joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400325e0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r13, r8
mov r12, rdx
xor ebx, ebx
mov dword [rax + 0x20], ebx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x50]
cmp ecx, 0xff
jbe 0x14003267a
mov dword [rsp + 0x20], 1
mov r9d, 0x10a
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpad_snapshotwin_system_snapshot_win.cc
lea rdx, str.unsigned_char___cdecl_crashpad::internal::SystemSnapshotWin::CPUCount_void__const
lea rcx, [rsp + 0x68]
call fcn.14004fa70
nop
mov dword [rsp + 0x1b8], 1
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov rcx, rax
call fcn.140001300
nop
lea rcx, [rsp + 0x68]
call fcn.14004fcb0
mov ecx, dword [rsp + 0x50]
xor dl, dl
mov word [rsp + 0x1b8], 0x100
movzx eax, word [rsp + 0x1b8]
shr ax, 8
test al, al
jne 0x14003269e
test dl, dl
je 0x14003269e
mov eax, ebx
jmp 0x1400326ad
mov word [rsp + 0x1b8], 0
mov eax, 0xff
cmp ecx, 0xff
cmovbe eax, ecx
movzx r14d, al
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
test al, al
jne 0x1400326e1
mov rdi, rbx
mov rbp, rbx
mov r15, rbx
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
jmp 0x14003272c
lea rax, [r14 + r14*2]
lea rsi, [rax*8]
mov rcx, rsi
call fcn.1400095b0
mov rbx, rax
mov qword [rsp + 0x30], rax
lea r15, [rsi + rax]
mov qword [rsp + 0x40], r15
mov rbp, rax
mov rdi, rax
test r14, r14
je 0x140032721
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.14005be80
mov rbp, r15
mov rsi, rbp
mov qword [rsp + 0x38], rbp
mov r15, rbp
lea eax, [r14 + r14*2]
shl eax, 3
mov dword [rsp + 0x20], eax
mov r9, rbx
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call sub.POWRPROF.dll_CallNtPowerInformation
test eax, eax
je 0x14003275a
xor eax, eax
mov qword [r12], rax
mov qword [r13], rax
jmp 0x1400327d7
mov rdx, rdi
cmp rdi, rbp
je 0x140032789
lea rcx, [rdi + 0x18]
cmp rcx, r15
je 0x140032789
nop dword [rax + rax]
mov rdx, rcx
mov eax, dword [rcx + 8]
cmp dword [rdi + 8], eax
cmovae rdx, rdi
add rcx, 0x18
mov rdi, rdx
cmp rcx, rsi
jne 0x140032770
mov eax, dword [rdx + 8]
imul rcx, rax, 0xf4240
mov qword [r12], rcx
cmp rbx, rsi
je 0x1400327c9
lea rdx, [rbx + 0x18]
cmp rdx, rsi
je 0x1400327c9
nop word [rax + rax]
mov rcx, rdx
mov eax, dword [rdx + 4]
cmp dword [rbx + 4], eax
cmovae rcx, rbx
mov rbx, rcx
add rdx, 0x18
cmp rdx, rsi
jne 0x1400327b0
mov eax, dword [rbx + 4]
imul rcx, rax, 0xf4240
mov qword [r13], rcx
lea rcx, [rsp + 0x30]
call fcn.140033810
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14004c220
Capabilities:
Write file on windows

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14004e440
push rbx
sub rsp, 0x140
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov ebx, 0xffffffff
cmp r8, rbx
cmova r8d, ebx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14004e489
mov rax, 0xffffffffffffffff
add rsp, 0x140
pop rbx
ret
mov dword [rsp + 0x168], ebx
cmp dword [rsp + 0x160], ebx
jne 0x14004e4e7
lea r8, str.bytes_written___static_cast_DWORD___1_
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x160]
call fcn.14002dc30
test rax, rax
je 0x14004e4e7
mov qword [rsp + 0x20], rax
mov r9d, 0x65
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::internal::NativeWriteFile_void__const_void__unsigned___int64_
lea rcx, [rsp + 0x38]
call fcn.14004fb00
lea rcx, [rsp + 0x38]
call fcn.14004fcb0
mov eax, dword [rsp + 0x160]
add rsp, 0x140
pop rbx
ret

Function at 0x14004c230
Capabilities:
Check os version
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
xor esi, esi
movzx edi, dl
mov rbx, rcx
test dl, dl
je 0x14004c287
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x14004c287
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x40], 0x18
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
call fcn.14004c2e0
mov qword [rsp + 0x48], rax
lea rsi, [rsp + 0x40]
mov dword [rsp + 0x50], 1
cmp qword [rbx + 0x18], 8
jb 0x14004c291
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rsi
mov r9d, 2
movzx edx, dil
mov rcx, rbx
shl edx, 0x13
mov dword [rsp + 0x30], 0
or edx, 3
lea r8d, [r9 + 4]
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x14004ca60
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x140
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, rcx
xor edi, edi
mov dword [rax + 8], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov r9, rcx
lea r8, [0x14004cb30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x14004cb0e
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 4
lea r9d, [rdi + 0x1b]
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_thread_thread_win.cc
lea rdx, str.void___cdecl_crashpad::Thread::Start_void_
lea rcx, [rsp + 0x38]
call fcn.14004fc20
nop
mov edi, 2
mov dword [rsp + 0x150], edi
lea rdx, str.Check_failed:_platform_thread_
mov rcx, rax
call fcn.140001300
mov rcx, rax
lea rdx, [0x14009bef0]
call fcn.140001300
mov rcx, rax
lea rdx, [0x1400a6d58]
call fcn.140001300
nop
test dil, 2
je 0x14004cb1e
lea rcx, [rsp + 0x38]
call fcn.14004ff50
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret

Function at 0x14004e260
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x140
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
mov dword [rax + 0x10], 0
xor r9d, r9d
lea r8, [rax + 0x18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14004e2f1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0xf1
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::LoggingSeekFile_void____int64_int_
lea rcx, [rsp + 0x38]
call fcn.14004fc20
nop
mov dword [rsp + 0x158], 4
lea rdx, [0x1400abda8]
mov rcx, rax
call fcn.140001300
nop
lea rcx, [rsp + 0x38]
call fcn.14004ff50
xor al, al
add rsp, 0x140
pop rbx
ret
cmp qword [rsp + 0x160], 0
jne 0x14004e35e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14004e369
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0xfb
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_file_io_win.cc
lea rdx, str.bool___cdecl_crashpad::LoggingTruncateFile_void__
lea rcx, [rsp + 0x38]
call fcn.14004fc20
nop
mov dword [rsp + 0x158], 1
lea rdx, [0x1400abdc0]
mov rcx, rax
call fcn.140001300
nop
lea rcx, [rsp + 0x38]
call fcn.14004ff50
xor al, al
add rsp, 0x140
pop rbx
ret
mov al, 1
add rsp, 0x140
pop rbx
ret
Function at 0x14004e440
Capabilities:
Write file on windows

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14004e440
push rbx
sub rsp, 0x140
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov ebx, 0xffffffff
cmp r8, rbx
cmova r8d, ebx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14004e489
mov rax, 0xffffffffffffffff
add rsp, 0x140
pop rbx
ret
mov dword [rsp + 0x168], ebx
cmp dword [rsp + 0x160], ebx
jne 0x14004e4e7
lea r8, str.bytes_written___static_cast_DWORD___1_
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x160]
call fcn.14002dc30
test rax, rax
je 0x14004e4e7
mov qword [rsp + 0x20], rax
mov r9d, 0x65
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::internal::NativeWriteFile_void__const_void__unsigned___int64_
lea rcx, [rsp + 0x38]
call fcn.14004fb00
lea rcx, [rsp + 0x38]
call fcn.14004fcb0
mov eax, dword [rsp + 0x160]
add rsp, 0x140
pop rbx
ret

Function at 0x14004e580
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x130
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov r14d, 0xffffffff
lea r9, [rsp + 0x160]
cmp r8, r14
cmova edi, r14d
xor ebp, ebp
mov r8d, edi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004e66b
mov dword [rsp + 0x168], r14d
cmp dword [rsp + 0x160], r14d
je 0x14004e5e2
mov rax, rbp
jmp 0x14004e5fe
lea r8, str.bytes_read___static_cast_DWORD___1_
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x160]
call fcn.14002dc30
test rax, rax
je 0x14004e630
mov r9d, 0x7e
mov qword [rsp + 0x20], rax
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::ReadFile_void__void__unsigned___int64_
lea rcx, [rsp + 0x30]
call fcn.14004fb00
lea rcx, [rsp + 0x30]
call fcn.14004fcb0
cmp dword [rsp + 0x160], ebp
jne 0x14004e691
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x14004e691
lea r9, [rsp + 0x160]
mov qword [rsp + 0x20], rbp
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14004e5d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x6d
neg eax
sbb rax, rax
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov eax, dword [rsp + 0x160]
jmp 0x14004e679
Function at 0x140081a00
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x190
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1400da088]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x140081a39
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140081a4c
mov al, 1
jmp 0x140081b57
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140081b4f
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140081a6a
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x160]
call fcn.140051060
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x266
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadclientcrash_report_database_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::CreateDirectoryIfNecessary_const_class_base::FilePath__
lea rcx, [rsp + 0x58]
call fcn.14004fc20
nop
mov dword [rsp + 0x30], 3
lea rdx, str.CreateDirectory
mov rcx, rax
call fcn.140001300
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140081af5
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140001f90
nop
lea rcx, [rsp + 0x58]
call fcn.14004ff50
nop
mov rdx, qword [rsp + 0x178]
cmp rdx, 0x10
jb 0x140081b4b
inc rdx
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140081b46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140081b70
call fcn.140059fc8
xor al, al
jmp 0x140081b57
mov rcx, rbx
call fcn.140081de0
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14005a430
add rsp, 0x190
pop rbx
ret
call fcn.14005e364
int3
Function at 0x140081de0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1a8], rbx
mov rax, qword [0x1400da088]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x140081e28
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140081f24
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140081e44
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x60]
call fcn.140051060
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x251
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadclientcrash_report_database_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea rcx, [rsp + 0x58]
call fcn.14004fc20
nop
mov dword [rsp + 0x30], 3
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.140001300
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140081ecb
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140001f90
nop
lea rcx, [rsp + 0x58]
call fcn.14004ff50
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140081f1d
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140081f18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008203e
call fcn.140059fc8
xor al, al
jmp 0x14008201e
test al, 0x10
jne 0x14008201c
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140081f39
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x60]
call fcn.140051060
mov rbx, rax
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x20], 2
mov r9d, 0x255
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadclientcrash_report_database_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea rcx, [rsp + 0x58]
call fcn.14004fa70
nop
mov dword [rsp + 0x30], 0xc
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.140001300
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140081fb7
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140001f90
lea rdx, str.:_not_a_directory
mov rcx, rax
call fcn.140001300
nop
lea rcx, [rsp + 0x58]
call fcn.14004fcb0
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140081f1d
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140081f18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140082044
jmp 0x140081f18
mov al, 1
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14005a430
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x190
pop rbp
ret
call fcn.14005e364
int3
call fcn.14005e364
int3
Function at 0x140087300
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x240
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rdi, rcx
mov dword [rax + 0x10], 0
mov ebx, 1
nop word [rax + rax]
mov rax, qword [0x1400df160]
test rax, rax
jne 0x140087346
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140087330
cmp eax, 2
jne 0x14008738f
mov dword [rsp + 0x20], eax
mov r9d, 0x97
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadclientcrashpad_client_win.cc
lea rdx, str.long___cdecl_crashpad::_anonymous_namespace::UnhandledExceptionHandler_struct__EXCEPTION_POINTERS__
lea rcx, [rsp + 0x38]
call fcn.14004fa70
nop
mov dword [rsp + 0x258], ebx
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov rcx, rax
call fcn.140001300
nop
lea rcx, [rsp + 0x38]
jmp 0x140087440
mov rax, qword [0x1400df140]
test rax, rax
je 0x1400873a8
mov rcx, rdi
call rax
test al, al
jne 0x140087459
lock xadd qword [0x1400df198], rbx
lea rax, [rbx + 1]
cmp rax, 1
jle 0x1400873c8
xor edx, edx
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1400df138], eax
mov qword [0x1400df130], rdi
mov rcx, qword [0x1400daca0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 2
mov r9d, 0xc7
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadclientcrashpad_client_win.cc
lea rdx, str.long___cdecl_crashpad::_anonymous_namespace::UnhandledExceptionHandler_struct__EXCEPTION_POINTERS__
lea rcx, [rsp + 0x138]
call fcn.14004fa70
nop
mov dword [rsp + 0x258], 2
lea rdx, str.crash_server_did_not_respond__self_terminating
mov rcx, rax
call fcn.140001300
nop
lea rcx, [rsp + 0x138]
call fcn.14004fcb0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xffff7001
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x14008d450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x190
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1a8], rbx
mov rax, qword [0x1400da088]
xor rax, rsp
mov qword [rsp + 0x180], rax
movzx edi, dl
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x14008d494
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14008d595
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14008d4b0
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x160]
call fcn.140051060
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x82
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::IsDirectory_const_class_base::FilePath__bool_
lea rcx, [rsp + 0x58]
call fcn.14004fc20
nop
mov dword [rsp + 0x30], 3
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.140001300
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14008d53b
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140001f90
nop
lea rcx, [rsp + 0x58]
call fcn.14004ff50
nop
mov rdx, qword [rsp + 0x178]
cmp rdx, 0x10
jb 0x14008d591
inc rdx
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008d58c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008d5c6
call fcn.140059fc8
xor al, al
jmp 0x14008d5a5
test dil, dil
jne 0x14008d5a0
bt eax, 0xa
jb 0x14008d591
shr eax, 4
and al, 1
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14005a430
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x190
pop rdi
ret
call fcn.14005e364
int3
Function at 0x14008dce0
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x190
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1400da088]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x14008dd19
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14008de19
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14008dd34
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x160]
call fcn.140051060
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x30
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::LoggingRemoveDirectoryImpl_const_class_base::FilePath__
lea rcx, [rsp + 0x58]
call fcn.14004fc20
nop
mov dword [rsp + 0x30], 3
lea rdx, str.RemoveDirectory
mov rcx, rax
call fcn.140001300
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14008ddbf
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140001f90
nop
lea rcx, [rsp + 0x58]
call fcn.14004ff50
nop
mov rdx, qword [rsp + 0x178]
cmp rdx, 0x10
jb 0x14008de15
inc rdx
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008de10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008de34
call fcn.140059fc8
xor al, al
jmp 0x14008de1b
mov al, 1
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14005a430
add rsp, 0x190
pop rbx
ret
call fcn.14005e364
int3
Function at 0x14008de40
Capabilities:
Check if file exists
Delete file

Disassembly:
push rbx
sub rsp, 0x190
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1400da088]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x14008de79
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14008de9d
and eax, 0x410
cmp eax, 0x410
jne 0x14008de9d
mov rcx, rbx
call fcn.14008dce0
jmp 0x14008dfac
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14008deaa
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14008dfaa
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14008dec5
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x160]
call fcn.140051060
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x95
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutil_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::LoggingRemoveFile_const_class_base::FilePath__
lea rcx, [rsp + 0x58]
call fcn.14004fc20
nop
mov dword [rsp + 0x30], 3
lea rdx, str.DeleteFile
mov rcx, rax
call fcn.140001300
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14008df50
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140001f90
nop
lea rcx, [rsp + 0x58]
call fcn.14004ff50
nop
mov rdx, qword [rsp + 0x178]
cmp rdx, 0x10
jb 0x14008dfa6
inc rdx
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008dfa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008dfc5
call fcn.140059fc8
xor al, al
jmp 0x14008dfac
mov al, 1
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14005a430
add rsp, 0x190
pop rbx
ret
call fcn.14005e364
int3
Function at 0x14008e6b0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x140
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
mov dword [rsp + 0x158], 0
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx edx, ax
shr dx, 8
cmp al, 6
jb 0x14008e78d
jne 0x14008e6f1
cmp dx, 1
jbe 0x14008e78d
mov ecx, dword [0x1400ddd68]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1400df200], eax
jg 0x14008e7a1
xor edx, edx
mov r8d, 0x10000000
mov rcx, rbx
call qword [0x1400df1f8]
test eax, eax
jne 0x14008e796
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x21
lea r8, str.D:JenkinsworkspaceN_SentryNativeSDKexternalcrashpadutilwincritical_section_with_debug_info.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::CrashpadInitializeCriticalSectionEx_struct__RTL_CRITICAL_SECTION__unsigned_long_unsigned_long_
lea rcx, [rsp + 0x38]
call fcn.14004fc20
nop
mov dword [rsp + 0x158], 1
lea rdx, str.InitializeCriticalSectionEx
mov rcx, rax
call fcn.140001300
nop
lea rcx, [rsp + 0x38]
call fcn.14004ff50
xor al, al
add rsp, 0x140
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, 1
add rsp, 0x140
pop rbx
ret
lea rcx, [0x1400df200]
call fcn.14005a1e8
cmp dword [0x1400df200], 0xffffffff
jne 0x14008e718
mov r8b, 1
lea rdx, str.::InitializeCriticalSectionEx
lea rcx, [0x1400a1a98]
call fcn.14004af20
mov qword [0x1400df1f8], rax
lea rcx, [0x1400df200]
call fcn.14005a188
jmp 0x14008e718