joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c860
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14001c818
test byte [rbx + 0x40], 0xc
jne 0x14001c7cf
mov eax, dword [0x1401bc658]
test eax, eax
jne 0x14001c7e0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.14001a720
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x14001c803
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x14001c803
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x14001c82c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.14001aa10
call fcn.14001b550
test rax, rax
mov rbx, rax
jne 0x14001c7bf
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x30]
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14001c84a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.14001aa10
call fcn.14001c6c0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x14001c8d0
call fcn.14001d9b0
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x14001c908
call fcn.14001b4a0
mov ecx, dword [0x140020678]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14001c960
test esi, esi
je 0x14001c8e6
call fcn.14001c7a0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c940
mov edx, edi
call fcn.14001da60
call fcn.14001c7a0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001c950
call fcn.14001c7a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001c7a0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14001b4a0
mov ecx, dword [0x140020678]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
jne 0x14001c8a5
call fcn.14001b550
mov rbx, rax
jmp 0x14001c8a5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001c8be
call fcn.14001b550
jmp 0x14001c8e6
call fcn.14001b550
mov rbx, rax
jmp 0x14001c8a1

Function at 0x14001c970
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.14001b4a0
mov ecx, dword [0x140020678]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x14001c9e0
test esi, esi
je 0x14001c9c0
call fcn.14001c7a0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001c9f0
mov edx, esi
call fcn.14001da60
call fcn.14001c7a0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14001c7a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14001c7a0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14001b550
mov rbx, rax
jmp 0x14001c991
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001c9aa
Function at 0x14000d840
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x14000d960
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x14000d8a0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x14000d8a0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x14000d8a0

Function at 0x140026120
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140026167
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140026181
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14002615f
mov qword [rsi], rdi
call fcn.140066f00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140026197
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140066f00
mov rcx, qword [rsi]
call fcn.1400681a0
mov qword [rsi], 0
jmp 0x14002614d
int3
Function at 0x140026620
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x140026666
mov r14, r12
test r14, r14
je 0x140026768
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r15
jbe 0x1400266c8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x1400266b4
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1400b5900
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
jmp 0x140026642
mov rax, r12
sub rax, r15
sar rax, 2
cmp r12, r15
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x14002678e
lea rcx, [r13*8]
call fcn.14007f3f0
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, r12
mov r14, rcx
sub rdx, rbx
je 0x14002672e
lea r14, [rdx + rcx]
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x140026768
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x140026716
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], rdx
cmp r12, rbx
je 0x14002674e
add r12, 0xfffffffffffffff8
jne 0x140026741
jmp 0x14002677b
test r15, r15
je 0x140026642
mov rcx, r15
call fcn.14007f42c
mov r14, qword [rsi + 0x10]
jmp 0x140026642
lea rcx, [0x1400fc189]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.1400b71e0
lea rcx, [0x1400fc189]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.1400b71e0
call fcn.1400b6cf0
int3
Function at 0x140026d20
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140121040]
xor rax, rsp
mov qword [rsp + 0x490], rax
movaps xmm0, xmmword [0x1400fc140]
lea r14, [rsp + 0x30]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, [0x140100d76]
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x280]
mov rcx, r15
mov r9d, 0x1d9
call fcn.140066ee0
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140066f10
lea r14, [rsp + 0x280]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1400b5fa0
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x140026dbf
mov rdx, qword [rbx]
mov r8d, 0x104
mov rcx, r14
call fcn.140068ea0
mov rcx, r14
call fcn.140053690
lea r14, [rsp + 0x70]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1400b5fa0
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x140026df6
mov rdx, qword [rdi]
mov r8d, 0x104
mov rcx, r14
call fcn.140068ea0
mov rcx, r14
call fcn.140053690
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x140026e18
mov rdx, qword [rbx]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x140026e24
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x140026e7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140037a50
mov ebp, eax
cmp byte [rdi + 0x17], 0
jns 0x140026e57
mov rdi, qword [rdi]
cmp byte [rbx + 0x17], 0
jns 0x140026e60
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dil
test rsi, rsi
je 0x140026e80
test eax, eax
jne 0x140026e80
jmp 0x140026eac
mov dil, 1
lea rcx, [rsp + 0x30]
call fcn.140066f90
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.140080790
mov eax, edi
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
cmp ebp, 0xfffffffc
jne 0x140026eb8
call fcn.1400d5660
mov ebp, eax
mov dword [rsi], ebp
xor edi, edi
jmp 0x140026e80

Function at 0x140026ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x140121040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [0x1400fc140]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x20c
call fcn.140066ee0
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140066f10
cmp byte [rdi + 0x17], 0
jns 0x140026f32
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.140066f90
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140080790
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x140026f70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov ebp, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x140121040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x1400fc140]
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x215
call fcn.140066ee0
xor ebx, ebx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140066f10
cmp byte [rdi + 0x17], 0
jns 0x140026ff2
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140027085
test al, 0x10
cmove esi, ebp
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
xor r14d, r14d
mov rcx, rdi
mov edx, esi
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x140027068
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp rdi, 0xffffffffffffffff
je 0x1400270b1
call fcn.140066f00
mov r14, rdi
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
setne bl
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140027085
call fcn.140066f00
mov rcx, r14
call fcn.1400681a0
lea rcx, [rsp + 0x60]
call fcn.140066f90
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140080790
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor r14d, r14d
jmp 0x140027060

Function at 0x1400270c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x140121040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [0x1400fc140]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.DirectoryExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x234
call fcn.140066ee0
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140066f10
cmp byte [rdi + 0x17], 0
jns 0x140027132
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.140066f90
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140080790
mov eax, edi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x140027180
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x140121040]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1400b5fa0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14002721f
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.14009e498
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.140063ad0
lea r14, [rsp + 0x48]
mov rcx, rbx
mov rdx, r14
call fcn.14002c880
mov rcx, rsi
mov rdx, r14
call fcn.14002b0c0
mov rcx, r14
call fcn.140063c00
mov rcx, rbx
call fcn.140063c00
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140080790
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140027250
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x140121040]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400b5fa0
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400272e5
cmp word [rsp + 0x70], 0
je 0x1400272e5
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.14009e498
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.140063ad0
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140080790
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1400fc140]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.140063a70
mov rcx, rdi
call fcn.140027180
test al, al
jne 0x140027337
lea rax, [0x140100d9e]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.140063ad0
jmp 0x140027344
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14002b040
lea rcx, [rsp + 0x40]
call fcn.140063c00
jmp 0x1400272c7
Function at 0x140027740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x110
movaps xmmword [rsp + 0x100], xmm6
mov rax, qword [0x140121040]
xor rax, rsp
mov qword [rsp + 0xf8], rax
cmp byte [0x140132d54], 0
jne 0x1400279e1
mov rsi, rcx
movaps xmm6, xmmword [0x1400fc140]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.GetSecureSystemTemp
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0xb0]
mov rcx, rbx
mov r9d, 0x2ba
call fcn.140066ee0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140066f10
test rsi, rsi
je 0x1400279e5
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], r15
movaps xmmword [rdi], xmm6
mov rcx, rdi
call fcn.140063a70
mov ecx, 0x65
mov rdx, rdi
call fcn.140028d30
test al, al
je 0x1400278af
lea rax, str.SystemTemp
lea r8, [rsp + 0x20]
mov qword [r8], rax
mov qword [r8 + 8], 0xa
lea rbx, [rsp + 0xb0]
mov rcx, rdi
mov rdx, rbx
call fcn.14002c700
mov rcx, rdi
mov rdx, rbx
call fcn.14002b0c0
mov rcx, rbx
call fcn.140063c00
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x90]
mov rcx, r14
mov r9d, 0x20c
call fcn.140066ee0
lea rbx, [rsp + 0xb0]
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140066f10
cmp byte [rsp + 0x47], 0
jns 0x140027893
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rcx, rbx
call fcn.140066f90
cmp edi, 0xffffffff
jne 0x140027976
lea rcx, [rsp + 0x30]
call fcn.140063c00
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], r15
movaps xmmword [rdi], xmm6
mov rcx, rdi
call fcn.140063a70
mov ecx, 0x67
mov rdx, rdi
call fcn.140028d30
test al, al
je 0x140027968
lea rbx, [rsp + 0xb0]
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x90]
mov rcx, r14
mov r9d, 0x20c
call fcn.140066ee0
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140066f10
cmp byte [rsp + 0x47], 0
jns 0x140027937
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rcx, rbx
call fcn.140066f90
cmp edi, 0xffffffff
je 0x140027968
lea rcx, [rsp + 0x30]
mov edx, 2
mov r8d, 0x40000000
call fcn.140026f70
test al, al
jne 0x140027993
lea rcx, [rsp + 0x30]
call fcn.140063c00
xor esi, esi
jmp 0x1400279ae
lea rcx, [rsp + 0x30]
mov edx, 2
mov r8d, 0x40000000
call fcn.140026f70
test al, al
je 0x1400278af
lea rdi, [rsp + 0x30]
mov rcx, rsi
mov rdx, rdi
call fcn.14002b060
mov rcx, rdi
call fcn.140063c00
mov sil, 1
lea rcx, [rsp + 0x50]
call fcn.140066f90
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.140080790
mov eax, esi
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor esi, esi
jmp 0x1400279b8
int3
Function at 0x140028420
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
mov byte [rsp + 0x37], r8b
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140121040]
xor rax, rsp
mov qword [rsp + 0x570], rax
lea r14, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov r8d, 0x2c8
mov rcx, r14
mov dl, 0xaa
call fcn.1400b5fa0
mov qword [rsp + 0x20], rsi
xor ebp, ebp
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9d, 3
call fcn.14003a900
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1400fc140]
movaps xmmword [rdi], xmm0
mov rcx, r14
mov rdx, rdi
call fcn.14003aac0
movsx rax, byte [rdi + 0x17]
test rax, rax
jns 0x1400284ba
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14002858e
lea r14, [rsp + 0x58]
lea r15, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
xor r13d, r13d
mov r8d, 0x250
mov rcx, r14
mov dl, 0xaa
call fcn.1400b5fa0
mov rcx, r15
mov rdx, r14
call fcn.14003aa70
mov edx, dword [rsp + 0x58]
test dl, 1
jne 0x1400285cb
mov rcx, r14
call fcn.14003a8d0
test al, al
jne 0x140028620
cmp byte [rsp + 0x57], 0
mov rcx, rdi
jns 0x140028528
mov rcx, qword [rsp + 0x40]
call r12
test eax, eax
jne 0x140028619
call rbx
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
test r13d, r13d
cmovne ebp, r13d
mov rcx, r14
call fcn.1400185e0
mov rcx, r15
mov rdx, r14
call fcn.14003aac0
mov rcx, rdi
mov rdx, r14
call fcn.14002b0c0
mov rcx, r14
call fcn.140063c00
movsx rax, byte [rsp + 0x57]
test rax, rax
jns 0x140028582
mov rax, qword [rsp + 0x48]
mov r13d, ebp
test rax, rax
jne 0x1400284e1
lea rcx, [rsp + 0x40]
call fcn.140063c00
lea rcx, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
call fcn.14003aa00
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.140080790
mov eax, ebp
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [rsp + 0x37], 0
je 0x1400285f3
cmp byte [rsp + 0x57], 0
js 0x1400285e0
lea rcx, [rsp + 0x40]
jmp 0x1400285e5
mov rcx, qword [rsp + 0x40]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140028509
lea rcx, [rsp + 0x58]
call fcn.14003a8d0
test al, al
jne 0x140028607
mov edx, dword [rsp + 0x58]
jmp 0x1400285d2
lea rcx, [rsp + 0x58]
call fcn.14003a8d0
test al, al
je 0x140028519
xor ebp, ebp
jmp 0x140028545
xor ebp, ebp
cmp byte [rsp + 0x37], 0
je 0x140028545
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rcx
mov rdx, rsi
mov r8b, 1
call fcn.140028420
mov ebp, eax
test eax, eax
jne 0x140028545
cmp byte [rsp + 0x57], 0
jns 0x14002865d
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x140028545
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
cmp ecx, 2
cmovne ebp, eax
jmp 0x140028545