joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008b3c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
lea r8, [rdx - 0x40]
mov r9d, 0x40
lea r11, [rcx + r9]
cmp r8, r9
jb 0x140008c8a
add rdx, 0xffffffffffffff80
mov r9, rdx
and r9, 0xffffffffffffffc0
lea r10, [r9 + 0x80]
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x1400d5250]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm9, 0
movdqa xmm12, xmm3
pclmulqdq xmm12, xmm9, 0
movdqa xmm11, xmm2
pclmulqdq xmm11, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm8, 0x11
movdqa xmm5, xmm3
pclmulqdq xmm5, xmm8, 0x11
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm8, 0x11
movdqa xmm13, xmm1
pclmulqdq xmm13, xmm8, 0x11
movdqu xmm0, xmmword [r11]
pxor xmm0, xmm6
pxor xmm0, xmm4
movdqu xmm3, xmmword [r11 + 0x10]
pxor xmm3, xmm12
pxor xmm3, xmm5
movdqu xmm2, xmmword [r11 + 0x20]
pxor xmm2, xmm11
pxor xmm2, xmm7
movdqu xmm1, xmmword [r11 + 0x30]
pxor xmm1, xmm10
pxor xmm1, xmm13
add r8, 0xffffffffffffffc0
add r11, 0x40
cmp r8, 0x3f
ja 0x140008bd5
sub rdx, r9
add rcx, r10
mov r8, rdx
mov r11, rcx
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x1400d5260]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp r8, 0x10
jb 0x140008d1a
movdqu xmm1, xmmword [r11]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm1
pxor xmm0, xmm2
add r11, 0x10
add r8, 0xfffffffffffffff0
cmp r8, 0xf
ja 0x140008cef
movdqa xmm1, xmmword [0x1400d5260]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pmovzxdq xmm1, xmm0
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm2, rax
pclmulqdq xmm2, xmm1, 0
pxor xmm2, xmm0
pmovzxdq xmm0, xmm2
pclmulqdq xmm0, xmmword [0x1400d5270], 0x10
pmovzxdq xmm0, xmm0
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x14000c080
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r14, [rsp + 0x38]
lea r12, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov ebp, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x28]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1400c1338
cmp rax, rbx
jne 0x14000c107
cmp edi, 1
je 0x14000c0b4
cmp edi, 2
je 0x14000c107
mov rcx, qword [rsi + 0x40]
call fcn.1400c0c8c
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ab340
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14000c130
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x14000c165
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400c1338
xor ebx, ebx
test rsi, rsi
jle 0x14000c18a
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x14000c18a
inc rbx
cmp rsi, rbx
jne 0x14000c16c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14000c1a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp edx, 0xffffffff
je 0x14000c1fd
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x14000c20c
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.1400c1338
mov esi, 0xffffffff
cmp rax, 1
jne 0x14000c2bc
xor esi, esi
cmp r15d, 0xffffffff
cmovne esi, r15d
jmp 0x14000c2bc
lea rbx, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], rbx
lea rsi, [rsp + 0x57]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x14000c2b7
mov ebp, eax
cmp eax, 3
je 0x14000c296
cmp ebp, 1
ja 0x14000c2b7
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.1400c1338
cmp rax, rsi
jne 0x14000c2b7
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x14000c229
jmp 0x14000c1fd
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.1400c1338
cmp rax, 1
je 0x14000c1fd
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ab340
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000c320
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x14000c355
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400c1338
xor ebx, ebx
test rsi, rsi
jle 0x14000c37b
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x14000c37b
inc rbx
cmp rsi, rbx
jne 0x14000c35c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14000c390
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov esi, edx
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dx, 0xffff
je 0x14000c3ec
mov rdi, rcx
mov word [rsp + 0x56], si
cmp byte [rcx + 0x58], 0
je 0x14000c3fc
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.1400c1338
mov di, 0xffff
cmp rax, 1
jne 0x14000c4ab
xor eax, eax
cmp si, 0xffff
cmove esi, eax
mov edi, esi
jmp 0x14000c4ab
lea r15, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], r15
lea rbx, [rsp + 0x56]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r8, rbx
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rbx
je 0x14000c4a7
mov ebp, eax
cmp eax, 3
je 0x14000c486
cmp ebp, 1
ja 0x14000c4a7
mov rbx, qword [rsp + 0x48]
sub rbx, r15
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1400c1338
cmp rax, rbx
jne 0x14000c4a7
mov rbx, qword [rsp + 0x40]
cmp ebp, 1
je 0x14000c419
jmp 0x14000c3ec
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rbx
call fcn.1400c1338
cmp rax, 1
je 0x14000c3ec
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ab340
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400255f0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x140105a98], 0
je 0x140025615
xor esi, esi
jmp 0x1400256a5
mov ecx, 0x38
call fcn.1400aaf70
mov rsi, rax
mov ecx, 0x18
call fcn.1400aaf70
mov qword [rsi], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x10], rcx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [rsi + 8], rcx
lea rax, [rsi + 0x20]
movups xmmword [rsi + 0x20], xmm0
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x30], 1
mov qword [0x140105a98], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14002568e
cmp word [rax], 0
je 0x14002568e
xor ecx, ecx
nop dword [rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140025680
jmp 0x140025690
xor ecx, ecx
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400256c0
mov sil, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ab340
mov eax, esi
add rsp, 0x40
pop rsi
ret
Function at 0x1400256c0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rbp, rcx
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r8d, 3
call fcn.140033e10
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
cmp qword [rsi + 8], 0
je 0x1400258fc
mov dword [rsp + 0x4c], 0
lea rcx, str.api_ms_win_downlevel_shell32_l1_1_0.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
je 0x140025769
mov rdi, rax
lea rdx, [0x1400d873e]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002577c
mov rbx, rax
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call rax
mov r15, rax
jmp 0x14002577f
mov rcx, qword [rsi]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r15, rax
jmp 0x140025788
xor r15d, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movsxd r13, dword [rsp + 0x4c]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
test r13, r13
je 0x14002589f
mov qword [rsp + 0x28], rbp
test r13d, r13d
js 0x14002592f
shl r13, 3
lea rsi, [r13*2]
add rsi, r13
mov rcx, rsi
call fcn.1400aaf70
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
add rsi, rax
mov qword [rsp + 0x40], rsi
xor r14d, r14d
xorps xmm6, xmm6
jmp 0x140025820
mov byte [rbx + 0x17], dil
mov rsi, rbx
test rdi, rdi
je 0x14002580d
mov r8, rdi
add r8, rdi
mov rcx, rsi
mov rdx, r12
call fcn.1400adbe0
mov word [rsi + rdi*2], 0
add rbx, 0x18
add r14, 8
cmp r13, r14
je 0x140025895
mov r12, qword [r15 + r14]
movups xmmword [rbx], xmm6
mov qword [rbx + 0x10], 0
mov rcx, r12
call fcn.1400c3208
mov rdi, rax
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x140025922
cmp rdi, 0xb
jb 0x1400257f0
lea rbp, [rdi + 8]
and rbp, 0xfffffffffffffff8
js 0x14002592a
mov rcx, rbp
add rcx, rbp
lea rcx, [rbp + rbp]
call fcn.1400aaf70
mov rsi, rax
mov qword [rbx], rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, rbp
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rdi
jmp 0x1400257fc
mov qword [rsp + 0x38], rbx
mov rbp, qword [rsp + 0x28]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.140025430
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x1400258fc
mov rax, qword [rsp + 0x38]
cmp rax, rsi
jne 0x1400258d8
mov rcx, rsi
jmp 0x1400258f2
mov rax, rdi
cmp rsi, rdi
je 0x1400258ed
lea rdi, [rax - 0x18]
cmp byte [rax - 1], 0
jns 0x1400258d0
mov rcx, qword [rax - 0x18]
call fcn.1400aafcc
jmp 0x1400258d0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rsi
call fcn.1400aafcc
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400ab340
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
call fcn.14002231c
call fcn.1400bbef4
lea rcx, [rsp + 0x30]
call fcn.14002400c
int3
Function at 0x140029db0
Capabilities:
Delete file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
mov r14, rcx
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x78], rax
call fcn.140025940
mov rdi, rax
lea rbx, [0x1400db281]
mov rcx, rax
mov rdx, rbx
call fcn.140025df0
test al, al
jne 0x140029e05
lea rdx, str.vmodule
mov rcx, rdi
call fcn.140025df0
test al, al
je 0x140029eaa
cmp qword [0x140105aa8], 0
jne 0x140029f85
mov rax, qword [0x140105ab0]
mov qword [0x140105aa8], rax
mov ecx, 0x20
call fcn.1400aaf70
mov rsi, rax
lea rcx, str.vmodule
mov qword [rsp + 0x50], rcx
call fcn.1400c2b00
mov qword [rsp + 0x58], rax
lea r15, [rsp + 0x60]
lea r8, [rsp + 0x50]
mov rcx, rdi
mov rdx, r15
call fcn.140025e60
mov qword [rsp + 0x28], rbx
mov rcx, rbx
call fcn.1400c2b00
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 0x38]
lea r8, [rsp + 0x28]
mov rcx, rdi
mov rdx, rbx
call fcn.140025e60
lea r9, [0x140105ab8]
mov rcx, rsi
mov rdx, rbx
mov r8, r15
call fcn.140036880
mov qword [0x140105ab0], rsi
cmp byte [rsp + 0x4f], 0
js 0x140029eef
cmp byte [rsp + 0x77], 0
js 0x140029f00
mov eax, dword [r14]
mov dword [0x140102338], eax
mov bl, 1
test al, 1
je 0x140029f67
mov rcx, qword [0x140105ae0]
test rcx, rcx
je 0x140029f0c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140105ae0], 0
mov rcx, qword [0x140105ac0]
test rcx, rcx
jne 0x140029f3a
and byte [0x140102338], 0xfe
jmp 0x140029f18
mov rcx, qword [rsp + 0x38]
call fcn.1400aafcc
cmp byte [rsp + 0x77], 0
jns 0x140029eaa
mov rcx, qword [rsp + 0x60]
call fcn.1400aafcc
jmp 0x140029eaa
mov rcx, qword [0x140105ac0]
test rcx, rcx
jne 0x140029f3a
mov ecx, 0x18
call fcn.1400aaf70
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x140105ac0], rax
mov rdx, qword [r14 + 8]
call fcn.1400236fa
cmp dword [r14 + 0x14], 0
jne 0x140029f60
mov rcx, qword [0x140105ac0]
cmp byte [rcx + 0x17], 0
jns 0x140029f5a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.140029f90
mov ebx, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400ab340
mov eax, ebx
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
int3
Function at 0x140029f90
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14b, 1
cmp qword [0x140105ae0], 0
jne 0x14002a21f
mov rdi, qword [0x140105ac0]
test rdi, rdi
je 0x14002a08f
test byte [0x140102338], 1
je 0x14002a21f
cmp byte [rdi + 0x17], 0
jns 0x140029fe8
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140105ae0], rax
add rax, 1
cmp rax, 1
ja 0x14002a21f
mov word [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14002a21c
cmp eax, 0x104
ja 0x14002a21c
mov rcx, qword [0x140105ac0]
lea rdx, [rsp + 0x40]
call fcn.1400236fa
mov rcx, qword [0x140105ac0]
movzx eax, byte [rcx + 0x17]
test al, al
js 0x14002a195
mov rdx, rcx
cmp word [rdx + rax*2 - 2], 0x5c
jne 0x14002a1a4
jmp 0x14002a1b7
movabs rbp, 0x7fffffffffffffef
mov ecx, 0x18
call fcn.1400aaf70
mov rdi, rax
lea rsi, [rsp + 0x40]
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov rcx, rsi
call fcn.1400c3208
cmp rax, rbp
ja 0x14002a242
mov rbx, rax
cmp rax, 0xb
jae 0x14002a0f1
mov byte [rdi + 0x17], bl
mov r15, rdi
test rbx, rbx
jne 0x14002a11d
jmp 0x14002a130
lea rsi, [rbx + 8]
and rsi, 0xfffffffffffffff8
js 0x14002a24a
lea rcx, [rsi + rsi]
call fcn.1400aaf70
mov r15, rax
mov qword [rdi], rax
add rbp, 0x11
or rbp, rsi
mov qword [rdi + 0x10], rbp
mov qword [rdi + 8], rbx
mov r8, rbx
add r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.1400adbe0
mov word [r15 + rbx*2], 0
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x14002a145
mov r8, qword [rdi + 8]
mov rcx, rdi
mov dx, 0x5c
call fcn.140023932
cmp rax, 0xffffffffffffffff
je 0x14002a16d
add rax, 1
mov rcx, rdi
mov rdx, rax
mov r8, 0xffffffffffffffff
call fcn.14002385a
lea rdx, [0x1400d88ac]
mov rcx, rdi
call fcn.14002352a
mov qword [0x140105ac0], rdi
test byte [0x140102338], 1
jne 0x140029fdf
jmp 0x14002a21f
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
cmp word [rdx + rax*2 - 2], 0x5c
je 0x14002a1b7
lea rdx, [0x1400d88a8]
call fcn.14002352a
mov rcx, qword [0x140105ac0]
lea rdx, [0x1400d88ac]
call fcn.14002352a
mov rcx, qword [0x140105ac0]
cmp byte [rcx + 0x17], 0
jns 0x14002a1d3
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140105ae0], rax
add rax, 1
cmp rax, 1
ja 0x14002a21f
mov qword [0x140105ae0], 0
xor r14d, r14d
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ab340
mov eax, r14d
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rdi
call fcn.14002231c
call fcn.1400bbef4
int3
Function at 0x14002d880
Capabilities:
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdx, str.DeleteFileAfterReboot
lea r8, str..._.._base_files_file_util_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x187
call fcn.140029d80
lea rcx, [rsp + 0x48]
mov rdx, rdi
xor r8d, r8d
call fcn.140042460
cmp byte [rsi + 0x17], 0
jns 0x14002d8e0
cmp qword [rsi + 8], 0x103
jbe 0x14002d8dd
xor esi, esi
jmp 0x14002d8f7
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne sil
lea rcx, [rsp + 0x48]
call fcn.140042590
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ab340
mov eax, esi
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x14002d920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rdx, str.PathExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1ba
call fcn.140029d80
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140042460
cmp byte [rsi + 0x17], 0
jns 0x14002d976
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rdi
call fcn.140042590
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ab340
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x14002d9b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rdx, str.DirectoryExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1cc
call fcn.140029d80
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140042460
cmp byte [rsi + 0x17], 0
jns 0x14002da06
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
setne al
and esi, 0x10
shr esi, 4
and sil, al
mov rcx, rdi
call fcn.140042590
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ab340
mov eax, esi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002da40
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x60]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xffffffff
cmp eax, 0x102
jbe 0x14002da80
xor esi, esi
jmp 0x14002dae5
mov qword [rsp + 0x20], rdi
cmp word [rsp + 0x60], 0
je 0x14002da9e
xor eax, eax
nop
cmp word [rsp + rax*2 + 0x62], 0
lea rax, [rax + 1]
jne 0x14002da90
jmp 0x14002daa0
xor eax, eax
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400284e0
lea rbx, [rsp + 0x48]
mov rcx, rdi
mov rdx, rbx
call fcn.140029720
mov rcx, rsi
mov rdx, rbx
call fcn.140028560
mov rcx, rbx
call fcn.140028530
mov rcx, rdi
call fcn.140028530
mov sil, 1
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.1400ab340
mov eax, esi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret

Function at 0x14002db10
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002db80
cmp word [rsp + 0x60], 0
je 0x14002db80
mov qword [rsp + 0x50], rdi
xor eax, eax
nop
cmp word [rsp + rax*2 + 0x62], 0
lea rax, [rax + 1]
jne 0x14002db60
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400284e0
jmp 0x14002dbd4
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.140028490
mov rcx, rdi
call fcn.14002da40
test al, al
je 0x14002dba8
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1400284c0
jmp 0x14002dbca
lea rax, [0x1400d89b8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 3
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400284e0
lea rcx, [rsp + 0x38]
call fcn.140028530
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400ab340
mov rax, rsi
add rsp, 0x278
pop rdi
pop rsi
ret
Function at 0x14002e040
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
mov r12, rdx
mov rdi, rcx
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rdx, str.CreateDirectoryAndGetError
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x50]
mov rcx, rbx
mov r9d, 0x265
call fcn.140029d80
lea rcx, [rsp + 0x38]
mov rdx, rbx
xor r8d, r8d
call fcn.140042460
cmp byte [rdi + 0x17], 0
mov rbx, rdi
jns 0x14002e0a6
mov rbx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002e0dd
mov bl, 1
test al, 0x10
jne 0x14002e212
test r12, r12
je 0x14002e0cb
mov dword [r12], 0xfffffff7
mov ecx, 0x50
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x14002e212
lea rbp, [rsp + 0x20]
mov rcx, rdi
mov rdx, rbp
call fcn.140028ef0
movzx ecx, byte [rsp + 0x37]
mov rax, rcx
test cl, cl
jns 0x14002e0fe
mov rax, qword [rsp + 0x28]
movzx esi, byte [rdi + 0x17]
mov rdx, rsi
test sil, sil
jns 0x14002e10e
mov rdx, qword [rdi + 8]
cmp rax, rdx
jne 0x14002e15b
test rax, rax
je 0x14002e144
test cl, cl
jns 0x14002e121
mov rbp, qword [rsp + 0x20]
mov rcx, rdi
test sil, sil
jns 0x14002e12c
mov rcx, qword [rdi]
xor edx, edx
nop
movzx esi, word [rbp + rdx*2]
cmp si, word [rcx + rdx*2]
jne 0x14002e15b
add rdx, 1
cmp rax, rdx
jne 0x14002e130
test r12, r12
je 0x14002e151
mov dword [r12], 0xfffffffc
mov ecx, 2
jmp 0x14002e200
lea rcx, [rsp + 0x20]
mov rdx, r12
call fcn.14002e040
test al, al
je 0x14002e206
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x14002e208
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0xb7
jne 0x14002e1ee
lea rdx, str.DirectoryExists
lea r8, str..._.._base_files_file_util_win.cc
lea r15, [rsp + 0x50]
mov rcx, r15
mov r9d, 0x1cc
call fcn.140029d80
lea r14, [rsp + 0x70]
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140042460
cmp byte [rdi + 0x17], 0
jns 0x14002e1d1
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rcx, r14
call fcn.140042590
cmp edi, 0xffffffff
je 0x14002e1ee
and edi, 0x10
jne 0x14002e208
test r12, r12
je 0x14002e1fe
mov ecx, ebp
call fcn.14002e9d0
mov dword [r12], eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea rcx, [rsp + 0x20]
call fcn.140028530
lea rcx, [rsp + 0x38]
call fcn.140042590
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400ab340
mov eax, ebx
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret