joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402096f0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x40], rax
movaps xmm0, xmmword [0x1403df810]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.DoInitialize
lea r8, str........._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x173
call fcn.140317d20
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14030e910
mov eax, ebx
and eax, 1
neg eax
and eax, 3
test bl, 2
mov edx, 1
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov r8d, 2
cmove r8d, edx
test bl, 0x10
mov eax, 5
cmove eax, r8d
test eax, eax
je 0x14020996a
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov r8d, ebx
rol r8d, 0x1a
and r8d, 0x80000100
or r8d, ecx
bt ebx, 0x12
jb 0x14020993f
mov edx, ebx
shr edx, 4
and edx, 0x10000
or edx, r8d
mov ecx, ebx
shr ecx, 8
and ecx, 3
mov r8d, ebx
shr r8d, 0xd
and r8d, 4
or r8d, ecx
xor r8d, 3
mov r15d, ebx
and r15d, 0x400
mov ecx, r15d
shl ecx, 0x14
mov r9d, ebx
shr r9d, 3
and r9d, 0x100
or r9d, ecx
mov ecx, ebx
shr ecx, 0xb
and ecx, 2
or ecx, r9d
mov r10d, ebx
shl r10d, 0xd
and r10d, 0x4000000
or r10d, ecx
mov r9d, ebx
shl r9d, 8
and r9d, 0xa000000
or r9d, r10d
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x140209861
mov rcx, qword [rdi]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x30], 0
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp qword [rsi], rax
je 0x1402098bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140209951
mov rax, r14
inc rax
cmp rax, 2
jb 0x1402098b0
mov qword [rsi], r14
call fcn.140317d40
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsi]
inc r14
cmp r14, 2
jb 0x140209923
shr r15d, 0xa
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x29], r15b
test bl, 4
jne 0x140209912
test bl, 0xa
je 0x1402098e1
mov byte [rsi + 0x28], 1
bt ebx, 0x15
jb 0x140209935
lea rcx, [rsp + 0x60]
call fcn.14030eb40
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140334bf0
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [rsi + 0x28]
jmp 0x1402098e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1402095b0
mov dword [rsi + 0x24], eax
jmp 0x1402098e7
mov rcx, rdi
call fcn.14020acf0
jmp 0x1402098e7
bt ebx, 0x15
jb 0x140209986
or r8d, 0x20000000
jmp 0x1402097df
call fcn.140317d40
mov rcx, qword [rsi]
call fcn.14030bac0
mov qword [rsi], 0
jmp 0x14020989c
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsi + 0x24], 0xffffffff
call fcn.14038e8c0
jmp 0x1402098e7
int3
Function at 0x140209e20
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x450]
mov qword [r14 + 0x40], rax
movaps xmm0, xmmword [0x1403df810]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, [0x1403e5479]
lea r8, str........._base_files_file_util_win.cc
lea r15, [rsp + 0x240]
mov rcx, r15
mov r9d, 0x1cc
call fcn.140317d20
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14030e910
lea r14, [rsp + 0x240]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1403369a0
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x140209ed0
mov rdx, qword [rbx]
mov r8d, 0x104
mov rcx, r14
call fcn.140310ad0
mov rcx, r14
call fcn.1402ff350
lea r14, [rsp + 0x30]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1403369a0
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x140209f07
mov rdx, qword [rdi]
mov r8d, 0x104
mov rcx, r14
call fcn.140310ad0
mov rcx, r14
call fcn.1402ff350
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x140209f29
mov rdx, qword [rbx]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x140209f35
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x140209fbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1402095b0
mov ebp, eax
cmp byte [rdi + 0x17], 0
jns 0x140209f68
mov rdi, qword [rdi]
cmp byte [rbx + 0x17], 0
jns 0x140209f71
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dil
test rsi, rsi
je 0x140209f8c
test eax, eax
je 0x140209fc0
lea rcx, [rsp + 0x450]
call fcn.14030eb40
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.140334bf0
mov eax, edi
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dil, 1
jmp 0x140209f8c
cmp ebp, 0xfffffffc
jne 0x140209fcc
call fcn.140389c20
mov ebp, eax
mov dword [rsi], ebp
xor edi, edi
jmp 0x140209f8c

Function at 0x140209fe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x40], rax
movaps xmm0, xmmword [0x1403df810]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str........._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1ff
call fcn.140317d20
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14030e910
cmp byte [rdi + 0x17], 0
jns 0x14020a060
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.14030eb40
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140334bf0
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x14020a0a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x40], rax
movaps xmm0, xmmword [0x1403df810]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.DirectoryExists
lea r8, str........._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x227
call fcn.140317d20
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14030e910
cmp byte [rdi + 0x17], 0
jns 0x14020a120
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.14030eb40
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140334bf0
mov eax, edi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x14020a160
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1403369a0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14020a1ff
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.14035ad74
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.1403188f0
lea r14, [rsp + 0x48]
mov rcx, rbx
mov rdx, r14
call fcn.1402159d0
mov rcx, rsi
mov rdx, r14
call fcn.140318a90
mov rcx, r14
call fcn.140318a80
mov rcx, rbx
call fcn.140318a80
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140334bf0
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14020a230
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1403369a0
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14020a2c5
cmp word [rsp + 0x70], 0
je 0x14020a2c5
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.14035ad74
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.1403188f0
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140334bf0
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1403df810]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.1403187c0
mov rcx, rdi
call fcn.14020a160
test al, al
je 0x14020a305
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1403188d0
jmp 0x14020a324
lea rax, [0x1403e5486]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.1403188f0
lea rcx, [rsp + 0x40]
call fcn.140318a80
jmp 0x14020a2a7
Function at 0x14020aca0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x24]
mov dword [r8], 1
movsxd rcx, ecx
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140334bf0
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14020b080
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x568
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x560], rax
lea r14, [rsp + 0x298]
mov r8d, 0x2c8
mov rcx, r14
mov dl, 0xaa
call fcn.1403369a0
mov qword [rsp + 0x20], rsi
xor ebp, ebp
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.14020b310
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1403df810]
movaps xmmword [rdi], xmm0
mov rcx, r14
mov rdx, rdi
call fcn.14020b4d0
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x14020b116
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14020b250
lea r14, [rsp + 0x48]
lea r15, [rsp + 0x298]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r13d, r13d
mov r8d, 0x250
mov rcx, r14
mov dl, 0xaa
call fcn.1403369a0
mov rcx, r15
mov rdx, r14
call fcn.14020b480
mov edx, dword [rsp + 0x48]
test dl, 1
je 0x14020b199
test bl, bl
jne 0x14020b181
mov rcx, r14
call fcn.14020b2e0
test al, al
je 0x14020b17d
mov rcx, r14
call fcn.14020b2e0
xor ebp, ebp
test al, al
je 0x14020b1db
jmp 0x14020b209
mov edx, dword [rsp + 0x48]
and edx, 0xfffffffe
cmp byte [rsp + 0x47], 0
mov rcx, rdi
jns 0x14020b193
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, r14
call fcn.14020b2e0
test al, al
je 0x14020b1db
xor ebp, ebp
test bl, bl
je 0x14020b209
mov rcx, rdi
mov rdx, rsi
mov r8b, 1
call fcn.14020b080
mov ebp, eax
test eax, eax
jne 0x14020b209
cmp byte [rsp + 0x47], 0
mov rcx, rdi
jns 0x14020b1ce
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
jmp 0x14020b1ef
cmp byte [rsp + 0x47], 0
mov rcx, rdi
jns 0x14020b1ea
mov rcx, qword [rsp + 0x30]
call r12
xor ebp, ebp
test eax, eax
jne 0x14020b209
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
test r13d, r13d
cmovne ebp, r13d
mov rcx, r14
call fcn.1401f1190
mov rcx, r15
mov rdx, r14
call fcn.14020b4d0
mov rcx, rdi
mov rdx, r14
call fcn.140318a90
mov rcx, r14
call fcn.140318a80
movzx eax, byte [rsp + 0x47]
test al, al
jns 0x14020b244
mov rax, qword [rsp + 0x38]
mov r13d, ebp
test rax, rax
jne 0x14020b136
lea rcx, [rsp + 0x30]
call fcn.140318a80
lea rcx, [rsp + 0x298]
call fcn.14020b410
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.140334bf0
mov eax, ebp
add rsp, 0x568
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14020be20
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x260], rax
movzx ebp, word [rcx + 0x28]
movzx r12d, word [rcx + 0x2a]
mov r15, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call r15
mov r14d, eax
movzx r13d, word [rdi + 0x2a]
movzx eax, word [rdi + 0x28]
mov dword [rsp + 0x40], eax
call r15
mov word [rsp + 0x3e], ax
lea r15, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.1403369a0
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebp
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r15
call fcn.14020c0c0
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14020bf26
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14020bf26
mov r8d, dword [rsp + 0x44]
test r8d, r8d
je 0x14020bf26
dec r8d
mov rcx, rsi
call fcn.1403067e0
mov sil, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140334bf0
mov eax, esi
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r15, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.1403369a0
movzx eax, r14w
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r15
call fcn.14020c0c0
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14020bfa7
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14020bfa7
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x14020bef2
lea r14, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1403369a0
mov qword [rsp + 0x30], rbx
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
call fcn.14020c0c0
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14020c02b
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14020c02b
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x14020bef2
lea r14, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1403369a0
movzx eax, word [rsp + 0x3e]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
call fcn.14020c0c0
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14020c0b0
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14020c0b0
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x14020bef2
xor esi, esi
jmp 0x14020bf00
Function at 0x140212ba0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x14041ee08], 0
jne 0x140212c6d
mov rdi, qword [0x14041ede0]
test rdi, rdi
je 0x140212c8a
test byte [reloc.WS2_32.dll_accept], 1
je 0x140212c6d
cmp byte [rdi + 0x17], 0
jns 0x140212bf3
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14041ee08], rax
inc rax
cmp rax, 1
ja 0x140212c6d
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1403369a0
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x140212d50
xor esi, esi
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140334bf0
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x18
call fcn.1403336b8
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1403369a0
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x1403df810]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.14036ecf0
movzx eax, byte [rdi + 0x17]
mov rcx, rdi
test al, al
jns 0x140212cf2
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
test rax, rax
jne 0x140212d18
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rdi
call fcn.140202620
mov qword [0x14041ede0], rdi
jmp 0x140212bdd
lea r8, [rax + rax]
test r8, r8
je 0x140212cf7
lea rdx, [r8 - 2]
cmp word [rcx + r8 - 2], 0x5c
mov r8, rdx
jne 0x140212d1c
cmp rdx, 0xfffffffffffffffe
je 0x140212cf7
sar rdx, 1
cmp rax, rdx
jbe 0x140212e36
inc rdx
mov rcx, rdi
call fcn.140371690
jmp 0x140212cf7
mov rdi, qword [0x14041ede0]
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.14035ad74
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.140202270
mov rcx, qword [0x14041ede0]
movzx eax, byte [rcx + 0x17]
test al, al
jns 0x140212e29
mov rax, qword [rcx + 8]
test rax, rax
je 0x140212e3e
mov rdx, qword [rcx]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x140212db6
lea rdx, [0x1403e1760]
mov r8d, 1
call fcn.140202620
mov rcx, qword [0x14041ede0]
lea rdx, str.debug.log
mov r8d, 9
call fcn.140202620
mov rcx, qword [0x14041ede0]
cmp byte [rcx + 0x17], 0
jns 0x140212dd8
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14041ee08], rax
inc rax
cmp rax, 1
ja 0x140212c6d
mov qword [0x14041ee08], 0
jmp 0x140212c6b
test rax, rax
je 0x140212e3e
mov rdx, rcx
jmp 0x140212d95
mov rcx, rdi
call fcn.14036f3f0
lea rax, str.string::back__:_string_is_empty
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str........._buildtools_third_partylibc_trunkinclude_string
lea r9, str._empty__
mov r8d, 0x502
call fcn.14036f7d0
int3
Function at 0x140215d50
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.14030c4b0
mov qword [rsi], 0
test rax, rax
je 0x140215da3
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140215dd7
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140215d9b
mov qword [rsi], rbx
call fcn.140317d40
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.1403187e0
lea rcx, [rsi + 0x20]
call fcn.140320d40
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.140317d40
mov rcx, qword [rsi]
call fcn.14030bac0
mov qword [rsi], 0
jmp 0x140215d89

Function at 0x1402163d0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x14041eec0]
test rdi, rdi
jne 0x140216483
mov ecx, 0x50
call fcn.1403336b8
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.1403336b8
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x1402164a5
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x14041eec0], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1402164d1
mov rcx, rax
call fcn.14035ad74
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.1402164e0
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140334bf0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str........._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.14036f7d0
int3
Function at 0x1402164e0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14040b018]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.140208f00
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x14021666c
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, [0x1403e6ad8]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x1402166bd
lea rdx, [0x1403e6b28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1402166d0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [case.0x1403339d6.0]
mov r14, rax
movsxd r12, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test r12, r12
je 0x1402166d8
shl r12, 3
movabs rax, 0x5555555555555551
cmp r12, rax
jae 0x1402166e2
lea r15, [r12 + r12*2]
mov rcx, r15
call fcn.1403336b8
mov rbx, rax
mov qword [rsp + 0x30], rax
add rax, r15
mov qword [rsp + 0x40], rax
xor r13d, r13d
mov r15, rbx
test r15, r15
je 0x140216691
mov rdx, qword [r14 + r13]
mov rcx, r15
call fcn.14036ecf0
add r15, 0x18
add r13, 8
cmp r12, r13
jne 0x1402165ec
mov qword [rsp + 0x38], r15
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1402161f0
movups xmmword [rsi], xmm6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x14021663a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x14021666c
cmp r15, rbx
jne 0x140216651
jmp 0x140216664
mov rcx, qword [r15 - 0x18]
call fcn.1403336f4
jmp 0x14021665c
lea rsi, [r15 - 0x18]
cmp byte [r15 - 1], 0
js 0x140216646
mov r15, rsi
cmp rsi, rbx
jne 0x140216651
mov rcx, rbx
call fcn.1403336f4
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140334bf0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str........._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.14036f7d0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x140216591
xor r14d, r14d
jmp 0x140216594
xor r15d, r15d
xor ebx, ebx
jmp 0x140216613
lea rcx, [rsp + 0x30]
call fcn.14036f740
int3