joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f11f0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x1402b0c60], 0
je 0x1401f1236
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1401874c0
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x1402b0c50]
test rdi, rdi
je 0x1401f12d7
test byte [0x14029ee60], 1
je 0x1401f1219
cmp byte [rdi + 0x17], 0
jns 0x1401f1258
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1402b0c60], rax
inc rax
cmp rax, 1
ja 0x1401f1219
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140189600
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1401f13ae
xor esi, esi
jmp 0x1401f1219
mov ecx, 0x18
call fcn.140184834
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.140189600
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x1402724c0]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.1401c4820
movzx ecx, byte [rdi + 0x17]
test cl, cl
mov rdx, rcx
cmovs rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov r8, rdi
cmovs r8, rax
test rdx, rdx
jne 0x1401f136b
lea rdx, [0x14027b3e8]
mov r8d, 9
mov rcx, rdi
call fcn.14001f400
mov qword [0x1402b0c50], rdi
jmp 0x1401f1246
lea r10, [rdx + rdx]
test r10, r10
je 0x1401f134a
lea r9, [r10 - 2]
cmp word [r8 + r10 - 2], 0x5c
mov r10, r9
jne 0x1401f136f
cmp r9, 0xfffffffffffffffe
je 0x1401f134a
mov r8, r9
sar r8, 1
cmp rdx, r8
jbe 0x1401f14ad
lea rdx, [r8 + 1]
test cl, cl
jns 0x1401f1484
mov qword [rdi + 8], rdx
jmp 0x1401f1490
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.1401855e4
mov rcx, qword [0x1402b0c50]
mov rdx, rdi
mov r8, rax
call fcn.1400309f0
mov rcx, qword [0x1402b0c50]
movzx eax, byte [rcx + 0x17]
test al, al
jns 0x1401f149d
mov rax, qword [rcx + 8]
test rax, rax
je 0x1401f14aa
mov rdx, qword [rcx]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x1401f1411
lea rdx, [0x14027b3e4]
mov r8d, 1
call fcn.14001f400
mov rcx, qword [0x1402b0c50]
lea rdx, [0x14027b3e8]
mov r8d, 9
call fcn.14001f400
mov rcx, qword [0x1402b0c50]
cmp byte [rcx + 0x17], 0
jns 0x1401f1433
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1402b0c60], rax
inc rax
cmp rax, 1
ja 0x1401f1219
mov qword [0x1402b0c60], 0
jmp 0x1401f12d0
cmp r9, 0x14
jae 0x1401f14b0
mov byte [rdi + 0x17], dl
mov rax, rdi
mov word [rax + r8*2 + 2], 0
jmp 0x1401f134a
test rax, rax
je 0x1401f14aa
mov rdx, rcx
jmp 0x1401f13f0
int3
int3
int3
Function at 0x1401f98f0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x10]
cmp r15, qword [rcx + 0x18]
je 0x1401f992f
test r15, r15
je 0x1401f9a1d
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x1401f9979
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
shr r14, 1
shl r14, 3
mov rcx, rbx
sub rcx, r14
mov r8, r15
sub r8, rbx
mov rdx, rbx
call fcn.140188f50
sub r15, r14
mov qword [rsi + 0x10], r15
sub qword [rsi + 8], r14
jmp 0x1401f990d
mov rax, r15
sub rax, r14
sar rax, 2
cmp r15, r14
mov r12d, 1
cmovne r12, rax
mov rax, r12
shr rax, 0x3d
jne 0x1401f9a49
lea rcx, [r12*8]
call fcn.140184834
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rcx
sub r15, rbx
je 0x1401f99ed
mov r8, r15
sar r8, 3
and r15, 0xfffffffffffffff8
mov rdx, r15
add rdx, rcx
shl r8, 3
xor r9d, r9d
mov r10, rcx
add r10, r9
je 0x1401f9a1d
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp r8, r9
jne 0x1401f99d5
lea r8, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r8
mov r15, rdx
test r14, r14
je 0x1401f990d
mov rcx, r14
call fcn.14018482c
mov r15, qword [rsi + 0x10]
jmp 0x1401f990d
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1401c1b10
call fcn.1401c1b10
int3
Function at 0x1401f9a50
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x1401f9a92
mov r14, rbx
add r14, 0xfffffffffffffff8
je 0x1401f9b84
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r15, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r15, rax
jae 0x1401f9adf
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
shl r12, 2
and r12, 0xfffffffffffffff8
lea r14, [r15 + r12]
sub r15, rbx
sub r14, r15
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.140188f50
mov qword [rsi + 8], r14
add qword [rsi + 0x10], r12
jmp 0x1401f9a6f
mov rcx, rax
sub rcx, rbx
sar rcx, 2
cmp rax, rbx
mov r12d, 1
cmovne r12, rcx
mov rax, r12
shr rax, 0x3d
jne 0x1401f9bb0
lea rcx, [r12*8]
call fcn.140184834
lea r14, [r12*2 + 6]
and r14, 0xfffffffffffffff8
add r14, rax
mov rcx, r14
sub r15, rbx
je 0x1401f9b57
mov rdx, r15
sar rdx, 3
and r15, 0xfffffffffffffff8
mov rcx, r15
add rcx, r14
shl rdx, 3
xor r8d, r8d
mov r9, r14
add r9, r8
je 0x1401f9b84
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x1401f9b3f
lea rdx, [rax + r12*8]
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
test rbx, rbx
je 0x1401f9a6f
mov rcx, rbx
call fcn.14018482c
mov r14, qword [rsi + 8]
jmp 0x1401f9a6f
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1401c1b10
call fcn.1401c1b10
int3
Function at 0x1402025e0
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
je 0x14020261a
test rax, rax
je 0x1402026cc
mov rcx, qword [rdi]
mov qword [rax], rcx
add rax, 8
mov qword [rsi + 8], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
sub rax, qword [rsi]
mov r14, rax
sar r14, 3
lea rcx, [r14 + 1]
mov rdx, rcx
shr rdx, 0x3d
jne 0x1402026f8
movabs rdx, 0x1fffffffffffffff
mov rbx, rax
shr rbx, 2
cmp rbx, rcx
cmovbe rbx, rcx
movabs rcx, 0x7ffffffffffffff8
cmp rax, rcx
cmovae rbx, rdx
test rbx, rbx
jne 0x1402026c2
xor eax, eax
shl r14, 3
add r14, rax
je 0x1402026cc
lea rax, [rax + rbx*8]
mov rcx, qword [rdi]
mov qword [r14], rcx
lea rdx, [r14 + 8]
mov rcx, qword [rsi]
mov r8, qword [rsi + 8]
cmp r8, rcx
je 0x1402026a0
mov r9, qword [r8 - 8]
add r8, 0xfffffffffffffff8
mov qword [r14 - 8], r9
add r14, 0xfffffffffffffff8
cmp r8, rcx
jne 0x140202688
mov rcx, qword [rsi]
mov qword [rsi], r14
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rax
test rcx, rcx
je 0x140202610
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140202b70
mov rcx, rbx
call fcn.1402030c0
jmp 0x140202665
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1401c1b10
call fcn.1401c7c60
int3

Function at 0x14020c370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x38], rax
movdqu xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x20], xmm0
mov rbx, qword [rcx + 0x50]
mov rax, qword [rcx + 0x58]
mov edi, 1
cmp rbx, rax
je 0x14020c3c4
mov rsi, r8
movdqu xmm0, xmmword [rbx]
pcmpeqb xmm0, xmmword [rsp + 0x20]
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x14020c3db
add rbx, 0x70
cmp rbx, rax
jne 0x14020c3a5
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401874c0
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
cmp rbx, rax
je 0x14020c3c4
cmp byte [rbx + 0x27], 0
jns 0x14020c3ec
mov rcx, qword [rbx + 0x10]
jmp 0x14020c3f0
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov edi, 1
cmovne edi, ecx
test edi, edi
jne 0x14020c3c4
mov qword [rsi], rbx
xor edi, edi
jmp 0x14020c3c4
Function at 0x14020c580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movdqu xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x20], xmm0
mov r14, qword [rcx + 0x50]
mov rax, qword [rcx + 0x58]
mov esi, 1
cmp r14, rax
je 0x14020c5da
mov rdi, r9
mov rbx, rcx
movdqu xmm0, xmmword [r14]
pcmpeqb xmm0, xmmword [rsp + 0x20]
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x14020c5f3
add r14, 0x70
cmp r14, rax
jne 0x14020c5ba
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401874c0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp r14, rax
je 0x14020c5da
mov eax, dword [r14 + 0x68]
cmp eax, r8d
jne 0x14020c60e
cmp byte [r14 + 0x27], 0
jns 0x14020c61d
mov rcx, qword [r14 + 0x10]
jmp 0x14020c621
xor ecx, ecx
cmp eax, 1
sete cl
lea esi, [rcx + rcx*2]
inc esi
jmp 0x14020c5da
lea rcx, [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14020c5da
shr eax, 3
and eax, 2
mov esi, eax
jne 0x14020c5da
mov byte [rbx + 0x48], 1
mov qword [rdi], r14
xor esi, esi
jmp 0x14020c5da

Function at 0x14020e4f0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1402b6d88]
test rax, rax
je 0x14020e62a
cmp eax, 2
jne 0x14020e567
cmp dword [0x1402b0c58], 2
jg 0x14020e5fa
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x8e
mov r9d, 2
call fcn.1400049c0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x14020e5ed
mov eax, 1
lock xadd qword [0x1402b6dc0], rax
test rax, rax
jle 0x14020e587
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1402b6d40], eax
mov qword [0x1402b6d38], rsi
mov rcx, qword [0x1402ab108]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1402b0c58], 2
jg 0x14020e5fa
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xba
mov r9d, 2
call fcn.1400049c0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.1401c17b0
mov rcx, rsi
call fcn.140004ab0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401874c0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1402b6d88]
test rax, rax
je 0x14020e631
jmp 0x14020e51e
Function at 0x140216ae0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, 0xffffffffffffffff
xor edx, edx
div rcx
mov rbx, 0xfffffffffffffffe
sub rbx, rdx
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x28]
mov qword [rsp + 0x28], r14
mov rcx, rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140216b62
mov rax, qword [rsp + 0x28]
cmp rax, rbx
ja 0x140216b20
xor edx, edx
div rsi
mov rsi, rdx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401874c0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
int3

Function at 0x140216f30
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x140216fb8
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x140216fb1
mov rdx, rcx
add rdi, rdx
cmp al, 1
jne 0x140216f72
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401874c0
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140217b10
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor r8d, r8d
call fcn.14004fc00
test rax, rax
jne 0x140217b4e
mov rcx, rdi
call fcn.14005d2b0
test al, al
je 0x140217b4e
mov r8d, 0x28
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14005e4a0
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140219880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1402198aa
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402198cc
mov edi, eax
test bl, bl
jne 0x1402198c4
mov eax, edi
and eax, 0x400
jne 0x1402198da
and edi, 0x10
shr edi, 4
jmp 0x1402198dc
mov ecx, 2
call fcn.1400ea0a0
test al, al
jne 0x1402198f9
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1401874c0
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x82
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401c17b0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.140149600
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140219978
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1401c17b0
cmp byte [rsp + 0x57], 0
jns 0x140219994
mov rcx, qword [rsp + 0x40]
call fcn.14018482c
lea rcx, [rsp + 0x58]
call fcn.1401f1840
jmp 0x1402198da
Function at 0x1402199b0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
cmp byte [rcx + 0x17], 0
jns 0x1402199db
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
je 0x140219a07
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1401874c0
mov eax, edi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
ret
test bl, bl
je 0x140219a1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140219ae7
mov ecx, 2
call fcn.1400ea0a0
test al, al
jne 0x140219a2e
xor edi, edi
jmp 0x1402199ea
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x40]
mov r8d, 0x62
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x50]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1401c17b0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x190]
mov rcx, rsi
call fcn.140149600
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140219ab6
mov r8, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rcx, rdi
mov rdx, rsi
call fcn.1401c17b0
cmp byte [rsp + 0x1a7], 0
jns 0x140219ad8
mov rcx, qword [rsp + 0x190]
call fcn.14018482c
lea rcx, [rsp + 0x40]
call fcn.1401f1840
jmp 0x140219a2a
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.140219880
test al, al
jne 0x1402199ea
mov ecx, 2
call fcn.1400ea0a0
test al, al
je 0x140219a2a
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x40]
mov r8d, 0x5d
mov r9d, 2
call fcn.1400049c0
lea rdi, [rsp + 0x50]
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x180]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x190]
mov rcx, rsi
call fcn.140149600
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140219b7b
mov r8, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rcx, rdi
mov rdx, rsi
call fcn.1401c17b0
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.1401c17b0
cmp byte [rsp + 0x1a7], 0
jns 0x140219bb2
mov rcx, qword [rsp + 0x190]
call fcn.14018482c
lea rcx, [rsp + 0x40]
call fcn.140004ab0
jmp 0x140219a2a
Function at 0x140219bd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140219bf7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140219c27
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401874c0
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400ea0a0
test al, al
jne 0x140219c39
xor esi, esi
jmp 0x140219c0b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x75
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401c17b0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140149600
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140219cb8
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1401c17b0
cmp byte [rsp + 0x4f], 0
jns 0x140219cd4
mov rcx, qword [rsp + 0x38]
call fcn.14018482c
lea rcx, [rsp + 0x50]
call fcn.1401f1840
jmp 0x140219c35

Function at 0x140219cf0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140219d17
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140219d2e
and eax, 0x410
cmp eax, 0x410
je 0x140219d75
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140219d3a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
je 0x140219d63
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401874c0
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400ea0a0
test al, al
jne 0x140219d96
xor edi, edi
jmp 0x140219d47
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401874c0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140219e40
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x95
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.1401c17b0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140149600
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140219e15
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1401c17b0
cmp byte [rsp + 0x4f], 0
jns 0x140219e31
mov rcx, qword [rsp + 0x38]
call fcn.14018482c
lea rcx, [rsp + 0x50]
call fcn.1401f1840
jmp 0x140219d71
Function at 0x140219e40
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x140219e68
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x140219e82
mov ecx, 2
call fcn.1400ea0a0
test al, al
jne 0x140219ea4
test esi, esi
setne bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1401874c0
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x30
mov r9d, 2
call fcn.1401f17c0
lea rcx, [rsp + 0x68]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1401c17b0
mov rbx, rax
movzx eax, byte [rdi + 0x17]
test al, al
mov rcx, qword [rdi]
cmovns rcx, rdi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140149600
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x140219f23
mov r8, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rcx, rbx
mov rdx, rdi
call fcn.1401c17b0
cmp byte [rsp + 0x57], 0
jns 0x140219f3f
mov rcx, qword [rsp + 0x40]
call fcn.14018482c
lea rcx, [rsp + 0x58]
call fcn.1401f1840
jmp 0x140219e82