joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4914e0
Capabilities:
Get common file path

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x50
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, 1
mov r12, rcx
mov rbx, rdx
xor ecx, ecx
xor edx, edx
call rsi
test eax, eax
cmovne r13d, eax
mov ecx, r13d
add rcx, rcx
call sym.operator_new___unsigned_long_long_
mov ecx, r13d
mov r14, rax
mov rdx, rax
call rsi
test eax, eax
jne 0x4915a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x4915a0
test rbx, rbx
je 0x49160e
call method.boost::system.system_category__
mov dword [rbx], esi
mov qword [rbx + 8], rax
lea rax, [r12 + 0x10]
mov rcx, r14
mov qword [r12], rax
call sym.wcslen
lea r13, [rax + rax]
mov rdx, r13
sar rdx, 1
mov qword [rsp + 0x30], rdx
cmp rdx, 7
ja 0x4915d0
mov rcx, qword [r12]
cmp rdx, 1
jne 0x4915c0
movzx eax, word [r14]
mov word [rcx], ax
xor eax, eax
mov qword [r12 + 8], rdx
mov word [rcx + r13], ax
mov rcx, r14
call sym.operator_delete___void_
mov rax, r12
add rsp, 0x50
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
test rbx, rbx
je 0x491545
mov dword [rbx], 0
call method.boost::system.system_category__
mov qword [rbx + 8], rax
jmp 0x491545
test rdx, rdx
je 0x49157c
jmp 0x4915f1
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, r12
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___._M_create_unsigned_long_long__unsigned_long_long_
mov qword [r12], rax
mov rcx, rax
mov rax, qword [rsp + 0x30]
mov qword [r12 + 0x10], rax
mov r8, r13
mov rdx, r14
call sym.memcpy
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r12]
lea r13, [rdx + rdx]
jmp 0x49157c
mov ecx, 0x50
lea r12, [rsp + 0x30]
call sym.__cxa_allocate_exception
mov r13, rax
call method.boost::system.system_category__
lea rdx, str.boost::filesystem::current_path
mov rcx, r12
mov rbx, rax
call fcn.0085be40
mov rcx, r13
lea r8, [rsp + 0x20]
mov rdx, r12
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rbx
call method.boost::filesystem::filesystem_error.filesystem_error_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__boost::system::error_code_
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
cmp rcx, rax
je 0x491665
call sym.operator_delete_void_
lea r8, [sym.boost::filesystem::filesystem_error::filesystem_error__]
lea rdx, [0x0093d330]
mov rcx, r13
call sym.__cxa_throw
mov r12, rax
mov rcx, r14
call sym.operator_delete___void_
mov rcx, r12
call sym._Unwind_Resume
mov rcx, r13
mov r12, rax
call sym.__cxa_free_exception
jmp 0x49167e
Function at 0x4929a0
Capabilities:
Delete directory
Delete file

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
mov rbx, r8
cmp edx, 1
je 0x492a40
and edx, 0xfffffff7
mov rcx, qword [rcx]
cmp edx, 3
jne 0x4929f8
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x492a02
xor ecx, ecx
mov rdx, r12
lea r9, str.boost::filesystem::remove
mov r8, rbx
call sym._anonymous_namespace_::error_unsigned_long__boost::filesystem::path_const__boost::system::error_code__char_const_
xor eax, 1
mov r12d, eax
mov eax, r12d
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4929cc
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
mov ecx, eax
xor eax, eax
cmp ecx, 0x35
ja 0x492a24
movabs rax, 0x2000000020800c
shr rax, cl
and eax, 1
cmp ecx, 0x7b
je 0x4929cc
test al, al
jne 0x4929cc
cmp ecx, 0x57
je 0x4929cc
cmp ecx, 0xa1
je 0x4929cc
call rsi
mov ecx, eax
jmp 0x4929ce
xor r12d, r12d
test r8, r8
je 0x4929e6
mov dword [r8], 0
call method.boost::system.system_category__
mov qword [rbx + 8], rax
mov eax, r12d
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x493580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x28
mov r13, rcx
mov r14, rdx
mov rcx, qword [rdx]
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r12d, eax
cmp eax, 0xffffffff
je 0x493658
test rbx, rbx
je 0x4935bd
mov dword [rbx], 0
call method.boost::system.system_category__
mov qword [rbx + 8], rax
test r12d, 0x400
jne 0x493620
mov edx, r12d
and r12d, 0x10
mov rcx, r14
jne 0x4935f8
call sym._anonymous_namespace_::make_permissions_boost::filesystem::path_const__unsigned_long_
mov dword [r13], 2
mov dword [r13 + 4], eax
mov rax, r13
add rsp, 0x28
pop rbx
pop r12
pop r13
pop r14
ret
call sym._anonymous_namespace_::make_permissions_boost::filesystem::path_const__unsigned_long_
mov dword [r13], 3
mov dword [r13 + 4], eax
mov rax, r13
add rsp, 0x28
pop rbx
pop r12
pop r13
pop r14
ret
mov rcx, r14
call sym._anonymous_namespace_::is_reparse_point_a_symlink_boost::filesystem::path_const_
mov edx, r12d
mov rcx, r14
test al, al
je 0x493678
call sym._anonymous_namespace_::make_permissions_boost::filesystem::path_const__unsigned_long_
mov dword [r13], 4
mov dword [r13 + 4], eax
mov rax, r13
add rsp, 0x28
pop rbx
pop r12
pop r13
pop r14
ret
mov r8, rbx
mov rdx, r14
mov rcx, r13
call sym._anonymous_namespace_::process_status_failure_boost::filesystem::path_const__boost::system::error_code_
mov rax, r13
add rsp, 0x28
pop rbx
pop r12
pop r13
pop r14
ret
call sym._anonymous_namespace_::make_permissions_boost::filesystem::path_const__unsigned_long_
mov dword [r13], 9
mov dword [r13 + 4], eax
mov rax, r13
add rsp, 0x28
pop rbx
pop r12
pop r13
pop r14
ret
Function at 0x4936a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov r13, rcx
mov r14, rdx
mov rcx, qword [rdx]
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r12d, eax
cmp eax, 0xffffffff
je 0x493730
test ah, 4
jne 0x493740
test rbx, rbx
je 0x4936e3
mov dword [rbx], 0
call method.boost::system.system_category__
mov qword [rbx + 8], rax
mov edx, r12d
and r12d, 0x10
mov rcx, r14
jne 0x493718
call sym._anonymous_namespace_::make_permissions_boost::filesystem::path_const__unsigned_long_
mov dword [r13], 2
mov dword [r13 + 4], eax
mov rax, r13
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sym._anonymous_namespace_::make_permissions_boost::filesystem::path_const__unsigned_long_
mov dword [r13], 3
mov dword [r13 + 4], eax
jmp 0x493700
mov r8, rbx
mov rdx, r14
mov rcx, r13
call sym._anonymous_namespace_::process_status_failure_boost::filesystem::path_const__boost::system::error_code_
jmp 0x493700
mov rbp, qword [r14]
lea rsi, [rsp + 0x60]
lea r15, [rsp + 0x50]
mov qword [rsp + 0x50], rsi
test rbp, rbp
je 0x493820
mov rcx, rbp
call sym.wcslen
lea rdi, [rax + rax]
mov rdx, rdi
sar rdx, 1
mov qword [rsp + 0x48], rdx
cmp rdx, 7
ja 0x493830
mov rcx, qword [rsp + 0x50]
cmp rdx, 1
jne 0x493880
movzx eax, word [rbp]
mov word [rcx], ax
xor eax, eax
mov qword [rsp + 0x58], rdx
xor r9d, r9d
mov r8d, 7
mov word [rcx + rdi], ax
xor edx, edx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x50]
mov r15, rax
cmp rcx, rsi
je 0x4937d9
call sym.operator_delete_void_
cmp r15, 0xffffffffffffffff
je 0x493730
mov rcx, r14
call sym._anonymous_namespace_::is_reparse_point_a_symlink_boost::filesystem::path_const_
test al, al
jne 0x493870
mov edx, r12d
mov rcx, r14
call sym._anonymous_namespace_::make_permissions_boost::filesystem::path_const__unsigned_long_
mov dword [r13], 9
mov rcx, r15
mov dword [r13 + 4], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x493700
lea rcx, [0x00885f68]
call method.std.__throw_logic_error_char_const_
nop dword [rax]
mov rcx, r15
lea rdx, [rsp + 0x48]
xor r8d, r8d
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___._M_create_unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x50], rax
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
mov r8, rdi
mov rdx, rbp
call sym.memcpy
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
lea rdi, [rdx + rdx]
jmp 0x493792
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4936cf
test rdx, rdx
je 0x493792
jmp 0x493852
Function at 0x493fb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x38
mov rbx, rdx
mov r12, rcx
mov edx, dword [rdx + 0x28]
mov rsi, r8
mov eax, dword [rbx + 0x2c]
cmp eax, 0xffff
je 0x493fd4
test edx, edx
jne 0x494040
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r13d, eax
cmp eax, 0xffffffff
je 0x494090
test rsi, rsi
je 0x493ffd
mov dword [rsi], 0
call method.boost::system.system_category__
mov qword [rsi + 8], rax
test r13d, 0x400
jne 0x494070
mov edx, r13d
and r13d, 0x10
mov rcx, rbx
jne 0x494060
call sym._anonymous_namespace_::make_permissions_boost::filesystem::path_const__unsigned_long_
mov edx, 2
mov dword [rbx + 0x28], edx
mov dword [rbx + 0x2c], eax
mov dword [r12 + 4], eax
mov rax, r12
mov dword [r12], edx
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret
test r8, r8
je 0x494022
mov dword [r8], 0
call method.boost::system.system_category__
mov edx, dword [rbx + 0x28]
mov qword [rsi + 8], rax
mov eax, dword [rbx + 0x2c]
jmp 0x494022
call sym._anonymous_namespace_::make_permissions_boost::filesystem::path_const__unsigned_long_
mov edx, 3
jmp 0x49401c
mov rcx, rbx
call sym._anonymous_namespace_::is_reparse_point_a_symlink_boost::filesystem::path_const_
mov edx, r13d
mov rcx, rbx
test al, al
je 0x4940b0
call sym._anonymous_namespace_::make_permissions_boost::filesystem::path_const__unsigned_long_
mov edx, 4
jmp 0x49401c
mov rdx, rbx
lea rcx, [rsp + 0x28]
mov r8, rsi
call sym._anonymous_namespace_::process_status_failure_boost::filesystem::path_const__boost::system::error_code_
mov edx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
jmp 0x49401c
call sym._anonymous_namespace_::make_permissions_boost::filesystem::path_const__unsigned_long_
mov edx, 9
jmp 0x49401c
Function at 0x495a80
Capabilities:
Create directory

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rbx, rdx
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x495ad0
mov r12d, 1
test rbx, rbx
je 0x495abb
mov dword [rbx], 0
call method.boost::system.system_category__
mov qword [rbx + 8], rax
mov eax, r12d
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r12, [rsp + 0x40]
mov dword [rsp + 0x30], 0
mov edi, eax
call method.boost::system.system_category__
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x38], rax
call method.boost::filesystem::detail.status_boost::filesystem::path_const__boost::system::error_code_
cmp dword [rsp + 0x40], 3
je 0x495b30
test rbx, rbx
je 0x495b41
call method.boost::system.system_category__
xor r12d, r12d
mov dword [rbx], edi
mov qword [rbx + 8], rax
mov eax, r12d
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r12d, r12d
test rbx, rbx
jne 0x495aac
jmp 0x495abb
mov ecx, 0x50
call sym.__cxa_allocate_exception
mov r13, rax
call method.boost::system.system_category__
lea rdx, str.boost::filesystem::create_directory
mov rcx, r12
mov rbp, rax
call fcn.0085be40
mov rcx, r13
lea r9, [rsp + 0x20]
mov r8, rsi
mov rdx, r12
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rbp
call sym._ZN5boost10filesystem16filesystem_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKNS0_4pathENS_6system10error_
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x495b96
call sym.operator_delete_void_
lea r8, [sym.boost::filesystem::filesystem_error::filesystem_error__]
lea rdx, [0x0093d330]
mov rcx, r13
call sym.__cxa_throw
mov r12, rax
mov rcx, r13
call sym.__cxa_free_exception
mov rcx, r12
call sym._Unwind_Resume
nop
Function at 0x496000
Capabilities:
Set current directory

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rbx, rdx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x496040
test rbx, rbx
je 0x496033
mov dword [rbx], 0
call method.boost::system.system_category__
mov qword [rbx + 8], rax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x49601f
test rbx, rbx
je 0x496069
call method.boost::system.system_category__
mov dword [rbx], edi
mov qword [rbx + 8], rax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov ecx, 0x50
lea r12, [rsp + 0x30]
call sym.__cxa_allocate_exception
mov r13, rax
call method.boost::system.system_category__
lea rdx, str.boost::filesystem::current_path
mov rcx, r12
mov rbp, rax
call fcn.0085be40
mov rcx, r13
lea r9, [rsp + 0x20]
mov r8, rsi
mov rdx, r12
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rbp
call sym._ZN5boost10filesystem16filesystem_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKNS0_4pathENS_6system10error_
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
cmp rcx, rax
je 0x4960c3
call sym.operator_delete_void_
lea r8, [sym.boost::filesystem::filesystem_error::filesystem_error__]
lea rdx, [0x0093d330]
mov rcx, r13
call sym.__cxa_throw
mov r12, rax
mov rcx, r13
call sym.__cxa_free_exception
mov rcx, r12
call sym._Unwind_Resume
nop
nop dword [rax]
Function at 0x4960f0
Capabilities:
Clear file content

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x70
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rsi, rcx
mov r13, rdx
mov rbx, r8
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x49615a
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, r12
test eax, eax
jne 0x496190
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
test r12d, r12d
je 0x4961a7
test rbx, rbx
je 0x4961c8
call method.boost::system.system_category__
mov dword [rbx], r12d
mov qword [rbx + 8], rax
add rsp, 0x70
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov r13d, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13d, r13d
je 0x49615a
test rbx, rbx
je 0x496179
mov dword [rbx], 0
call method.boost::system.system_category__
mov qword [rbx + 8], rax
add rsp, 0x70
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov ecx, 0x50
lea r14, [rsp + 0x50]
call sym.__cxa_allocate_exception
mov r13, rax
call method.boost::system.system_category__
lea rdx, str.boost::filesystem::resize_file
mov rcx, r14
mov rbx, rax
call fcn.0085be40
mov rcx, r13
lea r9, [rsp + 0x40]
mov r8, rsi
mov rdx, r14
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rbx
call sym._ZN5boost10filesystem16filesystem_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKNS0_4pathENS_6system10error_
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
cmp rcx, rax
je 0x496222
call sym.operator_delete_void_
lea r8, [sym.boost::filesystem::filesystem_error::filesystem_error__]
lea rdx, [0x0093d330]
mov rcx, r13
call sym.__cxa_throw
mov r13, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call sym._Unwind_Resume
mov r12, rax
mov rcx, r13
call sym.__cxa_free_exception
mov rcx, r12
call sym._Unwind_Resume
nop
Function at 0x496260
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x60
mov r13, rcx
mov rbx, rdx
mov dword [rsp + 0x30], 0
call method.boost::system.system_category__
mov rcx, qword [r13]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
je 0x496318
mov dword [rsp + 0x30], 0
call method.boost::system.system_category__
mov qword [rsp + 0x38], rax
test esi, 0x400
jne 0x4962f0
xor r12d, r12d
and esi, 0x10
setne r12b
add r12d, 2
test rbx, rbx
je 0x4962d5
mov dword [rbx], 0
call method.boost::system.system_category__
mov qword [rbx + 8], rax
mov r8, rbx
mov edx, r12d
mov rcx, r13
call sym._anonymous_namespace_::remove_file_or_directory_boost::filesystem::path_const__boost::filesystem::file_type__boost::system::error_code_
add rsp, 0x60
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov rcx, r13
mov r12d, 9
call sym._anonymous_namespace_::is_reparse_point_a_symlink_boost::filesystem::path_const_
test al, al
je 0x4962c1
and esi, 0x10
cmp esi, 1
sbb r12d, r12d
and r12d, 0xfffffff9
add r12d, 0xb
jmp 0x4962c1
lea r14, [rsp + 0x40]
lea r8, [rsp + 0x30]
mov rdx, r13
mov rcx, r14
call sym._anonymous_namespace_::process_status_failure_boost::filesystem::path_const__boost::system::error_code_
mov r12d, dword [rsp + 0x40]
test r12d, r12d
jne 0x4962c1
mov esi, dword [rsp + 0x30]
test esi, esi
je 0x4962c1
test rbx, rbx
je 0x496362
call method.boost::system.system_category__
mov dword [rbx], esi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov ecx, 0x50
call sym.__cxa_allocate_exception
mov r12, rax
call method.boost::system.system_category__
lea rdx, str.boost::filesystem::remove
mov rcx, r14
mov rbx, rax
call fcn.0085be40
mov rcx, r12
lea r9, [rsp + 0x20]
mov r8, r13
mov rdx, r14
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rbx
call sym._ZN5boost10filesystem16filesystem_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKNS0_4pathENS_6system10error_
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x4963b7
call sym.operator_delete_void_
lea r8, [sym.boost::filesystem::filesystem_error::filesystem_error__]
lea rdx, [0x0093d330]
mov rcx, r12
call sym.__cxa_throw
mov r13, rax
mov rcx, r12
call sym.__cxa_free_exception
mov rcx, r13
call sym._Unwind_Resume
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x4963f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x60
mov r12, rcx
mov rbx, rdx
mov dword [rsp + 0x30], 0
call method.boost::system.system_category__
mov rcx, qword [r12]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
je 0x4964c0
mov dword [rsp + 0x30], 0
call method.boost::system.system_category__
mov qword [rsp + 0x38], rax
test esi, 0x400
jne 0x496498
and esi, 0x10
je 0x496488
mov r13d, 3
test rbx, rbx
je 0x496467
nop dword [rax + rax]
mov dword [rbx], 0
call method.boost::system.system_category__
mov qword [rbx + 8], rax
mov r8, rbx
mov edx, r13d
mov rcx, r12
call sym._anonymous_namespace_::remove_all_aux_boost::filesystem::path_const__boost::filesystem::file_type__boost::system::error_code_
add rsp, 0x60
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov r13d, 2
test rbx, rbx
jne 0x496458
jmp 0x496467
mov rcx, r12
call sym._anonymous_namespace_::is_reparse_point_a_symlink_boost::filesystem::path_const_
test al, al
je 0x496510
and esi, 0x10
jne 0x496528
mov r13d, 4
test rbx, rbx
jne 0x496458
jmp 0x496467
lea r14, [rsp + 0x40]
lea r8, [rsp + 0x30]
mov rdx, r12
mov rcx, r14
call sym._anonymous_namespace_::process_status_failure_boost::filesystem::path_const__boost::system::error_code_
mov r13d, dword [rsp + 0x40]
test r13d, r13d
jne 0x496567
mov esi, dword [rsp + 0x30]
test esi, esi
je 0x496540
test rbx, rbx
je 0x496589
call method.boost::system.system_category__
mov dword [rbx], esi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov r13d, 9
test rbx, rbx
jne 0x496458
jmp 0x496467
mov r13d, 0xb
test rbx, rbx
jne 0x496458
jmp 0x496467
test rbx, rbx
jne 0x496554
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov dword [rbx], 0
call method.boost::system.system_category__
mov qword [rbx + 8], rax
xor eax, eax
jmp 0x496547
test rbx, rbx
je 0x49657b
mov dword [rbx], 0
call method.boost::system.system_category__
mov qword [rbx + 8], rax
cmp r13d, 1
ja 0x496467
xor eax, eax
jmp 0x496547
mov ecx, 0x50
call sym.__cxa_allocate_exception
mov r13, rax
call method.boost::system.system_category__
lea rdx, str.boost::filesystem::remove_all
mov rcx, r14
mov rbx, rax
call fcn.0085be40
mov rcx, r13
lea r9, [rsp + 0x20]
mov r8, r12
mov rdx, r14
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rbx
call sym._ZN5boost10filesystem16filesystem_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKNS0_4pathENS_6system10error_
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x4965de
call sym.operator_delete_void_
lea r8, [sym.boost::filesystem::filesystem_error::filesystem_error__]
lea rdx, [0x0093d330]
mov rcx, r13
call sym.__cxa_throw
mov r12, rax
mov rcx, r13
call sym.__cxa_free_exception
mov rcx, r12
call sym._Unwind_Resume
nop
nop dword [rax + rax]
Function at 0x496610
Capabilities:
Get disk size

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x78
mov rsi, rdx
mov r12, rcx
lea rdx, [rsp + 0x38]
mov rbx, r8
mov rcx, qword [rsi]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4966a0
test rbx, rbx
je 0x496653
mov dword [rbx], 0
call method.boost::system.system_category__
mov qword [rbx + 8], rax
mov eax, dword [rsp + 0x44]
mov edx, dword [rsp + 0x40]
shl rax, 0x20
add rax, rdx
mov edx, dword [rsp + 0x48]
mov qword [r12], rax
mov eax, dword [rsp + 0x4c]
shl rax, 0x20
add rax, rdx
mov edx, dword [rsp + 0x38]
mov qword [r12 + 8], rax
mov eax, dword [rsp + 0x3c]
shl rax, 0x20
add rax, rdx
mov qword [r12 + 0x10], rax
mov rax, r12
add rsp, 0x78
pop rbx
pop rsi
pop r12
pop r13
ret
test rbx, rbx
je 0x4966d4
call method.boost::system.system_category__
pxor xmm0, xmm0
mov dword [rbx], 1
mov qword [rbx + 8], rax
mov rax, r12
mov qword [r12 + 0x10], 0
movups xmmword [r12], xmm0
add rsp, 0x78
pop rbx
pop rsi
pop r12
pop r13
ret
mov ecx, 0x50
lea r13, [rsp + 0x50]
call sym.__cxa_allocate_exception
mov r12, rax
call method.boost::system.system_category__
lea rdx, str.boost::filesystem::space
mov rcx, r13
mov rbx, rax
call fcn.0085be40
mov rcx, r12
lea r9, [rsp + 0x20]
mov r8, rsi
mov rdx, r13
mov qword [rsp + 0x20], 1
mov qword [rsp + 0x28], rbx
call sym._ZN5boost10filesystem16filesystem_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKNS0_4pathENS_6system10error_
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
cmp rcx, rax
je 0x496732
call sym.operator_delete_void_
lea r8, [sym.boost::filesystem::filesystem_error::filesystem_error__]
lea rdx, [0x0093d330]
mov rcx, r12
call sym.__cxa_throw
mov r13, rax
mov rcx, r12
call sym.__cxa_free_exception
mov rcx, r13
call sym._Unwind_Resume
nop
nop dword [rax]