joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140183430
Capabilities:
Check if file exists

Disassembly:
mov edx, 1
mov r8d, 0x80000000
jmp fcn.140183440

Function at 0x140183440
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov ebp, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x1402cdfe0]
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x216
call fcn.1400e1900
xor ebx, ebx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140061fe0
cmp byte [rdi + 0x17], 0
jns 0x1401834c2
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14018354e
test al, 0x10
cmove esi, ebp
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], rax
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, esi
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], r14
mov rcx, rbx
mov rdx, rax
call fcn.1400ce330
mov rax, qword [rbx]
inc rax
test rax, 0xfffffffffffffffe
setne bl
cmp rax, 2
jb 0x14018354e
call fcn.1400e1920
mov rcx, qword [rsp + 0x40]
call fcn.1400d9a60
lea rcx, [rsp + 0x60]
call fcn.140062060
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140110970
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140183580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [0x1402cdfe0]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.DirectoryExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x235
call fcn.1400e1900
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140061fe0
cmp byte [rdi + 0x17], 0
jns 0x1401835f2
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.140062060
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140110970
mov eax, edi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x140183640
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1401496f0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x1401836df
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.140131e24
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.1400e1b10
lea r14, [rsp + 0x48]
mov rcx, rbx
mov rdx, r14
call fcn.1401914c0
mov rcx, rsi
mov rdx, r14
call fcn.14006c4f0
mov rcx, r14
call fcn.14006c480
mov rcx, rbx
call fcn.14006c480
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140110970
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1401845a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x1402cdfe0]
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, [0x1402e8154]
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x401
call fcn.1400e1900
xor r12d, r12d
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140061fe0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [r15], rax
cmp byte [rbx + 0x17], 0
jns 0x140184632
mov rbx, qword [rbx]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov rcx, rbx
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r14, [rsp + 0x40]
mov qword [r14], r12
mov rcx, r14
mov rdx, rax
call fcn.1400ce330
mov ebx, 0xffffffff
mov rcx, qword [r14]
test esi, esi
js 0x1401846c1
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1401846c1
lea rbx, [rsp + 0x3c]
mov dword [rbx], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rbx]
xor edx, edx
cmp eax, 1
sbb edx, edx
cmp ecx, esi
mov ebx, 0xffffffff
cmove ebx, ecx
or ebx, edx
mov rcx, qword [rsp + 0x40]
inc rcx
cmp rcx, 2
jb 0x1401846d9
call fcn.1400e1920
mov rcx, qword [rsp + 0x40]
call fcn.1400d9a60
lea rcx, [rsp + 0x60]
call fcn.140062060
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140110970
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140184710
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2b8
mov rsi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
movaps xmm0, xmmword [0x1402cdfe0]
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, [0x1402e815e]
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0xa0]
mov rcx, rbx
mov r9d, 0x43a
call fcn.1400e1900
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140061fe0
lea rbx, [rsp + 0xa0]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1401496f0
mov word [rbx], 0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
dec edi
cmp edi, 0x103
ja 0x140184804
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.140131e24
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.1400e1b10
lea r14, [rsp + 0x48]
mov rcx, rbx
mov rdx, r14
call fcn.1401914c0
mov rcx, rsi
mov rdx, r14
call fcn.14006c4f0
mov rcx, r14
call fcn.14006c480
mov rcx, rbx
call fcn.14006c480
cmp edi, 0x104
setb bl
lea rcx, [rsp + 0x60]
call fcn.140062060
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140110970
mov eax, ebx
add rsp, 0x2b8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140184840
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [0x1402cdfe0]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, [0x1402e8173]
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x44a
call fcn.1400e1900
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140061fe0
cmp byte [rdi + 0x17], 0
jns 0x1401848b2
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov rcx, rsi
call fcn.140062060
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140110970
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret

Function at 0x140184900
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm6, xmmword [0x1402cdfe0]
lea r14, [rsp + 0x50]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.DoCopyFile
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x89
call fcn.1400e1900
xor ebp, ebp
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140061fe0
mov rcx, rdi
call fcn.1400e1c30
test al, al
jne 0x1401849ac
mov rcx, rsi
call fcn.1400e1c30
test al, al
jne 0x1401849aa
cmp byte [rdi + 0x17], 0
jns 0x1401849ee
cmp qword [rdi + 8], 0x103
jbe 0x1401849ee
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.140062060
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140110970
mov eax, ebp
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebp, ebp
lea rcx, [rsp + 0x20]
call fcn.140081340
jmp 0x1401849ac
cmp byte [rsi + 0x17], 0
jns 0x1401849fe
cmp qword [rsi + 8], 0x103
ja 0x1401849aa
lea r14, [rsp + 0x20]
movaps xmmword [r14], xmm6
lea rdx, str.DoCopyFile
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, ILFree
call fcn.1400e1900
lea r8, [0x140361ddc]
mov rcx, r14
mov rdx, r15
call fcn.140081210
cmp byte [rsi + 0x17], 0
jns 0x140184a43
mov rsi, qword [rsi]
movzx r8d, bl
cmp byte [rdi + 0x17], 0
jns 0x140184a50
mov rdi, qword [rdi]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1401849e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bpl
sete cl
test al, 1
sete dl
or dl, cl
jne 0x1401849e2
and eax, 0xfffffffe
mov rcx, rsi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bpl, 1
jmp 0x1401849e2
Function at 0x140184ca0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x568
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x560], rax
lea r14, [rsp + 0x298]
mov r8d, 0x2c8
mov rcx, r14
mov dl, 0xaa
call fcn.1401496f0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor ebp, ebp
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.1401850d0
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1402cdfe0]
movaps xmmword [rdi], xmm0
mov rcx, r14
mov rdx, rdi
call fcn.14005dce0
movsx rax, byte [rdi + 0x17]
test rax, rax
jns 0x140184d3d
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140184e95
lea r14, [rsp + 0x48]
lea r15, [rsp + 0x298]
mov rsi, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r12, qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor r13d, r13d
jmp 0x140184e3e
mov rcx, rdi
mov rdx, qword [rsp + 0x28]
mov r8b, 1
call fcn.140184ca0
mov ebp, eax
test eax, eax
jne 0x140184df9
cmp byte [rsp + 0x47], 0
mov rcx, rdi
jns 0x140184d8e
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
jmp 0x140184dd3
mov edx, dword [rsp + 0x48]
cmp byte [rsp + 0x47], 0
mov rcx, rdi
jns 0x140184dae
mov rcx, qword [rsp + 0x30]
and edx, 0xfffffffe
call r12
mov rcx, r14
call fcn.140184ff0
test al, al
jne 0x140184def
cmp byte [rsp + 0x47], 0
mov rcx, rdi
jns 0x140184dcf
mov rcx, qword [rsp + 0x30]
call rsi
xor ebp, ebp
test eax, eax
jne 0x140184df9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
jmp 0x140184df9
xor ebp, ebp
test bl, bl
jne 0x140184d69
test r13d, r13d
cmovne ebp, r13d
mov rcx, r14
call fcn.14014a4d0
mov rcx, r15
mov rdx, r14
call fcn.14005dce0
mov rcx, rdi
mov rdx, r14
call fcn.14006c4f0
mov rcx, r14
call fcn.14006c480
movsx rax, byte [rsp + 0x47]
test rax, rax
jns 0x140184e36
mov rax, qword [rsp + 0x38]
mov r13d, ebp
test rax, rax
je 0x140184e95
mov r8d, 0x250
mov rcx, r14
mov dl, 0xaa
call fcn.1401496f0
mov rcx, r15
mov rdx, r14
call fcn.1401852a0
mov edx, dword [rsp + 0x48]
test dl, 1
je 0x140184db4
test bl, bl
jne 0x140184d9f
mov rcx, r14
call fcn.140184ff0
test al, al
je 0x140184d9b
mov rcx, r14
call fcn.140184ff0
xor ebp, ebp
test al, al
jne 0x140184df9
jmp 0x140184dc0
lea rcx, [rsp + 0x30]
call fcn.14006c480
lea rcx, [rsp + 0x298]
call fcn.140185230
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.140110970
mov eax, ebp
add rsp, 0x568
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140185b50
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x260], rax
movzx ebp, word [rcx + 0x28]
movzx r12d, word [rcx + 0x2a]
mov r15, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call r15
mov r14d, eax
movzx r13d, word [rdi + 0x2a]
movzx eax, word [rdi + 0x28]
mov dword [rsp + 0x40], eax
call r15
mov word [rsp + 0x3e], ax
lea r15, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.1401496f0
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebp
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r15
call fcn.140185e00
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140185c56
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140185c56
mov r8d, dword [rsp + 0x44]
test r8d, r8d
je 0x140185c56
dec r8d
mov rcx, rsi
call fcn.1400dc410
mov sil, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140110970
mov eax, esi
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r15, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.1401496f0
movzx eax, r14w
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r15
call fcn.140185e00
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140185cd7
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140185cd7
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x140185c22
lea r14, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1401496f0
mov qword [rsp + 0x30], rbx
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
call fcn.140185e00
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r14
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140185d5b
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140185d5b
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x140185c22
lea r14, [rsp + 0x50]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1401496f0
movzx eax, word [rsp + 0x3e]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
call fcn.140185e00
lea rbx, [rsp + 0x48]
mov qword [rbx], 0
lea r15, [rsp + 0x44]
mov dword [r15], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, r14
mov r8, rbx
mov r9, r15
call sub.VERSION.dll_VerQueryValueW
test eax, eax
sete al
mov rdx, qword [rbx]
test rdx, rdx
sete cl
mov r8d, dword [r15]
test r8d, r8d
sete r9b
or r9b, cl
or r9b, al
cmp r9b, 1
jne 0x140185c22
xor esi, esi
jmp 0x140185c30
Function at 0x140186460
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x1402cdfe0]
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.MoveUnsafe
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x20]
mov rcx, r15
mov r9d, 0x4e2
call fcn.1400e1900
xor ebx, ebx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140061fe0
mov al, byte [rdi + 0x17]
test al, al
jns 0x140184b38
cmp qword [rdi + 8], 0x103
ja 0x140184b4b
mov cl, byte [rsi + 0x17]
test cl, cl
jns 0x140184b77
cmp qword [rsi + 8], 0x103
jbe 0x140184b77
xor ebx, ebx
lea rcx, [rsp + 0x40]
call fcn.140062060
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140110970
mov eax, ebx
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdx, rsi
test cl, cl
jns 0x140184b81
mov rdx, qword [rsi]
mov rcx, rdi
test al, al
jns 0x140184b8b
mov rcx, qword [rdi]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x140184b4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, rdi
call fcn.140183580
test al, al
jne 0x140184bbb
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140184b49
mov rcx, rdi
mov rdx, rsi
call fcn.140184bd0
test al, al
jne 0x140184b4b
jmp 0x140184bb1
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.1400e1c30
test al, al
jne 0x140186481
mov rcx, rsi
call fcn.1400e1c30
test al, al
je 0x14018648a
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x140184ab0
Function at 0x1401869c0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0xc8], rax
test rcx, rcx
je 0x140186b56
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
xor r8d, r8d
call fcn.14012f504
movaps xmm6, xmmword [0x1402cdfe0]
lea r14, [rsp + 0x80]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.ReadStreamToSpanWithMaxSize
lea r8, str....._base_files_file_util.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x50
call fcn.1400e1900
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140061fe0
xorps xmm0, xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
mov dword [r15 + 0x30], 0
mov rcx, rbx
call fcn.140125b1c
mov ecx, eax
call fcn.1401265dc
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x140186b47
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov r14d, 0xffff
cmovg r14, rax
cmp r14, rdi
cmovae r14, rdi
inc r14
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm6
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
mov r8, r14
call qword [0x14033dc40]
xor r13d, r13d
mov ebp, 0x10000
lea r15, [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
add rcx, r13
mov edx, 1
mov r8, r14
mov r9, rbx
call fcn.14012f18c
test rax, rax
je 0x140186b5d
mov r12, rax
mov rax, rdi
sub rax, r13
cmp rax, r12
jb 0x140186b52
add r12, r13
mov rcx, rbx
call fcn.14012e9f4
test eax, eax
jne 0x140186b5a
test r13, r13
cmove r14, rbp
lea r8, [r12 + r14]
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
mov rcx, r15
call qword [0x14033dc40]
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
mov r13, r12
jmp 0x140186ae3
mov r14d, 0xffff
jmp 0x140186ab4
xor ebx, ebx
jmp 0x140186b6d
xor ebx, ebx
jmp 0x140186b8f
mov r13, r12
mov rcx, rbx
call fcn.14012ea20
test eax, eax
sete bl
mov rdi, r13
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea rcx, [rsp + 0x20]
mov r8, rdi
call qword [0x14033dc40]
lea rcx, [rsp + 0x80]
call fcn.140062060
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.140110970
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140188f60
Capabilities:
Access the windows event log
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x860
mov rsi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x858], rax
mov rdx, qword [0x140361e00]
test rdx, rdx
setne al
and al, byte [0x1403508a8]
cmp al, 1
jne 0x140189119
cmp byte [rdx + 0x17], 0
jns 0x140188faa
mov rdx, qword [rdx]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
test rax, rax
je 0x140189144
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.1400e1920
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 0x18]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x60]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x1402cdfe0]
movaps xmmword [r14], xmm0
lea rbx, [rsp + 0x80]
mov rdx, rbx
call fcn.140035580
lea r15, [rsp + 0x48]
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1400ce510
mov eax, dword [rsi + 8]
mov bp, 1
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x14018915c
cmp eax, 1
je 0x14018903a
test eax, eax
jne 0x14018903e
mov bp, 4
jmp 0x14018903e
mov bp, 2
cmp byte [rsp + 0x77], 0
jns 0x14018904a
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x48], 0
mov rcx, qword [0x140361e10]
cmp byte [rcx + 0x17], 0
jns 0x14018906b
mov rcx, qword [rcx]
lea rdx, [rsp + 0x48]
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
jne 0x14018908f
lea rcx, [rsi + 0x10]
lea rdx, str.___ERROR_GETTING_USER_SID__
mov r8d, 0x1b
call fcn.1400cdd30
mov rax, qword [rsp + 0x48]
mov r9d, dword [0x140361e0c]
movzx r8d, word [0x140361e08]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 1
mov rcx, rdi
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
jne 0x1401890ea
lea rcx, [rsi + 0x10]
lea rdx, str.___NOT_ADDED_TO_EVENTLOG__
mov r8d, 0x1a
call fcn.1400cdd30
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1401890fa
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [rsp + 0x77], 0
jns 0x14018910b
mov rcx, qword [rsp + 0x60]
call fcn.14010f42c
call fcn.1400e1920
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, rsi
call fcn.14018dbe0
mov rcx, qword [rsp + 0x858]
xor rcx, rsp
call fcn.140110970
nop
add rsp, 0x860
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsi + 0x10]
lea rdx, str.___NOT_ADDED_TO_EVENTLOG__
mov r8d, 0x1a
call fcn.1400cdd30
jmp 0x140189119
lea r12, [rsp + 0x80]
mov r8d, 0x7d8
mov rcx, r12
mov dl, 0xaa
call fcn.1401496f0
mov rcx, r12
call fcn.14008e430
mov rcx, r12
mov rdx, r15
call fcn.14021bbd0
movsx r8, byte [rsp + 0x5f]
test r8, r8
jns 0x14018919c
mov r8, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov rdx, r15
call fcn.1400d8900
cmp byte [rsp + 0x5f], 0
jns 0x14018903e
mov rcx, qword [rsp + 0x48]
call fcn.14010f42c
jmp 0x14018903e