joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140217ef0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x140217f36
mov r15, r12
test r15, r15
je 0x14021804c
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x140217f98
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r15, rbx
sub r15, rax
mov r14, r12
sub r14, rbx
je 0x140217f84
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1401d0030
mov r12, qword [rsi + 8]
add r15, r14
mov qword [rsi + 0x10], r15
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
jmp 0x140217f12
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x14021804f
lea rcx, [r13*8]
call fcn.1401cbbc4
mov rcx, r13
and rcx, 0xfffffffffffffffc
mov rdx, r12
sub rdx, rbx
mov r8, r12
lea rcx, [rax + rcx*2]
mov r15, rcx
sub r8, rbx
je 0x14021800c
sar rdx, 3
lea r15, [r8 + rcx]
shl rdx, 3
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x140218049
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x140217ff4
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
cmp r12, rbx
je 0x14021802c
add r12, 0xfffffffffffffff8
jne 0x14021801f
jmp 0x140218046
test r14, r14
je 0x140217f12
mov rcx, r14
call fcn.1401cbbbc
mov r15, qword [rsi + 0x10]
jmp 0x140217f12
int3
int3
int3
int3
Function at 0x140218060
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x1402180a2
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x1402181b2
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r14, rax
jae 0x1402180fa
sub rax, r14
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x1402180ec
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1401d0030
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x14021807f
mov rcx, rax
sub rcx, rbx
sar rcx, 2
cmp rax, rbx
mov r12d, 1
cmovne r12, rcx
mov rax, r12
shr rax, 0x3d
jne 0x1402181b5
lea rcx, [r12*8]
call fcn.1401cbbc4
lea r15, [r12*2 + 6]
and r15, 0xfffffffffffffff8
add r15, rax
mov rdx, r14
sub rdx, rbx
mov r8, r14
mov rcx, r15
sub r8, rbx
je 0x140218172
sar rdx, 3
lea rcx, [r8 + r15]
shl rdx, 3
xor r8d, r8d
mov r9, r15
add r9, r8
je 0x1402181af
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x14021815a
lea rdx, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
cmp r14, rbx
je 0x140218192
add r14, 0xfffffffffffffff8
jne 0x140218185
jmp 0x1402181ac
test rbx, rbx
je 0x14021807f
mov rcx, rbx
call fcn.1401cbbbc
mov r15, qword [rsi + 8]
jmp 0x14021807f
int3
int3
int3
int3

Function at 0x14021ad30
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x14021ad67
movabs rcx, 0xf000000000000000
shl rax, 4
movsx r9, byte [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
inc rdx
cmp rdx, r8
jne 0x14021ad41
ret

Function at 0x14021ade0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x14021ae18
movabs rcx, 0xf000000000000000
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x14021adf1
ret
Function at 0x140220fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14022102d
movzx edx, word [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov word [rsp + 0x20], dx
mov rdx, rsi
mov r8, rdi
call qword [0x1402f5008]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rsi], rdi
test al, al
jns 0x14022100f
call fcn.1401cbbbc
jmp 0x14022100f
mov rax, qword [r9 + 0x30]
lea rcx, [rbp - 0x20]
mov qword [rcx], rax
mov qword [rbp - 8], rax
lock inc dword [rax + 8]
lea rdx, [0x1402e2f20]
call fcn.1401591d0
mov r14, rax
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x14022106e
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1402f5008]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rbp - 0x20]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x14029ca60]
movaps xmmword [rbx], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [0x1402f5008]
movzx eax, byte [rbx + 0x17]
mov r8d, eax
and r8d, 0x7f
test al, al
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
cmovs r8, rdx
test r8, r8
je 0x14022101f
test al, al
mov r14, rbx
cmovs r14, rcx
jmp 0x14022111d
xor edi, edi
jmp 0x1402210f4
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
cmp ax, 0xffff
jne 0x1402210e9
xor edi, edi
mov al, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add r14, 2
mov r8d, eax
and r8b, 0x7f
test al, al
mov r9, rbx
cmovs r9, rcx
movzx r8d, r8b
cmovs r8, rdx
lea r8, [r9 + r8*2]
cmp r14, r8
je 0x14022101f
test rdi, rdi
je 0x1402210d2
movzx eax, word [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
jne 0x1402210d6
mov rcx, qword [rdi]
mov r8, qword [rcx + 0x60]
mov rcx, rdi
mov edx, eax
mov rax, r8
call qword [0x1402f5008]
jmp 0x1402210e1
Function at 0x140230c20
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x140230c81
test r12, r12
je 0x140230d98
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401ce5b0
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x140230ce6
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x140230ccf
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1401d0030
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, r14
jmp 0x140230c4e
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r15d, 1
cmovne r15, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x50], rax
mov rax, r15
shr rax, 0x3d
jne 0x140230dc4
lea rcx, [r15*8]
call fcn.1401cbbc4
mov rdx, r15
and rdx, 0xfffffffffffffffc
mov rcx, r12
sub rcx, rbx
mov r9, r12
lea rdx, [rax + rdx*2]
mov r8, rdx
sub r9, rbx
je 0x140230d63
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x140230d98
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x140230d4b
lea r9, [rax + r15*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], r14
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r12
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r12
call fcn.1401bc320
mov r12, qword [rsi + 0x10]
jmp 0x140230c4e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.140207060
call fcn.140207060
int3
Function at 0x14023c520
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
sub rdx, rax
je 0x14023c563
mov r8, rdx
shr r8, 2
xor r9d, r9d
lea r10, [0x1402aa880]
movzx r11d, r8b
movzx esi, byte [rax + r9]
xor esi, r11d
shr r8d, 8
xor r8d, dword [r10 + rsi*4]
inc r9
cmp rdx, r9
jne 0x14023c53e
cmp r8d, dword [rcx + 0x18]
sete al
pop rsi
ret
xor r8d, r8d
jmp 0x14023c55a
Function at 0x140248f30
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x140248f91
test r12, r12
je 0x1402490a8
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401ce5b0
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x140248ff6
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x140248fdf
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1401d0030
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, r14
jmp 0x140248f5e
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r15d, 1
cmovne r15, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x50], rax
mov rax, r15
shr rax, 0x3d
jne 0x1402490d4
lea rcx, [r15*8]
call fcn.1401cbbc4
mov rdx, r15
and rdx, 0xfffffffffffffffc
mov rcx, r12
sub rcx, rbx
mov r9, r12
lea rdx, [rax + rdx*2]
mov r8, rdx
sub r9, rbx
je 0x140249073
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x1402490a8
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x14024905b
lea r9, [rax + r15*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], r14
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r12
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r12
call fcn.140249440
mov r12, qword [rsi + 0x10]
jmp 0x140248f5e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.140207060
call fcn.140207060
int3
Function at 0x1402490e0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x14024913f
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x140249250
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401ce5b0
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x14024919a
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x140249189
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1401d0030
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x14024910e
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x14024927c
lea rcx, [r12*8]
call fcn.1401cbbc4
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x14024921b
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x140249250
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x140249203
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.140249440
mov r15, qword [rsi + 8]
jmp 0x14024910e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.140207060
call fcn.140207060
int3
Function at 0x140249290
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x1402492ef
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x140249400
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401ce5b0
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x14024934a
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x140249339
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1401d0030
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x1402492be
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x14024942c
lea rcx, [r12*8]
call fcn.1401cbbc4
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x1402493cb
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x140249400
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1402493b3
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.140249440
mov r15, qword [rsi + 8]
jmp 0x1402492be
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.140207060
call fcn.140207060
int3

Function at 0x140256040
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x38], rax
movdqu xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x20], xmm0
mov rbx, qword [rcx + 0x50]
mov rax, qword [rcx + 0x58]
mov edi, 1
cmp rbx, rax
je 0x140256094
mov rsi, r8
movdqu xmm0, xmmword [rbx]
pcmpeqb xmm0, xmmword [rsp + 0x20]
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x1402560ab
add rbx, 0x70
cmp rbx, rax
jne 0x140256075
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
cmp rbx, rax
je 0x140256094
cmp byte [rbx + 0x27], 0
js 0x1402560bc
lea rcx, [rbx + 0x10]
jmp 0x1402560c0
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov edi, 1
cmovne edi, ecx
test edi, edi
jne 0x140256094
mov qword [rsi], rbx
xor edi, edi
jmp 0x140256094
Function at 0x140256250
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movdqu xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x20], xmm0
mov r14, qword [rcx + 0x50]
mov rax, qword [rcx + 0x58]
mov esi, 1
cmp r14, rax
je 0x1402562aa
mov rdi, r9
mov rbx, rcx
movdqu xmm0, xmmword [r14]
pcmpeqb xmm0, xmmword [rsp + 0x20]
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x1402562c3
add r14, 0x70
cmp r14, rax
jne 0x14025628a
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp r14, rax
je 0x1402562aa
mov eax, dword [r14 + 0x68]
cmp eax, r8d
je 0x1402562e0
xor ecx, ecx
cmp eax, 1
sete cl
lea esi, [rcx + rcx*2]
inc esi
jmp 0x1402562aa
cmp byte [r14 + 0x27], 0
js 0x1402562ed
lea rcx, [r14 + 0x10]
jmp 0x1402562f1
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402562aa
shr eax, 3
and eax, 2
mov esi, eax
jne 0x1402562aa
mov byte [rbx + 0x48], 1
mov qword [rdi], r14
xor esi, esi
jmp 0x1402562aa

Function at 0x140259040
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1402e6100]
test rax, rax
jne 0x140259084
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1402e6100]
test rax, rax
je 0x140259071
cmp eax, 2
jne 0x1402590cd
cmp dword [0x1402e5a28], 2
jg 0x140259164
lea rdx, str.crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x8f
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x140259157
mov eax, 1
lock xadd qword [0x1402e6138], rax
inc rax
cmp rax, 2
jl 0x1402590f1
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1402e60c0], eax
mov qword [0x1402e60b8], rsi
mov rcx, qword [0x1402daa48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1402e5a28], 2
jg 0x140259164
lea rdx, str.crashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xbb
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.140206b20
mov rcx, rsi
call fcn.1400038d0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401ce5b0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x1402604e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor r8d, r8d
call fcn.140022760
test rax, rax
jne 0x14026051e
mov rcx, rdi
call fcn.140034a60
test al, al
je 0x14026051e
mov r8d, 0x30
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14004ce30
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1402621a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1402621ca
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402621e9
mov edi, eax
bt eax, 0xa
jae 0x1402621e1
test bl, bl
je 0x1402621f7
and edi, 0x10
shr edi, 4
jmp 0x1402621f9
mov ecx, 2
call fcn.140159120
test al, al
jne 0x140262216
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x80
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140206b20
mov rcx, rax
mov rdx, rsi
call fcn.14023dcd0
mov rcx, rdi
call fcn.14023caa0
jmp 0x1402621f7

Function at 0x140262270
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x14026229b
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x1402622cf
test bl, bl
je 0x1402622bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140262341
mov ecx, 2
call fcn.140159120
test al, al
jne 0x1402622ec
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x61
mov r9d, 2
call fcn.14023ca20
lea rcx, [rsp + 0x38]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.140206b20
mov rcx, rax
mov rdx, rsi
call fcn.14023dcd0
mov rcx, rdi
call fcn.14023caa0
jmp 0x1402622cd
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.1402621a0
test al, al
jne 0x1402622cf
mov ecx, 2
call fcn.140159120
test al, al
je 0x1402622cd
lea rdx, str.filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x5c
mov r9d, 2
call fcn.1400036d0
lea rcx, [rsp + 0x38]
mov rdx, rsi
call fcn.14023dcd0
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.140206b20
mov rcx, rdi
call fcn.1400038d0
jmp 0x1402622cd