joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017c90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140017e6f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140015b90
mov rcx, qword [rsi + 8]
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140017e34
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140017dac
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140017e23
mov rax, qword [r11 + 8]
mov r8, qword [rcx + 0x10]
cmp r8, qword [rax + 0x10]
jne 0x140017de9
mov r8, qword [rax]
cmp r8, rcx
je 0x140017de3
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140017e23
cmp r9, rax
je 0x140017dff
nop
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
je 0x140017e49
cmp r9, rax
jne 0x140017df0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140017d30
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140017e23
lea rcx, str.invalid_hash_bucket_count
call fcn.14008c1c4
int3
Function at 0x14001a510
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140100258]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x58], rdi
mov rax, r8
mov qword [rdx], rbx
mov qword [rdx + 0x10], rbx
mov r14, rdx
mov qword [rsp + 0x20], rbx
mov r13, rcx
mov qword [rsp + 0x30], rbx
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x50], r12
mov qword [rdx + 0x18], 0xf
mov qword [rsp + 0x38], 0xf
nop word [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001a570
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000eff0
mov r15, qword [rsp + 0x38]
lea rcx, [rsp + 0x20]
mov rsi, qword [rsp + 0x20]
cmp r15, 0x10
mov rdi, qword [rsp + 0x30]
movabs rdx, 0xcbf29ce484222325
mov r8, qword [r13]
cmovae rcx, rsi
test rdi, rdi
je 0x14001a5d3
movabs r9, 0x100000001b3
nop
movzx eax, byte [rbx + rcx]
inc rbx
xor rdx, rax
imul rdx, r9
cmp rbx, rdi
jb 0x14001a5c0
mov rcx, qword [r8 + 0x68]
mov rax, qword [r8 + 0x50]
and rcx, rdx
mov r12, qword [r8 + 0x40]
add rcx, rcx
mov qword [rsp + 0x90], rbp
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, r12
je 0x14001a63e
mov rbp, qword [rax + rcx*8]
nop dword [rax + rax]
cmp qword [rbx + 0x28], 0x10
lea rdx, [rbx + 0x10]
jb 0x14001a60f
mov rdx, qword [rbx + 0x10]
cmp r15, 0x10
lea rcx, [rsp + 0x20]
cmovae rcx, rsi
cmp rdi, qword [rbx + 0x20]
jne 0x14001a62e
mov r8, rdi
call fcn.14008f8b0
test eax, eax
je 0x14001a639
cmp rbx, rbp
je 0x14001a63e
mov rbx, qword [rbx + 8]
jmp 0x14001a600
test rbx, rbx
jne 0x14001a641
mov rbx, r12
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x90]
cmp r15, 0x10
jb 0x14001a686
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14001a67e
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a6cf
mov rcx, rsi
call fcn.14008df80
mov rax, qword [r13]
cmp rbx, qword [rax + 0x40]
je 0x14001a6b2
lea r8, [rbx + 0x30]
cmp r14, r8
je 0x14001a6b2
cmp qword [r8 + 0x18], 0x10
mov rdx, r8
jb 0x14001a6a6
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
mov rcx, r14
call fcn.14000eff0
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008e050
add rsp, 0x60
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret
call fcn.14009464c
int3
Function at 0x14001ab30
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x140100258]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor esi, esi
mov qword [rsp + 0x38], 7
mov rbx, rdx
mov qword [rcx], rsi
mov rdi, rcx
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
lea rdx, [0x1400c94b0]
lea r8d, [rsi + 1]
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rsi
call fcn.1400225c0
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x40]
call fcn.140026e60
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001abe7
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001abe2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ad42
call fcn.14008df80
cmp qword [rsp + 0x58], 8
lea rcx, [rsp + 0x40]
lea rdx, [rbp - 0x80]
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001acf1
nop
cmp word [rbp - 0x54], 0x2e
je 0x14001acdc
test byte [rbp - 0x80], 0x10
jne 0x14001acdc
mov qword [rsp + 0x20], rsi
lea rax, [rbp - 0x54]
mov qword [rsp + 0x30], rsi
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], 7
inc r8
cmp word [rax + r8*2], si
jne 0x14001ac43
lea rdx, [rbp - 0x54]
lea rcx, [rsp + 0x20]
call fcn.1400225c0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140026d00
mov r8, rax
mov rax, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x14001ac89
mov rdx, r8
mov rcx, rax
call fcn.140026ce0
add qword [rdi + 8], 0x20
jmp 0x14001ac94
mov rdx, rax
mov rcx, rdi
call fcn.140008780
lea rcx, [rsp + 0x60]
call fcn.140026dd0
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001acdc
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001acd7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ad48
call fcn.14008df80
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001ac10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdx, qword [rdi + 8]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, rdx
sub r8, rcx
sar r8, 5
call fcn.140019930
lea rcx, [rsp + 0x40]
call fcn.140026dd0
mov rax, rdi
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14008e050
mov rbx, qword [rsp + 0x310]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbp
ret
call fcn.14009464c
int3
call fcn.14009464c
int3
Function at 0x1400226f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400227ba
mov rax, qword [rsi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14002272a
mov rdx, qword [rsi + 8]
mov rcx, rsi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rsi
jmp fcn.140015fe0
mov qword [rsp + 0x38], rbp
xor ebp, ebp
mov qword [rsp + 0x40], rdi
mov rdi, qword [rsi + 8]
mov rax, qword [rdi + 8]
mov qword [rax], rbp
mov rdi, qword [rdi]
test rdi, rdi
je 0x140022776
mov qword [rsp + 0x30], rbx
nop
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.140014170
mov edx, 0x50
mov rcx, rdi
call fcn.14008df80
mov rdi, rbx
test rbx, rbx
jne 0x140022750
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsi + 8]
mov qword [rax], rax
mov rax, qword [rsi + 8]
mov qword [rax + 8], rax
mov qword [rsi + 0x10], rbp
mov rdi, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x20]
sub rcx, rdi
add rcx, 7
shr rcx, 3
cmp rdi, qword [rsi + 0x20]
cmova rcx, rbp
mov rbp, qword [rsp + 0x38]
test rcx, rcx
je 0x1400227b5
mov rax, qword [rsi + 8]
rep stosq qword [rdi], rax
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x1400233f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
cmp qword [r8 + 0x18], 0x10
mov rbx, rdx
mov rbp, qword [rcx]
mov rdx, r8
mov rdi, r8
jb 0x140023412
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x140023444
movabs r10, 0x100000001b3
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x140023431
mov r8, rdi
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x38]
call fcn.140012e30
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x140023462
mov rdx, qword [rbp + 0x40]
cmp rdx, qword [rbp + 0x40]
je 0x140023476
add rdx, 0x30
mov rcx, rbx
call fcn.140009b60
jmp 0x14002348d
mov qword [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], 0
mov rcx, rdi
call fcn.14000a100
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002ef60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x140100258]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 8
movzx edi, dl
mov rbx, rcx
jb 0x14002ef8f
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002f07d
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14002efab
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140026c00
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._util_file_filesystem_win.cc
mov r9d, 0x82
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::IsDirectory_const_class_base::FilePath__bool_
lea rcx, [rsp + 0x40]
call fcn.140028500
mov rcx, rax
lea rdx, str.GetFileAttributes
call fcn.140007ed0
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14002f024
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.1400089f0
lea rcx, [rsp + 0x40]
call fcn.140028830
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x14002f088
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f074
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f0b2
call fcn.14008df80
xor al, al
jmp 0x14002f091
test dil, dil
jne 0x14002f08c
bt eax, 0xa
jae 0x14002f08c
xor al, al
jmp 0x14002f091
shr eax, 4
and al, 1
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14008e050
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rdi
ret
call fcn.14009464c
int3
Function at 0x14002f0c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140100258]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x14002f0e8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002f1ed
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14002f104
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140026c00
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._util_file_filesystem_win.cc
mov r9d, 0x75
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::IsRegularFile_const_class_base::FilePath__
lea rcx, [rsp + 0x40]
call fcn.140028500
mov rcx, rax
lea rdx, str.GetFileAttributes
call fcn.140007ed0
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14002f17d
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.1400089f0
lea rcx, [rsp + 0x40]
call fcn.140028830
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x14002f1d2
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f1cd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f1f8
call fcn.14008df80
xor al, al
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14008e050
add rsp, 0x170
pop rbx
ret
test eax, 0x410
jne 0x14002f1d2
mov al, 1
jmp 0x14002f1d4
call fcn.14009464c
int3
Function at 0x14002f200
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x140100258]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 8
movzx edi, r8b
mov rbx, rcx
jb 0x14002f230
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14002f429
test dil, dil
je 0x14002f34a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14002f34a
mov dl, 1
mov rcx, rbx
call fcn.14002ef60
test al, al
jne 0x14002f429
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14002f279
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140026c00
mov r9d, 0x5d
mov dword [rsp + 0x20], 2
lea r8, str..._.._.._util_file_filesystem_win.cc
mov rbx, rax
lea rdx, str.bool___cdecl_crashpad::LoggingCreateDirectory_const_class_base::FilePath__enum_crashpad::FilePermissions_bool_
lea rcx, [rsp + 0x40]
call fcn.140028380
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14002f2da
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.1400089f0
lea rdx, str._not_a_directory
mov rcx, rax
call fcn.140007ed0
lea rcx, [rsp + 0x40]
call fcn.140028580
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x14002f425
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f420
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f452
jmp 0x14002f420
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14002f357
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140026c00
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._util_file_filesystem_win.cc
mov r9d, 0x62
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingCreateDirectory_const_class_base::FilePath__enum_crashpad::FilePermissions_bool_
lea rcx, [rsp + 0x40]
call fcn.140028500
mov rcx, rax
lea rdx, str.CreateDirectory
call fcn.140007ed0
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14002f3d0
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.1400089f0
lea rcx, [rsp + 0x40]
call fcn.140028830
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x14002f425
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f420
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f44c
call fcn.14008df80
xor al, al
jmp 0x14002f42b
mov al, 1
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14008e050
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rdi
ret
call fcn.14009464c
int3
call fcn.14009464c
int3
Function at 0x14002f6e0
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140100258]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x14002f708
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14002f7f5
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14002f723
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140026c00
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._util_file_filesystem_win.cc
mov r9d, 0x30
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::LoggingRemoveDirectoryImpl_const_class_base::FilePath__
lea rcx, [rsp + 0x40]
call fcn.140028500
mov rcx, rax
lea rdx, str.RemoveDirectory
call fcn.140007ed0
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14002f79c
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.1400089f0
lea rcx, [rsp + 0x40]
call fcn.140028830
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x14002f7f1
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f7ec
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f810
call fcn.14008df80
xor al, al
jmp 0x14002f7f7
mov al, 1
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14008e050
add rsp, 0x170
pop rbx
ret
call fcn.14009464c
int3
Function at 0x14002f820
Capabilities:
Check if file exists
Delete file

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140100258]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x14002f848
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002f86c
and eax, 0x410
cmp eax, 0x410
jne 0x14002f86c
mov rcx, rbx
call fcn.14002f6e0
jmp 0x14002f968
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14002f879
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002f966
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14002f894
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140026c00
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._util_file_filesystem_win.cc
mov r9d, 0x95
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingRemoveFile_const_class_base::FilePath__
lea rcx, [rsp + 0x40]
call fcn.140028500
mov rcx, rax
lea rdx, str.DeleteFile
call fcn.140007ed0
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14002f90d
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.1400089f0
lea rcx, [rsp + 0x40]
call fcn.140028830
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x14002f962
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f95d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f981
call fcn.14008df80
xor al, al
jmp 0x14002f968
mov al, 1
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14008e050
add rsp, 0x170
pop rbx
ret
call fcn.14009464c
int3

Function at 0x140031460
Capabilities:
Create process memory minidump

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rcx, rdx
call fcn.14002e880
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400314a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.failed_to_open_file___error_code__d
lea rcx, str.fulldmp
call fcn.14005df40
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov r9d, 0x69926
mov r8, rbx
mov edx, eax
mov rcx, rdi
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call sub.dbghelp.dll_MiniDumpWriteDump
test eax, eax
jne 0x140031501
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Fail_to_write_fulldmp__s._Errcode:__d
lea rcx, str.fulldmp
call fcn.14005df40
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
mov al, 1
add rsp, 0x40
pop rdi
ret
Function at 0x140032da0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x140
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140032e0d
call fcn.14003bcd0
test eax, eax
jns 0x140032e0d
cmp byte [rbx + 8], 0
je 0x140032dca
cmp eax, 0xc000010a
je 0x140032e0d
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._util_win_scoped_process_suspend.cc
mov r9d, 0x2a
mov dword [rsp + 0x20], 2
lea rdx, str.__cdecl_crashpad::ScopedProcessSuspend::ScopedProcessSuspend_void_
lea rcx, [rsp + 0x30]
call fcn.14003be70
mov rcx, rax
lea rdx, str.NtResumeProcess
call fcn.140007ed0
lea rcx, [rsp + 0x30]
call fcn.14003bea0
lea rdx, str.Resume_process
lea rcx, str.server
add rsp, 0x140
pop rbx
jmp fcn.14005df40
Function at 0x140038800
Capabilities:
Check os version

Disassembly:
sub rsp, 0x168
mov rax, qword [0x140100258]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140104188]
mov r8d, 0x80
mov rdx, qword [rax + rcx*8]
mov eax, dword [r8 + rdx]
cmp dword [0x140103770], eax
jg 0x140038a28
cmp byte [0x140103710], 0
je 0x14003886a
movzx eax, byte [0x140100034]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14008e050
add rsp, 0x168
ret
lea rcx, [0x140103720]
call fcn.14008cf80
test eax, eax
jne 0x140038a20
cmp byte [0x140103710], al
mov qword [rsp + 0x170], rbx
je 0x14003889a
movzx ebx, byte [0x140100034]
jmp 0x14003899e
lea rcx, str.ntdll.dll
mov qword [rsp + 0x178], rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x1400389cd
mov qword [rsp + 0x160], rdi
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
xor dil, dil
xor sil, sil
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400388fb
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x24]
call rax
movzx eax, word [rsp + 0x20]
mov dil, 1
mov dword [rsp + 0x20], eax
lea rdx, str.RtlGetVersion
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, 0xffffffffffffffff
mov rbx, rax
mov rdx, rcx
test rax, rax
je 0x140038949
xor edx, edx
mov dword [rsp + 0x30], 0x114
mov r8d, 0x110
lea rcx, [rsp + 0x34]
call fcn.14008f9b0
lea rcx, [rsp + 0x30]
call rbx
mov ecx, dword [rsp + 0x34]
mov sil, 1
mov edx, dword [rsp + 0x38]
test dil, dil
mov rdi, qword [rsp + 0x160]
je 0x14003896d
cmp dword [rsp + 0x24], 6
jb 0x140038a13
jne 0x140038988
cmp dword [rsp + 0x28], 3
jmp 0x140038a0d
test sil, sil
je 0x1400389cd
cmp rcx, 6
jl 0x140038a13
jne 0x140038988
cmp rdx, 3
jl 0x140038a13
movzx ebx, byte [0x140100034]
mov rsi, qword [rsp + 0x178]
mov byte [0x140103710], 1
lea rcx, [0x140103720]
call fcn.14008cf88
movzx eax, bl
mov rbx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14008e050
add rsp, 0x168
ret
cmp byte [0x140103710], 0
jne 0x140038988
xor edx, edx
mov dword [rsp + 0x30], 0x11c
mov r8d, 0x118
lea rcx, [rsp + 0x34]
call fcn.14008f9b0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140038988
cmp dword [rsp + 0x34], 6
jb 0x140038a13
jne 0x140038988
cmp dword [rsp + 0x38], 3
jae 0x140038988
xor bl, bl
mov byte [0x140100034], bl
jmp 0x14003898f
mov ecx, eax
call fcn.14008d2a4
int3
lea rcx, [0x140103770]
call fcn.14008e434
cmp dword [0x140103770], 0xffffffff
jne 0x140038842
mov edx, 2
lea rcx, [0x140103720]
call fcn.14008cf50
lea rcx, [0x1400c5940]
call fcn.14008eb04
lea rcx, [0x140103770]
call fcn.14008e3d4
jmp 0x140038842