joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058cf0
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x298
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x290], rax
lea rbx, [rsp + 0x80]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1401851f0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x140058df0
lea r14, [rsp + 0x28]
mov qword [r14], rbx
mov rcx, rbx
call fcn.140180ff4
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov rdx, r14
call fcn.140109400
movaps xmm0, xmmword [0x140268c70]
lea r14, [rsp + 0x50]
movaps xmmword [r14], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [r14 + 0x10], rax
movzx eax, byte [rbx + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rbx]
cmovns rax, rbx
lea rdx, [rsp + 0x70]
mov qword [rdx], rax
cmovs rcx, qword [rbx + 8]
mov qword [rdx + 8], rcx
mov rcx, r14
call fcn.140109400
mov rcx, r14
call fcn.14004ac50
cmp byte [rsi + 0x17], 0
js 0x140058e18
mov rax, qword [rsp + 0x60]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x67], 0
mov word [rsp + 0x50], 0
cmp byte [rsp + 0x4f], 0
jns 0x140058df0
mov rcx, qword [rsp + 0x38]
call fcn.14018039c
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1401830b0
mov eax, ebx
add rsp, 0x298
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsi]
call fcn.14018039c
jmp 0x140058dc2
Function at 0x14005a990
Capabilities:
Clear file content

Disassembly:
push rsi
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x178], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r8, [rsp + 0x170]
mov qword [r8], rax
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14005aa07
cmp qword [rsp + 0x170], 0
jne 0x14005aa58
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x14005aa5c
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1401830b0
mov eax, esi
add rsp, 0x180
pop rsi
ret
cmp dword [0x1402acb48], 2
jg 0x14005aa58
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xf1
mov r9d, 2
call fcn.1401ed840
lea rcx, [rsp + 0x40]
lea rdx, [0x14028372a]
mov r8d, 0x10
call fcn.1401bd290
mov rcx, rsi
call fcn.1401ed8c0
xor esi, esi
jmp 0x14005a9ec
cmp dword [0x1402acb48], 2
jg 0x14005aa58
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfb
mov r9d, 2
call fcn.1401ed840
lea rcx, [rsp + 0x40]
lea rdx, [0x14028373b]
mov r8d, 0xc
jmp 0x14005aa4b

Function at 0x14005bd10
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov sil, 1
test r8, r8
je 0x14005bd9a
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov r12d, 0xffffffff
lea r15, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, r12
mov r8d, 0xffffffff
cmovb r8, rdi
mov dword [rsp + 0x28], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rbx
mov r9, r15
call r13
test eax, eax
je 0x14005bdbf
mov eax, dword [rsp + 0x28]
cmp rax, r12
je 0x14005be14
add rbx, rax
sub rdi, rax
jne 0x14005bd57
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1401830b0
mov eax, esi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [0x1402acb48], 2
jg 0x14005be10
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x8c
mov r9d, 2
call fcn.1401ed840
lea rcx, [rsp + 0x38]
lea rdx, [0x1402837a4]
mov r8d, 9
call fcn.1401bd290
mov rcx, rsi
call fcn.1401ed8c0
xor esi, esi
jmp 0x14005bd9a
int3
Function at 0x140060e30
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.140061840
mov rax, qword [rsi]
test rax, rax
je 0x140060ea7
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x140060eae
lea rcx, [rsp + 0x28]
call fcn.140060f10
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401830b0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140060e80
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
je 0x140060ec6
add rbx, 0x70
cmp rbx, r15
je 0x140060e80
jmp 0x140060eb5
cmp byte [rbx + 0x27], 0
js 0x140060ed2
lea rcx, [rbx + 0x10]
jmp 0x140060ed6
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
jne 0x140060ebb
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
je 0x140060efc
mov rcx, r14
mov rdx, rbx
call fcn.1400bdb30
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x140060ebb
mov rcx, rdi
mov rdx, rbx
call fcn.1400bd910
jmp 0x140060ebb
Function at 0x140065b40
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rcx], 0
mov byte [rcx + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x140065c4b
lea rdi, [rsi + 0x10]
lea rdx, [0x14026f451]
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.1401beb80
mov rcx, rdi
mov rdx, rbx
call fcn.140065c50
cmp byte [rbx + 0x17], 0
js 0x140065c3c
mov dword [rsi + 0x98], 0x103
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0xa0], 0
test rax, rax
je 0x140065c06
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0xa0]
inc rax
cmp rax, 2
jae 0x140065c1e
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140065bfe
mov qword [rsi + 0xa0], rdi
call fcn.1400e62c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401830b0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.1400e62c0
mov rcx, qword [rsi + 0xa0]
call fcn.140161150
mov qword [rsi + 0xa0], 0
jmp 0x140065be8
mov rcx, qword [rsp + 0x20]
call fcn.14018039c
jmp 0x140065ba0
int3
Function at 0x140066770
Capabilities:
Check if file exists
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rax, qword [rcx + 8]
mov r14d, 8
inc rax
cmp rax, 1
ja 0x1400668f1
mov rdi, rcx
cmp qword [rcx + 0x18], 0
jne 0x1400668f1
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov r14, rax
cmp qword [rdi + 8], rax
je 0x1400667fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi + 8]
inc rax
cmp rax, 2
jae 0x140066912
mov rax, r14
inc rax
cmp rax, 2
jb 0x1400667f2
mov qword [rdi + 8], r14
call fcn.1400e62c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400669cc
movabs r12, 0xfffffffc00000000
mov ecx, 0x20
call fcn.1401803a4
mov r15, rax
mov qword [rax], rax
mov qword [rax + 8], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov ecx, 0x18
call fcn.1401803a4
mov rbx, rax
mov rax, qword [rsi]
mov qword [rsi], 0
mov qword [rbx], r14
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r15
mov rcx, qword [rdi + 0x18]
mov rax, rcx
and rax, r12
cmp rax, qword [0x1402a6e88]
je 0x140066945
mov rax, r15
and rax, r12
cmp rax, qword [0x1402a6e88]
je 0x14006694f
mov qword [rdi + 0x18], r15
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400bc3f0]
xor r14d, r14d
xor ecx, ecx
xor edx, edx
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
cmp qword [rdi + 0x10], rax
je 0x1400668e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rdi + 0x10]
inc rax
cmp rax, 2
jae 0x14006692d
mov rax, r15
inc rax
cmp rax, 2
jb 0x1400668dc
mov qword [rdi + 0x10], r15
call fcn.1400e62c0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rdi + 0x10]
inc r15
cmp r15, 1
jbe 0x140066970
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
jne 0x14006695c
mov eax, r14d
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400e62c0
mov rcx, qword [rdi + 8]
call fcn.140161150
mov qword [rdi + 8], 0
jmp 0x1400667dd
call fcn.1400e62c0
mov rcx, qword [rdi + 0x10]
call fcn.140161150
mov qword [rdi + 0x10], 0
jmp 0x1400668c7
call fcn.1400db1b0
jmp 0x14006686a
mov rcx, r15
call fcn.1400d8270
jmp 0x14006687d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [case.0x1401e9be0.0]
jmp 0x140066900
mov rcx, qword [rdi + 0x18]
and r12, rcx
cmp r12, qword [0x1402a6e88]
jne 0x140066985
call fcn.1400db1b0
mov qword [rdi + 0x18], 0
test rbx, rbx
je 0x1400669cc
mov rdi, qword [rbx + 0x10]
mov qword [rbx + 0x10], 0
test rdi, rdi
je 0x1400669b3
mov rcx, rdi
call fcn.1400c91f0
mov rcx, rdi
call fcn.14018039c
mov rcx, qword [rbx + 8]
mov qword [rbx + 8], 0
test rcx, rcx
jne 0x1400669d7
mov rcx, rbx
call fcn.14018039c
mov r14d, 0x3b
jmp 0x1400668f1
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [case.0x1401e9be0.0]
jmp 0x1400669c4
Function at 0x14006a0b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14006a112
mov dl, byte [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [case.0x1401e9be0.0]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rsi], rdi
jmp 0x14006a0fd
mov rax, qword [r9 + 0x30]
lea rbx, [rbp - 0x20]
mov qword [rbx], rax
mov qword [rbp - 8], rax
lock inc dword [rax + 8]
lea rdx, [0x1402ab830]
mov rcx, rbx
call fcn.14015cce0
mov r14, rax
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x14006a15a
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1401e9be0.0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [0x140268c70]
movaps xmmword [rbp - 0x20], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [case.0x1401e9be0.0]
mov al, byte [rbp - 9]
test al, al
mov rcx, qword [rbp - 0x20]
mov r14, rbx
cmovs r14, rcx
jmp 0x14006a1c5
movzx edx, al
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [case.0x1401e9be0.0]
cmp eax, 0xffffffff
jne 0x14006a1bb
xor edi, edi
inc r14
mov al, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rdx, rbx
test al, al
cmovs rdx, rcx
js 0x14006a1fd
movzx eax, al
add rdx, rax
cmp r14, rdx
je 0x14006a10d
test rdi, rdi
je 0x14006a1b9
mov al, byte [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14006a1a1
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
jmp 0x14006a1bb
add rdx, qword [rbp - 0x18]
cmp r14, rdx
jne 0x14006a1df
mov qword [rsi], rdi
call fcn.14018039c
jmp 0x14006a0fd
Function at 0x14006eb80
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x14006ebc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14006ebe5
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14006ebc1
mov qword [rsi], rdi
call fcn.1400e62c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x14006ec57
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400e62c0
mov r14, qword [rsi]
cmp qword [0x1402accf8], 0
je 0x14006ec16
mov rcx, qword [0x1402accf8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x1401e9be0.0]
mov qword [rsi], 0
jmp 0x14006ebaf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetHandleVerifier
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14006ec5a
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14006ec51
call qword [case.0x1401e9be0.0]
mov rcx, rax
xor edx, edx
call fcn.14003b960
jmp 0x14006ebf7
xor ecx, ecx
mov dl, 1
jmp 0x14006ec4a
int3
xor ecx, ecx
jmp 0x14006ec48

Function at 0x14006eff0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov edi, r8d
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x50]
mov qword [r15 + 0x40], rax
movaps xmm0, xmmword [0x140268c70]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r12, [rsp + 0x30]
mov rcx, r12
mov r9d, 0x97
call fcn.1400e92c0
xor esi, esi
mov rcx, r15
mov rdx, r12
xor r8d, r8d
call fcn.14011f810
test edi, edi
js 0x14006f0d9
lea r15, [rsp + 0x30]
mov dword [r15], 0xaaaaaaaa
mov rcx, qword [r14]
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8d, edi
mov r9, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [r15]
lea rcx, [rsp + 0x50]
call fcn.14011f330
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401830b0
mov eax, esi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14006f0ac
Function at 0x14006f0e0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x60]
mov qword [rbx + 0x40], rax
movaps xmm0, xmmword [0x140268c70]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DoDeleteFile
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r9d, 0x104
call fcn.1400e92c0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.14011f810
movzx eax, byte [rsi + 0x17]
mov edx, eax
and edx, 0x7f
test al, al
mov rcx, qword [rsi + 8]
cmovs rdx, rcx
test rdx, rdx
je 0x14006f228
test al, al
jns 0x14006f184
cmp rcx, 0x103
ja 0x14006f296
mov rcx, rsi
mov rdx, rdi
call fcn.140144a00
movzx eax, byte [rsp + 0x57]
mov edx, eax
and edx, 0x7f
test al, al
cmovs rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmovs rdi, rcx
test rdx, rdx
je 0x14006f284
lea r8, [rdi + rdx*2]
add rdx, rdx
mov r9, rdi
movzx r10d, word [r9]
cmp r10d, 0x2a
je 0x14006f1da
cmp r10d, 0x3f
je 0x14006f1da
add r9, 2
add rdx, 0xfffffffffffffffe
jne 0x14006f1bd
mov r9, r8
cmp r9, r8
sete dl
sub r9, rdi
cmp r9, 0xfffffffffffffffe
sete bl
or bl, dl
test al, al
jns 0x14006f1f5
call fcn.14018039c
test bl, bl
je 0x14006f2b1
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14006f209
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14006f252
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
and eax, 0xfffffffe
cmp eax, 2
jne 0x14006f2ff
lea rcx, [rsp + 0x60]
call fcn.14011f330
mov dil, 1
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401830b0
mov eax, edi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
mov edi, eax
test dil, 1
jne 0x14006f316
cmp byte [rsi + 0x17], 0
jns 0x14006f267
mov rsi, qword [rsi]
mov rcx, rsi
test dil, 0x10
je 0x14006f27c
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14006f228
jmp 0x14006f214
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14006f276
test al, al
jns 0x14006f1fd
call fcn.14018039c
jmp 0x14006f1fd
lea rcx, [rsp + 0x60]
call fcn.14011f330
mov esi, 0xa1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x14006f235
lea rdi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rdi
call fcn.140144a00
lea rbx, [rsp + 0x28]
mov rcx, rsi
mov rdx, rbx
call fcn.140144e40
mov rcx, rbx
mov rdx, rdi
call fcn.140022ae0
mov esi, eax
cmp byte [rbx + 0x17], 0
jns 0x14006f2ee
mov rcx, qword [rsp + 0x28]
call fcn.14018039c
cmp byte [rsp + 0x57], 0
jns 0x14006f2ff
mov rcx, qword [rsp + 0x40]
call fcn.14018039c
lea rcx, [rsp + 0x60]
call fcn.14011f330
mov dil, 1
test esi, esi
je 0x14006f235
jmp 0x14006f2a5
mov edx, edi
and edx, 0xfffffffe
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14006f327
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x14006f25e
jmp 0x14006f214
Function at 0x14006f340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x40], rax
movaps xmm0, xmmword [0x140268c70]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x209
call fcn.1400e92c0
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14011f810
cmp byte [rdi + 0x17], 0
jns 0x14006f3c0
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.14011f330
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1401830b0
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x14006f400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rbx, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x40], rax
movaps xmm0, xmmword [0x140268c70]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x40]
mov rcx, r14
mov r9d, 0x212
call fcn.1400e92c0
xor esi, esi
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.14011f810
cmp byte [rbx + 0x17], 0
jns 0x14006f484
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006f537
test al, 0x10
mov eax, 0x40000000
mov edx, 2
cmove edx, eax
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
xor edi, edi
mov rcx, rbx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x14006f501
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp rbx, 0xffffffffffffffff
je 0x14006f560
call fcn.1400e62c0
mov rdi, rbx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
setne sil
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14006f537
call fcn.1400e62c0
cmp qword [0x1402accf8], 0
je 0x14006f564
mov rcx, qword [0x1402accf8]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [case.0x1401e9be0.0]
lea rcx, [rsp + 0x60]
call fcn.14011f330
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401830b0
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
xor edi, edi
jmp 0x14006f4f9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetHandleVerifier
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14006f5a5
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14006f59f
call qword [case.0x1401e9be0.0]
mov rcx, rax
xor edx, edx
call fcn.14003b960
jmp 0x14006f521
xor ecx, ecx
mov dl, 1
jmp 0x14006f598
xor ecx, ecx
jmp 0x14006f596
Function at 0x14006f5b0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2f0
movaps xmmword [rsp + 0x2e0], xmm6
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x2d8], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x290]
mov qword [rdi + 0x40], r15
movaps xmm6, xmmword [0x140268c70]
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, [0x140276be2]
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x80]
mov rcx, rbx
mov r9d, 0x41c
call fcn.1400e92c0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14011f810
lea rbx, [rsp + 0x80]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1401851f0
mov word [rbx], 0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
dec edi
cmp edi, 0x103
ja 0x14006f70c
lea r14, [rsp + 0x28]
mov qword [r14], rbx
mov rcx, rbx
call fcn.140180ff4
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov rdx, r14
call fcn.140109400
lea r14, [rsp + 0x50]
movaps xmmword [r14], xmm6
mov qword [r14 + 0x10], r15
movzx eax, byte [rbx + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rbx]
cmovns rax, rbx
lea rdx, [rsp + 0x70]
mov qword [rdx], rax
cmovs rcx, qword [rbx + 8]
mov qword [rdx + 8], rcx
mov rcx, r14
call fcn.140109400
mov rcx, r14
call fcn.14004ac50
cmp byte [rsi + 0x17], 0
js 0x14006f74b
mov rax, qword [rsp + 0x60]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x67], 0
mov word [rsp + 0x50], 0
cmp byte [rsp + 0x4f], 0
jns 0x14006f70c
mov rcx, qword [rsp + 0x38]
call fcn.14018039c
cmp edi, 0x104
setb bl
lea rcx, [rsp + 0x290]
call fcn.14011f330
mov rcx, qword [rsp + 0x2d8]
xor rcx, rsp
call fcn.1401830b0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x2e0]
add rsp, 0x2f0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rsi]
call fcn.14018039c
jmp 0x14006f6de