joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400203a0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.14001a140
xor ebx, ebx
cmp qword [0x1400292f0], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x1400204cc
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x1400205df
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400205df
mov rcx, rax
call fcn.14001a070
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400292f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14001a070
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400292f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14001a070
lea rcx, [rsp + 0x98]
mov qword [0x140029300], rax
call fcn.14001b510
test eax, eax
je 0x14002047f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140018ec0
cmp dword [rsp + 0x98], 2
jne 0x1400204cc
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14001a070
test rax, rax
mov qword [0x140029310], rax
je 0x1400204cc
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14001a070
mov qword [0x140029308], rax
mov rcx, qword [0x140029308]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x140020578
cmp qword [0x140029310], rbp
je 0x140020578
call fcn.14001a230
mov rcx, qword [0x140029310]
mov rsi, rax
call fcn.14001a230
test rsi, rsi
mov r12, rax
je 0x140020578
test rax, rax
je 0x140020578
call rsi
test rax, rax
je 0x140020543
lea rcx, [rsp + 0x34]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140020543
test byte [rsp + 0x40], 1
jne 0x140020578
lea rcx, [rsp + 0x30]
call fcn.14001b560
test eax, eax
je 0x140020565
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140018ec0
cmp dword [rsp + 0x30], 4
jb 0x140020572
bts edi, 0x15
jmp 0x1400205b6
bts edi, 0x12
jmp 0x1400205b6
mov rcx, qword [0x1400292f8]
cmp rcx, rbp
je 0x1400205b6
call fcn.14001a230
test rax, rax
je 0x1400205b6
call rax
test rax, rax
mov rbx, rax
je 0x1400205b6
mov rcx, qword [0x140029300]
cmp rcx, rbp
je 0x1400205b6
call fcn.14001a230
test rax, rax
je 0x1400205b6
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400292f0]
call fcn.14001a230
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x1400205df
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400205e1
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001960
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [0x140005730]
mov byte [rsp + 0x20], socket
mov ecx, dword [rax + 0x96814]
mov eax, ecx
and eax, 0xffffff3f
mov edx, eax
or edx, 0x40
bt ecx, 0xa
cmovae edx, eax
movzx eax, dl
or al, 0x80
movzx r8d, al
bt edx, 0xb
movzx eax, dl
cmovae r8d, eax
movzx eax, byte [0x140005659]
mov byte [rsp + 0x21], r8b
cmp r8b, al
jne 0x1400019c5
cmp al, byte [0x140005658]
je 0x1400019eb
mov rcx, qword [0x1400056b0]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov byte [0x140005659], r8b
mov byte [0x140005658], al
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001c80
add rsp, 0x38
ret

Function at 0x140001a80
Capabilities:
Execute command
Initialize winsock library
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x340
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x330], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r8d, dword [rsp + 0x34]
mov r9d, 0x1e0
mov edx, dword [rsp + 0x30]
mov rcx, rbx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x113
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, str.Enter_DuckStation_PID:
call fcn.140001080
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x1e0]
lea rcx, [0x14000335c]
call fcn.1400010e0
lea r9, [rsp + 0x1e0]
mov edx, 0x64
lea r8, str.duckstation__s
lea rcx, [rsp + 0x1f0]
call fcn.140001140
lea r9, [rsp + 0x1f0]
mov edx, 0x64
lea r8, [0x140003420]
lea rcx, [rsp + 0x260]
call fcn.140001020
xor edx, edx
lea r8, [rsp + 0x260]
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
xor r9d, r9d
mov qword [rsp + 0x20], 0x800000
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x140005730], rax
test rax, rax
jne 0x140001ba8
lea rcx, str.Error:_Failed_to_open_DuckStation_nTry_again_n
call fcn.140001080
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140003458]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call main
mov ecx, 0x202
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140001bee
mov rax, qword [0x140005730]
lea rbx, [0x140003490]
add rax, 0xc000
mov qword [0x140005728], rax
movsxd rcx, dword [rax]
inc dword [rax + 0x20]
call qword [rbx + rcx*8]
call 0x140001c30
mov rax, qword [0x140005728]
jmp 0x140001bd7
mov edx, eax
lea rcx, str.WSAStartup_failed_with_error:__d_n
call fcn.140001080
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.140001c80
add rsp, 0x340
pop rbx
ret
Function at 0x14000c997
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140019110]
jne 0x14000a7ca
rol rcx, 0x10
test cx, 0xffff
jne 0x14000a7c6
repz ret
ror rcx, 0x10
jmp 0x14000c8f0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14001a7e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14001a8d8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000c975
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14001a7e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000c997
mov rax, qword [rsp + 0x88]
mov qword [0x14001a8d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14001a878], rax
mov rax, qword [0x14001a8d8]
mov qword [0x14001a750], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14001a860], rax
mov dword [0x14001a740], 0xc0000409
mov dword [0x14001a744], 1
mov rax, qword [0x140019110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140019118]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14001a7d8], eax
mov ecx, 1
call fcn.14000f0d4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400126f8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14001a7d8], 0
jne 0x14000ca1e
mov ecx, 1
call fcn.14000f0d4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14000cf64
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000cdd4
Function at 0x14000f4f8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140019110]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000afcc
xor ebx, ebx
cmp qword [0x14001b868], rbx
mov rdi, rax
jne 0x14000f60b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000f6e2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000f6e2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14001b868], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14001b870], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14001b878], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14001b888], rax
test rax, rax
je 0x14000f602
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14001b880], rax
jmp 0x14000f612
mov rax, qword [0x14001b880]
jmp 0x14000f619
mov rax, qword [0x14001b880]
mov r11, qword [0x14001b888]
cmp rax, rdi
je 0x14000f680
cmp r11, rdi
je 0x14000f680
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14001b888]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14000f680
test rax, rax
je 0x14000f680
call rsi
test rax, rax
je 0x14000f67a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000f67a
test byte [rsp + 0x40], 1
jne 0x14000f680
bts ebp, 0x15
jmp 0x14000f6c0
mov rcx, qword [0x14001b870]
cmp rcx, rdi
je 0x14000f6c0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000f6c0
call rax
mov rbx, rax
test rax, rax
je 0x14000f6c0
mov rcx, qword [0x14001b878]
cmp rcx, rdi
je 0x14000f6c0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000f6c0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14001b868]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000f6e2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14000f6e4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000a7b0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000a1af
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0xd8
mov qword [rsp + 0x98], 0x5f5e100
mov byte [rsp + 0x30], 0x2a
mov byte [rsp + 0x31], 0x71
mov byte [rsp + 0x32], 0x5f
mov byte [rsp + 0x33], 0x49
mov byte [rsp + 0x34], 0x4c
mov byte [rsp + 0x35], 0x25
mov byte [rsp + 0x36], 0x3c
mov byte [rsp + 0x37], 0x6f
mov byte [rsp + 0x38], 0x6e
mov byte [rsp + 0x39], 0x3f
and al, 0x39
invalid
mov byte [rsp + 0x3a], 0x6a
mov byte [rsp + 0x3b], 0x78
mov byte [rsp + 0x3c], 0x4f
mov byte [rsp + 0x3d], 0x31
mov byte [rsp + 0x3e], 0x47
mov byte [rsp + 0x3f], 0x48
mov byte [rsp + 0x40], 0x2b
mov byte [rsp + 0x41], 0x44
mov byte [rsp + 0x42], 0x30
mov byte [rsp + 0x43], 0x4b
mov byte [rsp + 0x44], 0x36
mov byte [rsp + 0x45], 0x59
mov byte [rsp + 0x46], 0x49
mov byte [rsp + 0x47], 0x53
mov byte [rsp + 0x48], 0x37
mov byte [rsp + 0x49], 0x67
mov byte [rsp + 0x4a], 0x4d
mov byte [rsp + 0x4b], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x78], 0
mov dword [rsp + 0xc0], 0
movabs rax, 0x13ffe8960
mov qword [rsp + 0x60], rax
movabs rax, section..text
add dword [rax], eax
add byte [rax], al

Function at 0x14000a1b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xd8
mov qword [rsp + 0x98], 0x5f5e100
mov byte [rsp + 0x30], 0x2a
mov byte [rsp + 0x31], 0x71
mov byte [rsp + 0x32], 0x5f
mov byte [rsp + 0x33], 0x49
mov byte [rsp + 0x34], 0x4c
mov byte [rsp + 0x35], 0x25
mov byte [rsp + 0x36], 0x3c
mov byte [rsp + 0x37], 0x6f
mov byte [rsp + 0x38], 0x6e
mov byte [rsp + 0x39], 0x3f
and al, 0x39
invalid
mov byte [rsp + 0x3a], 0x6a
mov byte [rsp + 0x3b], 0x78
mov byte [rsp + 0x3c], 0x4f
mov byte [rsp + 0x3d], 0x31
mov byte [rsp + 0x3e], 0x47
mov byte [rsp + 0x3f], 0x48
mov byte [rsp + 0x40], 0x2b
mov byte [rsp + 0x41], 0x44
mov byte [rsp + 0x42], 0x30
mov byte [rsp + 0x43], 0x4b
mov byte [rsp + 0x44], 0x36
mov byte [rsp + 0x45], 0x59
mov byte [rsp + 0x46], 0x49
mov byte [rsp + 0x47], 0x53
mov byte [rsp + 0x48], 0x37
mov byte [rsp + 0x49], 0x67
mov byte [rsp + 0x4a], 0x4d
mov byte [rsp + 0x4b], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x78], 0
mov dword [rsp + 0xc0], 0
movabs rax, 0x13ffe8960
mov qword [rsp + 0x60], rax
movabs rax, section..text
add dword [rax], eax
add byte [rax], al
Function at 0x14007fdb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebp, edx
mov rsi, qword [rcx + 0x58]
mov rbx, qword [rcx + 0x50]
cmp rbx, rsi
je 0x14007fe2b
cmp dword [rbx + 0x78], ebp
jne 0x14007fe22
cmp qword [rbx + 0x28], 7
lea rcx, [rbx + 0x10]
jbe 0x14007fde9
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007fe22
test al, 0x10
jne 0x14007fe22
mov rax, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x14007fe14
mov rdx, rbx
mov rcx, rax
call fcn.14007e630
add qword [rdi + 8], 0x78
jmp 0x14007fe22
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.14007dea0
sub rbx, 0xffffffffffffff80
cmp rbx, rsi
jne 0x14007fdd6
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14007fe50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
movups xmm0, xmmword [rdx]
mov rdi, qword [rcx + 0x58]
mov r14, r9
mov rbx, qword [rcx + 0x50]
mov ebp, r8d
movaps xmmword [rsp + 0x20], xmm0
mov rsi, rcx
cmp rbx, rdi
je 0x14007feaa
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14003ce50
test al, al
jne 0x14007feaa
sub rbx, 0xffffffffffffff80
cmp rbx, rdi
jne 0x14007fe90
cmp rbx, qword [rsi + 0x58]
jne 0x14007feb7
mov eax, 1
jmp 0x14007ff03
mov eax, dword [rbx + 0x78]
cmp eax, ebp
jne 0x14007fee7
cmp qword [rbx + 0x28], 7
lea rcx, [rbx + 0x10]
jbe 0x14007fecc
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov edx, 1
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
cmove ecx, edx
jmp 0x14007fef6
mov ecx, 1
mov edx, 4
cmp eax, ecx
cmove ecx, edx
test ecx, ecx
jne 0x14007ff01
mov byte [rsi + 0x48], 1
mov qword [r14], rbx
mov eax, ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400805f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rbp, rdx
lea rdx, [rsp + 0x68]
call fcn.14007eb80
nop
mov rbx, qword [rsp + 0x68]
test rbx, rbx
jne 0x140080627
mov ebx, 3
jmp 0x1400806a6
mov rsi, qword [rbx + 0x58]
mov rdi, qword [rbx + 0x50]
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x20], xmm0
cmp rdi, rsi
je 0x14008065a
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14003ce50
test al, al
jne 0x14008065a
sub rdi, 0xffffffffffffff80
cmp rdi, rsi
jne 0x140080640
cmp rdi, qword [rbx + 0x58]
jne 0x140080667
mov ebx, 1
jmp 0x1400806a6
lea rcx, [rdi + 0x10]
cmp qword [rcx + 0x18], 7
jbe 0x140080675
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140080689
mov ebx, 1
jmp 0x140080691
shr ebx, 3
and ebx, 2
je 0x140080696
mov rdi, qword [rsp + 0x68]
test ebx, ebx
jne 0x1400806a6
mov rdx, rdi
mov rcx, r14
call fcn.14007ea70
nop
lea rcx, [rsp + 0x68]
call fcn.14007e890
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14008b630
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x1c0
mov rax, qword [0x1400c9040]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 7
jbe 0x14008b660
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14008b76a
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14008b67c
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14004cd30
mov rbx, rax
mov dword [rsp + 0x30], 2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x75
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::IsRegularFile_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.14004b920
nop
mov dword [rsp + 0x30], 6
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.1400012e0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14008b707
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140002610
nop
lea rcx, [rsp + 0x50]
call fcn.14004bbf0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0xf
jbe 0x14008b804
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008b760
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008b81f
call fcn.1400551e8
jmp 0x14008b804
test eax, 0x410
jne 0x14008b804
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14008b782
mov rcx, qword [rbx]
lea rdx, [rsp + 0x178]
call fcn.14008d480
test eax, eax
jne 0x14008b79d
mov rax, qword [rsp + 0x190]
jmp 0x14008b806
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0xac
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.unsigned___int64___cdecl_crashpad::GetFileSize_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.14004b920
nop
mov dword [rsp + 0x30], 1
lea rdx, str.stat
mov rcx, rax
call fcn.1400012e0
cmp qword [rbx + 0x18], 7
jbe 0x14008b7ee
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140004490
nop
lea rcx, [rsp + 0x50]
call fcn.14004bbf0
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140055420
add rsp, 0x1c0
pop rbx
ret
call fcn.14005bf54
int3
Function at 0x14008b9b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1400c9040]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 7
jbe 0x14008b9e0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14008bae1
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14008b9fc
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14004cd30
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x75
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::IsRegularFile_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.14004b920
nop
mov dword [rsp + 0x30], 3
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.1400012e0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14008ba87
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140002610
nop
lea rcx, [rsp + 0x50]
call fcn.14004bbf0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0xf
jbe 0x14008badd
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008bad8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008bb02
call fcn.1400551e8
xor al, al
jmp 0x14008bae9
test eax, 0x410
sete al
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140055420
add rsp, 0x180
pop rbx
ret
call fcn.14005bf54
int3
Function at 0x14008c200
Capabilities:
Check if file exists
Delete file

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1400c9040]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 7
jbe 0x14008c230
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14008c254
and eax, 0x410
cmp eax, 0x410
jne 0x14008c254
mov rcx, rbx
call fcn.14008c0a0
jmp 0x14008c363
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14008c261
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14008c361
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14008c27c
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.14004cd30
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x95
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::LoggingRemoveFile_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.14004b920
nop
mov dword [rsp + 0x30], 3
lea rdx, str.DeleteFile
mov rcx, rax
call fcn.1400012e0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14008c307
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140002610
nop
lea rcx, [rsp + 0x50]
call fcn.14004bbf0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0xf
jbe 0x14008c35d
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008c358
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008c37c
call fcn.1400551e8
xor al, al
jmp 0x14008c363
mov al, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140055420
add rsp, 0x180
pop rbx
ret
call fcn.14005bf54
int3