joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d8ed0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.18013ac84
cdqe
add rsp, 0x28
ret

Function at 0x1800d93f0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, [0x1801b5d58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1800d941a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801ae74c]
mov rcx, rbx
mov r14, rax
call fcn.1801438f0
test rax, rax
je 0x1800d947d
mov rcx, rbx
test r14, r14
je 0x1800d9467
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x1800d94b5
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800d94b5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x1800d9578
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x1800d94e0
lea ecx, [rax + 1]
add rcx, rdx
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x1800d956a
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1800d956a
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x1800d9510
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x1800d9524
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1800d9540
mov rcx, rdi
test r14, r14
je 0x1800d9561
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x1800d9567
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.18013e810]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x1800db070
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1801df668]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, rcx
mov rax, qword [rcx]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call fcn.1800c4a60
movzx edx, al
mov rcx, rdi
call fcn.1800ab030
mov rcx, rdi
call fcn.18006ad00
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1800ba940
mov rax, qword [0x1801e97f0]
test rax, rax
je 0x1800db16e
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9, qword [rdi + 0xf0]
mov r8d, dword [rdi + 0xf8]
mov rdx, qword [rdi + 0xe8]
mov ecx, dword [rdi + 0xfc]
call rax
test al, al
je 0x1800db16e
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1800db140
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800db13b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800db2be
call fcn.1800c38fc
mov rcx, rdi
call fcn.1800baa40
nop
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1800da5d0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov eax, dword [reloc.WS2_32.dll_accept]
test al, 4
je 0x1800db1bd
lea rbx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rbx, qword [rsp + 0x50]
mov ecx, 2
call fcn.180128c54
mov r8, rbx
lea rdx, [0x1801adeec]
mov rcx, rax
call fcn.1800dae80
mov ecx, 2
call fcn.180128c54
mov rcx, rax
call fcn.18013da0c
mov eax, dword [reloc.WS2_32.dll_accept]
test al, 2
je 0x1800db26b
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.1800df4e0
cmp qword [rax + 0x18], 8
jb 0x1800db209
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x1800db253
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800db24e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800db2b8
call fcn.1800c38fc
movdqa xmm0, xmmword [0x18015e0c0]
movdqu xmmword [rsp + 0x80], xmm0
xor eax, eax
mov word [rsp + 0x70], ax
cmp dword [rdi + 0xfc], 4
jne 0x1800db277
int3
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1800db140
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800db13b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800db2be
jmp 0x1800db13b
call fcn.180139754
int3
call fcn.180139754
int3
Function at 0x1800dc740
Capabilities:
Write file on windows

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x1800dc750
push rbx
sub rsp, 0x130
mov ebx, 0xffffffff
cmp r8, rbx
cmova r8d, ebx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800dc790
mov rax, 0xffffffffffffffff
add rsp, 0x130
pop rbx
ret
mov dword [rsp + 0x158], ebx
cmp dword [rsp + 0x150], ebx
jne 0x1800dc7ee
lea r8, str.bytes_written___static_cast_DWORD___1_
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x150]
call fcn.1800dd2d0
test rax, rax
je 0x1800dc7ee
mov qword [rsp + 0x20], rax
mov r9d, 0x65
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_util_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::internal::NativeWriteFile_void__const_void__unsigned___int64_
lea rcx, [rsp + 0x30]
call fcn.1800daf60
lea rcx, [rsp + 0x30]
call fcn.1800db070
mov eax, dword [rsp + 0x150]
add rsp, 0x130
pop rbx
ret

Function at 0x1800dc750
Capabilities:
Write file on windows

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x1800dc750
push rbx
sub rsp, 0x130
mov ebx, 0xffffffff
cmp r8, rbx
cmova r8d, ebx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800dc790
mov rax, 0xffffffffffffffff
add rsp, 0x130
pop rbx
ret
mov dword [rsp + 0x158], ebx
cmp dword [rsp + 0x150], ebx
jne 0x1800dc7ee
lea r8, str.bytes_written___static_cast_DWORD___1_
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x150]
call fcn.1800dd2d0
test rax, rax
je 0x1800dc7ee
mov qword [rsp + 0x20], rax
mov r9d, 0x65
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_util_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::internal::NativeWriteFile_void__const_void__unsigned___int64_
lea rcx, [rsp + 0x30]
call fcn.1800daf60
lea rcx, [rsp + 0x30]
call fcn.1800db070
mov eax, dword [rsp + 0x150]
add rsp, 0x130
pop rbx
ret
Function at 0x1800dc800
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x130
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
xor r14d, r14d
mov ebp, 0xffffffff
mov qword [rsp + 0x20], r14
cmp r8, rbp
lea r9, [rsp + 0x160]
cmova edi, ebp
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800dc8e4
mov dword [rsp + 0x168], ebp
cmp dword [rsp + 0x160], ebp
jne 0x1800dc8a8
lea r8, str.bytes_read___static_cast_DWORD___1_
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x160]
call fcn.1800dd2d0
test rax, rax
je 0x1800dc8a8
mov r9d, 0x7e
mov qword [rsp + 0x20], rax
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_util_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::ReadFile_void__void__unsigned___int64_
lea rcx, [rsp + 0x30]
call fcn.1800daf60
lea rcx, [rsp + 0x30]
call fcn.1800db070
cmp dword [rsp + 0x160], 0
jne 0x1800dc90a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x1800dc90a
lea r9, [rsp + 0x160]
mov qword [rsp + 0x20], r14
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800dc851
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x6d
neg eax
sbb rax, rax
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov eax, dword [rsp + 0x160]
jmp 0x1800dc8f2

Function at 0x1800dd120
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x140
mov rbx, rcx
mov dword [rax + 0x10], 0
xor r9d, r9d
lea r8, [rax + 0x18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1800dd1a8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0xf1
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_util_file_file_io_win.cc
lea rdx, str.__int64___cdecl_crashpad::LoggingSeekFile_void____int64_int_
lea rcx, [rsp + 0x30]
call fcn.1800dbc60
nop
mov dword [rsp + 0x158], 4
lea rdx, [0x1801af118]
mov rcx, rax
call fcn.1800aac20
nop
lea rcx, [rsp + 0x30]
call fcn.1800dbce0
xor al, al
add rsp, 0x140
pop rbx
ret
cmp qword [rsp + 0x160], 0
jne 0x1800dd215
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800dd220
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0xfb
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_util_file_file_io_win.cc
lea rdx, str.bool___cdecl_crashpad::LoggingTruncateFile_void__
lea rcx, [rsp + 0x30]
call fcn.1800dbc60
nop
mov dword [rsp + 0x158], 1
lea rdx, [0x1801b2b70]
mov rcx, rax
call fcn.1800aac20
nop
lea rcx, [rsp + 0x30]
call fcn.1800dbce0
xor al, al
add rsp, 0x140
pop rbx
ret
mov al, 1
add rsp, 0x140
pop rbx
ret
Function at 0x1800dfd80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1801df668]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x1800dfdb0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800dfeb1
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800dfdcc
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.1800df490
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x75
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_util_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::IsRegularFile_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.1800dbc60
nop
mov dword [rsp + 0x30], 3
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.1800aac20
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800dfe57
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1800ab2d0
nop
lea rcx, [rsp + 0x50]
call fcn.1800dbce0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x1800dfead
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800dfea8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800dfed2
call fcn.1800c38fc
xor al, al
jmp 0x1800dfeb9
test eax, 0x410
sete al
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1800da5d0
add rsp, 0x180
pop rbx
ret
call fcn.180139754
int3
Function at 0x1800dfee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x1801df668]
xor rax, rsp
mov qword [rsp + 0x178], rax
movzx edi, dl
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x1800dff17
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800e0018
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800dff33
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.1800df490
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x82
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_util_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::IsDirectory_const_class_base::FilePath__bool_
lea rcx, [rsp + 0x50]
call fcn.1800dbc60
nop
mov dword [rsp + 0x30], 3
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.1800aac20
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800dffbe
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1800ab2d0
nop
lea rcx, [rsp + 0x50]
call fcn.1800dbce0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x1800e0023
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800e000f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800e004d
call fcn.1800c38fc
xor al, al
jmp 0x1800e002c
test dil, dil
jne 0x1800e0027
bt eax, 0xa
jae 0x1800e0027
xor al, al
jmp 0x1800e002c
shr eax, 4
and al, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1800da5d0
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret
call fcn.180139754
int3
Function at 0x1800e0060
Capabilities:
Check if file exists
Delete file

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1801df668]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x1800e0090
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800e00b4
and eax, 0x410
cmp eax, 0x410
jne 0x1800e00b4
mov rcx, rbx
call fcn.1800e0830
jmp 0x1800e01c3
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800e00c1
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1800e01c1
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800e00dc
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.1800df490
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, __WSAFDIsSet
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_util_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::LoggingRemoveFile_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.1800dbc60
nop
mov dword [rsp + 0x30], 3
lea rdx, str.DeleteFile
mov rcx, rax
call fcn.1800aac20
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800e0167
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1800ab2d0
nop
lea rcx, [rsp + 0x50]
call fcn.1800dbce0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x1800e01bd
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800e01b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800e01dc
call fcn.1800c38fc
xor al, al
jmp 0x1800e01c3
mov al, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1800da5d0
add rsp, 0x180
pop rbx
ret
call fcn.180139754
int3
Function at 0x1800e0340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x1c0
mov rax, qword [0x1801df668]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x1800e0370
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800e047a
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800e038c
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.1800df490
mov rbx, rax
mov dword [rsp + 0x30], 2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0x75
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_util_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::IsRegularFile_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.1800dbc60
nop
mov dword [rsp + 0x30], 6
lea rdx, str.GetFileAttributes
mov rcx, rax
call fcn.1800aac20
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800e0417
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1800ab2d0
nop
lea rcx, [rsp + 0x50]
call fcn.1800dbce0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x1800e0514
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800e0470
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800e052f
call fcn.1800c38fc
jmp 0x1800e0514
test eax, 0x410
jne 0x1800e0514
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800e0492
mov rcx, qword [rbx]
lea rdx, [rsp + 0x178]
call fcn.180138670
test eax, eax
jne 0x1800e04ad
mov rax, qword [rsp + 0x190]
jmp 0x1800e0516
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, 0xac
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_util_file_filesystem_win.cc
lea rdx, str.unsigned___int64___cdecl_crashpad::GetFileSize_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.1800dbc60
nop
mov dword [rsp + 0x30], 1
lea rdx, str.stat
mov rcx, rax
call fcn.1800aac20
cmp qword [rbx + 0x18], 8
jb 0x1800e04fe
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1800b7350
nop
lea rcx, [rsp + 0x50]
call fcn.1800dbce0
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1800da5d0
add rsp, 0x1c0
pop rbx
ret
call fcn.180139754
int3
Function at 0x1800e0830
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1801df668]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
cmp qword [rcx + 0x18], 8
jb 0x1800e0860
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1800e0960
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800e087b
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.1800df490
mov rbx, rax
mov dword [rsp + 0x30], 1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, Ordinal_50
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_util_file_filesystem_win.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::LoggingRemoveDirectoryImpl_const_class_base::FilePath__
lea rcx, [rsp + 0x50]
call fcn.1800dbc60
nop
mov dword [rsp + 0x30], 3
lea rdx, str.RemoveDirectory
mov rcx, rax
call fcn.1800aac20
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800e0906
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1800ab2d0
nop
lea rcx, [rsp + 0x50]
call fcn.1800dbce0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x1800e095c
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800e0957
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800e097b
call fcn.1800c38fc
xor al, al
jmp 0x1800e0962
mov al, 1
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1800da5d0
add rsp, 0x180
pop rbx
ret
call fcn.180139754
int3
Function at 0x1800e1740
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x140
mov rbx, rcx
mov dword [rsp + 0x158], 0
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx edx, ax
shr dx, 8
cmp al, 6
jb 0x1800e1814
jne 0x1800e1778
cmp dx, 1
jbe 0x1800e1814
mov ecx, dword [0x1801e986c]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1801e9850], eax
jg 0x1800e1828
xor edx, edx
mov r8d, 0x10000000
mov rcx, rbx
call qword [0x1801e9848]
test eax, eax
jne 0x1800e181d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov r9d, reloc.WLDAP32.dll_Ordinal_33
lea r8, str..._src_4c3e2d1c10_1c4f0a1e28.clean_util_win_critical_section_with_debug_info.cc
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::CrashpadInitializeCriticalSectionEx_struct__RTL_CRITICAL_SECTION__unsigned_long_unsigned_long_
lea rcx, [rsp + 0x30]
call fcn.1800dbc60
nop
mov dword [rsp + 0x158], 1
lea rdx, [0x1801af160]
mov rcx, rax
call fcn.1800aac20
nop
lea rcx, [rsp + 0x30]
call fcn.1800dbce0
xor al, al
add rsp, 0x140
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, 1
add rsp, 0x140
pop rbx
ret
lea rcx, [0x1801e9850]
call fcn.1800e0a54
cmp dword [0x1801e9850], 0xffffffff
jne 0x1800e179f
mov r8b, 1
lea rdx, str.::InitializeCriticalSectionEx
lea rcx, str.kernel32.dll
call fcn.1800e1870
mov qword [0x1801e9848], rax
lea rcx, [0x1801e9850]
call fcn.1800e0aec
jmp 0x1800e179f
Function at 0x1800e1d20
Capabilities:
Check os version
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
xor edi, edi
movzx esi, dl
mov rbx, rcx
test dl, dl
je 0x1800e1d6b
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x1800e1d6b
xor ecx, ecx
mov qword [rsp + 0x40], Ordinal_32
mov dword [rsp + 0x54], edi
call fcn.1800e1dc0
mov qword [rsp + 0x48], rax
lea rdi, [rsp + 0x40]
mov dword [rsp + 0x50], 1
cmp qword [rbx + 0x18], 8
jb 0x1800e1d75
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov r9d, 2
mov edx, esi
mov dword [rsp + 0x30], 0
shl edx, 0x13
mov rcx, rbx
or edx, 3
mov dword [rsp + 0x28], 0x200
lea r8d, [r9 + 4]
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret