joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005ed90
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
mov byte [rsp + 0x37], r8b
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x570], rax
lea r14, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov r8d, 0x2c8
mov rcx, r14
mov dl, 0xaa
call fcn.1400ffb20
mov qword [rsp + 0x20], rsi
xor ebp, ebp
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.14005f330
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1402103c0]
movaps xmmword [rdi], xmm0
mov rcx, r14
mov rdx, rdi
call fcn.14005f570
movsx rax, byte [rdi + 0x17]
test rax, rax
jns 0x14005ee2a
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14005eefe
lea r14, [rsp + 0x58]
lea r15, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
xor r13d, r13d
mov r8d, 0x250
mov rcx, r14
mov dl, 0xaa
call fcn.1400ffb20
mov rcx, r15
mov rdx, r14
call fcn.14005f520
mov edx, dword [rsp + 0x58]
test dl, 1
jne 0x14005ef3b
mov rcx, r14
call fcn.14005f2a0
test al, al
jne 0x14005ef90
cmp byte [rsp + 0x57], 0
mov rcx, rdi
jns 0x14005ee98
mov rcx, qword [rsp + 0x40]
call r12
test eax, eax
jne 0x14005ef89
call rbx
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
test r13d, r13d
cmovne ebp, r13d
mov rcx, r14
call fcn.1400248b0
mov rcx, r15
mov rdx, r14
call fcn.14005f570
mov rcx, rdi
mov rdx, r14
call fcn.140068ec0
mov rcx, r14
call fcn.1400dc710
movsx rax, byte [rsp + 0x57]
test rax, rax
jns 0x14005eef2
mov rax, qword [rsp + 0x48]
mov r13d, ebp
test rax, rax
jne 0x14005ee51
lea rcx, [rsp + 0x40]
call fcn.1400dc710
lea rcx, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
call fcn.14005f4b0
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, ebp
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [rsp + 0x37], 0
je 0x14005ef63
cmp byte [rsp + 0x57], 0
js 0x14005ef50
lea rcx, [rsp + 0x40]
jmp 0x14005ef55
mov rcx, qword [rsp + 0x40]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x14005ee79
lea rcx, [rsp + 0x58]
call fcn.14005f2a0
test al, al
jne 0x14005ef77
mov edx, dword [rsp + 0x58]
jmp 0x14005ef42
lea rcx, [rsp + 0x58]
call fcn.14005f2a0
test al, al
je 0x14005ee89
xor ebp, ebp
jmp 0x14005eeb5
xor ebp, ebp
cmp byte [rsp + 0x37], 0
je 0x14005eeb5
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rcx
mov rdx, rsi
mov r8b, 1
call fcn.14005ed90
mov ebp, eax
test eax, eax
jne 0x14005eeb5
cmp byte [rsp + 0x57], 0
jns 0x14005efcd
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x14005eeb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
cmp ecx, 2
cmovne ebp, eax
jmp 0x14005eeb5
Function at 0x140060020
Capabilities:
Get file version info

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x1402103c0]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.CreateFileVersionInfoWin
lea r8, str....._base_file_version_info_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x4d
call fcn.1400dc390
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.1400d1670
mov dword [rsp + 0x2c], 0xaaaaaaaa
cmp byte [rbx + 0x17], 0
jns 0x1400600a6
mov rbx, qword [rbx]
lea rdx, [rsp + 0x2c]
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x1400600d3
mov ebp, eax
mov r14d, eax
mov rcx, r14
call fcn.1400fc2cc
mov rdi, rax
lea r15, [rax + r14]
xor r12d, r12d
jmp 0x140060219
mov qword [rsi], 0
jmp 0x1400601e8
mov edx, dword [rsp + 0x2c]
mov rcx, rbx
mov r8d, ebp
mov r9, rdi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140060244
lea r8, [rsp + 0x30]
mov qword [r8], 0
lea r9, [rsp + 0x9c]
mov dword [r9], 0xaaaaaaaa
lea rdx, str.VarFileInfoTranslation
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140060244
mov rbp, qword [rsp + 0x30]
test rbp, rbp
je 0x140060244
add r12, rdi
mov ecx, 0x38
call fcn.1400fc2cc
mov rbx, rax
movzx r13d, word [rbp]
movzx ebp, word [rbp + 2]
lea rax, fcn.140060310
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r15
movabs r14, 0xfffffffc00000000
mov rax, rdi
and rax, r14
cmp rax, qword [0x140251888]
jne 0x140060189
mov rcx, rdi
call fcn.1400dfd90
mov qword [rbx + 0x20], rdi
mov word [rbx + 0x28], r13w
mov word [rbx + 0x2a], bp
lea r8, [rsp + 0x30]
mov qword [r8], 0
lea r9, [rsp + 0x9c]
mov dword [r9], 0xaaaaaaaa
lea rdx, [0x140223112]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14006026b
mov rdi, qword [rsp + 0x30]
and r14, rdi
cmp r14, qword [0x140251888]
jne 0x1400601e1
mov rcx, rdi
call fcn.1400dfd90
mov qword [rbx + 0x30], rdi
mov qword [rsi], rbx
lea rcx, [rsp + 0x50]
call fcn.1400d16f0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400fd9d0
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, rdi
add rax, r12
je 0x140060231
mov byte [rax], 0
inc r12
cmp r14, r12
jne 0x140060219
jmp 0x1400600df
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.140139400
mov qword [rsi], 0
test rdi, rdi
je 0x1400601e8
dec r15
cmp r15, r14
jae 0x14006026e
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.140139400
int3
mov rcx, rdi
call fcn.1400fc308
jmp 0x1400601e8
Function at 0x140061760
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0xc8], rax
test rcx, rcx
je 0x140061910
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
xor r8d, r8d
call fcn.14011ce70
movaps xmm6, xmmword [0x1402103c0]
lea r14, [rsp + 0x80]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.ReadStreamToSpanWithMaxSize
lea r8, str....._base_files_file_util.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x4f
call fcn.1400dc390
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400d1670
xorps xmm0, xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
mov dword [r15 + 0x30], 0
mov rcx, rbx
call fcn.14011374c
mov ecx, eax
call fcn.14011420c
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x140061914
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov r14d, 0xffff
cmovg r14, rax
cmp r14, rdi
cmovae r14, rdi
inc r14
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm6
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
mov r8, r14
call qword [0x14023e858]
xor r12d, r12d
mov rcx, qword [rsp + 0x30]
add rcx, r12
mov edx, 1
mov r8, r14
mov r9, rbx
call fcn.14011caf8
test rax, rax
je 0x1400618b3
mov r15, rax
mov rax, rdi
sub rax, r12
cmp rax, r15
jb 0x14006191f
add r15, r12
mov rcx, rbx
call fcn.14011c360
test eax, eax
je 0x140061923
mov r12, r15
mov rcx, rbx
call fcn.14011c38c
test eax, eax
sete bl
mov rdi, r12
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea rcx, [rsp + 0x20]
mov r8, rdi
call qword [0x14023e858]
lea rcx, [rsp + 0x80]
call fcn.1400d16f0
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x1400618e5
mov r14d, 0xffff
jmp 0x140061851
xor ebx, ebx
jmp 0x1400618c3
test r12, r12
mov eax, 0x10000
cmove r14, rax
lea r8, [r15 + r14]
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea r12, [rsp + 0x20]
mov rcx, r12
call qword [0x14023e858]
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x30], xmm0
mov r12, r15
jmp 0x140061876
Function at 0x14006adf0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14006ae1f
call fcn.1400dc3b0
cmp qword [rsi], r14
je 0x14006ae4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14006aea0
cmp r15, 2
jb 0x14006ae46
mov qword [rsi], r14
call fcn.1400dc3b0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
call fcn.1400dc560
lea rcx, [rsi + 0x20]
call fcn.1400e6000
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x28], 0
mov byte [rsi + 0x29], bl
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14006ae8a
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400dc3b0
mov rcx, qword [rdi]
call fcn.1400ce120
mov qword [rdi], 0
jmp 0x14006ae7a
call fcn.1400dc3b0
mov rcx, qword [rsi]
call fcn.1400ce120
mov qword [rsi], 0
jmp 0x14006ae38

Function at 0x14006b780
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x140261818]
test rdi, rdi
jne 0x14006b833
mov ecx, 0x50
call fcn.1400fc2cc
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.1400fc2cc
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x14006b855
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x140261818], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14006b868
mov rcx, rax
call fcn.14011f794
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.14006b880
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.140139400
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude_string_view:268:_assertion___s___nullptr_failed:_null_pointer_passed_to_non_null_argument_of_char_traits_..._::length_n
call fcn.140139400
int3
Function at 0x140074050
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x14007406a
test r8d, r8d
jne 0x140074063
call fcn.1400a1960
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.1400e0fa0

Function at 0x140075470
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rsi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rdi, [rsp + 0x40]
mov r8d, 0x200
mov rcx, rdi
mov dl, 0xaa
call fcn.1400ffb20
lea rbx, [rsp + 0x3c]
mov dword [rbx], 0x100
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
setne al
mov ecx, dword [rbx]
test rcx, rcx
setne bl
and bl, al
je 0x1400755d2
movsx r8, byte [rsi + 0x17]
test r8, r8
js 0x1400755ad
mov rdx, rsi
cmp ecx, 0xa
jbe 0x140075562
mov eax, r8d
mov rdx, r8
cmp rdx, rcx
cmova rcx, rdx
mov r9d, 0xa
mov edx, 0xa
cmp rcx, 0xb
jb 0x14007551e
mov rdx, rcx
and rdx, 0xfffffffffffffffc
add rdx, 4
or rcx, 3
cmp rcx, 0xb
cmove rcx, rdx
mov rdx, rcx
test r8b, r8b
js 0x1400755df
cmp rdx, r9
je 0x140075537
mov rcx, rsi
call fcn.14003a1a0
mov al, byte [rsi + 0x17]
mov rdx, rsi
test al, al
jns 0x140075562
mov rax, qword [rsi + 0x10]
mov rcx, rax
btr rcx, 0x3f
cmp rcx, 1
je 0x1400755f7
shr rax, 0x38
mov rdx, rsi
test al, al
jns 0x140075562
mov rdx, qword [rsi]
mov word [rdx], 0x2e
cmp byte [rsi + 0x17], 0
jns 0x1400755d9
mov qword [rsi + 8], 1
mov word [rdx + 2], 0
mov r8d, dword [rsp + 0x3c]
dec r8d
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400cc6b0
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsi + 0x10]
mov rdx, rax
btr rdx, 0x3f
dec rdx
shr rax, 0x38
cmp rdx, rcx
jae 0x140075537
mov rdx, qword [rsi + 8]
jmp 0x1400754ec
call fcn.14016d550
jmp 0x140075590
mov byte [rsi + 0x17], 1
jmp 0x140075575
mov rax, qword [rsi + 0x10]
mov r9, rax
btr r9, 0x3f
dec r9
shr rax, 0x38
jmp 0x140075527
mov r9, qword [rsi + 8]
mov r8d, 2
sub r8, rcx
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rdi
mov rcx, rsi
xor edx, edx
call fcn.1400be760
mov qword [rsi + 8], rdi
mov al, byte [rsi + 0x17]
jmp 0x140075558
Function at 0x140087810
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov byte [rcx], 0
mov qword [rcx + 8], 0
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x28
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140087920
mov r15, qword [rsp + 0x40]
cmp qword [rsi + 8], r15
je 0x1400878ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14008793c
lea rax, [r15 + 1]
cmp rax, 2
jb 0x1400878a3
mov qword [rsi + 8], r15
call fcn.1400dc3b0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, [rsp + 0x38]
mov qword [r8], r14
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140087913
lea r8, [rsp + 0x48]
mov dword [r8], 1
mov rax, qword [rsp + 0x38]
mov qword [r8 + 4], rax
mov dword [r8 + 0xc], 2
lea rax, [rsp + 0x34]
mov dword [rax], 0xaaaaaaaa
lea rdx, [rsi + 0x10]
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
xor edx, edx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140087913
mov byte [rsi], 1
jmp 0x140087920
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140087957
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400fd9d0
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400dc3b0
mov rcx, qword [rsi + 8]
call fcn.1400ce120
mov qword [rsi + 8], 0
jmp 0x140087890
call fcn.1400dc3b0
mov rcx, qword [rsi + 8]
call fcn.1400ce120
mov qword [rsi + 8], 0
jmp 0x140087920
Function at 0x14008dd70
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x68]
mov qword [r9], 0
lea rcx, [0x1401ff0f8]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x14008df6b
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x14008df1f
movabs r15, 0x7ffffffffffffff7
mov rcx, rdi
call fcn.14011f794
cmp rax, r15
ja 0x14008df15
mov rbx, rax
lea r14, [rsp + 0x28]
cmp rax, 0xa
jbe 0x14008df04
lea rax, [r15 + 5]
and rax, rbx
add rax, 4
mov r12, rbx
or r12, 3
cmp r12, 0xb
cmove r12, rax
inc r12
js 0x14008df10
lea rcx, [r12 + r12]
call fcn.1400fc2cc
mov rcx, rax
mov qword [rsp + 0x28], rax
lea rax, [r15 + r12]
add rax, 9
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea r15, [rcx + rbx*2]
cmp rcx, rdi
seta al
cmp r15, rdi
setbe dl
or dl, al
je 0x14008df32
test rbx, rbx
je 0x14008de60
add rbx, rbx
mov rdx, rdi
mov r8, rbx
call fcn.1400ff470
mov word [r15], 0
movsx rax, byte [rsp + 0x3f]
test rax, rax
cmovs rax, qword [rsp + 0x30]
cmovs r14, qword [rsp + 0x28]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rax
test rax, rax
js 0x14008df45
sete al
test r14, r14
setne cl
or cl, al
je 0x14008df58
lea rdi, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400dc5c0
mov rcx, rsi
mov rdx, rdi
call fcn.140068ec0
mov rcx, rdi
call fcn.1400dc710
cmp byte [rsp + 0x3f], 0
jns 0x14008ded5
mov rcx, qword [rsp + 0x28]
call fcn.1400fc308
mov bl, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14008dee7
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov byte [rsp + 0x3f], bl
mov rcx, r14
jmp 0x14008de35
call fcn.140136570
lea rcx, [rsp + 0x28]
call fcn.140136530
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude_string:973:_assertion___s___nullptr_failed:_basic_string_const_char__detected_nullptr_n
call fcn.140139400
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude__stringchar_traits.h:222:_assertion__std::__is_pointer_in_range___s1____s1____n____s2__failed:_char_traits::copy:_source_and_destination_ranges_overlap_n
call fcn.140139400
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude_string_view:318:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.140139400
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude_string_view:320:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.140139400
mov rcx, rsi
call fcn.140182620
mov ebx, eax
jmp 0x14008ded7
Function at 0x14008e260
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x14008e287
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14008e2c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14008e2e0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400fd9d0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.14008e3e0
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400dc0e0
test al, al
je 0x14008e3ab
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x265
mov r9d, 2
call fcn.14016b430
lea rcx, [rsp + 0x68]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400be440
mov rdi, rax
movsx rax, byte [rsi + 0x17]
test rax, rax
jns 0x14008e343
mov rax, qword [rsi + 8]
mov rsi, qword [rsi]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
test rax, rax
js 0x14008e3b2
sete al
test rsi, rsi
setne cl
or cl, al
je 0x14008e3c5
lea rsi, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400d2d90
movsx r8, byte [rsi + 0x17]
test r8, r8
jns 0x14008e385
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1400be440
cmp byte [rsp + 0x57], 0
jns 0x14008e3a1
mov rcx, qword [rsp + 0x40]
call fcn.1400fc308
lea rcx, [rsp + 0x58]
call fcn.14016b4a0
xor esi, esi
jmp 0x14008e2c4
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude_string_view:318:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.140139400
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude_string_view:320:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.140139400
int3
Function at 0x14008e3e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp byte [rcx + 0x17], 0
jns 0x14008e407
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14008e4ad
mov dil, 1
test al, 0x10
je 0x14008e439
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, edi
add rsp, 0x168
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400dc0e0
test al, al
je 0x14008e4a6
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x255
mov r9d, 2
call fcn.140067850
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400be440
mov rcx, rax
mov rdx, rsi
call fcn.14016c220
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1400be440
mov rcx, rdi
call fcn.140067e60
xor edi, edi
jmp 0x14008e41d
mov ecx, 2
call fcn.1400dc0e0
test al, al
je 0x14008e4a6
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x251
mov r9d, 2
call fcn.14016b430
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400be440
mov rcx, rax
mov rdx, rsi
call fcn.14016c220
mov rcx, rdi
call fcn.14016b4a0
jmp 0x14008e4a6
Function at 0x14008f8f0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.14008e5a0
mov rax, qword [rsi]
test rax, rax
je 0x14008f967
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14008f96e
lea rcx, [rsp + 0x28]
call fcn.14008f060
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x14008f940
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
jne 0x14008f992
cmp byte [rbx + 0x27], 0
js 0x14008f987
lea rcx, [rbx + 0x10]
jmp 0x14008f98b
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
je 0x14008f99d
add rbx, 0x70
cmp rbx, r15
je 0x14008f940
jmp 0x14008f975
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x14008f9bc
mov rcx, r14
mov rdx, rbx
call fcn.140183ee0
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x14008f992
mov rcx, rdi
mov rdx, rbx
call fcn.140183d80
mov r14, rax
jmp 0x14008f9b6

Function at 0x14008f9d0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.14008e5a0
mov rax, qword [rsi]
test rax, rax
je 0x14008fa47
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14008fa4e
lea rcx, [rsp + 0x28]
call fcn.14008f060
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x14008fa20
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 2
jne 0x14008fa72
cmp byte [rbx + 0x27], 0
js 0x14008fa67
lea rcx, [rbx + 0x10]
jmp 0x14008fa6b
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
je 0x14008fa7d
add rbx, 0x70
cmp rbx, r15
je 0x14008fa20
jmp 0x14008fa55
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x14008fa9c
mov rcx, r14
mov rdx, rbx
call fcn.140183ee0
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x14008fa72
mov rcx, rdi
mov rdx, rbx
call fcn.140183d80
mov r14, rax
jmp 0x14008fa96