joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400aebe0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov esi, r9d
mov rbx, r8
mov ebp, edx
mov r14, rcx
mov r13d, dword [rcx + 8]
mov r15d, dword [rcx + 0x18]
add r15d, dword [rcx + 0x14]
add r15d, dword [rcx + 0x1c]
mov rcx, r15
call fcn.1401f05e0
test rax, rax
je 0x1400aec4a
mov rdi, rax
add r13, rbx
mov r12, rax
test r15d, r15d
je 0x1400aec51
mov ecx, ebp
mov rdx, r12
mov r8d, r15d
call fcn.14025a3ec
test eax, eax
js 0x1400aec6d
sub r15d, eax
mov ecx, eax
add r12, rcx
test eax, eax
jne 0x1400aec21
test r15d, r15d
je 0x1400aec21
jmp 0x1400aec66
mov ebp, 1
jmp 0x1400aec7a
mov eax, dword [r14 + 0x14]
imul ecx, eax, 0xaaaaaaab
ror ecx, 2
cmp ecx, 0x15555555
jbe 0x1400aec8d
mov ebp, 8
jmp 0x1400aec72
mov ebp, 6
mov rcx, rdi
call fcn.1401f0640
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test rax, rax
je 0x1400aedb8
mov dword [rsp + 0x24], esi
mov r15, rdi
add r15, rax
mov eax, dword [r14 + 0x18]
mov ecx, dword [r14 + 0x1c]
add rax, r15
add rcx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
mov r14, rax
mov qword [rsp + 0x28], r15
mov rsi, rdi
mov qword [rsp + 0x30], rbx
mov ecx, dword [rsi]
mov r12, qword [sym.imp.WS2_32.dll_ntohl]
call r12
mov dword [rsi], eax
mov ecx, dword [rsi + 4]
call r12
mov dword [rsi + 4], eax
mov ecx, dword [rsi + 8]
call r12
mov dword [rsi + 8], eax
mov eax, dword [rsi]
mov rcx, r13
sub rcx, rbx
cmp rcx, rax
jb 0x1400aec66
mov rcx, qword [rsp + 0x40]
sub rcx, r15
cmp rcx, rax
jb 0x1400aec66
test eax, eax
je 0x1400aed24
xor eax, eax
mov cl, byte [rbx + rax]
add byte [r15 + rax], cl
inc rax
mov r8d, dword [rsi]
cmp rax, r8
jb 0x1400aed10
jmp 0x1400aed27
xor r8d, r8d
mov ecx, dword [rsp + 0x24]
mov rdx, r15
call fcn.14025f42c
mov ebp, 7
cmp eax, dword [rsi]
jne 0x1400aec72
mov r12d, eax
mov r8d, dword [rsi + 4]
mov rax, qword [rsp + 0x38]
sub rax, r14
cmp rax, r8
jb 0x1400aec66
mov ecx, dword [rsp + 0x24]
mov rdx, r14
call fcn.14025f42c
cmp eax, dword [rsi + 4]
jne 0x1400aec72
mov edx, r12d
add rbx, rdx
movsxd rcx, dword [rsi + 8]
mov r8, qword [rsp + 0x30]
sub r8, rbx
cmp r8, rcx
jg 0x1400aec66
mov r8, r13
sub r8, rbx
cmp r8, rcx
jl 0x1400aec66
add r15, rdx
mov eax, eax
add r14, rax
add rbx, rcx
add rsi, 0xc
xor ebp, ebp
cmp rsi, qword [rsp + 0x28]
jb 0x1400aecc8
jmp 0x1400aec72
xor ebp, ebp
jmp 0x1400aec72
Function at 0x1400aedc0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov r15, r8
mov r12, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea r13, [rsp + 0x30]
mov dword [r13], 0xaaaaaaaa
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x28], 0
xor esi, esi
mov rcx, rdx
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.14025b17c
neg eax
sbb esi, esi
or esi, dword [r13]
js 0x1400aee61
movaps xmm6, xmmword [0x1403aa440]
lea rdx, [rsp + 0x70]
movaps xmmword [rdx + 0x10], xmm6
movaps xmmword [rdx], xmm6
mov ecx, esi
call fcn.1400aeaf0
mov ebx, 0xffffffff
xor r14d, r14d
test eax, eax
je 0x1400aee6b
mov edi, eax
mov ebp, 0xffffffff
jmp 0x1400aefa3
mov edi, 6
jmp 0x1400aefc8
mov dword [rsp + 0x30], 0xaaaaaaaa
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x28], 0
mov rcx, r12
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.14025b17c
mov ebp, dword [rsp + 0x30]
neg eax
mov r12d, 0
sbb r12d, r12d
or r12d, ebp
js 0x1400aef8a
lea rdx, [rsp + 0x30]
movaps xmmword [rdx + 0x20], xmm6
movaps xmmword [rdx + 0x10], xmm6
movaps xmmword [rdx], xmm6
mov ecx, r12d
call fcn.140257f4c
mov ebx, 0xffffffff
mov edi, 6
test eax, eax
jne 0x1400aefa0
mov r13d, dword [rsp + 0x44]
cmp r13d, dword [rsp + 0x78]
jne 0x1400aef94
mov rcx, r13
call fcn.1401f05e0
test rax, rax
je 0x1400aef9b
mov r14, rax
mov ecx, r12d
mov rdx, rax
mov r8d, r13d
call fcn.14025a3ec
cmp eax, dword [rsp + 0x78]
jne 0x1400aefa3
mov r12d, eax
call fcn.1402ccca0
movsxd rdx, r12d
mov rcx, r14
call fcn.1402ccc70
not eax
cmp dword [rsp + 0x7c], eax
jne 0x1400aeff6
lea rbx, [rsp + 0x6c]
mov dword [rbx], 0xaaaaaaaa
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
xor r12d, r12d
mov rcx, r15
mov edx, 0x8301
mov r8d, 0x40
xor r9d, r9d
call fcn.14025b17c
mov ebx, dword [rbx]
neg eax
sbb r12d, r12d
or r12d, ebx
js 0x1400aeffd
lea rcx, [rsp + 0x70]
mov edx, esi
mov r8, r14
mov r9d, r12d
call fcn.1400aebe0
mov edi, eax
jmp 0x1400aefa3
mov edi, 6
mov ebp, r12d
jmp 0x1400aefa3
mov edi, 8
jmp 0x1400aefa0
mov edi, 1
xor r14d, r14d
mov rcx, r14
call fcn.1401f0640
mov ecx, esi
call fcn.140254dd4
test ebp, ebp
js 0x1400aefbd
mov ecx, ebp
call fcn.140254dd4
test ebx, ebx
js 0x1400aefc8
mov ecx, ebx
call fcn.140254dd4
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140242430
mov eax, edi
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 4
jmp 0x1400aefa3
mov ebx, r12d
jmp 0x1400aefa3
Function at 0x1400b3b80
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x38], rax
test rcx, rcx
je 0x1400b3c04
mov rsi, rcx
xor eax, eax
mov qword [rsp + 0x30], rax
mov rbx, qword [rdx]
mov qword [rdx], rax
cmp rbx, 0xffffffffffffffff
je 0x1400b3bbb
test rbx, rbx
je 0x1400b3bdf
call fcn.1401de850
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400b3bd7
mov qword [rsp + 0x30], rbx
call fcn.1401de850
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140112370
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140242430
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140280b90
int3
Function at 0x1400ba6e0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov qword [rsp + 0x50], r9
mov ebp, r8d
mov rsi, rdx
mov r14d, ecx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r15d, r15d
lea r12, [rsp + 0x78]
mov qword [r12], r15
lea r13, [rsp + 0x70]
mov qword [r13], r15
lea rdi, [rsp + 0x68]
mov qword [rdi], r15
mov ecx, pe_nt_image_headers64
call fcn.140240cd8
mov rbx, rax
mov rcx, rax
xor edx, edx
call fcn.1401f64b0
lea rax, [rsp + 0x60]
mov qword [rax], r15
mov ecx, ebp
mov r15d, r14d
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov rdx, r15
mov r8, r15
mov r9, rsi
call fcn.1400ba920
mov dword [rsp + 0x4c], eax
test eax, eax
jne 0x1400ba8e7
mov ecx, 0x88
call fcn.140240cd8
mov r14, rax
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
xor esi, esi
mov qword [rsp + 0x78], rsi
lea rdx, [0x1403afaaa]
mov rcx, rax
call fcn.1402017b0
lea rax, fcn.1401d3cf0
mov qword [r14], rax
mov qword [r14 + 0x10], rbx
xorps xmm0, xmm0
movups xmmword [r14 + 0x18], xmm0
mov qword [r14 + 0x28], rsi
mov qword [r14 + 0x30], rbp
mov word [r14 + 0x38], 0x100
mov byte [r14 + 0x3a], 1
mov qword [r14 + 0x40], r13
mov qword [r14 + 0x48], r12
mov qword [r14 + 0x50], rdi
mov qword [r14 + 0x58], r15
movups xmmword [r14 + 0x60], xmm0
mov qword [r14 + 0x70], rsi
movups xmm0, xmmword [0x1403be1c0]
movups xmmword [r14 + 0x78], xmm0
mov eax, dword [0x14042b5a8]
mov ecx, dword [0x14042a04c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400ba892
lock inc dword [0x14042b59c]
lea rdx, [rsp + 0x58]
mov qword [rdx], r14
mov rcx, rbx
call fcn.1401f6910
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
mov qword [rax], rbx
test rcx, rcx
jne 0x1400ba8f3
mov rcx, qword [rsp + 0x78]
test rcx, rcx
jne 0x1400ba902
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140242430
mov eax, dword [rsp + 0x4c]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x14042b5a8]
call fcn.140240e30
cmp dword [0x14042b5a8], 0xffffffff
jne 0x1400ba831
lea rax, [0x1403a7230]
mov qword [0x14042b5a0], rax
lea r15, [0x14042b5a0]
call fcn.1400fc450
lea r8, str.MojoMessages
mov rcx, rax
mov rdx, r15
xor r9d, r9d
call fcn.1400fc500
lea rcx, [0x14042b5a8]
call fcn.140240ec8
jmp 0x1400ba831
test rbx, rbx
je 0x1400ba85c
mov rcx, rbx
mov edx, 1
call fcn.1401f6b70
jmp 0x1400ba85c
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x1402bbc90.0]
jmp 0x1400ba86a
Function at 0x1400bc830
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x50], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x30]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x1403aa440]
movaps xmmword [r14], xmm0
mov rax, qword [rdx]
mov rax, qword [rax + 0x38]
mov rcx, rdx
mov rdx, r14
call qword [case.0x1402bbc90.0]
mov rbx, qword [r14]
mov r14, qword [r14 + 8]
cmp rbx, r14
jne 0x1400bc8fd
lea r14, [rsi + 0xe0]
mov ebx, dword [rdi + 8]
mov rax, qword [rdi]
mov rax, qword [rax + 0x10]
mov rcx, rdi
call qword [case.0x1402bbc90.0]
mov rcx, qword [rsi + 0x78]
mov qword [rsp + 0x20], r14
mov rdx, rax
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400bc8ee
mov byte [rsi + 0x12a], 1
lock inc dword [rsi + 8]
mov rdi, qword [rsp + 0x30]
test rdi, rdi
jne 0x1400bc90e
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140242430
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1400bc8c1
jmp 0x1400bc8cc
mov rcx, rbx
call fcn.1400b9360
add rbx, 0x28
jmp 0x1400bc886
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
cmp rsi, rdi
je 0x1400bc931
add rsi, 0xffffffffffffffd8
mov rcx, rsi
call fcn.1401d3080
cmp rsi, rdi
jne 0x1400bc91b
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.140240d14
jmp 0x1400bc8d6
Function at 0x1400d58f0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rcx], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x1400d592e
call fcn.1401de850
cmp qword [rsi], r14
je 0x1400d5961
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400d5a18
cmp r15, 2
jb 0x1400d5959
mov qword [rsi], r14
call fcn.1401de850
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsi + 8], 0xffffffffffffffff
lea r14, [rsi + 0x10]
xor eax, eax
mov qword [rsp + 0x28], rax
mov r15, qword [rdi]
mov qword [rdi], rax
cmp r15, 0xffffffffffffffff
je 0x1400d598a
test r15, r15
je 0x1400d59ae
call fcn.1401de850
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
lea rax, [r15 + 1]
cmp rax, 2
jb 0x1400d59a6
mov qword [rsp + 0x28], r15
call fcn.1401de850
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.1402ffcc0
mov rax, qword [rbx]
inc rax
cmp rax, 2
jb 0x1400d59db
call fcn.1401de850
mov rcx, qword [rbx]
call fcn.1401f05b0
mov qword [rbx], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jb 0x1400d59fb
call fcn.1401de850
mov rcx, qword [rdi]
call fcn.1401f05b0
mov qword [rdi], 0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140242430
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1401de850
mov rcx, qword [rsi]
call fcn.1401f05b0
mov qword [rsi], 0
jmp 0x1400d594b
Function at 0x1400d8250
Capabilities:
Get session information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x1400d8331
lea r9, [rsp + 0x40]
mov qword [r9], 0
lea rcx, [rsp + 0x3c]
mov dword [rcx], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov edx, eax
mov r8d, 0x18
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x1400d8331
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
mov rdi, qword [rsp + 0x40]
mov rax, qword [0x14041b9a0]
and rax, rdi
cmp rax, qword [0x14041b988]
jne 0x1400d82da
mov rcx, rdi
call fcn.1401e07d0
mov ecx, 0x30
call fcn.140240cd8
mov rbx, rax
lea rdx, [0x1400d9790]
lea r8, [0x1400a5990]
mov rcx, rax
call fcn.1401de610
lea rax, [0x14038efe0]
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rdi
lea rdx, [rsp + 0x28]
mov qword [rdx], rbx
lea rcx, [rsp + 0x30]
call fcn.1402021c0
cmp dword [rsp + 0x3c], 0xd7
ja 0x1400d833a
mov qword [rsi], 0
jmp 0x1400d834e
mov qword [rsi], 0
jmp 0x1400d8358
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0xc8]
mov rcx, rsi
call fcn.1400fb9e0
lea rcx, [rsp + 0x30]
call fcn.1402021f0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140242430
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400dceb0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x14042cd08]
test rdi, rdi
jne 0x1400dcf63
mov ecx, 0x50
call fcn.140240cd8
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.140240cd8
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x1400dcf85
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x14042cd08], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400dcfb1
mov rcx, rax
call fcn.140268c14
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.1400dcfc0
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140242430
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140280b90
int3
Function at 0x1400dcfc0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.1400f6e50
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x1400dd154
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, [0x1403b4988]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x1400dd1d1
lea rdx, [0x1403b49d8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400dd1e4
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [case.0x1402bbc90.0]
mov r15, rax
movsxd r12, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test r12, r12
je 0x1400dd1ec
shl r12, 3
movabs rax, 0x5555555555555551
cmp r12, rax
jae 0x1400dd1f6
lea r14, [r12 + r12*2]
mov rcx, r14
call fcn.140240cd8
mov rbx, rax
mov qword [rsp + 0x30], rax
add rax, r14
mov qword [rsp + 0x40], rax
xor r13d, r13d
mov r14, rbx
test r14, r14
je 0x1400dd179
mov rdx, qword [r15 + r13]
mov rcx, r14
call fcn.14027e510
add r14, 0x18
add r13, 8
cmp r12, r13
jne 0x1400dd0cc
mov qword [rsp + 0x38], r14
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400dcac0
movups xmmword [rsi], xmm6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x1400dd11a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x1400dd154
cmp r14, rbx
je 0x1400dd14c
add r14, 0xffffffffffffffe8
test r14, r14
je 0x1400dd1a5
cmp byte [r14 + 0x17], 0
js 0x1400dd142
lea rax, [r14 - 0x18]
cmp r14, rbx
mov r14, rax
jne 0x1400dd128
jmp 0x1400dd14c
mov rcx, qword [r14]
call fcn.140240d14
jmp 0x1400dd134
mov rcx, rbx
call fcn.140240d14
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140242430
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140280b90
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.140280b90
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1400dd071
xor r15d, r15d
jmp 0x1400dd074
xor r14d, r14d
xor ebx, ebx
jmp 0x1400dd0f3
call fcn.14025af90
int3
Function at 0x1400dfcc0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov r14, qword [rdx]
mov qword [rdx], rax
lea r15, [r14 + 1]
cmp r15, 2
jb 0x1400dfcef
call fcn.1401de850
cmp qword [rsi], r14
je 0x1400dfd1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400dfd5a
cmp r15, 2
jb 0x1400dfd16
mov qword [rsi], r14
call fcn.1401de850
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
call fcn.1401dd8e0
lea rcx, [rsi + 0x20]
call fcn.1402041a0
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x28], 0
mov byte [rsi + 0x29], bl
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400dfd70
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1401de850
mov rcx, qword [rsi]
call fcn.1401f05b0
mov qword [rsi], 0
jmp 0x1400dfd08
call fcn.1401de850
mov rcx, qword [rdi]
call fcn.1401f05b0
mov qword [rdi], 0
jmp 0x1400dfd4a

Function at 0x1400dfd90
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400f34d0
mov qword [rsi], 0
test rax, rax
je 0x1400dfde3
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400dfe17
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400dfddb
mov qword [rsi], rbx
call fcn.1401de850
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.1401dd900
lea rcx, [rsi + 0x20]
call fcn.1402041a0
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.1401de850
mov rcx, qword [rsi]
call fcn.1401f05b0
mov qword [rsi], 0
jmp 0x1400dfdc9
Function at 0x1400e1a20
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf8
movaps xmmword [rsp + 0xe0], xmm6
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0xd8], rax
test rcx, rcx
je 0x1400e1be3
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
xor r8d, r8d
call fcn.1402627c4
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x80]
mov qword [r14 + 0x50], rax
movaps xmm6, xmmword [0x1403aa440]
movaps xmmword [r14 + 0x40], xmm6
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.ReadStreamToSpanWithMaxSize
lea r8, str....._base_files_file_util.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x48
call fcn.1401de830
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1401ea620
xorps xmm0, xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
mov dword [r15 + 0x30], 0
mov rcx, rbx
call fcn.140257f24
mov ecx, eax
call fcn.1402589dc
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1400e1be7
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov r14d, 0xffff
cmovg r14, rax
cmp r14, rdi
cmovae r14, rdi
inc r14
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm6
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
mov r8, r14
call qword [case.0x1402bbc90.0]
xor r12d, r12d
mov rcx, qword [rsp + 0x38]
add rcx, r12
mov edx, 1
mov r8, r14
mov r9, rbx
call fcn.140262544
test rax, rax
je 0x1400e1b86
mov r15, rax
mov rax, rdi
sub rax, r12
cmp rax, r15
jb 0x1400e1bf2
add r15, r12
mov rcx, rbx
call fcn.140261d60
test eax, eax
je 0x1400e1bf6
mov r12, r15
mov rcx, rbx
call fcn.140261d8c
test eax, eax
sete bl
mov rdi, r12
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea rcx, [rsp + 0x20]
mov r8, rdi
call qword [case.0x1402bbc90.0]
lea rcx, [rsp + 0x80]
call fcn.1401ea680
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.140242430
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x1400e1bb8
mov r14d, 0xffff
jmp 0x1400e1b24
xor ebx, ebx
jmp 0x1400e1b96
test r12, r12
mov eax, 0x10000
cmove r14, rax
lea r8, [r15 + r14]
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea r12, [rsp + 0x20]
mov rcx, r12
call qword [case.0x1402bbc90.0]
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x30], xmm0
mov r12, r15
jmp 0x1400e1b49
Function at 0x1400e3330
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.1400e33f0
mov eax, dword [rsi]
mov dword [0x14041a268], eax
test al, 1
jne 0x1400e3351
mov al, 1
add rsp, 0x20
pop rsi
ret
mov rcx, qword [0x14042cd78]
test rcx, rcx
jne 0x1400e336b
mov rcx, qword [0x14042cd50]
test rcx, rcx
je 0x1400e338f
jmp 0x1400e33b1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14042cd78], 0
mov rcx, qword [0x14042cd50]
test rcx, rcx
jne 0x1400e33b1
and byte [0x14041a268], 0xfe
mov ecx, 0x18
call fcn.140240cd8
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x14042cd50], rax
mov rdx, qword [rsi + 8]
call fcn.1400e3fd0
cmp dword [rsi + 0x14], 0
jne 0x1400e33d6
mov rcx, qword [0x14042cd50]
cmp byte [rcx + 0x17], 0
jns 0x1400e33d0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
add rsp, 0x20
pop rsi
jmp fcn.1402b31c0
Function at 0x1400e4850
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r14, qword [rdx]
mov qword [rdx], 0
lea r15, [r14 + 1]
cmp r15, 2
jae 0x1400e48c3
cmp qword [rsi], r14
je 0x1400e48a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400e48ca
cmp r15, 2
jb 0x1400e489c
mov qword [rsi], r14
call fcn.1401de850
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movups xmm0, xmmword [rdi + 8]
movups xmm1, xmmword [rdi + 0x18]
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1401de850
jmp 0x1400e4875
call fcn.1401de850
mov rcx, qword [rsi]
call fcn.1401f05b0
mov qword [rsi], 0
jmp 0x1400e488e