joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140238720
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x14023877f
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x140238890
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401ad700
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x1402387da
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x1402387c9
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1401af190
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x14023874e
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x1402388bc
lea rcx, [r12*8]
call fcn.1401abf00
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x14023885b
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x140238890
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x140238843
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.140238a80
mov r15, qword [rsi + 8]
jmp 0x14023874e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.1401f6bb0
call fcn.1401e8fd0
int3
Function at 0x1402388d0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x14023892f
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x140238a40
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401ad700
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x14023898a
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x140238979
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1401af190
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x1402388fe
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x140238a6c
lea rcx, [r12*8]
call fcn.1401abf00
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x140238a0b
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x140238a40
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x1402389f3
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.140238a80
mov r15, qword [rsi + 8]
jmp 0x1402388fe
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.1401f6bb0
call fcn.1401e8fd0
int3
Function at 0x140239130
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x1402af0f0]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.PinShortcutToTaskbar
lea r8, str.....chromeinstallerutil_taskbar_util.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x77
call fcn.14018d210
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140182070
call fcn.140126bf0
cmp eax, 0xd
jge 0x140239205
cmp byte [rsi + 0x17], 0
jns 0x1402391ac
mov rsi, qword [rsi]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.taskbarpin
xor ecx, ecx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x21
setge sil
lea rcx, [rsp + 0x50]
call fcn.1401822b0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401ad700
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x1402391da
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi], rax
mov rcx, rdi
call fcn.140239410
cmp qword [rdi], 0
je 0x140239201
cmp byte [rsi + 0x17], 0
jns 0x14023922e
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov rdi, rax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
xor edx, edx
mov r8, rdi
mov r9d, 4
call qword [0x14031b008]
test eax, eax
setns sil
test rdi, rdi
je 0x14023926e
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_ILFree]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1402391da
mov qword [rsp + 0x30], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14031b008]
jmp 0x1402391da
Function at 0x1402392a0
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x1402af0f0]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.UnpinShortcutFromTaskbar
lea r8, str.....chromeinstallerutil_taskbar_util.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x83
call fcn.14018d210
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140182070
call fcn.140126bf0
cmp eax, 0xd
jge 0x140239370
cmp byte [rsi + 0x17], 0
jns 0x14023931c
mov rsi, qword [rsi]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.taskbarunpin
xor ecx, ecx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x21
setge bl
lea rcx, [rsp + 0x50]
call fcn.1401822b0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401ad700
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi], rax
mov rcx, rdi
call fcn.140239410
cmp qword [rdi], 0
je 0x140239313
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14023939c
mov rcx, qword [rsi]
call qword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov rbx, rax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
mov rdx, rbx
xor r8d, r8d
mov r9d, 4
call qword [0x14031b008]
mov edi, eax
test rbx, rbx
je 0x1402393d6
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_ILFree]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1402393f6
mov qword [rsp + 0x30], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14031b008]
mov bl, 1
test edi, edi
jns 0x140239349
jmp 0x140239313

Function at 0x1402396a0
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rdi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1401af840
mov word [rdi], 0
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, ebx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
test eax, eax
js 0x14023972f
lea r14, [rsp + 0x28]
mov qword [r14], rdi
mov rcx, rdi
call fcn.1401cfa44
mov qword [r14 + 8], rax
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov rdx, r14
call fcn.14018d560
mov rcx, rsi
mov rdx, rdi
call fcn.14018d730
mov rcx, rdi
call fcn.14018d6b0
test ebx, ebx
setns bl
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401ad700
mov eax, ebx
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140239c60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov ebx, 1
cmp rdi, r12
je 0x140239cf4
mov rsi, r8
mov r14, rcx
lea r15, [rsp + 0x20]
mov rcx, rdi
mov rdx, r15
call fcn.14023ac50
test al, al
jne 0x140239cbc
add rdi, 0x70
cmp rdi, r12
jne 0x140239ca1
mov rdi, r12
cmp rdi, qword [r14 + 0x58]
je 0x140239cf4
cmp byte [rdi + 0x27], 0
js 0x140239cce
lea rcx, [rdi + 0x10]
jmp 0x140239cd2
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov ebx, 1
cmovne ebx, ecx
test ebx, ebx
jne 0x140239cf4
mov qword [rsi], rdi
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401ad700
mov eax, ebx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140239e80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov r14, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov esi, 1
cmp r14, r12
je 0x140239efb
mov rdi, r9
mov ebp, r8d
mov rbx, rcx
lea r15, [rsp + 0x20]
mov rcx, r14
mov rdx, r15
call fcn.14023ac50
test al, al
jne 0x140239ee0
add r14, 0x70
cmp r14, r12
jne 0x140239ec5
mov r14, r12
cmp r14, qword [rbx + 0x58]
je 0x140239efb
mov eax, dword [r14 + 0x68]
cmp eax, ebp
je 0x140239f19
xor ecx, ecx
cmp eax, 1
sete cl
lea esi, [rcx + rcx*2]
inc esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401ad700
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp byte [r14 + 0x27], 0
js 0x140239f26
lea rcx, [r14 + 0x10]
jmp 0x140239f2a
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140239efb
shr eax, 3
and eax, 2
mov esi, eax
jne 0x140239efb
mov byte [rbx + 0x48], 1
mov qword [rdi], r14
xor esi, esi
jmp 0x140239efb
Function at 0x140240c00
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
movabs rax, 0x4000000000
mov qword [rcx + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov eax, 1
ret

Function at 0x140241ce0
Capabilities:
Enumerate processes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
lea rsi, [rcx + 0x18]
mov r8d, 0x238
mov rcx, rsi
xor edx, edx
call fcn.1401af840
mov dword [rdi + 0x18], 0x238
cmp byte [rdi + 0x10], 0
je 0x140241d22
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
mov byte [rdi + 0x10], 1
mov rcx, qword [rdi + 8]
mov rdx, rsi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x140241d16
Function at 0x14024f3f0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x140307d28]
mov ecx, dword [0x1402fa5e8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14024f66f
mov rax, qword [0x140307d20]
test rax, rax
je 0x14024f4db
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call qword [0x14031b008]
test eax, eax
je 0x14024f485
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
je 0x14024f4e2
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x14024f517
mov ecx, 2
call fcn.14018cad0
test al, al
je 0x14024f4db
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4c
mov r9d, 2
call fcn.1402274c0
lea rcx, [rsp + 0x40]
lea rdx, [0x1402cc6ce]
mov r8d, reloc.WS2_32.dll_ntohl
call fcn.1401e9050
mov rcx, rbx
call fcn.140227540
mov byte [rsi + 0x81], 0
movaps xmm0, xmmword [0x1402af0f0]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
cmp byte [rsi + 0x81], 0
setne dl
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.14024f6c0
test al, al
jne 0x14024f5a1
mov ecx, 2
call fcn.14018cad0
test al, al
jne 0x14024f560
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1401ad700
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21f
mov r9d, 2
call fcn.1400ff950
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.1401e9050
mov rcx, rsi
call fcn.1400fffa0
jmp 0x14024f541
cmp byte [rsi + 0x80], 0
mov rdx, qword [rsi + 0x28]
mov rcx, rdi
mov r8, rsi
jne 0x14024f5bb
call fcn.14024ff80
jmp 0x14024f5c0
call fcn.14024f900
test al, al
jne 0x14024f60a
mov ecx, 2
call fcn.14018cad0
test al, al
je 0x14024f541
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x228
mov r9d, 2
call fcn.1400ff950
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x14024f592
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.14013d360
mov sil, 1
test al, al
jne 0x14024f543
mov ecx, 2
call fcn.14018cad0
test al, al
je 0x14024f541
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22d
mov r9d, 2
call fcn.1400ff950
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x14024f592
lea rcx, [0x140307d28]
call fcn.1401ac060
cmp dword [0x140307d28], 0xffffffff
jne 0x14024f43b
lea rcx, [0x1402bb02c]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.14013ec50
mov qword [0x140307d20], rax
lea rcx, [0x140307d28]
call fcn.1401ac0f8
jmp 0x14024f43b
Function at 0x140257600
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x14025762a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140257649
mov edi, eax
bt eax, 0xa
jae 0x140257641
test bl, bl
je 0x140257657
and edi, 0x10
shr edi, 4
jmp 0x140257659
mov ecx, 2
call fcn.14018cad0
test al, al
jne 0x140257676
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1401ad700
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x80
mov r9d, 2
call fcn.1402274c0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401e9050
mov rcx, rax
mov rdx, rsi
call fcn.140228100
mov rcx, rdi
call fcn.140227540
jmp 0x140257657

Function at 0x1402576d0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1402576fb
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14025772f
test bl, bl
je 0x14025771f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1402577a1
mov ecx, 2
call fcn.14018cad0
test al, al
jne 0x14025774c
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1401ad700
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x61
mov r9d, 2
call fcn.1402274c0
lea rcx, [rsp + 0x38]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1401e9050
mov rcx, rax
mov rdx, rsi
call fcn.140228100
mov rcx, rdi
call fcn.140227540
jmp 0x14025772d
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.140257600
test al, al
jne 0x14025772f
mov ecx, 2
call fcn.14018cad0
test al, al
je 0x14025772d
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x5c
mov r9d, 2
call fcn.1400ff950
lea rcx, [rsp + 0x38]
mov rdx, rsi
call fcn.140228100
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.1401e9050
mov rcx, rdi
call fcn.1400fffa0
jmp 0x14025772d
Function at 0x140257820
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x140257847
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140257877
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1401ad700
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14018cad0
test al, al
jne 0x140257889
xor esi, esi
jmp 0x14025785b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x73
mov r9d, 2
call fcn.1402274c0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401e9050
mov rcx, rax
mov rdx, rsi
call fcn.140228100
mov rcx, rdi
call fcn.140227540
jmp 0x140257885

Function at 0x1402578e0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x140257907
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14025791e
and eax, 0x410
cmp eax, 0x410
je 0x140257963
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14025792a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x140257947
mov ecx, 2
call fcn.14018cad0
test al, al
jne 0x140257984
xor edi, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1401ad700
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1401ad700
mov rcx, rsi
add rsp, 0x178
pop rdi
pop rsi
jmp fcn.1402579e0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x93
mov r9d, 2
call fcn.1402274c0
lea rcx, [rsp + 0x40]
lea rdx, str.DeleteFile
mov r8d, ntohl
call fcn.1401e9050
mov rcx, rax
mov rdx, rsi
call fcn.140228100
mov rcx, rdi
call fcn.140227540
jmp 0x140257945

Function at 0x1402579e0
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x140257a08
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
jne 0x140257a22
mov ecx, 2
call fcn.14018cad0
test al, al
jne 0x140257a44
test edi, edi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1401ad700
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.1402274c0
lea rcx, [rsp + 0x38]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1401e9050
mov rcx, rax
mov rdx, rsi
call fcn.140228100
mov rcx, rbx
call fcn.140227540
jmp 0x140257a22
Function at 0x140264610
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x140308364]
mov ecx, dword [0x1402fa5e8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140264670
cmp rdi, rsi
je 0x14026466c
mov eax, 0xffffffff
lea rcx, [0x140307f64]
mov dl, byte [rdi]
xor dl, al
movzx edx, dl
shr eax, 8
xor eax, dword [rcx + rdx*4]
inc rdi
cmp rdi, rsi
jne 0x14026464e
not eax
add rsp, 0x28
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140264665
lea rcx, [0x140308364]
call fcn.1401ac060
cmp dword [0x140308364], 0xffffffff
jne 0x14026463d
call fcn.1402646a0
lea rcx, [0x140308364]
call fcn.1401ac0f8
jmp 0x14026463d

Function at 0x1402646a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
lea rsi, [0x140307f64]
mov r8d, 0x400
mov rcx, rsi
mov dl, 0xaa
call fcn.1401af840
xor eax, eax
mov ecx, 0xedb88320
mov r8d, eax
shr r8d, 1
mov edx, eax
and edx, 1
neg edx
and edx, ecx
xor edx, r8d
mov r9d, edx
shr r9d, 1
mov r8d, eax
shl r8d, 0x1e
sar r8d, 0x1f
and r8d, ecx
xor r8d, r9d
mov r9d, r8d
shr r9d, 6
mov r10d, eax
shl r10d, 0x1d
sar r10d, 0x1f
and r10d, 0x76dc419
mov r11d, eax
shl r11d, 0x1c
sar r11d, 0x1f
and r11d, 0xedb8832
xor r11d, r10d
mov r10d, eax
shl r10d, 0x1b
sar r10d, 0x1f
and r10d, 0x1db71064
xor r10d, r11d
mov r11d, eax
shl r11d, 0x1a
sar r11d, 0x1f
and r11d, 0x3b6e20c8
xor r11d, r10d
xor r11d, r9d
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
xor edx, r11d
shl r8d, 0x1a
sar r8d, 0x1f
and r8d, ecx
xor r8d, edx
mov dword [rsi], r8d
inc rax
add rsi, 4
cmp rax, 0x100
jne 0x1402646c3
add rsp, 0x20
pop rsi
ret