joyce8/EMBER2024-capa huggingface dataset:
Function at 0x509370
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb2000]
push edi
jmp 0x50938a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x509391
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x509380
mov eax, 1
add ebx, ebx
jne 0x5093a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5093b4
jne 0x5093d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5093d3
dec eax
add ebx, ebx
jne 0x5093c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x509398
add ebx, ebx
jne 0x5093cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x509425
xor ecx, ecx
sub eax, 3
jb 0x5093eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50945a
sar eax, 1
mov ebp, eax
jmp 0x5093f6
add ebx, ebx
jne 0x5093f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5093c4
inc ecx
add ebx, ebx
jne 0x509404
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5093c4
add ebx, ebx
jne 0x509411
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x509406
jne 0x509422
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x509406
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x509444
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x509436
jmp 0x509386
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x509444
add edi, ecx
jmp 0x509386
pop esi
mov edi, esi
mov ecx, 0x2dc1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x509462
cmp byte [edi], 0x19
jne 0x509462
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x509467
lea edi, [esi + 0x106000]
mov eax, dword [edi]
or eax, eax
je 0x5094df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13fb34]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13fc80]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x509494
mov ecx, edi
jns 0x5094c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13fc88]
or eax, eax
je 0x5094d9
mov dword [ebx], eax
add ebx, 4
jmp 0x5094b1
call dword [esi + 0x13fc84]
mov ebp, dword [esi + 0x13fc8c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x509513
sub esp, 0xffffff80
jmp 0x492ea3
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x75044704
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x39ef6d45
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x100012a3
Capabilities:
Check if file exists
Delete file

Disassembly:
jmp 0x1002e9d0
jmp fcn.1000224d

Function at 0x10001483
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x1000d580
cmp dword [eax], ebx
je 0x1000d5ac
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1000d5a7
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1000d591
and ecx, 0xfff
dec dword [edi]
add byte [eax], al
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1000d599
cmp edx, ebx
jne 0x1000d6e7
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1000d568
add eax, dword [eax + 4]
jmp 0x1000d555
mov dword [ebp + 0xc], ebx
jmp 0x1000d5b7
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000d5cf
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1000d5ed
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1000d64b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000d632
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1000d63b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000d645
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1000d627
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1000d5b1
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1000d698
dec eax
je 0x1000d68f
sub eax, 3
je 0x1000d686
mov dword [ebp - 4], 0x40
jmp 0x1000d6b5
mov dword [ebp - 4], 4
jmp 0x1000d69b
mov dword [ebp - 4], 0x20
jmp 0x1000d69b
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1000d6e7
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1000d667
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1000cef8
adc dword [esi - 0x7b], ebx
retf 0x75ff
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100021e4
Capabilities:
Query environment variable

Disassembly:
jmp 0x10011550
push edi
push 0x60
call sym.sentry.dll_sentry_malloc
mov edi, eax
add esp, 4
test edi, edi
jne 0x10011563
pop edi
ret
push esi
push 0x60
push 0
push edi
call sub.VCRUNTIME140.dll_memset
push str..sentry_native
call fcn.10001ac3
mov esi, dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
push str.SENTRY_DSN
mov dword [edi + 0x24], eax
call esi
push eax
push edi
call sym.sentry.dll_sentry_options_set_dsn
push str.SENTRY_DEBUG
call esi
add esp, 0x20
test eax, eax
je 0x100115cf
mov ecx, 0x100491c8
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100115c2
test dl, dl
je 0x100115be
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100115c2
add eax, 2
add ecx, 2
test dl, dl
jne 0x100115a2
xor eax, eax
jmp 0x100115c7
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100115cf
mov al, 1
jmp 0x100115d1
xor al, al
push str.sentry_http
mov byte [edi + 0x34], al
mov dword [edi + 0x2c], 0x10001a23
mov dword [edi + 0x30], 0
call fcn.10001a00
mov esi, dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
push str.SENTRY_RELEASE
mov dword [edi + 0x20], eax
call esi
push eax
call fcn.10002374
push str.SENTRY_ENVIRONMENT
mov dword [edi + 0xc], eax
call esi
push eax
call fcn.10002374
add esp, 0x14
mov dword [edi + 0x10], eax
mov dword [edi + 0x54], 0xffffffff
mov byte [edi + 0x35], 1
mov word [edi + 0x37], 0
call fcn.10002725
mov dword [edi + 0x50], eax
call fcn.10001ee2
movsd xmm0, qword [0x10048f78]
mov dword [edi + 0x44], eax
mov eax, edi
pop esi
movsd qword [edi], xmm0
mov dword [edi + 0x58], 1
pop edi
ret
Function at 0x100074d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push esi
push edi
call ebx
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push 2
push 0
push dword [ebp + 0x10]
mov dword [eax], 0
call esi
call ebx
push dword [ebp + 0x10]
mov edi, dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov dword [ebp - 4], eax
call ebx
push 0
push 0
push dword [ebp + 0x10]
or edi, dword [eax]
call esi
add esp, 0x1c
call ebx
mov eax, dword [eax]
or eax, edi
jne 0x100075df
mov ebx, dword [ebp - 4]
test ebx, ebx
js 0x100075df
jne 0x10007543
push 3
push dword [ebp + 8]
call fcn.10001096
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10007564
cmp ebx, eax
jbe 0x10007564
push 6
push dword [ebp + 8]
call fcn.10001096
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, dword [ebp + 0xc]
add esp, 4
mov dword [edi], eax
test eax, eax
jne 0x1000758d
push 7
push dword [ebp + 8]
call fcn.10001096
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
test ebx, ebx
jle 0x100075b5
push dword [ebp + 0x10]
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [edi]
add eax, esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x100075c1
add esi, eax
cmp esi, ebx
jl 0x10007593
mov dword [edi + 4], ebx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push dword [ebp + 8]
call fcn.10001096
push dword [edi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push dword [ebp + 8]
call fcn.10001096
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d630
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x1000d580
cmp dword [eax], ebx
je 0x1000d5ac
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1000d5a7
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1000d591
and ecx, 0xfff
dec dword [edi]
add byte [eax], al
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1000d599
cmp edx, ebx
jne 0x1000d6e7
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1000d568
add eax, dword [eax + 4]
jmp 0x1000d555
mov dword [ebp + 0xc], ebx
jmp 0x1000d5b7
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000d5cf
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1000d5ed
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1000d64b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000d632
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1000d63b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000d645
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1000d627
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1000d5b1
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1000d698
dec eax
je 0x1000d68f
sub eax, 3
je 0x1000d686
mov dword [ebp - 4], 0x40
jmp 0x1000d6b5
mov dword [ebp - 4], 4
jmp 0x1000d69b
mov dword [ebp - 4], 0x20
jmp 0x1000d69b
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1000d6e7
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1000d667
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1000cef8
adc dword [esi - 0x7b], ebx
retf 0x75ff
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100119f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10057a58], 0
jne 0x10011a33
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10011a25
push str.SystemFunction036
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10057a54], eax
mov byte [0x10057a58], 1
jmp 0x10011a38
mov eax, dword [0x10057a54]
mov byte [0x10057a58], 1
jmp 0x10011a38
mov eax, dword [0x10057a54]
test eax, eax
je 0x10011a4c
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
test al, al
je 0x10011a4c
xor eax, eax
pop ebp
ret
mov eax, 1
pop ebp
ret

Function at 0x10018d90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10018dd6
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push eax
push esi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10018dc2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0x16
je 0x10018dca
cmp edi, esi
jb 0x10018dd1
add ebx, edi
sub esi, edi
mov eax, dword [ebp + 8]
test esi, esi
jne 0x10018da3
mov eax, dword [ebp + 8]
pop edi
pop ebx
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
add esp, 4
mov eax, esi
pop esi
pop ebp
ret
Function at 0x10018f20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10057034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10019057
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10019057
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10019056
mov ecx, dword [ebx + 0xa8]
test ecx, ecx
je 0x10019056
add ecx, eax
je 0x10019056
cmp dword [ecx + 0xc], 2
jne 0x10019056
mov ecx, dword [ecx + 0x14]
add ecx, eax
mov dword [ebp - 0x4c], ecx
je 0x10019056
cmp dword [ecx], 0x53445352
jne 0x10019056
push esi
lea eax, [ecx + 0x18]
push edi
push eax
call sym.sentry.dll_sentry_value_new_string
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push edx
push eax
push str.debug_file
push edi
push esi
call sym.sentry.dll_sentry_value_set_by_key
mov eax, dword [ebp - 0x4c]
add eax, 4
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.100015d7
movups xmm0, xmmword [eax]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x48]
push eax
movups xmmword [ebp - 0x48], xmm0
call sym.sentry.dll_sentry_uuid_as_string
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 0x14], 0x2d
push dword [eax + 0x14]
lea eax, [ebp - 0x13]
push 0x100499fc
push 0xa
push eax
call fcn.10001c49
lea eax, [ebp - 0x38]
push eax
call sym.sentry.dll_sentry_value_new_string
push edx
push eax
push str.debug_id
push edi
push esi
call sym.sentry.dll_sentry_value_set_by_key
add esp, 0x50
lea eax, [ebp - 0x38]
push dword [ebx + 0x50]
push dword [ebx + 8]
push str._08x_X
push 0x32
push eax
call fcn.10001c49
lea eax, [ebp - 0x38]
push eax
call sym.sentry.dll_sentry_value_new_string
push edx
push eax
push str.code_id
push edi
push esi
call sym.sentry.dll_sentry_value_set_by_key
push 0x10049a20
call sym.sentry.dll_sentry_value_new_string
push edx
push eax
push str.type
push edi
push esi
call sym.sentry.dll_sentry_value_set_by_key
add esp, 0x44
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001811
mov esp, ebp
pop ebp
ret
Function at 0x10020000
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041e1a
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
mov eax, dword [0x10057034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x44]
push ecx
mov ecx, eax
mov dword [ebp - 0x44], 0
call fcn.1001e980
mov esi, dword [eax]
mov dword [eax], 0
mov dword [ebp - 0x4c], esi
mov edi, dword [ebp - 0x44]
mov dword [ebp - 4], 0
test edi, edi
je 0x10020073
mov ecx, edi
call fcn.1001e400
push 0x2c
push edi
call fcn.10001280
add esp, 8
test esi, esi
jne 0x1002007f
lea edi, [esi + 3]
jmp 0x10020161
lea ecx, [ebp - 0x28]
call fcn.10001c71
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push ebx
mov ecx, esi
call fcn.10020200
mov edi, eax
test edi, edi
jne 0x10020159
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1002014e
sub esp, 8
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov ecx, esp
cmovae eax, dword [ebp - 0x28]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.100018bb
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x44], 1
call fcn.1000212b
push eax
push 2
push 0x39d
push str.E:ALIEN_PROJECTS_sentry_native_0.4.6externalcrashpadclientcrash_report_database_win.cc
push str.enum_crashpad::CrashReportDatabase::OperationStatus___thiscall_crashpad::CrashReportDatabaseWin::DeleteReport_const_struct_crashpad::UUID__
lea ecx, [ebp - 0xfc]
call fcn.1000126c
push edi
push str.DeleteFile
push eax
mov dword [ebp - 4], 3
mov dword [ebp - 0x44], 3
call fcn.10001901
add esp, 8
push eax
call fcn.10001ec4
add esp, 8
lea ecx, [ebp - 0xfc]
call fcn.10002473
lea ecx, [ebp - 0x40]
call fcn.10001a73
mov edi, 2
jmp 0x10020159
mov ecx, dword [ebp - 0x48]
push ebx
call fcn.100010b4
xor edi, edi
lea ecx, [ebp - 0x28]
call fcn.100014f6
test esi, esi
je 0x10020177
mov ecx, esi
call fcn.1001e400
push 0x2c
push esi
call fcn.10001280
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001811
mov esp, ebp
pop ebp
ret 4
Function at 0x4e22d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x87000]
push edi
jmp 0x4e22ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e22f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e22e0
mov eax, 1
add ebx, ebx
jne 0x4e2303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e2314
jne 0x4e2333
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e2333
dec eax
add ebx, ebx
jne 0x4e2320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e22f8
add ebx, ebx
jne 0x4e232f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e2385
xor ecx, ecx
sub eax, 3
jb 0x4e234b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e23ba
sar eax, 1
mov ebp, eax
jmp 0x4e2356
add ebx, ebx
jne 0x4e2356
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e2324
inc ecx
add ebx, ebx
jne 0x4e2364
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e2324
add ebx, ebx
jne 0x4e2371
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e2366
jne 0x4e2382
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e2366
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e23a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e2396
jmp 0x4e22e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e23a4
add edi, ecx
jmp 0x4e22e6
pop esi
mov edi, esi
mov ecx, 0x3ede
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e23c2
cmp byte [edi], 0x11
jne 0x4e23c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e23c7
lea edi, [esi + 0xdb000]
mov eax, dword [edi]
or eax, eax
je 0x4e243f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe63f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe6570]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e23f4
mov ecx, edi
jns 0x4e2423
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe6574]
or eax, eax
je 0x4e2439
mov dword [ebx], eax
add ebx, 4
jmp 0x4e2411
call dword [esi + 0xe6584]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4e2470
cmp al, 0xef
ja 0x4e2463
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4e2445
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4e2452
mov ebp, dword [esi + 0xe6578]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e24a4
sub esp, 0xffffff80
jmp 0x4276e7