joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d8cbc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
lea rsi, [rcx + 2]
test byte [rcx], 1
mov rcx, rsi
je 0x1400d8ceb
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400d8d64
mov bl, 1
test al, 0x10
jne 0x1400d8eab
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x1400d8ea9
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x68]
mov r8d, 0x255
mov r9d, 2
call fcn.140056fb0
lea rcx, [rsp + 0x78]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14000211d
mov rbx, rax
movzx r8d, byte [rdi]
test r8b, 1
je 0x1400d8e30
mov r8, qword [rdi + 8]
mov rsi, qword [rdi + 0x10]
jmp 0x1400d8e33
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x1400d8ea9
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x68]
mov r8d, 0x251
mov r9d, 2
call fcn.1400581a0
lea rcx, [rsp + 0x78]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14000211d
mov rbx, rax
movzx r8d, byte [rdi]
test r8b, 1
je 0x1400d8dca
mov r8, qword [rdi + 8]
mov rsi, qword [rdi + 0x10]
jmp 0x1400d8dcd
shr r8d, 1
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.140001ad4
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov rdx, rdi
call fcn.140049a20
movzx r8d, byte [rsi]
test r8b, 1
je 0x1400d8e03
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
jmp 0x1400d8e0b
shr r8d, 1
lea rdx, [rsp + 0x51]
mov rcx, rbx
call fcn.14000211d
test byte [rsp + 0x50], 1
je 0x1400d8e24
mov rcx, qword [rsp + 0x60]
call fcn.140148278
lea rcx, [rsp + 0x68]
call fcn.140058290
jmp 0x1400d8ea9
shr r8d, 1
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov rdx, rsi
call fcn.140001ad4
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov rdx, rdi
call fcn.140049a20
movzx r8d, byte [rsi]
test r8b, 1
je 0x1400d8e69
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
jmp 0x1400d8e71
shr r8d, 1
lea rdx, [rsp + 0x51]
mov rcx, rbx
call fcn.14000211d
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.14000211d
test byte [rsp + 0x50], 1
je 0x1400d8e9f
mov rcx, qword [rsp + 0x60]
call fcn.140148278
lea rcx, [rsp + 0x68]
call fcn.1400574d0
xor ebx, ebx
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140148650
mov eax, ebx
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400da7ae
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov ebx, 1
cmp rdi, r12
je 0x1400da842
mov rsi, r8
mov r14, rcx
lea r15, [rsp + 0x20]
mov rcx, rdi
mov rdx, r15
call fcn.1400fd528
test al, al
jne 0x1400da80a
add rdi, 0x70
cmp rdi, r12
jne 0x1400da7ef
mov rdi, r12
cmp rdi, qword [r14 + 0x58]
je 0x1400da842
test byte [rdi + 0x10], 1
je 0x1400da81c
mov rcx, qword [rdi + 0x20]
jmp 0x1400da820
lea rcx, [rdi + 0x12]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov ebx, 1
cmovne ebx, ecx
test ebx, ebx
jne 0x1400da842
mov qword [rsi], rdi
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140148650
mov eax, ebx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400dbe1a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x68]
cmp eax, edx
jne 0x1400dbe31
test byte [rcx + 0x10], 1
je 0x1400dbe40
mov rcx, qword [rcx + 0x20]
jmp 0x1400dbe44
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
inc eax
jmp 0x1400dbe5d
add rcx, 0x12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret
Function at 0x1400e42a0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1401cca80]
test rax, rax
jne 0x1400e42e4
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1401cca80]
test rax, rax
je 0x1400e42d1
cmp eax, 2
jne 0x1400e4332
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x1400e43ca
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x8e
mov r9d, 2
call fcn.140056fb0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x1400e43bd
mov eax, 1
lock xadd qword [0x1401ccab8], rax
test rax, rax
jle 0x1400e4352
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1401cca38], eax
mov qword [0x1401cca30], rsi
mov rcx, qword [0x1401c6be8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x1400e43ca
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xba
mov r9d, 2
call fcn.140056fb0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.14000211d
mov rcx, rsi
call fcn.1400574d0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140148650
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x1400f1940
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
mov rax, qword [rcx]
jne 0x1400f196e
test rax, rax
jne 0x1400f196e
cmp dword [rsi + 0x14], 0
jne 0x1400f196e
cmp qword [rsi + 8], 0
je 0x1400f1a72
lea rcx, [rax + 1]
cmp rcx, 2
jb 0x1400f198e
call fcn.140059c20
mov rcx, qword [rsi]
call fcn.140038f70
mov qword [rsi], 0
xor eax, eax
mov rcx, qword [rsi + 8]
lea rdx, [rcx + 1]
cmp rdx, 2
jb 0x1400f19b7
call fcn.140059c20
mov rcx, qword [rsi + 8]
call fcn.140038f70
mov qword [rsi + 8], 0
mov rax, qword [rsi]
xor ecx, ecx
mov qword [rsi + 0x10], 0
mov r14, qword [rdi]
cmp rax, r14
je 0x1400f1a0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x1400f19ef
call fcn.140059c20
mov rcx, qword [rsi]
call fcn.140038f70
mov qword [rsi], 0
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400f1a01
mov qword [rsi], r14
call fcn.140059c20
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsi + 8]
mov r14, qword [rdi + 8]
cmp rcx, r14
je 0x1400f1a5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jb 0x1400f1a41
call fcn.140059c20
mov rcx, qword [rsi + 8]
call fcn.140038f70
mov qword [rsi + 8], 0
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400f1a54
mov qword [rsi + 8], r14
call fcn.140059c20
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ecx, ecx
xor eax, eax
jmp 0x1400f19bf

Function at 0x1400f1b90
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x40], rax
test rcx, rcx
je 0x1400f1c49
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x38], 0
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r14
mov rbx, rax
call r14
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne bl
je 0x1400f1c4d
mov r14, qword [rsp + 0x38]
cmp qword [rsi], r14
je 0x1400f1c5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x1400f1c35
call fcn.140059c20
mov rcx, qword [rsi]
call fcn.140038f70
mov qword [rsi], 0
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400f1c55
mov qword [rsi], r14
call fcn.140059c20
jmp 0x1400f1c55
mov bl, 1
jmp 0x1400f1c5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140148650
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400f1d80
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.1400f1b20
test al, al
je 0x1400f1dae
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdi, [rsi + 0x30]
mov rcx, rdi
xor edx, edx
call fcn.1400f1e06
mov rcx, qword [rsi + 0x48]
mov qword [rsi + 0x48], 0
test rcx, rcx
je 0x1400f1dd2
call fcn.140167d00
mov rcx, rdi
xor edx, edx
call fcn.1400f1e06
lea rcx, [rsi + 0x28]
call fcn.140002f50
lea rcx, [rsi + 0x20]
call fcn.140002f50
lea rcx, [rsi + 0x18]
call fcn.140002f50
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400f1a80
Function at 0x1400f2ab6
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.1400f1b20
test al, al
je 0x1400f2ad8
mov rcx, qword [rsi]
xor edx, edx
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x20
pop rsi
ret

Function at 0x1400f57f0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400f5805
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret
Function at 0x1400f6420
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov eax, dword [0x1401ccb98]
mov ecx, dword [0x1401ca5a0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x40]
jg 0x1400f64a9
lea rcx, [0x1401ccb88]
call fcn.1400bc730
test rax, rax
jne 0x1400f6496
mov ecx, 4
call fcn.140148228
mov rdi, rax
mov dword [rax], 0
lea rbx, [0x1401ccb88]
mov rcx, rbx
call fcn.1400bc730
mov rsi, rax
mov rcx, rbx
mov rdx, rdi
call fcn.1400bc770
test rsi, rsi
je 0x1400f6496
mov rcx, rsi
call fcn.140148278
lea rcx, [0x1401ccb88]
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400bc730
lea rcx, [0x1401ccb98]
call fcn.140148390
cmp dword [0x1401ccb98], 0xffffffff
jne 0x1400f6448
xorps xmm0, xmm0
movups xmmword [0x1401ccb88], xmm0
lea rcx, [0x1401ccb88]
lea rdx, [0x140002fa0]
call fcn.1400bc7c0
lea rcx, [0x1401ccb98]
call fcn.140148428
jmp 0x1400f6448

Function at 0x1400fb825
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
lea r9, [rsp + 0x5c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400fb91f
lea r14, str.bytes_read___static_cast_DWORD___1_
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea rbp, [rsp + 0x30]
lea r12, [rsp + 0x50]
mov ecx, dword [rsp + 0x5c]
mov edx, 0xffffffff
mov r8, r14
call fcn.1400fb7e7
test rax, rax
je 0x1400fb8df
mov r13, rax
mov rcx, rbp
lea rdx, [0x14018dc47]
lea r8, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
mov r9d, 0x7e
call fcn.140059c00
mov rcx, r12
mov rdx, r13
mov r8, rbp
call fcn.1400646f0
mov rcx, r12
call fcn.140064810
mov eax, dword [rsp + 0x5c]
test eax, eax
jne 0x1400fb937
mov rcx, rdi
call r15
cmp eax, 3
jne 0x1400fb933
mov dword [rsp + 0x5c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
lea r9, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400fb894
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x1400fb939
mov eax, dword [rsp + 0x5c]
mov esi, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140148650
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400fc034
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.1400fbf1c
test rax, rax
jne 0x1400fc0cb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x1400fc0cb
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x1400fc0c9
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfb
mov r9d, 2
call fcn.1400581a0
lea rcx, [rsp + 0x40]
lea rdx, [0x14019ec27]
mov r8d, 0xc
call fcn.14000211d
mov rcx, rsi
call fcn.140058290
xor esi, esi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140148650
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret

Function at 0x1400fc7fb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov ebp, edx
mov rdi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x190], rax
lea rsi, [rcx + 2]
test byte [rcx], 1
mov rcx, rsi
je 0x1400fc82d
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400fc854
mov ebx, eax
bt eax, 0xa
jae 0x1400fc849
test bpl, bpl
je 0x1400fc91e
and ebx, 0x10
shr ebx, 4
jmp 0x1400fc920
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x1400fc91e
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x82
mov r9d, 2
call fcn.1400581a0
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14000211d
mov rbx, rax
movzx r8d, byte [rdi]
test r8b, 1
je 0x1400fc8ba
mov r8, qword [rdi + 8]
mov rsi, qword [rdi + 0x10]
jmp 0x1400fc8bd
shr r8d, 1
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov rdx, rsi
call fcn.140001ad4
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov rdx, rdi
call fcn.140049a20
movzx r8d, byte [rsi]
test r8b, 1
je 0x1400fc8f3
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
jmp 0x1400fc8fb
shr r8d, 1
lea rdx, [rsp + 0x39]
mov rcx, rbx
call fcn.14000211d
test byte [rsp + 0x38], 1
je 0x1400fc914
mov rcx, qword [rsp + 0x48]
call fcn.140148278
lea rcx, [rsp + 0x50]
call fcn.140058290
xor ebx, ebx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140148650
mov eax, ebx
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400fc93e
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1a8
mov ebp, r8d
mov rdi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
lea rsi, [rcx + 2]
test byte [rcx], 1
mov rcx, rsi
je 0x1400fc971
mov rcx, qword [rdi + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1400fcad1
test bpl, bpl
je 0x1400fc9f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400fc9f3
mov bl, 1
mov rcx, rdi
mov dl, 1
call fcn.1400fc7fb
test al, al
jne 0x1400fcad1
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x1400fcacf
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x38]
mov r8d, 0x5d
mov r9d, 2
call fcn.140056fb0
movzx r8d, byte [rdi]
test r8b, 1
je 0x1400fcaef
mov r8, qword [rdi + 8]
mov rsi, qword [rdi + 0x10]
jmp 0x1400fcaf2
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x1400fcacf
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x38]
mov r8d, 0x62
mov r9d, 2
call fcn.1400581a0
lea rcx, [rsp + 0x48]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.14000211d
mov rbx, rax
movzx r8d, byte [rdi]
test r8b, 1
je 0x1400fca59
mov r8, qword [rdi + 8]
mov rsi, qword [rdi + 0x10]
jmp 0x1400fca5c
shr r8d, 1
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov rdx, rsi
call fcn.140001ad4
lea rsi, [rsp + 0x188]
mov rcx, rsi
mov rdx, rdi
call fcn.140049a20
movzx r8d, byte [rsi]
test r8b, 1
je 0x1400fca9b
mov r8, qword [rsp + 0x190]
mov rdx, qword [rsp + 0x198]
jmp 0x1400fcaa6
shr r8d, 1
lea rdx, [rsp + 0x189]
mov rcx, rbx
call fcn.14000211d
test byte [rsp + 0x188], 1
je 0x1400fcac5
mov rcx, qword [rsp + 0x198]
call fcn.140148278
lea rcx, [rsp + 0x38]
call fcn.140058290
xor ebx, ebx
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140148650
mov eax, ebx
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
ret
shr r8d, 1
lea rdi, [rsp + 0x48]
lea rbx, [rsp + 0x178]
mov rcx, rbx
mov rdx, rsi
call fcn.140001ad4
lea rsi, [rsp + 0x188]
mov rcx, rsi
mov rdx, rbx
call fcn.140049a20
movzx r8d, byte [rsi]
test r8b, 1
je 0x1400fcb39
mov r8, qword [rsp + 0x190]
mov rdx, qword [rsp + 0x198]
jmp 0x1400fcb44
shr r8d, 1
lea rdx, [rsp + 0x189]
mov rcx, rdi
call fcn.14000211d
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.14000211d
test byte [rsp + 0x188], 1
je 0x1400fcb78
mov rcx, qword [rsp + 0x198]
call fcn.140148278
lea rcx, [rsp + 0x38]
call fcn.1400574d0
jmp 0x1400fcacf
Function at 0x1400fcb87
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x198], rax
lea rsi, [rcx + 2]
test byte [rcx], 1
mov rcx, rsi
je 0x1400fcbb6
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400fcbcf
test eax, 0x410
sete sil
jmp 0x1400fcc9b
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x1400fcc99
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x75
mov r9d, 2
call fcn.1400581a0
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14000211d
mov rbx, rax
movzx r8d, byte [rdi]
test r8b, 1
je 0x1400fcc35
mov r8, qword [rdi + 8]
mov rsi, qword [rdi + 0x10]
jmp 0x1400fcc38
shr r8d, 1
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov rdx, rsi
call fcn.140001ad4
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rdi
call fcn.140049a20
movzx r8d, byte [rsi]
test r8b, 1
je 0x1400fcc6e
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
jmp 0x1400fcc76
shr r8d, 1
lea rdx, [rsp + 0x41]
mov rcx, rbx
call fcn.14000211d
test byte [rsp + 0x40], 1
je 0x1400fcc8f
mov rcx, qword [rsp + 0x50]
call fcn.140148278
lea rcx, [rsp + 0x58]
call fcn.140058290
xor esi, esi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140148650
mov eax, esi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400fccb8
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x198], rax
lea rsi, [rcx + 2]
test byte [rcx], 1
mov rcx, rsi
je 0x1400fcce7
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400fcd20
and eax, 0x410
cmp eax, 0x410
jne 0x1400fcd20
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140148650
mov rcx, rdi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
jmp fcn.1400fce25
test byte [rdi], 1
mov rcx, rsi
je 0x1400fcd2c
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x1400fce08
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x1400fce06
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x95
mov r9d, 2
call fcn.1400581a0
lea rcx, [rsp + 0x68]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.14000211d
mov rbx, rax
movzx r8d, byte [rdi]
test r8b, 1
je 0x1400fcda2
mov r8, qword [rdi + 8]
mov rsi, qword [rdi + 0x10]
jmp 0x1400fcda5
shr r8d, 1
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov rdx, rsi
call fcn.140001ad4
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rdi
call fcn.140049a20
movzx r8d, byte [rsi]
test r8b, 1
je 0x1400fcddb
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
jmp 0x1400fcde3
shr r8d, 1
lea rdx, [rsp + 0x41]
mov rcx, rbx
call fcn.14000211d
test byte [rsp + 0x40], 1
je 0x1400fcdfc
mov rcx, qword [rsp + 0x50]
call fcn.140148278
lea rcx, [rsp + 0x58]
call fcn.140058290
xor ebx, ebx
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140148650
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400fce25
Capabilities:
Delete directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x198
mov rbx, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x190], rax
lea rdi, [rcx + 2]
test byte [rcx], 1
mov rcx, rdi
je 0x1400fce56
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x1400fcf30
mov ecx, 2
call fcn.140056eb0
test al, al
je 0x1400fcf30
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x30
mov r9d, 2
call fcn.1400581a0
lea rcx, [rsp + 0x60]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.14000211d
mov r14, rax
movzx r8d, byte [rbx]
test r8b, 1
je 0x1400fcecc
mov r8, qword [rbx + 8]
mov rdi, qword [rbx + 0x10]
jmp 0x1400fcecf
shr r8d, 1
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rdi
call fcn.140001ad4
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov rdx, rbx
call fcn.140049a20
movzx r8d, byte [rdi]
test r8b, 1
je 0x1400fcf05
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
jmp 0x1400fcf0d
shr r8d, 1
lea rdx, [rsp + 0x39]
mov rcx, r14
call fcn.14000211d
test byte [rsp + 0x38], 1
je 0x1400fcf26
mov rcx, qword [rsp + 0x48]
call fcn.140148278
lea rcx, [rsp + 0x50]
call fcn.140058290
test esi, esi
setne bl
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140148650
mov eax, ebx
add rsp, 0x198
pop rbx
pop rdi
pop rsi
pop r14
ret