joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov ebx, r9d
mov rsi, r8
mov r14, rdx
mov rdi, rcx
lea rdx, [rbp - 0x10]
call fcn.14000b650
mov r13, qword [rbp - 0x10]
test r13, r13
je 0x14000d823
movups xmm0, xmmword [r14]
movaps xmmword [rbp - 0x20], xmm0
mov r14, qword [r13 + 0x40]
mov r12, qword [r13 + 0x48]
cmp r14, r12
je 0x14000d7ff
lea r15, [rbp - 0x20]
nop word cs:[rax + rax]
mov rcx, r14
mov rdx, r15
call fcn.14004b2e0
test al, al
jne 0x14000d7fb
add r14, 0x70
cmp r14, r12
jne 0x14000d7e0
mov r14, r12
mov r12, qword [r13 + 0x48]
mov r15d, 1
cmp r14, r12
je 0x14000d829
mov eax, dword [r14 + 0x68]
test eax, eax
je 0x14000d846
xor ecx, ecx
cmp eax, 1
sete cl
lea r15d, [rcx + rcx*2]
inc r15d
jmp 0x14000d829
mov r15d, 3
lea rcx, [rbp - 0x10]
call fcn.14000c680
mov eax, r15d
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r12, [r14 + 0x10]
cmp byte [r14 + 0x27], 0
mov rcx, r12
jns 0x14000d858
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000d829
shr eax, 3
and eax, 2
mov r15d, eax
jne 0x14000d829
mov byte [r13 + 0x38], 1
mov dword [r14 + 0x68], 1
mov ecx, 0xb8
call fcn.140096664
mov rcx, rax
mov qword [rbp - 8], rax
call fcn.140047c40
movups xmm0, xmmword [r14]
mov rax, qword [rbp - 8]
movups xmmword [rax + 8], xmm0
lea r15, [rax + 0x18]
mov rcx, r15
mov rdx, r12
call fcn.1400073b0
mov r12, qword [rbp - 8]
lea rax, [r12 + 8]
cmp rax, r14
je 0x14000d90e
mov rax, qword [rbp - 8]
mov rcx, rax
add rcx, 0x30
lea rdx, [r14 + 0x28]
cmp byte [rax + 0x47], 0
movzx eax, byte [r14 + 0x3f]
js 0x14000d8e8
test al, al
js 0x14000d8f6
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
jmp 0x14000d90e
test al, al
jns 0x14000d905
mov r8, qword [r14 + 0x30]
mov rdx, qword [r14 + 0x28]
jmp 0x14000d909
mov rdx, qword [r14 + 0x28]
mov r8, qword [r14 + 0x30]
call fcn.140009c60
jmp 0x14000d90e
movzx r8d, al
call fcn.140009b30
mov rax, qword [r14 + 0x60]
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x68], rax
movups xmm0, xmmword [r14 + 0x40]
movups xmm1, xmmword [r14 + 0x50]
movups xmmword [rcx + 0x58], xmm1
movups xmmword [rcx + 0x48], xmm0
mov rdx, r15
mov r8, rdi
call fcn.140047eb0
test al, al
je 0x14000d964
mov byte [r12 + 0xb0], bl
mov rcx, qword [rsi]
mov qword [rsi], r12
xor r15d, r15d
test rcx, rcx
je 0x14000d829
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x14000d829
mov rcx, r12
mov rax, qword [r12]
mov edx, 1
call qword [rax]
mov r15d, 2
jmp 0x14000d829
Function at 0x14000da40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov r14, r9
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
cmp byte [rdx + 0xb0], 1
jne 0x14000da79
mov ecx, ebx
call fcn.1400051f0
lea rdx, [rbp - 0x10]
mov rcx, rsi
call fcn.14000b650
mov r13, qword [rbp - 0x10]
test r13, r13
je 0x14000daee
mov qword [rbp - 8], r14
movups xmm0, xmmword [rdi + 8]
movaps xmmword [rbp - 0x20], xmm0
mov r14, qword [r13 + 0x40]
mov r15, qword [r13 + 0x48]
cmp r14, r15
je 0x14000dacf
lea r12, [rbp - 0x20]
nop dword [rax + rax]
mov rcx, r14
mov rdx, r12
call fcn.14004b2e0
test al, al
jne 0x14000dacb
add r14, 0x70
cmp r14, r15
jne 0x14000dab0
mov r14, r15
mov r15, qword [r13 + 0x48]
mov r12d, 1
cmp r14, r15
je 0x14000daf4
cmp dword [r14 + 0x68], 1
jne 0x14000daf4
cmp byte [r14 + 0x27], 0
jns 0x14000db11
mov rcx, qword [r14 + 0x10]
jmp 0x14000db15
mov r12d, 3
lea rcx, [rbp - 0x10]
call fcn.14000c680
mov eax, r12d
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000daf4
shr eax, 3
and eax, 2
mov r12d, eax
jne 0x14000daf4
mov byte [r13 + 0x38], 1
xor ecx, ecx
call fcn.1400abb10
mov r12, rax
mov byte [r14 + 0x48], bl
lea rcx, [r14 + 0x28]
cmp rcx, qword [rbp - 8]
je 0x14000db9f
cmp byte [r14 + 0x3f], 0
mov rax, qword [rbp - 8]
movzx eax, byte [rax + 0x17]
js 0x14000db6f
test al, al
js 0x14000db80
mov rdx, qword [rbp - 8]
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
jmp 0x14000db9f
test al, al
jns 0x14000db92
mov rdx, qword [rbp - 8]
mov r8, qword [rdx + 8]
mov rdx, qword [rdx]
jmp 0x14000db9a
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov r8, qword [rax + 8]
call fcn.140009c60
jmp 0x14000db9f
movzx r8d, al
mov rdx, qword [rbp - 8]
call fcn.140009b30
mov qword [r14 + 0x50], r12
inc dword [r14 + 0x58]
test bl, bl
je 0x14000dbb7
mov dword [r14 + 0x68], 2
xor eax, eax
jmp 0x14000dbc3
mov dword [r14 + 0x68], 0
movzx eax, byte [rdi + 0x64]
mov byte [r14 + 0x5c], al
mov qword [rbp - 0x28], rsi
mov rax, qword [rsi + 0x40]
cmp rax, 0xffffffffffffffff
je 0x14000dbf9
lea rcx, [rsi + 0x40]
lea rax, [rbp - 0x28]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], rax
lea r8, [0x14000f170]
lea rdx, [rbp - 0x30]
call fcn.140048990
add rsi, 0x20
mov rcx, rsi
mov rdx, r12
call fcn.1400462e0
xor al, 1
movzx eax, al
lea r12d, [rax + rax*2]
jmp 0x14000daf4
Function at 0x14000dfc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov ecx, r8d
call fcn.1400051f0
lea rdx, [rbp - 0x10]
mov rcx, rdi
call fcn.14000b650
mov rbx, qword [rbp - 0x10]
test rbx, rbx
je 0x14000e05f
movups xmm0, xmmword [rsi]
movaps xmmword [rbp - 0x20], xmm0
mov rsi, qword [rbx + 0x40]
mov r14, qword [rbx + 0x48]
cmp rsi, r14
je 0x14000e03f
lea rdi, [rbp - 0x20]
nop word cs:[rax + rax]
mov rcx, rsi
mov rdx, rdi
call fcn.14004b2e0
test al, al
jne 0x14000e03b
add rsi, 0x70
cmp rsi, r14
jne 0x14000e020
mov rsi, r14
mov r14, qword [rbx + 0x48]
mov edi, 1
cmp rsi, r14
je 0x14000e064
mov eax, dword [rsi + 0x68]
test eax, eax
je 0x14000e07a
xor ecx, ecx
cmp eax, 1
sete cl
lea edi, [rcx + rcx*2]
inc edi
jmp 0x14000e064
mov edi, 3
lea rcx, [rbp - 0x10]
call fcn.14000c680
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
cmp byte [rsi + 0x27], 0
jns 0x14000e086
mov rcx, qword [rsi + 0x10]
jmp 0x14000e08a
lea rcx, [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000e064
shr eax, 3
and eax, 2
mov edi, eax
jne 0x14000e064
mov byte [rbx + 0x38], 1
mov dword [rsi + 0x68], 2
mov byte [rsi + 0x5c], 0
xor edi, edi
jmp 0x14000e064
Function at 0x14000e210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
lea rdx, [rbp - 8]
call fcn.14000b650
mov r14, qword [rbp - 8]
test r14, r14
je 0x14000e29d
movups xmm0, xmmword [rdi]
movaps xmmword [rbp - 0x20], xmm0
mov rsi, qword [r14 + 0x40]
mov r15, qword [r14 + 0x48]
cmp rsi, r15
je 0x14000e27f
lea rbx, [rbp - 0x20]
nop word cs:[rax + rax]
mov rcx, rsi
mov rdx, rbx
call fcn.14004b2e0
test al, al
jne 0x14000e27b
add rsi, 0x70
cmp rsi, r15
jne 0x14000e260
mov rsi, r15
mov r15, qword [r14 + 0x48]
cmp rsi, r15
je 0x14000e2db
mov eax, dword [rsi + 0x68]
cmp eax, 1
je 0x14000e2a7
cmp eax, 2
jne 0x14000e2db
cmp byte [rsi + 0x27], 0
jns 0x14000e2b1
mov rcx, qword [rsi + 0x10]
jmp 0x14000e2b5
mov ebx, 3
jmp 0x14000e353
mov ebx, 4
jmp 0x14000e32d
lea rcx, [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000e2d3
mov ebx, eax
shr ebx, 3
and ebx, 2
jne 0x14000e32d
mov byte [r14 + 0x38], 1
xor ebx, ebx
jmp 0x14000e32d
mov r14, qword [rbp - 8]
mov r15, qword [r14 + 0x48]
movups xmm0, xmmword [rdi]
movaps xmmword [rbp - 0x20], xmm0
mov rdi, qword [r14 + 0x40]
cmp rdi, r15
je 0x14000e30f
lea rbx, [rbp - 0x20]
nop
mov rcx, rdi
mov rdx, rbx
call fcn.14004b2e0
test al, al
jne 0x14000e30b
add rdi, 0x70
cmp rdi, r15
jne 0x14000e2f0
mov rdi, r15
mov r15, qword [r14 + 0x48]
mov ebx, 1
cmp rdi, r15
je 0x14000e32d
mov eax, dword [rdi + 0x68]
test eax, eax
je 0x14000e36b
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [rcx + rcx*2]
inc ebx
test ebx, ebx
jne 0x14000e353
mov ebx, 5
cmp byte [rsi + 0x48], 0
jne 0x14000e353
mov byte [rsi + 0x5c], 1
mov dword [rsi + 0x68], 0
xor ebx, ebx
mov ecx, 1
call fcn.1400051f0
lea rcx, [rbp - 8]
call fcn.14000c680
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
cmp byte [rdi + 0x27], 0
jns 0x14000e377
mov rcx, qword [rdi + 0x10]
jmp 0x14000e37b
lea rcx, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000e32d
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x14000e32d
mov byte [r14 + 0x38], 1
xor ebx, ebx
mov rsi, rdi
jmp 0x14000e32d
Function at 0x14001cd90
Capabilities:
Terminate process

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd8], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [0x14010c6f0]
test rax, rax
jne 0x14001cde3
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
nop word cs:[rax + rax]
mov ecx, 1
call rdi
mov rax, qword [0x14010c6f0]
test rax, rax
je 0x14001cdd0
cmp eax, 2
jne 0x14001ce28
mov dword [rsp + 0x20], 2
lea rdx, str.LONG___cdecl_crashpad::_anonymous_namespace_::UnhandledExceptionHandler_EXCEPTION_POINTERS__
lea r8, str.third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rcx, [rbp - 0x50]
mov r9d, 0x8d
call fcn.140005c30
lea rcx, [rbp - 0x48]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
call fcn.1400048b0
jmp 0x14001ceae
mov eax, 1
lock xadd qword [0x14010c728], rax
test rax, rax
jle 0x14001ce48
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x14010c698], eax
mov qword [0x14010c690], rsi
mov rcx, qword [0x1401086f0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 2
lea rdx, str.LONG___cdecl_crashpad::_anonymous_namespace_::UnhandledExceptionHandler_EXCEPTION_POINTERS__
lea r8, str.third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rcx, [rbp - 0x50]
mov r9d, 0xb9
call fcn.140005c30
lea rcx, [rbp - 0x48]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.1400048b0
lea rcx, [rbp - 0x50]
call fcn.140006650
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002a970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
movzx ebx, byte [rbp + 0x58]
test byte [r9 + 8], 1
jne 0x14002a9b9
movzx eax, byte [rbp + 0x50]
movzx edx, bl
mov r10, qword [rcx]
mov dword [rsp + 0x28], edx
mov byte [rsp + 0x20], al
mov rdx, rsi
mov r8, rdi
call qword [r10 + 0x30]
jmp 0x14002ab2a
lea rdx, [rbp - 0x28]
mov rcx, r9
call fcn.140020150
mov r14, qword [rbp - 0x28]
lea rax, [0x14010c948]
mov qword [rbp - 0x30], rax
mov rax, qword [0x14010c948]
cmp rax, 0xffffffffffffffff
je 0x14002aa08
lea rax, [rbp - 0x30]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x38], rax
lea rcx, [0x14010c948]
lea r8, [0x140045020]
lea rdx, [rbp - 0x38]
call fcn.140048990
movsxd rax, dword [0x14010c950]
lea rdx, [rax - 1]
mov rcx, qword [r14 + 0x10]
mov r8, qword [r14 + 0x18]
sub r8, rcx
sar r8, 3
cmp r8, rdx
jbe 0x14002ab38
mov rcx, qword [rcx + rax*8 - 8]
test rcx, rcx
je 0x14002ab38
mov rax, qword [rbp - 0x28]
lea rdx, [0x14010c770]
cmp rax, rdx
je 0x14002aa66
mov edx, 0xffffffff
lock xadd dword [rax + 8], edx
test edx, edx
jne 0x14002aa66
mov rdx, qword [rax]
mov r14, rcx
mov rcx, rax
call qword [rdx + 8]
mov rcx, r14
mov rax, qword [rcx]
xor bl, 1
movzx r8d, bl
lea rbx, [rbp - 0x20]
mov rdx, rbx
call qword [rax + r8*8 + 0x28]
movsx rax, byte [rbp - 9]
mov rdx, rax
test rax, rax
jns 0x14002aa8d
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
test rdx, rdx
je 0x14002ab10
test al, al
cmovns rcx, rbx
mov r14, rcx
jmp 0x14002aabb
add rdx, r8
inc r14
cmp r14, rdx
je 0x14002ab10
test rdi, rdi
je 0x14002aaf1
movzx eax, byte [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14002aae0
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
jmp 0x14002aaf3
movzx edx, al
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
jne 0x14002aaf3
xor edi, edi
movsx rax, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rdx, rbx
mov r8, rax
test rax, rax
jns 0x14002aab0
mov r8, qword [rbp - 0x18]
mov rdx, rcx
jmp 0x14002aab0
mov qword [rsi], rdi
test al, al
jns 0x14002ab2a
movabs rdx, 0x7fffffffffffffff
and rdx, qword [rbp - 0x10]
call fcn.14009665c
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.14001ff70
int3
Function at 0x14002c540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
movzx ebx, byte [rbp + 0x58]
test byte [r9 + 8], 1
jne 0x14002c58a
movzx eax, word [rbp + 0x50]
movzx edx, bl
mov r10, qword [rcx]
mov dword [rsp + 0x28], edx
mov word [rsp + 0x20], ax
mov rdx, rsi
mov r8, rdi
call qword [r10 + 0x30]
jmp 0x14002c6f5
lea rdx, [rbp - 0x28]
mov rcx, r9
call fcn.140020150
mov r14, qword [rbp - 0x28]
lea rax, [0x14010c958]
mov qword [rbp - 0x30], rax
mov rax, qword [0x14010c958]
cmp rax, 0xffffffffffffffff
je 0x14002c5d9
lea rax, [rbp - 0x30]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x38], rax
lea rcx, [0x14010c958]
lea r8, [0x140045020]
lea rdx, [rbp - 0x38]
call fcn.140048990
movsxd rax, dword [0x14010c960]
lea rdx, [rax - 1]
mov rcx, qword [r14 + 0x10]
mov r8, qword [r14 + 0x18]
sub r8, rcx
sar r8, 3
cmp r8, rdx
jbe 0x14002c703
mov rcx, qword [rcx + rax*8 - 8]
test rcx, rcx
je 0x14002c703
mov rax, qword [rbp - 0x28]
lea rdx, [0x14010c770]
cmp rax, rdx
je 0x14002c637
mov edx, 0xffffffff
lock xadd dword [rax + 8], edx
test edx, edx
jne 0x14002c637
mov rdx, qword [rax]
mov r14, rcx
mov rcx, rax
call qword [rdx + 8]
mov rcx, r14
mov rax, qword [rcx]
xor bl, 1
movzx r8d, bl
lea rbx, [rbp - 0x20]
mov rdx, rbx
call qword [rax + r8*8 + 0x28]
movsx rax, byte [rbp - 9]
test rax, rax
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov r8, rax
cmovs r8, rdx
test r8, r8
je 0x14002c6e2
test al, al
mov r14, rbx
cmovs r14, rcx
jmp 0x14002c6a0
xor edi, edi
add r14, 2
test al, al
mov r8, rbx
cmovs r8, rcx
movzx r9d, al
cmovs r9, rdx
lea r8, [r8 + r9*2]
cmp r14, r8
je 0x14002c6e2
test rdi, rdi
je 0x14002c680
movzx eax, word [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14002c6c0
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
jmp 0x14002c6cc
mov r8, qword [rdi]
mov rcx, rdi
mov edx, eax
call qword [r8 + 0x60]
cmp ax, 0xffff
jne 0x14002c6d4
xor edi, edi
movzx eax, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
jmp 0x14002c682
mov qword [rsi], rdi
test al, al
jns 0x14002c6f5
mov rdx, qword [rbp - 0x10]
add rdx, rdx
call fcn.14009665c
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.14001ff70
int3
Function at 0x1400490f0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x160
mov eax, 0xffffffff
cmp r8, rax
cmovae r8, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14004917a
mov dword [rsp + 0x38], 0xffffffff
cmp dword [rsp + 0x34], 0xffffffff
jne 0x140049174
lea r8, str.bytes_written___static_cast_DWORD___1_
lea rcx, [rsp + 0x34]
lea rdx, [rsp + 0x38]
call fcn.140049cf0
test rax, rax
je 0x140049174
mov qword [rsp + 0x20], rax
lea rdx, str.FileOperationResult___cdecl_crashpad::internal::NativeWriteFile_FileHandle__const_void___size_t_
lea r8, str.third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r9d, 0x66
call fcn.140006530
mov rcx, rsi
call fcn.140006650
mov eax, dword [rsp + 0x34]
jmp 0x140049181
mov rax, 0xffffffffffffffff
add rsp, 0x160
pop rsi
ret
mov rcx, qword [rcx + 8]
jmp 0x1400490f0

Function at 0x140049190
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov rsi, rdx
mov rdi, rcx
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004927b
lea r14, str.bytes_read___static_cast_DWORD___1_
lea r15, [rsp + 0x2c]
lea r12, [rsp + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_GetFileType]
mov rbp, qword [sym.imp.KERNEL32.dll_ReadFile]
nop word cs:[rax + rax]
mov dword [rsp + 0x30], 0xffffffff
mov eax, dword [rsp + 0x2c]
cmp eax, 0xffffffff
jne 0x140049251
mov rcx, r15
mov rdx, r12
mov r8, r14
call fcn.140049cf0
test rax, rax
je 0x14004924d
mov qword [rsp + 0x20], rax
mov rcx, r12
lea rdx, str.FileOperationResult___cdecl_crashpad::ReadFile_FileHandle__void___size_t_
lea r8, str.third_party_crashpad_crashpad_util_file_file_io_win.cc
mov r9d, 0x7f
call fcn.140006530
mov rcx, r12
call fcn.140006650
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x140049294
mov rcx, rdi
call r13
cmp eax, 3
jne 0x140049290
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r15
call rbp
test eax, eax
jne 0x140049200
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
setne al
neg rax
jmp 0x140049296
mov eax, dword [rsp + 0x2c]
mov eax, eax
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140049b60
Capabilities:
Clear file content

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe8], 0xfffffffffffffffe
mov rdi, rcx
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.140049a80
test rax, rax
jne 0x140049bf0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x140049bf0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingTruncateFile_FileHandle_
lea r8, str.third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rcx, [rbp - 0x48]
mov r9d, 0xfc
call fcn.1400069d0
lea rcx, [rbp - 0x40]
lea rdx, [0x1400cbb1b]
mov r8d, 0xc
call fcn.1400048b0
lea rcx, [rbp - 0x48]
call fcn.140006a90
xor esi, esi
mov eax, esi
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret

Function at 0x14004a3f0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x160
mov eax, 0xffffffff
cmp r8, rax
cmovae r8, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14004917a
mov dword [rsp + 0x38], 0xffffffff
cmp dword [rsp + 0x34], 0xffffffff
jne 0x140049174
lea r8, str.bytes_written___static_cast_DWORD___1_
lea rcx, [rsp + 0x34]
lea rdx, [rsp + 0x38]
call fcn.140049cf0
test rax, rax
je 0x140049174
mov qword [rsp + 0x20], rax
lea rdx, str.FileOperationResult___cdecl_crashpad::internal::NativeWriteFile_FileHandle__const_void___size_t_
lea r8, str.third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov r9d, 0x66
call fcn.140006530
mov rcx, rsi
call fcn.140006650
mov eax, dword [rsp + 0x34]
jmp 0x140049181
mov rax, 0xffffffffffffffff
add rsp, 0x160
pop rsi
ret
mov rcx, qword [rcx + 8]
jmp 0x1400490f0

Function at 0x14004a8b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe8], 0xfffffffffffffffe
mov ebx, edx
mov rsi, rcx
cmp byte [rcx + 0x17], 0
jns 0x14004a8db
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004a8f8
test bl, bl
jne 0x14004a954
mov ecx, eax
and ecx, 0x400
je 0x14004a954
xor eax, eax
jmp 0x14004a95a
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::IsDirectory_const_base::FilePath___bool_
lea r8, str.third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rbp - 0x48]
mov r9d, 0x80
call fcn.1400069d0
lea rcx, [rbp - 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400048b0
mov rcx, rax
mov rdx, rsi
call fcn.140008200
lea rcx, [rbp - 0x48]
call fcn.140006a90
xor eax, eax
jmp 0x14004a95a
and eax, 0x10
shr eax, 4
add rsp, 0x170
pop rbx
pop rsi
pop rbp
ret
Function at 0x14004a9a0
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], 0xfffffffffffffffe
mov ebx, r8d
mov rsi, rcx
cmp byte [rcx + 0x17], 0
jns 0x14004a9cd
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14004aab1
test bl, bl
je 0x14004aa57
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14004aa57
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.14004a8b0
test al, al
jne 0x14004aab1
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingCreateDirectory_const_base::FilePath___FilePermissions__bool_
lea r8, str.third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rbp - 0x50]
mov r9d, 0x5c
call fcn.140005c30
lea rcx, [rbp - 0x48]
mov rdx, rsi
call fcn.140008200
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.1400048b0
lea rcx, [rbp - 0x50]
call fcn.140006650
jmp 0x14004aaaf
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::LoggingCreateDirectory_const_base::FilePath___FilePermissions__bool_
lea r8, str.third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rbp - 0x50]
mov r9d, 0x61
call fcn.1400069d0
lea rcx, [rbp - 0x48]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400048b0
mov rcx, rax
mov rdx, rsi
call fcn.140008200
lea rcx, [rbp - 0x50]
call fcn.140006a90
xor edi, edi
mov eax, edi
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x14004ab20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], 0xfffffffffffffffe
mov rsi, rcx
cmp byte [rcx + 0x17], 0
jns 0x14004ab48
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004ab5d
test eax, 0x410
sete al
jmp 0x14004abb7
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::IsRegularFile_const_base::FilePath__
lea r8, str.third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rbp - 0x50]
mov r9d, 0x73
call fcn.1400069d0
lea rcx, [rbp - 0x48]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400048b0
mov rcx, rax
mov rdx, rsi
call fcn.140008200
lea rcx, [rbp - 0x50]
call fcn.140006a90
xor eax, eax
add rsp, 0x168
pop rsi
pop rbp
ret