joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c5c30
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401fdc38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400c5c6e
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x1400c5c67
call fcn.1400c59c0
jmp 0x1400c5c4e

Function at 0x1400cac90
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x1400caca0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov edi, r8d
mov rsi, rdx
mov r14, rcx
test byte [rdx], 1
je 0x1400cacc4
mov rsi, qword [rsi + 0x10]
jmp 0x1400cacc8
add rsi, 2
mov ebx, r9d
and ebx, 0xfffffff
test r9b, 4
je 0x1400cace4
cmp byte [r14 + 0x50], 1
jne 0x1400cacf8
or ebx, 0x80000000
test bl, 8
je 0x1400cad0b
cmp byte [r14 + 0x68], 1
jne 0x1400cad05
or ebx, 0x40000000
jmp 0x1400cad0b
or ebx, 0x20000000
test bl, 8
jne 0x1400cace9
jmp 0x1400cad0b
or ebx, 0x10000000
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r13d, 0
je 0x1400cad1f
mov r13, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov ebp, 0
je 0x1400cad2f
mov rbp, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 1
jne 0x1400cad42
lea rcx, [r14 + 0x20]
call fcn.140048170
mov r15, rax
xor r12d, r12d
cmp byte [r14 + 0x18], 1
jne 0x1400cad5e
mov rcx, r14
call fcn.140048170
mov r9, rax
cmp edi, 4
jbe 0x1400cad66
jmp 0x1400cad73
xor r9d, r9d
cmp edi, 4
ja 0x1400cad73
mov eax, edi
lea rcx, [0x1401cb474]
mov r12d, dword [rcx + rax*4]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov edx, r12d
mov r8d, ebx
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
je 0x1400cad9f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400caca0
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x1400caca0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov edi, r8d
mov rsi, rdx
mov r14, rcx
test byte [rdx], 1
je 0x1400cacc4
mov rsi, qword [rsi + 0x10]
jmp 0x1400cacc8
add rsi, 2
mov ebx, r9d
and ebx, 0xfffffff
test r9b, 4
je 0x1400cace4
cmp byte [r14 + 0x50], 1
jne 0x1400cacf8
or ebx, 0x80000000
test bl, 8
je 0x1400cad0b
cmp byte [r14 + 0x68], 1
jne 0x1400cad05
or ebx, 0x40000000
jmp 0x1400cad0b
or ebx, 0x20000000
test bl, 8
jne 0x1400cace9
jmp 0x1400cad0b
or ebx, 0x10000000
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r13d, 0
je 0x1400cad1f
mov r13, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov ebp, 0
je 0x1400cad2f
mov rbp, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 1
jne 0x1400cad42
lea rcx, [r14 + 0x20]
call fcn.140048170
mov r15, rax
xor r12d, r12d
cmp byte [r14 + 0x18], 1
jne 0x1400cad5e
mov rcx, r14
call fcn.140048170
mov r9, rax
cmp edi, 4
jbe 0x1400cad66
jmp 0x1400cad73
xor r9d, r9d
cmp edi, 4
ja 0x1400cad73
mov eax, edi
lea rcx, [0x1401cb474]
mov r12d, dword [rcx + rax*4]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov edx, r12d
mov r8d, ebx
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
je 0x1400cad9f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400cfbc0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, qword [rcx + 8]
jmp 0x1400cfbd7
mov rsi, qword [rsi + 0x218]
test rsi, rsi
je 0x1400cfc0e
xor edi, edi
xchg qword [rsi], rdi
test rdi, rdi
je 0x1400cfbd0
lea rbx, [rsi + 0x10]
nop word [rax + rax]
tzcnt rcx, rdi
mov r14d, 1
shl r14, cl
lea rcx, [rbx + rcx*8]
call fcn.140013700
xor rdi, r14
jne 0x1400cfbf0
jmp 0x1400cfbd0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400e56e0
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rsi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x188], rax
lea rbx, [rcx + 2]
test byte [rcx], 1
mov rcx, rbx
je 0x1400e570f
mov rcx, qword [rsi + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x1400e583b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400e5751
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140174050
mov rcx, rsi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
jmp fcn.1400e5880
mov ecx, 2
call fcn.140060510
test al, al
je 0x1400e5839
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x265
mov r9d, 2
call fcn.1400619a0
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.140001af0
mov rdi, rax
movzx eax, byte [rsi]
test al, 1
jne 0x1400e57b8
shr eax, 1
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
jmp 0x1400e57d3
mov rax, qword [rsi + 8]
mov rbx, qword [rsi + 0x10]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
test rax, rax
js 0x1400e5858
test rax, rax
sete al
test rbx, rbx
setne cl
or cl, al
je 0x1400e586b
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x28]
call fcn.1400515e0
movzx r8d, byte [rsp + 0x38]
test r8b, 1
je 0x1400e580e
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
jmp 0x1400e5816
shr r8d, 1
lea rdx, [rsp + 0x39]
mov rcx, rdi
call fcn.140001af0
test byte [rsp + 0x38], 1
je 0x1400e582f
mov rcx, qword [rsp + 0x48]
call fcn.140173cf0
lea rcx, [rsp + 0x50]
call fcn.140061a90
xor edi, edi
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140174050
mov eax, edi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401b1076]
lea rdx, str....._third_partylibc_srcinclude_string_view:318:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.14003f000
lea rcx, [0x1401b1076]
lea rdx, str....._third_partylibc_srcinclude_string_view:320:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.14003f000
int3
Function at 0x1400e5880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x160], rax
test byte [rcx], 1
je 0x1400e58a9
mov rcx, qword [rsi + 0x10]
jmp 0x1400e58ad
lea rcx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e5936
mov dil, 1
test al, 0x10
jne 0x1400e5999
mov ecx, 2
call fcn.140060510
test al, al
je 0x1400e5997
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x255
mov r9d, 2
call fcn.1400605e0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140001af0
mov rcx, rax
mov rdx, rsi
call fcn.140065870
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.140001af0
mov rcx, rdi
call fcn.140060b40
jmp 0x1400e5997
mov ecx, 2
call fcn.140060510
test al, al
je 0x1400e5997
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x251
mov r9d, 2
call fcn.1400619a0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140001af0
mov rcx, rax
mov rdx, rsi
call fcn.140065870
mov rcx, rdi
call fcn.140061a90
xor edi, edi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140174050
mov eax, edi
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x1400e7400
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x50]
mov r15, qword [rcx + 0x58]
cmp rbx, r15
je 0x1400e74dc
mov rsi, r8
mov edi, edx
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1400e744b
mov rcx, rsi
mov rdx, rbx
call fcn.1400e8b30
mov r14, rax
mov qword [rsi + 8], r14
add rbx, 0x70
cmp rbx, r15
je 0x1400e74dc
cmp dword [rbx + 0x68], edi
jne 0x1400e743e
test byte [rbx + 0x10], 1
je 0x1400e7460
mov rcx, qword [rbx + 0x20]
jmp 0x1400e7464
lea rcx, [rbx + 0x12]
call r12
test al, 0x10
jne 0x1400e743e
mov r14, qword [rsi + 8]
cmp r14, qword [rsi + 0x10]
jae 0x1400e742c
test r14, r14
je 0x1400e74ea
lea rdx, [rbx + 0x10]
movups xmm0, xmmword [rbx]
movups xmmword [r14], xmm0
lea rcx, [r14 + 0x10]
call fcn.1400652a0
lea rcx, [r14 + 0x28]
test byte [rbx + 0x28], 1
jne 0x1400e74ac
lea rax, [rbx + 0x28]
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
jmp 0x1400e74b9
mov r8, qword [rbx + 0x30]
mov rdx, qword [rbx + 0x38]
call fcn.140005040
mov rax, qword [rbx + 0x60]
mov qword [r14 + 0x60], rax
movups xmm0, xmmword [rbx + 0x40]
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [r14 + 0x50], xmm1
movups xmmword [r14 + 0x40], xmm0
add r14, 0x68
jmp 0x1400e743a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x1401b1076]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.14003f000
int3
Function at 0x1400f2220
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rsi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword [0x140203868]
test rax, rax
jne 0x1400f2273
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
nop word cs:[rax + rax]
mov ecx, 1
call rdi
mov rax, qword [0x140203868]
test rax, rax
je 0x1400f2260
cmp eax, 2
jne 0x1400f22c1
mov ecx, 2
call fcn.140060510
test al, al
je 0x1400f235d
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x90
mov r9d, 2
call fcn.1400605e0
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x1400f2350
mov eax, 1
lock xadd qword [0x1402038a0], rax
inc rax
cmp rax, 2
jl 0x1400f22e5
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140203820], eax
mov qword [0x140203818], rsi
mov rcx, qword [0x1401fdc60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.140060510
test al, al
je 0x1400f235d
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0xbc
mov r9d, 2
call fcn.1400605e0
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.140001af0
mov rcx, rsi
call fcn.140060b40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140174050
xor eax, eax
add rsp, 0x158
pop rdi
pop rsi
ret
Function at 0x140103450
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140103230
test al, al
je 0x14010347e
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x30]
mov qword [rsi + 0x30], 0
test rdi, rdi
je 0x14010349f
mov rcx, rdi
call fcn.14012b530
mov rcx, rdi
call fcn.140173cf0
mov rcx, qword [rsi + 0x48]
mov qword [rsi + 0x48], 0
test rcx, rcx
je 0x1401034b5
call fcn.140193770
mov rdi, qword [rsi + 0x30]
mov qword [rsi + 0x30], 0
test rdi, rdi
je 0x1401034d6
mov rcx, rdi
call fcn.14012b530
mov rcx, rdi
call fcn.140173cf0
mov rax, qword [rsi + 0x28]
inc rax
cmp rax, 2
jb 0x1401034f9
call fcn.140063870
mov rcx, qword [rsi + 0x28]
call fcn.140041930
mov qword [rsi + 0x28], 0
lea rcx, [rsi + 0x20]
call fcn.140042f20
lea rcx, [rsi + 0x18]
call fcn.140042f20
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140103190
Function at 0x140104440
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140103230
test al, al
je 0x140104462
mov rcx, qword [rsi]
xor edx, edx
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x20
pop rsi
ret

Function at 0x140107570
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140107585
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret
Function at 0x140108050
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov eax, dword [0x140204300]
mov ecx, dword [0x140201350]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x30]
jg 0x1401080d9
lea rcx, [0x1402042f0]
call fcn.1400c5bf0
test rax, rax
jne 0x1401080c6
mov ecx, 4
call fcn.140173ca0
mov rdi, rax
mov dword [rax], 0
lea rbx, [0x1402042f0]
mov rcx, rbx
call fcn.1400c5bf0
mov rsi, rax
mov rcx, rbx
mov rdx, rdi
call fcn.1400c5c30
test rsi, rsi
je 0x1401080c6
mov rcx, rsi
call fcn.140173cf0
lea rcx, [0x1402042f0]
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400c5bf0
lea rcx, [0x140204300]
call fcn.140173e10
cmp dword [0x140204300], 0xffffffff
jne 0x140108078
xorps xmm0, xmm0
movups xmmword [0x1402042f0], xmm0
lea rcx, [0x1402042f0]
lea rdx, [0x140002900]
call fcn.1400c5c80
lea rcx, [0x140204300]
call fcn.140173ea8
jmp 0x140108078

Function at 0x14010d510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, ecx
test r8, r8
je 0x14010d5a9
mov rax, rdx
mov rdx, qword [rsp + 0x80]
mov r10d, edi
shr r10d, 8
lea r8, [rax + r8*2]
movzx ebx, byte [rax + 1]
xor esi, esi
mov rcx, rbx
lea r11, [rax + 2]
cmp byte [rax], r10b
jne 0x14010d580
cmp rcx, rdx
ja 0x14010d676
nop dword [rax + rax]
cmp rcx, rsi
je 0x14010d582
lea rbx, [rsi + 1]
cmp byte [r9 + rsi], dil
mov rsi, rbx
jne 0x14010d560
jmp 0x14010d5a2
ja 0x14010d5a9
cmp r11, r8
je 0x14010d5a9
movzx ebx, byte [rax + 3]
mov rax, r11
mov rsi, rcx
add rbx, rcx
jae 0x14010d543
lea rcx, str..._.._third_party_rust_toolchain_lib_rustlib_src_rust_library_core_srcunicodeprintable.rs
call fcn.1401af060
xor esi, esi
jmp 0x14010d657
mov r15, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
test r15, r15
mov rcx, rbx
cmove rcx, r15
call fcn.14010ca50
mov sil, 1
test al, 1
je 0x14010d657
lea r14, [rbx + r15]
cmp r15, 1
sbb rbx, 0xffffffffffffffff
movzx edi, di
mov sil, 1
nop word cs:[rax + rax]
test dl, dl
js 0x14010d600
movzx eax, dl
sub edi, eax
jns 0x14010d636
jmp 0x14010d657
mov ebp, edx
cmp rbx, r14
mov ecx, 0
cmovne rcx, rbx
call fcn.14010ca50
test al, 1
je 0x14010d66a
xor eax, eax
cmp rbx, r14
setne al
add rbx, rax
and bpl, 0x7f
movzx ecx, bpl
shl ecx, 8
movzx eax, dl
or eax, ecx
sub edi, eax
js 0x14010d657
xor sil, 1
xor eax, eax
cmp rbx, r14
setne al
mov ecx, 0
cmovne rcx, rbx
add rbx, rax
call fcn.14010ca50
test al, 1
jne 0x14010d5f0
and sil, 1
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str..._.._third_party_rust_toolchain_lib_rustlib_src_rust_library_core_srcunicodeprintable.rs
call fcn.1401aefc0
lea r8, str..._.._third_party_rust_toolchain_lib_rustlib_src_rust_library_core_srcunicodeprintable.rs
call fcn.1401af130
int3
Function at 0x1401113e0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
mov dword [rsp + 0x5c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x5c]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140111525
lea r13, [rsp + 0x30]
lea rbp, [rsp + 0x50]
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x5c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
nop word cs:[rax + rax]
mov eax, dword [rsp + 0x5c]
cmp eax, 0xffffffff
je 0x1401114a6
test eax, eax
jne 0x14011153d
mov rcx, rdi
call r15
cmp eax, 3
jne 0x140111539
mov dword [rsp + 0x5c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x140111460
jmp 0x140111525
mov ecx, 0xffffffff
call fcn.14006daf0
mov qword [rsp + 0x28], rax
mov ecx, 0xffffffff
call fcn.14006daf0
lea rcx, str.bytes_read___static_cast_DWORD___1_
mov rdx, rax
mov r8, qword [rsp + 0x28]
call fcn.14006dea0
test rax, rax
je 0x140111517
mov rcx, r13
lea rdx, [0x1401c0ea3]
lea r8, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
mov r9d, 0x7f
mov qword [rsp + 0x28], rax
call fcn.140063850
mov rcx, rbp
mov rdx, qword [rsp + 0x28]
mov r8d, 0xffffffff
mov r9, r13
call fcn.14006e250
mov rcx, rbp
call fcn.14006e420
mov eax, dword [rsp + 0x5c]
test eax, eax
je 0x140111471
jmp 0x14011153d
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x14011153f
mov eax, dword [rsp + 0x5c]
mov esi, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140174050
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140111db0
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rdi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.140111c80
test rax, rax
jne 0x140111e47
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x140111e47
mov ecx, 2
call fcn.140060510
test al, al
je 0x140111e45
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xfc
mov r9d, 2
call fcn.1400619a0
lea rcx, [rsp + 0x38]
lea rdx, [0x1401d1637]
mov r8d, 0xc
call fcn.140001af0
mov rcx, rsi
call fcn.140061a90
xor esi, esi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140174050
mov eax, esi
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x140112530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x168], rax
test byte [rcx], 1
je 0x14011255c
mov rcx, qword [rsi + 0x10]
jmp 0x140112560
lea rcx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14011257f
mov edi, eax
shr eax, 0xa
xor bl, 1
test al, bl
jne 0x1401125e0
and edi, 0x10
shr edi, 4
jmp 0x1401125e2
mov ecx, 2
call fcn.140060510
test al, al
je 0x1401125e0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x80
mov r9d, 2
call fcn.1400619a0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140001af0
mov rcx, rax
mov rdx, rsi
call fcn.140065870
mov rcx, rdi
call fcn.140061a90
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140174050
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret

Function at 0x140112600
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x168], rax
test byte [rcx], 1
je 0x14011262d
mov rcx, qword [rsi + 0x10]
jmp 0x140112631
lea rcx, [rsi + 2]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14011272f
test bl, bl
je 0x1401126cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1401126cc
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.140112530
test al, al
jne 0x14011272f
mov ecx, 2
call fcn.140060510
test al, al
je 0x14011272d
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x5c
mov r9d, 2
call fcn.1400605e0
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.140065870
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.140001af0
mov rcx, rdi
call fcn.140060b40
jmp 0x14011272d
mov ecx, 2
call fcn.140060510
test al, al
je 0x14011272d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x61
mov r9d, 2
call fcn.1400619a0
lea rcx, [rsp + 0x40]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.140001af0
mov rcx, rax
mov rdx, rsi
call fcn.140065870
mov rcx, rdi
call fcn.140061a90
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140174050
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
Function at 0x140112750
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x160], rax
test byte [rcx], 1
je 0x140112779
mov rcx, qword [rsi + 0x10]
jmp 0x14011277d
lea rcx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140112793
test eax, 0x410
sete sil
jmp 0x1401127f6
mov ecx, 2
call fcn.140060510
test al, al
je 0x1401127f4
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x73
mov r9d, 2
call fcn.1400619a0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140001af0
mov rcx, rax
mov rdx, rsi
call fcn.140065870
mov rcx, rdi
call fcn.140061a90
xor esi, esi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140174050
mov eax, esi
add rsp, 0x168
pop rdi
pop rsi
ret

Function at 0x140112820
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rdi, [rcx + 2]
test byte [rcx], 1
mov rcx, rdi
je 0x14011284e
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
sete cl
not eax
test eax, 0x410
setne al
or al, cl
je 0x140112904
test byte [rsi], 1
je 0x140112875
mov rdi, qword [rsi + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x1401128e8
mov ecx, 2
call fcn.140060510
test al, al
je 0x1401128e6
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x93
mov r9d, 2
call fcn.1400619a0
lea rcx, [rsp + 0x38]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.140001af0
mov rcx, rax
mov rdx, rsi
call fcn.140065870
mov rcx, rdi
call fcn.140061a90
xor edi, edi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140174050
mov eax, edi
add rsp, 0x168
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140174050
mov rcx, rsi
add rsp, 0x168
pop rdi
pop rsi
jmp fcn.140112930
Function at 0x140112930
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0x168], rax
test byte [rcx], 1
je 0x14011295a
mov rcx, qword [rsi + 0x10]
jmp 0x14011295e
lea rcx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
jne 0x1401129cb
mov ecx, 2
call fcn.140060510
test al, al
je 0x1401129cb
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.1400619a0
lea rcx, [rsp + 0x40]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.140001af0
mov rcx, rax
mov rdx, rsi
call fcn.140065870
mov rcx, rbx
call fcn.140061a90
test edi, edi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140174050
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret