joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005e150
Capabilities:
Clear file content

Disassembly:
push rsi
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0x178], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r8, [rsp + 0x170]
mov qword [r8], rax
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14005e1cb
cmp qword [rsp + 0x170], 0
jne 0x14005e266
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x14005e215
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1401756e0
mov eax, esi
add rsp, 0x180
pop rsi
ret
cmp dword [0x140299b30], 2
jg 0x14005e266
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xf1
mov r9d, 2
call fcn.1401d2730
lea rcx, [rsp + 0x40]
lea rdx, [0x1402734f5]
mov r8d, 0x10
jmp 0x14005e259
cmp dword [0x140299b30], 2
jg 0x14005e266
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfb
mov r9d, 2
call fcn.1401d2730
lea rcx, [rsp + 0x40]
lea rdx, [0x140273506]
mov r8d, 0xc
call fcn.1401af730
mov rcx, rsi
call fcn.1401d27b0
xor esi, esi
jmp 0x14005e1b0

Function at 0x14005e330
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x298
mov rsi, rcx
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0x290], rax
lea rbx, [rsp + 0x80]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.140177800
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
add edi, 0xfffffefc
cmp edi, 0xfffffefd
jb 0x14005e434
lea r14, [rsp + 0x28]
mov qword [r14], rbx
mov rcx, rbx
call fcn.140173694
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov rdx, r14
call fcn.140133380
movaps xmm0, xmmword [0x140261350]
lea r14, [rsp + 0x50]
movaps xmmword [r14], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [r14 + 0x10], rax
movzx eax, byte [rbx + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rbx]
cmovns rax, rbx
lea rdx, [rsp + 0x70]
mov qword [rdx], rax
cmovs rcx, qword [rbx + 8]
mov qword [rdx + 8], rcx
mov rcx, r14
call fcn.140133380
mov rcx, r14
call fcn.140133270
cmp byte [rsi + 0x17], 0
js 0x14005e45c
mov rax, qword [rsp + 0x60]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x67], 0
mov word [rsp + 0x50], 0
cmp byte [rsp + 0x4f], 0
jns 0x14005e434
mov rcx, qword [rsp + 0x38]
call fcn.140172a44
cmp edi, 0xfffffefd
setae bl
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1401756e0
mov eax, ebx
add rsp, 0x298
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsi]
call fcn.140172a44
jmp 0x14005e406
Function at 0x14005ee30
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov sil, 1
test r8, r8
je 0x14005eeba
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov r12d, 0xffffffff
lea r15, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, r12
mov r8d, 0xffffffff
cmovb r8, rdi
mov dword [rsp + 0x28], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rbx
mov r9, r15
call r13
test eax, eax
je 0x14005eedf
mov eax, dword [rsp + 0x28]
cmp rax, r12
je 0x14005ef34
add rbx, rax
sub rdi, rax
jne 0x14005ee77
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1401756e0
mov eax, esi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [0x140299b30], 2
jg 0x14005ef30
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x8c
mov r9d, 2
call fcn.1401d2730
lea rcx, [rsp + 0x38]
lea rdx, [0x14027356f]
mov r8d, 9
call fcn.1401af730
mov rcx, rsi
call fcn.1401d27b0
xor esi, esi
jmp 0x14005eeba
int3
Function at 0x14005f820
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov qword [rdx], 0
lea r12, [r15 + 1]
cmp r12, 2
jb 0x14005f84c
call fcn.1400f24d0
mov qword [rsi], 0
test r15, r15
je 0x14005f882
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14005f8a9
cmp r12, 2
jb 0x14005f87a
mov qword [rsi], r15
call fcn.1400f24d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14005f8da
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400f24d0
mov r14, qword [rsi]
cmp qword [0x1402a1a18], 0
je 0x14005f90b
mov rcx, qword [0x1402a1a18]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x1401d7990.0]
mov qword [rsi], 0
jmp 0x14005f86c
call fcn.1400f24d0
mov rbx, qword [rdi]
cmp qword [0x1402a1a18], 0
je 0x14005f94f
mov rcx, qword [0x1402a1a18]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [case.0x1401d7990.0]
mov qword [rdi], 0
jmp 0x14005f898
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14026b3c1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005f993
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14005f949
call qword [case.0x1401d7990.0]
mov rcx, rax
xor edx, edx
call fcn.14003cbf0
jmp 0x14005f8bb
xor ecx, ecx
mov dl, 1
jmp 0x14005f93f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14026b3c1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005f997
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14005f98d
call qword [case.0x1401d7990.0]
mov rcx, rax
xor edx, edx
call fcn.14003cbf0
jmp 0x14005f8ec
xor ecx, ecx
mov dl, 1
jmp 0x14005f983
xor ecx, ecx
jmp 0x14005f93d
xor ecx, ecx
jmp 0x14005f981
Function at 0x140062b70
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov r15, qword [rsp + 0x120]
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rax, qword [rcx]
inc rax
cmp rax, 1
ja 0x140062d2a
mov edi, r9d
mov r14d, edx
mov rsi, rcx
xor ecx, ecx
mov rdx, r8
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov rbx, rax
cmp qword [rsi], rax
je 0x140062bfe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140062d07
mov rax, rbx
inc rax
cmp rax, 2
jb 0x140062bf3
mov qword [rsi], rbx
call fcn.1400f24d0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsi]
lea rax, [rbx + 1]
cmp rax, 1
jbe 0x140062d31
xor r12d, r12d
lea rcx, [rsp + 0x28]
mov r8d, 0x90
xor edx, edx
call fcn.140177800
test r14d, r14d
jne 0x140062cd6
mov eax, 0xff
mov edx, 0x408
mov dword [rsp + 0x50], 1
mov r12d, edx
mov r8d, eax
mov ecx, r12d
mov dword [rsp + 0x20], r8d
mov r12d, r8d
test r15, r15
je 0x140062c60
or ecx, 0x100
mov qword [rsp + 0x98], r15
or ecx, 0x2000
mov dword [rsp + 0x38], ecx
lea r8, [rsp + 0x28]
mov rcx, rbx
mov edx, 9
mov r9d, 0x90
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x140062d20
not edi
and r12d, edi
lea r8, [rsp + 0x20]
mov dword [r8], r12d
mov rcx, qword [rsi]
mov edx, 4
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor ebp, ebp
test eax, eax
je 0x140062d20
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1401756e0
mov eax, ebp
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
dec r14d
cmp r14d, 3
ja case.default.0x140062d04
mov ebp, 0xa0
mov r8d, 0xc8
mov eax, 0xd8
mov edx, 8
lea rcx, [0x140062d5c]
movsxd r9, dword [rcx + r14*4]
add r9, rcx
xor ecx, ecx
jmp r9
call fcn.1400f24d0
mov rcx, qword [rsi]
call fcn.1401571e0
mov qword [rsi], 0
jmp 0x140062bdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp case.0x140062d04.4
mov ebp, 0x4df
jmp case.0x140062d04.4
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1401756e0
nop
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x140065400
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.140065e20
mov rax, qword [rsi]
test rax, rax
je 0x140065477
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14006547e
lea rcx, [rsp + 0x28]
call fcn.1400654e0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401756e0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140065450
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
je 0x140065496
add rbx, 0x70
cmp rbx, r15
je 0x140065450
jmp 0x140065485
cmp byte [rbx + 0x27], 0
jns 0x1400654a2
mov rcx, qword [rbx + 0x10]
jmp 0x1400654a6
lea rcx, [rbx + 0x10]
call r12
test al, 0x10
jne 0x14006548b
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
je 0x1400654cc
mov rcx, r14
mov rdx, rbx
call fcn.1400c50f0
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x14006548b
mov rcx, rdi
mov rdx, rbx
call fcn.1400c4ed0
jmp 0x14006548b
Function at 0x140068ba0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rcx], 0
mov byte [rcx + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x140068c9c
lea rdi, [rsi + 0x10]
lea rdx, str.ExitCodeWatcherThread
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.1401af190
mov rcx, rdi
mov rdx, rbx
call fcn.140068cb0
cmp byte [rbx + 0x17], 0
js 0x140068c9f
mov dword [rsi + 0x98], 0x103
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0xa0], 0
test rax, rax
je 0x140068c66
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0xa0]
inc rax
cmp rax, 2
jae 0x140068c7e
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140068c5e
mov qword [rsi + 0xa0], rdi
call fcn.1400f24d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401756e0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.1400f24d0
mov rcx, qword [rsi + 0xa0]
call fcn.1401571e0
mov qword [rsi + 0xa0], 0
jmp 0x140068c48
int3
mov rcx, qword [rsp + 0x20]
call fcn.140172a44
jmp 0x140068c00
Function at 0x14006a3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14006a41d
mov dl, byte [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [case.0x1401d7990.0]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rax, qword [r9 + 0x30]
lea rbx, [rbp - 0x20]
mov qword [rbx], rax
mov qword [rbp - 8], rax
lock inc dword [rax + 8]
lea rdx, [0x140298da0]
mov rcx, rbx
call fcn.140157260
mov r14, rax
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x14006a465
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1401d7990.0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [0x140261350]
movaps xmmword [rbp - 0x20], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [case.0x1401d7990.0]
mov al, byte [rbp - 9]
test al, al
mov rcx, qword [rbp - 0x20]
mov r14, rbx
cmovs r14, rcx
mov rdx, rbx
test al, al
cmovs rdx, rcx
js 0x14006a4de
movzx eax, al
add rdx, rax
cmp r14, rdx
je 0x14006a50f
test rdi, rdi
je 0x14006a501
mov al, byte [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14006a4e9
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
jmp 0x14006a503
add rdx, qword [rbp - 0x18]
cmp r14, rdx
jne 0x14006a4c0
jmp 0x14006a517
movzx edx, al
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [case.0x1401d7990.0]
cmp eax, 0xffffffff
jne 0x14006a503
xor edi, edi
inc r14
mov al, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
jmp 0x14006a4aa
mov qword [rsi], rdi
jmp 0x14006a40d
mov qword [rsi], rdi
call fcn.140172a44
jmp 0x14006a40d
Function at 0x140073820
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4b8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x450]
mov qword [r15 + 0x50], rax
movaps xmm0, xmmword [0x140261350]
movaps xmmword [r15 + 0x40], xmm0
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, [0x140265fee]
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x240]
mov rcx, r14
mov r9d, 0x196
call fcn.14011b9f0
mov rcx, r15
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call fcn.14010e570
test byte [0x140289010], 0x19
jne 0x140073a09
lea rcx, [rsp + 0x240]
mov r8d, 0x208
mov dl, 0xaa
call fcn.140177800
cmp byte [rbx + 0x17], 0
mov rax, rbx
jns 0x1400738e2
mov rax, qword [rbx]
xor ecx, ecx
movzx edx, word [rax + rcx*2]
mov word [rsp + rcx*2 + 0x240], dx
test dx, dx
je 0x14007390b
inc rcx
cmp rcx, 0x104
jne 0x1400738e4
mov word [rsp + 0x446], 0
lea rcx, [rsp + 0x240]
call fcn.1400f24c0
lea rcx, [rsp + 0x30]
mov r8d, 0x208
mov dl, 0xaa
call fcn.140177800
cmp byte [rdi + 0x17], 0
mov rax, rdi
jns 0x140073936
mov rax, qword [rdi]
xor ecx, ecx
movzx edx, word [rax + rcx*2]
mov word [rsp + rcx*2 + 0x30], dx
test dx, dx
je 0x14007395c
inc rcx
cmp rcx, 0x104
jne 0x140073938
mov word [rsp + 0x236], 0
lea rcx, [rsp + 0x30]
call fcn.1400f24c0
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x140073972
mov rdx, qword [rbx]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x14007397e
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x140073a04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140015f60
mov ebp, eax
cmp byte [rdi + 0x17], 0
jns 0x1400739b1
mov rdi, qword [rdi]
cmp byte [rbx + 0x17], 0
jns 0x1400739ba
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dil
test rsi, rsi
je 0x1400739d5
test eax, eax
je 0x140073a22
lea rcx, [rsp + 0x450]
call fcn.140140790
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.1401756e0
mov eax, edi
add rsp, 0x4b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dil, 1
jmp 0x1400739d5
lea rdx, [rsp + 0x30]
mov qword [rdx], r14
lea rcx, str.ScopedBlockingCall
call fcn.1401d6b20
jmp 0x1400738c1
cmp ebp, 0xfffffffc
jne 0x140073a2e
call fcn.1401d7180
mov ebp, eax
mov dword [rsi], ebp
xor edi, edi
jmp 0x1400739d5
Function at 0x140073a40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rsi, rcx
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x50]
mov qword [rbx + 0x50], rax
movaps xmm0, xmmword [0x140261350]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x1c9
call fcn.14011b9f0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call fcn.14010e570
test byte [0x140289010], 0x19
jne 0x140073b06
cmp byte [rsi + 0x17], 0
jns 0x140073ad0
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
lea rcx, [rsp + 0x50]
call fcn.140140790
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401756e0
mov eax, ebx
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x48]
mov qword [rdx], rdi
lea rcx, str.ScopedBlockingCall
call fcn.1401d6b20
jmp 0x140073ac7

Function at 0x140073b20
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov esi, r9d
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0x60]
mov qword [r12 + 0x50], rax
movaps xmm0, xmmword [0x140261350]
movaps xmmword [r12 + 0x40], xmm0
movaps xmmword [r12 + 0x30], xmm0
movaps xmmword [r12 + 0x20], xmm0
movaps xmmword [r12 + 0x10], xmm0
movaps xmmword [r12], xmm0
lea rdx, str.Read
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x3e
call fcn.14011b9f0
mov rcx, r12
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call fcn.14010e570
test byte [0x140289010], 0x19
jne 0x140073c53
mov ebp, 0xffffffff
test r14, r14
js 0x140073c12
test esi, esi
js 0x140073c12
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
lea r9, [rsp + 0x58]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140073c40
mov ebp, dword [rsp + 0x58]
test ebp, ebp
js 0x140073c6c
lea rcx, [rsp + 0x60]
call fcn.140140790
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1401756e0
mov eax, ebp
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
cmp eax, 0x26
setne bpl
neg ebp
jmp 0x140073c12
lea rdx, [rsp + 0x58]
mov qword [rdx], r15
lea rcx, str.ScopedBlockingCall
call fcn.1401d6b20
jmp 0x140073bc6
int3
Function at 0x140073c80
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x50]
mov qword [r15 + 0x50], rax
movaps xmm0, xmmword [0x140261350]
movaps xmmword [r15 + 0x40], xmm0
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x28]
mov rcx, r14
mov r9d, 0x93
call fcn.14011b9f0
mov rcx, r15
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call fcn.14010e570
test byte [0x140289010], 0x19
jne 0x140073d76
test esi, esi
js 0x140073d8c
lea r14, [rsp + 0x28]
mov dword [r14], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [r14]
lea rcx, [rsp + 0x50]
call fcn.140140790
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401756e0
mov eax, esi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rdx, [rsp + 0x48]
mov qword [rdx], r14
lea rcx, str.ScopedBlockingCall
call fcn.1401d6b20
jmp 0x140073d16
mov esi, 0xffffffff
jmp 0x140073d4b
Function at 0x140074080
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rax, qword [0x140287028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rcx]
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400741fd
mov rdi, rcx
cmp dword [rcx + 8], 1
jne 0x140074201
mov qword [rdi], 0
call fcn.1400f24d0
test rsi, rsi
je 0x1400740dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.1400f24d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 5
mov rcx, rax
mov rdx, rsi
mov r8, rax
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ebx, eax
test eax, eax
je 0x14007415e
mov r14, qword [rsp + 0x40]
cmp qword [rdi], r14
je 0x140074157
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400741a3
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14007414f
mov qword [rdi], r14
call fcn.1400f24d0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rdi + 8], 0
test ebx, ebx
setne dil
call fcn.1400f24d0
cmp qword [0x1402a1a18], 0
je 0x1400741b9
mov rcx, qword [0x1402a1a18]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rsi
call qword [case.0x1401d7990.0]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401756e0
mov eax, edi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400f24d0
mov rcx, qword [rdi]
call fcn.1401571e0
mov qword [rdi], 0
jmp 0x14007413d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14026b3c1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140074204
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x1400741f7
call qword [case.0x1401d7990.0]
mov rcx, rax
xor edx, edx
call fcn.14003cbf0
jmp 0x140074173
xor ecx, ecx
mov dl, 1
jmp 0x1400741ed
xor edi, edi
jmp 0x140074189
int3
xor ecx, ecx
jmp 0x1400741eb
Function at 0x1400743c0
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, 2
cmp rcx, 1
jne 0x1400743f2
mov rdi, qword [0x14029b7f8]
cmp rsi, rdi
jbe 0x140074400
lea rcx, [0x14029b7f0]
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400302b0
lea rax, [rcx - 1]
test rcx, rax
jne 0x140074419
mov rsi, rcx
jmp 0x1400743d1
jae 0x140074506
mov rax, qword [0x14029b808]
test rax, rax
js 0x140074423
cvtsi2ss xmm0, rax
jmp 0x140074438
call fcn.14010a4c0
mov rsi, rax
jmp 0x1400743d1
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x14029b810]
call fcn.140190fd4
cvttss2si rax, xmm0
mov rcx, rax
subss xmm0, dword [0x14024eb68]
cvttss2si rdx, xmm0
sar rcx, 0x3f
and rdx, rcx
or rdx, rax
cmp rdi, 3
jb 0x1400744ee
mov rax, rdi
shr rax, 1
movabs rcx, 0x5555555555555555
and rcx, rax
mov rax, rdi
sub rax, rcx
movabs rcx, 0x3333333333333333
mov r8, rax
shr r8, 2
and rax, rcx
and r8, rcx
add r8, rax
mov rax, r8
shr rax, 4
add rax, r8
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rax
movabs rax, 0x101010101010101
imul rax, rcx
shr rax, 0x38
cmp eax, 1
ja 0x1400744ee
lea rax, [rdx - 1]
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
cmp rdx, 2
cmovb rax, rdx
jmp 0x1400744f6
mov rcx, rdx
call fcn.14010a4c0
cmp rsi, rax
cmovbe rsi, rax
cmp rsi, rdi
jb 0x1400743dd
add rsp, 0x28
pop rdi
pop rsi
ret