joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f8bc0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140221ae0]
cmp rsi, 1
jbe 0x1400f8be3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400f34b0
lea rcx, [0x140221ae0]
call fcn.140084520
test al, al
je 0x1400f8c29
mov qword [0x140221ae8], 0
lea rdi, [0x140221ae0]
lea rsi, [0x140221ae8]
mov rcx, rsi
xor edx, edx
call fcn.1400934b0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.1400845c0
jmp 0x1400f8bd3
mov rsi, qword [0x140221ae0]
jmp 0x1400f8bd3

Function at 0x1400f8cc0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140221ef8]
cmp rsi, 1
jbe 0x1400f8ce3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400f34b0
lea rcx, [0x140221ef8]
call fcn.140084520
test al, al
je 0x1400f8d29
mov qword [0x140221f00], 0
lea rdi, [0x140221ef8]
lea rsi, [0x140221f00]
mov rcx, rsi
xor edx, edx
call fcn.1400934b0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.1400845c0
jmp 0x1400f8cd3
mov rsi, qword [0x140221ef8]
jmp 0x1400f8cd3

Function at 0x1400f9710
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140221f38]
mov ecx, dword [0x140216fcc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400f9745
lea rcx, [0x140221f30]
add rsp, 0x28
jmp fcn.1400f3470
lea rcx, [0x140221f38]
call fcn.140100680
cmp dword [0x140221f38], 0xffffffff
jne 0x1400f9735
mov qword [0x140221f30], 0
lea rcx, [0x140221f30]
xor edx, edx
call fcn.1400934b0
lea rcx, [0x140221f38]
call fcn.140100718
jmp 0x1400f9735

Function at 0x140100380
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1402228b8]
mov ecx, dword [0x140216fcc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140100422
lea rcx, [0x1402228b0]
xor edx, edx
call fcn.1400f34b0
mov eax, dword [0x1402228c8]
mov ecx, dword [0x140216fcc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401003e6
lea rcx, [0x1402228c0]
xor edx, edx
add rsp, 0x28
jmp fcn.1400f34b0
lea rcx, [0x1402228c8]
call fcn.140100680
cmp dword [0x1402228c8], 0xffffffff
jne 0x1401003d4
mov qword [0x1402228c0], 0
lea rcx, [0x1402228c0]
xor edx, edx
call fcn.1400934b0
lea rcx, [0x1402228c8]
call fcn.140100718
jmp 0x1401003d4
lea rcx, [0x1402228b8]
call fcn.140100680
cmp dword [0x1402228b8], 0xffffffff
jne 0x1401003a5
mov qword [0x1402228b0], 0
lea rcx, [0x1402228b0]
xor edx, edx
call fcn.1400934b0
lea rcx, [0x1402228b8]
call fcn.140100718
jmp 0x1401003a5
Function at 0x140100470
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1402228d8]
mov ecx, dword [0x140216fcc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401004ad
lea rcx, [0x1402228d0]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1400f34b0
lea rcx, [0x1402228d8]
call fcn.140100680
cmp dword [0x1402228d8], 0xffffffff
jne 0x140100499
mov qword [0x1402228d0], 0
lea rcx, [0x1402228d0]
xor edx, edx
call fcn.1400934b0
lea rcx, [0x1402228d8]
call fcn.140100718
jmp 0x140100499

Function at 0x14010e7a4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14010e8d4
Function at 0x140131300
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov al, 1
xchg byte [rcx + 0xb0], al
test al, 1
je 0x140131338
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401013e0
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov edi, edx
mov rbx, rcx
xor eax, eax
xchg qword [rcx + 0x90], rax
mov qword [rcx + 0xa8], rax
lock inc qword [rcx + 0xa0]
mov ecx, 0x58
call fcn.1401313e0
mov rsi, rax
mov rcx, rax
mov rdx, rbx
call fcn.1401316c0
cmp edi, 1
jne 0x140131389
call fcn.140131a50
lea rdx, [rsp + 0x20]
mov qword [rdx], rsi
mov rcx, rax
call fcn.140131b10
jmp 0x140131322
mov rcx, rsi
call fcn.140131bd0
test rsi, rsi
je 0x140131322
lea rcx, [rsi + 0x40]
mov rdx, qword [rsi + 0x48]
call fcn.140131dc0
mov rcx, rsi
add rcx, 0x28
call fcn.140132110
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x1401313c1
mov qword [rsi + 0x18], rcx
call fcn.140132450
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401013e0
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.140132450
Function at 0x140131b10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.1400d45d0
mov rax, qword [rsi]
mov qword [rsi], 0
mov rbx, qword [rdi + 0x10]
mov qword [rdi + 0x10], rax
test rbx, rbx
jne 0x140131b64
mov rcx, rdi
call fcn.1400d4600
add rdi, 8
mov rcx, rdi
call fcn.140028f10
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
jne 0x140131b96
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [rbx + 0x40]
mov rdx, qword [rbx + 0x48]
call fcn.140131dc0
lea rcx, [rbx + 0x28]
call fcn.140132110
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140131b8c
mov qword [rbx + 0x18], rcx
call fcn.140132450
mov rcx, rbx
call fcn.140132450
jmp 0x140131b39
lea rcx, [rdi + 0x40]
mov rdx, qword [rdi + 0x48]
call fcn.140131dc0
lea rcx, [rdi + 0x28]
call fcn.140132110
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140131bbe
mov qword [rdi + 0x18], rcx
call fcn.140132450
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140132450
Function at 0x140134b80
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.140132790
mov rsi, rax
mov r15, rax
mov byte [rsp + 0x37], 0
cmp byte [rax + 2], 0
je 0x140134c4d
mov edi, dword [0x140221510]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test ebx, ebx
jne 0x140134c43
cmp rdi, 1
jbe 0x140134cde
inc qword [rdi + 0x298]
mov rbx, qword [rdi + 0xc0]
test rbx, rbx
je 0x140134d08
inc qword [rdi + 0x2a0]
mov rax, qword [rbx]
test rax, rax
je 0x140134c14
mov rcx, rax
not rcx
cmp qword [rbx + 8], rcx
jne 0x140134d7e
bswap rax
dec byte [rdi + 0xc8]
mov qword [rdi + 0xc0], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401013e0
mov rax, rbx
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140134bd4
lea r14, [rsi + 0x1f0]
add rsi, 8
mov edi, 1
xor ebx, ebx
mov r12, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov ebp, 0x40
mov rcx, rsi
call r12
test al, al
jne 0x140134c9a
jmp 0x140134d83
pause
dec eax
jne 0x140134c7a
add ebx, edi
add edi, edi
cmp edi, 0x40
cmovge edi, ebp
cmp ebx, 0x3e8
jl 0x140134c6b
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [r14]
mov rbx, qword [rax]
test rbx, rbx
je 0x140134d9a
mov byte [rsp + 0x37], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x140134cc6
mov rdx, rcx
not rdx
cmp qword [rbx + 8], rdx
jne 0x140134d7e
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
jmp 0x140134c24
je 0x140134d33
mov byte [r15 + 2], 0
mov rcx, r15
call fcn.1400f6c10
mov rdi, rax
mov byte [r15 + 2], 1
inc qword [rax + 0x298]
mov rbx, qword [rax + 0xc0]
jmp 0x140134bec
inc qword [rdi + 0x2b0]
inc qword [rdi + reloc.SHELL32.dll_IsUserAnAdmin]
mov edx, ntohl
mov rcx, rdi
call fcn.1400f6e90
mov rbx, qword [rdi + 0xc0]
test rbx, rbx
jne 0x140134bfc
lea r14, [rsi + 0x1f0]
add rsi, 8
mov edi, 1
xor ebx, ebx
mov r12, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov ebp, 0x40
mov rcx, rsi
call r12
test al, al
jne 0x140134c9a
jmp 0x140134d92
pause
dec eax
jne 0x140134d61
add ebx, edi
add edi, edi
cmp edi, 0x40
cmovge edi, ebp
cmp ebx, 0x3e8
jl 0x140134d51
jmp 0x140134c92
call 0x140131100
mov eax, edi
test edi, edi
jg 0x140134c7a
jmp 0x140134c82
mov eax, edi
test edi, edi
jg 0x140134d61
jmp 0x140134d69
lea rax, [rsp + 0x37]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400cea80
mov rbx, rax
jmp 0x140134cd0
Function at 0x140138d20
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r13, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x140138d5a
mov rax, qword [r14]
mov qword [rbx], rax
add qword [r13 + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [r13]
mov rsi, qword [r13 + 8]
mov rax, rsi
sub rax, r15
jbe 0x140138db7
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, rsi
sub r15, rax
sub rbx, rsi
je 0x140138da6
mov rcx, r15
mov rdx, rsi
mov r8, rbx
call fcn.140103960
mov rsi, qword [r13 + 8]
add rbx, r15
mov qword [r13 + 0x10], rbx
lea rax, [rsi + r12*8]
mov qword [r13 + 8], rax
jmp 0x140138d3f
mov rax, rbx
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov edi, 1
cmovne rdi, rcx
mov rax, rdi
shr rax, 0x3d
jne 0x140138e83
mov r12, rdi
shr r12, 2
lea rcx, [rdi*8]
call fcn.140100528
lea r10, [rax + r12*8]
lea r9, [rax + rdi*8]
mov rcx, rbx
sub rcx, rsi
lea r8, [r10 + rcx]
mov rdx, r10
test rcx, rcx
je 0x140138e56
mov rdx, 0xffffffffffffffff
cmovns rdx, rcx
test rdx, rdx
mov r11d, 1
cmovle r11, rdx
mov rdi, rsi
sub rdi, rbx
cmp rdi, rcx
cmovle rdi, rcx
shr rdi, 3
imul rdi, r11
shl rdi, 3
lea rcx, [rax + r12*8]
xor ebx, ebx
mov rdx, qword [rsi + rbx]
mov qword [rcx + rbx], rdx
add rbx, 8
cmp rdi, rbx
jne 0x140138e42
mov rdx, r8
mov qword [r13], rax
mov qword [r13 + 8], r10
mov qword [r13 + 0x10], rdx
mov qword [r13 + 0x18], r9
mov rbx, rdx
test r15, r15
je 0x140138d3f
mov rcx, r15
call fcn.140100564
mov rbx, qword [r13 + 0x10]
jmp 0x140138d3f
call fcn.1401143a0
int3
Function at 0x140138e90
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov rbp, rcx
mov rdi, qword [rcx + 8]
cmp rdi, qword [rcx]
je 0x140138ecf
mov r13, rdi
mov rax, qword [r14]
mov qword [r13 - 8], rax
add qword [rbp + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rbp + 0x10]
mov rax, qword [rbp + 0x18]
cmp r15, rax
jae 0x140138f21
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea r13, [r15 + r12*8]
mov r8, r15
sub r8, rdi
je 0x140138f13
sub r13, r8
mov rcx, r13
mov rdx, rdi
call fcn.140103960
mov r15, qword [rbp + 0x10]
mov qword [rbp + 8], r13
lea rax, [r15 + r12*8]
mov qword [rbp + 0x10], rax
jmp 0x140138eb2
sub rax, rdi
mov rcx, rax
sar rcx, 2
test rax, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x140138fe8
lea r12, [rbx + 3]
shr r12, 2
lea rcx, [rbx*8]
call fcn.140100528
lea r13, [rax + r12*8]
lea r9, [rax + rbx*8]
mov rdx, r15
sub rdx, rdi
lea r8, [rdx + r13]
mov rcx, r13
test rdx, rdx
je 0x140138fbe
mov rcx, 0xffffffffffffffff
cmovns rcx, rdx
test rcx, rcx
mov r10d, 1
cmovle r10, rcx
mov rbx, rdi
sub rbx, r15
cmp rbx, rdx
cmovle rbx, rdx
shr rbx, 3
imul rbx, r10
shl rbx, 3
lea rdx, [rax + r12*8]
xor ecx, ecx
mov rsi, qword [rdi + rcx]
mov qword [rdx + rcx], rsi
add rcx, 8
cmp rbx, rcx
jne 0x140138faa
mov rcx, r8
mov qword [rbp], rax
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], r9
test rdi, rdi
je 0x140138eb2
mov rcx, rdi
call fcn.140100564
mov r13, qword [rbp + 8]
jmp 0x140138eb2
call fcn.1401143a0
int3
Function at 0x14013aa70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r15, rdx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rdx]
lea r12, [rdx + 8]
test rax, rax
mov rdx, r12
cmove rdx, rax
mov ebp, dword [rdx + 8]
xor ebx, ebx
test ebp, ebp
setne bl
lea rdi, [r15 + 0x28]
xor edx, edx
cmp rax, 1
cmovbe rdi, rdx
mov dword [rsp + 0x20], ebp
mov ebp, dword [rdi + 8]
test ebp, ebp
mov edi, 2
cmove rdi, rbx
lea rbx, [r15 + 0x48]
cmp rax, 2
cmovbe rbx, rdx
mov dword [rsp + 0x24], ebp
mov ebp, dword [rbx + 8]
test ebp, ebp
mov ebx, 3
cmove rbx, rdi
lea rdi, [r15 + 0x68]
cmp rax, 3
cmovbe rdi, rdx
mov dword [rsp + 0x28], ebp
mov ebp, dword [rdi + 8]
test ebp, ebp
mov edi, 4
cmove rdi, rbx
lea rbx, [r15 + 0x88]
cmp rax, 4
cmovbe rbx, rdx
mov dword [rsp + 0x2c], ebp
mov ebp, dword [rbx + 8]
test ebp, ebp
mov ebx, 5
cmove rbx, rdi
lea rdi, [r15 + 0xa8]
cmp rax, 5
cmovbe rdi, rdx
mov dword [rsp + 0x30], ebp
mov ebp, dword [rdi + 8]
test ebp, ebp
mov edi, 6
cmove rdi, rbx
lea rbx, [r15 + 0xc8]
cmp rax, 6
cmovbe rbx, rdx
mov dword [rsp + 0x34], ebp
mov ebp, dword [rbx + 8]
test ebp, ebp
mov ebx, 7
cmove rbx, rdi
lea rdi, [r15 + 0xe8]
cmp rax, 7
cmovbe rdi, rdx
mov dword [rsp + 0x38], ebp
mov ebp, dword [rdi + 8]
test ebp, ebp
mov edi, 8
cmove rdi, rbx
lea rbx, [r15 + 0x108]
cmp rax, 8
cmovbe rbx, rdx
mov r14, rcx
mov dword [rsp + 0x3c], ebp
mov ecx, dword [rbx + 8]
test ecx, ecx
mov ebp, 9
cmove rbp, rdi
cmp rax, 9
lea rax, [r15 + 0x128]
cmovbe rax, rdx
mov dword [rsp + 0x40], ecx
mov eax, dword [rax + 8]
mov dword [rsp + 0x44], eax
test eax, eax
mov r13d, 0xa
cmove r13, rbp
mov rsi, qword [r14]
lea rdi, [r14 + 8]
test rsi, rsi
cmovne rsi, rdi
mov rcx, rsi
mov rdx, r13
call fcn.14013a150
mov ebx, eax
test al, al
je 0x14013ac1e
test r13, r13
je 0x14013ac1e
mov ebp, 1
mov edx, dword [rsp + rbp*4 + 0x1c]
mov rcx, rsi
call fcn.14013a150
mov ebx, eax
test al, al
je 0x14013ac1e
lea rax, [rbp + 1]
cmp rbp, r13
mov rbp, rax
jb 0x14013ac00
test bl, bl
je 0x14013ac63
test r13, r13
je 0x14013ac63
mov esi, 1
lea rax, [rsi - 1]
mov rcx, rdi
cmp qword [r14], rax
ja 0x14013ac3a
xor ecx, ecx
mov rdx, r12
cmp qword [r15], rax
ja 0x14013ac44
xor edx, edx
call fcn.14013a240
mov ebx, eax
test al, al
je 0x14013ac63
lea rax, [rsi + 1]
add r12, 0x20
add rdi, 0x20
cmp rsi, r13
mov rsi, rax
jb 0x14013ac2c
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401013e0
mov eax, ebx
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140156590
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.140100528
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140156600]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.14010e570
mov qword [rbx], rax
test rax, rax
je 0x1401565e7
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x140158500
Capabilities:
Check if file exists
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.1400d91f0
test al, al
jne 0x140158521
mov rcx, rsi
call fcn.1400d91f0
test al, al
je 0x14015852a
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14015d5e0
Function at 0x14015a020
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov edi, 2
cmp rdx, 1
jne 0x14015a0c7
mov rbx, qword [rsi + 8]
cmp rdi, rbx
ja 0x14015a1b5
jae 0x14015a1ad
cmp rbx, 3
jb 0x14015a0e8
mov rax, rbx
shr rax, 1
movabs rcx, 0x5555555555555555
and rcx, rax
mov rax, rbx
sub rax, rcx
movabs rcx, 0x3333333333333333
mov rdx, rax
and rdx, rcx
shr rax, 2
and rax, rcx
add rax, rdx
mov rcx, rax
shr rcx, 4
add rcx, rax
movabs rax, 0xf0f0f0f0f0f0f0f
and rax, rcx
movabs rcx, 0x101010101010101
imul rcx, rax
shr rcx, 0x38
cmp ecx, 1
ja 0x14015a0e8
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x14015a0f8
cvtsi2ss xmm0, rax
jmp 0x14015a10d
lea rax, [rdx - 1]
test rdx, rax
jne 0x14015a0d8
mov rdi, rdx
jmp 0x14015a039
mov rcx, rdx
call fcn.1400d3760
mov rdi, rax
jmp 0x14015a039
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x14015a158
cvtsi2ss xmm0, rax
jmp 0x14015a16d
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.14012f650
cvttss2si rcx, xmm0
movss xmm1, dword [0x1401e1ee8]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
btc rax, 0x3f
ucomiss xmm0, xmm1
cmovb rax, rcx
cmp rax, 2
jb 0x14015a1a1
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x14015a1a1
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.14012f650
cvttss2si rax, xmm0
movss xmm1, dword [0x1401e1ee8]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rcx, xmm2
btc rcx, 0x3f
ucomiss xmm0, xmm1
cmovb rcx, rax
call fcn.1400d3760
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rbx
jb 0x14015a1b5
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140138910

Function at 0x14015c780
Capabilities:
Move file

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0x90], rax
movaps xmm0, xmmword [0x1401d9dd0]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str..._.._base_files_file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x18f
call fcn.1400d95e0
xor ebp, ebp
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.1400e5a80
movzx eax, byte [rsi + 0x17]
mov rcx, rax
test al, al
jns 0x14015c7ff
mov rcx, qword [rsi + 8]
cmp rcx, 0x103
ja 0x14015c826
test al, al
jns 0x14015c80f
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bpl
lea rcx, [rsp + 0x40]
call fcn.1400e5c10
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401013e0
mov eax, ebp
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14015d440
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm6, xmmword [0x1401d9dd0]
lea rbx, [rsp + 0x50]
movaps xmmword [rbx + 0x40], xmm6
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
lea rdx, str.DoCopyFile
lea r8, str..._.._base_files_file_util_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r9d, 0xb2
call fcn.1400d95e0
xor ebp, ebp
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
call fcn.1400e5a80
mov rcx, rdi
call fcn.1400d91f0
test al, al
je 0x14015d502
lea rcx, [rsp + 0x50]
call fcn.1400e5c10
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401013e0
mov eax, ebp
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, r15
call fcn.1400d91f0
test al, al
je 0x14015d512
xor ebp, ebp
jmp 0x14015d4ce
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x14015d51e
mov rax, qword [rdi + 8]
cmp rax, 0x103
ja 0x14015d50e
movzx eax, byte [r15 + 0x17]
test al, al
jns 0x14015d533
mov rax, qword [r15 + 8]
cmp rax, 0x103
ja 0x14015d50e
lea rsi, [rsp + 0x20]
movaps xmmword [rsi], xmm6
lea rdx, str.DoCopyFile
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0xbf
call fcn.1400d95e0
lea r8, [0x14021b364]
mov rcx, rsi
mov rdx, rbx
call fcn.14007b850
cmp byte [r15 + 0x17], 0
jns 0x14015d580
mov r15, qword [r15]
movzx r8d, r14b
cmp byte [rdi + 0x17], 0
jns 0x14015d58d
mov rdi, qword [rdi]
mov rcx, rdi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14015d5d8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x14015d5c2
mov eax, edi
and eax, 1
je 0x14015d5c2
mov edx, edi
and edx, 0xfffffffe
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
setne bpl
lea rcx, [rsp + 0x20]
call fcn.14007b9f0
jmp 0x14015d4ce
xor ebp, ebp
jmp 0x14015d5c9
Function at 0x14015d5e0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x100
movaps xmmword [rsp + 0xf0], xmm6
mov r12, rdx
mov rdi, rcx
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0xe8], rax
movaps xmm6, xmmword [0x1401d9dd0]
lea rbp, [rsp + 0x20]
movaps xmmword [rbp + 0x40], xmm6
movaps xmmword [rbp + 0x30], xmm6
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x10], xmm6
movaps xmmword [rbp], xmm6
lea rdx, str.MoveUnsafe
lea r8, str..._.._base_files_file_util_win.cc
lea rsi, [rsp + 0x90]
mov rcx, rsi
mov r9d, 0x424
call fcn.1400d95e0
xor ebx, ebx
mov rcx, rbp
mov rdx, rsi
xor r8d, r8d
call fcn.1400e5a80
movzx eax, byte [rdi + 0x17]
mov rcx, rax
test al, al
jns 0x14015d674
mov rcx, qword [rdi + 8]
cmp rcx, 0x103
jbe 0x14015d6b3
lea rcx, [rsp + 0x20]
call fcn.1400e5c10
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.1401013e0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xf0]
add rsp, 0x100
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movzx ecx, byte [r12 + 0x17]
mov rdx, rcx
test cl, cl
jns 0x14015d6c5
mov rdx, qword [r12 + 8]
cmp rdx, 0x103
jbe 0x14015d6d2
xor ebx, ebx
jmp 0x14015d67d
mov rdx, r12
test cl, cl
jns 0x14015d6dd
mov rdx, qword [r12]
mov rcx, rdi
test al, al
jns 0x14015d6e7
mov rcx, qword [rdi]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x14015d67d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
lea r15, [rsp + 0x90]
movaps xmmword [r15 + 0x40], xmm6
movaps xmmword [r15 + 0x30], xmm6
movaps xmmword [r15 + 0x20], xmm6
movaps xmmword [r15 + 0x10], xmm6
movaps xmmword [r15], xmm6
lea rdx, str.DirectoryExists
lea r8, str..._.._base_files_file_util_win.cc
lea rsi, [rsp + 0x70]
mov rcx, rsi
mov r9d, 0x1f6
call fcn.1400d95e0
mov rcx, r15
mov rdx, rsi
xor r8d, r8d
call fcn.1400e5a80
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x14015d75d
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
mov rcx, r15
call fcn.1400e5c10
cmp ebp, 0xffffffff
je 0x14015d777
and ebp, 0x10
jne 0x14015d785
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14015d6ce
mov rcx, rdi
mov rdx, r12
call fcn.14015d7a0
test al, al
jne 0x14015d67d
jmp 0x14015d777