joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003eba0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rcx, rcx
je 0x14003ec7d
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x40]
mov qword [rbx], 0
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call r15
mov r14, rax
call r15
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
mov rcx, rax
mov rdx, rdi
mov r8, r14
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x14003ec81
mov r14, qword [rsp + 0x40]
cmp qword [rsi], r14
je 0x14003ec47
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003ec67
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14003ec3f
mov qword [rsi], r14
call fcn.140105b90
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14017e7b0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140105b90
mov rcx, qword [rsi]
call fcn.1401651a0
mov qword [rsi], 0
jmp 0x14003ec2d
mov bl, 1
jmp 0x14003ec4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14003ec3f
Function at 0x14003f470
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x14003f626
cmp qword [rsi], 0
jne 0x14003f626
cmp dword [rsi + 0x14], 0
jne 0x14003f626
cmp qword [rsi + 8], 0
jne 0x14003f626
xor eax, eax
mov r15, qword [rdi]
cmp rax, r15
je 0x14003f4e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003f534
lea rax, [r15 + 1]
cmp rax, 2
jb 0x14003f4da
mov qword [rsi], r15
call fcn.140105b90
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rdi + 8]
cmp qword [rsi + 8], r15
je 0x14003f51c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14003f568
lea rax, [r15 + 1]
cmp rax, 2
jb 0x14003f514
mov qword [rsi + 8], r15
call fcn.140105b90
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140105b90
mov r14, qword [rsi]
cmp qword [0x1402a45d0], 0
je 0x14003f59e
mov rcx, qword [0x1402a45d0]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x1401e7f70.0]
mov qword [rsi], 0
jmp 0x14003f4c8
call fcn.140105b90
mov r14, qword [rsi + 8]
cmp qword [0x1402a45d0], 0
je 0x14003f5dc
mov rcx, qword [0x1402a45d0]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x1401e7f70.0]
mov qword [rsi + 8], 0
jmp 0x14003f501
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14027d081]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003f636
lea rcx, [sym.Maxthon.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14003f61a
call qword [case.0x1401e7f70.0]
mov rcx, rax
xor edx, edx
call fcn.140005a10
jmp 0x14003f546
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14027d081]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003f63a
lea rcx, [sym.Maxthon.exe_GetHandleVerifier]
cmp rax, rcx
je 0x14003f620
call qword [case.0x1401e7f70.0]
mov rcx, rax
xor edx, edx
call fcn.140005a10
jmp 0x14003f57b
xor ecx, ecx
mov dl, 1
jmp 0x14003f5d2
xor ecx, ecx
mov dl, 1
jmp 0x14003f610
mov rcx, rsi
call fcn.1401f3d20
mov rax, qword [rsi]
jmp 0x14003f4ac
xor ecx, ecx
jmp 0x14003f5d0
xor ecx, ecx
jmp 0x14003f60e
Function at 0x1400429f0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x6c], 0
jne 0x140042b26
mov rdi, rdx
mov rsi, rcx
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
test rdi, rdi
jne 0x140042b2d
lea r8, [rsp + 0x38]
mov rcx, rbx
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140042b5e
mov rdi, qword [rsp + 0x38]
cmp qword [rsi + 0x48], rdi
je 0x140042a97
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x48]
inc rax
cmp rax, 2
jae 0x140042b0b
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140042a8b
mov qword [rsi + 0x48], rdi
call fcn.140105b90
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsi + 0x48]
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x10], r14
movaps xmm0, xmmword [0x140270690]
movaps xmmword [rbx], xmm0
mov rcx, rbx
mov rdx, rdi
call fcn.140042ba0
cmp byte [rbx], 0
je 0x140042b68
lea rcx, [rsi + 0x58]
cmp byte [rsi + 0x50], 0
lea rbx, [rsp + 0x48]
mov rdx, rbx
jne 0x140042b6f
call fcn.140042ca0
mov byte [rsi + 0x50], 1
cmp byte [rsp + 0x40], 0
je 0x140042aec
mov rcx, rbx
call fcn.140042960
mov byte [rsi + 0x6c], 1
xor edi, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14017e7b0
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140105b90
mov rcx, qword [rsi + 0x48]
call fcn.1401651a0
mov qword [rsi + 0x48], 0
jmp 0x140042a78
mov edi, 0x4df
jmp 0x140042af2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x38]
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x140042a4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140042af2
mov edi, 0x3f0
jmp 0x140042af2
call fcn.1400ec730
xor edi, edi
cmp byte [rsp + 0x40], 0
mov byte [rsi + 0x6c], 1
je 0x140042af2
mov rcx, rbx
call fcn.140042960
jmp 0x140042af2

Function at 0x140042ca0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov rbx, qword [rdx]
mov qword [rdx], rax
lea r14, [rbx + 1]
cmp r14, 2
jb 0x140042cc6
call fcn.140105b90
cmp qword [rsi], rbx
je 0x140042cf5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140042d02
cmp r14, 2
jb 0x140042ced
mov qword [rsi], rbx
call fcn.140105b90
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140105b90
mov rcx, qword [rsi]
call fcn.1401651a0
mov qword [rsi], 0
jmp 0x140042cdf
Function at 0x140043290
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [rcx + 0x6c], 0
je 0x1400433ef
mov rbx, rdx
lea rdx, [rsp + 0x40]
mov qword [rdx], 0
call fcn.140043640
test eax, eax
jne 0x1400433f6
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x38]
mov qword [rcx], rax
mov rdi, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 2
xor esi, esi
mov rcx, rdi
mov edx, 0xf01ff
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x140043402
mov r14, qword [rsp + 0x38]
cmp qword [rbx], r14
je 0x14004334c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rbx]
inc rax
cmp rax, 2
jae 0x140043395
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140043344
mov qword [rbx], r14
call fcn.140105b90
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14004337b
call fcn.140105b90
cmp qword [0x1402a45d0], 0
je 0x1400433ab
mov rcx, qword [0x1402a45d0]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [case.0x1401e7f70.0]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14017e7b0
mov eax, esi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140105b90
mov rcx, qword [rbx]
call fcn.1401651a0
mov qword [rbx], 0
jmp 0x140043332
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14027d081]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004340f
lea rcx, [sym.Maxthon.exe_GetHandleVerifier]
cmp rax, rcx
je 0x1400433e9
call qword [case.0x1401e7f70.0]
mov rcx, rax
xor edx, edx
call fcn.140005a10
jmp 0x140043365
xor ecx, ecx
mov dl, 1
jmp 0x1400433df
mov esi, 0x3f0
jmp 0x14004337b
mov esi, eax
mov rdi, qword [rsp + 0x40]
jmp 0x14004334c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14004334c
xor ecx, ecx
jmp 0x1400433dd
Function at 0x140043420
Capabilities:
Compare security identifiers

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp byte [rcx + 0x6c], 0
je 0x140043629
mov rdi, rcx
cmp byte [rcx + 0x50], 0
je 0x140043630
mov rsi, rdx
mov rdx, qword [rdi + 0x58]
lea rbx, [rsp + 0x50]
mov rcx, rbx
mov r8d, 2
call fcn.140044310
mov r13, qword [rbx]
mov rbp, qword [rbx + 8]
cmp r13, rbp
je 0x14004358f
lea rbx, [rdi + 0x18]
xorps xmm6, xmm6
mov eax, dword [r13 + 0x18]
cmp eax, 0xbfffffff
ja 0x140043558
and eax, 0x20
jne 0x140043558
mov r15, qword [rsi]
mov r12, qword [rsi + 8]
cmp r15, r12
je 0x1400434ce
mov rdx, qword [r13]
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140043558
add r15, 0x18
jmp 0x1400434ae
mov r15, qword [r13]
mov r12, qword [r13 + 8]
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
sub r12, r15
je 0x140043518
js 0x1400435f8
mov rcx, r12
call fcn.14017b1d8
mov qword [rsp + 0x30], rax
lea r14, [rax + r12]
mov qword [rsp + 0x40], r14
mov rcx, rax
mov rdx, r15
mov r8, r12
call fcn.140180220
mov qword [rsp + 0x38], r14
mov rax, qword [rdi + 0x20]
cmp rax, qword [rdi + 0x28]
jae 0x140043567
test rax, rax
je 0x1400435fd
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [rdi + 0x20], rax
add r13, 0x20
cmp r13, rbp
jne 0x14004348f
jmp 0x14004358a
mov rcx, rbx
lea rdx, [rsp + 0x30]
call fcn.1401bd460
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140043558
mov qword [rsp + 0x38], rcx
call fcn.14017b254
jmp 0x140043558
mov r13, qword [rsp + 0x50]
test r13, r13
je 0x1400435ce
mov rax, qword [rsp + 0x58]
mov rcx, r13
cmp rax, r13
je 0x1400435c4
lea rsi, [rax - 0x20]
mov rcx, qword [rax - 0x20]
test rcx, rcx
je 0x1400435b7
mov qword [rax - 0x18], rcx
call fcn.14017b254
mov rax, rsi
cmp rsi, r13
jne 0x1400435a1
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], r13
call fcn.14017b254
xor esi, esi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14017e7b0
mov eax, esi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14017b5a8
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.1401bdbc0
mov esi, 0x3f0
jmp 0x1400435d0
ud2
Function at 0x1400453c0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140045488
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x140045450
cmp eax, 0xffffffff
je 0x140045461
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14017e7b0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call r15
cmp eax, 3
je 0x140045464
mov eax, dword [rsp + 0x2c]
jmp 0x140045430
int3
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x140045423
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
setne sil
neg rsi
jmp 0x140045432
Function at 0x14004d880
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.14014abf0
test al, al
jne 0x14004d8b1
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140017ab0
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsi + 0x24], 0xfffffffb
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14004d9a0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x50]
mov qword [r14 + 0x50], rax
movaps xmm0, xmmword [0x140270690]
movaps xmmword [r14 + 0x40], xmm0
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.ReadAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x5b
call fcn.140120f60
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140121610
test esi, esi
js 0x14004da89
lea r9, [rsp + 0x30]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004da90
mov esi, dword [rsp + 0x30]
test esi, esi
js 0x14004daa3
lea rcx, [rsp + 0x50]
call fcn.140120f80
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14017e7b0
mov eax, esi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14004da5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x14004da5e
int3
Function at 0x14004f2e0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1401808d0
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14004f375
cmp word [rsp + 0x70], 0
je 0x14004f375
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.14017bd98
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.14014b0f0
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.14017e7b0
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.14005c650
test al, al
je 0x14004f3a0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1401796f0
jmp 0x14004f3bf
lea rax, [0x140275894]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.14014b0f0
cmp byte [rsp + 0x57], 0
jns 0x14004f357
mov rcx, qword [rsp + 0x40]
call fcn.14017b254
jmp 0x14004f357

Function at 0x140050170
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140050197
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400501d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400501f0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14017e7b0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.1400502c0
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14017e7b0
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
cmp dword [0x1402a0cb8], 2
jg 0x1400502ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x266
mov r9d, 2
call fcn.1401dfc50
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1401b98e0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14014f5a0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x140050284
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
jmp 0x140050288
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.1401b98e0
cmp byte [rsp + 0x4f], 0
jns 0x1400502a4
mov rcx, qword [rsp + 0x38]
call fcn.14017b254
lea rcx, [rsp + 0x50]
call fcn.1401dfcd0
xor esi, esi
jmp 0x1400501d4
Function at 0x1400502c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x1400502e7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140050319
mov dil, 1
test al, 0x10
je 0x1400503b4
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14017e7b0
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
cmp dword [0x1402a0cb8], 2
jg 0x1400504a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x251
mov r9d, 2
call fcn.1401dfc50
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401b98e0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x38]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.14014f5a0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14005043e
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
jmp 0x140050442
cmp dword [0x1402a0cb8], 2
jg 0x1400504a9
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x255
mov r9d, 2
call fcn.140001120
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401b98e0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsi]
cmovns rax, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
cmovs rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.14014f5a0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14005046a
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
jmp 0x14005046e
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.1401b98e0
cmp byte [rsp + 0x5f], 0
jns 0x14005045e
mov rcx, qword [rsp + 0x48]
call fcn.14017b254
lea rcx, [rsp + 0x60]
call fcn.1401dfcd0
jmp 0x1400504a9
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.1401b98e0
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1401b98e0
cmp byte [rsp + 0x5f], 0
jns 0x14005049f
mov rcx, qword [rsp + 0x48]
call fcn.14017b254
lea rcx, [rsp + 0x60]
call fcn.140001210
xor edi, edi
jmp 0x1400502fd
Function at 0x1400516e0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x300
movaps xmmword [rsp + 0x2f0], xmm6
mov rsi, rcx
mov rax, qword [0x14029a038]
xor rax, rsp
mov qword [rsp + 0x2e8], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x290]
mov qword [rdi + 0x50], r15
movaps xmm6, xmmword [0x140270690]
movaps xmmword [rdi + 0x40], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, [0x140275900]
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x80]
mov rcx, rbx
mov r9d, 0x3e1
call fcn.140120f60
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140121610
lea rbx, [rsp + 0x80]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1401808d0
mov word [rbx], 0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
add edi, 0xfffffefb
cmp edi, 0xfffffefc
jb 0x140051844
lea r14, [rsp + 0x28]
mov qword [r14], rbx
mov rcx, rbx
call fcn.14017bd98
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov rdx, r14
call fcn.14014b0f0
lea r14, [rsp + 0x50]
movaps xmmword [r14], xmm6
mov qword [r14 + 0x10], r15
movzx eax, byte [rbx + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rbx]
cmovns rax, rbx
lea rdx, [rsp + 0x70]
mov qword [rdx], rax
cmovs rcx, qword [rbx + 8]
mov qword [rdx + 8], rcx
mov rcx, r14
call fcn.14014b0f0
mov rcx, r14
call fcn.14014afe0
cmp byte [rsi + 0x17], 0
js 0x140051883
mov rax, qword [rsp + 0x60]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x67], 0
mov word [rsp + 0x50], 0
cmp byte [rsp + 0x4f], 0
jns 0x140051844
mov rcx, qword [rsp + 0x38]
call fcn.14017b254
cmp edi, 0xfffffefc
setae bl
lea rcx, [rsp + 0x290]
call fcn.140120f80
mov rcx, qword [rsp + 0x2e8]
xor rcx, rsp
call fcn.14017e7b0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x2f0]
add rsp, 0x300
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rsi]
call fcn.14017b254
jmp 0x140051816
Function at 0x140051d50
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rax, [0x14026e310]
mov qword [rcx], rax
lea rax, [0x14026d050]
mov qword [rcx + 8], rax
mov eax, dword [0x1402a44f8]
mov ecx, dword [0x14029dfe4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140051e7d
lea rdi, [rsi + 8]
mov ecx, dword [0x14029bf80]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140051f0f
mov rcx, qword [0x1402a44e8]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1402a44f0]
jne 0x140051f0f
mov rcx, qword [rax + rcx]
mov rdx, rdi
call fcn.140032610
mov rdi, qword [rsi + 0x28]
test rdi, rdi
je 0x140051e14
mov rax, qword [rdi]
mov rax, qword [rax + 8]
mov rcx, rdi
call qword [case.0x1401e7f70.0]
cmp byte [rdi + 0xc], 0
jne 0x140051dfb
mov qword [rdi + 0x10], 0
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x140051e14
lock dec dword [rcx + 8]
jne 0x140051e14
mov edx, 1
call fcn.140048500
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x140051e4a
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jne 0x140051e31
add rsp, 0x28
pop rdi
pop rsi
ret
lock dec dword [rcx]
jne 0x140051e2a
mov rax, qword [rcx + 0x10]
mov rdx, qword [case.0x1401e7f70.0]
add rsp, 0x28
pop rdi
pop rsi
jmp rdx
call fcn.140105b90
mov rdi, qword [rsi + 0x18]
cmp qword [0x1402a45d0], 0
je 0x140051ecb
mov rcx, qword [0x1402a45d0]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [case.0x1401e7f70.0]
mov qword [rsi + 0x18], 0
jmp 0x140051e21
lea rcx, [0x1402a44f8]
call fcn.14017b2bc
cmp dword [0x1402a44f8], 0xffffffff
jne 0x140051d93
mov qword [0x1402a44f0], 0
lea rcx, [0x1402a44e8]
mov qword [0x1402a44e8], 0xffffffffffffffff
xor edx, edx
call fcn.140002850
lea rcx, [0x1402a44f8]
call fcn.14017b25c
jmp 0x140051d93
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14027d081]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140051f16
lea rcx, [sym.Maxthon.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140051f01
call qword [case.0x1401e7f70.0]
mov rcx, rax
xor edx, edx
jmp 0x140051f05
xor ecx, ecx
mov dl, 1
call fcn.140005a10
jmp 0x140051e5d
xor ecx, ecx
jmp 0x140051dcc
xor ecx, ecx
jmp 0x140051efd