joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140047d70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x78], rax
movzx eax, byte [0x140259ca8]
and eax, 1
neg rax
cmp rax, 0xfffffffffffffffd
je 0x140047f17
mov qword [rsp + 0x40], rdx
mov rbx, qword [rcx]
mov qword [rsp + 0x38], rcx
mov rdi, qword [rcx + 8]
xor r13d, r13d
lea r12, [0x14021f840]
movabs rcx, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x1402183e0]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x48], rbx
mov rbx, qword [rsp + 0x48]
mov rax, r13
shl rax, 4
mov qword [rsp + 0x70], rcx
movaps xmmword [rsp + 0x60], xmm6
mov rdx, qword [rax + r12]
mov rbp, qword [rax + r12 + 8]
mov byte [rsp + 0x77], bpl
mov r8, rbp
add r8, rbp
mov r15, rsi
mov rcx, rsi
call fcn.140108e80
mov word [rsp + rbp*2 + 0x60], 0
movzx eax, byte [rsp + 0x77]
mov rcx, rax
test al, al
jns 0x140047e39
mov rcx, qword [rsp + 0x68]
cmp rdi, rcx
jb 0x140047f71
mov r14b, 1
test rcx, rcx
mov rsi, r15
je 0x140047f7c
mov rdx, rsi
test al, al
jns 0x140047e5d
mov rdx, qword [rsp + 0x60]
xor ebp, ebp
movzx edi, word [rbx + rbp*2]
cmp di, word [rdx + rbp*2]
jne 0x140047eae
inc rbp
cmp rcx, rbp
jne 0x140047e5f
mov rbp, rcx
test al, al
js 0x140047f83
test r14b, r14b
jne 0x140047eb8
mov qword [rsp + 0x28], rbp
inc r13
movzx eax, byte [0x140259ca8]
xor rax, 3
cmp r13, rax
mov rdi, qword [rsp + 0x30]
movabs rcx, 0xaaaaaaaaaaaaaaaa
jb 0x140047df1
jmp 0x140047f17
xor r14d, r14d
mov rbp, qword [rsp + 0x28]
jmp 0x140047e74
test rbp, rbp
je 0x140047f17
mov rsi, qword [rsp + 0x38]
cmp rbp, qword [rsi + 8]
mov rdi, qword [rsp + 0x40]
je 0x140047f17
lea rax, [0x14021f870]
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], 1
movups xmm0, xmmword [rsi]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
xor r8d, r8d
call fcn.1400799d0
mov rdx, qword [rsi + 8]
sub rdx, rbp
jb 0x140047f95
sub rax, rbp
mov rcx, qword [rdi + 8]
cmp rdx, rax
cmovb rax, rdx
cmp rax, rcx
je 0x140047f44
xor ebx, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140106490
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov bl, 1
test rcx, rcx
je 0x140047f19
mov rax, qword [rdi]
add rbp, rbp
add rbp, qword [rsi]
xor edx, edx
mov rdi, rbp
movzx ebp, word [rbp + rdx*2]
cmp bp, word [rax + rdx*2]
jne 0x140047f17
inc rdx
cmp rcx, rdx
mov rbp, rdi
jne 0x140047f56
jmp 0x140047f19
xor r14d, r14d
mov rsi, r15
jmp 0x140047eb1
xor ebp, ebp
jmp 0x140047e74
mov rcx, qword [rsp + 0x60]
call fcn.140105bb4
mov rsi, r15
jmp 0x140047e7c
int3
Function at 0x140049220
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov rbx, qword [rdx]
mov qword [rdx], rax
lea r15, [rbx + 1]
cmp r15, 2
jb 0x14004924f
call fcn.1400ed9a0
cmp qword [rsi], rbx
je 0x14004927e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400492bb
cmp r15, 2
jb 0x140049276
mov qword [rsi], rbx
call fcn.1400ed9a0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
call fcn.140049430
lea rcx, [rsi + 0x20]
call fcn.140079be0
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x28], 0
mov byte [rsi + 0x29], r14b
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400492d1
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400ed9a0
mov rcx, qword [rsi]
call fcn.1400f1110
mov qword [rsi], 0
jmp 0x140049268
call fcn.1400ed9a0
mov rcx, qword [rdi]
call fcn.1400f1110
mov qword [rdi], 0
jmp 0x1400492ab

Function at 0x1400492f0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140051e30
mov qword [rsi], 0
test rax, rax
je 0x140049343
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140049377
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14004933b
mov qword [rsi], rbx
call fcn.1400ed9a0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.140049450
lea rcx, [rsi + 0x20]
call fcn.140079be0
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.1400ed9a0
mov rcx, qword [rsi]
call fcn.1400f1110
mov qword [rsi], 0
jmp 0x140049329
Function at 0x14004b470
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf0
movaps xmmword [rsp + 0xe0], xmm6
mov rsi, r8
mov r14, rdx
mov r12, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0xd8], rax
test r8, r8
je 0x14004b4bb
cmp byte [rsi + 0x17], 0
js 0x14004b684
xor eax, eax
mov byte [rsi], al
mov byte [rsi + 0x17], al
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.14011e914
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x80]
mov qword [rdi + 0x50], rax
movaps xmm0, xmmword [0x1402183e0]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.ReadStreamToStringWithMaxSize
lea r8, str..._.._base_files_file_util.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0xcd
call fcn.1400ed980
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400f44c0
xorps xmm6, xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
mov dword [rbx + 0x30], 0
mov rcx, r12
call fcn.140117030
mov ecx, eax
call fcn.140117acc
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x14004b697
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov edi, 0xffff
cmovg rdi, rax
cmp rdi, r14
cmova rdi, r14
lea r15, [rsp + 0x20]
movaps xmmword [r15], xmm6
mov qword [r15 + 0x10], 0
inc rdi
xor ebx, ebx
mov rcx, r15
mov rdx, rdi
xor r8d, r8d
call fcn.1400eba70
mov r13d, 0x10000
cmp byte [rsp + 0x37], 0
mov rcx, r15
jns 0x14004b5bc
mov rcx, qword [rsp + 0x20]
add rcx, rbx
mov edx, 1
mov r8, rdi
mov r9, r12
call fcn.14011e694
test rax, rax
je 0x14004b5fd
mov rcx, r14
sub rcx, rbx
cmp rcx, rax
jb 0x14004b6a1
test rbx, rbx
cmove rdi, r13
add rbx, rax
mov rcx, r12
call fcn.14011e240
test eax, eax
je 0x14004b6a8
mov rcx, r12
call fcn.14011e26c
test eax, eax
sete dil
mov r14, rbx
test rsi, rsi
je 0x14004b643
movups xmm0, xmmword [rsi]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x30]
mov qword [rsi + 0x10], rcx
movaps xmm1, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.1400eba70
cmp byte [rsp + 0x37], 0
js 0x14004b6be
lea rcx, [rsp + 0x80]
call fcn.1400f4520
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.140106490
mov eax, edi
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi]
mov byte [rax], 0
mov qword [rsi + 8], 0
jmp 0x14004b4bb
mov edi, 0xffff
jmp 0x14004b57c
xor edi, edi
jmp 0x14004b60e
lea rdx, [rbx + rdi]
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.1400eba70
jmp 0x14004b5ad
mov rcx, qword [rsp + 0x20]
call fcn.140105bb4
jmp 0x14004b64a
Function at 0x14004ba10
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x70], rax
call fcn.140046460
test al, al
je 0x14004ba69
call fcn.1400ec070
mov rdi, rax
lea rbx, [0x14022705e]
mov rcx, rax
mov rdx, rbx
call fcn.1400ec110
test al, al
jne 0x14004ba98
lea rdx, str.vmodule
mov rcx, rdi
call fcn.1400ec110
test al, al
jne 0x14004ba98
mov eax, dword [rsi]
mov dword [0x140251288], eax
mov bl, 1
test al, 1
jne 0x14004bb59
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140106490
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp qword [0x140259cb0], 0
jne 0x14004bbea
mov rax, qword [0x140259cb8]
mov qword [0x140259cb0], rax
mov ecx, 0x28
call fcn.140105b78
mov r14, rax
lea rcx, str.vmodule
lea r15, [rsp + 0x48]
mov qword [r15], rcx
call fcn.140121090
mov qword [r15 + 8], rax
lea r12, [rsp + 0x58]
mov rcx, rdi
mov rdx, r12
mov r8, r15
call fcn.140046b00
lea r15, [rsp + 0x20]
mov qword [r15], rbx
mov rcx, rbx
call fcn.140121090
mov qword [r15 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rdi
mov rdx, rbx
mov r8, r15
call fcn.140046b00
lea r9, [0x140259cc0]
mov rcx, r14
mov rdx, rbx
mov r8, r12
call fcn.140175290
mov qword [0x140259cb8], r14
cmp byte [rbx + 0x17], 0
jns 0x14004bb3f
mov rcx, qword [rsp + 0x30]
call fcn.140105bb4
cmp byte [rsp + 0x6f], 0
jns 0x14004ba69
mov rcx, qword [rsp + 0x58]
call fcn.140105bb4
jmp 0x14004ba69
mov rcx, qword [0x140259ce8]
test rcx, rcx
jne 0x14004bb73
mov rcx, qword [0x140259cc8]
test rcx, rcx
je 0x14004bb97
jmp 0x14004bbb9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140259ce8], 0
mov rcx, qword [0x140259cc8]
test rcx, rcx
jne 0x14004bbb9
and byte [0x140251288], 0xfe
mov ecx, 0x18
call fcn.140105b78
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x140259cc8], rax
mov rdx, qword [rsi + 8]
call fcn.1400267f0
cmp dword [rsi + 0x14], 0
jne 0x14004bbde
mov rcx, qword [0x140259cc8]
cmp byte [rcx + 0x17], 0
jns 0x14004bbd8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.140156a50
mov ebx, eax
jmp 0x14004ba7b
int3
Function at 0x1400505d0
Capabilities:
Get file version info

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb0
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x50]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x1402183e0]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.CreateFileVersionInfoWin
lea r8, str..._.._base_file_version_info_win.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r9d, 0x4c
call fcn.1400ed980
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1400f44c0
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 0x17], 0
jns 0x140050662
mov rdi, qword [rdi]
lea rdx, [rsp + 0x24]
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x14005077f
mov ebp, eax
mov esi, eax
mov rcx, rsi
call fcn.140105b78
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call fcn.140109290
mov edx, dword [rsp + 0x24]
mov rcx, rdi
mov r8d, ebp
mov r9, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140050788
lea r8, [rsp + 0x28]
mov qword [r8], 0
lea r9, [rsp + 0x4c]
mov dword [r9], 0xaaaaaaaa
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140050788
mov rbp, qword [rsp + 0x28]
test rbp, rbp
je 0x140050788
mov rdi, rbx
add rdi, rsi
mov ecx, 0x38
call fcn.140105b78
mov rsi, rax
mov eax, dword [rbp]
lea rcx, fcn.140050b70
mov qword [rsi], rcx
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
mov qword [rsi + 0x20], rbx
mov dword [rsi + 0x28], eax
lea r8, [rsp + 0x28]
mov qword [r8], 0
lea r9, [rsp + 0x4c]
mov dword [r9], 0xaaaaaaaa
lea rdx, [0x14021fd82]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14005079e
mov rax, qword [rsp + 0x28]
mov qword [rsi + 0x30], rax
mov qword [r14], rsi
lea rcx, [rsp + 0x50]
call fcn.1400f4520
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140106490
mov rax, r14
add rsp, 0xb0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov qword [r14], 0
jmp 0x140050754
mov qword [r14], 0
test rbx, rbx
je 0x140050754
mov rcx, rbx
call fcn.140105bb4
jmp 0x140050754
int3
Function at 0x140050840
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov r15, r8
mov r13, rdx
mov rdi, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x260], rax
movzx r14d, word [rcx + 0x28]
movzx r12d, word [rcx + 0x2a]
mov rsi, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call rsi
mov ebp, eax
movzx ebx, word [rdi + 0x2a]
movzx eax, word [rdi + 0x28]
mov dword [rsp + 0x40], eax
call rsi
mov word [rsp + 0x3e], ax
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140109290
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r14d
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140050ae0
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140050944
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140050944
mov r8d, dword [rsp + 0x44]
test r8d, r8d
je 0x140050944
dec r8d
mov rcx, r15
call fcn.1400f0b90
mov sil, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140106490
mov eax, esi
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140109290
movzx eax, bp
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140050ae0
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400509c3
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400509c3
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x140050910
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140109290
mov qword [rsp + 0x30], r13
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140050ae0
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140050a47
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140050a47
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x140050910
lea rsi, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140109290
movzx eax, word [rsp + 0x3e]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x4e4
lea r9, str.StringFileInfo_04x_04x_ls
mov edx, 0x104
mov r8d, 0x104
mov rcx, rsi
call fcn.140050ae0
lea r8, [rsp + 0x48]
mov qword [r8], 0
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140050acc
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140050acc
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jne 0x140050910
xor esi, esi
jmp 0x14005091e
Function at 0x140050f60
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4b0
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x4a8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x450]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x1402183e0]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, [0x14021fdd3]
lea r8, str..._.._base_files_file_util_win.cc
lea rbp, [rsp + 0x240]
mov rcx, rbp
mov r9d, 0x17d
call fcn.1400ed980
mov rcx, rsi
mov rdx, rbp
xor r8d, r8d
call fcn.1400f44c0
lea rsi, [rsp + 0x240]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140109290
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x14005100e
mov rdx, qword [rbx]
mov r8d, 0x104
mov rcx, rsi
call fcn.14004f390
mov rcx, rsi
call fcn.1400f3de0
lea rsi, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140109290
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x140051045
mov rdx, qword [rdi]
mov r8d, 0x104
mov rcx, rsi
call fcn.14004f390
mov rcx, rsi
call fcn.1400f3de0
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x140051067
mov rdx, qword [rbx]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x140051073
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov sil, 1
test eax, eax
je 0x1400510be
lea rcx, [rsp + 0x450]
call fcn.1400f4520
mov rcx, qword [rsp + 0x4a8]
xor rcx, rsp
call fcn.140106490
mov eax, esi
add rsp, 0x4b0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140052440
mov ebp, eax
cmp byte [rdi + 0x17], 0
jns 0x1400510d6
mov rdi, qword [rdi]
cmp byte [rbx + 0x17], 0
jns 0x1400510df
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne sil
jne 0x140051091
test r14, r14
je 0x140051091
cmp ebp, 0xfffffffc
jne 0x140051104
call fcn.14015b5e0
mov ebp, eax
mov dword [r14], ebp
xor esi, esi
jmp 0x140051091

Function at 0x140051110
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x1402183e0]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, IsOS
call fcn.1400ed980
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1400f44c0
cmp byte [rdi + 0x17], 0
jns 0x140051194
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.1400f4520
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140106490
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400511d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x1402183e0]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.DirectoryExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1d8
call fcn.1400ed980
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1400f44c0
cmp byte [rdi + 0x17], 0
jns 0x140051254
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.1400f4520
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140106490
mov eax, edi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400512a0
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov r14, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.140109290
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14005133f
lea rsi, [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.140121344
mov qword [rsi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.1400494b0
lea rsi, [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
call fcn.14004af50
mov rcx, r14
mov rdx, rsi
call fcn.1400495f0
mov rcx, rsi
call fcn.1400ec550
mov rcx, rbx
call fcn.1400ec550
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140106490
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140051700
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm6
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x14024f018]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], r15
movaps xmm6, xmmword [0x1402183e0]
movaps xmmword [rsi + 0x40], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rdx, str.CreateDirectoryAndGetError
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x265
call fcn.1400ed980
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1400f44c0
cmp byte [rdi + 0x17], 0
mov rbx, rdi
jns 0x140051796
mov rbx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400517e2
mov sil, 1
test al, 0x10
je 0x14005187c
lea rcx, [rsp + 0x40]
call fcn.1400f4520
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140106490
mov eax, esi
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rsi, [rsp + 0x20]
mov qword [rsi + 0x10], r15
movaps xmmword [rsi], xmm6
mov rcx, rdi
mov rdx, rsi
call fcn.140049fc0
movzx ecx, byte [rsi + 0x17]
mov r8, rcx
test cl, cl
jns 0x140051809
mov r8, qword [rsp + 0x28]
movzx eax, byte [rdi + 0x17]
mov rdx, rax
test al, al
jns 0x140051818
mov rdx, qword [rdi + 8]
cmp r8, rdx
je 0x14005189a
lea rcx, [rsp + 0x20]
mov rdx, r14
call fcn.140051700
test al, al
je 0x1400518e4
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov sil, 1
test eax, eax
je 0x140051853
lea rcx, [rsp + 0x20]
call fcn.1400ec550
jmp 0x1400517af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xb7
jne 0x14005186e
mov rcx, rdi
call fcn.1400511d0
test al, al
jne 0x140051844
test r14, r14
je 0x1400518dc
mov ecx, ebx
call fcn.140052440
jmp 0x1400518d9
test r14, r14
je 0x140051888
mov dword [r14], 0xfffffff7
mov ecx, 0x50
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x1400517af
test r8, r8
je 0x1400518ca
test cl, cl
jns 0x1400518a8
mov rsi, qword [rsp + 0x20]
mov rcx, rdi
test al, al
jns 0x1400518b2
mov rcx, qword [rdi]
xor edx, edx
movzx eax, word [rsi + rdx*2]
cmp ax, word [rcx + rdx*2]
jne 0x14005181d
inc rdx
cmp r8, rdx
jne 0x1400518b4
mov eax, 0xfffffffc
mov ebx, 2
test r14, r14
je 0x1400518dc
mov dword [r14], eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x140051844