joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400362b0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
cmp byte [0x140325f08], 0
jne 0x1400362eb
lea rax, str.g_initialized
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_sel_main_chrome.c
mov ecx, 0xfffffffc
mov r9d, 0x48
call fcn.1400c46f0
cmp qword [0x140325f10], 0
je 0x140036306
lea rdx, str.NaClSetFatalErrorCallback_called_twice._n
mov ecx, 0xfffffffc
call fcn.1400c46f0
mov qword [0x140325f10], rsi
lea rcx, [0x140036320]
xor edx, edx
add rsp, 0x30
pop rsi
jmp 0x140038c50
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
lea rdx, str.NaClErrorLogHookInit:_entered_n
mov ecx, 2
call fcn.1400c46f0
call fcn.1400c4480
lea rcx, [0x140325f18]
mov rdx, rax
call fcn.140038ac0
test eax, eax
jne 0x140038cae
mov ecx, 2
call fcn.140194930
lea rcx, str.sel_main_chrome:_log_reporting_setup_failed_n
mov edx, 0x2c
mov r8d, 1
mov r9, rax
call fcn.1401adae0
call fcn.1400c4b30
mov qword [0x140326138], rdi
mov qword [0x140326140], rsi
lea rcx, [0x140325f18]
call fcn.1400c40a0
lea rcx, [0x140038ce0]
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1400c4760
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rdi, [0x14034d4c0]
mov rcx, rdi
call fcn.1400c47c0
mov qword [str.0K_f_], rsi
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400c47f0
Function at 0x140038c50
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
cmp byte [0x140325f08], 0
jne 0x1400362eb
lea rax, str.g_initialized
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_sel_main_chrome.c
mov ecx, 0xfffffffc
mov r9d, 0x48
call fcn.1400c46f0
cmp qword [0x140325f10], 0
je 0x140036306
lea rdx, str.NaClSetFatalErrorCallback_called_twice._n
mov ecx, 0xfffffffc
call fcn.1400c46f0
mov qword [0x140325f10], rsi
lea rcx, [0x140036320]
xor edx, edx
add rsp, 0x30
pop rsi
jmp 0x140038c50
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
lea rdx, str.NaClErrorLogHookInit:_entered_n
mov ecx, 2
call fcn.1400c46f0
call fcn.1400c4480
lea rcx, [0x140325f18]
mov rdx, rax
call fcn.140038ac0
test eax, eax
jne 0x140038cae
mov ecx, 2
call fcn.140194930
lea rcx, str.sel_main_chrome:_log_reporting_setup_failed_n
mov edx, 0x2c
mov r8d, 1
mov r9, rax
call fcn.1401adae0
call fcn.1400c4b30
mov qword [0x140326138], rdi
mov qword [0x140326140], rsi
lea rcx, [0x140325f18]
call fcn.1400c40a0
lea rcx, [0x140038ce0]
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1400c4760
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rdi, [0x14034d4c0]
mov rcx, rdi
call fcn.1400c47c0
mov qword [str.0K_f_], rsi
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400c47f0

Function at 0x140039eb0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov edi, r8d
mov ebp, edx
mov r8, rcx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, qword [rcx + 0xc8]
mov dword [rsp + 0x20], edi
lea rdx, str.Entered_NaClSysSysconf__08I64xx___d__0x_08I32x__n
mov ecx, 3
mov r9d, ebp
call fcn.1400c46f0
mov ebx, 0xffffffea
cmp ebp, 0xffffff
jg 0x140039f3c
cmp ebp, 1
je 0x140039f5c
cmp ebp, 2
je 0x140039f7f
cmp ebp, 0x10000
jne 0x140039fd0
cmp dword [rsi + 0x620], 0
jne 0x140039fd0
mov rax, qword [rsi + 0x600]
movsx ecx, byte [rax + 0x25]
movsx edx, byte [rax + 0x1c]
add edx, edx
or edx, ecx
movsx eax, byte [rax + 4]
shl eax, 2
or eax, edx
jmp 0x140039fab
cmp ebp, 0x1000000
je 0x140039f89
cmp ebp, 0x1000001
je 0x140039fa5
cmp ebp, 0x1000002
jne 0x140039fd0
mov eax, dword [rsi + 0x620]
jmp 0x140039fab
mov eax, dword [0x14033e170]
test eax, eax
jne 0x140039fab
lea rbx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 0x20]
mov dword [0x14033e170], eax
jmp 0x140039fab
mov dword [rsp + 0x30], 0x10000
jmp 0x140039faf
cmp dword [0x14033e158], 0
setne al
cmp qword [0x14033e160], 0
setne cl
or cl, al
movzx eax, cl
jmp 0x140039fab
mov eax, dword [rsi + 0x61c]
mov dword [rsp + 0x30], eax
mov edx, edi
lea r8, [rsp + 0x30]
mov r9d, 4
mov rcx, rsi
call fcn.1400388d0
xor ecx, ecx
test eax, eax
mov ebx, 0xfffffff2
cmovne ebx, ecx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140190ca0
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400468e0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, rdx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x28], rcx
mov rsi, qword [rcx]
lea rdx, str.NaClPageAlloc___0x_I64x__n
mov ecx, 3
mov r8, rdi
call fcn.1400c46f0
lea rbx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, dword [rbx + 4]
cmp r8d, 0x1000
je 0x140046950
lea rdx, str.page_size_is_0x_x__expected_0x_x_n
mov ecx, 2
mov r9d, 0x1000
call fcn.1400c46f0
mov r8d, dword [rsp + 0x58]
cmp r8d, 0x10000
je 0x140046975
lea rdx, str.allocation_granularity_is_0x_x__expected_0x_x_n
mov ecx, 0xfffffffd
mov r9d, 0x10000
call fcn.1400c46f0
add rdi, 0xffff
and rdi, 0xffffffffffff0000
xor r13d, r13d
mov r14, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rbx, str.NaClPageAlloc:__VirtualAlloc__0x_I64x__succeeded__0x_016I64x__releasing_and_re_allocating_in_64K_chunks...._n
mov r15, qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov rdx, rdi
mov r8d, 0x2000
mov r9d, 1
call r14
test rax, rax
je 0x140046ac0
mov rsi, rax
mov ecx, 3
mov rdx, rbx
mov r8, rdi
mov r9, rax
call fcn.1400c46f0
mov rcx, rsi
xor edx, edx
mov r8d, 0x8000
call r15
test rdi, rdi
jle 0x140046a82
lea r12, [rsi + rdi]
mov rbx, rsi
mov edx, 0x10000
mov rcx, rbx
mov r8d, 0x2000
mov r9d, 1
call r14
test rax, rax
je 0x140046a1e
add rbx, 0x10000
cmp rbx, r12
jb 0x1400469f4
jmp 0x140046a82
call rbp
mov ecx, 0xfffffffd
lea rdx, str.NaClPageAlloc:_re_allocation_failed_at_0x_016I64x__error__d_n
mov r8, rbx
mov r9d, eax
call fcn.1400c46f0
jmp 0x140046a4e
mov rcx, rsi
xor edx, edx
mov r8d, 0x8000
call r15
add rsi, 0x10000
cmp rsi, rbx
jb 0x140046a39
mov ecx, 2
lea rdx, str.NaClPageAllocAtAddr:_retrying_w_o_hint_n
call fcn.1400c46f0
inc r13d
mov esi, 0
cmp r13d, 0x100
lea rbx, str.NaClPageAlloc:__VirtualAlloc__0x_I64x__succeeded__0x_016I64x__releasing_and_re_allocating_in_64K_chunks...._n
jb 0x1400469a2
jmp 0x140046ad4
lea rdx, str.NaClPageAlloc:_p__0x_016I64x__returning_success._n
mov ecx, 2
mov r8, rsi
call fcn.1400c46f0
mov rax, qword [rsp + 0x28]
mov qword [rax], rsi
xor esi, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140190ca0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, str.NaClPageAlloc:_VirtualAlloc__0x_I64x__failed_n
mov ecx, 0xfffffffd
mov r8, rdi
call fcn.1400c46f0
mov esi, 0xfffffff4
jmp 0x140046aa0

Function at 0x140046ae0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rcx], 0
jmp fcn.1400468e0
Function at 0x140046af0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
lea r14, str.NaClPageAllocRandomized:_0x_I64x_n
lea r15, str.NaClPageAllocRandomized:_hint_0x_I64x_n
call fcn.1400c3e10
mov ebx, eax
mov ecx, 2
mov rdx, r14
mov r8, rbx
call fcn.1400c46f0
and rbx, 0x7ffffff
shl rbx, 0x10
mov qword [rdi], rbx
mov ecx, 2
mov rdx, r15
mov r8, rbx
call fcn.1400c46f0
mov rcx, rdi
mov rdx, rsi
call fcn.1400468e0
test eax, eax
je 0x140046b91
inc ebp
cmp ebp, 4
jb 0x140046b12
neg eax
lea rdx, str.NaClPageAllocRandomized:_failed___d___dropping_hints_n
mov ecx, 0xffffffff
mov r8d, eax
call fcn.1400c46f0
mov qword [rdi], 0
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400468e0
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140047100
Capabilities:
Suspend thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x510
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x508], rax
lea rcx, [rcx + 0xe0]
call fcn.1400c47c0
cmp dword [rsi + 0xf0], 1
jne 0x140047219
cmp dword [rsi + 0xd4], 0
jne 0x14004716d
lea rax, str.natp__host_thread_is_defined
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_win_thread_suspension.c
mov ecx, 0xfffffffc
mov r9d, reloc.WS2_32.dll_setsockopt
call fcn.1400c46f0
mov rdi, qword [rsi + 0xd8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x14004719c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClUntrustedThreadSuspend:_SuspendThread___call_failed__error__u_n
mov ecx, 0xfffffffc
mov r8d, eax
call fcn.1400c46f0
test ebx, ebx
je 0x1400471e6
mov rdx, qword [rsi + 0xf8]
test rdx, rdx
jne 0x1400471dd
mov ecx, 0x4d0
call fcn.1400a12f0
mov rdx, rax
mov qword [rsi + 0xf8], rax
test rax, rax
jne 0x1400471dd
lea rdx, str.NaClUntrustedThreadSuspend:_malloc___failed_n
mov ecx, 0xfffffffc
call fcn.1400c46f0
mov rdx, qword [rsi + 0xf8]
mov dword [rdx + 0x30], 0x100003
jmp 0x1400471f2
lea rdx, [rsp + 0x30]
mov dword [rdx + 0x30], 0x100001
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x140047219
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.NaClUntrustedThreadSuspend:_GetThreadContext___failed__error__u_n
mov ecx, 0xfffffffc
mov r8d, eax
call fcn.1400c46f0
mov rcx, qword [rsp + 0x508]
xor rcx, rsp
call fcn.140190ca0
nop
add rsp, 0x510
pop rbx
pop rdi
pop rsi
ret
Function at 0x140047380
Capabilities:
Resume thread

Disassembly:
push rsi
sub rsp, 0x30
mov eax, dword [rcx + 0x100]
test eax, eax
je 0x140047432
mov rsi, rcx
mov dword [rdx], eax
xor eax, eax
mov dword [rcx + 0x100], eax
mov rcx, qword [rcx + 0xc8]
lock dec dword [rcx + 0x70c]
cmp dword [rsi + 0xd4], eax
jne 0x1400473e0
lea rax, str.natp__host_thread_is_defined
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_win_thread_suspension.c
mov ecx, 0xfffffffc
mov r9d, reloc.WS2_32.dll_setsockopt
call fcn.1400c46f0
mov rcx, qword [rsi + 0xd8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x140047436
mov esi, 1
cmp eax, 1
ja 0x14004744c
mov eax, dword [0x14034d094]
test eax, eax
je 0x14004744c
lea rax, str.previous_suspend_count___2
mov qword [rsp + 0x20], rax
lea rdx, str.Fatal_error_in_file__s__line__d:____s__n
lea r8, str..._.._native_client_src_trusted_service_runtime_win_thread_suspension.c
mov ecx, 0xfffffffc
mov r9d, 0x97
call fcn.1400c46f0
jmp 0x14004744c
xor esi, esi
jmp 0x14004744c
lea rdx, str.NaClAppThreadUnblockIfFaulted:_ResumeThread___call_failed_n
mov ecx, 0xfffffffc
call fcn.1400c46f0
mov esi, 1
mov eax, esi
add rsp, 0x30
pop rsi
ret
Function at 0x140048270
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x28], rax
call fcn.140047ed0
mov rsi, rax
lea rbx, [0x140048b10]
lea rdi, [0x140048b14]
sub rdi, rbx
lea r9, [rsp + 0x24]
mov rcx, rax
mov rdx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400482cb
lea rdx, str.NaClPatchWindowsExceptionDispatcherToFailFast:_VirtualProtect___failed_to_make_the_routine_writable_n
mov ecx, 0xfffffffc
call fcn.1400c46f0
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.140193590
lea r9, [rsp + 0x24]
mov r8d, dword [r9]
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140048302
lea rdx, str.NaClPatchWindowsExceptionDispatcherToFailFast:_VirtualProtect___failed_to_restore_page_permissions_n
mov ecx, 0xfffffffc
call fcn.1400c46f0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140190ca0
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
sub rsp, 0x28
call fcn.140047f30
test eax, eax
je 0x140048332
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x140048270

Function at 0x140054400
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r14, [rsp + 0x38]
lea r12, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov ebp, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x28]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1401adae0
cmp rax, rbx
jne 0x140054487
cmp edi, 1
je 0x140054434
cmp edi, 2
je 0x140054487
mov rcx, qword [rsi + 0x40]
call fcn.1401ac910
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140190ca0
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400544b0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmp byte [rcx + 0x58], 0
je 0x1400544e5
mov r9, qword [rbx + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1401adae0
xor edi, edi
test rsi, rsi
jle 0x140054507
movzx edx, byte [r14 + rdi]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x140054507
inc rdi
cmp rdi, rsi
jl 0x1400544ec
mov rax, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140054520
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp edx, 0xffffffff
je 0x14005457d
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x14005458c
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.1401adae0
mov esi, 0xffffffff
cmp rax, 1
jne 0x14005463c
xor esi, esi
cmp r15d, 0xffffffff
cmovne esi, r15d
jmp 0x14005463c
lea rbx, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], rbx
lea rsi, [rsp + 0x57]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + reloc.WS2_32.dll_recv]
cmp qword [rsp + 0x40], rsi
je 0x140054637
mov ebp, eax
cmp eax, 3
je 0x140054616
cmp ebp, 1
ja 0x140054637
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.1401adae0
cmp rax, rsi
jne 0x140054637
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x1400545a9
jmp 0x14005457d
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.1401adae0
cmp rax, 1
je 0x14005457d
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140190ca0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400546a0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmp byte [rcx + 0x58], 0
je 0x1400546d5
mov r9, qword [rbx + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1401adae0
xor edi, edi
test rsi, rsi
jle 0x1400546f8
movzx edx, word [r14 + rdi*2]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x1400546f8
inc rdi
cmp rdi, rsi
jl 0x1400546dc
mov rax, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140054710
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov esi, edx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dx, 0xffff
je 0x14005476c
mov rdi, rcx
mov word [rsp + 0x56], si
cmp byte [rcx + 0x58], 0
je 0x14005477c
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.1401adae0
mov di, 0xffff
cmp rax, 1
jne 0x14005482b
xor eax, eax
cmp si, 0xffff
cmove esi, eax
mov edi, esi
jmp 0x14005482b
lea r15, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], r15
lea rbx, [rsp + 0x56]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r8, rbx
lea r9, [rsp + 0x58]
call qword [rax + reloc.WS2_32.dll_recv]
cmp qword [rsp + 0x40], rbx
je 0x140054827
mov ebp, eax
cmp eax, 3
je 0x140054806
cmp ebp, 1
ja 0x140054827
mov rbx, qword [rsp + 0x48]
sub rbx, r15
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1401adae0
cmp rax, rbx
jne 0x140054827
mov rbx, qword [rsp + 0x40]
cmp ebp, 1
je 0x140054799
jmp 0x14005476c
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rbx
call fcn.1401adae0
cmp rax, 1
je 0x14005476c
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140190ca0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14006eb50
Capabilities:
Accept command line arguments

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x140347820], 0
je 0x14006eb75
xor esi, esi
jmp 0x14006ec05
mov ecx, 0x38
call fcn.140190820
mov rsi, rax
mov ecx, 0x18
call fcn.140190820
mov qword [rsi], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x10], rcx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [rsi + 8], rcx
lea rax, [rsi + 0x20]
movups xmmword [rsi + 0x20], xmm0
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x30], 1
mov qword [0x140347820], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14006ebee
cmp word [rax], 0
je 0x14006ebee
xor ecx, ecx
nop dword [rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14006ebe0
jmp 0x14006ebf0
xor ecx, ecx
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.14006ec20
mov sil, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140190ca0
mov eax, esi
add rsp, 0x40
pop rsi
ret
Function at 0x140075330
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rdx, str.PathExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1ab
call fcn.1400764c0
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14008c020
cmp byte [rsi + 0x17], 0
jns 0x140075386
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rdi
call fcn.14008c150
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140190ca0
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400753c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rdx, str.DirectoryExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1bd
call fcn.1400764c0
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14008c020
cmp byte [rsi + 0x17], 0
jns 0x140075416
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
setne al
and esi, 0x10
shr esi, 4
and sil, al
mov rcx, rdi
call fcn.14008c150
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140190ca0
mov eax, esi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x140075450
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x60]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xffffffff
cmp eax, 0x102
jbe 0x140075490
xor esi, esi
jmp 0x1400754f5
mov qword [rsp + 0x20], rdi
cmp word [rsp + 0x60], 0
je 0x1400754ae
xor eax, eax
nop
cmp word [rsp + rax*2 + 0x62], 0
lea rax, [rax + 1]
jne 0x1400754a0
jmp 0x1400754b0
xor eax, eax
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140073a80
lea rbx, [rsp + 0x48]
mov rcx, rdi
mov rdx, rbx
call fcn.140074cf0
mov rcx, rsi
mov rdx, rbx
call fcn.140073b00
mov rcx, rbx
call fcn.140073ad0
mov rcx, rdi
call fcn.140073ad0
mov sil, 1
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140190ca0
mov eax, esi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
Function at 0x140075520
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x140324948]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140075590
movzx eax, word [rsp + 0x60]
test ax, ax
je 0x140075590
mov qword [rsp + 0x50], rdi
xor eax, eax
cmp word [rsp + rax*2 + 0x62], 0
lea rax, [rax + 1]
jne 0x140075570
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140073a80
jmp 0x1400755e4
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.140073a30
mov rcx, rdi
call fcn.140075450
test al, al
je 0x1400755b8
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140073a60
jmp 0x1400755da
lea rax, [0x1401d7172]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 3
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140073a80
lea rcx, [rsp + 0x38]
call fcn.140073ad0
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140190ca0
mov rax, rsi
add rsp, 0x278
pop rdi
pop rsi
ret