joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ed270
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x1402acb50], 0
je 0x1401ed2b6
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1401830b0
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x1402acb40]
test rdi, rdi
je 0x1401ed357
test byte [0x14029ae10], 1
je 0x1401ed299
cmp byte [rdi + 0x17], 0
jns 0x1401ed2d8
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1402acb50], rax
inc rax
cmp rax, 1
ja 0x1401ed299
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1401851f0
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1401ed441
xor esi, esi
jmp 0x1401ed299
mov ecx, 0x18
call fcn.1401803a4
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1401851f0
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x140268c70]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.1401bf270
movzx eax, byte [rdi + 0x17]
mov edx, eax
and edx, 0x7f
test al, al
cmovs rdx, qword [rdi + 8]
mov rcx, qword [rdi]
mov r8, rdi
cmovs r8, rcx
test rdx, rdx
je 0x1401ed40e
lea r10, [rdx + rdx]
test r10, r10
je 0x1401ed40e
lea r9, [r10 - 2]
cmp word [r8 + r10 - 2], 0x5c
mov r10, r9
jne 0x1401ed3d0
cmp r9, 0xfffffffffffffffe
je 0x1401ed40e
mov r8, r9
sar r8, 1
cmp rdx, r8
jbe 0x1401ed52a
lea rdx, [r8 + 1]
test al, al
jns 0x1401ed42f
mov qword [rdi + 8], rdx
mov word [rcx + r8*2 + 2], 0
lea rdx, [0x140277154]
mov r8d, 9
mov rcx, rdi
call fcn.14001e0f0
mov qword [0x1402acb40], rdi
jmp 0x1401ed2c6
cmp r9, 0x14
jae 0x1401ed524
mov byte [rdi + 0x17], dl
mov rcx, rdi
jmp 0x1401ed406
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140180ff4
mov rcx, qword [0x1402acb40]
mov rdx, rdi
mov r8, rax
call fcn.14002b3c0
mov rcx, qword [0x1402acb40]
movzx eax, byte [rcx + 0x17]
test al, al
jns 0x1401ed517
mov rax, qword [rcx + 8]
test rax, rax
je 0x1401ed527
mov rdx, qword [rcx]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x1401ed4a4
lea rdx, [0x140277150]
mov r8d, 1
call fcn.14001e0f0
mov rcx, qword [0x1402acb40]
lea rdx, [0x140277154]
mov r8d, 9
call fcn.14001e0f0
mov rcx, qword [0x1402acb40]
cmp byte [rcx + 0x17], 0
jns 0x1401ed4c6
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1402acb50], rax
inc rax
cmp rax, 1
ja 0x1401ed299
mov qword [0x1402acb50], 0
jmp 0x1401ed350
test rax, rax
je 0x1401ed527
mov rdx, rcx
jmp 0x1401ed483
int3
int3
int3
Function at 0x1401f59a0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
je 0x1401f59df
test r15, r15
je 0x1401f5acd
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x1401f5a29
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.140184b40
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x1401f59bd
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x1401f5af9
lea rcx, [r12*8]
call fcn.1401803a4
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x1401f5a9d
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
mov r10, rcx
add r10, r9
je 0x1401f5acd
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x1401f5a85
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x1401f59bd
mov rcx, r14
call fcn.14018039c
mov r15, qword [rsi + 0x10]
jmp 0x1401f59bd
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1401bda10
call fcn.1401bda10
int3
Function at 0x1401f5b00
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x1401f5b42
mov r14, rbx
add r14, 0xfffffffffffffff8
je 0x1401f5c34
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r15, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r15, rax
jae 0x1401f5b8f
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
shl r12, 2
and r12, 0xfffffffffffffff8
lea r14, [r15 + r12]
sub r15, rbx
sub r14, r15
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.140184b40
mov qword [rsi + 8], r14
add qword [rsi + 0x10], r12
jmp 0x1401f5b1f
mov rcx, rax
sub rcx, rbx
sar rcx, 2
cmp rax, rbx
mov r12d, 1
cmovne r12, rcx
mov rax, r12
shr rax, 0x3d
jne 0x1401f5c60
lea rcx, [r12*8]
call fcn.1401803a4
lea r14, [r12*2 + 6]
and r14, 0xfffffffffffffff8
add r14, rax
mov rcx, r14
sub r15, rbx
je 0x1401f5c07
mov rdx, r15
sar rdx, 3
and r15, 0xfffffffffffffff8
mov rcx, r15
add rcx, r14
shl rdx, 3
xor r8d, r8d
mov r9, r14
add r9, r8
je 0x1401f5c34
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x1401f5bef
lea rdx, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
test rbx, rbx
je 0x1401f5b1f
mov rcx, rbx
call fcn.14018039c
mov r14, qword [rsi + 8]
jmp 0x1401f5b1f
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1401bda10
call fcn.1401bda10
int3
Function at 0x1401fe6e0
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
je 0x1401fe71a
test rax, rax
je 0x1401fe7cc
mov rcx, qword [rdi]
mov qword [rax], rcx
add rax, 8
mov qword [rsi + 8], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
sub rax, qword [rsi]
mov r14, rax
sar r14, 3
lea rcx, [r14 + 1]
mov rdx, rcx
shr rdx, 0x3d
jne 0x1401fe7f8
movabs rdx, 0x1fffffffffffffff
mov rbx, rax
sar rbx, 2
cmp rbx, rcx
cmovbe rbx, rcx
movabs rcx, 0x7ffffffffffffff8
cmp rax, rcx
cmovae rbx, rdx
test rbx, rbx
jne 0x1401fe7c2
xor eax, eax
shl r14, 3
add r14, rax
je 0x1401fe7cc
lea rax, [rax + rbx*8]
mov rcx, qword [rdi]
mov qword [r14], rcx
lea rdx, [r14 + 8]
mov rcx, qword [rsi]
mov r8, qword [rsi + 8]
cmp r8, rcx
je 0x1401fe7a0
mov r9, qword [r8 - 8]
add r8, 0xfffffffffffffff8
mov qword [r14 - 8], r9
add r14, 0xfffffffffffffff8
cmp r8, rcx
jne 0x1401fe788
mov rcx, qword [rsi]
mov qword [rsi], r14
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rax
test rcx, rcx
je 0x1401fe710
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1401fec60
mov rcx, rbx
call fcn.1401ff220
jmp 0x1401fe765
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1401bda10
call fcn.1401c33a0
int3

Function at 0x140208090
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x38], rax
movdqu xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x20], xmm0
mov rbx, qword [rcx + 0x50]
mov rax, qword [rcx + 0x58]
mov edi, 1
cmp rbx, rax
je 0x1402080e4
mov rsi, r8
movdqu xmm0, xmmword [rbx]
pcmpeqb xmm0, xmmword [rsp + 0x20]
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x1402080fb
add rbx, 0x70
cmp rbx, rax
jne 0x1402080c5
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401830b0
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
cmp rbx, rax
je 0x1402080e4
cmp byte [rbx + 0x27], 0
js 0x14020810c
lea rcx, [rbx + 0x10]
jmp 0x140208110
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov edi, 1
cmovne edi, ecx
test edi, edi
jne 0x1402080e4
mov qword [rsi], rbx
xor edi, edi
jmp 0x1402080e4
Function at 0x1402082a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movdqu xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x20], xmm0
mov r14, qword [rcx + 0x50]
mov rax, qword [rcx + 0x58]
mov esi, 1
cmp r14, rax
je 0x1402082fa
mov rdi, r9
mov rbx, rcx
movdqu xmm0, xmmword [r14]
pcmpeqb xmm0, xmmword [rsp + 0x20]
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x140208313
add r14, 0x70
cmp r14, rax
jne 0x1402082da
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401830b0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp r14, rax
je 0x1402082fa
mov eax, dword [r14 + 0x68]
cmp eax, r8d
je 0x140208330
xor ecx, ecx
cmp eax, 1
sete cl
lea esi, [rcx + rcx*2]
inc esi
jmp 0x1402082fa
cmp byte [r14 + 0x27], 0
js 0x14020833d
lea rcx, [r14 + 0x10]
jmp 0x140208341
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402082fa
shr eax, 3
and eax, 2
mov esi, eax
jne 0x1402082fa
mov byte [rbx + 0x48], 1
mov qword [rdi], r14
xor esi, esi
jmp 0x1402082fa

Function at 0x14020a230
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1402b2bf0]
test rax, rax
jne 0x14020a274
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1402b2bf0]
test rax, rax
je 0x14020a261
cmp eax, 2
je 0x14020a305
mov eax, 1
lock xadd qword [0x1402b2c28], rax
test rax, rax
jle 0x14020a29d
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1402b2ba8], eax
mov qword [0x1402b2ba0], rsi
mov rcx, qword [0x1402a7048]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1402acb48], 2
jg 0x14020a34d
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xba
mov r9d, 2
call fcn.140004b00
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
jmp 0x14020a340
cmp dword [0x1402acb48], 2
jg 0x14020a34d
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x8e
mov r9d, 2
call fcn.140004b00
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
call fcn.1401bd290
mov rcx, rsi
call fcn.140004bf0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401830b0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x1402128b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, 0xffffffffffffffff
xor edx, edx
div rcx
mov rbx, 0xfffffffffffffffe
sub rbx, rdx
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x28]
mov qword [rsp + 0x28], r14
mov rcx, rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140212932
mov rax, qword [rsp + 0x28]
cmp rax, rbx
ja 0x1402128f0
xor edx, edx
div rsi
mov rsi, rdx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401830b0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
int3

Function at 0x140212d10
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140212d5e
mov rdx, rcx
add rdi, rdx
cmp al, 1
je 0x140212d9c
cmp rdi, rsi
jae 0x140212d9c
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x140212d57
jmp 0x140212d54
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401830b0
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140213980
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor r8d, r8d
call fcn.14004ab70
test rax, rax
jne 0x1402139be
mov rcx, rdi
call fcn.14005a990
test al, al
je 0x1402139be
mov r8d, 0x28
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14005bd10
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1402156f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x14021571a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140215739
mov edi, eax
bt eax, 0xa
jae 0x140215731
test bl, bl
je 0x140215747
and edi, 0x10
shr edi, 4
jmp 0x140215749
mov ecx, 2
call fcn.1400e83b0
test al, al
jne 0x140215766
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1401830b0
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x82
mov r9d, 2
call fcn.1401ed840
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401bd290
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.140145eb0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1402157e6
and r8d, 0x7f
jmp 0x1402157f0
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1401bd290
cmp byte [rsp + 0x57], 0
jns 0x14021580c
mov rcx, qword [rsp + 0x40]
call fcn.14018039c
lea rcx, [rsp + 0x58]
call fcn.1401ed8c0
jmp 0x140215747
Function at 0x140215820
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
cmp byte [rcx + 0x17], 0
jns 0x14021584b
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14021587b
test bl, bl
je 0x14021586b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140215898
mov ecx, 2
call fcn.1400e83b0
test al, al
jne 0x1402158bc
xor edi, edi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1401830b0
mov eax, edi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
ret
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.1402156f0
test al, al
jne 0x14021587b
mov ecx, 2
call fcn.1400e83b0
test al, al
je 0x140215879
jmp 0x140215980
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x40]
mov r8d, 0x62
mov r9d, 2
call fcn.1401ed840
lea rcx, [rsp + 0x50]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1401bd290
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x190]
mov rcx, rsi
call fcn.140145eb0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14021593f
and r8d, 0x7f
jmp 0x14021594f
mov r8, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rcx, rdi
mov rdx, rsi
call fcn.1401bd290
cmp byte [rsp + 0x1a7], 0
jns 0x140215971
mov rcx, qword [rsp + 0x190]
call fcn.14018039c
lea rcx, [rsp + 0x40]
call fcn.1401ed8c0
jmp 0x140215879
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x40]
mov r8d, 0x5d
mov r9d, 2
call fcn.140004b00
lea rdi, [rsp + 0x50]
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x180]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x190]
mov rcx, rsi
call fcn.140145eb0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1402159e8
and r8d, 0x7f
jmp 0x1402159f8
mov r8, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rcx, rdi
mov rdx, rsi
call fcn.1401bd290
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.1401bd290
cmp byte [rsp + 0x1a7], 0
jns 0x140215a2f
mov rcx, qword [rsp + 0x190]
call fcn.14018039c
lea rcx, [rsp + 0x40]
call fcn.140004bf0
jmp 0x140215879
Function at 0x140215a40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140215a67
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140215a97
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401830b0
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400e83b0
test al, al
jne 0x140215aa9
xor esi, esi
jmp 0x140215a7b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x75
mov r9d, 2
call fcn.1401ed840
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401bd290
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140145eb0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x140215b29
and r8d, 0x7f
jmp 0x140215b33
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1401bd290
cmp byte [rsp + 0x4f], 0
jns 0x140215b4f
mov rcx, qword [rsp + 0x38]
call fcn.14018039c
lea rcx, [rsp + 0x50]
call fcn.1401ed8c0
jmp 0x140215aa5
Function at 0x140215b60
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140215b87
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140215b9e
and eax, 0x410
cmp eax, 0x410
je 0x140215be3
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140215baa
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x140215bc7
mov ecx, 2
call fcn.1400e83b0
test al, al
jne 0x140215c04
xor edi, edi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401830b0
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401830b0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140215cc0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x95
mov r9d, 2
call fcn.1401ed840
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.1401bd290
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140145eb0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x140215c84
and r8d, 0x7f
jmp 0x140215c8e
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1401bd290
cmp byte [rsp + 0x4f], 0
jns 0x140215caa
mov rcx, qword [rsp + 0x38]
call fcn.14018039c
lea rcx, [rsp + 0x50]
call fcn.1401ed8c0
jmp 0x140215bc5

Function at 0x140215cc0
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x140215ce8
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x140215d02
mov ecx, 2
call fcn.1400e83b0
test al, al
jne 0x140215d24
test esi, esi
setne bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1401830b0
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x30
mov r9d, 2
call fcn.1401ed840
lea rcx, [rsp + 0x68]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1401bd290
mov rbx, rax
movzx eax, byte [rdi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rdi]
cmovns rax, rdi
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
cmovs rcx, qword [rdi + 8]
mov qword [rdx + 8], rcx
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140145eb0
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
js 0x140215da4
and r8d, 0x7f
jmp 0x140215dae
mov r8, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rcx, rbx
mov rdx, rdi
call fcn.1401bd290
cmp byte [rsp + 0x57], 0
jns 0x140215dca
mov rcx, qword [rsp + 0x40]
call fcn.14018039c
lea rcx, [rsp + 0x58]
call fcn.1401ed8c0
jmp 0x140215d02