joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401c6360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140516040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov al, byte [rdx]
cmp al, 0xa3
je 0x1401c64c5
mov rcx, rdi
cmp al, 0xa4
je 0x1401c64d1
movzx eax, al
cmp eax, 0x80
je 0x1401c64cd
test rdi, rdi
je 0x1401c6450
mov eax, dword [rdi + 4]
test eax, 0x82000
jne 0x1401c6555
cmp byte [rsi + 0x23], 0
je 0x1401c6452
cmp byte [rdi], 0xa3
je 0x1401c6452
movaps xmm0, xmmword [0x140484a40]
lea r14, [rsp + 0x20]
movups xmmword [r14 + 0x18], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [r14 + 0x28], rax
mov word [r14 + 0x24], 2
mov qword [r14], rsi
lea rax, [0x14028c340]
mov qword [r14 + 8], rax
lea rax, [0x1401c7790]
mov qword [r14 + 0x10], rax
mov rcx, r14
mov rdx, rdi
call fcn.14028c480
cmp word [r14 + 0x24], 0
je 0x1401c6452
mov dword [rbx], 0
mov rcx, rsi
mov rdx, rdi
mov r8d, 0xffffffff
call fcn.1401c4720
mov ebp, eax
jmp 0x1401c647e
dec al
mov byte [rsi + 0x1f], al
movzx eax, al
mov r14d, dword [rsi + rax*4 + 0xd8]
jmp 0x1401c6464
xor edi, edi
mov al, byte [rsi + 0x1f]
test al, al
jne 0x1401c643e
mov r14d, dword [rsi + 0x38]
inc r14d
mov dword [rsi + 0x38], r14d
mov rcx, rsi
mov rdx, rdi
mov r8d, r14d
call fcn.140289030
mov ebp, eax
cmp eax, r14d
jne 0x1401c64a4
mov eax, r14d
mov dword [rbx], eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
cmp rcx, qword [0x140516040]
je 0x1401c6495
call fcn.14029bbb0
int3
mov eax, ebp
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor eax, eax
test r14d, r14d
je 0x1401c647c
movzx ecx, byte [rsi + 0x1f]
cmp rcx, 7
ja 0x1401c647c
lea edx, [rcx + 1]
mov byte [rsi + 0x1f], dl
mov dword [rsi + rcx*4 + 0xd8], r14d
jmp 0x1401c647c
mov al, byte [rdi + 2]
jmp 0x1401c638e
mov rcx, qword [rdi + 0x20]
mov rax, qword [rcx + 0x20]
mov r14d, dword [rax]
cmp r14, 1
je 0x1401c63a7
mov dword [rbx], 0
xor eax, eax
cmp al, byte [rdi]
jno 0x1401c6512
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14029bbb0
mov rcx, rsi
mov rdx, rdi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1401c4ab0
mov ebx, dword [rsi + 0x38]
lea ebp, [rbx + 1]
lea eax, [rbx + r14]
mov dword [rsi + 0x38], eax
test r14d, r14d
jle 0x1401c647e
shl r14, 5
inc ebx
xor r15d, r15d
mov rax, qword [rdi + 0x20]
mov rdx, qword [rax + r15 + 8]
mov rcx, rsi
mov r8d, ebx
call fcn.14041b640
add r15, 0x20
inc ebx
cmp r14, r15
jne 0x1401c6531
jmp 0x1401c647e
bt eax, 0x13
jb 0x1401c656a
cmp byte [rdi], 0x67
jne 0x1401c63be
add rdi, 0x10
jmp 0x1401c6572
mov rdi, qword [rdi + 0x20]
add rdi, 8
mov rdi, qword [rdi]
jmp 0x1401c63a7
Function at 0x1401da580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, qword [rcx + 0x98]
test r14, r14
je 0x1401da69c
mov rsi, rcx
mov rdi, qword [rcx + 0x10]
mov r15, qword [rcx]
mov r13, qword [r15 + 0x20]
movsxd rbx, dword [r14 + 0x10]
mov r12d, dword [r14 + 0x14]
mov al, byte [rsi + 0x1f]
test al, al
jne 0x1401da6c4
mov ebp, dword [rsi + 0x38]
inc ebp
mov dword [rsi + 0x38], ebp
movsxd rax, dword [rdi + 0x90]
lea r9d, [rax + 7]
lea r8d, [r12 + 2]
cmp dword [rdi + 0x94], eax
jle 0x1401da6ad
lea ecx, [rax + 1]
mov dword [rdi + 0x90], ecx
mov rcx, qword [rdi + 0x88]
lea rax, [rax + rax*2]
mov dword [rcx + rax*8], 0x35
mov dword [rcx + rax*8 + 4], r8d
mov dword [rcx + rax*8 + 8], r9d
mov dword [rcx + rax*8 + 0xc], r12d
mov qword [rcx + rax*8 + 0x10], 0
shl rbx, 5
mov rax, qword [r13 + rbx + 0x18]
mov r9, qword [rax + 0x68]
mov r8d, dword [r14 + 0x10]
mov dword [rsp + 0x20], 0x73
mov rcx, rsi
xor edx, edx
call fcn.1401c3cf0
mov rcx, rdi
mov edx, 5
lea r8, [0x1404f9cd0]
call fcn.14019f950
test rax, rax
je 0x1401da69c
lea ecx, [r12 + 1]
mov dword [rax + 4], ecx
mov dword [rax + 0x20], ecx
dec r12d
mov dword [rax + 0x34], r12d
mov dword [rax + 0x3c], ebp
mov dword [rax + 0x50], ebp
mov dword [rax + 0x54], ecx
mov word [rax + 0x4a], 8
test ebp, ebp
je 0x1401da690
movzx eax, byte [rsi + 0x1f]
cmp rax, 7
ja 0x1401da690
lea ecx, [rax + 1]
mov byte [rsi + 0x1f], cl
mov dword [rsi + rax*4 + 0xd8], ebp
mov r14, qword [r14]
test r14, r14
jne 0x1401da5aa
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x20], r12d
mov rcx, rdi
mov edx, 0x35
call fcn.1401b7bc0
jmp 0x1401da618
dec al
mov byte [rsi + 0x1f], al
movzx eax, al
mov ebp, dword [rsi + rax*4 + 0xd8]
jmp 0x1401da5c9
Function at 0x1401ddd90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x140516040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movzx eax, byte [rcx]
add rax, 0xffffffffffffffc6
cmp rax, 0xfffffffffffffff6
jae 0x1401dde1d
mov ebx, r8d
mov edi, edx
xor r14d, r14d
mov eax, 0
test rsi, rsi
je 0x1401dddde
mov rcx, rsi
call fcn.1402bd870
and eax, 0x3fffffff
mov rcx, rsi
neg rcx
mov ecx, 0
sbb ecx, ecx
lea r9d, [rax + 1]
lea r8, [0x1404fa331]
mov edx, 0xfffffff8
lea r15, [rdx + 6]
lea r12, [0x1404f3130]
movzx edx, byte [r14 + r8]
cmp eax, edx
je 0x1401dde37
inc r14
cmp r14, 8
jne 0x1401dde06
jmp 0x1401ddeab
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0
mov rcx, rsi
mov rdx, rdi
call fcn.1401b8950
mov bl, byte [rdi]
jmp 0x1401ddeab
lea rdx, [0x1404fa329]
movzx r13d, byte [r14 + rdx]
mov edx, ecx
lea r10, str.onoffalseyestruextrafull
add r13, r10
je 0x1401ddee9
test rsi, rsi
je 0x1401dde0f
test eax, eax
je 0x1401dde87
xor ebp, ebp
mov edx, r9d
movzx r10d, byte [r13 + rbp]
test r10, r10
je 0x1401dded5
mov r10b, byte [r10 + r12]
movzx r11d, byte [rsi + rbp]
cmp r10b, byte [r11 + r12]
jne 0x1401dded8
dec edx
inc rbp
cmp edx, 1
ja 0x1401dde63
test edi, edi
je 0x1401ddea0
mov rdx, r14
mov r10d, 0xfffffff8
or rdx, r10
cmp rdx, r15
jae 0x1401dde0f
lea rax, [0x1404fa339]
mov bl, byte [r14 + rax]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x140516040]
je 0x1401ddec2
call fcn.14029bbb0
int3
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r10d, r10d
movzx edx, r10b
movzx r10d, byte [rsi + rbp]
movzx r10d, byte [r10 + r12]
sub edx, r10d
test edx, edx
je 0x1401dde87
jmp 0x1401dde0f
Function at 0x1401e0f70
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 0x40
jb 0x1401e0fc7
cmp byte [rcx], 0x4d
jne 0x1401e0fc7
cmp byte [rcx + 1], 0x5a
jne 0x1401e0fc7
mov r9d, dword [rcx + 0x3c]
mov eax, r9d
test al, 7
setne r10b
cmp r9d, 0x40
setb r9b
or r9b, r10b
mov r10, rdx
sub r10, rax
setbe r11b
or r11b, r9b
cmp r10, 0x18
setb r9b
or r9b, r11b
jne 0x1401e0fc7
cmp byte [rcx + rax], 0x50
jne 0x1401e0fc7
cmp byte [rcx + rax + 1], 0x45
jne 0x1401e0fc7
cmp byte [rcx + rax + 2], 0
je 0x1401e0fca
xor eax, eax
ret
cmp byte [rcx + rax + 3], 0
jne 0x1401e0fc7
add rax, 0x18
sub rdx, rax
setbe r9b
cmp rdx, 2
setb dl
or dl, r9b
jne 0x1401e0fc7
cmp word [rcx + rax], r8w
sete al
ret
Function at 0x1401e9190
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x1401e91d8
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1401e91e1
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1401e91c8
mov qword [rdi], rsi
call fcn.140212f50
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140212f50
mov rcx, qword [rdi]
call fcn.1401fded0
mov qword [rdi], 0
jmp 0x1401e91b6
Function at 0x1401f3570
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x40
jb 0x1401f366e
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x1404927c0]
nop dword [rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm3
pclmulqdq xmm7, xmm4, 0
movdqa xmm8, xmm2
pclmulqdq xmm8, xmm4, 0
movdqa xmm9, xmm1
pclmulqdq xmm9, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm1, xmm5, 0x11
movdqu xmm10, xmmword [rcx]
pxor xmm10, xmm6
pxor xmm0, xmm10
movdqu xmm6, xmmword [rcx + 0x10]
pxor xmm6, xmm7
pxor xmm3, xmm6
movdqu xmm6, xmmword [rcx + 0x20]
pxor xmm6, xmm8
pxor xmm2, xmm6
movdqu xmm6, xmmword [rcx + 0x30]
pxor xmm6, xmm9
pxor xmm1, xmm6
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x3f
ja 0x1401f35e0
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
pmovzxdq xmm3, qword [0x1404927e0]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp rdx, 0x10
jb 0x1401f36fe
movdqu xmm1, xmmword [rcx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add rcx, 0x10
add rdx, 0xfffffffffffffff0
cmp rdx, 0xf
ja 0x1401f36d4
pmovzxdq xmm1, qword [0x1404927e0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
pxor xmm3, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm3, 3
pclmulqdq xmm0, xmmword [0x1404927d0], 0x10
pblendw xmm0, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm3
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x1401fdd60
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x140516040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x14052b250]
mov ecx, dword [0x140527e80]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401fddc7
mov rax, qword [0x14052b248]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
cmp rcx, qword [0x140516040]
je 0x1401fddbd
call fcn.14029bbb0
int3
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x14052b250]
call fcn.14029a6ac
cmp dword [0x14052b250], 0xffffffff
jne 0x1401fdd9c
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1402d9b60
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x88
call fcn.14029a62c
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x14052b298]
mov ecx, dword [0x140527e80]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401fde87
lea r8, [0x14052b268]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.1400fe170
mov qword [0x14052b248], rsi
lea rcx, [0x14052b250]
call fcn.14029a760
jmp 0x1401fdd9c
lea rcx, [0x14052b298]
call fcn.14029a6ac
cmp dword [0x14052b298], 0xffffffff
jne 0x1401fde58
xorps xmm0, xmm0
movups xmmword [0x14052b288], xmm0
movups xmmword [0x14052b278], xmm0
movups xmmword [0x14052b268], xmm0
lea rcx, [0x14052b268]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14052b298]
call fcn.14029a760
jmp 0x1401fde58
Function at 0x1401fe730
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x140516040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movsd xmm0, qword [0x14052b328]
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x1401fe760
jnp 0x1401fe785
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x140516040]
je 0x1401fe777
call fcn.14029bbb0
int3
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov esi, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x14052b338]
mov ecx, dword [0x140527e80]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401fe89d
mov eax, dword [0x14052b348]
mov ecx, dword [0x140527e80]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401fe8d7
rdtsc
mov rdi, rax
mov rbx, rdx
xor r15d, r15d
lea r14, [rsp + 0x28]
mov qword [r14], r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r12, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [r14], r15
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub r12, qword [0x14052b340]
xorps xmm1, xmm1
cvtsi2sd xmm1, r12
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x140492020]
ucomisd xmm2, xmm1
ja 0x1401fe760
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x14052b330]
movq xmm0, rdi
punpckldq xmm0, xmmword [0x140492030]
subpd xmm0, xmmword [0x140492040]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x14052b328], xmm0
jmp 0x1401fe760
lea rcx, [0x14052b338]
call fcn.14029a6ac
cmp dword [0x14052b338], 0xffffffff
jne 0x1401fe7ce
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x14052b330], rdx
lea rcx, [0x14052b338]
call fcn.14029a760
jmp 0x1401fe7ce
lea rcx, [0x14052b348]
call fcn.14029a6ac
cmp dword [0x14052b348], 0xffffffff
jne 0x1401fe7f3
lea rdi, [rsp + 0x28]
mov qword [rdi], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
mov qword [0x14052b340], rax
lea rcx, [0x14052b348]
call fcn.14029a760
jmp 0x1401fe7f3
Function at 0x1401fe970
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor r8d, r8d
test edx, edx
sete r8b
xor ecx, ecx
mov edx, r8d
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x1401fea0a
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1401fe9f4
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1401fe9d1
mov qword [rsi], rdi
call fcn.140212f50
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 0
inc rax
cmp rax, 1
jbe 0x1401fea0e
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140212f50
mov rcx, qword [rsi]
call fcn.1401fded0
mov qword [rsi], 0
jmp 0x1401fe9bf
mov byte [rsi + 8], 0
int3
Function at 0x140202230
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb0
mov esi, r9d
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140516040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [0x140484a40]
lea r12, [rsp + 0x60]
movaps xmmword [r12 + 0x30], xmm0
movaps xmmword [r12 + 0x20], xmm0
movaps xmmword [r12 + 0x10], xmm0
movaps xmmword [r12], xmm0
lea rdx, str.Read
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x42
call fcn.140212f30
mov rcx, r12
mov rdx, r15
xor r8d, r8d
call fcn.140205200
mov ebp, 0xffffffff
test r14, r14
js 0x14020232c
test esi, esi
js 0x14020232c
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.140232d20
test al, al
jne 0x14020237c
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140202364
mov ebp, dword [rsp + 0x2c]
test ebp, ebp
js 0x140202377
lea rcx, [rsp + 0x30]
call fcn.140232da0
lea rcx, [rsp + 0x60]
call fcn.140205290
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
cmp rcx, qword [0x140516040]
je 0x140202350
call fcn.14029bbb0
int3
mov eax, ebp
add rsp, 0xb0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
cmp eax, 0x26
setne bpl
neg ebp
jmp 0x140202322
int3
mov r9d, esi
lea rdx, str.File::Read
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1403a7ca0
jmp 0x1402022e4
Function at 0x1402023a0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140516040]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x140484a40]
lea r14, [rsp + 0x50]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.ReadAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x5f
call fcn.140212f30
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140205200
test esi, esi
js 0x1402024af
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.140232d20
test al, al
jne 0x1402024bb
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1402024d7
mov esi, dword [rsp + 0x2c]
test esi, esi
js 0x1402024b6
lea rcx, [rsp + 0x30]
call fcn.140232da0
lea rcx, [rsp + 0x50]
call fcn.140205290
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
cmp rcx, qword [0x140516040]
je 0x14020249e
call fcn.14029bbb0
int3
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14020247a
int3
mov r9d, esi
lea rdx, str.File::ReadAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1403a7ca0
jmp 0x140202440
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x140202470

Function at 0x1402024f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb0
mov esi, r9d
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140516040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [0x140484a40]
lea r12, [rsp + 0x60]
movaps xmmword [r12 + 0x30], xmm0
movaps xmmword [r12 + 0x20], xmm0
movaps xmmword [r12 + 0x10], xmm0
movaps xmmword [r12], xmm0
lea rdx, [0x140494b10]
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x81
call fcn.140212f30
mov rcx, r12
mov rdx, r15
xor r8d, r8d
call fcn.140205200
mov ebp, 0xffffffff
test r14, r14
js 0x1402025ed
test esi, esi
js 0x1402025ed
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.140232d20
test al, al
jne 0x140202625
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
lea r14, [rsp + 0x2c]
mov dword [r14], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor ebp, ebp
cmp eax, 1
sbb ebp, ebp
or ebp, dword [r14]
lea rcx, [rsp + 0x30]
call fcn.140232da0
lea rcx, [rsp + 0x60]
call fcn.140205290
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
cmp rcx, qword [0x140516040]
je 0x140202611
call fcn.14029bbb0
int3
mov eax, ebp
add rsp, 0xb0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r9d, esi
lea rdx, str.File::Write
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1403a7ca0
jmp 0x1402025a4
Function at 0x140202650
Capabilities:
Get file version info

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140516040]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x140484a40]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.CreateFileVersionInfoWin
lea r8, str....._base_file_version_info_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x4d
call fcn.140212f30
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.140205200
mov dword [rsp + 0x2c], 0xaaaaaaaa
cmp byte [rbx + 0x17], 0
jns 0x1402026d4
mov rbx, qword [rbx]
lea rdx, [rsp + 0x2c]
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
jne 0x140202710
mov qword [rsi], 0
lea rcx, [rsp + 0x50]
call fcn.140205290
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
cmp rcx, qword [0x140516040]
je 0x14020272b
call fcn.14029bbb0
int3
mov ebp, eax
mov r14d, eax
mov rcx, r14
call fcn.14029a62c
mov rdi, rax
lea r15, [rax + r14]
xor eax, eax
jmp 0x140202847
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edx, dword [rsp + 0x2c]
mov rcx, rbx
mov r8d, ebp
mov r9, rdi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140202861
lea r8, [rsp + 0x30]
mov qword [r8], 0
lea r9, [rsp + 0x94]
mov dword [r9], 0xaaaaaaaa
lea rdx, str.VarFileInfoTranslation
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140202861
mov r14, qword [rsp + 0x30]
test r14, r14
je 0x140202861
mov ecx, 0x38
call fcn.14029a62c
mov rbx, rax
movzx r12d, word [r14]
movzx ebp, word [r14 + 2]
lea rax, fcn.140109b10
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
movabs r14, 0xfffffffc00000000
mov rax, rdi
and rax, r14
cmp rax, qword [0x140518a88]
jne 0x1402027e7
mov rcx, rdi
call fcn.1400c3720
mov qword [rbx + 0x20], rdi
mov word [rbx + 0x28], r12w
mov word [rbx + 0x2a], bp
lea r8, [rsp + 0x30]
mov qword [r8], 0
lea r9, [rsp + 0x94]
mov dword [r9], 0xaaaaaaaa
lea rdx, [0x1404a1d82]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14020287e
mov rdi, qword [rsp + 0x30]
and r14, rdi
cmp r14, qword [0x140518a88]
jne 0x14020283b
mov rcx, rdi
call fcn.1400c3720
mov qword [rbx + 0x30], rdi
mov qword [rsi], rbx
jmp 0x1402026ec
mov rcx, rdi
add rcx, rax
je 0x14020285f
mov byte [rcx], 0
inc rax
cmp r14, rax
jne 0x140202847
jmp 0x140202740
ud2
mov qword [rsi], 0
test rdi, rdi
je 0x1402026ec
mov rcx, rdi
call fcn.14029a668
jmp 0x1402026ec
int3
Function at 0x140215b90
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1402020f0
mov qword [rsi], 0
test rax, rax
je 0x140215be3
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140215c17
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140215bdb
mov qword [rsi], rbx
call fcn.140212f50
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.140213ee0
lea rcx, [rsi + 0x20]
call fcn.140232d40
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.140212f50
mov rcx, qword [rsi]
call fcn.1401fded0
mov qword [rsi], 0
jmp 0x140215bc9