joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403d7950
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x1403d79b1
test r12, r12
je 0x1403d7ac8
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402ddd70
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x1403d7a16
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x1403d79ff
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1402e0660
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, r14
jmp 0x1403d797e
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r15d, 1
cmovne r15, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x50], rax
mov rax, r15
shr rax, 0x3d
jne 0x1403d7af4
lea rcx, [r15*8]
call fcn.1402dd130
mov rdx, r15
and rdx, 0xfffffffffffffffc
mov rcx, r12
sub rcx, rbx
mov r9, r12
lea rdx, [rax + rdx*2]
mov r8, rdx
sub r9, rbx
je 0x1403d7a93
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1403d7ac8
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1403d7a7b
lea r9, [rax + r15*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], r14
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r12
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r12
call fcn.1403d7e60
mov r12, qword [rsi + 0x10]
jmp 0x1403d797e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14032ac00
call fcn.14031db10
int3
Function at 0x1403d7b00
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x1403d7b5f
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x1403d7c70
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402ddd70
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x1403d7bba
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x1403d7ba9
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1402e0660
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x1403d7b2e
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x1403d7c9c
lea rcx, [r12*8]
call fcn.1402dd130
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x1403d7c3b
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1403d7c70
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1403d7c23
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.1403d7e60
mov r15, qword [rsi + 8]
jmp 0x1403d7b2e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14032ac00
call fcn.14031db10
int3
Function at 0x1403d7cb0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x1403d7d0f
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x1403d7e20
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402ddd70
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x1403d7d6a
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x1403d7d59
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1402e0660
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x1403d7cde
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x1403d7e4c
lea rcx, [r12*8]
call fcn.1402dd130
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x1403d7deb
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1403d7e20
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1403d7dd3
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.1403d7e60
mov r15, qword [rsi + 8]
jmp 0x1403d7cde
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14032ac00
call fcn.14031db10
int3

Function at 0x1403d88f0
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1403d890a
xor edx, edx
mov r8d, 1
add rsp, 0x28
jmp fcn.1402536d0
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14032ac00
int3
Function at 0x1403e1030
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x118
movaps xmmword [rsp + 0x100], xmm6
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r8
mov r14, rdx
mov r15, rcx
mov r12, qword [rsp + 0x188]
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov rcx, r12
call fcn.1400b8d10
mov rbx, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0x40]
mov qword [r13 + 0x60], rax
movaps xmm6, xmmword [0x14047fb40]
movaps xmmword [r13 + 0x50], xmm6
movaps xmmword [r13 + 0x40], xmm6
movaps xmmword [r13 + 0x30], xmm6
movaps xmmword [r13 + 0x20], xmm6
movaps xmmword [r13 + 0x10], xmm6
movaps xmmword [r13], xmm6
mov rcx, r13
call fcn.1403cbc70
mov qword [rsp + 0x20], 0
mov rcx, r13
mov rdx, r15
mov r8, r14
mov r9, r12
call fcn.1402821f0
test eax, eax
je 0x1403e127f
mov r12, qword [rsp + 0x190]
test r12, r12
je 0x1403e126f
mov r14, qword [rsp + 0x198]
mov edi, 1
lea r15, [rsp + 0x40]
jmp 0x1403e1115
add r14, rsi
inc edi
sub r12, rsi
je 0x1403e126f
cmp rbx, r12
mov rsi, r12
cmovb rsi, rbx
mov eax, edi
bswap eax
mov dword [rsp + 0xac], eax
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0x20], 0
mov rcx, r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.1402821f0
test eax, eax
je 0x1403e127f
mov rcx, r15
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
call fcn.1403cbca0
test eax, eax
je 0x1403e127f
mov r8d, 4
mov rcx, r15
lea rdx, [rsp + 0xac]
call fcn.1403cbca0
test eax, eax
je 0x1403e127f
mov rcx, r15
lea rdx, [rsp + 0xb0]
xor r8d, r8d
call fcn.14018bad0
test eax, eax
je 0x1403e127f
test rbx, rbx
je 0x1403e11d6
mov rcx, r14
lea rdx, [rsp + 0xb0]
mov r8, rsi
call fcn.1402e0660
cmp dword [rsp + 0x180], 2
jb 0x1403e1107
cmp rsi, 1
mov rbp, rsi
adc rbp, 0
mov r13d, 1
jmp 0x1403e1208
inc r13d
cmp r13d, dword [rsp + 0x180]
je 0x1403e1107
mov qword [rsp + 0x20], 0
mov rcx, r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.1402821f0
test eax, eax
je 0x1403e127f
mov rcx, r15
lea rdx, [rsp + 0xb0]
mov r8, rbx
call fcn.1403cbca0
test eax, eax
je 0x1403e127f
mov rcx, r15
lea rdx, [rsp + 0xb0]
xor r8d, r8d
call fcn.14018bad0
test eax, eax
je 0x1403e127f
test rbx, rbx
je 0x1403e11f7
xor eax, eax
mov cl, byte [rsp + rax + 0xb0]
xor byte [r14 + rax], cl
inc rax
cmp rbp, rax
jne 0x1403e125a
jmp 0x1403e11f7
xor esi, esi
cmp dword [rsp + 0x180], 0
setne sil
jmp 0x1403e1281
xor esi, esi
lea rcx, [rsp + 0x40]
call fcn.14018bbc0
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1402ddd70
mov eax, esi
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x118
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1403f01c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov ebx, 1
cmp rdi, r12
je 0x1403f0254
mov rsi, r8
mov r14, rcx
lea r15, [rsp + 0x20]
mov rcx, rdi
mov rdx, r15
call fcn.1403efa30
test al, al
jne 0x1403f021c
add rdi, 0x70
cmp rdi, r12
jne 0x1403f0201
mov rdi, r12
cmp rdi, qword [r14 + 0x58]
je 0x1403f0254
cmp byte [rdi + 0x27], 0
js 0x1403f022e
lea rcx, [rdi + 0x10]
jmp 0x1403f0232
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov ebx, 1
cmovne ebx, ecx
test ebx, ebx
jne 0x1403f0254
mov qword [rsi], rdi
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402ddd70
mov eax, ebx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1403f03e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov r14, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov esi, 1
cmp r14, r12
je 0x1403f045b
mov rdi, r9
mov ebp, r8d
mov rbx, rcx
lea r15, [rsp + 0x20]
mov rcx, r14
mov rdx, r15
call fcn.1403efa30
test al, al
jne 0x1403f0440
add r14, 0x70
cmp r14, r12
jne 0x1403f0425
mov r14, r12
cmp r14, qword [rbx + 0x58]
je 0x1403f045b
mov eax, dword [r14 + 0x68]
cmp eax, ebp
je 0x1403f0479
xor ecx, ecx
cmp eax, 1
sete cl
lea esi, [rcx + rcx*2]
inc esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402ddd70
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp byte [r14 + 0x27], 0
js 0x1403f0486
lea rcx, [r14 + 0x10]
jmp 0x1403f048a
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1403f045b
shr eax, 3
and eax, 2
mov esi, eax
jne 0x1403f045b
mov byte [rbx + 0x48], 1
mov qword [rdi], r14
xor esi, esi
jmp 0x1403f045b
Function at 0x140415d00
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x140415d3f
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x140415d0f
mov dword [rsi], 7
jmp 0x140415d0f
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1401a5e40
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140415d1b
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140415d1b
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x140415df1
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x140415d11
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140415d0f

Function at 0x14041b440
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x14041b46a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14041b489
mov edi, eax
bt eax, 0xa
jae 0x14041b481
test bl, bl
je 0x14041b497
and edi, 0x10
shr edi, 4
jmp 0x14041b499
mov ecx, 2
call fcn.14026cdd0
test al, al
jne 0x14041b4b6
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1402ddd70
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x80
mov r9d, 2
call fcn.14037ed30
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, reloc.WS2_32.dll_select
call fcn.14031d7c0
mov rcx, rax
mov rdx, rsi
call fcn.14037fc70
mov rcx, rdi
call fcn.14037edb0
jmp 0x14041b497
Function at 0x14041b510
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x14041b53b
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14041b56f
test bl, bl
je 0x14041b55f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14041b5e1
mov ecx, 2
call fcn.14026cdd0
test al, al
jne 0x14041b58c
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1402ddd70
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x61
mov r9d, 2
call fcn.14037ed30
lea rcx, [rsp + 0x38]
lea rdx, str.CreateDirectory
mov r8d, reloc.WS2_32.dll_recv
call fcn.14031d7c0
mov rcx, rax
mov rdx, rsi
call fcn.14037fc70
mov rcx, rdi
call fcn.14037edb0
jmp 0x14041b56d
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.14041b440
test al, al
jne 0x14041b56f
mov ecx, 2
call fcn.14026cdd0
test al, al
je 0x14041b56d
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x5c
mov r9d, 2
call fcn.14015a460
lea rcx, [rsp + 0x38]
mov rdx, rsi
call fcn.14037fc70
lea rdx, str._not_a_directory
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rax
call fcn.14031d7c0
mov rcx, rdi
call fcn.14015aab0
jmp 0x14041b56d

Function at 0x14041b660
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x14041b687
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14041b6b7
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1402ddd70
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14026cdd0
test al, al
jne 0x14041b6c9
xor esi, esi
jmp 0x14041b69b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, reloc.WS2_32.dll_WSAStartup
mov r9d, 2
call fcn.14037ed30
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, reloc.WS2_32.dll_select
call fcn.14031d7c0
mov rcx, rax
mov rdx, rsi
call fcn.14037fc70
mov rcx, rdi
call fcn.14037edb0
jmp 0x14041b6c5
Function at 0x14041b720
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x14041b747
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14041b75e
and eax, 0x410
cmp eax, 0x410
je 0x14041b7a3
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14041b76a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x14041b787
mov ecx, 2
call fcn.14026cdd0
test al, al
jne 0x14041b7c4
xor edi, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1402ddd70
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1402ddd70
mov rcx, rsi
add rsp, 0x178
pop rdi
pop rsi
jmp fcn.14041b820
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, DllRegisterServer
mov r9d, 2
call fcn.14037ed30
lea rcx, [rsp + 0x40]
lea rdx, str.DeleteFile
mov r8d, SafeArrayDestroy
call fcn.14031d7c0
mov rcx, rax
mov rdx, rsi
call fcn.14037fc70
mov rcx, rdi
call fcn.14037edb0
jmp 0x14041b785

Function at 0x14041b820
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x14041b848
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
jne 0x14041b862
mov ecx, 2
call fcn.14026cdd0
test al, al
jne 0x14041b884
test edi, edi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1402ddd70
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.14037ed30
lea rcx, [rsp + 0x38]
lea rdx, str.RemoveDirectory
mov r8d, reloc.WS2_32.dll_recv
call fcn.14031d7c0
mov rcx, rax
mov rdx, rsi
call fcn.14037fc70
mov rcx, rbx
call fcn.14037edb0
jmp 0x14041b862

Function at 0x140421a20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x140542a18]
mov ecx, dword [0x14052f0f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140421a80
cmp rdi, rsi
je 0x140421a7c
mov eax, 0xffffffff
lea rcx, [0x140542618]
mov dl, byte [rdi]
xor dl, al
movzx edx, dl
shr eax, 8
xor eax, dword [rcx + rdx*4]
inc rdi
cmp rdi, rsi
jne 0x140421a5e
not eax
add rsp, 0x28
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140421a75
lea rcx, [0x140542a18]
call fcn.1402dd290
cmp dword [0x140542a18], 0xffffffff
jne 0x140421a4d
call fcn.140421ab0
lea rcx, [0x140542a18]
call fcn.1402dd328
jmp 0x140421a4d
Function at 0x140421ab0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
lea rsi, [0x140542618]
mov r8d, 0x400
mov rcx, rsi
mov dl, 0xaa
call fcn.1402e0d10
xor eax, eax
mov ecx, 0xedb88320
mov r8d, eax
shr r8d, 1
mov edx, eax
and edx, 1
neg edx
and edx, ecx
xor edx, r8d
mov r9d, edx
shr r9d, 1
mov r8d, eax
shl r8d, 0x1e
sar r8d, 0x1f
and r8d, ecx
xor r8d, r9d
mov r9d, r8d
shr r9d, 6
mov r10d, eax
shl r10d, 0x1d
sar r10d, 0x1f
and r10d, 0x76dc419
mov r11d, eax
shl r11d, 0x1c
sar r11d, 0x1f
and r11d, 0xedb8832
xor r11d, r10d
mov r10d, eax
shl r10d, 0x1b
sar r10d, 0x1f
and r10d, 0x1db71064
xor r10d, r11d
mov r11d, eax
shl r11d, 0x1a
sar r11d, 0x1f
and r11d, 0x3b6e20c8
xor r11d, r10d
xor r11d, r9d
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
xor edx, r11d
shl r8d, 0x1a
sar r8d, 0x1f
and r8d, ecx
xor r8d, edx
mov dword [rsi], r8d
inc rax
add rsi, 4
cmp rax, 0x100
jne 0x140421ad3
add rsp, 0x20
pop rsi
ret

Function at 0x140427460
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
jne 0x1404274f2
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x140427525
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x1404274e0
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1402e0660
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, r14
test r12, r12
je 0x1404275d7
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402ddd70
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r15d, 1
cmovne r15, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x50], rax
mov rax, r15
shr rax, 0x3d
jne 0x140427603
lea rcx, [r15*8]
call fcn.1402dd130
mov rdx, r15
and rdx, 0xfffffffffffffffc
mov rcx, r12
sub rcx, rbx
mov r9, r12
lea rdx, [rax + rdx*2]
mov r8, rdx
sub r9, rbx
je 0x1404275a2
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1404275d7
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x14042758a
lea r9, [rax + r15*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], r14
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r12
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r12
call fcn.14035d4b0
mov r12, qword [rsi + 0x10]
jmp 0x1404274f2
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14032ac00
call fcn.14031db10
int3