joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400873b0
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x40], rax
movzx eax, byte [rcx + 0x1f]
test al, al
jns 0x1400873d8
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1400874d2
lea r8, [rsi + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x20]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14020b860]
movaps xmmword [rdi], xmm0
lea rdx, str.opera_splash_lock_
mov rcx, rdi
call fcn.14006e680
cmp byte [rdi + 0x17], 0
jns 0x14008741c
mov rdi, qword [rsp + 0x20]
xor ecx, ecx
mov edx, 1
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
cmp qword [rsi + 0x38], rax
je 0x14008746f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi + 0x38]
inc rax
cmp rax, 2
jae 0x1400874ec
mov rax, rdi
inc rax
cmp rax, 2
jb 0x140087463
mov qword [rsi + 0x38], rdi
call fcn.140100430
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsi + 0x38]
xor ebp, ebp
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400874bf
test bl, bl
mov eax, 0x1f4
cmovne ebp, eax
mov rcx, rdi
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov bpl, 1
test eax, 0xffffff7f
je 0x1400874bf
mov rax, qword [rsi + 0x38]
inc rax
cmp rax, 2
jb 0x1400874bd
call fcn.140100430
mov rcx, qword [rsi + 0x38]
call fcn.140112e70
mov qword [rsi + 0x38], 0
xor ebp, ebp
cmp byte [rsp + 0x37], 0
jns 0x1400874d4
mov rcx, qword [rsp + 0x20]
call fcn.14014c3ec
jmp 0x1400874d4
xor ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14014ced0
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.140100430
mov rcx, qword [rsi + 0x38]
call fcn.140112e70
mov qword [rsi + 0x38], 0
jmp 0x14008744e
Function at 0x140094fb0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x140242268]
test rdi, rdi
jne 0x140095063
mov ecx, 0x50
call fcn.14014c3b0
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, SafeArrayCopy
call fcn.14014c3b0
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x140095085
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x140242268], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400950b1
mov rcx, rax
call fcn.140174394
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.1400950c0
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14014ced0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.14018a2b0
int3
Function at 0x1400950c0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.1400ae280
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x140095254
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, [0x140215224]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x1400952d1
lea rdx, [0x140215274]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400952e4
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [case.0x1401b58f0.0]
mov r15, rax
movsxd r12, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test r12, r12
je 0x1400952ec
shl r12, 3
movabs rax, 0x5555555555555551
cmp r12, rax
jae 0x1400952f6
lea r14, [r12 + r12*2]
mov rcx, r14
call fcn.14014c3b0
mov rbx, rax
mov qword [rsp + 0x30], rax
add rax, r14
mov qword [rsp + 0x40], rax
xor r13d, r13d
mov r14, rbx
test r14, r14
je 0x140095279
mov rdx, qword [r15 + r13]
mov rcx, r14
call fcn.140189970
add r14, 0x18
add r13, 8
cmp r12, r13
jne 0x1400951cc
mov qword [rsp + 0x38], r14
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140094dc0
movups xmmword [rsi], xmm6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x14009521a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x140095254
cmp r14, rbx
je 0x14009524c
add r14, 0xffffffffffffffe8
test r14, r14
je 0x1400952a5
cmp byte [r14 + 0x17], 0
js 0x140095242
lea rax, [r14 - 0x18]
cmp r14, rbx
mov r14, rax
jne 0x140095228
jmp 0x14009524c
mov rcx, qword [r14]
call fcn.14014c3ec
jmp 0x140095234
mov rcx, rbx
call fcn.14014c3ec
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14014ced0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.14018a2b0
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.14018a2b0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x140095171
xor r15d, r15d
jmp 0x140095174
xor r14d, r14d
xor ebx, ebx
jmp 0x1400951f3
call fcn.1401663e0
int3
Function at 0x140097a50
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.1400a5a40
cmp byte [rdi + 0x17], 0
jns 0x140097a91
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x6f], 0
jns 0x140097ab2
mov rcx, qword [rsp + 0x58]
call fcn.14014c3ec
test rsi, rsi
je 0x140097b59
test edi, edi
je 0x140097b59
mov ecx, edi
add rcx, rcx
call fcn.14014c42c
mov rbx, rax
movups xmm0, xmmword [r14]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea r14, [rsp + 0x58]
mov rcx, r14
call fcn.1400a5a40
cmp byte [r14 + 0x17], 0
jns 0x140097af5
mov r14, qword [rsp + 0x58]
mov rcx, r14
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x6f], 0
jns 0x140097b15
mov rcx, qword [rsp + 0x58]
call fcn.14014c3ec
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x140097b77
mov rcx, rbx
call fcn.140174394
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.14010b8f0
cmp byte [rsi + 0x17], 0
js 0x140097b7a
mov rax, qword [rsp + 0x68]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsi], xmm0
mov rcx, rbx
call fcn.14014c434
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14014ced0
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
mov rcx, qword [rsi]
call fcn.14014c3ec
jmp 0x140097b40
Function at 0x140099ca0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf8
movaps xmmword [rsp + 0xe0], xmm6
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0xd8], rax
test rcx, rcx
je 0x140099e63
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
xor r8d, r8d
call fcn.14016db80
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x80]
mov qword [r14 + 0x50], rax
movaps xmm6, xmmword [0x14020b860]
movaps xmmword [r14 + 0x40], xmm6
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.ReadStreamToSpanWithMaxSize
lea r8, str....._base_files_file_util.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, VarR8FromUI1
call fcn.140100410
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14010c8f0
xorps xmm0, xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
mov dword [r15 + 0x30], 0
mov rcx, rbx
call fcn.1401638a4
mov ecx, eax
call fcn.1401638fc
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x140099e67
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
shl rax, 0x20
or rax, rcx
test rax, rax
mov r14d, 0xffff
cmovg r14, rax
cmp r14, rdi
cmovae r14, rdi
inc r14
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm6
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
mov r8, r14
call qword [case.0x1401b58f0.0]
xor r12d, r12d
mov rcx, qword [rsp + 0x38]
add rcx, r12
mov edx, 1
mov r8, r14
mov r9, rbx
call fcn.14016d900
test rax, rax
je 0x140099e06
mov r15, rax
mov rax, rdi
sub rax, r12
cmp rax, r15
jb 0x140099e72
add r15, r12
mov rcx, rbx
call fcn.14016ce80
test eax, eax
je 0x140099e76
mov r12, r15
mov rcx, rbx
call fcn.14016ceac
test eax, eax
sete bl
mov rdi, r12
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea rcx, [rsp + 0x20]
mov r8, rdi
call qword [case.0x1401b58f0.0]
lea rcx, [rsp + 0x80]
call fcn.14010c950
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.14014ced0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x140099e38
mov r14d, 0xffff
jmp 0x140099da4
xor ebx, ebx
jmp 0x140099e16
test r12, r12
mov eax, 0x10000
cmove r14, rax
lea r8, [r15 + r14]
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea r12, [rsp + 0x20]
mov rcx, r12
call qword [case.0x1401b58f0.0]
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x30], xmm0
mov r12, r15
jmp 0x140099dc9
Function at 0x14009b6d0
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.14009b790
mov eax, dword [rsi]
mov dword [reloc.WS2_32.dll_accept], eax
test al, 1
jne 0x14009b6f1
mov al, 1
add rsp, 0x20
pop rsi
ret
mov rcx, qword [0x140242310]
test rcx, rcx
jne 0x14009b70b
mov rcx, qword [0x1402422e8]
test rcx, rcx
je 0x14009b72f
jmp 0x14009b751
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140242310], 0
mov rcx, qword [0x1402422e8]
test rcx, rcx
jne 0x14009b751
and byte [reloc.WS2_32.dll_accept], 0xfe
mov ecx, SafeArrayCopy
call fcn.14014c3b0
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1402422e8], rax
mov rdx, qword [rsi + 8]
call fcn.14009c350
cmp dword [rsi + 0x14], 0
jne 0x14009b776
mov rcx, qword [0x1402422e8]
cmp byte [rcx + 0x17], 0
jns 0x14009b770
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
add rsp, 0x20
pop rsi
jmp fcn.1401ad8c0
Function at 0x14009cbd0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r14, qword [rdx]
mov qword [rdx], 0
lea r15, [r14 + 1]
cmp r15, 2
jae 0x14009cc43
cmp qword [rsi], r14
je 0x14009cc24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14009cc4a
cmp r15, 2
jb 0x14009cc1c
mov qword [rsi], r14
call fcn.140100430
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
movups xmm0, xmmword [rdi + 8]
movups xmm1, xmmword [rdi + 0x18]
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140100430
jmp 0x14009cbf5
call fcn.140100430
mov rcx, qword [rsi]
call fcn.140112e70
mov qword [rsi], 0
jmp 0x14009cc0e
Function at 0x1400a6fe0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140231378]
cmp ecx, 0xffffffff
je 0x1400a7005
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x1400a7000

Function at 0x1400a7010
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140231378]
cmp ecx, 0xffffffff
je 0x1400a70d9
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x1400a70d9
mov eax, dword [0x140243cf8]
mov ecx, dword [0x14023ece4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400a70e3
mov rbx, qword [0x140243cf0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400a7129
mov rax, qword [0x1402424e0]
inc rax
xor ecx, ecx
lea rdx, [0x1402424f0]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x1400a7136
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov qword [0x1402424e0], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x1400a714b
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400a7150
jmp 0x1400a703a
lea rcx, [0x140243cf8]
call fcn.14014c510
cmp dword [0x140243cf8], 0xffffffff
jne 0x1400a705f
mov ecx, 8
call fcn.14014c3b0
mov rbx, rax
mov rcx, rax
call fcn.1400f1200
mov qword [0x140243cf0], rbx
lea rcx, [0x140243cf8]
call fcn.14014c5a8
jmp 0x1400a705f
mov rcx, rbx
call fcn.140112b90
jmp 0x1400a7077
inc rcx
cmp rcx, 0x100
jne 0x1400a708a
jmp 0x1400a70bf
int3
Function at 0x1400a7150
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.14014ce70
sub rsp, rax
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x140231378]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x1400a7204
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1400a7242
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.14014fe30
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14014c42c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.14014f780
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14014ced0
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.1400cc0e0
test al, al
je 0x1400a7245
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x1400a7248
mov eax, 0xffffffff
lock cmpxchg dword [0x140231378], ecx
je 0x1400a7188
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x140231378]
mov dword [rsp + 0x2c], ecx
jmp 0x1400a7188
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.1400cc0e0
test al, al
je 0x1400a726d
cmp dword [rsp + 0x2c], 0xffffffff
je 0x1400a726d
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x1400a721b
int3

Function at 0x1400a7360
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, dword [0x140231378]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
jne 0x1400a73bd
lea rdx, [0x14021643e]
lea r8, str....._base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r9d, 0x1db
call fcn.140100410
mov edx, 0x11e1a300
mov rcx, rsi
call fcn.1401ad1b0
jmp 0x1400a73d9
and rax, 0xfffffffffffffffc
je 0x1400a73d9
mov rcx, qword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 8]
jne 0x1400a73d9
mov rsi, qword [rax + rcx]
jmp 0x1400a73db
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014ced0
mov rax, rsi
add rsp, 0x50
pop rsi
ret
Function at 0x1400aa6e0
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4b8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x450]
mov qword [r14 + 0x50], rax
movaps xmm0, xmmword [0x14020b860]
movaps xmmword [r14 + 0x40], xmm0
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, [0x1402164ee]
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x240]
mov rcx, r15
mov r9d, 0x196
call fcn.140100410
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14010c8f0
lea r14, [rsp + 0x240]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.14014fe30
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x1400aa795
mov rdx, qword [rbx]
mov r8d, 0x104
mov rcx, r14
call fcn.14010a540
mov rcx, r14
call fcn.1400ea370
lea r14, [rsp + 0x30]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.14014fe30
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x1400aa7cc
mov rdx, qword [rdi]
mov r8d, 0x104
mov rcx, r14
call fcn.14010a540
mov rcx, r14
call fcn.1400ea370
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x1400aa7ee
mov rdx, qword [rbx]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x1400aa7fa
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x1400aa880
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400ab460
mov ebp, eax
cmp byte [rdi + 0x17], 0
jns 0x1400aa82d
mov rdi, qword [rdi]
cmp byte [rbx + 0x17], 0
jns 0x1400aa836
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dil
test rsi, rsi
je 0x1400aa851
test eax, eax
je 0x1400aa885
lea rcx, [rsp + 0x450]
call fcn.14010c950
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.14014ced0
mov eax, edi
add rsp, 0x4b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dil, 1
jmp 0x1400aa851
cmp ebp, 0xfffffffc
jne 0x1400aa891
call fcn.1401b3990
mov ebp, eax
mov dword [rsi], ebp
xor edi, edi
jmp 0x1400aa851

Function at 0x1400aa8a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x14020b860]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1c9
call fcn.140100410
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14010c8f0
cmp byte [rdi + 0x17], 0
jns 0x1400aa924
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.14010c950
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14014ced0
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400aa960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x14020b860]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.DirectoryExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1f1
call fcn.140100410
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14010c8f0
cmp byte [rdi + 0x17], 0
jns 0x1400aa9e4
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.14010c950
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14014ced0
mov eax, edi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400aaa30
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.14014fe30
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
add edi, 0xfffffefc
cmp edi, 0xfffffefd
jb 0x1400aaad3
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.140174394
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.1400ff560
lea r14, [rsp + 0x48]
mov rcx, rbx
mov rdx, r14
call fcn.140099690
mov rcx, rsi
mov rdx, r14
call fcn.140097e60
mov rcx, r14
call fcn.1400ff6e0
mov rcx, rbx
call fcn.1400ff6e0
cmp edi, 0xfffffefd
setae bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14014ced0
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400aab00
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14014fe30
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400aab95
cmp word [rsp + 0x70], 0
je 0x1400aab95
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.140174394
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.1400ff560
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.14014ced0
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x40]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14020b860]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.1400ff430
mov rcx, rdi
call fcn.1400aaa30
test al, al
je 0x1400aabd5
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400ff540
jmp 0x1400aabf4
lea rax, [0x1402129a6]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.1400ff560
lea rcx, [rsp + 0x40]
call fcn.1400ff6e0
jmp 0x1400aab77
Function at 0x1400ab1a0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x24]
mov dword [r8], 1
movsxd rcx, ecx
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14014ced0
mov eax, ebx
add rsp, 0x30
pop rbx
ret