joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a2460
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400a246d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400a247d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400a2465
lea eax, [rcx + 1]
jmp 0x1400a248b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400a249e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400a2484
sub eax, 3
jb 0x1400a24be
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400a250d
sar eax, 1
movsxd rbp, eax
jb 0x1400a24f4
jmp 0x1400a24cc
add ebx, ebx
jne 0x1400a24ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400a24f4
inc ecx
add ebx, ebx
jne 0x1400a24da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400a24f4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400a24ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400a24dc
add ecx, 2
jmp 0x1400a24f9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400a2422
jmp 0x1400a246d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x46000
mov dl, 0x1b
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400a255d
cmp rsi, rcx
jae 0x1400a2565
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400a2544
cmp al, 0x8f
ja 0x1400a2544
cmp byte [rsi - 2], 0xf
je 0x1400a254a
sub al, 0xe8
cmp al, 1
ja 0x1400a252e
cmp rsi, rcx
jae 0x1400a2565
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400a2534
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400a2565
lodsb al, byte [rsi]
jmp 0x1400a2544
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x9e000]
mov eax, dword [rdi]
or eax, eax
je 0x1400a25c2
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xafa90]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400a2572
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400a25bc
mov qword [rbx], rax
add rbx, 8
jmp 0x1400a2592
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400a25fc
cmp al, 0xef
ja 0x1400a25ee
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400a25ce
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400a25dd
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x247]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400a2650
sub rsp, 0xffffffffffffff80
jmp 0x140032a4c
Function at 0x14001bab0
Capabilities:
Check os version
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x160
xor r14d, r14d
movzx ebp, dl
mov dword [rsp + 0x188], r14d
mov rbx, rcx
mov edi, r14d
mov esi, r14d
test dl, dl
je 0x14001bbe0
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x14001bbe0
mov qword [rsp + 0x40], 0x18
mov dword [rsp + 0x54], r14d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword gs:[0x30]
mov rdx, qword [rcx + 0x110]
mov rcx, qword [rax + 0x48]
cmp qword [rdx + 0x10], rcx
jne 0x14001bb8d
lea rcx, [rsp + 0x58]
call fcn.140006da0
lea rax, str..._.._util_win_registration_protocol_win.cc
mov qword [rsp + 0x148], r14
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x140], rax
mov dword [rsp + 0x150], 0xfc
mov dword [rsp + 0x154], 4
call fcn.140013280
lea rdx, str.Check_failed:__IsThreadInLoaderLock__
lea rcx, [rsp + 0x58]
call fcn.140006680
mov rcx, rax
lea rdx, [0x1400c20f0]
call fcn.140006680
mov edi, 1
test dil, 1
je 0x14001bb9d
lea rcx, [rsp + 0x58]
call fcn.140012fd0
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400e4e54], eax
jg 0x14001bc37
mov rax, qword [0x1400e4e58]
lea rcx, [0x1400c6da0]
test rax, rax
mov dword [rsp + 0x50], 1
lea rsi, [rsp + 0x40]
cmovne rcx, rax
mov qword [rsp + 0x48], rcx
cmp qword [rbx + 0x18], 8
jb 0x14001bbea
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rsi
mov r9d, 2
mov edx, ebp
mov dword [rsp + 0x30], r14d
shl edx, 0x13
mov rcx, rbx
or edx, 3
mov dword [rsp + 0x28], 0x200
lea r8d, [r9 + 4]
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rcx, [0x1400e4e54]
call fcn.140080e34
cmp dword [0x1400e4e54], 0xffffffff
jne 0x14001bbb9
call fcn.14001b2c0
lea rcx, [0x1400e4e54]
mov qword [0x1400e4e58], rax
call fcn.140080dd4
jmp 0x14001bbb9
Function at 0x14001be00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x130
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x140]
mov ebx, 0xffffffff
mov qword [rsp + 0x20], 0
cmp r8, rbx
cmova r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14001be44
mov rax, 0xffffffffffffffff
add rsp, 0x130
pop rbx
ret
mov dword [rsp + 0x150], ebx
cmp dword [rsp + 0x140], ebx
jne 0x14001bf1d
lea r8, str.bytes_written___static_cast_DWORD___1_
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x140]
call fcn.14001d570
mov rbx, rax
test rax, rax
je 0x14001bf1d
lea rcx, [rsp + 0x30]
call fcn.140006da0
lea rax, str..._.._util_file_file_io_win.cc
mov qword [rsp + 0x120], 0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x118], rax
mov dword [rsp + 0x128], 0x65
mov dword [rsp + 0x12c], 4
call fcn.140013280
lea rdx, str.Check_failed:
lea rcx, [rsp + 0x30]
call fcn.140006680
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14001bee3
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140009230
mov rcx, rax
lea rdx, [0x1400c20f0]
call fcn.140006680
mov rcx, rbx
call fcn.140001980
mov edx, 0x20
mov rcx, rbx
call fcn.1400809f0
lea rcx, [rsp + 0x30]
call fcn.140012fd0
mov eax, dword [rsp + 0x140]
add rsp, 0x130
pop rbx
ret

Function at 0x14001c630
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x1400e0038]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor edi, edi
lea r8, [0x14001c970]
mov rbx, rcx
mov qword [rsp + 0x28], rdi
mov r9, rcx
mov dword [rsp + 0x20], edi
xor edx, edx
mov dword [rsp + 0x30], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x14001c708
lea edi, [rax + 2]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x38]
mov ebx, eax
call fcn.140006da0
lea rax, str..._.._util_thread_thread_win.cc
mov qword [rsp + 0x128], 0
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x130], 0x1b
mov dword [rsp + 0x134], 4
call fcn.140013280
lea rdx, str.Check_failed:_platform_thread_
mov dword [rsp + 0x138], ebx
lea rcx, [rsp + 0x38]
call fcn.140006680
mov rcx, rax
lea rdx, [0x1400c20f0]
call fcn.140006680
mov rcx, rax
lea rdx, [0x1400c6698]
call fcn.140006680
test dil, 2
je 0x14001c79c
lea rdx, [0x1400c2070]
lea rcx, [rsp + 0x38]
call fcn.140006680
mov edx, dword [rsp + 0x138]
lea rcx, [rsp + 0x140]
mov rbx, rax
call fcn.140012e60
cmp qword [rax + 0x18], 0x10
mov r8, qword [rax + 0x10]
jb 0x14001c748
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140009230
mov rdx, qword [rsp + 0x158]
cmp rdx, 0x10
jb 0x14001c792
mov rcx, qword [rsp + 0x140]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c78d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c7bd
call fcn.1400809f0
lea rcx, [rsp + 0x38]
call fcn.140012fd0
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400809d0
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rdi
ret
call fcn.140087b78
int3
Function at 0x14001ce40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rsi, r8
lea r9, [rsp + 0x170]
xor r15d, r15d
mov r14d, 0xffffffff
cmp r8, r14
mov qword [rsp + 0x20], r15
mov rbp, rdx
mov rdi, rcx
cmova esi, r14d
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001cfac
lea r12, str..._.._util_file_file_io_win.cc
nop word [rax + rax]
mov dword [rsp + 0x178], r14d
cmp dword [rsp + 0x170], r14d
jne 0x14001cf70
lea r8, str.bytes_read___static_cast_DWORD___1_
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x170]
call fcn.14001d570
mov rbx, rax
test rax, rax
je 0x14001cf70
lea rcx, [rsp + 0x30]
call fcn.140006da0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x118], r12
mov qword [rsp + 0x120], r15
mov dword [rsp + 0x128], 0x7e
mov dword [rsp + 0x12c], 4
call fcn.140013280
lea rdx, str.Check_failed:
lea rcx, [rsp + 0x30]
call fcn.140006680
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14001cf36
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140009230
mov rcx, rax
lea rdx, [0x1400c20f0]
call fcn.140006680
mov rcx, rbx
call fcn.140001980
mov edx, 0x20
mov rcx, rbx
call fcn.1400809f0
lea rcx, [rsp + 0x30]
call fcn.140012fd0
cmp dword [rsp + 0x170], r15d
jne 0x14001cfd6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x14001cfd6
lea r9, [rsp + 0x170]
mov qword [rsp + 0x20], r15
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14001cea0
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x6d
neg eax
sbb rax, rax
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov eax, dword [rsp + 0x170]
jmp 0x14001cfba
Function at 0x14001d330
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1400e0038]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor ebx, ebx
lea r8, [rsp + 0x20]
mov edx, ebx
xor r9d, r9d
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14001d455
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x28]
mov edi, eax
call fcn.140006da0
lea rax, str..._.._util_file_file_io_win.cc
mov qword [rbp + 0x18], rbx
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], 0xf1
mov dword [rbp + 0x24], 2
call fcn.140013280
lea rdx, [0x1400c7170]
mov dword [rbp + 0x28], edi
lea rcx, [rsp + 0x28]
call fcn.140006680
lea rdx, [0x1400c2070]
lea rcx, [rsp + 0x28]
call fcn.140006680
mov edx, dword [rbp + 0x28]
lea rcx, [rbp + 0x30]
mov rbx, rax
call fcn.140012e60
cmp qword [rax + 0x18], 0x10
mov r8, qword [rax + 0x10]
jb 0x14001d3ed
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140009230
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14001d433
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d42e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d565
call fcn.1400809f0
movdqa xmm0, xmmword [0x1400cd310]
lea rcx, [rsp + 0x28]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
call fcn.140012fd0
xor al, al
jmp 0x14001d53e
cmp qword [rsp + 0x20], rbx
jne 0x14001d538
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14001d53c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x28]
mov edi, eax
call fcn.140006da0
lea rax, str..._.._util_file_file_io_win.cc
mov qword [rbp + 0x18], rbx
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], 0xfb
mov dword [rbp + 0x24], 2
call fcn.140013280
lea rdx, [0x1400c7188]
mov dword [rbp + 0x28], edi
lea rcx, [rsp + 0x28]
call fcn.140006680
lea rdx, [0x1400c2070]
lea rcx, [rsp + 0x28]
call fcn.140006680
mov edx, dword [rbp + 0x28]
lea rcx, [rbp + 0x30]
mov rbx, rax
call fcn.140012e60
cmp qword [rax + 0x18], 0x10
mov r8, qword [rax + 0x10]
jb 0x14001d4ec
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140009230
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14001d52e
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d529
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d55f
call fcn.1400809f0
lea rcx, [rsp + 0x28]
call fcn.140012fd0
xor al, al
jmp 0x14001d53e
mov al, 1
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400809d0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140087b78
int3
call fcn.140087b78
int3
Function at 0x14001f1f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rcx + 0x50]
mov rdi, r8
mov r13, qword [rcx + 0x58]
mov eax, edx
cmp rbx, r13
je 0x14001f37b
movabs rsi, 0x1af286bca1af286
movabs r15, 0x6bca1af286bca1b
movabs r14, 0x86bca1af286bca1b
nop dword [rax]
cmp dword [rbx + 0x98], eax
jne 0x14001f36b
cmp qword [rbx + 0x28], 8
lea rcx, [rbx + 0x10]
jb 0x14001f25a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001f367
test al, 0x10
jne 0x14001f367
mov rbp, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rbp
cmp rbp, r8
je 0x14001f296
mov rdx, rbx
call fcn.140023930
add qword [rdi + 8], 0x98
jmp 0x14001f367
mov r9, qword [rdi]
mov rax, r15
sub rcx, r9
imul rcx
mov r15, rdx
sar r15, 2
mov rax, r15
shr rax, 0x3f
add r15, rax
cmp r15, rsi
je 0x14001f392
sub r8, r9
lea r12, [r15 + 1]
sar r8, 3
mov rax, rsi
imul r8, r14
mov rcx, r8
shr rcx, 1
sub rax, rcx
cmp r8, rax
ja 0x14001f2e7
lea rsi, [rcx + r8]
cmp rsi, r12
cmovb rsi, r12
mov rdx, rsi
call fcn.140023770
imul r15, r15, 0x98
mov rdx, rbx
mov r14, rax
add r15, rax
mov rcx, r15
call fcn.140023930
mov rdx, qword [rdi + 8]
mov r8, r14
mov rcx, qword [rdi]
cmp rbp, rdx
jne 0x14001f31d
call fcn.1400237e0
jmp 0x14001f338
mov rdx, rbp
call fcn.140023840
mov rdx, qword [rdi + 8]
lea r8, [r15 + 0x98]
mov rcx, rbp
call fcn.140023840
mov r9, rsi
mov r8, r12
mov rdx, r14
mov rcx, rdi
call fcn.140023680
movabs rsi, 0x1af286bca1af286
movabs r14, 0x86bca1af286bca1b
movabs r15, 0x6bca1af286bca1b
mov eax, dword [rsp + 0x68]
add rbx, 0xa0
cmp rbx, r13
jne 0x14001f240
mov rbx, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140001860
int3

Function at 0x14001f3a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
movups xmm0, xmmword [rdx]
mov rbx, qword [rcx + 0x50]
mov rsi, r9
mov rax, qword [rcx + 0x58]
mov rdi, rcx
movaps xmmword [rsp + 0x20], xmm0
cmp rbx, rax
je 0x14001f3eb
mov rdx, qword [rsp + 0x28]
mov r9, qword [rsp + 0x20]
cmp qword [rbx], r9
jne 0x14001f3df
cmp qword [rbx + 8], rdx
je 0x14001f400
add rbx, 0xa0
cmp rbx, rax
jne 0x14001f3d4
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, dword [rbx + 0x98]
cmp ecx, r8d
jne 0x14001f433
cmp qword [rbx + 0x28], 8
lea rcx, [rbx + 0x10]
jb 0x14001f419
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001f42b
mov eax, 1
jmp 0x14001f442
shr eax, 3
and eax, 2
jmp 0x14001f442
mov eax, 1
mov edx, 4
cmp ecx, eax
cmove eax, edx
test eax, eax
jne 0x14001f3f0
mov qword [rsi], rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov byte [rdi + 0x48], 1
add rsp, 0x30
pop rdi
ret
Function at 0x140020890
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1400e0038]
xor rax, rsp
mov qword [rbp + 0x50], rax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x1400208bd
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400209b6
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x1400208d9
mov rcx, qword [rbx]
movdqa xmm1, xmmword [0x1400cd310]
lea r8, [rbp + 0x30]
mov rdx, qword [rbx + 0x10]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x30], 0
movdqu xmmword [rbp + 0x40], xmm1
call fcn.1400111b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x28]
mov ebx, eax
call fcn.140006da0
lea rax, str..._.._client_crash_report_database_win.cc
mov qword [rbp + 0x18], 0
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], 0x267
mov dword [rbp + 0x24], 2
call fcn.140013280
lea rdx, str.GetFileAttributes
mov dword [rbp + 0x28], ebx
lea rcx, [rsp + 0x28]
call fcn.140006680
cmp qword [rbp + 0x48], 0x10
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x40]
mov rcx, rax
cmovae rdx, qword [rbp + 0x30]
call fcn.140009230
lea rcx, [rsp + 0x28]
call fcn.140013810
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140020aa0
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020a9b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020ac9
jmp 0x140020a9b
test al, 0x10
jne 0x140020aa4
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x1400209cb
mov rcx, qword [rbx]
movdqa xmm1, xmmword [0x1400cd310]
lea r8, [rbp + 0x30]
mov rdx, qword [rbx + 0x10]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x30], 0
movdqu xmmword [rbp + 0x40], xmm1
call fcn.1400111b0
lea rcx, [rsp + 0x28]
call fcn.140006da0
lea rax, str..._.._client_crash_report_database_win.cc
mov qword [rbp + 0x18], 0
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], 0x26b
mov dword [rbp + 0x24], 2
call fcn.140013280
lea rdx, str.GetFileAttributes
lea rcx, [rsp + 0x28]
call fcn.140006680
cmp qword [rbp + 0x48], 0x10
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x40]
mov rcx, rax
cmovae rdx, qword [rbp + 0x30]
call fcn.140009230
lea rdx, str.:_not_a_directory
mov rcx, rax
call fcn.140006680
lea rcx, [rsp + 0x28]
call fcn.140012fd0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140020aa0
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020a9b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020ac3
call fcn.1400809f0
xor al, al
jmp 0x140020aa6
mov al, 1
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400809d0
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rbp
ret
call fcn.140087b78
int3
call fcn.140087b78
int3
Function at 0x140020ad0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x1400e0038]
xor rax, rsp
mov qword [rsp + 0x150], rax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x140020af8
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140020b0b
mov al, 1
jmp 0x140020c3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
cmp eax, 0xb7
je 0x140020c3a
cmp qword [rbx + 0x18], 8
jb 0x140020b29
mov rcx, qword [rbx]
movdqa xmm1, xmmword [0x1400cd310]
lea r8, [rsp + 0x130]
mov rdx, qword [rbx + 0x10]
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
mov byte [rsp + 0x130], 0
movdqu xmmword [rsp + 0x140], xmm1
call fcn.1400111b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x28]
mov ebx, eax
call fcn.140006da0
lea rax, str..._.._client_crash_report_database_win.cc
mov qword [rsp + 0x118], 0
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x120], 0x27c
mov dword [rsp + 0x124], 2
call fcn.140013280
lea rdx, str.CreateDirectory
mov dword [rsp + 0x128], ebx
lea rcx, [rsp + 0x28]
call fcn.140006680
cmp qword [rsp + 0x148], 0x10
lea rdx, [rsp + 0x130]
mov r8, qword [rsp + 0x140]
mov rcx, rax
cmovae rdx, qword [rsp + 0x130]
call fcn.140009230
lea rcx, [rsp + 0x28]
call fcn.140013810
mov rdx, qword [rsp + 0x148]
cmp rdx, 0x10
jb 0x140020c36
mov rcx, qword [rsp + 0x130]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020c31
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020c58
call fcn.1400809f0
xor al, al
jmp 0x140020c3f
call fcn.140020890
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400809d0
add rsp, 0x160
pop rbx
ret
call fcn.140087b78
int3

Function at 0x1400218b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rsi, r8
lea rdx, [rsp + 0x58]
call fcn.140022160
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x1400218de
lea edi, [rax + 3]
jmp 0x14002191c
movups xmm0, xmmword [rbx]
mov rbx, qword [rax + 0x50]
mov rcx, qword [rax + 0x58]
movaps xmmword [rsp + 0x20], xmm0
cmp rbx, rcx
je 0x140021917
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
nop dword [rax]
cmp qword [rbx], rdx
jne 0x14002190b
cmp qword [rbx + 8], rax
je 0x140021938
add rbx, 0xa0
cmp rbx, rcx
jne 0x140021900
mov edi, 1
lea rcx, [rsp + 0x58]
call fcn.140022e80
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp qword [rbx + 0x28], 8
lea rcx, [rbx + 0x10]
jb 0x140021946
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14002195a
mov edi, 1
jmp 0x140021962
shr edi, 3
and edi, 2
je 0x140021967
mov rbx, qword [rsp + 0x58]
test edi, edi
jne 0x14002191c
mov rdx, rbx
mov rcx, rsi
call fcn.140021980
jmp 0x14002191c