joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140084b40
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov esi, r8d
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x68], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x48], r14
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov r9d, r8d
or r9d, 0x10009
lea rax, [rsp + 0x58]
mov qword [rax], rbx
mov qword [rsp + 0x20], rax
mov r8d, 8
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140084c20
lea rbx, [rsp + 0x58]
mov rdi, qword [rbx]
lea rcx, [rsp + 0x40]
mov qword [rcx], rdi
mov eax, esi
and eax, 0x300
mov dword [rcx + 8], eax
mov qword [rbx], r14
mov dword [rbx + 8], 0xaaaaaaaa
mov rdx, rbx
call fcn.140084ce0
cmp byte [rbx], 0
jne 0x140084c28
lea rdx, [0x1401c5a14]
xor ebx, ebx
mov rcx, rdi
mov r8d, esi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
jne 0x140084c2e
test rdi, rdi
je 0x140084bfd
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140126950
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
cmp eax, 2
cmovne ebx, eax
jmp 0x140084bfd
mov ebx, dword [rsp + 0x5c]
jmp 0x140084bef
mov ecx, 0x200
call fcn.140125e1c
mov r14, rax
mov r8d, 0x200
mov rcx, rax
xor edx, edx
call fcn.1401298e0
xorps xmm6, xmm6
lea rbx, [rsp + 0x58]
mov r15, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x58], 0x100
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, rdi
xor edx, edx
mov r8, r14
mov r9, rbx
call r15
test eax, eax
jne 0x140084ca4
mov eax, dword [rsp + 0x58]
cmp rax, 0x100
jae 0x140084cd2
cmp word [r14 + rax*2], 0
jne 0x140084cd5
mov rcx, rdi
mov rdx, r14
mov r8d, esi
call fcn.140084b40
test eax, eax
je 0x140084c5a
lea rdx, [0x1401c5a14]
mov rcx, rdi
mov r8d, esi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ebx, eax
test r14, r14
je 0x140084bef
mov rcx, r14
call fcn.140125e24
jmp 0x140084bef
int3
int3
Function at 0x140084ce0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea r9, [rsp + 0x3c]
mov dword [r9], 0
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rdx, str.SymbolicLinkValue
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x140084d41
mov byte [rsi], 0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140126950
mov rax, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
test eax, eax
jne 0x140084d8f
cmp dword [rsp + 0x3c], 6
jne 0x140084d27
mov rcx, qword [rdi]
call sub.ntdll.dll_NtDeleteKey
test eax, eax
je 0x140084d97
mov edi, eax
mov eax, dword [0x140203f10]
mov ecx, dword [0x1401f78b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140084daa
mov rax, qword [0x140203f08]
test rax, rax
je 0x140084da3
mov ecx, edi
call qword [0x140215008]
mov byte [rsi], 1
mov dword [rsi + 4], eax
jmp 0x140084d2a
mov byte [rsi], 1
mov dword [rsi + 4], 0
jmp 0x140084d2a
mov eax, 5
jmp 0x140084d8f
lea rcx, [0x140203f10]
call fcn.140125f00
cmp dword [0x140203f10], 0xffffffff
jne 0x140084d7b
lea rcx, [0x1401ce4b6]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlNtStatusToDosError
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140203f08], rax
lea rcx, [0x140203f10]
call fcn.140125f98
jmp 0x140084d7b

Function at 0x140084e10
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea r8, [rsp + 0x38]
mov dword [r8], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140084e98
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x140084e82
cmp dword [rsp + 0x38], 4
jne 0x140084e82
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140126950
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x140084e82
Function at 0x140084ea0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1058
call fcn.1401268f0
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x1050], rax
lea r14, [rsp + 0x850]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1401298e0
lea r9, [rsp + 0x4c]
mov dword [r9], 1
lea rax, [rsp + 0x48]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140084fa1
mov eax, dword [rsp + 0x4c]
cmp eax, 1
jne 0x140085002
lea rbx, [rsp + 0x850]
mov rcx, rbx
call fcn.1401486d4
mov rdi, rax
mov al, byte [rsi + 0x17]
test al, al
js 0x140084fe2
cmp rdi, 0xa
ja 0x140084fab
mov rbx, rsi
test rdi, rdi
je 0x140084f6f
mov r8, rdi
add r8, rdi
lea rdx, [rsp + 0x850]
mov rcx, rbx
call fcn.140129230
mov al, byte [rsi + 0x17]
test al, al
js 0x140084fa5
mov eax, edi
and al, 0x7f
mov byte [rsi + 0x17], al
mov word [rbx + rdi*2], 0
xor edi, edi
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140126950
mov eax, edi
add rsp, 0x1058
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x140084f82
mov qword [rsi + 8], rdi
jmp 0x140084f7a
movzx r9d, al
mov edx, 0xa
mov r8, rdi
sub r8, rdx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], 0
mov rcx, rsi
call fcn.14007da50
jmp 0x140084f80
mov r9, qword [rsi + 8]
jmp 0x140084fb4
mov rax, qword [rsi + 0x10]
mov rdx, rax
btr rdx, 0x3f
dec rdx
cmp rdx, rdi
jb 0x140084fdc
shr rax, 0x38
mov rbx, qword [rsi]
jmp 0x140084f51
cmp eax, 2
jne 0x1400850a5
lea rdi, [rsp + 0x50]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1401298e0
lea rcx, [rsp + 0x850]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x48], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x1400850af
lea rbx, [rsp + 0x50]
mov rcx, rbx
call fcn.1401486d4
mov rdi, rax
mov al, byte [rsi + 0x17]
test al, al
js 0x140085084
cmp rdi, 0xa
ja 0x140084fab
mov rbx, rsi
test rdi, rdi
je 0x140084f6f
mov r8, rdi
add r8, rdi
lea rdx, [rsp + 0x50]
jmp 0x140084f64
mov rax, qword [rsi + 0x10]
mov rdx, rax
btr rdx, 0x3f
dec rdx
cmp rdx, rdi
jb 0x140084fdc
shr rax, 0x38
mov rbx, qword [rsi]
jmp 0x14008506b
mov edi, 0x3f4
jmp 0x140084f82
mov edi, 0xea
jmp 0x140084f82

Function at 0x1400850c0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.1401486d4
lea eax, [rax*2 + 2]
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140086170
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r9d
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
test rcx, rcx
setne bpl
mov r13d, dword [rsp + 0xd0]
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x60], rax
shl ebp, 0x10
mov ecx, SafeArrayCopy
call fcn.140125da0
mov rsi, rax
movabs r12, 0xfffffffc00000000
mov rax, r15
and rax, r12
cmp rax, qword [0x1401e8ec8]
je 0x14008623e
mov qword [rsi], r15
test r14, r14
setne byte [rsi + 8]
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], r13d
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
lea r8, [0x140086630]
xor ecx, ecx
mov rdx, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140086253
test r14, r14
je 0x140086248
mov qword [r14], rdi
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140126950
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
call fcn.1400d2680
jmp 0x1400861d5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140086218
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x14008626c
mov ebp, eax
cmp eax, 0x5af
je 0x14008626c
cmp ebp, 0xe
jne 0x140086297
mov rcx, rbx
call fcn.140163970
test rsi, rsi
je 0x140086218
mov rcx, qword [rsi]
and r12, rcx
cmp r12, qword [0x1401e8ec8]
jne 0x14008628d
call fcn.1400d27d0
mov rcx, rsi
call fcn.140125ddc
jmp 0x140086218
mov eax, dword [0x140203fb0]
mov ecx, dword [0x1401f78b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008631a
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov edx, ebp
call fcn.1400929d0
movzx r8d, byte [rbx + 0x17]
test r8b, r8b
js 0x1400862d7
and r8d, 0x7f
jmp 0x1400862e1
mov r8, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
lea r14, [rsp + 0x50]
mov rcx, r14
mov rdx, rbx
call fcn.1400cacb0
mov rcx, qword [0x140203fa8]
mov rdx, r14
call fcn.1400a3e90
cmp byte [rsp + 0x4f], 0
jns 0x140086274
mov rcx, qword [rsp + 0x38]
call fcn.140125ddc
jmp 0x140086274
lea rcx, [0x140203fb0]
call fcn.140125f00
cmp dword [0x140203fb0], 0xffffffff
jne 0x1400862b8
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.1400a3e60
mov qword [0x140203fa8], rax
lea rcx, [0x140203fb0]
call fcn.140125f98
jmp 0x1400862b8

Function at 0x1400883b0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x1400883f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140088411
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400883ef
mov qword [rsi], rdi
call fcn.1400f2160
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140088427
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400f2160
mov rcx, qword [rsi]
call fcn.1400db920
mov qword [rsi], 0
jmp 0x1400883dd
int3
Function at 0x140088430
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r14, qword [rdx]
mov qword [rdx], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14008845a
call fcn.1400f2160
mov qword [rsi], 0
test r14, r14
je 0x140088490
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400884cb
cmp r15, 2
jb 0x140088488
mov qword [rsi], r14
call fcn.1400f2160
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400884b5
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400f2160
mov rcx, qword [rdi]
call fcn.1400db920
mov qword [rdi], 0
jmp 0x1400884a6
call fcn.1400f2160
mov rcx, qword [rsi]
call fcn.1400db920
mov qword [rsi], 0
jmp 0x14008847a
Function at 0x140089c50
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call fcn.1400a5b90
mov byte [rsi + 8], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
lea rax, [0x1401bf1a0]
mov qword [rsi], rax
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp qword [rsi + 0x18], rax
je 0x140089cc5
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x140089cd0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140089cbd
mov qword [rsi + 0x18], rdi
call fcn.1400f2160
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400f2160
mov rcx, qword [rsi + 0x18]
call fcn.1400db920
mov qword [rsi + 0x18], 0
jmp 0x140089caa
Function at 0x14008a1f0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x40], rax
movaps xmm0, xmmword [0x1401bc9e0]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.DoInitialize
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x171
call fcn.1400f2140
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400e51a0
mov eax, ebx
and eax, 1
neg eax
and eax, 3
test bl, 2
mov edx, 1
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov r8d, 2
cmove r8d, edx
test bl, 0x10
mov eax, 5
cmove eax, r8d
test eax, eax
je 0x14008a46a
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov r8d, ebx
rol r8d, 0x1a
and r8d, 0x80000100
or r8d, ecx
bt ebx, 0x12
jb 0x14008a43f
mov edx, ebx
shr edx, 4
and edx, 0x10000
or edx, r8d
mov ecx, ebx
shr ecx, 8
and ecx, 3
mov r8d, ebx
shr r8d, 0xd
and r8d, 4
or r8d, ecx
xor r8d, 3
mov r15d, ebx
and r15d, 0x400
mov ecx, r15d
shl ecx, 0x14
mov r9d, ebx
shr r9d, 3
and r9d, 0x100
or r9d, ecx
mov ecx, ebx
shr ecx, 0xb
and ecx, 2
or ecx, r9d
mov r10d, ebx
shl r10d, 0xd
and r10d, 0x4000000
or r10d, ecx
mov r9d, ebx
shl r9d, 8
and r9d, 0xa000000
or r9d, r10d
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x14008a361
mov rcx, qword [rdi]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x30], 0
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp qword [rsi], rax
je 0x14008a3bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14008a451
mov rax, r14
inc rax
cmp rax, 2
jb 0x14008a3b0
mov qword [rsi], r14
call fcn.1400f2160
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsi]
inc r14
cmp r14, 2
jb 0x14008a412
shr r15d, 0xa
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x29], r15b
test bl, 4
jne 0x14008a424
test bl, 0xa
je 0x14008a3e1
mov byte [rsi + 0x28], 1
bt ebx, 0x15
jb 0x14008a435
lea rcx, [rsp + 0x60]
call fcn.1400e5410
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140126950
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14008a0f0
mov dword [rsi + 0x24], eax
jmp 0x14008a3e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [rsi + 0x28]
jmp 0x14008a3e1
mov rcx, rdi
call fcn.14008b910
jmp 0x14008a3e7
bt ebx, 0x15
jb 0x14008a486
or r8d, 0x20000000
jmp 0x14008a2df
call fcn.1400f2160
mov rcx, qword [rsi]
call fcn.1400db920
mov qword [rsi], 0
jmp 0x14008a39c
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsi + 0x24], 0xffffffff
call fcn.1401936c0
jmp 0x14008a3e7
int3
Function at 0x14008a860
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x450]
mov qword [r14 + 0x40], rax
movaps xmm0, xmmword [0x1401bc9e0]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, [0x1401ce9c1]
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x240]
mov rcx, r15
mov r9d, 0x1d6
call fcn.1400f2140
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400e51a0
lea r14, [rsp + 0x240]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1401298e0
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14008a910
mov rdx, qword [rbx]
mov r8d, 0x104
mov rcx, r14
call fcn.1400e9910
mov rcx, r14
call fcn.1400c9a70
lea r14, [rsp + 0x30]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1401298e0
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x14008a947
mov rdx, qword [rdi]
mov r8d, 0x104
mov rcx, r14
call fcn.1400e9910
mov rcx, r14
call fcn.1400c9a70
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14008a969
mov rdx, qword [rbx]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x14008a975
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x14008a9fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14008a0f0
mov ebp, eax
cmp byte [rdi + 0x17], 0
jns 0x14008a9a8
mov rdi, qword [rdi]
cmp byte [rbx + 0x17], 0
jns 0x14008a9b1
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dil
test rsi, rsi
je 0x14008a9cc
test eax, eax
je 0x14008aa00
lea rcx, [rsp + 0x450]
call fcn.1400e5410
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.140126950
mov eax, edi
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dil, 1
jmp 0x14008a9cc
cmp ebp, 0xfffffffc
jne 0x14008aa0c
call fcn.14018d280
mov ebp, eax
mov dword [rsi], ebp
xor edi, edi
jmp 0x14008a9cc

Function at 0x14008aa20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x40], rax
movaps xmm0, xmmword [0x1401bc9e0]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x209
call fcn.1400f2140
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1400e51a0
cmp byte [rdi + 0x17], 0
jns 0x14008aaa0
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.1400e5410
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140126950
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x14008aae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov ebp, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x40], rax
movaps xmm0, xmmword [0x1401bc9e0]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x212
call fcn.1400f2140
xor ebx, ebx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400e51a0
cmp byte [rdi + 0x17], 0
jns 0x14008ab70
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14008ac03
test al, 0x10
cmove esi, ebp
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
xor r14d, r14d
mov rcx, rdi
mov edx, esi
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x14008abe6
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp rdi, 0xffffffffffffffff
je 0x14008ac2f
call fcn.1400f2160
mov r14, rdi
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
setne bl
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14008ac03
call fcn.1400f2160
mov rcx, r14
call fcn.1400db920
lea rcx, [rsp + 0x60]
call fcn.1400e5410
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140126950
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor r14d, r14d
jmp 0x14008abde

Function at 0x14008ac40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x40], rax
movaps xmm0, xmmword [0x1401bc9e0]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.DirectoryExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x231
call fcn.1400f2140
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1400e51a0
cmp byte [rdi + 0x17], 0
jns 0x14008acc0
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.1400e5410
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140126950
mov eax, edi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x14008ad00
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1401298e0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14008ad9f
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.1401486d4
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.1400f2c10
lea r14, [rsp + 0x48]
mov rcx, rbx
mov rdx, r14
call fcn.14009ac50
mov rcx, rsi
mov rdx, r14
call fcn.1400f2dd0
mov rcx, r14
call fcn.1400f2d50
mov rcx, rbx
call fcn.1400f2d50
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140126950
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14008add0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1401298e0
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14008ae7e
cmp word [rsp + 0x70], 0
je 0x14008ae7e
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.1401486d4
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.1400f2c10
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140126950
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400f2bf0
lea rcx, [rsp + 0x40]
call fcn.1400f2d50
jmp 0x14008ae47
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1401bc9e0]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.1400f2ae0
mov rcx, rdi
call fcn.14008ad00
test al, al
jne 0x14008ae65
lea rax, [0x1401ca4b6]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.1400f2c10
jmp 0x14008ae72