joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b0a0
Capabilities:
Delete file
Get uefi variable

Disassembly:
sub esp, 0xc18
cmp dword [0x2b75b64], 0x37
jne 0x41b108
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0xc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
lea eax, [esp + 0x41c]
push eax
push 0x4035d8
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov ecx, dword [0x2b75f78]
mov eax, dword [0x2b75648]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
add esp, 0xc18
ret
Function at 0x415800
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x41bac0], ecx
add edx, 1
cmp edx, 0x100
jb 0x415802
cmp edx, 0x800
jae 0x4158eb
mov edi, edi
mov eax, dword [edx*4 + 0x41b6c0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x41bac0]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x41babc], eax
jb 0x4158c0
mov dword [0x41ba94], 0x415f40
call fcn.00415a30
test eax, eax
jne 0x415908
mov dword [0x41ba94], 0x415e60
ret

Function at 0x83977b
Capabilities:
Encode data using xor

Disassembly:
call fcn.00861064
pop esp
cli
sbb al, 0x16
mov eax, 0xcca8ae79
fsubr dword [ebx - 0x63]
sub dh, byte [ecx - 0x37]
std
adc eax, 0xf2b27d74
arpl word [ebp - 0x58], dx
pop esi
xor esi, edi
cmp bh, bl
mov dh, 0xbc
jne 0x839781
or byte [ebp - 0x79], dl
ljmp 0x2b8b
Function at 0x100012a3
Capabilities:
Check if file exists
Delete file

Disassembly:
jmp 0x1002e9d0
jmp fcn.1000224d

Function at 0x100021e4
Capabilities:
Query environment variable

Disassembly:
jmp 0x10011550
push edi
push 0x60
call sym.sentry.dll_sentry_malloc
mov edi, eax
add esp, 4
test edi, edi
jne 0x10011563
pop edi
ret
push esi
push 0x60
push 0
push edi
call sub.VCRUNTIME140.dll_memset
push str..sentry_native
call fcn.10001ac3
mov esi, dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
push str.SENTRY_DSN
mov dword [edi + 0x24], eax
call esi
push eax
push edi
call sym.sentry.dll_sentry_options_set_dsn
push str.SENTRY_DEBUG
call esi
add esp, 0x20
test eax, eax
je 0x100115cf
mov ecx, 0x100491c8
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100115c2
test dl, dl
je 0x100115be
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100115c2
add eax, 2
add ecx, 2
test dl, dl
jne 0x100115a2
xor eax, eax
jmp 0x100115c7
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100115cf
mov al, 1
jmp 0x100115d1
xor al, al
push str.sentry_http
mov byte [edi + 0x34], al
mov dword [edi + 0x2c], 0x10001a23
mov dword [edi + 0x30], 0
call fcn.10001a00
mov esi, dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
push str.SENTRY_RELEASE
mov dword [edi + 0x20], eax
call esi
push eax
call fcn.10002374
push str.SENTRY_ENVIRONMENT
mov dword [edi + 0xc], eax
call esi
push eax
call fcn.10002374
add esp, 0x14
mov dword [edi + 0x10], eax
mov dword [edi + 0x54], 0xffffffff
mov byte [edi + 0x35], 1
mov word [edi + 0x37], 0
call fcn.10002725
mov dword [edi + 0x50], eax
call fcn.10001ee2
movsd xmm0, qword [0x10048f78]
mov dword [edi + 0x44], eax
mov eax, edi
pop esi
movsd qword [edi], xmm0
mov dword [edi + 0x58], 1
pop edi
ret
Function at 0x100074d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push esi
push edi
call ebx
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push 2
push 0
push dword [ebp + 0x10]
mov dword [eax], 0
call esi
call ebx
push dword [ebp + 0x10]
mov edi, dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov dword [ebp - 4], eax
call ebx
push 0
push 0
push dword [ebp + 0x10]
or edi, dword [eax]
call esi
add esp, 0x1c
call ebx
mov eax, dword [eax]
or eax, edi
jne 0x100075df
mov ebx, dword [ebp - 4]
test ebx, ebx
js 0x100075df
jne 0x10007543
push 3
push dword [ebp + 8]
call fcn.10001096
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10007564
cmp ebx, eax
jbe 0x10007564
push 6
push dword [ebp + 8]
call fcn.10001096
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, dword [ebp + 0xc]
add esp, 4
mov dword [edi], eax
test eax, eax
jne 0x1000758d
push 7
push dword [ebp + 8]
call fcn.10001096
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
test ebx, ebx
jle 0x100075b5
push dword [ebp + 0x10]
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [edi]
add eax, esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x100075c1
add esi, eax
cmp esi, ebx
jl 0x10007593
mov dword [edi + 4], ebx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push dword [ebp + 8]
call fcn.10001096
push dword [edi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push dword [ebp + 8]
call fcn.10001096
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100119f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10057a58], 0
jne 0x10011a33
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10011a25
push str.SystemFunction036
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10057a54], eax
mov byte [0x10057a58], 1
jmp 0x10011a38
mov eax, dword [0x10057a54]
mov byte [0x10057a58], 1
jmp 0x10011a38
mov eax, dword [0x10057a54]
test eax, eax
je 0x10011a4c
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
test al, al
je 0x10011a4c
xor eax, eax
pop ebp
ret
mov eax, 1
pop ebp
ret
Function at 0x10018d90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10018dd6
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push eax
push esi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10018dc2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0x16
je 0x10018dca
cmp edi, esi
jb 0x10018dd1
add ebx, edi
sub esi, edi
mov eax, dword [ebp + 8]
test esi, esi
jne 0x10018da3
mov eax, dword [ebp + 8]
pop edi
pop ebx
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
add esp, 4
mov eax, esi
pop esi
pop ebp
ret

Function at 0x10018f20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10057034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10019057
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10019057
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10019056
mov ecx, dword [ebx + 0xa8]
test ecx, ecx
je 0x10019056
add ecx, eax
je 0x10019056
cmp dword [ecx + 0xc], 2
jne 0x10019056
mov ecx, dword [ecx + 0x14]
add ecx, eax
mov dword [ebp - 0x4c], ecx
je 0x10019056
cmp dword [ecx], 0x53445352
jne 0x10019056
push esi
lea eax, [ecx + 0x18]
push edi
push eax
call sym.sentry.dll_sentry_value_new_string
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push edx
push eax
push str.debug_file
push edi
push esi
call sym.sentry.dll_sentry_value_set_by_key
mov eax, dword [ebp - 0x4c]
add eax, 4
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.100015d7
movups xmm0, xmmword [eax]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x48]
push eax
movups xmmword [ebp - 0x48], xmm0
call sym.sentry.dll_sentry_uuid_as_string
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 0x14], 0x2d
push dword [eax + 0x14]
lea eax, [ebp - 0x13]
push 0x100499fc
push 0xa
push eax
call fcn.10001c49
lea eax, [ebp - 0x38]
push eax
call sym.sentry.dll_sentry_value_new_string
push edx
push eax
push str.debug_id
push edi
push esi
call sym.sentry.dll_sentry_value_set_by_key
add esp, 0x50
lea eax, [ebp - 0x38]
push dword [ebx + 0x50]
push dword [ebx + 8]
push str._08x_X
push 0x32
push eax
call fcn.10001c49
lea eax, [ebp - 0x38]
push eax
call sym.sentry.dll_sentry_value_new_string
push edx
push eax
push str.code_id
push edi
push esi
call sym.sentry.dll_sentry_value_set_by_key
push 0x10049a20
call sym.sentry.dll_sentry_value_new_string
push edx
push eax
push str.type
push edi
push esi
call sym.sentry.dll_sentry_value_set_by_key
add esp, 0x44
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001811
mov esp, ebp
pop ebp
ret
Function at 0x100190c0
Capabilities:
Enumerate process modules

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x10057034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x42c]
push 0x424
push 0
push eax
mov dword [ebp - 0x438], edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x430], 0x428
call sym.sentry.dll_sentry_value_new_list
mov dword [0x10057b60], eax
lea eax, [ebp - 0x430]
push eax
push edi
mov dword [0x10057b64], edx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x10019265
push 2
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x448], 0
xorps xmm0, xmm0
movaps xmmword [ebp - 0x460], xmm0
movq qword [ebp - 0x450], xmm0
test esi, esi
je 0x10019249
push 0x1c
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp eax, 0x1c
jne 0x10019249
cmp dword [ebp - 0x450], 0x1000
jne 0x10019249
call sym.sentry.dll_sentry_value_new_object
mov dword [ebp - 0x434], eax
mov edi, edx
mov eax, dword [ebp - 0x41c]
cdq
push edx
push eax
call fcn.1000177b
push edx
push eax
push str.image_addr
push edi
push dword [ebp - 0x434]
call sym.sentry.dll_sentry_value_set_by_key
push dword [ebp - 0x418]
call sym.sentry.dll_sentry_value_new_int32
push edx
push eax
push str.image_size
push edi
push dword [ebp - 0x434]
call sym.sentry.dll_sentry_value_set_by_key
lea eax, [ebp - 0x210]
push eax
call fcn.1000242d
push edx
push eax
push str.code_file
push edi
push dword [ebp - 0x434]
call sym.sentry.dll_sentry_value_set_by_key
add esp, 0x4c
push edi
push dword [ebp - 0x434]
push dword [ebp - 0x41c]
call fcn.10018f20
push edi
push dword [ebp - 0x434]
push dword [0x10057b64]
push dword [0x10057b60]
call sym.sentry.dll_sentry_value_append
mov edi, dword [ebp - 0x438]
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x430]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x10019143
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x10057b64]
push dword [0x10057b60]
call sym.sentry.dll_sentry_value_freeze
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
call fcn.10001811
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1001fe90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041d8a
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x10057034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 0x2c], 0
cmp dword [esi + 0x14], 8
jb 0x1001fed0
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1001fee4
mov al, 1
jmp 0x1001ff9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1001ff94
sub esp, 8
mov eax, esi
cmp dword [esi + 0x14], 8
mov ecx, esp
jb 0x1001ff04
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x28]
push eax
call fcn.100018bb
add esp, 0xc
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 1
call fcn.1000212b
push eax
push 2
push 0x25e
push str.E:ALIEN_PROJECTS_sentry_native_0.4.6externalcrashpadclientcrash_report_database_win.cc
push str.bool___cdecl_crashpad::_anonymous_namespace::CreateDirectoryIfNecessary_const_class_base::FilePath__
lea ecx, [ebp - 0xdc]
call fcn.1000126c
push esi
push str.CreateDirectory
push eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x2c], 3
call fcn.10001901
add esp, 8
push eax
call fcn.10001ec4
add esp, 8
lea ecx, [ebp - 0xdc]
call fcn.10002473
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x1001ff90
inc eax
push eax
push dword [ebp - 0x28]
call fcn.100011a4
add esp, 8
xor al, al
jmp 0x1001ff9d
push esi
call fcn.100202e0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001811
mov esp, ebp
pop ebp
ret
Function at 0x100202e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041edf
mov eax, dword fs:[0]
push eax
sub esp, 0x190
mov eax, dword [0x10057034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 0x44], 0
cmp dword [esi + 0x14], 8
jb 0x10020320
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100203d6
sub esp, 8
mov eax, esi
cmp dword [esi + 0x14], 8
mov ecx, esp
jb 0x1002033f
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x28]
push eax
call fcn.100018bb
add esp, 0xc
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], 1
call fcn.1000212b
push eax
push 2
push 0x249
push str.E:ALIEN_PROJECTS_sentry_native_0.4.6externalcrashpadclientcrash_report_database_win.cc
push str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea ecx, [ebp - 0x19c]
call fcn.1000126c
push esi
push str.GetFileAttributes
push eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x44], 3
call fcn.10001901
add esp, 8
push eax
call fcn.10001ec4
add esp, 8
lea ecx, [ebp - 0x19c]
call fcn.10002473
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x10020481
inc eax
push eax
push dword [ebp - 0x28]
call fcn.100011a4
add esp, 8
xor al, al
jmp 0x10020487
test al, 0x10
jne 0x10020485
sub esp, 8
mov eax, esi
cmp dword [esi + 0x14], 8
mov ecx, esp
jb 0x100203ed
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.100018bb
add esp, 0xc
mov esi, eax
push 2
push 0x24d
push str.E:ALIEN_PROJECTS_sentry_native_0.4.6externalcrashpadclientcrash_report_database_win.cc
push str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea ecx, [ebp - 0xec]
mov dword [ebp - 4], 2
mov dword [ebp - 0x44], 4
call fcn.1000213a
push str.:_not_a_directory
push esi
push str.GetFileAttributes
push eax
mov dword [ebp - 4], 3
mov dword [ebp - 0x44], 0xc
call fcn.10001901
add esp, 8
push eax
call fcn.10001ec4
add esp, 8
push eax
call fcn.10001901
add esp, 8
lea ecx, [ebp - 0xec]
call fcn.100024f5
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x10020481
inc eax
push eax
push dword [ebp - 0x40]
call fcn.100011a4
add esp, 8
xor al, al
jmp 0x10020487
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001811
mov esp, ebp
pop ebp
ret

Function at 0x10022a40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0x10
cmp dword [eax + 0x14], 8
jb 0x10022a51
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10022a64
mov eax, 1
pop ebp
ret
shr eax, 3
and eax, 2
pop ebp
ret
Function at 0x1002ff90
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044f4a
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x10057034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 0x2c], 0
cmp dword [esi + 0x14], 8
jb 0x1002ffd0
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1003007b
sub esp, 8
mov eax, esi
cmp dword [esi + 0x14], 8
mov ecx, esp
jb 0x1002ffee
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x28]
push eax
call fcn.100018bb
add esp, 0xc
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 1
call fcn.1000212b
push eax
push 2
push 0x2f
push str.E:ALIEN_PROJECTS_sentry_native_0.4.6externalcrashpadutil_file_filesystem_win.cc
push str.bool___cdecl_crashpad::_anonymous_namespace::LoggingRemoveDirectoryImpl_const_class_base::FilePath__
lea ecx, [ebp - 0xdc]
call fcn.1000126c
push esi
push str.RemoveDirectory
push eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x2c], 3
call fcn.10001901
add esp, 8
push eax
call fcn.10001ec4
add esp, 8
lea ecx, [ebp - 0xdc]
call fcn.10002473
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x10030077
inc eax
push eax
push dword [ebp - 0x28]
call fcn.100011a4
add esp, 8
xor al, al
jmp 0x1003007d
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001811
mov esp, ebp
pop ebp
ret
Function at 0x1e002e13
Capabilities:
Get common file path
Get disk size
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1e02e028]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
lea edi, [ebp - 0xa]
stosd dword es:[edi], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
stosw word es:[edi], ax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov esi, 0x1e02e578
jmp 0x1e002e4e
xor ebx, ebx
push 8
lea eax, [ebp - 0x50]
push eax
mov word [ebp - 0xc], bx
mov dword [ebp - 0x40], ebx
call 0x1e028c4e
jmp 0x1e002ed4
push dword [ebp - 0x38]
push dword [ebp - 0x50]
call fcn.1e01dcc1
test eax, eax
jne 0x1e002ecb
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x1e002ecb
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x20]
cdq
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov edi, edx
cdq
push edx
push eax
push edi
push ecx
call fcn.1e01ae50
cmp edx, ebx
mov edi, eax
mov dword [ebp - 0x54], edx
jb 0x1e002ecb
ja 0x1e002eb7
cmp edi, dword [ebp - 0x40]
jbe 0x1e002ecb
push 8
push dword [ebp - 0x50]
lea eax, [ebp - 0xc]
push eax
call fcn.1e01bcd3
mov ebx, dword [ebp - 0x54]
mov dword [ebp - 0x40], edi
lea eax, [ebp - 0x50]
push eax
call fcn.1e027d78
test eax, eax
jne 0x1e002e62
mov ebx, 0xffff
jmp 0x1e002f5d
cmp word [ebp - 0xc], 0
je 0x1e002ef8
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.1e01bca8
xor edi, edi
inc edi
mov dword [ebp - 0x18], edi
jmp 0x1e002f0b
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
and dword [ebp - 0x18], 0
xor edi, edi
inc edi
cmp dword [ebp - 0x10], 0
je 0x1e002f2e
push 0
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
push dword [ebp - 0x10]
push 0x1e0012a0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
jmp 0x1e002f39
push 0x1e00128c
push esi
call fcn.1e01c1ad
push 0
push esi
call fcn.1e01b304
test eax, eax
je 0x1e002f68
push esi
call fcn.1e002d74
test eax, eax
je 0x1e002f5a
push edi
push esi
call fcn.1e027247
test eax, eax
jne 0x1e002f68
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jb 0x1e002edf
jmp 0x1e002fa5
push edi
push esi
call fcn.1e01b86f
test eax, eax
je 0x1e002f91
push esi
call fcn.1e002cd7
test eax, eax
je 0x1e002f91
cmp dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edi
je 0x1e002fa5
push 6
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1e002fa5
cmp word [ebp - 0xc], 0
je 0x1e002fb6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.1e01f4e0
cmp word [ebp - 0xc], 0
je 0x1e002fb6
cmp dword [ebp - 0x14], 0
je 0x1e002e4c
lea eax, [ebp - 0x38]
push eax
call fcn.1e01f4b1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
call fcn.1e01abd2
leave
ret
Function at 0x1e0032ab
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push 0x18
push 0x1e0013d8
call fcn.1e01ae8c
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
cmp eax, esi
jne 0x1e0032e1
push dword [0x1e0331f8]
call sub.LOG.dll_LogBegin
push 0x41b
jmp 0x1e003346
push esi
push 0x1e001378
push eax
push 0x1e001360
push esi
call fcn.1e01e6b4
add esp, 0x14
mov dword [ebp - 0x20], eax
push eax
call fcn.1e029540
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x1e003336
push dword [0x1e02e570]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [0x1e02e570]
push 2
push esi
push 0x1e00134c
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x1e003359
push dword [0x1e0331f8]
call sub.LOG.dll_LogBegin
push 0x41c
push 0x1e001344
call sub.LOG.dll_LogW
pop ecx
pop ecx
call sub.LOG.dll_LogEnd
jmp 0x1e003360
mov dword [ebp - 0x24], 1
or dword [ebp - 4], 0xffffffff
call fcn.1e003376
mov eax, dword [ebp - 0x24]
call fcn.1e01aec7
ret 4

Function at 0x1e0035e5
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x1e02e028]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push eax
push ecx
push ebx
call fcn.1e01e6b4
add esp, 0x10
mov esi, eax
push esi
call fcn.1e01b72d
test eax, eax
je 0x1e003659
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x254]
push eax
push esi
call fcn.1e01b304
test eax, eax
je 0x1e003652
cmp word [ebp - 0x20], bx
je 0x1e00364f
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1e003652
xor ebx, ebx
inc ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push 0
call fcn.1e01c0cf
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
pop ebx
call fcn.1e01abd2
leave
ret 8

Function at 0x1e00438f
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp word [0x1e02e7c8], bx
push esi
mov esi, 0x1e02e7c8
jne 0x1e0043b1
push 0x104
push esi
call sym.MIGISM.dll_IsmGetTempDirectory
push 0
push dword [ebp + 8]
push esi
push 0
call fcn.1e01e6b4
add esp, 0x10
mov esi, eax
push esi
call fcn.1e01b72d
test eax, eax
je 0x1e0043eb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
push esi
call fcn.1e01b304
test eax, eax
je 0x1e0043e4
xor ebx, ebx
inc ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push 0
call fcn.1e01c0cf
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8