joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140218c00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x140218c25
cvtsi2ss xmm0, rdx
jmp 0x140218c3a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.140338164
movss xmm1, dword [0x14048ccf0]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140218c68
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140218c68
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140218c9a
cmp rbx, 0x200
jae 0x140218c97
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x140218c9a
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140218690
Function at 0x14021a850
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r10, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
mov r8, qword [r9 + 8]
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, r8
je 0x14021a910
mov rcx, qword [r10]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x14021a8ff
nop word [rax + rax]
cmp rax, rdx
je 0x14021a910
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x14021a8f0
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x14021a910
mov rax, qword [rax + 0x18]
ret
xor eax, eax
ret
Function at 0x14021ce50
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14021d033
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140216f60
mov rcx, qword [rsi + 8]
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x14021cff8
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x14021cf6c
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x14021cfe7
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x14021cfa9
mov r10, qword [rax]
cmp r10, rcx
je 0x14021cfa3
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x14021cfe7
mov r8, rax
cmp r10, rax
je 0x14021cfc3
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x14021d00d
cmp r10, rax
jne 0x14021cfb1
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x14021cef0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x14021cfe7
lea rcx, [0x1404a1680]
call fcn.14031f248
int3
Function at 0x1402204e0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, r8
mov rcx, qword [rcx]
mov rsi, rdx
cmp qword [r8 + 0x50], rcx
je 0x140220510
lea r9, str.Field_does_not_match_message_type.
mov rdx, rdi
lea r8, str.GetEnumValue
call fcn.140223350
cmp dword [rdi + 0x3c], 3
jne 0x14022052f
mov rcx, qword [rbx]
lea r9, str.Field_is_repeated__the_method_requires_a_singular_field.
lea r8, str.GetEnumValue
mov rdx, rdi
call fcn.140223350
mov rcx, rdi
call fcn.140170240
movsxd rcx, eax
lea rax, [0x14049e850]
cmp dword [rax + rcx*4], 8
je 0x14022055f
mov rcx, qword [rbx]
lea r8, str.GetEnumValue
mov r9d, 8
mov rdx, rdi
call fcn.140223430
cmp byte [rdi + 0x43], 0
je 0x140220586
mov ebx, dword [rbx + 0x28]
mov rcx, rdi
add rbx, rsi
call fcn.1402195b0
mov edx, dword [rdi + 0x44]
mov rcx, rbx
mov r8d, dword [rax + 0x10]
call fcn.14023c3b0
mov ebx, eax
jmp 0x1402205f1
mov rdx, qword [rdi + 0x58]
test rdx, rdx
je 0x1402205e0
cmp dword [rdx + 0x18], 1
jne 0x1402205a2
mov rax, qword [rdx + 0x20]
mov rcx, qword [rax]
cmp byte [rcx + 0x41], 0
jne 0x1402205e0
mov rax, qword [rdx + 0x10]
sub rdx, qword [rax + 0x30]
movabs rax, 0x2aaaaaaaaaaaaaab
imul rdx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, dword [rbx + 0x2c]
lea ecx, [rax + rdx*4]
mov eax, dword [rdi + 0x44]
cmp dword [rcx + rsi], eax
je 0x1402205e0
mov rcx, rdi
call fcn.1402195b0
mov ebx, dword [rax + 0x10]
jmp 0x1402205f1
lea rcx, [rbx + 8]
mov rdx, rdi
call fcn.1402207d0
mov edx, eax
mov ebx, dword [rdx + rsi]
mov rcx, rdi
call fcn.1402196c0
mov rcx, rax
mov edx, ebx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp 0x1402089f0
Function at 0x140234f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea ecx, [rcx*8]
lea r9, [r8 + 1]
cmp ecx, 0x80
jae 0x140234f78
mov byte [r8], cl
jmp 0x140234fbc
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [r8], al
cmp ecx, 0x80
jae 0x140234fa0
mov byte [r9], cl
lea r9, [r8 + 2]
jmp 0x140234fbc
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [r9], al
inc r9
cmp ecx, 0x80
jae 0x140234fa0
mov byte [r9], cl
inc r9
mov eax, edx
lea ecx, [rdx + rdx]
sar eax, 0x1f
lea rdx, [r9 + 1]
xor eax, ecx
cmp eax, 0x80
jae 0x140234fd8
mov byte [r9], al
mov rax, rdx
ret
movzx ecx, al
shr eax, 7
or cl, 0x80
mov byte [r9], cl
cmp eax, 0x80
jae 0x140235000
mov byte [rdx], al
lea rax, [r9 + 2]
ret
movzx ecx, al
lea rdx, [rdx + 1]
or cl, 0x80
shr eax, 7
mov byte [rdx - 1], cl
cmp eax, 0x80
jae 0x140235000
mov byte [rdx], al
lea rax, [rdx + 1]
ret

Function at 0x140235020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea ecx, [rcx*8]
lea r9, [r8 + 1]
cmp ecx, 0x80
jae 0x140235038
mov byte [r8], cl
jmp 0x14023507c
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [r8], al
cmp ecx, 0x80
jae 0x140235060
mov byte [r9], cl
lea r9, [r8 + 2]
jmp 0x14023507c
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [r9], al
inc r9
cmp ecx, 0x80
jae 0x140235060
mov byte [r9], cl
inc r9
mov rax, rdx
lea rcx, [rdx + rdx]
sar rax, 0x3f
lea rdx, [r9 + 1]
xor rax, rcx
cmp rax, 0x80
jae 0x14023509d
mov byte [r9], al
mov rax, rdx
ret
movzx ecx, al
shr rax, 7
or cl, 0x80
mov byte [r9], cl
cmp rax, 0x80
jae 0x1402350c0
mov byte [rdx], al
lea rax, [r9 + 2]
ret
movzx ecx, al
lea rdx, [rdx + 1]
or cl, 0x80
shr rax, 7
mov byte [rdx - 1], cl
cmp rax, 0x80
jae 0x1402350c0
mov byte [rdx], al
lea rax, [rdx + 1]
ret
Function at 0x14023be80
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 8
mov r11, qword [0x1405d9e08]
test r11, r11
je 0x14023bfcf
mov r10, qword [rcx + 8]
mov qword [rsp + 0x10], rbx
mov rax, r10
shr rax, 8
movabs rbx, 0xcbf29ce484222325
movzx r9d, al
mov qword [rsp], rdi
movabs rdi, 0x100000001b3
movzx eax, r10b
xor rax, rbx
imul rax, rdi
xor r9, rax
mov rax, r10
shr rax, 0x10
movzx ecx, al
mov rax, r10
imul r9, rdi
shr rax, 0x18
xor r9, rcx
movzx ecx, al
imul r9, rdi
mov rax, r10
xor r9, rcx
shr rax, 0x20
movzx ecx, al
mov rax, r10
imul r9, rdi
shr rax, 0x28
xor r9, rcx
movzx ecx, al
imul r9, rdi
mov rax, r10
xor r9, rcx
shr rax, 0x30
movzx ecx, al
mov rax, r10
imul r9, rdi
shr rax, 0x38
xor r9, rcx
movzx ecx, dl
xor rcx, rbx
mov rbx, qword [rsp + 0x10]
imul rcx, rdi
imul r9, rdi
xor r9, rax
movzx eax, byte [rsp + 0x19]
xor rcx, rax
movzx eax, byte [rsp + 0x1a]
imul rcx, rdi
imul r9, rdi
xor rcx, rax
movzx eax, byte [rsp + 0x1b]
imul rcx, rdi
xor rcx, rax
imul rcx, rdi
mov rdi, qword [rsp]
xor rcx, r9
mov r9, qword [r11 + 8]
and rcx, qword [r11 + 0x30]
shl rcx, 4
add rcx, qword [r11 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, r9
je 0x14023bfcf
mov rcx, qword [rcx]
nop
cmp r10, qword [rax + 0x10]
jne 0x14023bf9b
cmp edx, dword [rax + 0x18]
je 0x14023bfa6
cmp rax, rcx
je 0x14023bfcf
mov rax, qword [rax + 8]
jmp 0x14023bf90
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x14023bfcf
add rax, 0x20
je 0x14023bfcf
movups xmm0, xmmword [rax]
movups xmmword [r8], xmm0
movups xmm1, xmmword [rax + 0x10]
mov al, 1
movups xmmword [r8 + 0x10], xmm1
add rsp, 8
ret
xor al, al
add rsp, 8
ret
Function at 0x14027e0e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rax, vtable.CFileWriterThread.0
mov rdi, rcx
mov qword [rcx], rax
movzx eax, byte [rcx + 0xe8]
test al, al
jne 0x14027e122
mov edx, 1
call fcn.1402812f0
mov rcx, rdi
call fcn.140293090
test al, al
je 0x14027e122
xor edx, edx
mov rcx, rdi
call fcn.1402936c0
lea rcx, [rdi + 0xc8]
mov dword [rdi + 0xe0], 0
call fcn.14027a430
lea rcx, [rdi + 0xc8]
call fcn.14027a430
lea rcx, [rdi + 0xb0]
call fcn.140292f20
lea rcx, [rdi + 0x70]
call fcn.14027df20
lea rcx, [rdi + 0x48]
call fcn.140292f10
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140292d20

Function at 0x14027e470
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x40
lea rax, vtable.CPathString.0
mov qword [rsp + 0x30], 0
mov rdx, rcx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.14027f9a0
lea rcx, [rsp + 0x20]
call fcn.14027f760
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14027e4c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14027e4c5
xor bl, bl
jmp 0x14027e4c7
mov bl, 1
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14027e4d6
call fcn.14031dc44
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14027e4e5
call fcn.14031dc44
movzx eax, bl
add rsp, 0x40
pop rbx
ret

Function at 0x14027e500
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140281760
test al, al
jne 0x14027e533
mov rcx, rbx
call fcn.14027e540
test al, al
je 0x14027e533
mov rcx, rbx
call fcn.1402804f0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140281760
mov al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x14027e540
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
lea rax, vtable.CPathString.0
mov qword [rsp + 0x30], 0
mov rdx, rcx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.14027f9a0
lea rcx, [rsp + 0x20]
call fcn.14027f760
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x30]
cmp eax, 0xffffffff
setne bl
test rcx, rcx
je 0x14027e593
call fcn.14031dc44
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14027e5a2
call fcn.14031dc44
movzx eax, bl
add rsp, 0x40
pop rbx
ret

Function at 0x14027e5b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
lea rax, vtable.CPathString.0
mov qword [rsp + 0x30], 0
mov rdx, rcx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.14027f9a0
lea rcx, [rsp + 0x20]
call fcn.14027f760
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14027e5fb
test al, 0x10
je 0x14027e5fb
mov bl, 1
jmp 0x14027e5fd
xor bl, bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14027e60c
call fcn.14031dc44
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14027e61b
call fcn.14031dc44
movzx eax, bl
add rsp, 0x40
pop rbx
ret
Function at 0x14027eb30
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
call fcn.1402804f0
lea rax, vtable.CPathString.0
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14027f9a0
lea rcx, [rsp + 0x20]
call fcn.14027f760
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rsp + 0x30]
test eax, eax
setne bl
test rcx, rcx
je 0x14027eb8a
call fcn.14031dc44
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14027eb99
call fcn.14031dc44
movzx eax, bl
add rsp, 0x40
pop rbx
ret
Function at 0x14027ef80
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, rdx
lea rsi, vtable.CPathString.0
xor ebx, ebx
mov qword [rsp + 0x38], rsi
mov rdx, rcx
mov qword [rsp + 0x48], rbx
mov r8d, ebx
lea rcx, [rsp + 0x38]
call fcn.14027f9a0
mov r8d, ebx
mov qword [rsp + 0x20], rsi
mov rdx, rdi
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x20]
call fcn.14027f9a0
lea rcx, [rsp + 0x20]
call fcn.14027f760
lea rcx, [rsp + 0x38]
mov rbx, rax
call fcn.14027f760
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
setne bl
test rcx, rcx
je 0x14027f00c
call fcn.14031dc44
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14027f01b
call fcn.14031dc44
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14027f02a
call fcn.14031dc44
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14027f039
call fcn.14031dc44
mov rsi, qword [rsp + 0x68]
movzx eax, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x14027f0d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x50
xor ebx, ebx
mov qword [rsp + 0x70], r14
mov rdx, rcx
mov qword [rsp + 0x48], rbx
lea r14, vtable.CPathString.0
mov r8d, ebx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], r14
call fcn.14027f9a0
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
call fcn.14027e540
test al, al
jne 0x14027f1ed
mov qword [rsp + 0x68], rdi
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], bl
jne 0x14027f123
mov eax, eax
lea rdi, [rsi - 1]
add rdi, rax
cmp rdi, rsi
jbe 0x14027f1b3
mov qword [rsp + 0x60], rbp
nop
cmp byte [rdi], 0x5c
jne 0x14027f1a1
mov r8, rbx
mov byte [rdi], bl
mov rdx, rsi
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rbx
call fcn.14027f9a0
lea rcx, [rsp + 0x20]
call fcn.14027f760
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x30]
cmp eax, 0xffffffff
setne bpl
test rcx, rcx
je 0x14027f18a
call fcn.14031dc44
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14027f199
call fcn.14031dc44
mov byte [rdi], 0x5c
test bpl, bpl
jne 0x14027f1ab
dec rdi
cmp rdi, rsi
ja 0x14027f140
jmp 0x14027f1ae
inc rdi
mov rbp, qword [rsp + 0x60]
movzx eax, byte [rdi]
test al, al
je 0x14027f1dc
nop word [rax + rax]
cmp al, 0x5c
jne 0x14027f1d1
mov rcx, rsi
mov byte [rdi], bl
call fcn.14027e470
mov byte [rdi], 0x5c
movzx eax, byte [rdi + 1]
inc rdi
test al, al
jne 0x14027f1c0
mov rcx, rsi
call fcn.14027e470
mov rdi, qword [rsp + 0x68]
test al, al
je 0x14027f1ef
mov bl, 1
mov rcx, qword [rsp + 0x48]
mov r14, qword [rsp + 0x70]
test rcx, rcx
je 0x14027f203
call fcn.14031dc44
test rsi, rsi
je 0x14027f210
mov rcx, rsi
call fcn.14031dc44
movzx eax, bl
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
Function at 0x14027f230
Capabilities:
Timestomp file

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x70
mov qword [r11 + 8], rbp
lea rax, vtable.CPathString.0
mov qword [r11 + 0x10], rsi
xor ebx, ebx
mov qword [r11 + 0x18], rdi
mov esi, r9d
mov qword [r11 + 0x20], r12
mov edi, r8d
mov qword [r11 - 0x10], r14
mov r8d, ebx
mov r14d, edx
mov qword [r11 - 0x38], rax
mov rdx, rcx
mov qword [r11 - 0x28], rbx
lea rcx, [r11 - 0x38]
call fcn.14027f9a0
mov r12, qword [rsp + 0xa8]
mov ecx, r14d
shl ecx, 0x1f
mov eax, r14d
mov ebp, ecx
bts ebp, 0x1e
and al, 2
mov qword [r12], 0xffffffffffffffff
cmove ebp, ecx
cmp r14d, 4
jne 0x14027f2a6
mov ebp, 0xc0000000
jmp 0x14027f2af
test r14b, 8
je 0x14027f2af
or ebp, 4
mov qword [rsp + 0x60], r15
mov r14d, 2
test edi, edi
je 0x14027f2ed
sub edi, 1
je 0x14027f2e5
sub edi, 1
je 0x14027f2e0
sub edi, 1
je 0x14027f2d8
cmp edi, 4
jne 0x14027f303
lea r15d, [r14 + 5]
jmp 0x14027f2f0
mov r15d, 3
jmp 0x14027f2f0
mov r15d, r14d
jmp 0x14027f2f0
mov r15d, 1
jmp 0x14027f2f0
mov r15d, ebx
test esi, esi
je 0x14027f31d
sub esi, 1
je 0x14027f315
sub esi, 1
je 0x14027f30d
cmp esi, 1
je 0x14027f323
mov ebx, 0x57
jmp 0x14027f3fa
mov r14d, 1
jmp 0x14027f323
mov r14d, 4
jmp 0x14027f323
mov r14d, 3
mov esi, dword [rsp + 0xa0]
mov eax, esi
mov ecx, esi
and ecx, 1
shl ecx, 0x1e
sub ecx, 0xffffff80
mov edx, ecx
bts edx, 0x1d
and al, 2
mov eax, esi
cmove edx, ecx
mov ecx, edx
bts ecx, 0x1b
and al, 8
cmove ecx, edx
test sil, 0x10
je 0x14027f35d
btr ecx, 7
bts ecx, 8
mov edi, ecx
mov eax, esi
bts edi, 0x1a
and al, 0x20
cmove edi, ecx
lea rcx, [rsp + 0x40]
call fcn.14027f760
mov qword [rsp + 0x30], rbx
mov rcx, rax
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov r8d, r15d
mov dword [rsp + 0x20], r14d
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r12], rax
cmp rax, 0xffffffffffffffff
jne 0x14027f3a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14027f3fa
test sil, 4
je 0x14027f3cf
xor r9d, r9d
mov qword [rsp + 0xa8], 0xffffffffffffffff
lea r8, [rsp + 0xa8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test sil, sil
jns 0x14027f3fa
lea rcx, [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rcx, qword [r12]
lea rdx, [rsp + 0xa8]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov r12, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
test rcx, rcx
je 0x14027f433
call fcn.14031dc44
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14027f442
call fcn.14031dc44
mov eax, ebx
add rsp, 0x70
pop rbx
ret
Function at 0x14027f450
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
test r9, r9
lea r14, [rsp + 0x70]
mov rbx, r8
mov rbp, rdx
cmovne r14, r9
mov r15, rcx
xor r12d, r12d
mov esi, r12d
test r8, r8
je 0x14027f4f7
mov r13d, 0x40000000
nop dword [rax]
nop word [rax + rax]
mov r8d, ebx
mov dword [rsp + 0x70], r12d
cmp rbx, r13
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
mov rdx, rbp
cmova r8d, r13d
mov rcx, r15
mov edi, r12d
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
je 0x14027f4dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14027f4e4
mov qword [r14], r12
jmp 0x14027f4fc
mov edi, dword [rsp + 0x70]
test edi, edi
jne 0x14027f4e9
test rsi, rsi
jne 0x14027f4f7
movsxd rax, edi
add rbp, rax
add rsi, rax
sub rbx, rax
jne 0x14027f4a0
mov qword [r14], rsi
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1402804f0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x40
lea rax, vtable.CPathString.0
mov qword [rsp + 0x30], 0
mov rdx, rcx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.14027f9a0
lea rcx, [rsp + 0x20]
call fcn.14027f760
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140280556
test bl, 3
je 0x140280552
lea rcx, [rsp + 0x20]
and ebx, 0xfffffffc
call fcn.14027f760
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov bl, 1
jmp 0x140280558
xor bl, bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140280567
call fcn.14031dc44
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140280576
call fcn.14031dc44
movzx eax, bl
add rsp, 0x40
pop rbx
ret
Function at 0x1402809f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140280a71
mov edi, dword [rbx + 0x34]
lea r9, [rsp + 0x60]
mov rdx, qword [rbx + 0x20]
mov r8d, edi
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x68], rsi
xor esi, esi
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
je 0x140280a40
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140280a44
jmp 0x140280a48
mov esi, dword [rsp + 0x60]
cmp edi, esi
je 0x140280a56
mov rax, qword [rbx + 8]
mov r8d, 1
xchg dword [rax + 0x1c], r8d
mov rax, qword [rbx + 8]
neg edi
lock xadd dword [rax + 0x18], edi
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140280b60
cmp byte [rax], 0
je 0x140280b60
call sub.KERNEL32.dll_GetCurrentProcessId
mov rcx, qword [rbx + 0x10]
lea rdi, [0x1404830ad]
test rcx, rcx
lea rdx, str._s.async_u.tmp
mov r8, rdi
mov r9d, eax
cmovne r8, rcx
lea rcx, [rsp + 0x30]
call fcn.14027a880
cmp byte [rsp + 0x47], 0
jge 0x140280acb
mov rdx, qword [rsp + 0x30]
test rdx, rdx
jne 0x140280ad0
mov rdx, rdi
jmp 0x140280ad0
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 0x18]
mov r8d, 1
call fcn.140280fe0
test al, al
je 0x140280b37
mov rax, qword [rbx + 0x10]
mov rdx, rdi
test rax, rax
cmovne rdx, rax
cmp byte [rsp + 0x47], 0
jge 0x140280b07
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x140280b0c
mov rcx, rdi
jmp 0x140280b0c
lea rcx, [rsp + 0x30]
call fcn.14027ef80
test al, al
jne 0x140280b37
cmp byte [rsp + 0x47], al
jge 0x140280b27
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x140280b2c
jmp 0x140280b2f
lea rax, [rsp + 0x30]
mov rdi, rax
mov rcx, rdi
call fcn.140281760
cmp byte [rsp + 0x47], 0
jge 0x140280b7d
call fcn.14029bdd0
mov rdx, qword [rsp + 0x30]
xor r8d, r8d
mov rcx, rax
mov r9, qword [rax]
call qword [r9 + 0x38]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea r8, str.Invalid_FileWriterItem_t
mov edx, 0x1542
lea rcx, str.c:_buildslave_steam_rel_client_hotfix_win64_build_src_tier1_fileio.cpp
call fcn.14029bf90
test al, al
jne 0x140280b7d
int3
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret