joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140042c50
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov sil, 1
test r8, r8
je 0x140042cda
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov r12d, 0xffffffff
lea r15, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, r12
mov r8d, 0xffffffff
cmovb r8, rdi
mov dword [rsp + 0x28], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rbx
mov r9, r15
call r13
test eax, eax
je 0x140042cff
mov eax, dword [rsp + 0x28]
cmp rax, r12
je 0x140042d54
add rbx, rax
sub rdi, rax
jne 0x140042c97
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14012ec00
mov eax, esi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [0x140231b60], 2
jg 0x140042d50
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x8c
mov r9d, 2
call fcn.140192990
lea rcx, [rsp + 0x38]
lea rdx, [0x140206214]
mov r8d, 9
call fcn.140167320
mov rcx, rsi
call fcn.140192a10
xor esi, esi
jmp 0x140042cda
int3

Function at 0x1400434d0
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.140130d40
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x140043585
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.14012cc94
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.1400f4ba0
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1400435c0
cmp byte [rsi + 0x17], 0
js 0x1400435ad
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x5f], 0
mov word [rsp + 0x48], 0
cmp byte [rsp + 0x47], 0
jns 0x140043585
mov rcx, qword [rsp + 0x30]
call fcn.14012c25c
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14012ec00
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsi]
call fcn.14012c25c
jmp 0x140043557
Function at 0x140044690
Capabilities:
Clear file content

Disassembly:
push rsi
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x178], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r8, [rsp + 0x170]
mov qword [r8], rax
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140044707
cmp qword [rsp + 0x170], 0
jne 0x140044758
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x14004475c
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14012ec00
mov eax, esi
add rsp, 0x180
pop rsi
ret
cmp dword [0x140231b60], 2
jg 0x140044758
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xf2
mov r9d, 2
call fcn.140192990
lea rcx, [rsp + 0x40]
lea rdx, [0x14020619a]
mov r8d, 0x10
call fcn.140167320
mov rcx, rsi
call fcn.140192a10
xor esi, esi
jmp 0x1400446ec
cmp dword [0x140231b60], 2
jg 0x140044758
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfc
mov r9d, 2
call fcn.140192990
lea rcx, [rsp + 0x40]
lea rdx, [0x1402061ab]
mov r8d, 0xc
jmp 0x14004474b

Function at 0x14004b250
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.14004bc20
mov rax, qword [rsi]
test rax, rax
je 0x14004b2c7
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14004b2ce
lea rcx, [rsp + 0x28]
call fcn.14004b330
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14012ec00
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x14004b2a0
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
je 0x14004b2e6
add rbx, 0x70
cmp rbx, r15
je 0x14004b2a0
jmp 0x14004b2d5
cmp byte [rbx + 0x27], 0
jns 0x14004b2f2
mov rcx, qword [rbx + 0x10]
jmp 0x14004b2f6
lea rcx, [rbx + 0x10]
call r12
test al, 0x10
jne 0x14004b2db
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x14004b31c
mov rcx, r14
mov rdx, rbx
call fcn.140090a20
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x14004b2db
mov rcx, rdi
mov rdx, rbx
call fcn.140090810
mov r14, rax
jmp 0x14004b316
Function at 0x140050d10
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r14, qword [rdx]
mov qword [rdx], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x140050d3a
call fcn.1400b90a0
cmp qword [rsi], r14
je 0x140050d69
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140050dbf
cmp r15, 2
jb 0x140050d61
mov qword [rsi], r14
call fcn.1400b90a0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140050d8e
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400b90a0
mov rbx, qword [rdi]
cmp qword [0x140231c98], 0
je 0x140050dd8
mov rcx, qword [0x140231c98]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [0x140243008]
mov qword [rdi], 0
jmp 0x140050d7f
call fcn.1400b90a0
mov rcx, qword [rsi]
call fcn.14011a250
mov qword [rsi], 0
jmp 0x140050d53
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140200139]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140050e19
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140050e13
call qword [0x140243008]
mov rcx, rax
xor edx, edx
call fcn.140026ae0
jmp 0x140050da0
xor ecx, ecx
mov dl, 1
jmp 0x140050e0c
xor ecx, ecx
jmp 0x140050e0a
Function at 0x140051610
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rcx], 0
mov byte [rcx + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x140051748
lea rcx, [rsp + 0x30]
mov byte [rcx + 0x17], 0x15
lea rax, str.ExitCodeWatcherThread
cmp rcx, rax
ja 0x140051666
lea rcx, [rsp + 0x45]
cmp rcx, rax
ja 0x14005174b
lea rcx, [rsi + 0x10]
movups xmm0, xmmword [str.ExitCodeWatcherThread]
lea rdi, [rsp + 0x30]
movaps xmmword [rdi], xmm0
movabs rax, 0x6461657268547265
mov qword [rdi + 0xd], rax
mov byte [rdi + 0x15], 0
mov rdx, rdi
call fcn.140051780
cmp byte [rdi + 0x17], 0
js 0x140051739
mov dword [rsi + 0x90], 0x103
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x98], 0
test rax, rax
je 0x140051703
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x98]
inc rax
cmp rax, 2
jae 0x14005171b
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400516fb
mov qword [rsi + 0x98], rdi
call fcn.1400b90a0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14012ec00
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
call fcn.1400b90a0
mov rcx, qword [rsi + 0x98]
call fcn.14011a250
mov qword [rsi + 0x98], 0
jmp 0x1400516e5
mov rcx, qword [rsp + 0x30]
call fcn.14012c25c
jmp 0x14005169d
int3
lea rax, str.char_traits::copy_overlapped_range
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__stringchar_traits.h
lea r9, str.__s2_____s1____s2_____s1____n
mov r8d, 0xf3
call fcn.140167880
int3
Function at 0x140051860
Capabilities:
Check if file exists
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rax, qword [rcx + 8]
mov r14d, 8
inc rax
cmp rax, 1
ja 0x1400519e1
mov rdi, rcx
cmp qword [rcx + 0x18], 0
jne 0x1400519e1
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov r14, rax
cmp qword [rdi + 8], rax
je 0x1400518ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi + 8]
inc rax
cmp rax, 2
jae 0x140051a02
mov rax, r14
inc rax
cmp rax, 2
jb 0x1400518e2
mov qword [rdi + 8], r14
call fcn.1400b90a0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140051abc
movabs r12, 0xfffffffc00000000
mov ecx, 0x20
call fcn.14012c264
mov r15, rax
mov qword [rax], rax
mov qword [rax + 8], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov ecx, 0x18
call fcn.14012c264
mov rbx, rax
mov rax, qword [rsi]
mov qword [rsi], 0
mov qword [rbx], r14
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r15
mov rcx, qword [rdi + 0x18]
mov rax, rcx
and rax, r12
cmp rax, qword [0x140219dc8]
je 0x140051a35
mov rax, r15
and rax, r12
cmp rax, qword [0x140219dc8]
je 0x140051a3f
mov qword [rdi + 0x18], r15
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14008f280]
xor r14d, r14d
xor ecx, ecx
xor edx, edx
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
cmp qword [rdi + 0x10], rax
je 0x1400519d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rdi + 0x10]
inc rax
cmp rax, 2
jae 0x140051a1d
mov rax, r15
inc rax
cmp rax, 2
jb 0x1400519cc
mov qword [rdi + 0x10], r15
call fcn.1400b90a0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rdi + 0x10]
inc r15
cmp r15, 1
jbe 0x140051a60
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
jne 0x140051a4c
mov eax, r14d
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400b90a0
mov rcx, qword [rdi + 8]
call fcn.14011a250
mov qword [rdi + 8], 0
jmp 0x1400518cd
call fcn.1400b90a0
mov rcx, qword [rdi + 0x10]
call fcn.14011a250
mov qword [rdi + 0x10], 0
jmp 0x1400519b7
call fcn.1400b2070
jmp 0x14005195a
mov rcx, r15
call fcn.1400b1f30
jmp 0x14005196d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [0x140243008]
jmp 0x1400519f0
mov rcx, qword [rdi + 0x18]
and r12, rcx
cmp r12, qword [0x140219dc8]
jne 0x140051a75
call fcn.1400b2070
mov qword [rdi + 0x18], 0
test rbx, rbx
je 0x140051abc
mov rdi, qword [rbx + 0x10]
mov qword [rbx + 0x10], 0
test rdi, rdi
je 0x140051aa3
mov rcx, rdi
call fcn.14009cdf0
mov rcx, rdi
call fcn.14012c25c
mov rcx, qword [rbx + 8]
mov qword [rbx + 8], 0
test rcx, rcx
jne 0x140051ac7
mov rcx, rbx
call fcn.14012c25c
mov r14d, 0x3b
jmp 0x1400519e1
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [0x140243008]
jmp 0x140051ab4
Function at 0x1400555c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14005562b
mov dl, byte [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x140243008]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rsi], rdi
test al, al
jns 0x14005560d
call fcn.14012c25c
jmp 0x14005560d
mov rax, qword [r9 + 0x30]
lea rcx, [rbp - 0x20]
mov qword [rcx], rax
mov qword [rbp - 8], rax
lock inc dword [rax + 8]
lea rdx, [0x140230938]
call fcn.1400b9e30
mov r14, rax
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140055670
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140243008]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rbp - 0x20]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1401ee3a0]
movaps xmmword [rbx], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [0x140243008]
movzx eax, byte [rbx + 0x17]
test al, al
js 0x1400556b7
mov edx, eax
and edx, 0x7f
jmp 0x1400556bb
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
test rdx, rdx
je 0x14005561d
test al, al
cmovns rcx, rbx
mov r14, rcx
jmp 0x140055717
movzx edx, al
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [0x140243008]
cmp eax, 0xffffffff
jne 0x1400556ed
xor edi, edi
inc r14
movzx eax, byte [rbp - 9]
mov edx, eax
and edx, 0x7f
test al, al
mov rcx, qword [rbp - 0x20]
mov r8, rbx
cmovs rdx, qword [rbp - 0x18]
cmovs r8, rcx
add rdx, r8
cmp r14, rdx
je 0x14005561d
test rdi, rdi
je 0x1400556eb
mov al, byte [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x1400556d3
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
jmp 0x1400556ed
Function at 0x140058e60
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140058ea9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140058ec5
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140058ea1
mov qword [rsi], rdi
call fcn.1400b90a0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140058f37
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400b90a0
mov r14, qword [rsi]
cmp qword [0x140231c98], 0
je 0x140058ef6
mov rcx, qword [0x140231c98]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x140243008]
mov qword [rsi], 0
jmp 0x140058e8f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140200139]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140058f3a
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140058f31
call qword [0x140243008]
mov rcx, rax
xor edx, edx
call fcn.140026ae0
jmp 0x140058ed7
xor ecx, ecx
mov dl, 1
jmp 0x140058f2a
int3
xor ecx, ecx
jmp 0x140058f28
Function at 0x140058f40
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov qword [rdx], 0
lea r12, [r15 + 1]
cmp r12, 2
jb 0x140058f6c
call fcn.1400b90a0
mov qword [rsi], 0
test r15, r15
je 0x140058fa2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140058ffa
cmp r12, 2
jb 0x140058f9a
mov qword [rsi], r15
call fcn.1400b90a0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140058fc9
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400b90a0
mov rbx, qword [rdi]
cmp qword [0x140231c98], 0
je 0x14005902e
mov rcx, qword [0x140231c98]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [0x140243008]
mov qword [rdi], 0
jmp 0x140058fb8
call fcn.1400b90a0
mov r14, qword [rsi]
cmp qword [0x140231c98], 0
je 0x140059072
mov rcx, qword [0x140231c98]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x140243008]
mov qword [rsi], 0
jmp 0x140058f8c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140200139]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400590b6
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14005906c
call qword [0x140243008]
mov rcx, rax
xor edx, edx
call fcn.140026ae0
jmp 0x140058fdb
xor ecx, ecx
mov dl, 1
jmp 0x140059062
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140200139]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400590ba
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x1400590b0
call qword [0x140243008]
mov rcx, rax
xor edx, edx
call fcn.140026ae0
jmp 0x14005900c
xor ecx, ecx
mov dl, 1
jmp 0x1400590a6
xor ecx, ecx
jmp 0x140059060
xor ecx, ecx
jmp 0x1400590a4
Function at 0x1400592c0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rsi, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [0x1401ee3a0]
lea rbx, [rsp + 0x60]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DoDeleteFile
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r9d, 0x106
call fcn.1400ba440
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.1400d84a0
movzx eax, byte [rsi + 0x17]
mov edx, eax
and edx, 0x7f
test al, al
mov rcx, qword [rsi + 8]
cmovs rdx, rcx
test rdx, rdx
je 0x1400593fa
test al, al
jns 0x140059356
cmp rcx, 0x103
ja 0x140059456
mov rcx, rsi
mov rdx, rdi
call fcn.1400fd680
movzx eax, byte [rsp + 0x57]
mov edx, eax
and edx, 0x7f
test al, al
cmovs rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmovs rdi, rcx
test rdx, rdx
je 0x140059471
lea r8, [rdi + rdx*2]
add rdx, rdx
mov r9, rdi
movzx r10d, word [r9]
cmp r10d, 0x2a
je 0x1400593ac
cmp r10d, 0x3f
je 0x1400593ac
add r9, 2
add rdx, 0xfffffffffffffffe
jne 0x14005938f
mov r9, r8
cmp r9, r8
sete dl
sub r9, rdi
cmp r9, 0xfffffffffffffffe
sete bl
or bl, dl
test al, al
jns 0x1400593c7
call fcn.14012c25c
test bl, bl
je 0x140059483
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400593db
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140059424
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
and eax, 0xfffffffe
cmp eax, 2
jne 0x1400594d1
lea rcx, [rsp + 0x60]
call fcn.1400ae170
mov dil, 1
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14012ec00
mov eax, edi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
mov edi, eax
test dil, 1
jne 0x1400594eb
cmp byte [rsi + 0x17], 0
jns 0x140059439
mov rsi, qword [rsi]
mov rcx, rsi
test dil, 0x10
je 0x14005944e
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400593fa
jmp 0x1400593e6
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140059448
lea rcx, [rsp + 0x60]
call fcn.1400ae170
mov esi, 0xa1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x140059407
test al, al
jns 0x1400593cf
call fcn.14012c25c
jmp 0x1400593cf
lea rdi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rdi
call fcn.1400fd680
lea rbx, [rsp + 0x28]
mov rcx, rsi
mov rdx, rbx
call fcn.1400fddd0
mov rcx, rbx
mov rdx, rdi
call fcn.14001b490
mov esi, eax
cmp byte [rbx + 0x17], 0
jns 0x1400594c0
mov rcx, qword [rsp + 0x28]
call fcn.14012c25c
cmp byte [rsp + 0x57], 0
jns 0x1400594d1
mov rcx, qword [rsp + 0x40]
call fcn.14012c25c
lea rcx, [rsp + 0x60]
call fcn.1400ae170
mov dil, 1
test esi, esi
je 0x140059407
jmp 0x140059465
mov edx, edi
and edx, 0xfffffffe
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400594fc
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140059430
jmp 0x1400593e6
Function at 0x140059510
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [0x1401ee3a0]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x20b
call fcn.1400ba440
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1400d84a0
cmp byte [rdi + 0x17], 0
jns 0x140059582
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.1400ae170
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14012ec00
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400595c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rbx, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x1401ee3a0]
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x40]
mov rcx, r14
mov r9d, 0x214
call fcn.1400ba440
xor esi, esi
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.1400d84a0
cmp byte [rbx + 0x17], 0
jns 0x140059636
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400596e9
test al, 0x10
mov eax, 0x40000000
mov edx, 2
cmove edx, eax
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
xor edi, edi
mov rcx, rbx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x1400596b3
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp rbx, 0xffffffffffffffff
je 0x140059712
call fcn.1400b90a0
mov rdi, rbx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
setne sil
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400596e9
call fcn.1400b90a0
cmp qword [0x140231c98], 0
je 0x140059716
mov rcx, qword [0x140231c98]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [0x140243008]
lea rcx, [rsp + 0x60]
call fcn.1400ae170
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14012ec00
mov eax, esi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
xor edi, edi
jmp 0x1400596ab
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140200139]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140059757
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140059751
call qword [0x140243008]
mov rcx, rax
xor edx, edx
call fcn.140026ae0
jmp 0x1400596d3
xor ecx, ecx
mov dl, 1
jmp 0x14005974a
xor ecx, ecx
jmp 0x140059748