joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052770
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140189b30
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140052818
cmp word [rsp + 0x70], 0
je 0x140052818
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.140185998
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.14010c090
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.1401879f0
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
jmp 0x1400527e7
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.140056880
test al, al
jne 0x140052805
lea rax, [0x14027c3e4]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.14010c090
cmp byte [rsp + 0x57], 0
jns 0x1400527e7
mov rcx, qword [rsp + 0x40]
call fcn.140184dbc
jmp 0x1400527e7

Function at 0x140052f10
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x140052f37
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140052f71
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140052f90
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401879f0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.140053070
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401879f0
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
cmp dword [0x1402b75e0], 2
jg 0x14005305d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x266
mov r9d, 2
call fcn.1401fa650
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1401c2dd0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x140052fef
mov rax, qword [rsi + 8]
mov rsi, qword [rsi]
jmp 0x140052ff2
and eax, 0x7f
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
test rax, rax
js 0x140053064
test rsi, rsi
jne 0x14005300b
test rax, rax
jne 0x140053067
lea rsi, [rsp + 0x38]
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1401482e0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14005302d
and r8d, 0x7f
jmp 0x140053037
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1401c2dd0
cmp byte [rsp + 0x4f], 0
jns 0x140053053
mov rcx, qword [rsp + 0x38]
call fcn.140184dbc
lea rcx, [rsp + 0x50]
call fcn.1401fa6d0
xor esi, esi
jmp 0x140052f74
int3
int3
Function at 0x140053070
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x1a8
mov rsi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
cmp byte [rcx + 0x17], 0
jns 0x140053097
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400530c9
mov dil, 1
test al, 0x10
je 0x1400531a5
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401879f0
mov eax, edi
add rsp, 0x1a8
pop rdi
pop rsi
ret
cmp dword [0x1402b75e0], 2
jg 0x14005319e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x251
mov r9d, 2
call fcn.1401fa650
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401c2dd0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
js 0x140053124
and eax, 0x7f
jmp 0x14005312b
mov rax, qword [rsi + 8]
mov rsi, qword [rsi]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rax
test rax, rax
js 0x14005327e
test rsi, rsi
jne 0x14005314c
test rax, rax
jne 0x140053284
lea rsi, [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1401482e0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14005316e
and r8d, 0x7f
jmp 0x140053178
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.1401c2dd0
cmp byte [rsp + 0x5f], 0
jns 0x140053194
mov rcx, qword [rsp + 0x48]
call fcn.140184dbc
lea rcx, [rsp + 0x60]
call fcn.1401fa6d0
xor edi, edi
jmp 0x1400530ad
cmp dword [0x1402b75e0], 2
jg 0x14005319e
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x255
mov r9d, 2
call fcn.1400078c0
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1401c2dd0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
js 0x1400531f2
and eax, 0x7f
jmp 0x1400531f9
mov rax, qword [rsi + 8]
mov rsi, qword [rsi]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
test rax, rax
js 0x140053281
test rsi, rsi
jne 0x140053212
test rax, rax
jne 0x140053287
lea rsi, [rsp + 0x48]
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1401482e0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14005323a
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
jmp 0x14005323e
and r8d, 0x7f
mov rcx, rdi
mov rdx, rsi
call fcn.1401c2dd0
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1401c2dd0
cmp byte [rsp + 0x5f], 0
jns 0x14005326f
mov rcx, qword [rsp + 0x48]
call fcn.140184dbc
lea rcx, [rsp + 0x60]
call fcn.1400079b0
jmp 0x14005319e
int3
int3
int3
int3
Function at 0x140056880
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.140189b30
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x140056935
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.140185998
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.14010c090
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140056970
cmp byte [rsi + 0x17], 0
js 0x14005695d
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x5f], 0
mov word [rsp + 0x48], 0
cmp byte [rsp + 0x47], 0
jns 0x140056935
mov rcx, qword [rsp + 0x30]
call fcn.140184dbc
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401879f0
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [rsi]
call fcn.140184dbc
jmp 0x140056907
Function at 0x1400584e0
Capabilities:
Clear file content

Disassembly:
push rsi
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x178], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r8, [rsp + 0x170]
mov qword [r8], rax
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140058557
cmp qword [rsp + 0x170], 0
jne 0x1400585a8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x1400585ac
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1401879f0
mov eax, esi
add rsp, 0x180
pop rsi
ret
cmp dword [0x1402b75e0], 2
jg 0x1400585a8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xf1
mov r9d, 2
call fcn.1401fa650
lea rcx, [rsp + 0x40]
lea rdx, [0x140288bda]
mov r8d, 0x10
call fcn.1401c2dd0
mov rcx, rsi
call fcn.1401fa6d0
xor esi, esi
jmp 0x14005853c
cmp dword [0x1402b75e0], 2
jg 0x1400585a8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfb
mov r9d, 2
call fcn.1401fa650
lea rcx, [rsp + 0x40]
lea rdx, [0x140288beb]
mov r8d, 0xc
jmp 0x14005859b

Function at 0x140059c70
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov sil, 1
test r8, r8
je 0x140059cfa
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov r12d, 0xffffffff
lea r15, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, r12
mov r8d, 0xffffffff
cmovb r8, rdi
mov dword [rsp + 0x28], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rbx
mov r9, r15
call r13
test eax, eax
je 0x140059d1f
mov eax, dword [rsp + 0x28]
cmp rax, r12
je 0x140059d74
add rbx, rax
sub rdi, rax
jne 0x140059cb7
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1401879f0
mov eax, esi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [0x1402b75e0], 2
jg 0x140059d70
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x8c
mov r9d, 2
call fcn.1401fa650
lea rcx, [rsp + 0x38]
lea rdx, [0x140288c54]
mov r8d, 9
call fcn.1401c2dd0
mov rcx, rsi
call fcn.1401fa6d0
xor esi, esi
jmp 0x140059cfa
int3
Function at 0x140061320
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.140061da0
mov rax, qword [rsi]
test rax, rax
je 0x140061397
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14006139e
lea rcx, [rsp + 0x28]
call fcn.140061400
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401879f0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140061370
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
je 0x1400613b6
add rbx, 0x70
cmp rbx, r15
je 0x140061370
jmp 0x1400613a5
cmp byte [rbx + 0x27], 0
js 0x1400613c2
lea rcx, [rbx + 0x10]
jmp 0x1400613c6
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
jne 0x1400613ab
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
je 0x1400613ec
mov rcx, r14
mov rdx, rbx
call fcn.1400c2790
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x1400613ab
mov rcx, rdi
mov rdx, rbx
call fcn.1400c2570
jmp 0x1400613ab
Function at 0x140065130
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rcx], 0
mov byte [rcx + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x14006523b
lea rdi, [rsi + 0x10]
lea rdx, [0x1402744c9]
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.1401c4780
mov rcx, rdi
mov rdx, rbx
call fcn.140065240
cmp byte [rbx + 0x17], 0
js 0x14006522c
mov dword [rsi + 0x90], 0x103
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x98], 0
test rax, rax
je 0x1400651f6
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x98]
inc rax
cmp rax, 2
jae 0x14006520e
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400651ee
mov qword [rsi + 0x98], rdi
call fcn.1400eba00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401879f0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.1400eba00
mov rcx, qword [rsi + 0x98]
call fcn.1401692a0
mov qword [rsi + 0x98], 0
jmp 0x1400651d8
mov rcx, qword [rsp + 0x20]
call fcn.140184dbc
jmp 0x140065190
int3
Function at 0x140065fe0
Capabilities:
Check if file exists
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rax, qword [rcx + 8]
mov r14d, 8
inc rax
cmp rax, 1
ja 0x140066161
mov rdi, rcx
cmp qword [rcx + 0x18], 0
jne 0x140066161
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov r14, rax
cmp qword [rdi + 8], rax
je 0x14006606e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi + 8]
inc rax
cmp rax, 2
jae 0x140066182
mov rax, r14
inc rax
cmp rax, 2
jb 0x140066062
mov qword [rdi + 8], r14
call fcn.1400eba00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14006623c
movabs r12, 0xfffffffc00000000
mov ecx, 0x20
call fcn.140184dc4
mov r15, rax
mov qword [rax], rax
mov qword [rax + 8], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov ecx, 0x18
call fcn.140184dc4
mov rbx, rax
mov rax, qword [rsi]
mov qword [rsi], 0
mov qword [rbx], r14
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r15
mov rcx, qword [rdi + 0x18]
mov rax, rcx
and rax, r12
cmp rax, qword [0x14029ce48]
je 0x1400661b5
mov rax, r15
and rax, r12
cmp rax, qword [0x14029ce48]
je 0x1400661bf
mov qword [rdi + 0x18], r15
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400c0fc0]
xor r14d, r14d
xor ecx, ecx
xor edx, edx
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
cmp qword [rdi + 0x10], rax
je 0x140066158
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rdi + 0x10]
inc rax
cmp rax, 2
jae 0x14006619d
mov rax, r15
inc rax
cmp rax, 2
jb 0x14006614c
mov qword [rdi + 0x10], r15
call fcn.1400eba00
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rdi + 0x10]
inc r15
cmp r15, 1
jbe 0x1400661e0
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
jne 0x1400661cc
mov eax, r14d
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400eba00
mov rcx, qword [rdi + 8]
call fcn.1401692a0
mov qword [rdi + 8], 0
jmp 0x14006604d
call fcn.1400eba00
mov rcx, qword [rdi + 0x10]
call fcn.1401692a0
mov qword [rdi + 0x10], 0
jmp 0x140066137
call fcn.1400e1670
jmp 0x1400660da
mov rcx, r15
call fcn.1400ddc60
jmp 0x1400660ed
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [0x1402ca008]
jmp 0x140066170
mov rcx, qword [rdi + 0x18]
and r12, rcx
cmp r12, qword [0x14029ce48]
jne 0x1400661f5
call fcn.1400e1670
mov qword [rdi + 0x18], 0
test rbx, rbx
je 0x14006623c
mov rdi, qword [rbx + 0x10]
mov qword [rbx + 0x10], 0
test rdi, rdi
je 0x140066223
mov rcx, rdi
call fcn.1400ce390
mov rcx, rdi
call fcn.140184dbc
mov rcx, qword [rbx + 8]
mov qword [rbx + 8], 0
test rcx, rcx
jne 0x140066247
mov rcx, rbx
call fcn.140184dbc
mov r14d, 0x3b
jmp 0x140066161
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov edx, 1
call qword [0x1402ca008]
jmp 0x140066234
Function at 0x140069d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x140069da2
mov dl, byte [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x1402ca008]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rsi], rdi
jmp 0x140069d8d
mov rax, qword [r9 + 0x30]
lea rbx, [rbp - 0x20]
mov qword [rbx], rax
mov qword [rbp - 8], rax
lock inc dword [rax + 8]
lea rdx, [0x1402b62d0]
mov rcx, rbx
call fcn.140165a20
mov r14, rax
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140069dea
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1402ca008]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [0x14026dc70]
movaps xmmword [rbp - 0x20], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [0x1402ca008]
mov al, byte [rbp - 9]
test al, al
mov rcx, qword [rbp - 0x20]
cmovs rbx, rcx
jmp 0x140069e52
movzx edx, al
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [0x1402ca008]
cmp eax, 0xffffffff
jne 0x140069e48
xor edi, edi
inc rbx
mov al, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
test al, al
js 0x140069e86
movzx eax, al
add rax, rbp
add rax, 0xffffffffffffffe0
cmp rbx, rax
je 0x140069d9d
test rdi, rdi
je 0x140069e46
mov al, byte [rbx]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x140069e2e
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
jmp 0x140069e48
mov rax, qword [rbp - 0x18]
add rax, rcx
cmp rbx, rax
jne 0x140069e69
mov qword [rsi], rdi
call fcn.140184dbc
jmp 0x140069d8d
Function at 0x1400709a0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x1400709e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140070a05
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400709e1
mov qword [rsi], rdi
call fcn.1400eba00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140070a77
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400eba00
mov r14, qword [rsi]
cmp qword [0x1402b7720], 0
je 0x140070a36
mov rcx, qword [0x1402b7720]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [0x1402ca008]
mov qword [rsi], 0
jmp 0x1400709cf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetHandleVerifier
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140070a7a
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140070a71
call qword [0x1402ca008]
mov rcx, rax
xor edx, edx
call fcn.14003b860
jmp 0x140070a17
xor ecx, ecx
mov dl, 1
jmp 0x140070a6a
int3
xor ecx, ecx
jmp 0x140070a68
Function at 0x140070e20
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rsi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x60]
mov qword [rbx + 0x40], rax
movaps xmm0, xmmword [0x14026dc70]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DoDeleteFile
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r9d, 0x104
call fcn.1400ee990
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.140123200
movzx eax, byte [rsi + 0x17]
mov edx, eax
and edx, 0x7f
test al, al
mov rcx, qword [rsi + 8]
cmovs rdx, rcx
test rdx, rdx
je 0x140070f68
test al, al
jns 0x140070ec4
cmp rcx, 0x103
ja 0x140070fd6
mov rcx, rsi
mov rdx, rdi
call fcn.140149910
movzx eax, byte [rsp + 0x57]
mov edx, eax
and edx, 0x7f
test al, al
cmovs rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmovs rdi, rcx
test rdx, rdx
je 0x140070fc4
lea r8, [rdi + rdx*2]
add rdx, rdx
mov r9, rdi
movzx r10d, word [r9]
cmp r10d, 0x2a
je 0x140070f1a
cmp r10d, 0x3f
je 0x140070f1a
add r9, 2
add rdx, 0xfffffffffffffffe
jne 0x140070efd
mov r9, r8
cmp r9, r8
sete dl
sub r9, rdi
cmp r9, 0xfffffffffffffffe
sete bl
or bl, dl
test al, al
jns 0x140070f35
call fcn.140184dbc
test bl, bl
je 0x140070ff1
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140070f49
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140070f92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
and eax, 0xfffffffe
cmp eax, 2
jne 0x14007103f
lea rcx, [rsp + 0x60]
call fcn.1400dee50
mov dil, 1
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401879f0
mov eax, edi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
mov edi, eax
test dil, 1
jne 0x140071056
cmp byte [rsi + 0x17], 0
jns 0x140070fa7
mov rsi, qword [rsi]
mov rcx, rsi
test dil, 0x10
je 0x140070fbc
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140070f68
jmp 0x140070f54
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140070fb6
test al, al
jns 0x140070f3d
call fcn.140184dbc
jmp 0x140070f3d
lea rcx, [rsp + 0x60]
call fcn.1400dee50
mov esi, 0xa1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x140070f75
lea rdi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rdi
call fcn.140149910
lea rbx, [rsp + 0x28]
mov rcx, rsi
mov rdx, rbx
call fcn.140149d80
mov rcx, rbx
mov rdx, rdi
call fcn.140025320
mov esi, eax
cmp byte [rbx + 0x17], 0
jns 0x14007102e
mov rcx, qword [rsp + 0x28]
call fcn.140184dbc
cmp byte [rsp + 0x57], 0
jns 0x14007103f
mov rcx, qword [rsp + 0x40]
call fcn.140184dbc
lea rcx, [rsp + 0x60]
call fcn.1400dee50
mov dil, 1
test esi, esi
je 0x140070f75
jmp 0x140070fe5
mov edx, edi
and edx, 0xfffffffe
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140071067
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140070f9e
jmp 0x140070f54
Function at 0x140071080
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x40], rax
movaps xmm0, xmmword [0x14026dc70]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x209
call fcn.1400ee990
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140123200
cmp byte [rdi + 0x17], 0
jns 0x140071100
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.1400dee50
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1401879f0
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x140071140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rbx, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x40], rax
movaps xmm0, xmmword [0x14026dc70]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x40]
mov rcx, r14
mov r9d, 0x212
call fcn.1400ee990
xor esi, esi
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.140123200
cmp byte [rbx + 0x17], 0
jns 0x1400711c4
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140071277
test al, 0x10
mov eax, 0x40000000
mov edx, 2
cmove edx, eax
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
xor edi, edi
mov rcx, rbx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x140071241
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp rbx, 0xffffffffffffffff
je 0x1400712a0
call fcn.1400eba00
mov rdi, rbx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
setne sil
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140071277
call fcn.1400eba00
cmp qword [0x1402b7720], 0
je 0x1400712a4
mov rcx, qword [0x1402b7720]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [0x1402ca008]
lea rcx, [rsp + 0x60]
call fcn.1400dee50
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401879f0
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
xor edi, edi
jmp 0x140071239
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetHandleVerifier
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400712e5
lea rcx, [sym.chrome.exe_GetHandleVerifier]
cmp rax, rcx
je 0x1400712df
call qword [0x1402ca008]
mov rcx, rax
xor edx, edx
call fcn.14003b860
jmp 0x140071261
xor ecx, ecx
mov dl, 1
jmp 0x1400712d8
xor ecx, ecx
jmp 0x1400712d6