xc]
cmp dword [rdx + rbx*8], r11d
jb 0x140004d40
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx ebx, byte [rbp + 0x1f]
movzx r14d, byte [rbp + 0x14]
sub rsp, rdi
mov r15, rsp
mov byte [r15], r14b
mov r15d, ebx
xor r15b, bl
not r15b
and r15b, r14b
xor r15b, bl
movzx ebx, r15b
add r11d, dword [r10 + r8 + 8]
cmp dword [rdx + rbx*8], r11d
jae 0x140004d40
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx r8d, byte [rbp + 0x18]
movzx r9d, byte [rbp - 0x30]
sub rsp, rdi
mov r10, rsp
mov byte [r10], r9b
mov r10d, r8d
xor r10b, r8b
not r10b
and r10b, r9b
xor r10b, r8b
movzx r8d, r10b
mov edx, dword [rdx + r8*8]
mov r9d, dword [rdx + rcx + 0x20]
add rdx, rcx
add r9, rcx
xor r8d, r8d
jmp 0x140004e13
Function at 0x140004d7b
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea r8, [rdx + rcx]
movzx r9d, word [rdx + rcx + 0x14]
add r8, r9
add r8, 0x18
add rdx, rcx
add rdx, 0x88
mov r9b, 1
jmp 0x140004d43
inc r9b
lea r10d, [r9 - 1]
movzx r10d, r10b
shl r10d, 3
lea r10, [r10 + r10*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r11d, byte [rbp + 0x18]
movzx ebx, byte [rbp - 0x30]
sub rsp, rdi
mov r14, rsp
mov byte [r14], bl
mov r14d, r11d
xor r14b, r11b
not r14b
and r14b, bl
xor r14b, r11b
movzx ebx, r14b
mov r11d, dword [r8 + r10 + 0xc]
cmp dword [rdx + rbx*8], r11d
jb 0x140004d40
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx ebx, byte [rbp + 0x1f]
movzx r14d, byte [rbp + 0x14]
sub rsp, rdi
mov r15, rsp
mov byte [r15], r14b
mov r15d, ebx
xor r15b, bl
not r15b
and r15b, r14b
xor r15b, bl
movzx ebx, r15b
add r11d, dword [r10 + r8 + 8]
cmp dword [rdx + rbx*8], r11d
jae 0x140004d40
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx r8d, byte [rbp + 0x18]
movzx r9d, byte [rbp - 0x30]
sub rsp, rdi
mov r10, rsp
mov byte [r10], r9b
mov r10d, r8d
xor r10b, r8b
not r10b
and r10b, r9b
xor r10b, r8b
movzx r8d, r10b
mov edx, dword [rdx + r8*8]
mov r9d, dword [rdx + rcx + 0x20]
add rdx, rcx
add r9, rcx
xor r8d, r8d
jmp 0x140004e13

Function at 0x140004d9f
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea r8, [rdx + rcx]
movzx r9d, word [rdx + rcx + 0x14]
add r8, r9
add r8, 0x18
add rdx, rcx
add rdx, 0x88
mov r9b, 1
jmp 0x140004d43
inc r9b
lea r10d, [r9 - 1]
movzx r10d, r10b
shl r10d, 3
lea r10, [r10 + r10*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r11d, byte [rbp + 0x18]
movzx ebx, byte [rbp - 0x30]
sub rsp, rdi
mov r14, rsp
mov byte [r14], bl
mov r14d, r11d
xor r14b, r11b
not r14b
and r14b, bl
xor r14b, r11b
movzx ebx, r14b
mov r11d, dword [r8 + r10 + 0xc]
cmp dword [rdx + rbx*8], r11d
jb 0x140004d40
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx ebx, byte [rbp + 0x1f]
movzx r14d, byte [rbp + 0x14]
sub rsp, rdi
mov r15, rsp
mov byte [r15], r14b
mov r15d, ebx
xor r15b, bl
not r15b
and r15b, r14b
xor r15b, bl
movzx ebx, r15b
add r11d, dword [r10 + r8 + 8]
cmp dword [rdx + rbx*8], r11d
jae 0x140004d40
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx r8d, byte [rbp + 0x18]
movzx r9d, byte [rbp - 0x30]
sub rsp, rdi
mov r10, rsp
mov byte [r10], r9b
mov r10d, r8d
xor r10b, r8b
not r10b
and r10b, r9b
xor r10b, r8b
movzx r8d, r10b
mov edx, dword [rdx + r8*8]
mov r9d, dword [rdx + rcx + 0x20]
add rdx, rcx
add r9, rcx
xor r8d, r8d
jmp 0x140004e13
Function at 0x140004e60
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
inc r8d
movzx r8d, r8w
mov r10d, dword [r9 + r8*4]
movzx ebx, byte [r10 + rcx]
test bl, bl
je 0x140004e10
add r10, rcx
inc r10
mov r11d, 0xab43
movsx ebx, bl
sub rsp, rdi
mov r14, rsp
out 0x45, al
mov dword [rsi], ebx
out 0x45, al
mov dword [rsi], ebx
sub rsp, rdi
mov r15, rsp
mov dword [r15], ebx
mov r14d, dword [r14]
not r14d
or r11d, ebx
not ebx
or ebx, r14d
and ebx, r11d
imul r11d, ebx, 0x127aa3
movzx ebx, byte [r10]
inc r10
test bl, bl
jne 0x140004e30
cmp r11d, 0x1b5919a3
jne 0x140004e10
mov r9d, dword [rdx + 0x1c]
mov edx, dword [rdx + 0x24]
add rdx, rcx
movzx edx, word [rdx + r8*2]
add r9, rcx
mov r9d, dword [r9 + rdx*4]
add r9, rcx
sub rsp, 0x20
mov rcx, rax
xor edx, edx
mov r8, qword [rbp - 0x40]
call r9
add rsp, 0x20
jmp 0x140002e80
Function at 0x140006580
Capabilities:
Encode data using xor

Disassembly:
movzx r11d, r11w
mov edi, dword [r10 + r11*4]
movzx r14d, byte [rdi + rdx]
test r14b, r14b
je 0x140006596
add rdi, rdx
inc rdi
mov ebx, 0xab43
nop dword [rax]
movsx r14d, r14b
sub rsp, rsi
mov r15, rsp
mov edi, esp
mov dword [r15], ebx
mov r15d, r14d
xor r15d, r14d
not r15d
and r15d, ebx
xor r15d, r14d
imul ebx, r15d, 0x127aa3
movzx r14d, byte [rdi]
inc rdi
test r14b, r14b
jne 0x140006560
cmp ebx, r8d
jne 0x1400065a0
jmp 0x1400065be
mov ebx, 0xab43
cmp ebx, r8d
je 0x1400065be
inc r11d
movzx edi, r11w
cmp r9d, edi
ja 0x140006540
jmp 0x1400065b0
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov eax, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rdx
movzx ecx, word [rcx + r11*2]
add rax, rdx
mov eax, dword [rax + rcx*4]
add rax, rdx
jmp 0x1400065b0
Function at 0x140008450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov r14, qword [rcx]
mov byte [rsp + 0x2e], 0x69
movzx eax, byte [rsp + 0x2e]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
lea rcx, [0x14000a36e]
jmp 0x140008486
cmp r9w, r10w
je 0x1400084d3
mov rax, qword [rax]
mov rdx, qword [rax + 0x50]
xor r8d, r8d
movzx r10d, word [rdx + r8]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
movzx r11d, word [r8 + rcx]
lea edi, [r11 - 0x41]
mov r10d, r11d
or r10d, 0x20
cmp di, 0x1a
cmovae r10d, r11d
test r9w, r9w
je 0x140008480
add r8, 2
cmp r9w, r10w
je 0x140008490
jmp 0x140008480
mov rdx, qword [rax + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0xdd833843
call fcn.1400063b0
lea rbx, [0x14000a32a]
mov rcx, rbx
call rax
mov rdi, qword [rsi + 0x18]
mov r15, qword [rsi + 8]
mov rsi, qword [rsi + 0x10]
mov byte [rsp + 0x2f], 0x69
movzx eax, byte [rsp + 0x2f]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140008526
cmp r8w, r9w
je 0x140008574
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rbx]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140008520
add rdx, 2
cmp r8w, r9w
je 0x140008530
jmp 0x140008520
mov rdx, qword [rax + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov r8d, 0x139b9c0f
call fcn.1400063b0
mov r8d, dword [rsi]
mov rdx, qword [r15]
mov rcx, qword [r14 + 0x28]
mov r9, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp rax

Function at 0x14000db30
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov rcx, rdx
mov rdx, r8
call fcn.140009cce
mov r8, qword [rsi + 0x10]
sub r8, rdi
cmp r8, rbx
cmovae r8, rbx
cmp qword [rsi + 0x18], 0x10
jb 0x14000db68
mov rsi, qword [rsi]
add rsi, rdi
mov rcx, r14
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140003972
Function at 0x14000e6e4
Capabilities:
Write file on windows

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14000e6e4
push rsi
sub rsp, 0x130
mov eax, 0xffffffff
cmp r8, rax
cmovae r8, rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000e75f
lea rdx, [rsp + 0x30]
or dword [rdx], 0xffffffff
lea r8, str.bytes_written___static_cast_DWORD___1_
lea rcx, [rsp + 0x2c]
call fcn.14000e76f
test rax, rax
je 0x14000e759
mov qword [rsp + 0x20], rax
lea rdx, str.crashpad::FileOperationResult___cdecl_crashpad::internal::NativeWriteFile_crashpad::FileHandle__const_void___size_t_
lea r8, str..._.._.._third_party_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r9d, 0x65
call fcn.14004b9a2
mov rcx, rsi
call fcn.14004ba62
mov eax, dword [rsp + 0x2c]
jmp 0x14000e766
mov rax, 0xffffffffffffffff
add rsp, 0x130
pop rsi
ret

Function at 0x14000e77c
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov r15, rdx
mov rdi, rcx
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000e848
lea r14, str.bytes_read___static_cast_DWORD___1_
lea r12, [rsp + 0x34]
lea rsi, [rsp + 0x38]
mov r13, qword [sym.imp.KERNEL32.dll_GetFileType]
mov rbp, qword [sym.imp.KERNEL32.dll_ReadFile]
or dword [rsp + 0x38], 0xffffffff
mov rcx, r12
mov rdx, rsi
mov r8, r14
call fcn.14000e76f
test rax, rax
je 0x14000e81d
mov qword [rsp + 0x20], rax
mov rcx, rsi
lea rdx, str.crashpad::FileOperationResult___cdecl_crashpad::ReadFile_crashpad::FileHandle__void___size_t_
lea r8, str..._.._.._third_party_crashpad_util_file_file_io_win.cc
mov r9d, 0x7e
call fcn.14004b9a2
mov rcx, rsi
call fcn.14004ba62
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x14000e861
mov rcx, rdi
call r13
cmp eax, 3
jne 0x14000e85d
and qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r15
mov r8d, ebx
mov r9, r12
call rbp
test eax, eax
jne 0x14000e7dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
setne al
neg rax
jmp 0x14000e863
mov eax, dword [rsp + 0x34]
mov eax, eax
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000ef47
Capabilities:
Clear file content

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x140
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov rdi, rcx
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.14000ee7c
test rax, rax
jne 0x14000efd8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x14000efd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingTruncateFile_crashpad::FileHandle_
lea r8, str..._.._.._third_party_crashpad_util_file_file_io_win.cc
lea rdi, [rbp - 0x50]
mov rcx, rdi
mov r9d, 0xfb
call fcn.14004b54e
mov dword [rdi + 0x100], esi
lea rdx, [0x14009746e]
mov rcx, rdi
call fcn.140002bc9
lea rcx, [rbp - 0x50]
call fcn.14004bba4
xor esi, esi
mov eax, esi
add rsp, 0x140
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f63c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], 0xfffffffffffffffe
mov ebx, edx
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14000f669
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000f691
test bl, bl
jne 0x14000f686
mov ecx, eax
and ecx, 0x400
jne 0x14000f728
and eax, 0x10
shr eax, 4
jmp 0x14000f72a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::IsDirectory_const_base::FilePath___bool_
lea r8, str..._.._.._third_party_crashpad_util_file_filesystem_win.cc
lea rbx, [rbp - 0x58]
mov rcx, rbx
mov r9d, 0x82
call fcn.14004b54e
mov dword [rbx + 0x100], edi
lea rdx, str.GetFileAttributes
mov rcx, rbx
call fcn.140002bc9
mov rdi, rax
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14000f6e6
mov rax, qword [rsi]
lea rdx, [rbp + 0xb0]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rcx, [rbp + 0xc0]
call fcn.14004c790
lea rdx, [rbp + 0xc0]
mov rcx, rdi
call fcn.140003113
lea rcx, [rbp + 0xc0]
call fcn.1400049ea
lea rcx, [rbp - 0x58]
call fcn.14004bba4
xor eax, eax
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f787
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x178
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], 0xfffffffffffffffe
mov ebx, r8d
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14000f7b5
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14000f914
test bl, bl
je 0x14000f87d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000f87d
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.14000f63c
test al, al
jne 0x14000f914
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingCreateDirectory_const_base::FilePath___crashpad::FilePermissions__bool_
lea r8, str..._.._.._third_party_crashpad_util_file_filesystem_win.cc
lea rcx, [rbp - 0x58]
push 0x5d
pop r9
call fcn.14004b54e
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14000f826
mov rax, qword [rsi]
lea rdx, [rbp + 0xb0]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rcx, [rbp + 0xd0]
call fcn.14004c790
lea rcx, [rbp - 0x58]
lea rdx, [rbp + 0xd0]
call fcn.140003113
lea rdx, [0x140095a8d]
mov rcx, rax
call fcn.140002bc9
lea rcx, [rbp + 0xd0]
call fcn.1400049ea
lea rcx, [rbp - 0x58]
call fcn.14004ba62
jmp 0x14000f912
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingCreateDirectory_const_base::FilePath___crashpad::FilePermissions__bool_
lea r8, str..._.._.._third_party_crashpad_util_file_filesystem_win.cc
lea rbx, [rbp - 0x58]
push 0x62
pop r9
mov rcx, rbx
call fcn.14004b54e
mov dword [rbx + 0x100], edi
lea rdx, str.CreateDirectory
mov rcx, rbx
call fcn.140002bc9
mov rdi, rax
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14000f8d0
mov rax, qword [rsi]
lea rdx, [rbp + 0xc0]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rcx, [rbp + 0xd0]
call fcn.14004c790
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call fcn.140003113
lea rcx, [rbp + 0xd0]
call fcn.1400049ea
lea rcx, [rbp - 0x58]
call fcn.14004bba4
xor edi, edi
mov eax, edi
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f9c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], 0xfffffffffffffffe
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14000f9ef
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000fa06
test ax, 0x410
sete al
jmp 0x14000fa9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::IsRegularFile_const_base::FilePath__
lea r8, str..._.._.._third_party_crashpad_util_file_filesystem_win.cc
lea rbx, [rbp - 0x58]
push 0x75
pop r9
mov rcx, rbx
call fcn.14004b54e
mov dword [rbx + 0x100], edi
lea rdx, str.GetFileAttributes
mov rcx, rbx
call fcn.140002bc9
mov rdi, rax
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14000fa59
mov rax, qword [rsi]
lea rdx, [rbp + 0xb0]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rcx, [rbp + 0xc0]
call fcn.14004c790
lea rdx, [rbp + 0xc0]
mov rcx, rdi
call fcn.140003113
lea rcx, [rbp + 0xc0]
call fcn.1400049ea
lea rcx, [rbp - 0x58]
call fcn.14004bba4
xor eax, eax
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000fafa
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], 0xfffffffffffffffe
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14000fb25
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000fb4f
and eax, 0x410
cmp eax, 0x410
jne 0x14000fb4f
mov rcx, rsi
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
jmp fcn.14000fc64
cmp qword [rsi + 0x18], 8
mov rcx, rsi
jb 0x14000fb5c
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, eax
mov al, 1
test ecx, ecx
jne 0x14000fc07
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingRemoveFile_const_base::FilePath__
lea r8, str..._.._.._third_party_crashpad_util_file_filesystem_win.cc
lea rbx, [rbp - 0x58]
mov rcx, rbx
mov r9d, 0x95
call fcn.14004b54e
mov dword [rbx + 0x100], edi
lea rdx, str.DeleteFile
mov rcx, rbx
call fcn.140002bc9
mov rdi, rax
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14000fbc3
mov rax, qword [rsi]
lea rdx, [rbp + 0xb0]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rcx, [rbp + 0xc0]
call fcn.14004c790
lea rdx, [rbp + 0xc0]
mov rcx, rdi
call fcn.140003113
lea rcx, [rbp + 0xc0]
call fcn.1400049ea
lea rcx, [rbp - 0x58]
call fcn.14004bba4
xor eax, eax
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000fc64
Capabilities:
Delete directory

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe8], 0xfffffffffffffffe
mov rdi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14000fc91
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x14000fd38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::LoggingRemoveDirectoryImpl_const_base::FilePath__
lea r8, str..._.._.._third_party_crashpad_util_file_filesystem_win.cc
lea rbx, [rbp - 0x50]
push 0x30
pop r9
mov rcx, rbx
call fcn.14004b54e
mov dword [rbx + 0x100], r14d
lea rdx, str.RemoveDirectory
mov rcx, rbx
call fcn.140002bc9
mov rbx, rax
cmp qword [rdi + 0x18], 8
mov rax, rdi
jb 0x14000fcf6
mov rax, qword [rdi]
lea rdx, [rbp + 0xb8]
mov qword [rdx], rax
mov rax, qword [rdi + 0x10]
mov qword [rdx + 8], rax
lea rcx, [rbp + 0xc8]
call fcn.14004c790
lea rdx, [rbp + 0xc8]
mov rcx, rbx
call fcn.140003113
lea rcx, [rbp + 0xc8]
call fcn.1400049ea
lea rcx, [rbp - 0x50]
call fcn.14004bba4
test esi, esi
setne al
add rsp, 0x170
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x140010e64
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x140
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov rsi, rcx
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x140010f48]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
jne 0x140010f16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x20], 4
lea rdx, str.void___cdecl_crashpad::Thread::Start_void_
lea r8, str..._.._.._third_party_crashpad_util_thread_thread_win.cc
lea rdi, [rbp - 0x50]
push 0x1b
pop r9
mov rcx, rdi
call fcn.14004b54e
mov dword [rdi + 0x100], esi
lea rdx, str.Check_failed:_platform_thread_
mov rcx, rdi
call fcn.140002bc9
lea rdx, [0x14009fc16]
mov rcx, rax
call fcn.140002bc9
lea rdx, [0x1400979bb]
mov rcx, rax
call fcn.140002bc9
lea rcx, [rbp - 0x50]
call fcn.14004bba4
nop
add rsp, 0x140
pop rdi
pop rsi
pop rbp
ret
Function at 0x140011738
Capabilities:
Check os version

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb0], 0xfffffffffffffffe
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x14001180d
and eax, 0xfeff
cmp eax, 6
je 0x14001180d
mov eax, dword [0x1400c4f58]
mov ecx, dword [0x1400c3824]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140011824
mov rcx, rsi
xor edx, edx
mov r8d, 0x10000000
call qword [0x1400c4f50]
mov esi, eax
test eax, eax
jne 0x140011806
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::CrashpadInitializeCriticalSectionEx_CRITICAL_SECTION___DWORD__DWORD_
lea r8, str..._.._.._third_party_crashpad_util_win_critical_section_with_debug_info.cc
lea rbx, [rbp - 0x58]
push 0x21
pop r9
mov rcx, rbx
call fcn.14004b54e
mov dword [rbx + 0x100], edi
lea rdx, [0x140095b61]
mov rcx, rbx
call fcn.140002bc9
lea rcx, [rbp - 0x58]
call fcn.14004bba4
test esi, esi
setne al
jmp 0x140011818
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, 1
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1400c4f58]
call fcn.140052d98
cmp dword [0x1400c4f58], 0xffffffff
jne 0x1400117a3
lea rcx, [0x1400a05ca]
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call fcn.140013c90
mov qword [0x1400c4f50], rax
lea rcx, [0x1400c4f58]
call fcn.140052e30
jmp 0x1400117a3

Function at 0x140013499
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x140018521
Capabilities:
Check os version
Create pipe

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
test dl, dl
je 0x14001856e
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
mov edi, 0x80003
cmp eax, 6
jb 0x140018573
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
mov dword [rbx], 0x18
xor ecx, ecx
call fcn.1400185b6
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x140018575
mov edi, 3
xor ebx, ebx
cmp qword [rsi + 0x18], 8
jb 0x14001857f
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
and dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x14001bdde
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], 0xfffffffffffffffe
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001be09
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, eax
mov al, 1
test ecx, ecx
jne 0x14001bed6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14001be3d
mov rcx, rsi
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
jmp fcn.14001bf33
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::CreateDirectoryIfNecessary_const_base::FilePath__
lea r8, str..._.._.._third_party_crashpad_client_crash_report_database_win.cc
lea rbx, [rbp - 0x58]
mov rcx, rbx
mov r9d, 0x266
call fcn.14004b54e
mov dword [rbx + 0x100], edi
lea rdx, str.CreateDirectory
mov rcx, rbx
call fcn.140002bc9
mov rdi, rax
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14001be92
mov rax, qword [rsi]
lea rdx, [rbp + 0xb0]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rcx, [rbp + 0xc0]
call fcn.14004c790
lea rdx, [rbp + 0xc0]
mov rcx, rdi
call fcn.140003113
lea rcx, [rbp + 0xc0]
call fcn.1400049ea
lea rcx, [rbp - 0x58]
call fcn.14004bba4
xor eax, eax
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
ret