joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400449ad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rbx, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
call fcn.14004fa9e
mov ebp, eax
test rdi, rdi
je 0x1400449e2
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x1400449f7
movzx eax, word [rax]
jmp 0x140044a07
xor r15d, r15d
mov eax, 6
test bpl, bpl
jne 0x140044a91
xor edi, edi
jmp 0x140044a1f
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x1401b4100]
xor r15d, r15d
cmp ax, 0xffff
sete cl
cmove rdi, r15
mov eax, 6
cmp bpl, cl
je 0x140044a91
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x140044a31
movzx ebp, word [rax]
jmp 0x140044a40
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x1401b4100]
mov ebp, eax
mov rax, qword [rbx]
mov rax, qword [rax + 0x18]
mov rcx, rbx
mov dx, 4
mov r8d, ebp
call qword [0x1401b4100]
test al, al
je 0x140044a89
mov rax, qword [rbx]
mov rax, qword [rax + 0x68]
mov rcx, rbx
mov edx, ebp
xor r8d, r8d
call qword [0x1401b4100]
mov ebp, eax
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x140044aa5
add rax, 2
mov qword [rcx + 0x18], rax
jmp 0x140044ab2
xor r15d, r15d
mov eax, 4
or dword [rsi], eax
mov eax, r15d
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1401b4100]
mov r12d, dword [rsp + 0x80]
movsx r15d, bpl
mov rcx, r14
call fcn.14004fa9e
mov ebp, eax
test rdi, rdi
je 0x140044adc
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x140044ae0
movzx eax, word [rax]
jmp 0x140044af0
mov al, 1
jmp 0x140044af9
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x1401b4100]
cmp ax, 0xffff
sete al
jne 0x140044afb
xor edi, edi
add r15d, 0xffffffd0
cmp bpl, al
je 0x140044ba1
cmp r12d, 2
jl 0x140044ba1
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x140044b24
movzx ebp, word [rax]
jmp 0x140044b33
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x1401b4100]
mov ebp, eax
mov rax, qword [rbx]
mov rax, qword [rax + 0x18]
mov rcx, rbx
mov dx, 4
mov r8d, ebp
call qword [0x1401b4100]
test al, al
je 0x140044a93
mov rax, qword [rbx]
mov rax, qword [rax + 0x68]
mov rcx, rbx
mov edx, ebp
xor r8d, r8d
call qword [0x1401b4100]
mov ebp, eax
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x140044b80
add rax, 2
mov qword [rcx + 0x18], rax
jmp 0x140044b8d
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1401b4100]
lea eax, [r15 + r15*4]
movsx ecx, bpl
lea r15d, [rcx + rax*2]
dec r12d
jmp 0x140044abe
mov rcx, r14
call fcn.14004fa9e
mov ebx, eax
test rdi, rdi
je 0x140044bbf
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x140044bd1
movzx eax, word [rax]
jmp 0x140044be1
mov eax, 2
test bl, bl
jne 0x140044a91
jmp 0x140044a93
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x1401b4100]
cmp ax, 0xffff
sete al
xor bl, al
mov eax, 2
je 0x140044a91
jmp 0x140044a93
Function at 0x140053d80
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.14014c950
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.14014ead0
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x38], 0x800
mov rcx, qword [rbx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x3c]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140053e6b
mov eax, dword [rsp + 0x3c]
cmp eax, 2
je 0x140053e1b
mov edi, 0x3f4
cmp eax, 1
jne 0x140053e6b
lea rdx, [rsp + 0x840]
jmp 0x140053e61
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.14014ead0
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x140053e6b
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140050e2a
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14014c9b0
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140053e90
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.14016c344
lea eax, [rax*2 + 2]
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140054340
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r12d, dword [rsp + 0xb0]
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x48], rax
shl ebp, 0x10
mov ecx, 0x18
call fcn.14014b4a8
mov rsi, rax
mov rax, qword [0x1401c35a0]
and rax, r15
cmp rax, qword [0x1401c3588]
jne 0x1400543a5
mov rcx, r15
call fcn.140085c20
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r12d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x140054890]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x1400543ed
test r14, r14
je 0x14005440f
mov qword [r14], rdi
jmp 0x1400544b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0x27a
jg 0x14005441d
cmp ebp, 8
je 0x1400544da
cmp ebp, 0xe
jne 0x140054435
jmp 0x1400544da
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400544b6
cmp ebp, 0x5af
je 0x1400544da
cmp ebp, 0x27b
je 0x1400544da
mov eax, dword [0x1401d3004]
mov ecx, dword [0x1401d0348]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400544e2
lea rcx, [rsp + 0x30]
mov edx, ebp
call fcn.140067ad0
cmp byte [rsp + 0x47], 0
jns 0x14005448e
cmp qword [rsp + 0x38], 0
js 0x14005450c
mov rcx, qword [rsp + 0x30]
je 0x140054489
test rcx, rcx
je 0x14005450f
call fcn.14014b4e4
test rsi, rsi
je 0x1400544b6
mov rcx, qword [rsi]
mov rax, qword [0x1401c35a0]
and rax, rcx
cmp rax, qword [0x1401c3588]
jne 0x1400544ae
call fcn.140085d60
mov rcx, rsi
call fcn.14014b4e4
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014c9b0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rbx
call fcn.140086460
lea rcx, [0x1401d3004]
call fcn.14014b600
cmp dword [0x1401d3004], 0xffffffff
jne 0x14005445a
lea rcx, [0x1401d3004]
call fcn.14014b698
jmp 0x14005445a
int3
int3

Function at 0x140056180
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 8]
test rbx, rbx
je 0x1400561c2
mov rsi, qword [rcx]
mov r14d, 0xffffffff
nop dword [rax + rax]
cmp rbx, r14
mov edi, 0xffffffff
cmovb rdi, rbx
mov rcx, rsi
mov edx, edi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400561cc
add rsi, rdi
sub rbx, rdi
jne 0x1400561a0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3

Function at 0x1400561d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x140056212
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
nop word [rax + rax]
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14005621c
add rdi, rbx
sub rsi, rbx
jne 0x1400561f0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x140056400
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14005642f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140056432
mov rcx, qword [rsi]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140056456
mov dil, 1
test bl, bl
je 0x1400564bd
cmp byte [rsi + 8], 0
je 0x14005649c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14005649f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 0
je 0x14005646d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140056470
mov rcx, qword [rsi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140056483
xor edi, edi
jmp 0x1400564bd
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 0
je 0x1400564ac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400564af
mov rcx, qword [rsi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1400564bd
mov rcx, qword [rsi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14014c9b0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14005bbf0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov esi, r9d
mov rdi, r8
mov r15, rdx
mov r14, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
lea rdx, str.Read
lea r8, str....._base_files_file_win.cc
lea r12, [rsp + 0x40]
mov rcx, r12
mov r9d, 0x42
call fcn.1400763c0
lea rcx, [rsp + 0x60]
xor edx, edx
xor r8d, r8d
call fcn.1400a32f0
mov qword [rsp + 0xa0], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005bd5c
mov ebx, 0xffffffff
test r15, r15
js 0x14005bd1b
test esi, esi
js 0x14005bd1b
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov dword [rsp + 0xa8], 0xaaaaaaaa
mov rcx, qword [r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xa8]
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005bd01
mov ebx, dword [rsp + 0xa8]
test ebx, ebx
jns 0x14005bd11
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
lea rcx, [rsp + 0x30]
call fcn.140093980
mov qword [rsp + 0x30], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005bd92
lea rcx, [rsp + 0x60]
call fcn.1400a3590
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14014c9b0
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movzx ecx, al
mov qword [rsp + 0x30], r12
lea rax, str.ScopedBlockingCall
mov qword [rsp + 0xa8], rax
lea rdx, [rsp + 0xa0]
lea r8, [rsp + 0xa8]
lea r9, [rsp + 0x30]
call fcn.140062630
jmp 0x14005bc8a
movzx ecx, al
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 2
call fcn.140032900
jmp 0x14005bd2f
Function at 0x14005bdc0
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
lea rdx, str.ReadAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x5f
call fcn.1400763c0
lea rcx, [rsp + 0x50]
xor edx, edx
xor r8d, r8d
call fcn.1400a32f0
mov qword [rsp + 0x98], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005bec8
test esi, esi
js 0x14005bf07
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0xa8], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xa8]
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005beab
mov esi, dword [rsp + 0xa8]
test esi, esi
jns 0x14005bebc
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
lea rcx, [rsp + 0x30]
call fcn.140093980
jmp 0x14005bf0c
movzx ecx, al
mov qword [rsp + 0xa8], r14
lea rax, str.ScopedBlockingCall
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0x98]
lea r8, [rsp + 0xa0]
lea r9, [rsp + 0xa8]
call fcn.140062630
test esi, esi
jns 0x14005be54
mov esi, 0xffffffff
mov qword [rsp + 0xa8], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005bf4c
lea rcx, [rsp + 0x50]
call fcn.1400a3590
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14014c9b0
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
movzx ecx, al
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0xa8]
lea r8, [rsp + 0x30]
mov r9d, 2
call fcn.140032900
jmp 0x14005bf23
Function at 0x14005bf80
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov esi, r9d
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
lea rdx, str.Write
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x7f
call fcn.1400763c0
lea rcx, [rsp + 0x60]
xor edx, edx
xor r8d, r8d
call fcn.1400a32f0
mov qword [rsp + 0xa0], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005c0d0
mov ebp, 0xffffffff
test r14, r14
js 0x14005c090
test esi, esi
js 0x14005c090
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov dword [rsp + 0xa8], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xa8]
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor ebp, ebp
cmp eax, 1
sbb ebp, ebp
or ebp, dword [rsp + 0xa8]
lea rcx, [rsp + 0x30]
call fcn.140093980
mov qword [rsp + 0x30], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005c106
lea rcx, [rsp + 0x60]
call fcn.1400a3590
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14014c9b0
mov eax, ebp
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
movzx ecx, al
mov qword [rsp + 0x30], r15
lea rax, str.ScopedBlockingCall
mov qword [rsp + 0xa8], rax
lea rdx, [rsp + 0xa0]
lea r8, [rsp + 0xa8]
lea r9, [rsp + 0x30]
call fcn.140062630
jmp 0x14005c019
movzx ecx, al
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 2
call fcn.140032900
jmp 0x14005c0a4
Function at 0x14005c130
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x97
call fcn.1400763c0
lea rcx, [rsp + 0x50]
xor edx, edx
xor r8d, r8d
call fcn.1400a32f0
mov qword [rsp + 0x98], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005c221
test esi, esi
js 0x14005c260
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0xa8], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xa8]
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0xa8]
lea rcx, [rsp + 0x30]
call fcn.140093980
jmp 0x14005c265
movzx ecx, al
mov qword [rsp + 0xa8], r14
lea rax, str.ScopedBlockingCall
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0x98]
lea r8, [rsp + 0xa0]
lea r9, [rsp + 0xa8]
call fcn.140062630
test esi, esi
jns 0x14005c1c4
mov esi, 0xffffffff
mov qword [rsp + 0xa8], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005c2a5
lea rcx, [rsp + 0x50]
call fcn.1400a3590
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14014c9b0
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
movzx ecx, al
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0xa8]
lea r8, [rsp + 0x30]
mov r9d, 2
call fcn.140032900
jmp 0x14005c27c
Function at 0x14005c2d0
Capabilities:
Get file size

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0xac
call fcn.1400763c0
lea rcx, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
call fcn.1400a32f0
mov qword [rsp + 0x80], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005c3e4
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x90], rax
mov rcx, qword [rsi]
lea rdx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov esi, eax
mov rbx, qword [rsp + 0x90]
lea rcx, [rsp + 0x20]
call fcn.140093980
mov qword [rsp + 0x90], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005c420
xor edi, edi
cmp esi, 1
sbb rdi, rdi
or rdi, rbx
lea rcx, [rsp + 0x40]
call fcn.1400a3590
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14014c9b0
mov rax, rdi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movzx ecx, al
mov qword [rsp + 0x90], rdi
lea rax, str.ScopedBlockingCall
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x80]
lea r8, [rsp + 0x88]
lea r9, [rsp + 0x90]
call fcn.140062630
jmp 0x14005c355
movzx ecx, al
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x90]
lea r8, [rsp + 0x20]
mov r9d, 2
call fcn.140032900
jmp 0x14005c3b1
Function at 0x14005d030
Capabilities:
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x20c
call fcn.1400763c0
lea rcx, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
call fcn.1400a32f0
mov qword [rsp + 0x80], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005d109
cmp byte [rsi + 0x17], 0
jns 0x14005d0ba
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov qword [rsp + 0x90], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005d14f
cmp esi, 0xffffffff
setne bl
lea rcx, [rsp + 0x40]
call fcn.1400a3590
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14014c9b0
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
movzx ecx, al
mov qword [rsp + 0x90], rdi
lea rax, str.ScopedBlockingCall
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x80]
lea r8, [rsp + 0x88]
lea r9, [rsp + 0x90]
call fcn.140062630
cmp byte [rsi + 0x17], 0
js 0x14005d0b7
jmp 0x14005d0ba
movzx ecx, al
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x90]
lea r8, [rsp + 0x20]
mov r9d, 2
call fcn.140032900
jmp 0x14005d0dc
Function at 0x14005d180
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r9d, 0x215
call fcn.1400763c0
lea rcx, [rsp + 0x60]
xor edx, edx
xor r8d, r8d
call fcn.1400a32f0
mov qword [rsp + 0xa0], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005d2f1
cmp byte [rsi + 0x17], 0
jns 0x14005d214
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005d287
test al, 0x10
mov eax, 0x40000000
mov edx, 2
cmove edx, eax
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
xor edi, edi
mov rcx, rsi
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x14005d295
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp rbx, 0xffffffffffffffff
je 0x14005d28b
call fcn.1400763e0
mov rdi, rbx
jmp 0x14005d28d
xor esi, esi
jmp 0x14005d2b3
xor edi, edi
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
setne sil
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14005d2b3
call fcn.1400763e0
mov rcx, rdi
call fcn.140053b80
mov qword [rsp + 0xb0], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005d337
lea rcx, [rsp + 0x60]
call fcn.1400a3590
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.14014c9b0
mov eax, esi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
movzx ecx, al
mov qword [rsp + 0xb0], rdi
lea rax, str.ScopedBlockingCall
mov qword [rsp + 0xa8], rax
lea rdx, [rsp + 0xa0]
lea r8, [rsp + 0xa8]
lea r9, [rsp + 0xb0]
call fcn.140062630
cmp byte [rsi + 0x17], 0
js 0x14005d211
jmp 0x14005d214
movzx ecx, al
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0xb0]
lea r8, [rsp + 0x40]
mov r9d, 2
call fcn.140032900
jmp 0x14005d2ca
Function at 0x14005d360
Capabilities:
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rdx, str.DirectoryExists
lea r8, str....._base_files_file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x234
call fcn.1400763c0
lea rcx, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
call fcn.1400a32f0
mov qword [rsp + 0x88], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005d440
cmp byte [rsi + 0x17], 0
jns 0x14005d3e9
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov qword [rsp + 0x98], 0xa
movzx eax, byte [0x1401d2e3a]
test al, al
jne 0x14005d486
cmp esi, 0xffffffff
setne al
and esi, 0x10
shr esi, 4
and sil, al
lea rcx, [rsp + 0x40]
call fcn.1400a3590
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14014c9b0
mov eax, esi
add rsp, 0xa8
pop rdi
pop rsi
ret
movzx ecx, al
mov qword [rsp + 0x98], rdi
lea rax, str.ScopedBlockingCall
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x88]
lea r8, [rsp + 0x90]
lea r9, [rsp + 0x98]
call fcn.140062630
cmp byte [rsi + 0x17], 0
js 0x14005d3e6
jmp 0x14005d3e9
movzx ecx, al
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x98]
lea r8, [rsp + 0x20]
mov r9d, 2
call fcn.140032900
jmp 0x14005d40b

Function at 0x14005d4b0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.14014ead0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14005d56b
mov qword [rsp + 0x20], rbx
mov rcx, rbx
call fcn.14016c344
mov qword [rsp + 0x28], rax
lea rbx, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400784a0
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14007b1e0
cmp byte [rsi + 0x17], 0
jns 0x14005d53d
mov rcx, qword [rsi]
call fcn.14014b4e4
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi], xmm0
mov byte [rsp + 0x5f], 0
mov word [rsp + 0x48], 0
cmp byte [rsp + 0x47], 0
jns 0x14005d56b
mov rcx, qword [rsp + 0x30]
call fcn.14014b4e4
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.14014c9b0
mov eax, ebx
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret