joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14014b600
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
test esi, esi
je 0x14014b705
mov r15, r8
mov rdi, rcx
mov rbx, rsi
shr rbx, 0x20
mov ecx, dword [0x1401f6f88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14014b6c2
movsxd rcx, dword [rdi + 0x2f0]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rdi + 0x2f4]
jne 0x14014b6c2
cmp qword [rax + rcx], 0
je 0x14014b6c2
mov ecx, dword [0x1401f6f88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14014b750
movsxd rcx, dword [rdi + 0x2f0]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rdi + 0x2f4]
jne 0x14014b750
mov rcx, qword [rax + rcx]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14014b6c2
cmp dword [rax + 0x2610], esi
jne 0x14014b6c2
mov edx, ebx
and edx, 0x3ffffff
cmp rdx, qword [rcx + 0x20]
jne 0x14014b6c2
mov rcx, rsi
shr rcx, 0x3a
imul rcx, rcx, 0x98
add rax, rcx
add rax, 0x10
jne 0x14014b707
test r15, r15
je 0x14014b6ce
cmp byte [r15 + 8], 0
je 0x14014b72f
mov rax, qword [rdi + 0x330]
test rax, rax
je 0x14014b713
and ebx, 0x3ffffff
cmp rbx, qword [rdi + 0x338]
jne 0x14014b713
cmp dword [rax + 0x2610], esi
jne 0x14014b705
shr rsi, 0x3a
imul rcx, rsi, 0x98
add rax, rcx
add rax, 0x10
jmp 0x14014b707
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rdi + 0x20]
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp rax
mov r14, qword [r15]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14014b746
mov byte [r15 + 8], 1
jmp 0x14014b6ce
mov rcx, r14
call fcn.1400b0d10
jmp 0x14014b73f
xor ecx, ecx
jmp 0x14014b68c
Function at 0x14014d1e0
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14014d21b
mov eax, dword [0x1401f8a8c]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
lea rax, [rax + 0x120]
cmp qword [rcx + 8], rax
je 0x14014d2aa
mov rcx, qword [rcx + 0x20]
jmp 0x14014d1ec
mov rax, qword [rsi + 0x28]
cmp rax, 0x60
mov edi, 0x60
cmova rdi, rax
mov rcx, rdi
call qword [rsi + 0x48]
mov rdx, rax
xor r8d, r8d
mov qword [rax], r8
mov qword [rax + 8], 0x18
mov qword [rax + 0x10], rdi
lock add qword [rsi + 0x10], rdi
lea rcx, [rax + 0x18]
mov qword [rax + 8], 0x60
mov qword [rax + 0x18], rsi
mov edi, dword [0x1401f8a8c]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdi*8]
lea rax, [rax + 0x120]
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rdx
lea rax, [rdx + 0x60]
mov qword [rdx + 0x40], rax
mov rax, qword [rdx + 0x10]
add rax, rdx
mov qword [rdx + 0x48], rax
mov qword [rdx + 0x30], r8
xorps xmm0, xmm0
movups xmmword [rdx + 0x50], xmm0
mov rax, qword [rsi]
mov qword [rdx + 0x38], rax
lock cmpxchg qword [rsi], rcx
jne 0x14014d29f
mov eax, dword [0x1401f8a8c]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov qword [rax + 0x128], rcx
mov rdx, qword [rsi + 0x20]
mov qword [rax + 0x120], rdx
mov qword [rsi + 8], rcx
mov rax, rcx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140152a80
Capabilities:
Get thread local storage value

Disassembly:
mov rcx, rdx
mov rdx, r8
jmp fcn.1400d1c30

Function at 0x140152ac0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov al, 1
xchg byte [rcx + 0xb0], al
test al, 1
je 0x140152af8
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f32c0
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov edi, edx
mov rbx, rcx
xor eax, eax
xchg qword [rcx + 0x90], rax
mov qword [rcx + 0xa8], rax
lock inc qword [rcx + 0xa0]
call fcn.14019e6c0
mov rsi, rax
mov rcx, rax
mov rdx, rbx
call fcn.14019e930
cmp edi, 1
jne 0x140152b41
call fcn.14019eca0
lea rcx, [rsp + 0x20]
mov qword [rcx], rsi
call fcn.14019ed50
jmp 0x140152ae2
mov rcx, rsi
call fcn.14019ee10
test rsi, rsi
je 0x140152ae2
mov rcx, qword [rsi + 0x48]
call fcn.14019f140
mov rcx, rsi
add rcx, 0x28
call fcn.14019f480
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140152b75
mov qword [rsi + 0x18], rcx
call fcn.14019f7c0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f32c0
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.14019f7c0
Function at 0x140158450
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd0
movaps xmmword [rsp + 0xc0], xmm6
mov r15, r8
mov ebp, edx
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
lea rdi, [rsp + 0xb4]
mov dword [rdi], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x1401585e1
lea rdx, [rsp + 0xa8]
mov qword [rdx], 0
mov rcx, rsi
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x1401585e1
mov r14, qword [rsp + 0xa8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x90]
mov qword [rdi + 0x10], rax
movaps xmm6, xmmword [0x1401c8a80]
movaps xmmword [rdi], xmm6
mov r8d, dword [rsp + 0xb4]
lea rdx, str.Sessions_dAppContainerNamedObjects_ls
mov rcx, rdi
mov r9, r14
call fcn.14004ed10
xor esi, esi
lea r12, [rsp + 0x88]
mov qword [r12], rsi
lea rcx, str.NtCreateDirectoryObject
mov rdx, r12
call fcn.140014700
lea rbx, [rsp + 0x50]
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
lea rax, [rsp + 0x40]
movaps xmmword [rax], xmm6
movzx edx, bpl
shl edx, 7
or edx, 0x40
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov rcx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140014530
lea rcx, [rsp + 0x38]
mov qword [rcx], rsi
mov edx, 0xf
mov r8, rbx
call qword [r12]
test eax, eax
js 0x140158615
mov rbx, qword [rsp + 0x38]
cmp qword [r15], rbx
je 0x1401585ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [r15]
inc rax
cmp rax, 2
jae 0x140158620
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1401585b2
mov qword [r15], rbx
call fcn.1400c18d0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rsp + 0xa7], 0
jns 0x1401585d1
mov rcx, qword [rsp + 0x90]
call fcn.1400f0498
test r14, r14
je 0x1401585e9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1401585e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400f32c0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, eax
call fcn.140125460
mov esi, eax
jmp 0x1401585ba
call fcn.1400c18d0
mov rcx, qword [r15]
call fcn.1400def50
mov qword [r15], 0
jmp 0x1401585a0
Function at 0x1401588e0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rax, [rcx + 8]
xorps xmm0, xmm0
movups xmmword [rcx + 8], xmm0
mov qword [rcx], rax
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x18], 0
test rax, rax
je 0x140158948
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x140158953
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140158940
mov qword [rsi + 0x18], rdi
call fcn.1400c18d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400c18d0
mov rcx, qword [rsi + 0x18]
call fcn.1400def50
mov qword [rsi + 0x18], 0
jmp 0x14015892d
Function at 0x14015b150
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r13, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x14015b18a
mov rax, qword [r14]
mov qword [rbx], rax
add qword [r13 + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [r13]
mov rsi, qword [r13 + 8]
mov rax, rsi
sub rax, r15
jbe 0x14015b1e7
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, rsi
sub r15, rax
sub rbx, rsi
je 0x14015b1d6
mov rcx, r15
mov rdx, rsi
mov r8, rbx
call fcn.1400f5740
mov rsi, qword [r13 + 8]
add rbx, r15
mov qword [r13 + 0x10], rbx
lea rax, [rsi + r12*8]
mov qword [r13 + 8], rax
jmp 0x14015b16f
mov rax, rbx
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov edi, 1
cmovne rdi, rcx
mov rax, rdi
shr rax, 0x3d
jne 0x14015b2b3
mov r12, rdi
shr r12, 2
lea rcx, [rdi*8]
call fcn.1400f045c
lea r10, [rax + r12*8]
lea r9, [rax + rdi*8]
mov rcx, rbx
sub rcx, rsi
lea r8, [r10 + rcx]
mov rdx, r10
test rcx, rcx
je 0x14015b286
mov rdx, 0xffffffffffffffff
cmovns rdx, rcx
test rdx, rdx
mov r11d, 1
cmovle r11, rdx
mov rdi, rsi
sub rdi, rbx
cmp rdi, rcx
cmovle rdi, rcx
shr rdi, 3
imul rdi, r11
shl rdi, 3
lea rcx, [rax + r12*8]
xor ebx, ebx
mov rdx, qword [rsi + rbx]
mov qword [rcx + rbx], rdx
add rbx, 8
cmp rdi, rbx
jne 0x14015b272
mov rdx, r8
mov qword [r13], rax
mov qword [r13 + 8], r10
mov qword [r13 + 0x10], rdx
mov qword [r13 + 0x18], r9
mov rbx, rdx
test r15, r15
je 0x14015b16f
mov rcx, r15
call fcn.1400f0498
mov rbx, qword [r13 + 0x10]
jmp 0x14015b16f
call fcn.1400f1940
int3
Function at 0x14015b2c0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov rbp, rcx
mov rdi, qword [rcx + 8]
cmp rdi, qword [rcx]
je 0x14015b2ff
mov r13, rdi
mov rax, qword [r14]
mov qword [r13 - 8], rax
add qword [rbp + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rbp + 0x10]
mov rax, qword [rbp + 0x18]
cmp r15, rax
jae 0x14015b351
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea r13, [r15 + r12*8]
mov r8, r15
sub r8, rdi
je 0x14015b343
sub r13, r8
mov rcx, r13
mov rdx, rdi
call fcn.1400f5740
mov r15, qword [rbp + 0x10]
mov qword [rbp + 8], r13
lea rax, [r15 + r12*8]
mov qword [rbp + 0x10], rax
jmp 0x14015b2e2
sub rax, rdi
mov rcx, rax
sar rcx, 2
test rax, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x14015b418
lea r12, [rbx + 3]
shr r12, 2
lea rcx, [rbx*8]
call fcn.1400f045c
lea r13, [rax + r12*8]
lea r9, [rax + rbx*8]
mov rdx, r15
sub rdx, rdi
lea r8, [rdx + r13]
mov rcx, r13
test rdx, rdx
je 0x14015b3ee
mov rcx, 0xffffffffffffffff
cmovns rcx, rdx
test rcx, rcx
mov r10d, 1
cmovle r10, rcx
mov rbx, rdi
sub rbx, r15
cmp rbx, rdx
cmovle rbx, rdx
shr rbx, 3
imul rbx, r10
shl rbx, 3
lea rdx, [rax + r12*8]
xor ecx, ecx
mov rsi, qword [rdi + rcx]
mov qword [rdx + rcx], rsi
add rcx, 8
cmp rbx, rcx
jne 0x14015b3da
mov rcx, r8
mov qword [rbp], rax
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], r9
test rdi, rdi
je 0x14015b2e2
mov rcx, rdi
call fcn.1400f0498
mov r13, qword [rbp + 8]
jmp 0x14015b2e2
call fcn.1400f1940
int3
Function at 0x14015d700
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
cmp byte [rcx + 0x17], 0
jns 0x14015d72b
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
je 0x14015d757
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400f32c0
mov eax, edi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
ret
test bl, bl
je 0x14015d76c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14015d839
mov ecx, 2
call fcn.1400e8860
test al, al
je 0x14015d832
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x38]
mov r8d, 0x61
mov r9d, 2
call fcn.1401438e0
lea rcx, [rsp + 0x48]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400d6670
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x190]
mov rcx, rsi
call fcn.1400d96e0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14015d806
mov r8, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rcx, rdi
mov rdx, rsi
call fcn.1400d6670
cmp byte [rsp + 0x1a7], 0
jns 0x14015d828
mov rcx, qword [rsp + 0x190]
call fcn.1400f0498
lea rcx, [rsp + 0x38]
call fcn.1401439d0
xor edi, edi
jmp 0x14015d73a
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.14015e1e0
test al, al
jne 0x14015d73a
mov ecx, 2
call fcn.1400e8860
test al, al
je 0x14015d832
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x38]
mov r8d, 0x5c
mov r9d, 2
call fcn.140002b90
lea rdi, [rsp + 0x48]
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x180]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x190]
mov rcx, rsi
call fcn.1400d96e0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14015d8c9
mov r8, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rcx, rdi
mov rdx, rsi
call fcn.1400d6670
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.1400d6670
cmp byte [rsp + 0x1a7], 0
jns 0x14015d900
mov rcx, qword [rsp + 0x190]
call fcn.1400f0498
lea rcx, [rsp + 0x38]
call fcn.14002ed20
jmp 0x14015d832
Function at 0x14015e1e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x14015e20a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14015e248
mov edi, eax
bt eax, 0xa
jae 0x14015e300
test bl, bl
jne 0x14015e300
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400f32c0
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400e8860
test al, al
je 0x14015e229
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x81
mov r9d, 2
call fcn.1401438e0
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400d6670
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.1400d96e0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14015e2d5
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1400d6670
cmp byte [rsp + 0x4f], 0
jns 0x14015e2f1
mov rcx, qword [rsp + 0x38]
call fcn.1400f0498
lea rcx, [rsp + 0x50]
call fcn.1401439d0
jmp 0x14015e229
and edi, 0x10
shr edi, 4
jmp 0x14015e22b

Function at 0x14015f270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x38], rax
movdqu xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x20], xmm0
mov rbx, qword [rcx + 0x38]
mov rax, qword [rcx + 0x40]
mov edi, 1
cmp rbx, rax
je 0x14015f2c4
mov rsi, r8
movdqu xmm0, xmmword [rbx]
pcmpeqb xmm0, xmmword [rsp + 0x20]
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x14015f2db
add rbx, 0x70
cmp rax, rbx
jne 0x14015f2a5
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f32c0
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
cmp rax, rbx
je 0x14015f2c4
cmp byte [rbx + 0x27], 0
jns 0x14015f2ec
mov rcx, qword [rbx + 0x10]
jmp 0x14015f2f0
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov edi, 1
cmovne edi, ecx
test edi, edi
jne 0x14015f2c4
mov qword [rsi], rbx
xor edi, edi
jmp 0x14015f2c4
Function at 0x14015f720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movdqu xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x38]
mov rax, qword [rcx + 0x40]
mov esi, 1
cmp rdi, rax
je 0x14015f779
mov r14, r9
mov rbx, rcx
movdqu xmm0, xmmword [rdi]
pcmpeqb xmm0, xmmword [rsp + 0x20]
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x14015f792
add rdi, 0x70
cmp rax, rdi
jne 0x14015f75a
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400f32c0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp rax, rdi
je 0x14015f779
mov eax, dword [rdi + 0x68]
cmp eax, r8d
jne 0x14015f7ab
cmp byte [rdi + 0x27], 0
jns 0x14015f7ba
mov rcx, qword [rdi + 0x10]
jmp 0x14015f7be
xor ecx, ecx
cmp eax, 1
sete cl
lea esi, [rcx + rcx*2]
inc esi
jmp 0x14015f779
lea rcx, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14015f779
shr eax, 3
and eax, 2
mov esi, eax
jne 0x14015f779
mov byte [rbx + 0x30], 1
mov qword [r14], rdi
xor esi, esi
jmp 0x14015f779

Function at 0x14015fd70
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x14015fd97
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14015fdb2
and eax, 0x410
cmp eax, 0x410
je 0x14015fea5
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14015fdbe
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
je 0x14015fde7
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400f32c0
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400e8860
test al, al
je 0x14015fe9e
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x94
mov r9d, 2
call fcn.1401438e0
lea rcx, [rsp + 0x68]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.1400d6670
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.1400d96e0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14015fe78
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1400d6670
cmp byte [rsp + 0x57], 0
jns 0x14015fe94
mov rcx, qword [rsp + 0x40]
call fcn.1400f0498
lea rcx, [rsp + 0x58]
call fcn.1401439d0
xor edi, edi
jmp 0x14015fdcb
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400f32c0
mov rcx, rsi
add rsp, 0x1a8
pop rdi
pop rsi
jmp fcn.140179360
Function at 0x1401606e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x140160708
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140160738
test eax, 0x410
sete bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400f32c0
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400e8860
test al, al
je 0x1401607ef
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x74
mov r9d, 2
call fcn.1401438e0
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400d6670
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.1400d96e0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401607c9
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1400d6670
cmp byte [rsp + 0x4f], 0
jns 0x1401607e5
mov rcx, qword [rsp + 0x38]
call fcn.1400f0498
lea rcx, [rsp + 0x50]
call fcn.1401439d0
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400f32c0
xor eax, eax
jmp 0x14016072d
Function at 0x140164430
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1402004e8]
test rax, rax
je 0x140164574
cmp eax, 2
jne 0x1401644ac
mov ecx, 2
call fcn.1400e8860
test al, al
je 0x140164544
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x83
mov r9d, 2
call fcn.140002b90
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x140164537
mov eax, 1
lock xadd qword [0x140200520], rax
test rax, rax
jle 0x1401644cc
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1402004a0], eax
mov qword [0x140200498], rsi
mov rcx, qword [0x1401f82e8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.1400e8860
test al, al
je 0x140164544
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0xaf
mov r9d, 2
call fcn.140002b90
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.1400d6670
mov rcx, rsi
call fcn.14002ed20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400f32c0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1402004e8]
test rax, rax
je 0x14016457b
jmp 0x14016445e

Function at 0x140176a50
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140003880
test al, al
je 0x140176a72
mov rcx, qword [rsi]
xor edx, edx
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x20
pop rsi
ret
Function at 0x140179360
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x140179388
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
je 0x1401793b6
test esi, esi
setne bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400f32c0
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400e8860
test al, al
je 0x140179394
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x2f
mov r9d, 2
call fcn.1401438e0
lea rcx, [rsp + 0x60]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1400d6670
mov rbx, rax
movzx eax, byte [rdi + 0x17]
test al, al
mov rcx, qword [rdi]
cmovns rcx, rdi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.1400d96e0
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x140179443
mov r8, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rcx, rbx
mov rdx, rdi
call fcn.1400d6670
cmp byte [rsp + 0x4f], 0
jns 0x14017945f
mov rcx, qword [rsp + 0x38]
call fcn.1400f0498
lea rcx, [rsp + 0x50]
call fcn.1401439d0
jmp 0x140179394