joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055cf0
Capabilities:
Get thread local storage value
Read file via mapping
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x130
mov r14, rcx
mov rdi, rdx
mov ecx, dword [0x140147124]
mov rbp, r8
shr rdi, 0x20
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140055d54
mov byte [rsp + 0x15c], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x140147124]
mov dword [rsp + 0x158], eax
mov rbx, qword [rsp + 0x158]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
shr rbx, 0x20
test bl, bl
je 0x140055d7a
mov r9d, esi
mov qword [rsp + 0x20], rbp
mov r8d, edi
mov edx, 6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
jmp 0x140055da4
mov cl, 1
call fcn.1400560e0
mov r9d, esi
mov qword [rsp + 0x20], rbp
mov r8d, edi
mov edx, 6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ecx, ecx
mov rdi, rax
call fcn.1400560e0
test rdi, rdi
jne 0x140055dfb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x11a
mov dword [rsp + 0x20], 2
lea r8, str..._.._.._BDMemoryMatrix_BDMemoryMatrix_Classes_Memory_MemoryLogger_logger_internal.cpp
mov ebx, eax
lea rdx, str.void___cdecl_inter_mmap_void__unsigned___int64_unsigned___int64_
lea rcx, [rsp + 0x30]
call fcn.14002d900
mov rcx, rax
lea rdx, str._Parfait__mmapfail_
call fcn.140009610
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rcx, [rsp + 0x30]
call fcn.14002dc50
lea r11, [rsp + 0x130]
mov rax, rdi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140055e20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rdi, rdx
mov ecx, dword [0x140147124]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140055e6b
mov byte [rsp + 0x44], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x140147124]
mov dword [rsp + 0x40], eax
mov rbx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
shr rbx, 0x20
test bl, bl
je 0x140055ea6
test rsi, rsi
je 0x140055e81
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140055ed5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov cl, 1
call fcn.1400560e0
test rsi, rsi
je 0x140055ebb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140055ece
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.1400560e0
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400560e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
movzx edi, cl
mov ecx, dword [0x140147124]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14005612d
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x3c], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x140147124]
mov dword [rsp + 0x38], eax
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [rsp + 0x38], rbx
mov rbx, qword [rsp + 0x30]
jmp 0x140056132
mov qword [rsp + 0x38], rax
mov ecx, dword [0x140147124]
mov byte [rsp + 0x3c], dil
mov rdx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x140056be0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
lea rbx, [rdx - 1]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, dword [rsp + 0x34]
cmp r8d, dword [rsp + 0x58]
mov rcx, qword [rdi + 0x18]
cmovb r8d, dword [rsp + 0x58]
mov eax, r8d
add rbx, rax
dec rax
not rax
and rbx, rax
mov rdx, rbx
call fcn.1400578d0
test al, al
jne 0x140056c47
lea rcx, str.Matrix_realloc_ftruncate_failed
call fcn.14004f4f0
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov rcx, qword [rdi + 0x38]
xor r9d, r9d
mov qword [rsp + 0x70], rbp
xor edx, edx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x78], rsi
lea r8d, [r9 + 4]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rbp, rax
call fcn.140055cf0
mov rsi, rax
test rax, rax
jne 0x140056c99
lea rcx, str.Matrix_realloc_mmap_failed
call fcn.14004f4f0
xor eax, eax
jmp 0x140056cb5
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rax, rsi
mov qword [rdi + 0x20], rbx
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x30], rbp
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140056fb0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov rax, qword gs:[0x58]
mov rbx, rcx
mov r8d, dword [0x1401476c0]
mov edi, edx
mov ecx, 0x80
mov r8, qword [rax + r8*8]
mov eax, dword [rcx + r8]
cmp dword [0x140147380], eax
jg 0x1400570dd
mov r8, qword [rbx + 0x18]
lea eax, [rdi - 1]
mov r9, qword [rbx + 0x10]
xor edx, edx
div r8
mov rdx, qword [0x140147378]
add rdx, 0x800000
mov qword [rsp + 0x70], rbp
mov r14, rax
mov rsi, rax
shl r14, 0x17
add rdx, r14
cmp rdx, r9
ja 0x1400570bf
cmp rax, qword [rbx + 0x58]
jne 0x14005703b
mov rcx, qword [rbx + 0x60]
test rcx, rcx
jne 0x1400570ad
mov rcx, qword [rbx + 0x60]
xor ebp, ebp
test rcx, rcx
je 0x14005705b
mov rdx, qword [rbx + 0x68]
call fcn.140055e20
mov r9d, dword [rbx + 0x10]
mov qword [rbx + 0x60], rbp
mov qword [rbx + 0x68], rbp
mov rax, qword [rbx]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r9d
xor r9d, r9d
mov rcx, qword [rax]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdx, qword [0x140147378]
mov r8d, 0x800000
add rdx, r14
mov rcx, rax
mov rbp, rax
call fcn.140055cf0
mov rcx, rax
test rax, rax
je 0x1400570bf
mov r8d, dword [rbx + 0x18]
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x68], rbp
mov qword [rbx + 0x58], rsi
imul r8d, esi
sub edi, r8d
mov eax, edi
shl rax, 4
add rax, rcx
jmp 0x1400570c1
xor eax, eax
mov rbp, qword [rsp + 0x70]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
lea rcx, [0x140147380]
call fcn.1400d4f04
cmp dword [0x140147380], 0xffffffff
jne 0x140056ff3
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x34]
lea rcx, [0x140147380]
cmp edx, dword [rsp + 0x58]
cmovb edx, dword [rsp + 0x58]
mov eax, edx
dec rdx
not rdx
add rax, 0x6f
and rdx, rax
mov qword [0x140147378], rdx
call fcn.1400d4ea4
jmp 0x140056ff3
Function at 0x140057140
Capabilities:
Get system information on windows

Disassembly:
push rbx
push r14
sub rsp, 0x68
mov rax, qword gs:[0x58]
mov rbx, rcx
mov edx, dword [0x1401476c0]
mov ecx, 0x80
mov rdx, qword [rax + rdx*8]
mov eax, dword [rcx + rdx]
cmp dword [0x140147370], eax
jg 0x140057376
mov qword [rsp + 0x80], rbp
lea rdx, str.stack_frames_entry.dat
mov qword [rsp + 0x88], rsi
mov rcx, rbx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x60], r15
call fcn.140055ef0
mov rbx, rax
mov r14, qword [rax]
cmp r14, 0xffffffffffffffff
jne 0x1400571bb
mov dword [0x140147120], 0x32
xor eax, eax
jmp 0x140057293
mov rcx, rbx
call fcn.1400578a0
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400571db
mov dword [0x140147120], 0x33
jmp 0x14005735a
mov rdx, qword [0x140147368]
cmp rsi, rdx
jbe 0x1400572b8
sub rax, rdx
test rax, 0x7fffff
jne 0x1400572b8
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x28], rbp
mov rcx, r14
mov dword [rsp + 0x20], edx
xor edx, edx
lea r8d, [rbp + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r8, qword [0x140147368]
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.140055cf0
mov rdi, rax
test rax, rax
jne 0x140057242
mov dword [0x140147120], 0x35
jmp 0x14005735a
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rax + 8], r15
mov rcx, r14
mov qword [rax], rbx
mov qword [rax + 0x10], rsi
lea r8d, [r9 + 4]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea rdx, [rsi - 0x800000]
mov r8d, 0x800000
mov rcx, rax
mov rbx, rax
call fcn.140055cf0
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x50], rbx
mov qword [rdi + 0x60], rbp
mov rax, rdi
mov qword [rdi + 0x58], rbp
mov r15, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
add rsp, 0x68
pop r14
pop rbx
ret
mov rcx, rbx
call fcn.1400578d0
test al, al
jne 0x1400572d3
mov dword [0x140147120], 0x34
jmp 0x14005735a
mov eax, dword [0x140147368]
xor ebp, ebp
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
mov rcx, r14
lea r8d, [rbp + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r8, qword [0x140147368]
xor edx, edx
mov rcx, rax
call fcn.140055cf0
xorps xmm0, xmm0
mov rdi, rax
mov rcx, rdi
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
mov qword [rax + 0x18], 0x7ffff
mov qword [rax + 0x20], 0x2b93
mov qword [rax], rbx
mov rax, qword [0x140147368]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x40], rax
call fcn.140056ed0
test al, al
jne 0x140057288
mov rcx, rbx
call fcn.140057870
mov edx, 8
mov rcx, rbx
call fcn.1400d4a4c
xor eax, eax
jmp 0x140057293
lea rcx, [0x140147370]
call fcn.1400d4f04
cmp dword [0x140147370], 0xffffffff
jne 0x140057172
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x34]
lea rcx, [0x140147370]
cmp edx, dword [rsp + 0x58]
cmovb edx, dword [rsp + 0x58]
mov eax, edx
dec rdx
not rdx
add rax, 0x6f
and rdx, rax
mov qword [0x140147368], rdx
call fcn.1400d4ea4
jmp 0x140057172
Function at 0x1400575b0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x70
mov rbx, rcx
mov r12, r9
mov rcx, qword [rcx]
mov rsi, r8
call fcn.140056fb0
xor r15d, r15d
mov r11, rax
mov edi, r15d
test rax, rax
je 0x140057767
mov r10d, dword [0x1401476c0]
mov rdx, qword gs:[0x58]
mov qword [rsp + 0x68], r13
mov r13d, dword [rsp + 0xc0]
mov qword [rsp + 0xa8], rbp
lea rdx, [rdx + r10*8]
mov r8d, 0x80
mov qword [rsp + 0xb8], rdx
mov qword [rsp + 0x60], r14
cmp edi, r13d
jae 0x140057745
mov rax, qword [r11]
mov ecx, edi
inc edi
mov qword [rsi + rcx*8], rax
mov rsi, qword [r11 + 8]
test rsi, rsi
je 0x140057745
mov rax, qword [rdx]
mov rbx, qword [rbx]
mov ecx, r8d
mov eax, dword [rcx + rax]
cmp dword [0x140147380], eax
jg 0x140057777
mov r8, qword [rbx + 0x18]
lea eax, [rsi - 1]
mov r9, qword [rbx + 0x10]
xor edx, edx
div r8
mov rdx, qword [0x140147378]
add rdx, 0x800000
mov r14, rax
shl r14, 0x17
mov rbp, rax
add rdx, r14
cmp rdx, r9
ja 0x140057745
cmp rax, qword [rbx + 0x58]
jne 0x1400576a0
mov rax, qword [rbx + 0x60]
test rax, rax
jne 0x140057710
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x1400576be
mov rdx, qword [rbx + 0x68]
call fcn.140055e20
mov r9d, dword [rbx + 0x10]
mov qword [rbx + 0x60], r15
mov qword [rbx + 0x68], r15
mov rax, qword [rbx]
xor edx, edx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r9d
xor r9d, r9d
mov rcx, qword [rax]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdx, qword [0x140147378]
mov r8d, 0x800000
add rdx, r14
mov rcx, rax
mov r15, rax
call fcn.140055cf0
test rax, rax
je 0x140057745
mov r8d, dword [rbx + 0x18]
mov qword [rbx + 0x68], r15
xor r15d, r15d
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x58], rbp
mov rbx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xb8]
imul r8d, ebp
sub esi, r8d
mov r8d, 0x80
mov r11d, esi
mov rsi, qword [rsp + 0xb0]
shl r11, 4
add r11, rax
jne 0x140057624
mov rbp, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov dword [r12], edi
add rsp, 0x70
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r12], r15d
add rsp, 0x70
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rcx, [0x140147380]
call fcn.1400d4f04
cmp dword [0x140147380], 0xffffffff
jne 0x14005765d
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x34]
cmp ecx, dword [rsp + 0x58]
cmovb ecx, dword [rsp + 0x58]
mov eax, ecx
dec rcx
not rcx
add rax, 0x6f
and rcx, rax
mov qword [0x140147378], rcx
lea rcx, [0x140147380]
call fcn.1400d4ea4
jmp 0x14005765d

Function at 0x1400578a0
Capabilities:
Get file size

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x1400578c1
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov rax, qword [rsp + 0x30]
jne 0x1400578c8
mov rax, 0xffffffffffffffff
add rsp, 0x28
ret
Function at 0x1400578d0
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x140057907
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140057907
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x140057907
mov al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14005ae80
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x1401114a8]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x14005aea8
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14005aebb
mov al, 1
jmp 0x14005afba
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14005afb2
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14005aed9
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.14002c1f0
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._client_crash_report_database_win.cc
mov r9d, 0x317
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::CreateDirectoryIfNecessary_const_class_base::FilePath__
lea rcx, [rsp + 0x40]
call fcn.14002db60
mov rcx, rax
lea rdx, str.CreateDirectory
call fcn.140009610
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14005af52
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.14000a0e0
lea rcx, [rsp + 0x40]
call fcn.14002df10
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x14005afae
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005afa9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005afa9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d4a4c
xor al, al
jmp 0x14005afba
mov rcx, rbx
call fcn.14005b2d0
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400d4b20
add rsp, 0x170
pop rbx
ret
Function at 0x14005b000
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
push rsi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x1401114a8]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov r15, rdx
lea r8, [rdx + 0x10]
lea rdx, [rsp + 0x30]
mov r12, rcx
call fcn.140059cf0
xor esi, esi
lea rcx, [rsp + 0x30]
mov r14, qword [rax]
mov qword [rsp + 0x40], r14
mov qword [rax], rsi
call fcn.140059980
test r14, r14
jne 0x14005b065
lea esi, [r14 + 3]
jmp 0x14005b1f6
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x1f0], rdi
call fcn.14002c3a0
movups xmm0, xmmword [r15]
mov rbx, qword [r14 + 0x30]
mov rdi, qword [r14 + 0x38]
movaps xmmword [rsp + 0x30], xmm0
cmp rbx, rdi
je 0x14005b0ae
nop dword [rax]
lea rcx, [rbx + 4]
lea rdx, [rsp + 0x30]
call fcn.140032ac0
test al, al
jne 0x14005b0ae
add rbx, 0x98
cmp rbx, rdi
jne 0x14005b090
mov rdi, qword [rsp + 0x1f0]
cmp rbx, qword [r14 + 0x38]
jne 0x14005b0c6
mov esi, 1
jmp 0x14005b1ed
lea rdx, [rbx + 0x18]
lea rcx, [rbp + 0x50]
call fcn.14002c3d0
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [r14 + 0x30]
call fcn.140060dc0
mov byte [r14 + 0x28], 1
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14005b1e2
cmp qword [rbp + 0x68], 8
lea rax, [rbp + 0x50]
lea rdx, [rsp + 0x30]
cmovae rax, qword [rbp + 0x50]
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.14002c1f0
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._client_crash_report_database_win.cc
mov esi, 2
lea rdx, str.enum_crashpad::CrashReportDatabase::OperationStatus___cdecl_crashpad::CrashReportDatabaseWin::DeleteReport_const_struct_crashpad::PftReportInfo__
mov r9d, 0x535
mov dword [rsp + 0x20], esi
lea rcx, [rsp + 0x48]
call fcn.14002db60
mov rcx, rax
lea rdx, str.DeleteFile
call fcn.140009610
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14005b189
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.14000a0e0
lea rcx, [rsp + 0x48]
call fcn.14002df10
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x14005b1ed
mov rcx, qword [rbp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b1db
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b1db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d4a4c
jmp 0x14005b1ed
mov rdx, r15
mov rcx, r12
call fcn.14005fb50
lea rcx, [rbp + 0x50]
call fcn.14002c3c0
lea rcx, [rsp + 0x40]
call fcn.140059980
mov eax, esi
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400d4b20
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
Function at 0x14005b2d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x1401114a8]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x14005b2f8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005b3f0
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14005b314
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.14002c1f0
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._client_crash_report_database_win.cc
mov r9d, 0x302
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea rcx, [rsp + 0x40]
call fcn.14002db60
mov rcx, rax
lea rdx, str.GetFileAttributes
call fcn.140009610
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14005b38d
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.14000a0e0
lea rcx, [rsp + 0x40]
call fcn.14002df10
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x14005b4e0
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b4db
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b4db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test al, 0x10
jne 0x14005b4e4
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14005b405
mov rax, qword [rbx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.14002c1f0
mov r9d, 0x306
mov dword [rsp + 0x20], 2
lea r8, str..._.._.._client_crash_report_database_win.cc
mov rbx, rax
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::EnsureDirectory_const_class_base::FilePath__
lea rcx, [rsp + 0x40]
call fcn.14002d900
mov rcx, rax
lea rdx, str.GetFileAttributes
call fcn.140009610
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14005b475
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.14000a0e0
lea rdx, str.:_not_a_directory
mov rcx, rax
call fcn.140009610
lea rcx, [rsp + 0x40]
call fcn.14002dc50
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x14005b4e0
mov rcx, qword [rsp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b4db
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b4db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d4a4c
xor al, al
jmp 0x14005b4e6
mov al, 1
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400d4b20
add rsp, 0x170
pop rbx
ret
Function at 0x14005b500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rcx + 0x38]
mov r14, r8
mov rsi, qword [rcx + 0x30]
mov eax, edx
mov qword [rsp + 0x78], rbx
cmp rsi, rbx
je 0x14005b687
movabs rbp, 0x1ffffffffffffff
nop dword [rax]
cmp dword [rsi + 0x80], eax
jne 0x14005b677
cmp qword [rsi + 0x30], 8
lea rcx, [rsi + 0x18]
jb 0x14005b55a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005b673
test al, 0x10
jne 0x14005b673
mov rdi, qword [r14 + 8]
mov rcx, qword [r14 + 0x10]
cmp rdi, rcx
je 0x14005b593
mov rdx, rsi
mov rcx, rdi
call fcn.140018570
sub qword [r14 + 8], 0xffffffffffffff80
jmp 0x14005b673
mov rax, qword [r14]
mov rbx, rdi
sub rbx, rax
sar rbx, 7
cmp rbx, rbp
je 0x14005b69e
sub rcx, rax
lea r13, [rbx + 1]
sar rcx, 7
mov rax, rbp
mov rdx, rcx
shr rdx, 1
sub rax, rdx
cmp rcx, rax
jbe 0x14005b5ca
mov r15, rbp
jmp 0x14005b5d5
lea r15, [rdx + rcx]
cmp r15, r13
cmovb r15, r13
mov rdx, r15
mov rcx, r14
call fcn.140060ce0
mov r12, rax
shl rbx, 7
add rax, rbx
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x60], rax
call fcn.140018570
mov rbp, qword [r14 + 8]
mov rbx, qword [r14]
cmp rdi, rbp
jne 0x14005b62a
mov rdi, r12
cmp rbx, rbp
je 0x14005b653
nop
mov rdx, rbx
mov rcx, rdi
call fcn.140018570
sub rdi, 0xffffffffffffff80
sub rbx, 0xffffffffffffff80
cmp rbx, rbp
jne 0x14005b610
jmp 0x14005b653
mov r9, r12
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.140060ab0
mov r9, qword [rsp + 0x60]
mov rdx, rdi
mov r8, qword [r14 + 8]
sub r9, 0xffffffffffffff80
mov rcx, r14
call fcn.140060ab0
mov r9, r15
mov r8, r13
mov rdx, r12
mov rcx, r14
call fcn.1400608a0
mov rbx, qword [rsp + 0x78]
movabs rbp, 0x1ffffffffffffff
mov eax, dword [rsp + 0x68]
add rsi, 0x98
cmp rsi, rbx
jne 0x14005b540
mov rbx, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140008be0
int3