joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140111640
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x140111760
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1401116a0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1401116a0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1401116a0
Function at 0x14014950c
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov eax, dword [rsp + 0x30]
test edx, edx
jle 0x140149538
mov r10d, edx
xor r11d, r11d
movzx edx, byte [rcx + r11]
add edx, eax
mov esi, edx
shl esi, 0xa
add esi, edx
mov eax, esi
shr eax, 6
xor eax, esi
inc r11
cmp r10, r11
jne 0x14014951b
mov ecx, eax
shl ecx, 0xa
add ecx, eax
add ecx, 0xe83a
mov eax, ecx
shr eax, 6
xor eax, ecx
test r9d, r9d
jle 0x140149573
mov r9d, r9d
xor edx, edx
movzx ecx, byte [r8 + rdx]
add ecx, eax
mov esi, ecx
shl esi, 0xa
add esi, ecx
mov eax, esi
shr eax, 6
xor eax, esi
inc rdx
cmp r9, rdx
jne 0x140149556
lea eax, [rax + rax*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
pop rsi
ret
Function at 0x14014f435
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
xor esi, esi
test rcx, rcx
je 0x14014f672
mov r14, r8
test r8, r8
je 0x14014f672
mov r13, r9
mov r15, rdx
test rdx, rdx
mov rax, r14
cmovne rax, rdx
movzx edx, byte [rax]
mov edi, edx
shl edi, 5
sub edi, edx
sub edi, edx
test r15, r15
je 0x14014f4b7
mov bl, byte [r15]
imul ebp, edx, 0x3c0
mov edx, edi
shr edx, 3
add edx, ebp
test bl, bl
je 0x14014f4b2
lea rbp, [r15 + 1]
movsx ebx, bl
add ebx, edx
xor edi, ebx
mov bl, byte [rbp]
mov eax, edi
shl eax, 5
mov edx, edi
shr edx, 3
add edx, eax
inc rbp
test bl, bl
jne 0x14014f495
add edx, 0x3a
xor edi, edx
mov bl, byte [r14]
test bl, bl
je 0x14014f4de
lea rdx, [r14 + 1]
movsx ebp, bl
mov eax, edi
shl eax, 5
mov esi, edi
shr esi, 3
add esi, ebp
add esi, eax
xor edi, esi
mov bl, byte [rdx]
inc rdx
test bl, bl
jne 0x14014f4c2
mov rdx, qword [rsp + 0x90]
mov eax, edi
shl eax, 5
mov r8d, edi
shr r8d, 3
add r8d, eax
xor r8d, edi
test r13, r13
mov r9, rdx
je 0x14014f543
mov bl, byte [r13]
mov ebp, r8d
shl ebp, 5
mov eax, r8d
shr eax, 3
add eax, ebp
test bl, bl
je 0x14014f53a
lea rbp, [r13 + 1]
movsx ebx, bl
add ebx, eax
xor r8d, ebx
mov bl, byte [rbp]
mov edx, r8d
shl edx, 5
mov eax, r8d
shr eax, 3
add eax, edx
inc rbp
test bl, bl
jne 0x14014f51a
add eax, 0x3a
xor r8d, eax
mov rdx, r9
mov r10, qword [rsp + 0x98]
test rdx, rdx
je 0x14014f579
mov bl, byte [rdx]
test bl, bl
je 0x14014f579
lea rax, [rdx + 1]
movsx edx, bl
mov esi, r8d
shl esi, 5
mov ebp, r8d
shr ebp, 3
add ebp, edx
add ebp, esi
xor r8d, ebp
mov bl, byte [rax]
inc rax
test bl, bl
jne 0x14014f55a
mov r12, qword [rsp + 0xa0]
mov edx, r8d
shl edx, 5
mov eax, r8d
shr eax, 3
add eax, edx
xor eax, r8d
test r10, r10
je 0x14014f5d3
mov rdi, r10
mov bl, byte [r10]
mov ebp, eax
shl ebp, 5
mov edx, eax
shr edx, 3
add edx, ebp
test bl, bl
je 0x14014f5ce
lea rbp, [rdi + 1]
movsx ebx, bl
add ebx, edx
xor eax, ebx
mov bl, byte [rbp]
mov edi, eax
shl edi, 5
mov edx, eax
shr edx, 3
add edx, edi
inc rbp
test bl, bl
jne 0x14014f5b1
add edx, 0x3a
xor eax, edx
test r12, r12
je 0x14014f601
mov bl, byte [r12]
test bl, bl
je 0x14014f601
lea rdx, [r12 + 1]
movsx ebp, bl
mov ebx, eax
shl ebx, 5
mov edi, eax
shr edi, 3
add edi, ebp
add edi, ebx
xor eax, edi
mov bl, byte [rdx]
inc rdx
test bl, bl
jne 0x14014f5e5
xor edx, edx
div dword [rcx + 8]
mov rbp, qword [rcx]
lea rax, [rdx + rdx*2]
shl rax, 4
xor esi, esi
cmp dword [rbp + rax + 0x28], 0
je 0x14014f672
test rbp, rbp
je 0x14014f672
add rbp, rax
xor esi, esi
mov rdi, r9
mov rbx, r10
mov r8, qword [rbp + 8]
mov rcx, r15
mov rdx, r14
call fcn.1400ed714
test eax, eax
je 0x14014f663
mov r8, qword [rbp + 0x10]
mov rcx, r13
mov rdx, rdi
call fcn.1400ed714
test eax, eax
je 0x14014f663
mov r8, qword [rbp + 0x18]
mov rcx, rbx
mov rdx, r12
call fcn.1400ed714
test eax, eax
jne 0x14014f66e
mov rbp, qword [rbp]
test rbp, rbp
jne 0x14014f62a
jmp 0x14014f672
mov rsi, qword [rbp + 0x20]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14014f6a7
Capabilities:
Encode data using xor

Disassembly:
push rsi
test rdx, rdx
je 0x14014f6eb
movzx r10d, byte [rdx]
mov r11d, r10d
shl r11d, 5
sub r11d, r10d
sub r11d, r10d
test r10d, r10d
je 0x14014f6ee
inc rdx
movsx r10d, r10b
mov eax, r11d
shl eax, 5
mov esi, r11d
shr esi, 3
add esi, r10d
add esi, eax
xor r11d, esi
mov r10b, byte [rdx]
inc rdx
test r10b, r10b
jne 0x14014f6c6
jmp 0x14014f6ee
xor r11d, r11d
mov eax, r11d
shl eax, 5
mov r10d, r11d
shr r10d, 3
add r10d, eax
xor r10d, r11d
test r8, r8
je 0x14014f730
mov al, byte [r8]
test al, al
je 0x14014f730
inc r8
movsx eax, al
mov edx, r10d
shl edx, 5
mov esi, r10d
shr esi, 3
add esi, edx
add esi, eax
xor r10d, esi
mov al, byte [r8]
inc r8
test al, al
jne 0x14014f710
mov edx, r10d
shl edx, 5
mov eax, r10d
shr eax, 3
add eax, edx
xor eax, r10d
test r9, r9
je 0x14014f76f
mov dl, byte [r9]
test dl, dl
je 0x14014f76f
inc r9
movsx r8d, dl
mov esi, eax
shl esi, 5
mov edx, eax
shr edx, 3
add edx, esi
add edx, r8d
xor eax, edx
mov dl, byte [r9]
inc r9
test dl, dl
jne 0x14014f750
xor edx, edx
div dword [rcx + 8]
mov eax, edx
pop rsi
ret

Function at 0x140158890
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x1401588ab
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1400ef7d8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140158959
mov rbx, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x140158959
mov qword [rsp + 0x20], 0
mov rcx, r14
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x140158984
mov qword [rdi + 0x28], r14
mov al, 1
jmp 0x1401588a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x14015889f
mov dword [rsi], 7
jmp 0x14015889f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14015889f
Function at 0x14015befa
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
cmp dword [rcx + 0x10108], 0
mov r9d, dword [rcx + 0xd4]
je 0x14015bfb6
test r9d, r9d
je 0x14015bfb3
xor eax, eax
mov r8d, 0xff
mov esi, dword [rdi + 0x10128]
mov ecx, dword [rdi + 0x10130]
mov edx, ecx
and edx, 0xfffd
lea r10d, [rdx + 2]
xor edx, 3
imul edx, r10d
shr edx, 8
movzx r10d, byte [rdi + rax + 0x100]
mov r11, qword [rdi + 0x10138]
mov ebx, esi
and ebx, r8d
xor ebx, r10d
shr esi, 8
xor esi, dword [r11 + rbx*4]
mov dword [rdi + 0x10128], esi
and esi, r8d
add esi, dword [rdi + 0x1012c]
imul ebx, esi, 0x8088405
inc ebx
mov dword [rdi + 0x1012c], ebx
shr ebx, 0x18
mov esi, ecx
and esi, r8d
xor esi, ebx
shr ecx, 8
xor ecx, dword [r11 + rsi*4]
mov dword [rdi + 0x10130], ecx
xor byte [rdi + rax + 0x100], dl
inc rax
cmp rax, r9
jb 0x14015bf29
jmp 0x14015bfb6
xor r9d, r9d
lea r8, [rdi + 0x100]
mov rcx, qword [rdi + 0x38]
mov rdx, qword [rdi + 0x58]
call qword [rdi + 0x10]
mov edx, dword [rdi + 0x84]
mov ebx, dword [rdi + 0xd4]
xor ecx, ecx
cmp eax, ebx
setne cl
add qword [rdi + 0x10118], rbx
add qword [rdi + 0x10120], rdx
neg ecx
xor eax, eax
mov dword [rdi + 0x84], eax
mov dword [rdi + 0xd4], eax
mov eax, ecx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14015cd49
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [rcx]
mov r9d, dword [rcx + 8]
xor r8d, eax
mov r10d, 0xff
and r8d, r10d
shr eax, 8
xor eax, dword [rdx + r8*4]
mov dword [rcx], eax
and eax, r10d
add eax, dword [rcx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [rcx + 4], eax
shr eax, 0x18
and r10d, r9d
xor r10d, eax
shr r9d, 8
xor r9d, dword [rdx + r10*4]
mov dword [rcx + 8], r9d
ret

Function at 0x14015cd8c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov eax, dword [0x140271390]
mov ecx, dword [0x14026d938]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14015cdef
cmp rdi, rbx
je 0x14015cde5
mov eax, 0xffffffff
lea rcx, [0x140270f90]
movzx edx, byte [rdi]
movzx esi, al
xor esi, edx
shr eax, 8
xor eax, dword [rcx + rsi*4]
inc rdi
cmp rbx, rdi
jne 0x14015cdcb
not eax
jmp 0x14015cde7
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140271390]
call fcn.1401ca090
cmp dword [0x140271390], 0xffffffff
jne 0x14015cdba
xor r9d, r9d
lea r8, [0x140270f90]
mov edx, 8
mov ecx, r9d
mov eax, ecx
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
dec edx
jne 0x14015ce16
mov dword [r8 + r9*4], ecx
inc r9
cmp r9, 0x100
jne 0x14015ce0e
lea rcx, [0x140271390]
call fcn.1401ca128
jmp 0x14015cdba
Function at 0x140165668
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
jmp 0x140188fb8
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140188fdf
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140189017
and eax, 0x410
cmp eax, 0x410
jne 0x140189017
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401ca2e0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp 0x14018910a
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140189023
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x1401890ee
mov ecx, 2
call fcn.140060b40
test al, al
je 0x1401890ec
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x94
mov r9d, 2
call fcn.1400618b0
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.140007184
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14006f5f0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401890c5
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140007184
xor eax, eax
cmp byte [rsp + 0x4f], al
jns 0x1401890e2
mov rcx, qword [rsp + 0x38]
call fcn.1401c9f6c
lea rcx, [rsp + 0x50]
call fcn.140061980
xor edi, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140189131
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x1401891fc
mov ecx, 2
call fcn.140060b40
test al, al
je 0x1401891fa
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x2f
mov r9d, 2
call fcn.1400618b0
lea rcx, [rsp + 0x60]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.140007184
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14006f5f0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401891d3
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140007184
xor eax, eax
cmp byte [rsp + 0x4f], al
jns 0x1401891f0
mov rcx, qword [rsp + 0x38]
call fcn.1401c9f6c
lea rcx, [rsp + 0x50]
call fcn.140061980
xor edi, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
Function at 0x1401773c4
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140177460]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x140177429
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1401ca2e0
nop
add rsp, 0x180
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r8d, 0x19
mov r9d, 3
call fcn.1400618b0
mov rcx, rsi
call fcn.140061980
jmp 0x14017740f

Function at 0x1401848fa
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 0x40
jb 0x140184953
cmp byte [rcx], 0x4d
jne 0x140184953
cmp byte [rcx + 1], 0x5a
jne 0x140184953
mov r9d, dword [rcx + 0x3c]
mov r10, rdx
sub r10, r9
xor eax, eax
cmp r10, 0x18
jb 0x140184955
cmp r9, rdx
jae 0x140184955
cmp r9d, 0x40
jb 0x140184955
mov r10d, r9d
and r10d, 7
test r10, r10
jne 0x140184955
cmp byte [rcx + r9], 0x50
jne 0x140184953
cmp byte [rcx + r9 + 1], 0x45
jne 0x140184953
cmp byte [rcx + r9 + 2], 0
jne 0x140184953
cmp byte [rcx + r9 + 3], 0
je 0x140184956
xor eax, eax
ret
add r9, 0x18
xor eax, eax
sub rdx, r9
jbe 0x140184955
cmp rdx, 2
jb 0x140184955
cmp word [rcx + r9], r8w
sete al
ret
Function at 0x140188fb8
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
jmp 0x140188fb8
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140188fdf
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140189017
and eax, 0x410
cmp eax, 0x410
jne 0x140189017
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401ca2e0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp 0x14018910a
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140189023
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x1401890ee
mov ecx, 2
call fcn.140060b40
test al, al
je 0x1401890ec
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x94
mov r9d, 2
call fcn.1400618b0
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.140007184
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14006f5f0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401890c5
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140007184
xor eax, eax
cmp byte [rsp + 0x4f], al
jns 0x1401890e2
mov rcx, qword [rsp + 0x38]
call fcn.1401c9f6c
lea rcx, [rsp + 0x50]
call fcn.140061980
xor edi, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140189131
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x1401891fc
mov ecx, 2
call fcn.140060b40
test al, al
je 0x1401891fa
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x2f
mov r9d, 2
call fcn.1400618b0
lea rcx, [rsp + 0x60]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.140007184
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14006f5f0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401891d3
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140007184
xor eax, eax
cmp byte [rsp + 0x4f], al
jns 0x1401891f0
mov rcx, qword [rsp + 0x38]
call fcn.1401c9f6c
lea rcx, [rsp + 0x50]
call fcn.140061980
xor edi, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
Function at 0x14018910a
Capabilities:
Delete directory

Disassembly:
jmp 0x140188fb8
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140188fdf
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140189017
and eax, 0x410
cmp eax, 0x410
jne 0x140189017
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401ca2e0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp 0x14018910a
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140189023
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x1401890ee
mov ecx, 2
call fcn.140060b40
test al, al
je 0x1401890ec
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x94
mov r9d, 2
call fcn.1400618b0
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.140007184
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14006f5f0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401890c5
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140007184
xor eax, eax
cmp byte [rsp + 0x4f], al
jns 0x1401890e2
mov rcx, qword [rsp + 0x38]
call fcn.1401c9f6c
lea rcx, [rsp + 0x50]
call fcn.140061980
xor edi, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140189131
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x1401891fc
mov ecx, 2
call fcn.140060b40
test al, al
je 0x1401891fa
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x2f
mov r9d, 2
call fcn.1400618b0
lea rcx, [rsp + 0x60]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.140007184
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14006f5f0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401891d3
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.140007184
xor eax, eax
cmp byte [rsp + 0x4f], al
jns 0x1401891f0
mov rcx, qword [rsp + 0x38]
call fcn.1401c9f6c
lea rcx, [rsp + 0x50]
call fcn.140061980
xor edi, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
Function at 0x1401a7058
Capabilities:
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1a8
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
lea rdi, [rcx + 0x18]
mov rcx, rdi
call fcn.1401a7ab8
lea r9, [rsp + 0x160]
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
call fcn.1401b488e
test al, al
je 0x1401a710a
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1401a7153
mov rcx, rdi
call fcn.1401a7ab8
movsxd rdi, dword [rsp + 0x19c]
add rdi, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, rdi
mov r9, rbx
call fcn.1401b488e
test al, al
je 0x1401a719c
cmp dword [rbx], 0x4550
jne 0x1401a71df
mov sil, 1
test r14, r14
je 0x1401a724a
mov qword [r14], rdi
jmp 0x1401a724a
mov ecx, 1
call fcn.140060b40
test al, al
je 0x1401a7248
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140060c10
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
jmp 0x1401a721f
mov ecx, 1
call fcn.140060b40
test al, al
je 0x1401a7248
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140060c10
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1401a721f
mov ecx, 1
call fcn.140060b40
test al, al
je 0x1401a7248
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140060c10
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1401a7148
mov ecx, 1
call fcn.140060b40
test al, al
je 0x1401a7248
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140060c10
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
call fcn.140007184
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401a7235
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140007184
mov rcx, rdi
call fcn.140061070
xor esi, esi
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, esi
add rsp, 0x1a8
pop rbx
pop rdi
pop rsi
pop r14
ret