joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400067ee
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x140006832
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.1400067c0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140006822
mov qword [rdi], rsi
call fcn.14002da00
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14000ab20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x14000ac46
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r12d, edx
mov rsi, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x14000ac8d
mov edi, dword [rsi + 0x5c]
test r12b, r12b
je 0x14000adc4
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
jmp 0x14000adc4
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
cmp eax, 1
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.14014ba70
cmp eax, 0xffffffff
je 0x14000adbf
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x14000acac
mov byte [rsp + 0x57], 0xaa
cmp byte [rsi + 0x61], 0
je 0x14000acf3
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test r12b, r12b
je 0x14000ad84
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x14000adc4
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea rax, [rsp + 0x40]
mov qword [rax], r14
lea r14, [rsp + 0x58]
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r15d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x57]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
mov r8, r14
call qword [rax + 0x18]
cmp eax, 1
jne 0x14000adac
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r15w
cmp rdi, 8
je 0x14000adbf
mov rcx, qword [rsi + 0x40]
call fcn.14014ba70
cmp eax, 0xffffffff
je 0x14000adbf
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x14000ad08
mov edi, edi
test rdi, rdi
jle 0x14000ada5
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movzx ecx, byte [rsp + rax + 0x58]
call fcn.1401520f4
cmp eax, 0xffffffff
jne 0x14000ad86
jmp 0x14000adbf
movzx edi, byte [rsp + 0x57]
jmp 0x14000adc4
cmp eax, 2
je 0x14000adbf
cmp eax, 3
je 0x14000acd5
jmp 0x14000acdd
mov edi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140132550
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000ae70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x14000af9a
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r12d, edx
mov rsi, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x14000afe1
movzx edi, word [rsi + 0x5c]
test r12b, r12b
je 0x14000b11f
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
jmp 0x14000b11f
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
cmp eax, 1
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.14014ba70
cmp eax, 0xffffffff
je 0x14000b11b
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x14000b000
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x14000b04c
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test r12b, r12b
je 0x14000b0dd
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x14000b11f
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea rax, [rsp + 0x40]
mov qword [rax], r14
lea r14, [rsp + 0x58]
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r15d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x56]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
mov r8, r14
call qword [rax + 0x18]
cmp eax, 1
jne 0x14000b108
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r15w
cmp rdi, 8
je 0x14000b11b
mov rcx, qword [rsi + 0x40]
call fcn.14014ba70
cmp eax, 0xffffffff
je 0x14000b11b
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x14000b061
mov edi, edi
test rdi, rdi
jle 0x14000b101
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movsx eax, byte [rsp + rax + 0x58]
movzx ecx, ax
call fcn.1401520f4
cmp eax, 0xffffffff
jne 0x14000b0df
jmp 0x14000b11b
movzx edi, word [rsp + 0x56]
jmp 0x14000b11f
cmp eax, 2
je 0x14000b11b
cmp eax, 3
je 0x14000b02b
jmp 0x14000b035
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140132550
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000b180
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 - 8], r12
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov ebp, 0xffffffff
mov qword [rsp + 0x30], r12
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x30]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14014b694
cmp rax, rbx
jne 0x14000b21c
cmp edi, 1
je 0x14000b1c4
cmp edi, 2
je 0x14000b21c
mov rcx, qword [rsi + 0x40]
call fcn.14014afb8
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140132550
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000b240
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x14000b275
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14014b694
xor ebx, ebx
test rsi, rsi
jle 0x14000b29a
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x14000b29a
inc rbx
cmp rsi, rbx
jne 0x14000b27c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14000b2b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
mov byte [rsp + 0x57], 0xaa
cmp edx, 0xffffffff
je 0x14000b322
mov r15d, edx
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x14000b32d
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.14014b694
mov esi, 0xffffffff
cmp rax, 1
je 0x14000b325
jmp 0x14000b3e2
xor r15d, r15d
mov esi, r15d
jmp 0x14000b3e2
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x57]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x14000b3dd
mov ebp, eax
cmp eax, 3
je 0x14000b3bc
cmp ebp, 1
ja 0x14000b3dd
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14014b694
cmp rax, rsi
jne 0x14000b3dd
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x14000b345
jmp 0x14000b325
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14014b694
cmp rax, 1
je 0x14000b325
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140132550
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000b450
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x14000b485
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14014b694
xor ebx, ebx
test rsi, rsi
jle 0x14000b4ab
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x14000b4ab
inc rbx
cmp rsi, rbx
jne 0x14000b48c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14000b4c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
mov word [rsp + 0x56], 0xaaaa
cmp dx, 0xffff
je 0x14000b534
mov r15d, edx
mov rdi, rcx
mov word [rsp + 0x56], dx
cmp byte [rcx + 0x58], 0
je 0x14000b53f
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.14014b694
mov si, 0xffff
cmp rax, 1
je 0x14000b537
jmp 0x14000b5f3
xor r15d, r15d
mov esi, r15d
jmp 0x14000b5f3
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x56]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x14000b5ef
mov ebp, eax
cmp eax, 3
je 0x14000b5ce
cmp ebp, 1
ja 0x14000b5ef
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14014b694
cmp rax, rsi
jne 0x14000b5ef
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x14000b557
jmp 0x14000b537
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14014b694
cmp rax, 1
je 0x14000b537
mov si, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140132550
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000fad0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x14000fb07
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp r8, rdx
jne 0x14000fae1
ret

Function at 0x14000fc40
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x14000fc78
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp r8, rdx
jne 0x14000fc51
ret
Function at 0x140026b10
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1401b7028]
test rdi, rdi
jne 0x140026bf5
mov ecx, 0x70
call fcn.1401321a8
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.1401321a8
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
movups xmmword [rsi + 0x28], xmm6
mov qword [rsi + 0x38], 0
lea rax, [rsi + 0x48]
movups xmmword [rsi + 0x48], xmm6
mov qword [rsi + 0x40], rax
mov qword [rsi + 0x58], 1
mov dword [rsi + 0x60], 0
mov qword [rsi + 0x68], 0
mov qword [0x1401b7028], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140026be1
cmp word [rax], 0
je 0x140026be1
xor edx, edx
nop word cs:[rax + rax]
nop dword [rax + rax]
lea rcx, [rdx + 1]
cmp word [rax + rdx*2 + 2], 0
mov rdx, rcx
jne 0x140026bd0
jmp 0x140026be3
xor ecx, ecx
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140026c20
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140132550
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140027cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
mov r15, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx r13d, byte [0x1401b7030]
xor r13, 3
xor r12d, r12d
xorps xmm6, xmm6
jmp 0x140027d0d
add r12, 1
cmp r12, r13
jae 0x140027df8
mov rax, r12
shl rax, 4
lea rcx, [0x14016ac80]
mov rdx, qword [rax + rcx]
mov rsi, qword [rax + rcx + 8]
movaps xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x30], 0
lea eax, [rsi + rsi]
mov byte [rsp + 0x20], al
lea r8, [rsi + rsi]
lea rcx, [rsp + 0x22]
call fcn.140135640
mov word [rsp + rsi*2 + 0x22], 0
movzx eax, byte [rsp + 0x20]
mov r8, rax
shr r8, 1
test al, 1
mov r14, qword [rsp + 0x28]
mov rbx, r14
cmove rbx, r8
cmp rbx, qword [r15 + 8]
jbe 0x140027d90
test al, 1
je 0x140027d00
mov rcx, qword [rsp + 0x30]
call fcn.1401321e4
movzx r13d, byte [0x1401b7030]
xor r13, 3
jmp 0x140027d00
mov rcx, qword [rsp + 0x30]
test rbx, rbx
je 0x140027dc4
test al, 1
mov rsi, rcx
lea rdx, [rsp + 0x22]
cmove rsi, rdx
mov rbp, qword [r15]
xor edi, edi
nop dword [rax]
movzx edx, word [rbp + rdi*2]
cmp dx, word [rsi + rdi*2]
jne 0x140027d6d
add rdi, 1
cmp rbx, rdi
jne 0x140027db0
test al, 1
jne 0x140027dcd
mov r14, r8
jmp 0x140027dd2
call fcn.1401321e4
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140132550
mov rax, r14
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r14d, r14d
jmp 0x140027dd2

Function at 0x14002a770
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400404c0
mov qword [rsi], 0
test rax, rax
je 0x14002a7d8
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
add rax, 1
cmp rax, 2
jb 0x14002a7be
call fcn.14002da00
mov rcx, qword [rsi]
call fcn.140042990
mov qword [rsi], 0
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14002a7d0
mov qword [rsi], rbx
call fcn.14002da00
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.14002a8d0
lea rcx, [rsi + 0x20]
call fcn.140057af0
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14002da10
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x250
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov r14b, 1
cmp qword [0x1401b7068], 0
jne 0x14002dcc2
mov rdi, qword [0x1401b7048]
test rdi, rdi
je 0x14002da5e
test byte [0x1401b3358], 1
jne 0x14002db78
jmp 0x14002dcc2
mov ecx, 0x18
call fcn.1401321a8
mov rdi, rax
lea rsi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140135a50
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov rcx, rsi
call fcn.140150e84
mov rbx, rax
movabs rax, 0x7ffffffffffffff0
cmp rbx, rax
jae 0x14002dce3
cmp rbx, 0xb
jae 0x14002dad6
lea eax, [rbx + rbx]
mov byte [rdi], al
mov rsi, rdi
add rsi, 2
test rbx, rbx
jne 0x14002db01
jmp 0x14002db14
lea rbp, [rbx + 8]
and rbp, 0xfffffffffffffff8
js 0x14002dceb
mov rcx, rbp
add rcx, rbp
call fcn.1401321a8
mov rsi, rax
mov qword [rdi + 0x10], rax
or rbp, 1
mov qword [rdi], rbp
mov qword [rdi + 8], rbx
mov r8, rbx
add r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140135640
mov word [rsi + rbx*2], 0
movzx r8d, byte [rdi]
test r8b, 1
je 0x14002db2a
mov r8, qword [rdi + 8]
jmp 0x14002db2d
shr r8, 1
mov rcx, rdi
mov dx, 0x5c
call fcn.140023bf2
cmp rax, 0xffffffffffffffff
je 0x14002db55
add rax, 1
mov rcx, rdi
mov rdx, rax
mov r8, 0xffffffffffffffff
call fcn.140023872
lea rdx, [0x14016ae6c]
mov rcx, rdi
call fcn.14002353e
mov qword [0x1401b7048], rdi
test byte [0x1401b3358], 1
je 0x14002dcc2
test byte [rdi], 1
jne 0x14002db83
add rdi, 2
jmp 0x14002db87
mov rdi, qword [rdi + 0x10]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401b7068], rax
add rax, 1
cmp rax, 1
ja 0x14002dcc2
lea rsi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140135a50
mov word [rsp + 0x40], 0
mov ecx, 0x104
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14002dcbf
cmp eax, 0x104
ja 0x14002dcbf
mov rcx, qword [0x1401b7048]
lea rdx, [rsp + 0x40]
call fcn.140023712
mov rcx, qword [0x1401b7048]
movzx eax, byte [rcx]
test al, 1
jne 0x14002dc31
lea rdx, [rcx + 2]
shr rax, 1
jmp 0x14002dc39
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x14002dc54
lea rdx, [0x14016ae68]
call fcn.14002353e
mov rcx, qword [0x1401b7048]
lea rdx, [0x14016ae6c]
call fcn.14002353e
mov rcx, qword [0x1401b7048]
test byte [rcx], 1
jne 0x14002dc72
add rcx, 2
jmp 0x14002dc76
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401b7068], rax
add rax, 1
cmp rax, 1
ja 0x14002dcc2
mov qword [0x1401b7068], 0
xor r14d, r14d
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140132550
mov eax, r14d
add rsp, 0x250
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rcx, rdi
call fcn.1400221c4
call fcn.1401457d4
int3
Function at 0x14003f670
Capabilities:
Move file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a0
mov r14, r8
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x498], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [0x14016bacf]
lea r8, str..._.._base_files_file_util_win.cc
lea rsi, [rsp + 0x290]
mov rcx, rsi
mov r9d, 0x196
call fcn.14002d9e0
lea rcx, [rsp + 0x30]
mov rdx, rsi
xor r8d, r8d
call fcn.14003abb0
lea rsi, [rsp + 0x290]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140135a50
lea r15, [rdi + 2]
test byte [rdi], 1
mov rdx, r15
je 0x14003f718
mov rdx, qword [rdi + 0x10]
mov r8d, 0x104
mov rcx, rsi
call fcn.140039460
mov rcx, rsi
call fcn.140002830
lea rbp, [rsp + 0x80]
mov r8d, 0x208
mov rcx, rbp
mov dl, 0xaa
call fcn.140135a50
lea rsi, [rbx + 2]
test byte [rbx], 1
mov rdx, rsi
je 0x14003f756
mov rdx, qword [rbx + 0x10]
mov r8d, 0x104
mov rcx, rbp
call fcn.140039460
mov rcx, rbp
call fcn.140002830
test byte [rdi], 1
mov rdx, r15
je 0x14003f778
mov rdx, qword [rdi + 0x10]
test byte [rbx], 1
mov rcx, rsi
je 0x14003f784
mov rcx, qword [rbx + 0x10]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov bpl, 1
test eax, eax
jne 0x14003f7f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140040d80
mov r12d, eax
test byte [rbx], 1
je 0x14003f7bb
mov rsi, qword [rbx + 0x10]
test byte [rdi], 1
je 0x14003f7c4
mov r15, qword [rdi + 0x10]
mov rcx, r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bpl
test r14, r14
je 0x14003f7f2
test eax, eax
jne 0x14003f7f2
cmp r12d, 0xfffffffc
jne 0x14003f7ed
call fcn.140040d60
mov r12d, eax
mov dword [r14], r12d
xor ebp, ebp
lea rcx, [rsp + 0x30]
call fcn.14003acf0
mov rcx, qword [rsp + 0x498]
xor rcx, rsp
call fcn.140132550
mov eax, ebp
add rsp, 0x4a0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14003f820
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rdx, str.PathExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1c9
call fcn.14002d9e0
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14003abb0
test byte [rsi], 1
je 0x14003f8a1
mov rsi, qword [rsi + 0x10]
jmp 0x14003f8a5
add rsi, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rdi
call fcn.14003acf0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140132550
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
Function at 0x14003f8e0
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov r14, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.140135a50
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
add edi, 0xffffffff
cmp edi, 0x102
ja 0x14003f995
mov qword [rsp + 0x20], rbx
cmp word [rsp + 0x60], 0
je 0x14003f951
xor ecx, ecx
lea rax, [rcx + 1]
cmp word [rsp + rcx*2 + 0x62], 0
mov rcx, rax
jne 0x14003f940
jmp 0x14003f953
xor eax, eax
mov qword [rsp + 0x28], rax
lea rbx, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002a900
lea rsi, [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
call fcn.14002c6a0
mov rcx, r14
mov rdx, rsi
call fcn.14002aa10
mov rcx, rsi
call fcn.14002a9e0
mov rcx, rbx
call fcn.14002a9e0
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140132550
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14003f9c0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x288
mov rsi, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140135a50
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14003fa40
cmp word [rsp + 0x70], 0
je 0x14003fa40
mov qword [rsp + 0x60], rdi
xor eax, eax
nop
cmp word [rsp + rax*2 + 0x72], 0
lea rax, [rax + 1]
jne 0x14003fa20
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.14002a900
jmp 0x14003faaf
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x40], xmm0
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.14002a8b0
mov rcx, rdi
call fcn.14003f8e0
test al, al
je 0x14003fa83
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14002a8e0
jmp 0x14003faa5
lea rax, [0x14016bae8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 3
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14002a900
lea rcx, [rsp + 0x40]
call fcn.14002a9e0
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140132550
mov rax, rsi
add rsp, 0x288
pop rdi
pop rsi
ret