joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140056d90
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140189600
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140056e25
cmp word [rsp + 0x70], 0
je 0x140056e25
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.1401855e4
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.140125070
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.1401874c0
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.14005b660
test al, al
jne 0x140056e73
lea rax, [0x14027a37c]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.140125070
cmp byte [rsp + 0x57], 0
jns 0x140056e07
mov rcx, qword [rsp + 0x40]
call fcn.14018482c
jmp 0x140056e07
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
jmp 0x140056e07

Function at 0x1400584e0
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140058507
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140058541
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140058560
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401874c0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140058620
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401874c0
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
cmp dword [0x1402b0c58], 2
jg 0x140058613
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x266
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1401c17b0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140149600
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400585ed
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1401c17b0
cmp byte [rsp + 0x4f], 0
jns 0x140058609
mov rcx, qword [rsp + 0x38]
call fcn.14018482c
lea rcx, [rsp + 0x50]
call fcn.1401f1840
xor esi, esi
jmp 0x140058544
Function at 0x140058620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x140058647
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140058679
mov dil, 1
test al, 0x10
je 0x140058731
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401874c0
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
cmp dword [0x1402b0c58], 2
jg 0x1400587ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x251
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401c17b0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x38]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.140149600
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140058706
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.1401c17b0
cmp byte [rsp + 0x5f], 0
jns 0x140058722
mov rcx, qword [rsp + 0x48]
call fcn.14018482c
lea rcx, [rsp + 0x60]
call fcn.1401f1840
jmp 0x1400587ef
cmp dword [0x1402b0c58], 2
jg 0x1400587ef
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x255
mov r9d, 2
call fcn.1400049c0
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401c17b0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.140149600
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400587b4
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.1401c17b0
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1401c17b0
cmp byte [rsp + 0x5f], 0
jns 0x1400587e5
mov rcx, qword [rsp + 0x48]
call fcn.14018482c
lea rcx, [rsp + 0x60]
call fcn.140004ab0
xor edi, edi
jmp 0x14005865d
Function at 0x14005b660
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x298
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x290], rax
lea rbx, [rsp + 0x80]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.140189600
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14005b75b
lea r14, [rsp + 0x28]
mov qword [r14], rbx
mov rcx, rbx
call fcn.1401855e4
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov rdx, r14
call fcn.140125070
movaps xmm0, xmmword [0x1402724c0]
lea r14, [rsp + 0x50]
movaps xmmword [r14], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [r14 + 0x10], rax
movzx eax, byte [rbx + 0x17]
test al, al
mov rcx, qword [rbx]
cmovns rcx, rbx
lea rdx, [rsp + 0x70]
mov qword [rdx], rcx
cmovs rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov rcx, r14
call fcn.140125070
mov rcx, r14
call fcn.14004e010
cmp byte [rsi + 0x17], 0
js 0x14005b783
mov rax, qword [rsp + 0x60]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x67], 0
mov word [rsp + 0x50], 0
cmp byte [rsp + 0x4f], 0
jns 0x14005b75b
mov rcx, qword [rsp + 0x38]
call fcn.14018482c
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1401874c0
mov eax, ebx
add rsp, 0x298
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsi]
call fcn.14018482c
jmp 0x14005b72d

Function at 0x14005d2b0
Capabilities:
Clear file content

Disassembly:
push rsi
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x178], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r8, [rsp + 0x170]
mov qword [r8], rax
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14005d32b
cmp qword [rsp + 0x170], 0
jne 0x14005d3c6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x14005d375
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1401874c0
mov eax, esi
add rsp, 0x180
pop rsi
ret
cmp dword [0x1402b0c58], 2
jg 0x14005d3c6
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xf1
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x40]
lea rdx, [0x140287845]
mov r8d, 0x10
jmp 0x14005d3b9
cmp dword [0x1402b0c58], 2
jg 0x14005d3c6
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfb
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x40]
lea rdx, [0x140287856]
mov r8d, 0xc
call fcn.1401c17b0
mov rcx, rsi
call fcn.1401f1840
xor esi, esi
jmp 0x14005d310
Function at 0x14005e4a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov sil, 1
test r8, r8
je 0x14005e52a
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov r12d, 0xffffffff
lea r15, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, r12
mov r8d, 0xffffffff
cmovb r8, rdi
mov dword [rsp + 0x28], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rbx
mov r9, r15
call r13
test eax, eax
je 0x14005e54f
mov eax, dword [rsp + 0x28]
cmp rax, r12
je 0x14005e5a4
add rbx, rax
sub rdi, rax
jne 0x14005e4e7
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1401874c0
mov eax, esi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [0x1402b0c58], 2
jg 0x14005e5a0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x8c
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x38]
lea rdx, [0x1402878bf]
mov r8d, 9
call fcn.1401c17b0
mov rcx, rsi
call fcn.1401f1840
xor esi, esi
jmp 0x14005e52a
int3
Function at 0x140062df0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.1400637f0
mov rax, qword [rsi]
test rax, rax
je 0x140062e67
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x140062e6e
lea rcx, [rsp + 0x28]
call fcn.140062ed0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401874c0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140062e40
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
je 0x140062e86
add rbx, 0x70
cmp rbx, r15
je 0x140062e40
jmp 0x140062e75
cmp byte [rbx + 0x27], 0
jns 0x140062e92
mov rcx, qword [rbx + 0x10]
jmp 0x140062e96
lea rcx, [rbx + 0x10]
call r12
test al, 0x10
jne 0x140062e7b
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
je 0x140062ebc
mov rcx, r14
mov rdx, rbx
call fcn.1400bf900
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x140062e7b
mov rcx, rdi
mov rdx, rbx
call fcn.1400bf6f0
jmp 0x140062e7b
Function at 0x140066c50
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rcx], 0
mov byte [rcx + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x140066d4c
lea rdi, [rsi + 0x10]
lea rdx, str.ExitCodeWatcherThread
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.1401c45c0
mov rcx, rdi
mov rdx, rbx
call fcn.140066d60
cmp byte [rbx + 0x17], 0
js 0x140066d4f
mov dword [rsi + 0x98], 0x103
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0xa0], 0
test rax, rax
je 0x140066d16
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0xa0]
inc rax
cmp rax, 2
jae 0x140066d2e
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140066d0e
mov qword [rsi + 0xa0], rdi
call fcn.1400e8860
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401874c0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.1400e8860
mov rcx, qword [rsi + 0xa0]
call fcn.140165880
mov qword [rsi + 0xa0], 0
jmp 0x140066cf8
int3
mov rcx, qword [rsp + 0x20]
call fcn.14018482c
jmp 0x140066cb0
Function at 0x140068360
Capabilities:
Check if file exists
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rax, qword [rcx + 8]
mov r14d, 8
inc rax
cmp rax, 1
ja 0x1400684e1
mov rdi, rcx
cmp qword [rcx + 0x18], 0
jne 0x1400684e1
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov r14, rax
cmp qword [rdi + 8], rax
je 0x1400683ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi + 8]
inc rax
cmp rax, 2
jae 0x140068502
mov rax, r14
inc rax
cmp rax, 2
jb 0x1400683e2
mov qword [rdi + 8], r14
call fcn.1400e8860
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400685bc
movabs r12, 0xfffffffc00000000
mov ecx, 0x20
call fcn.140184834
mov r15, rax
mov qword [rax], rax
mov qword [rax + 8], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov ecx, 0x18
call fcn.140184834
mov rbx, rax
mov rax, qword [rsi]
mov qword [rsi], 0
mov qword [rbx], r14
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r15
mov rcx, qword [rdi + 0x18]
mov rax, rcx
and rax, r12
cmp rax, qword [0x1402aaec8]
je 0x140068549
mov rax, r15
and rax, r12
cmp rax, qword [0x1402aaec8]
je 0x140068553
mov qword [rdi + 0x18], r15
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400be1b0]
xor r14d, r14d
xor ecx, ecx
xor edx, edx
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
cmp qword [rdi + 0x10], rax
je 0x1400684d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rdi + 0x10]
inc rax
cmp rax, 2
jae 0x14006851d
mov rax, r15
inc rax
cmp rax, 2
jb 0x1400684cc
mov qword [rdi + 0x10], r15
call fcn.1400e8860
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rdi + 0x10]
inc r15
cmp r15, 1
jbe 0x140068560
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
jne 0x140068535
mov eax, r14d
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400e8860
mov rcx, qword [rdi + 8]
call fcn.140165880
mov qword [rdi + 8], 0
jmp 0x1400683cd
call fcn.1400e8860
mov rcx, qword [rdi + 0x10]
call fcn.140165880
mov qword [rdi + 0x10], 0
jmp 0x1400684b7
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [case.0x1401eda70.0]
jmp 0x1400684f0
call fcn.1400de100
jmp 0x14006845a
mov rcx, r15
call fcn.1400da330
jmp 0x14006846d
mov rcx, qword [rdi + 0x18]
and r12, rcx
cmp r12, qword [0x1402aaec8]
jne 0x140068575
call fcn.1400de100
mov qword [rdi + 0x18], 0
test rbx, rbx
je 0x1400685bc
mov rdi, qword [rbx + 0x10]
mov qword [rbx + 0x10], 0
test rdi, rdi
je 0x1400685a3
mov rcx, rdi
call fcn.1400cac90
mov rcx, rdi
call fcn.14018482c
mov rcx, qword [rbx + 8]
mov qword [rbx + 8], 0
test rcx, rcx
jne 0x1400685c7
mov rcx, rbx
call fcn.14018482c
mov r14d, 0x3b
jmp 0x1400684e1
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [case.0x1401eda70.0]
jmp 0x1400685b4
Function at 0x140070170
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x1400701b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400701d5
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400701b1
mov qword [rsi], rdi
call fcn.1400e8860
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140070247
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400e8860
mov r14, qword [rsi]
cmp qword [0x1402b0e48], 0
je 0x140070206
mov rcx, qword [0x1402b0e48]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x1401eda70.0]
mov qword [rsi], 0
jmp 0x14007019f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetHandleVerifier
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007024a
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140070241
call qword [case.0x1401eda70.0]
mov rcx, rax
xor edx, edx
call fcn.14003dd60
jmp 0x1400701e7
xor ecx, ecx
mov dl, 1
jmp 0x14007023a
int3
xor ecx, ecx
jmp 0x140070238

Function at 0x1400705e0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov edi, r8d
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x50]
mov qword [r15 + 0x40], rax
movaps xmm0, xmmword [0x1402724c0]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r12, [rsp + 0x30]
mov rcx, r12
mov r9d, 0x97
call fcn.1400ed710
xor esi, esi
mov rcx, r15
mov rdx, r12
xor r8d, r8d
call fcn.14011a620
test edi, edi
js 0x1400706c9
lea r15, [rsp + 0x30]
mov dword [r15], 0xaaaaaaaa
mov rcx, qword [r14]
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8d, edi
mov r9, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [r15]
lea rcx, [rsp + 0x50]
call fcn.14011a160
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401874c0
mov eax, esi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14007069c
Function at 0x1400706d0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x60]
mov qword [rbx + 0x40], rax
movaps xmm0, xmmword [0x1402724c0]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DoDeleteFile
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r9d, 0x104
call fcn.1400ed710
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.14011a620
movzx ecx, byte [rsi + 0x17]
test cl, cl
mov rax, qword [rsi + 8]
mov rdx, rcx
cmovs rdx, rax
test rdx, rdx
je 0x140070813
test cl, cl
jns 0x140070771
cmp rax, 0x103
ja 0x14007086f
mov rcx, rsi
mov rdx, rdi
call fcn.1401483b0
movzx eax, byte [rsp + 0x57]
test al, al
mov rdx, rax
cmovs rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmovs rdi, rcx
test rdx, rdx
je 0x14007088a
lea r8, [rdi + rdx*2]
add rdx, rdx
mov r9, rdi
movzx r10d, word [r9]
cmp r10d, 0x2a
je 0x1400707c5
cmp r10d, 0x3f
je 0x1400707c5
add r9, 2
add rdx, 0xfffffffffffffffe
jne 0x1400707a8
mov r9, r8
cmp r9, r8
sete dl
sub r9, rdi
cmp r9, 0xfffffffffffffffe
sete bl
or bl, dl
test al, al
jns 0x1400707e0
call fcn.14018482c
test bl, bl
je 0x14007089c
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400707f4
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14007083d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
and eax, 0xfffffffe
cmp eax, 2
jne 0x1400708ea
lea rcx, [rsp + 0x60]
call fcn.14011a160
mov dil, 1
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401874c0
mov eax, edi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
mov edi, eax
test dil, 1
jne 0x140070904
cmp byte [rsi + 0x17], 0
jns 0x140070852
mov rsi, qword [rsi]
mov rcx, rsi
test dil, 0x10
je 0x140070867
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140070813
jmp 0x1400707ff
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140070861
lea rcx, [rsp + 0x60]
call fcn.14011a160
mov esi, 0xa1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x140070820
test al, al
jns 0x1400707e8
call fcn.14018482c
jmp 0x1400707e8
lea rdi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rdi
call fcn.1401483b0
lea rbx, [rsp + 0x28]
mov rcx, rsi
mov rdx, rbx
call fcn.1401487c0
mov rcx, rbx
mov rdx, rdi
call fcn.140025f40
mov esi, eax
cmp byte [rbx + 0x17], 0
jns 0x1400708d9
mov rcx, qword [rsp + 0x28]
call fcn.14018482c
cmp byte [rsp + 0x57], 0
jns 0x1400708ea
mov rcx, qword [rsp + 0x40]
call fcn.14018482c
lea rcx, [rsp + 0x60]
call fcn.14011a160
mov dil, 1
test esi, esi
je 0x140070820
jmp 0x14007087e
mov edx, edi
and edx, 0xfffffffe
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140070915
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140070849
jmp 0x1400707ff
Function at 0x140070930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x40], rax
movaps xmm0, xmmword [0x1402724c0]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x209
call fcn.1400ed710
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14011a620
cmp byte [rdi + 0x17], 0
jns 0x1400709b0
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.14011a160
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1401874c0
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400709f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rbx, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x40], rax
movaps xmm0, xmmword [0x1402724c0]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x40]
mov rcx, r14
mov r9d, 0x212
call fcn.1400ed710
xor esi, esi
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.14011a620
cmp byte [rbx + 0x17], 0
jns 0x140070a74
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140070b2b
test al, 0x10
mov eax, 0x40000000
mov edx, 2
cmove edx, eax
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
xor edi, edi
mov rcx, rbx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x140070af5
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp rbx, 0xffffffffffffffff
je 0x140070b8f
call fcn.1400e8860
mov rdi, rbx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
setne sil
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140070b2b
call fcn.1400e8860
cmp qword [0x1402b0e48], 0
je 0x140070b54
mov rcx, qword [0x1402b0e48]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [case.0x1401eda70.0]
lea rcx, [rsp + 0x60]
call fcn.14011a160
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401874c0
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetHandleVerifier
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140070b9c
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140070b96
call qword [case.0x1401eda70.0]
mov rcx, rax
xor edx, edx
call fcn.14003dd60
jmp 0x140070b15
xor edi, edi
jmp 0x140070aed
xor ecx, ecx
mov dl, 1
jmp 0x140070b88
xor ecx, ecx
jmp 0x140070b86