joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a8f40
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, [0x1402ff4f8]
mov qword [rcx], rax
add rcx, 8
call fcn.140075520
lea rcx, [rsi + 0x10]
call fcn.140075520
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.140075520
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
movups xmmword [rsi + 0xd0], xmm6
mov qword [rsi + 0xe0], rbx
mov ebp, 0x3f800000
mov dword [rsi + 0xe8], ebp
mov dword [rsi + 0xf0], ebx
movups xmmword [rsi + 0xf8], xmm6
movups xmmword [rsi + 0x108], xmm6
mov dword [rsi + 0x118], ebp
movups xmmword [rsi + 0x120], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x140], ebp
movups xmmword [rsi + 0x148], xmm6
movups xmmword [rsi + 0x158], xmm6
mov dword [rsi + 0x168], ebp
movups xmmword [rsi + 0x170], xmm6
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebp
mov qword [rsi + 0x1b0], rbx
movups xmmword [rsi + 0x198], xmm6
mov dword [rsi + 0x1a8], ebx
mov dword [rsi + 0x1b8], 1
lea rcx, [rsi + 0x1c0]
call fcn.1400a9300
lea rcx, [rsi + 0x310]
movups xmmword [rsi + 0x2f8], xmm6
mov qword [rsi + 0x308], rbx
xor edx, edx
call fcn.140041af0
lea rcx, [rsi + 0x320]
xor edx, edx
call fcn.140041af0
lea rcx, [rsi + 0x330]
xor edx, edx
call fcn.140041af0
movups xmmword [rsi + 0x340], xmm6
movups xmmword [rsi + 0x350], xmm6
mov dword [rsi + 0x360], ebp
movups xmmword [rsi + 0x368], xmm6
movups xmmword [rsi + 0x378], xmm6
movups xmmword [rsi + 0x388], xmm6
mov byte [rsi + 0x398], bl
mov dword [rsi + 0x39c], edi
mov byte [rsi + 0x3a0], bl
movups xmmword [rsi + 0x3a8], xmm6
movups xmmword [rsi + 0x3b8], xmm6
call fcn.1400ad7f0
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x1a8], eax
mov eax, eax
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x1a0], rax
mov rcx, rsi
call fcn.1400a92a0
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x1400a9159
call fcn.14008fb10
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.140041ab0
mov qword [0x140354b70], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x140211850.0]
jmp 0x1400a9127
Function at 0x1400b3bf0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, dword [0x14035c098]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400b3cad
mov rdi, qword [rsi + 0x18]
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400b3cef
mov rcx, qword [0x14035c088]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [0x14035c090]
mov rdx, qword [0x14035c088]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
cmp byte [rsi + 0x10], 0
jne 0x1400b3d02
mov rcx, qword [rsi + 0x18]
mov rax, qword [0x1403428e0]
and rax, rcx
cmp rax, qword [0x1403428c8]
je 0x1400b3d7e
mov qword [rsi + 0x18], 0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140171860
nop
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x14035c098]
call fcn.14016f8b4
cmp dword [0x14035c098], 0xffffffff
jne 0x1400b3c2d
xorps xmm0, xmm0
movups xmmword [0x14035c088], xmm0
lea rcx, [0x14035c088]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035c098]
call fcn.14016ef8c
jmp 0x1400b3c2d
test rdi, rdi
je 0x1400b3c6b
call fcn.140001120
jmp 0x1400b3c47
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x28]
mov qword [rdi], rax
mov rax, qword [fcn.14007a620]
mov rcx, rdi
call qword [case.0x140211850.0]
mov rax, qword [rdi]
mov rcx, qword [rsi + 8]
xor edx, edx
cmp rax, rcx
setns dl
movabs r8, 0x7fffffffffffffff
add r8, rdx
sub rax, rcx
cmovo rax, r8
cmp rax, 0xfa0
jl 0x1400b3c75
test byte [0x140341bd0], 0x19
je 0x1400b3c75
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
test byte [0x140341bd0], 0x19
je 0x1400b3c75
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jmp 0x1400b3c75
call fcn.1401571d0
jmp 0x1400b3c90
Function at 0x1400b3d90
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rcx], rdx
mov qword [rcx + 8], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
mov dword [rcx + 0x28], 0
mov qword [rcx + 0x38], r8
mov qword [rcx + 0x40], r9
mov eax, dword [0x14035c098]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x1400b3e24
lea rcx, [0x14035c098]
call fcn.14016f8b4
cmp dword [0x14035c098], 0xffffffff
jne 0x1400b3e24
xorps xmm0, xmm0
movups xmmword [0x14035c088], xmm0
lea rcx, [0x14035c088]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035c098]
call fcn.14016ef8c
lea rbx, [rsi + 0x18]
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400b3ee5
mov rcx, qword [0x14035c088]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14035c090]
jne 0x1400b3ee5
mov rdi, qword [rax + rcx]
mov rcx, qword [rbx]
mov rax, qword [0x1403428e0]
and rax, rcx
cmp rax, qword [0x1403428c8]
je 0x1400b3eec
mov rax, qword [0x1403428e0]
and rax, rdi
cmp rax, qword [0x1403428c8]
je 0x1400b3ef3
mov qword [rsi + 0x18], rdi
test byte [0x140341bd0], 9
jne 0x1400b3efd
mov byte [rsi + 0x10], 0
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400b3f22
mov rcx, qword [0x14035c088]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [0x14035c090]
mov rdx, qword [0x14035c088]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140171860
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
xor edi, edi
jmp 0x1400b3e5d
call fcn.1401571d0
jmp 0x1400b3e73
mov rcx, rdi
call fcn.140156f20
jmp 0x1400b3e86
mov byte [rsi + 0x10], 1
mov rax, qword [fcn.14007a620]
lea rdi, [rsp + 0x20]
mov rcx, rdi
call qword [case.0x140211850.0]
mov rax, qword [rdi]
mov qword [rsi + 8], rax
jmp 0x1400b3e97
test rsi, rsi
je 0x1400b3ecd
call fcn.140001120
jmp 0x1400b3ea9
Function at 0x1400b63b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x48], rax
test byte [0x140341290], 0x19
jne 0x1400b6441
mov eax, dword [0x14035aaf8]
mov ecx, dword [0x14034fed0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400b6468
mov ecx, dword [0x1403411e0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400b6429
mov rcx, qword [0x14035aae8]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x14035aaf0]
jne 0x1400b6429
mov rdi, qword [rax + rcx]
test rdi, rdi
jne 0x1400b64aa
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140171860
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x20]
mov qword [rcx + 0x18], rax
xorps xmm0, xmm0
movaps xmmword [rcx], xmm0
movups xmmword [rcx + 9], xmm0
call fcn.1401b25f0
jmp 0x1400b63d2
lea rcx, [0x14035aaf8]
call fcn.14016f8b4
cmp dword [0x14035aaf8], 0xffffffff
jne 0x1400b63f3
xorps xmm0, xmm0
movups xmmword [0x14035aae8], xmm0
lea rcx, [0x14035aae8]
xor edx, edx
call fcn.140041af0
lea rcx, [0x14035aaf8]
call fcn.14016ef8c
jmp 0x1400b63f3
cmp qword [rdi + 8], 0
jne 0x1400b64c4
movabs rax, 0x4000000000000000
lock or qword [rdi], rax
jmp 0x1400b6429
lea rcx, [rdi + 8]
mov rbx, qword [rdi]
call fcn.14003b950
movabs rcx, 0xff00000000000000
and rcx, rbx
or rcx, rax
mov qword [rdi], rcx
jmp 0x1400b64b1
Function at 0x1400ba440
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
je 0x1400ba47b
test r15, r15
je 0x1400ba4c5
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x1400ba4c8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.1401730b0
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x1400ba45d
int3
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x1400ba56c
lea rcx, [r12*8]
call fcn.14016ecd4
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x1400ba53c
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
mov r10, rcx
add r10, r9
je 0x1400ba571
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x1400ba524
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x1400ba45d
mov rcx, r14
call fcn.14016eccc
mov r15, qword [rsi + 0x10]
jmp 0x1400ba45d
call fcn.1401c93df
int3
Function at 0x1400bd160
Capabilities:
Get token membership

Disassembly:
push rsi
sub rsp, 0x80
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea r9, [rsp + 0x2c]
mov dword [r9], 0x44
xorps xmm0, xmm0
lea r8, [rsp + 0x30]
movaps xmmword [r8 + 0x30], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
movaps xmmword [r8], xmm0
mov dword [r8 + 0x40], 0
xor esi, esi
mov ecx, 0x16
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1400bd1e3
lea rsi, [rsp + 0x28]
mov dword [rsi], 0
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
setne al
cmp dword [rsi], 0
setne sil
and sil, al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140171860
mov eax, esi
add rsp, 0x80
pop rsi
ret
Function at 0x1400bda20
Capabilities:
Accept command line arguments

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.140068600
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x1400bdb69
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, [0x1403089e4]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x1400bdbad
lea rdx, [0x140308a34]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400bdbc0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [case.0x140211850.0]
mov rbx, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x30]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x140301d60]
movaps xmmword [r14], xmm0
movsxd rax, dword [rsp + 0x4c]
lea r8, [rbx + rax*8]
mov rcx, r14
mov rdx, rbx
call fcn.1400bdbd0
mov rcx, rsi
mov rdx, r14
call fcn.1400bdcd0
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x1400bdb20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x1400bdb69
mov rdi, qword [rsp + 0x38]
mov rcx, rsi
cmp rdi, rsi
je 0x1400bdb5f
add rdi, 0xffffffffffffffe8
test rdi, rdi
je 0x1400bdb81
cmp byte [rdi + 0x17], 0
jns 0x1400bdb4e
mov rcx, qword [rdi]
call fcn.14016eccc
lea rax, [rdi - 0x18]
cmp rdi, rsi
mov rdi, rax
jne 0x1400bdb3b
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rsi
call fcn.14016eccc
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140171860
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.1401c469a
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1400bdac3
xor ebx, ebx
jmp 0x1400bdac6
Function at 0x1400be4a0
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov esi, ecx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [0x140354598]
test rax, rax
jne 0x1400be517
lea rcx, [0x14030a680]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x1400be57c
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x1400be57c
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x1400be57c
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
jne 0x1400be57c
xor eax, eax
lock cmpxchg qword [0x140354598], rcx
mov rax, qword [0x140354598]
test rax, rax
je 0x1400be57f
mov rcx, qword [0x140354598]
lea rdx, str.NtSetInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400be582
mov rdi, rax
lea rbx, [rsp + 0x20]
mov dword [rbx], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x6a
mov r8, rbx
mov r9d, 4
mov rax, rdi
call qword [case.0x140211850.0]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140171860
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
int3
int3
int3
Function at 0x1400bf280
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.1400bf2f0
mov rax, qword [rsi + 0x40]
inc rax
cmp rax, 2
jae 0x1400bf2c6
mov rcx, qword [rsi + 0x30]
mov rax, qword [0x1403428e0]
and rax, rcx
cmp rax, qword [0x1403428c8]
je 0x1400bf2de
mov qword [rsi + 0x30], 0
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1400e2da0
call fcn.1400412c0
mov rcx, qword [rsi + 0x40]
call fcn.140071ab0
mov qword [rsi + 0x40], 0
jmp 0x1400bf29a
call fcn.1401571d0
jmp 0x1400bf2b1
Function at 0x1400c0980
Capabilities:
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov esi, r9d
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov ebp, dword [rsp + 0xb0]
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rdx, str.WriteValue
lea r8, str....._basewin_registry.cc
lea rcx, [rsp + 0x38]
mov r9d, 0x1e6
call fcn.14004f270
mov rcx, qword [r14]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
mov rdx, rbx
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140171860
mov eax, esi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400c22ac
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edx, edx
call fcn.14008dc10
lea rcx, [rsp + 0x30]
mov byte [rcx + 0x17], 0x15
lea rax, str.ExitCodeWatcherThread
cmp rcx, rax
ja 0x1400c22f1
lea rcx, [rsp + 0x45]
cmp rcx, rax
ja 0x1400c23eb
lea rcx, [rsi + 0x10]
movups xmm0, xmmword [str.ExitCodeWatcherThread]
lea rdi, [rsp + 0x30]
movaps xmmword [rdi], xmm0
movabs rax, 0x6461657268547265
mov qword [rdi + 0xd], rax
mov byte [rdi + 0x15], 0
mov rdx, rdi
call fcn.1400c2430
cmp byte [rdi + 0x17], 0
js 0x1400c23a8
mov dword [rsi + 0x98], 0x103
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0xa0], 0
test rax, rax
je 0x1400c238e
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0xa0]
inc rax
cmp rax, 2
jae 0x1400c23b7
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400c2386
mov qword [rsi + 0xa0], rdi
call fcn.1400412c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140171860
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsp + 0x30]
call fcn.14016eccc
jmp 0x1400c2328
call fcn.1400412c0
mov r14, qword [rsi + 0xa0]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x1400c2417
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x140211850.0]
mov qword [rsi + 0xa0], 0
jmp 0x1400c2370
lea rax, str.char_traits::copy_overlapped_range
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__stringchar_traits.h
lea r9, str.__s2_____s1____s2_____s1__n
mov r8d, 0xec
call fcn.1401c469a
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x1400c23cf
Function at 0x1400c9800
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.1400c98c0
mov eax, dword [rsi]
mov dword [0x1403411a8], eax
test al, 1
jne 0x1400c9821
mov al, 1
add rsp, 0x20
pop rsi
ret
mov rcx, qword [0x140352b08]
test rcx, rcx
jne 0x1400c983b
mov rcx, qword [0x140352af8]
test rcx, rcx
je 0x1400c985f
jmp 0x1400c9881
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140352b08], 0
mov rcx, qword [0x140352af8]
test rcx, rcx
jne 0x1400c9881
and byte [0x1403411a8], 0xfe
mov ecx, 0x18
call fcn.14016ecd4
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x140352af8], rax
mov rdx, qword [rsi + 8]
call fcn.140127c60
cmp dword [rsi + 0x14], 0
jne 0x1400c98a6
mov rcx, qword [0x140352af8]
cmp byte [rcx + 0x17], 0
jns 0x1400c98a0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
add rsp, 0x20
pop rsi
jmp fcn.14020a380
Function at 0x1400cb113
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x1400cb13a
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400cb174
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400cb17c
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140171860
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.1400cb258
mov sil, 1
jmp 0x1400cb23c
cmp dword [0x140352b00], 2
jg 0x1400cb23a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x278
mov r9d, 2
call fcn.14020a880
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.14015f6d6
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.1400673e0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400cb210
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
jmp 0x1400cb214
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.14015f6d6
cmp byte [rsp + 0x4f], 0
jns 0x1400cb230
mov rcx, qword [rsp + 0x38]
call fcn.14016eccc
lea rcx, [rsp + 0x50]
call fcn.14020a900
xor esi, esi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140171860
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
Function at 0x1400cb258
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x1400cb27f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400cb2b1
mov dil, 1
test al, 0x10
je 0x1400cb34c
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140171860
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
cmp dword [0x140352b00], 2
jg 0x1400cb441
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x263
mov r9d, 2
call fcn.14020a880
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14015f6d6
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x38]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.1400673e0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400cb3d6
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
jmp 0x1400cb3da
cmp dword [0x140352b00], 2
jg 0x1400cb441
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x267
mov r9d, 2
call fcn.1400d3710
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.14015f6d6
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.1400673e0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400cb402
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
jmp 0x1400cb406
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.14015f6d6
cmp byte [rsp + 0x5f], 0
jns 0x1400cb3f6
mov rcx, qword [rsp + 0x48]
call fcn.14016eccc
lea rcx, [rsp + 0x60]
call fcn.14020a900
jmp 0x1400cb441
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.14015f6d6
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.14015f6d6
cmp byte [rsp + 0x5f], 0
jns 0x1400cb437
mov rcx, qword [rsp + 0x48]
call fcn.14016eccc
lea rcx, [rsp + 0x60]
call fcn.140169410
xor edi, edi
jmp 0x1400cb295
Function at 0x1400ccc20
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4b8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x450]
mov qword [r14 + 0x50], rax
movaps xmm0, xmmword [0x140301d60]
movaps xmmword [r14 + 0x40], xmm0
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, [0x14030a0a6]
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x240]
mov rcx, r15
mov r9d, 0x22b
call fcn.14004f270
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400cd290
lea r14, [rsp + 0x240]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.140173760
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x1400cccd5
mov rdx, qword [rbx]
mov r8d, 0x104
mov rcx, r14
call fcn.1400ccde0
mov rcx, r14
call fcn.14004a330
lea r14, [rsp + 0x30]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.140173760
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x1400ccd0c
mov rdx, qword [rdi]
mov r8d, 0x104
mov rcx, r14
call fcn.1400ccde0
mov rcx, r14
call fcn.14004a330
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x1400ccd2e
mov rdx, qword [rbx]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x1400ccd3a
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x1400ccdc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400cce30
mov ebp, eax
cmp byte [rdi + 0x17], 0
jns 0x1400ccd6d
mov rdi, qword [rdi]
cmp byte [rbx + 0x17], 0
jns 0x1400ccd76
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dil
test rsi, rsi
je 0x1400ccd91
test eax, eax
je 0x1400ccdc5
lea rcx, [rsp + 0x450]
call fcn.1400cd300
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.140171860
mov eax, edi
add rsp, 0x4b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dil, 1
jmp 0x1400ccd91
cmp ebp, 0xfffffffc
jne 0x1400ccdd1
call fcn.140129c30
mov ebp, eax
mov dword [rsi], ebp
xor edi, edi
jmp 0x1400ccd91