joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004cb39
Capabilities:
Terminate process

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x130
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [0x14019f1a8]
test rax, rax
jne 0x14004cb7f
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x14019f1a8]
test rax, rax
je 0x14004cb6c
cmp eax, 2
jne 0x14004cbc0
mov dword [rsp + 0x20], 2
lea rdx, str.LONG___cdecl_crashpad::_anonymous_namespace_::UnhandledExceptionHandler_EXCEPTION_POINTERS__
lea r8, str.xplat_third_partycrashpadclientcrashpad_client_win.cc
lea rsi, [rbp - 0x58]
mov rcx, rsi
mov r9d, 0x91
call fcn.1400366da
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov rcx, rsi
call fcn.14000345f
jmp 0x14004cc4a
mov eax, 1
lock xadd qword [0x14019f1e0], rax
test rax, rax
jle 0x14004cbe0
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x14019f160], eax
mov qword [0x14019f158], rsi
mov rcx, rsi
call fcn.140069cfb
mov rcx, qword [0x140199738]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 2
lea rdx, str.LONG___cdecl_crashpad::_anonymous_namespace_::UnhandledExceptionHandler_EXCEPTION_POINTERS__
lea r8, str.xplat_third_partycrashpadclientcrashpad_client_win.cc
lea rsi, [rbp - 0x58]
mov rcx, rsi
mov r9d, 0xbf
call fcn.1400366da
lea rdx, str.crash_server_did_not_respond__self_terminating
mov rcx, rsi
call fcn.14000345f
lea rcx, [rbp - 0x58]
call fcn.140036d3a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
add rsp, 0x130
pop rdi
pop rsi
pop rbp
ret

Function at 0x14004e5d0
Capabilities:
Query environment variable

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x14004e601
movsx edx, byte [rax]
lea rcx, str.tTyY1
mov r8d, 6
call sub.VCRUNTIME140.dll_memchr
test rax, rax
setne al
jmp 0x14004e603
xor eax, eax
add rsp, 0x20
pop rbp
ret

Function at 0x14004e968
Capabilities:
Get hostname

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rsi, rcx
lea rdx, [rbp - 4]
mov dword [rdx], send
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x14004e9ab
lea rdi, [rbp - 0x20]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.14000136e
jmp 0x14004e9c3
cmp qword [rsi + 0x18], 0x10
mov rax, rsi
jb 0x14004e9b8
mov rax, qword [rsi]
mov qword [rsi + 0x10], 0
mov byte [rax], 0
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004fd24
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rsi, r8
mov rdi, rdx
mov rax, qword [0x140196d40]
xor rax, rbp
mov qword [rbp - 8], rax
cmp byte [0x14019fad8], 0
je 0x14004fdff
cmp byte [0x14019f785], 0
je 0x14004fdff
dec ecx
cmp ecx, 3
jae 0x14004fdff
shl ecx, 4
movabs rbx, 0xc000c000e
shr rbx, cl
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r15, rax
lea r14, [rbp - 0x20]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx r14d, word [r14 + 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov r12, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, r15
mov edx, ebx
call r12
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 1
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov rcx, r15
mov edx, r14d
call r12
jmp 0x14004fe1d
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 1
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, qword [rbp - 8]
xor rcx, rbp
call fcn.1400e77c0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret

Function at 0x14004fe3a
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov rdi, rdx
cmp dword [0x140199d78], ecx
jle 0x14004fe6a
cmp byte [0x14019f781], 0
je 0x14004feeb
mov rdx, rdi
mov r8, rsi
call fcn.14004fd24
lea rbx, [rbp - 0x20]
mov qword [rbx], 0
movaps xmm0, xmmword [section..rdata]
movups xmmword [rbx + 0x10], xmm0
mov byte [rbx], 0
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.14000136e
cmp qword [rbx + 0x18], 0x10
jb 0x14004fea7
mov rbx, qword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x14004feeb
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14004fee6
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14004fef5
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
Function at 0x140059e18
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov eax, 0xffffffff
cmp r8, rax
cmovae r8, rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xb4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140059eb0
mov dword [rbp - 0x50], 0xffffffff
cmp dword [rbp + 0xb4], 0xffffffff
jne 0x140059ea8
lea r8, str.bytes_written___static_cast_DWORD___1_
lea rcx, [rbp + 0xb4]
lea rdx, [rbp - 0x50]
call fcn.14005a938
test rax, rax
je 0x140059ea8
mov qword [rsp + 0x20], rax
lea rdx, str.crashpad::FileOperationResult___cdecl_crashpad::internal::NativeWriteFile_crashpad::FileHandle__const_void___size_t_
lea r8, str.xplat_third_partycrashpadutil_file_file_io_win.cc
lea rsi, [rbp - 0x50]
mov rcx, rsi
mov r9d, 0x65
call fcn.140036c12
mov rcx, rsi
call fcn.140036d3a
mov eax, dword [rbp + 0xb4]
jmp 0x140059eb7
mov rax, 0xffffffffffffffff
add rsp, 0x138
pop rsi
pop rbp
ret

Function at 0x140059ec1
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov rsi, rdx
mov rdi, rcx
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xb4]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140059faf
lea r15, [rbp + 0xb4]
lea r12, [rbp - 0x50]
mov r13, qword [sym.imp.KERNEL32.dll_GetFileType]
mov r14, qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rbp - 0x50], 0xffffffff
mov eax, dword [rbp + 0xb4]
cmp eax, 0xffffffff
jne 0x140059f80
mov rcx, r15
mov rdx, r12
lea r8, str.bytes_read___static_cast_DWORD___1_
call fcn.14005a938
test rax, rax
je 0x140059f7a
mov qword [rsp + 0x20], rax
mov rcx, r12
lea rdx, str.crashpad::FileOperationResult___cdecl_crashpad::ReadFile_crashpad::FileHandle__void___size_t_
lea r8, str.xplat_third_partycrashpadutil_file_file_io_win.cc
mov r9d, 0x7e
call fcn.140036c12
mov rcx, r12
call fcn.140036d3a
mov eax, dword [rbp + 0xb4]
test eax, eax
jne 0x140059fca
mov rcx, rdi
call r13
cmp eax, 3
jne 0x140059fc4
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r15
call r14
test eax, eax
jne 0x140059f28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
setne al
neg rax
jmp 0x140059fcc
mov eax, dword [rbp + 0xb4]
mov eax, eax
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14005a7d3
Capabilities:
Clear file content

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x140
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov rdi, rcx
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.14005a70d
test rax, rax
jne 0x14005a85f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x14005a85f
call fcn.1400372c2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingTruncateFile_crashpad::FileHandle_
lea r8, str.xplat_third_partycrashpadutil_file_file_io_win.cc
lea rsi, [rbp - 0x50]
mov rcx, rsi
mov r9d, 0xfb
call fcn.1400372da
lea rdx, [0x14013cf12]
mov rcx, rsi
call fcn.14000345f
lea rcx, [rbp - 0x50]
call fcn.14003730a
xor esi, esi
mov eax, esi
add rsp, 0x140
pop rdi
pop rsi
pop rbp
ret

Function at 0x14005b32b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x178
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], 0xfffffffffffffffe
mov ebx, edx
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14005b358
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005b380
test bl, bl
jne 0x14005b375
mov ecx, eax
and ecx, 0x400
jne 0x14005b45e
and eax, 0x10
shr eax, 4
jmp 0x14005b460
call fcn.1400372c2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::IsDirectory_const_base::FilePath___bool_
lea r8, str.xplat_third_partycrashpadutil_file_filesystem_win.cc
lea rdi, [rbp - 0x48]
mov rcx, rdi
mov r9d, 0x82
call fcn.1400372da
lea rdx, str.GetFileAttributes
mov rcx, rdi
call fcn.14000345f
mov rdi, rax
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14005b3d0
mov rax, qword [rsi]
lea rdx, [rbp + 0xc0]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rbp + 0xd0]
mov rcx, rsi
call fcn.14004784a
mov r8, qword [rbp + 0xe0]
cmp qword [rbp + 0xe8], 0x10
jb 0x14005b409
mov rsi, qword [rbp + 0xd0]
mov rcx, rdi
mov rdx, rsi
call fcn.140004e8c
mov rax, qword [rbp + 0xe8]
cmp rax, 0x10
jb 0x14005b455
mov rcx, qword [rbp + 0xd0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14005b450
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14005b46c
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
lea rcx, [rbp - 0x48]
call fcn.14003730a
xor eax, eax
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop rbp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
Function at 0x14005b4dd
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x188
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x100], 0xfffffffffffffffe
mov ebx, r8d
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14005b50b
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14005b705
test bl, bl
je 0x14005b625
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14005b625
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.14005b32b
test al, al
jne 0x14005b705
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingCreateDirectory_const_base::FilePath___crashpad::FilePermissions__bool_
lea r8, str.xplat_third_partycrashpadutil_file_filesystem_win.cc
lea rcx, [rbp - 0x48]
mov r9d, 0x5d
call fcn.1400366da
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14005b57e
mov rax, qword [rsi]
lea rdx, [rbp + 0xc0]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rbp + 0xe0]
mov rcx, rsi
call fcn.14004784a
mov r8, qword [rbp + 0xf0]
cmp qword [rbp + 0xf8], 0x10
jb 0x14005b5b7
mov rsi, qword [rbp + 0xe0]
lea rcx, [rbp - 0x48]
mov rdx, rsi
call fcn.140004e8c
lea rdx, [0x140139c3d]
mov rcx, rax
call fcn.14000345f
mov rax, qword [rbp + 0xf8]
cmp rax, 0x10
jb 0x14005b617
mov rcx, qword [rbp + 0xe0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14005b612
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14005b718
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
lea rcx, [rbp - 0x48]
call fcn.140036d3a
jmp 0x14005b703
call fcn.1400372c2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingCreateDirectory_const_base::FilePath___crashpad::FilePermissions__bool_
lea r8, str.xplat_third_partycrashpadutil_file_filesystem_win.cc
lea rdi, [rbp - 0x48]
mov rcx, rdi
mov r9d, 0x62
call fcn.1400372da
lea rdx, str.CreateDirectory
mov rcx, rdi
call fcn.14000345f
mov rdi, rax
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14005b675
mov rax, qword [rsi]
lea rdx, [rbp + 0xd0]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rbp + 0xe0]
mov rcx, rsi
call fcn.14004784a
mov r8, qword [rbp + 0xf0]
cmp qword [rbp + 0xf8], 0x10
jb 0x14005b6ae
mov rsi, qword [rbp + 0xe0]
mov rcx, rdi
mov rdx, rsi
call fcn.140004e8c
mov rax, qword [rbp + 0xf8]
cmp rax, 0x10
jb 0x14005b6fa
mov rcx, qword [rbp + 0xe0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14005b6f5
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14005b713
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
lea rcx, [rbp - 0x48]
call fcn.14003730a
xor edi, edi
mov eax, edi
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop rbp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
Function at 0x14005b7f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe8], 0xfffffffffffffffe
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14005b81e
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005b836
test eax, 0x410
sete al
jmp 0x14005b916
call fcn.1400372c2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::IsRegularFile_const_base::FilePath__
lea r8, str.xplat_third_partycrashpadutil_file_filesystem_win.cc
lea rdi, [rbp - 0x50]
mov rcx, rdi
mov r9d, 0x75
call fcn.1400372da
lea rdx, str.GetFileAttributes
mov rcx, rdi
call fcn.14000345f
mov rdi, rax
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14005b886
mov rax, qword [rsi]
lea rdx, [rbp + 0xb8]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rbp + 0xc8]
mov rcx, rsi
call fcn.14004784a
mov r8, qword [rbp + 0xd8]
cmp qword [rbp + 0xe0], 0x10
jb 0x14005b8bf
mov rsi, qword [rbp + 0xc8]
mov rcx, rdi
mov rdx, rsi
call fcn.140004e8c
mov rax, qword [rbp + 0xe0]
cmp rax, 0x10
jb 0x14005b90b
mov rcx, qword [rbp + 0xc8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14005b906
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14005b921
add rax, 0x28
mov rdx, rax
mov rcx, rdi
call fcn.1400e7768
lea rcx, [rbp - 0x50]
call fcn.14003730a
xor eax, eax
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
Function at 0x14005b98d
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe8], 0xfffffffffffffffe
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14005b9b7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005b9db
and eax, 0x410
cmp eax, 0x410
jne 0x14005b9db
mov rcx, rsi
call fcn.14005bb51
jmp 0x14005bada
cmp qword [rsi + 0x18], 8
mov rcx, rsi
jb 0x14005b9e8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, eax
mov al, 1
test ecx, ecx
jne 0x14005bada
call fcn.1400372c2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingRemoveFile_const_base::FilePath__
lea r8, str.xplat_third_partycrashpadutil_file_filesystem_win.cc
lea rdi, [rbp - 0x50]
mov rcx, rdi
mov r9d, 0x95
call fcn.1400372da
lea rdx, str.DeleteFile
mov rcx, rdi
call fcn.14000345f
mov rdi, rax
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14005ba4a
mov rax, qword [rsi]
lea rdx, [rbp + 0xb8]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rbp + 0xc8]
mov rcx, rsi
call fcn.14004784a
mov r8, qword [rbp + 0xd8]
cmp qword [rbp + 0xe0], 0x10
jb 0x14005ba83
mov rsi, qword [rbp + 0xc8]
mov rcx, rdi
mov rdx, rsi
call fcn.140004e8c
mov rax, qword [rbp + 0xe0]
cmp rax, 0x10
jb 0x14005bacf
mov rcx, qword [rbp + 0xc8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14005baca
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14005bae5
add rax, 0x28
mov rdx, rax
mov rcx, rdi
call fcn.1400e7768
lea rcx, [rbp - 0x50]
call fcn.14003730a
xor eax, eax
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
Function at 0x14005bb51
Capabilities:
Delete directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x178
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], 0xfffffffffffffffe
mov rdi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14005bb7c
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x14005bc6a
call fcn.1400372c2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::LoggingRemoveDirectoryImpl_const_base::FilePath__
lea r8, str.xplat_third_partycrashpadutil_file_filesystem_win.cc
lea rbx, [rbp - 0x48]
mov rcx, rbx
mov r9d, 0x30
call fcn.1400372da
lea rdx, str.RemoveDirectory
mov rcx, rbx
call fcn.14000345f
mov rbx, rax
cmp qword [rdi + 0x18], 8
mov rax, rdi
jb 0x14005bbdc
mov rax, qword [rdi]
lea rdx, [rbp + 0xc0]
mov qword [rdx], rax
mov rax, qword [rdi + 0x10]
mov qword [rdx + 8], rax
lea rdi, [rbp + 0xd0]
mov rcx, rdi
call fcn.14004784a
mov r8, qword [rbp + 0xe0]
cmp qword [rbp + 0xe8], 0x10
jb 0x14005bc15
mov rdi, qword [rbp + 0xd0]
mov rcx, rbx
mov rdx, rdi
call fcn.140004e8c
mov rax, qword [rbp + 0xe8]
cmp rax, 0x10
jb 0x14005bc61
mov rcx, qword [rbp + 0xd0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14005bc5c
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14005bc7b
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400e7768
lea rcx, [rbp - 0x48]
call fcn.14003730a
test esi, esi
setne al
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop rbp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
Function at 0x14006802b
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb0], 0xfffffffffffffffe
test rdx, rdx
je 0x1400680de
mov rsi, rdx
mov rdi, rcx
mov r15d, 0xffffffff
lea rbx, [rbp - 0x50]
lea r12, str.Check_failed:_success
lea r13, [0x140146f36]
cmp rsi, r15
mov r14d, 0xffffffff
cmovb r14, rsi
mov rcx, rdi
mov edx, r14d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1400680d6
mov dword [rsp + 0x20], 4
mov rcx, rbx
lea rdx, str.void___cdecl_base::RandBytes_void___size_t_
lea r8, str.xplat_third_partycrashpad_third_partymini_chromiummini_chromium_base_rand_util.cc
mov r9d, 0x7d
call fcn.1400366da
mov rcx, rbx
mov rdx, r12
call fcn.14000345f
mov rcx, rax
mov rdx, r13
call fcn.14000345f
mov rcx, rbx
call fcn.140036d3a
add rdi, r14
sub rsi, r14
jne 0x140068078
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400685de
Capabilities:
Check os version
Create pipe

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rsi, rcx
mov rax, qword [0x140196d40]
xor rax, rbp
mov qword [rbp], rax
test dl, dl
je 0x140068641
call qword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xfe
mov edi, 0x80003
cmp eax, 6
jb 0x140068646
xorps xmm0, xmm0
lea rbx, [rbp - 0x20]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov dword [rbx], 0x18
xor ecx, ecx
call fcn.14006869e
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], 1
jmp 0x140068648
mov edi, 3
xor ebx, ebx
cmp qword [rsi + 0x18], 8
jb 0x140068652
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rbx
mov eax, 0x200
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0
mov rcx, rsi
mov edx, edi
mov r8d, 6
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1400e77c0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x14006923c
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
sub rsp, 0x148
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc0], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140069320]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
jne 0x1400692f0
call fcn.1400372c2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 4
lea rdx, str.void___cdecl_crashpad::Thread::Start_void_
lea r8, str.xplat_third_partycrashpadutil_thread_thread_win.cc
lea rsi, [rbp - 0x48]
mov rcx, rsi
mov r9d, 0x1b
call fcn.1400372da
lea rdx, str.Check_failed:_platform_thread_
mov rcx, rsi
call fcn.14000345f
lea rdx, [0x140146f36]
mov rcx, rax
call fcn.14000345f
lea rdx, [0x14013d6e9]
mov rcx, rax
call fcn.14000345f
lea rcx, [rbp - 0x48]
call fcn.14003730a
nop
add rsp, 0x148
pop rsi
pop rbp
ret
Function at 0x140069730
Capabilities:
Check os version

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x140
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
and ecx, 0xfe
cmp ecx, 6
jb 0x1400697fd
and eax, 0xfeff
cmp eax, 6
je 0x1400697fd
mov eax, dword [0x1401af040]
mov ecx, dword [0x14019ea3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140069813
mov rcx, rsi
xor edx, edx
mov r8d, 0x10000000
call qword [0x1401af038]
mov esi, eax
test eax, eax
jne 0x1400697f6
call fcn.1400372c2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::CrashpadInitializeCriticalSectionEx_CRITICAL_SECTION___DWORD__DWORD_
lea r8, str.xplat_third_partycrashpadutilwincritical_section_with_debug_info.cc
lea rdi, [rbp - 0x50]
mov rcx, rdi
mov r9d, 0x21
call fcn.1400372da
lea rdx, [0x140139e1c]
mov rcx, rdi
call fcn.14000345f
lea rcx, [rbp - 0x50]
call fcn.14003730a
test esi, esi
setne al
jmp 0x140069808
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, 1
add rsp, 0x140
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1401af040]
call fcn.1400e78b0
cmp dword [0x1401af040], 0xffffffff
jne 0x140069796
lea rcx, [0x140147d12]
lea rdx, str.::InitializeCriticalSectionEx
mov r8b, 1
call fcn.140068a78
mov qword [0x1401af038], rax
lea rcx, [0x1401af040]
call fcn.1400e7948
jmp 0x140069796