joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140050790
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r15d, r9d
mov r12, r8
mov ebx, edx
mov rdi, rcx
mov r13d, dword [rcx + 8]
mov ebp, dword [rcx + 0x18]
add ebp, dword [rcx + 0x14]
add ebp, dword [rcx + 0x1c]
mov rcx, rbp
call fcn.14016de40
test rax, rax
je 0x1400507f4
mov r14, rax
add r13, r12
mov rsi, rax
test ebp, ebp
je 0x1400507fb
mov ecx, ebx
mov rdx, rsi
mov r8d, ebp
call fcn.1401d30ac
test eax, eax
js 0x140050816
sub ebp, eax
mov ecx, eax
add rsi, rcx
test eax, eax
jne 0x1400507ce
test ebp, ebp
je 0x1400507ce
jmp 0x14005080f
mov ebx, 1
jmp 0x140050823
mov eax, dword [rdi + 0x14]
imul ecx, eax, 0xaaaaaaab
ror ecx, 2
cmp ecx, 0x15555555
jbe 0x140050836
mov ebx, 8
jmp 0x14005081b
mov ebx, 6
mov rcx, r14
call fcn.14016dea0
mov eax, ebx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test rax, rax
je 0x140050974
mov dword [rsp + 0x24], r15d
mov rbp, r14
add rbp, rax
mov eax, dword [rdi + 0x18]
mov ecx, dword [rdi + 0x1c]
add rax, rbp
add rcx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
mov rdi, rax
mov qword [rsp + 0x28], rbp
mov r15, r12
mov r12, r14
mov qword [rsp + 0x30], r15
mov ecx, dword [r12]
mov rsi, qword [sym.imp.WS2_32.dll_ntohl]
call rsi
mov dword [r12], eax
mov ecx, dword [r12 + 4]
call rsi
mov dword [r12 + 4], eax
mov ecx, dword [r12 + 8]
call rsi
mov dword [r12 + 8], eax
mov eax, dword [r12]
mov rcx, r13
sub rcx, r15
cmp rcx, rax
jb 0x14005080f
mov rcx, qword [rsp + 0x40]
sub rcx, rbp
cmp rcx, rax
jb 0x14005080f
test eax, eax
je 0x1400508dc
xor eax, eax
mov cl, byte [r15 + rax]
add byte [rbp + rax], cl
inc rax
mov r8d, dword [r12]
cmp rax, r8
jb 0x1400508c6
jmp 0x1400508df
xor r8d, r8d
mov ecx, dword [rsp + 0x24]
mov rdx, rbp
call fcn.1401d7e2c
mov ebx, 7
cmp eax, dword [r12]
jne 0x14005081b
mov esi, eax
mov r8d, dword [r12 + 4]
mov rax, qword [rsp + 0x38]
sub rax, rdi
cmp rax, r8
jb 0x14005080f
mov ecx, dword [rsp + 0x24]
mov rdx, rdi
call fcn.1401d7e2c
cmp eax, dword [r12 + 4]
jne 0x14005081b
mov edx, esi
add r15, rdx
movsxd rcx, dword [r12 + 8]
mov rbx, qword [rsp + 0x30]
sub rbx, r15
cmp rbx, rcx
jg 0x14005080f
mov rbx, r13
sub rbx, r15
cmp rbx, rcx
jl 0x14005080f
add rbp, rdx
mov eax, eax
add rdi, rax
add r15, rcx
add r12, 0xc
xor ebx, ebx
cmp r12, qword [rsp + 0x28]
jb 0x140050873
jmp 0x14005081b
xor ebx, ebx
jmp 0x14005081b
Function at 0x140050980
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov r15, r8
mov rbp, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rbx, [rsp + 0x30]
mov dword [rbx], 0xaaaaaaaa
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
xor esi, esi
mov rcx, rdx
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.1401d3e3c
neg eax
sbb esi, esi
or esi, dword [rbx]
js 0x140050a1e
movaps xmm6, xmmword [0x14032f5c0]
lea rdx, [rsp + 0x70]
movaps xmmword [rdx + 0x10], xmm6
movaps xmmword [rdx], xmm6
mov ecx, esi
call fcn.1400506a0
mov r12d, 0xffffffff
xor r14d, r14d
test eax, eax
je 0x140050a28
mov edi, eax
mov ebx, 0xffffffff
jmp 0x140050b5c
mov edi, 6
jmp 0x140050b83
mov dword [rsp + 0x30], 0xaaaaaaaa
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
mov rcx, rbp
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.1401d3e3c
mov ebx, dword [rsp + 0x30]
neg eax
mov ebp, 0
sbb ebp, ebp
or ebp, ebx
js 0x140050b44
lea rdx, [rsp + 0x30]
movaps xmmword [rdx + 0x20], xmm6
movaps xmmword [rdx + 0x10], xmm6
movaps xmmword [rdx], xmm6
mov ecx, ebp
call fcn.1401d0c08
mov r12d, 0xffffffff
mov edi, 6
test eax, eax
jne 0x140050b59
mov r13d, dword [rsp + 0x44]
cmp r13d, dword [rsp + 0x78]
jne 0x140050b4d
mov rcx, r13
call fcn.14016de40
test rax, rax
je 0x140050b54
mov r14, rax
mov ecx, ebp
mov rdx, rax
mov r8d, r13d
call fcn.1401d30ac
cmp eax, dword [rsp + 0x78]
jne 0x140050b5c
mov ebp, eax
call fcn.140254de0
movsxd rdx, ebp
mov rcx, r14
call fcn.140254db0
not eax
cmp dword [rsp + 0x7c], eax
jne 0x140050bb1
lea r12, [rsp + 0x6c]
mov dword [r12], 0xaaaaaaaa
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], 0
xor ebp, ebp
mov rcx, r15
mov edx, 0x8301
mov r8d, 0x40
xor r9d, r9d
call fcn.1401d3e3c
mov r12d, dword [r12]
neg eax
sbb ebp, ebp
or ebp, r12d
js 0x140050bb8
lea rcx, [rsp + 0x70]
mov edx, esi
mov r8, r14
mov r9d, ebp
call fcn.140050790
mov edi, eax
jmp 0x140050b5c
mov edi, 6
mov ebx, ebp
jmp 0x140050b5c
mov edi, 8
jmp 0x140050b59
mov edi, 1
xor r14d, r14d
mov rcx, r14
call fcn.14016dea0
mov ecx, esi
call fcn.1401cda74
test ebx, ebx
js 0x140050b76
mov ecx, ebx
call fcn.1401cda74
test r12d, r12d
js 0x140050b83
mov ecx, r12d
call fcn.1401cda74
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, edi
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 4
jmp 0x140050b5c
mov r12d, ebp
jmp 0x140050b5c
Function at 0x140054d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov bl, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x140054d5a
mov dl, byte [rbp + 0x60]
movzx ebx, bl
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], ebx
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x1403de008]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea r14, [rbp - 0x20]
mov rcx, r9
mov rdx, r14
call fcn.14015b5c0
lea rdx, [0x1403b3b50]
mov rcx, r14
call fcn.14015b850
mov r14, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140054d9a
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1403de008]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rbp - 0x20]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x14032f5c0]
movaps xmmword [r15], xmm0
mov rax, qword [r14]
xor bl, 1
movzx ecx, bl
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, r15
call qword [0x1403de008]
movzx r9d, byte [r15 + 0x17]
mov ebx, r9d
and ebx, 0x7f
test r9b, r9b
mov rcx, qword [r15]
mov r8, qword [r15 + 8]
cmovs rbx, r8
test rbx, rbx
je 0x140054e69
test r9b, r9b
mov rbx, r15
cmovs rbx, rcx
test rdi, rdi
je 0x140054e4e
mov al, byte [rbx]
movzx eax, al
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x140054e52
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
cmp eax, 0xffffffff
jne 0x140054e1e
xor edi, edi
mov r9b, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
inc rbx
mov edx, r9d
and dl, 0x7f
test r9b, r9b
mov rax, r15
cmovs rax, rcx
movzx edx, dl
cmovs rdx, r8
add rdx, rax
cmp rbx, rdx
jne 0x140054df9
jmp 0x140054e69
xor edi, edi
jmp 0x140054e2a
mov rcx, qword [rdi]
mov r8, qword [rcx + 0x60]
mov rcx, rdi
mov edx, eax
mov rax, r8
call qword [0x1403de008]
jmp 0x140054e17
shr r9b, 7
mov qword [rsi], rdi
test r9b, r9b
je 0x140054d4a
call fcn.1401b9ce8
jmp 0x140054d4a
Function at 0x140069600
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rcx], rax
mov rbp, qword [rdx]
mov qword [rdx], rax
lea rdi, [rbp + 1]
cmp rdi, 2
jb 0x14006963e
call fcn.140160650
cmp qword [rsi], rbp
je 0x140069673
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14006972a
cmp rdi, 2
jb 0x14006966a
mov qword [rsi], rbp
call fcn.140160650
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi + 8], 0xffffffffffffffff
lea r15, [rsi + 0x10]
xor eax, eax
mov qword [rsp + 0x28], rax
mov rdi, qword [r14]
mov qword [r14], rax
cmp rdi, 0xffffffffffffffff
je 0x14006969c
test rdi, rdi
je 0x1400696c0
call fcn.140160650
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400696b8
mov qword [rsp + 0x28], rdi
call fcn.140160650
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x28]
mov rcx, r15
call fcn.1402862b0
mov rax, qword [rbx]
inc rax
cmp rax, 2
jb 0x1400696ed
call fcn.140160650
mov rcx, qword [rbx]
call fcn.14016ddf0
mov qword [rbx], 0
mov rax, qword [r14]
inc rax
cmp rax, 2
jb 0x14006970d
call fcn.140160650
mov rcx, qword [r14]
call fcn.14016ddf0
mov qword [r14], 0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401bb0d0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140160650
mov rcx, qword [rsi]
call fcn.14016ddf0
mov qword [rsi], 0
jmp 0x14006965c
Function at 0x14006c250
Capabilities:
Get session information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x14006c331
lea r9, [rsp + 0x40]
mov qword [r9], 0
lea rcx, [rsp + 0x3c]
mov dword [rcx], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov edx, eax
mov r8d, 0x18
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x14006c331
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
mov rdi, qword [rsp + 0x40]
mov rax, qword [0x1403a3660]
and rax, rdi
cmp rax, qword [0x1403a3648]
jne 0x14006c2da
mov rcx, rdi
call fcn.1401616b0
mov ecx, 0x30
call fcn.1401b9cac
mov rbx, rax
lea rdx, [0x14006d310]
lea r8, [0x1400470b0]
mov rcx, rax
call fcn.14015d680
lea rax, [0x1402fd060]
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rdi
lea rdx, [rsp + 0x28]
mov qword [rdx], rbx
lea rcx, [rsp + 0x30]
call fcn.14015d5f0
cmp dword [rsp + 0x3c], 0xd7
ja 0x14006c33a
mov qword [rsi], 0
jmp 0x14006c34e
mov qword [rsi], 0
jmp 0x14006c358
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0xc8]
mov rcx, rsi
call fcn.140088ca0
lea rcx, [rsp + 0x30]
call fcn.14015d620
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401bb0d0
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140070880
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1403b48b8]
test rdi, rdi
jne 0x140070923
mov ecx, 0x48
call fcn.1401b9cac
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.1401b9cac
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
lea rax, [rsi + 0x30]
movups xmmword [rsi + 0x30], xmm6
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], 1
mov qword [0x1403b48b8], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140070945
mov rcx, rax
call fcn.1401e2874
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.140070950
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
int3
Function at 0x140070950
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.140085060
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
cmp qword [rsi + 8], 0
je 0x140070b39
movups xmm0, xmmword [rsi]
movups xmmword [rbx], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, [0x140338518]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov qword [rsp + 0x20], rax
je 0x140070b8e
lea rdx, [0x140338568]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140070ba1
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [0x1403de008]
mov r12, rax
movsxd r13, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test r13, r13
mov qword [rsp + 0x28], rbx
je 0x140070ba9
shl r13, 3
movabs rax, 0x5555555555555551
cmp r13, rax
jae 0x140070b89
lea rdi, [r13*2]
add rdi, r13
mov rcx, rdi
call fcn.1401b9cac
mov rsi, rax
mov qword [rsp + 0x30], rax
add rax, rdi
mov qword [rsp + 0x40], rax
xor r14d, r14d
mov rdi, qword [r12 + r14]
mov rcx, rdi
call fcn.1401e2874
mov rbx, rax
movabs rax, 0x7fffffffffffffef
cmp rbx, rax
ja 0x140070b89
cmp rbx, 0xb
jae 0x140070aa1
mov byte [rsi + 0x17], bl
lea r15, [rsi + rbx*2]
mov rcx, rsi
test rbx, rbx
jne 0x140070ad7
jmp 0x140070ae5
lea rbp, [rbx + 8]
and rbp, 0xfffffffffffffff8
mov rcx, rbp
add rcx, rbp
call fcn.1401b9cac
mov rcx, rax
mov qword [rsi], rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, rbp
mov qword [rsi + 0x10], rax
mov qword [rsi + 8], rbx
lea r15, [rcx + rbx*2]
add rbx, rbx
mov rdx, rdi
mov r8, rbx
call fcn.1401bcb50
mov word [r15], 0
add rsi, 0x18
add r14, 8
cmp r13, r14
jne 0x140070a68
mov qword [rsp + 0x38], rsi
lea rdx, [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.140070560
movups xmmword [rdi], xmm6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140070b2f
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x30]
test rdi, rdi
jne 0x140070b5f
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401bb0d0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp rsi, rdi
je 0x140070b7f
lea rbx, [rsi - 0x18]
cmp byte [rsi - 1], 0
jns 0x140070b77
mov rcx, qword [rsi - 0x18]
call fcn.1401b9ce8
mov rsi, rbx
cmp rbx, rdi
jne 0x140070b64
mov rcx, rdi
call fcn.1401b9ce8
jmp 0x140070b39
call fcn.1401d3c50
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x140070a04
xor r12d, r12d
jmp 0x140070a07
xor esi, esi
jmp 0x140070b01
Function at 0x140073310
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov rbx, qword [rdx]
mov qword [rdx], rax
lea rbp, [rbx + 1]
cmp rbp, 2
jb 0x14007333f
call fcn.140160650
cmp qword [rsi], rbx
je 0x140073370
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400733ad
cmp rbp, 2
jb 0x140073367
mov qword [rsi], rbx
call fcn.140160650
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
call fcn.14015ea60
lea rcx, [rsi + 0x20]
call fcn.14017a640
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x28], 0
mov byte [rsi + 0x29], r14b
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400733c3
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140160650
mov rcx, qword [rsi]
call fcn.14016ddf0
mov qword [rsi], 0
jmp 0x140073359
call fcn.140160650
mov rcx, qword [rdi]
call fcn.14016ddf0
mov qword [rdi], 0
jmp 0x14007339d

Function at 0x1400733e0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.14016d630
mov qword [rsi], 0
test rax, rax
je 0x140073433
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140073467
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14007342b
mov qword [rsi], rbx
call fcn.140160650
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.14015ea80
lea rcx, [rsi + 0x20]
call fcn.14017a640
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.140160650
mov rcx, qword [rsi]
call fcn.14016ddf0
mov qword [rsi], 0
jmp 0x140073419
Function at 0x140074ba0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf0
movaps xmmword [rsp + 0xe0], xmm6
mov r13, r8
mov r14, rdx
mov r12, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0xd8], rax
test r8, r8
je 0x140074bef
cmp byte [r13 + 0x17], 0
js 0x140074dc2
xor eax, eax
mov byte [r13], al
mov byte [r13 + 0x17], al
test r12, r12
je 0x140074dd6
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.1401dbc80
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x80]
mov qword [rdi + 0x50], rax
movaps xmm0, xmmword [0x14032f5c0]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.ReadStreamToStringWithMaxSize
lea r8, str....._base_files_file_util.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0xeb
call fcn.140160630
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14016ac30
xorps xmm6, xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
mov dword [rbx + 0x30], 0
mov rcx, r12
call fcn.1401d0be0
mov ecx, eax
call fcn.1401d169c
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x140074dda
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov edi, 0xffff
cmovg rdi, rax
cmp rdi, r14
cmovae rdi, r14
inc rdi
lea r15, [rsp + 0x20]
movaps xmmword [r15], xmm6
mov qword [r15 + 0x10], 0
xor esi, esi
mov rcx, r15
mov rdx, rdi
xor r8d, r8d
call fcn.14015c7d0
cmp byte [rsp + 0x37], 0
mov rcx, r15
jns 0x140074cf3
mov rcx, qword [rsp + 0x20]
add rcx, rsi
mov edx, 1
mov r8, rdi
mov r9, r12
call fcn.1401dba00
test rax, rax
je 0x140074d33
mov rbx, rax
mov rax, r14
sub rax, rsi
cmp rax, rbx
jb 0x140074de4
add rbx, rsi
mov rcx, r12
call fcn.1401daf80
test eax, eax
je 0x140074deb
mov rsi, rbx
mov rcx, r12
call fcn.1401dafac
test eax, eax
sete dil
mov r14, rsi
test r13, r13
je 0x140074d7d
movups xmm0, xmmword [r13]
mov rax, qword [r13 + 0x10]
mov rcx, qword [rsp + 0x30]
mov qword [r13 + 0x10], rcx
movaps xmm1, xmmword [rsp + 0x20]
movups xmmword [r13], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov rcx, r13
mov rdx, r14
xor r8d, r8d
call fcn.14015c7d0
cmp byte [rsp + 0x37], 0
js 0x140074e10
lea rcx, [rsp + 0x80]
call fcn.14016ac90
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, edi
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [r13]
mov byte [rax], 0
mov qword [r13 + 8], 0
jmp 0x140074bef
xor edi, edi
jmp 0x140074d95
mov edi, 0xffff
jmp 0x140074cb9
xor edi, edi
jmp 0x140074d44
test rsi, rsi
mov eax, 0x10000
cmove rdi, rax
lea rdx, [rbx + rdi]
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.14015c7d0
mov rsi, rbx
jmp 0x140074ce4
mov rcx, qword [rsp + 0x20]
call fcn.1401b9ce8
jmp 0x140074d88
Function at 0x140075e00
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140075ec0
mov eax, dword [rsi]
mov dword [0x1403a2248], eax
test al, 1
jne 0x140075e21
mov al, 1
add rsp, 0x20
pop rsi
ret
mov rcx, qword [0x1403b4910]
test rcx, rcx
jne 0x140075e3b
mov rcx, qword [0x1403b48e8]
test rcx, rcx
je 0x140075e5f
jmp 0x140075e81
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1403b4910], 0
mov rcx, qword [0x1403b48e8]
test rcx, rcx
jne 0x140075e81
and byte [0x1403a2248], 0xfe
mov ecx, 0x18
call fcn.1401b9cac
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1403b48e8], rax
mov rdx, qword [rsi + 8]
call fcn.14005cdc0
cmp dword [rsi + 0x14], 0
jne 0x140075ea6
mov rcx, qword [0x1403b48e8]
cmp byte [rcx + 0x17], 0
jns 0x140075ea0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
add rsp, 0x20
pop rsi
jmp fcn.140223f00
Function at 0x140080700
Capabilities:
Get file version info

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x50]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x14032f5c0]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.CreateFileVersionInfoWin
lea r8, str....._base_file_version_info_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x4c
call fcn.140160630
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
call fcn.14016ac30
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rbx + 0x17], 0
jns 0x140080794
mov rbx, qword [rbx]
lea rdx, [rsp + 0x24]
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x1400808d9
mov edi, eax
mov esi, eax
mov rcx, rsi
call fcn.1401b9cac
mov rbp, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call fcn.1401bd200
mov edx, dword [rsp + 0x24]
mov rcx, rbx
mov r8d, edi
mov r9, rbp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400808e2
lea r8, [rsp + 0x28]
mov qword [r8], 0
lea r9, [rsp + 0x4c]
mov dword [r9], 0xaaaaaaaa
lea rdx, str.VarFileInfoTranslation
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400808e2
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x1400808e2
mov rdi, rbp
add rdi, rsi
mov ecx, 0x38
call fcn.1401b9cac
mov rsi, rax
movzx r15d, word [rbx]
movzx ebx, word [rbx + 2]
lea rax, fcn.140080de0
mov qword [rsi], rax
mov qword [rsi + 8], rbp
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
mov rax, qword [0x1403a3660]
and rax, rbp
cmp rax, qword [0x1403a3648]
jne 0x140080868
mov rcx, rbp
call fcn.1401616b0
mov qword [rsi + 0x20], rbp
mov word [rsi + 0x28], r15w
mov word [rsi + 0x2a], bx
lea r8, [rsp + 0x28]
mov qword [r8], 0
lea r9, [rsp + 0x4c]
mov dword [r9], 0xaaaaaaaa
lea rdx, [0x140338dc2]
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400808f8
mov rax, qword [rsp + 0x28]
mov qword [rsi + 0x30], rax
mov qword [r14], rsi
lea rcx, [rsp + 0x50]
call fcn.14016ac90
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401bb0d0
mov rax, r14
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [r14], 0
jmp 0x1400808ac
mov qword [r14], 0
test rbp, rbp
je 0x1400808ac
mov rcx, rbp
call fcn.1401b9ce8
jmp 0x1400808ac
int3