joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041490
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x140112ac0]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [0x140114910], 0
jne 0x14004160b
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r11d, dword [rsp + 0x24]
cmp r11d, 5
jne 0x140041562
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x140041539
cmp eax, 1
je 0x14004150f
mov eax, 3
mov byte [0x140114910], 1
mov dword [0x14011490c], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400ac220
add rsp, 0x158
ret
mov eax, 2
mov byte [0x140114910], 1
mov dword [0x14011490c], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400ac220
add rsp, 0x158
ret
mov eax, 1
mov dword [0x14011490c], eax
mov byte [0x140114910], al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400ac220
add rsp, 0x158
ret
cmp r11d, 6
jne 0x1400415d3
cmp byte [rsp + 0x13a], 1
je 0x14004159c
mov eax, 5
mov byte [0x140114910], 1
mov dword [0x14011490c], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400ac220
add rsp, 0x158
ret
cmp dword [rsp + 0x28], 0
mov eax, 6
mov ecx, 4
cmove eax, ecx
mov byte [0x140114910], 1
mov dword [0x14011490c], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400ac220
add rsp, 0x158
ret
mov ecx, dword [0x14011490c]
mov eax, 6
mov byte [0x140114910], 1
cmp r11d, eax
cmova ecx, eax
mov eax, ecx
mov dword [0x14011490c], ecx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400ac220
add rsp, 0x158
ret
mov eax, dword [0x14011490c]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400ac220
add rsp, 0x158
ret
Function at 0x140048f60
Capabilities:
Accept command line arguments

Disassembly:
push rdi
sub rsp, 0x50
mov rdi, qword [0x140114920]
test rdi, rdi
je 0x140048f82
mov rcx, rdi
call fcn.1400485d0
mov rcx, rdi
call fcn.1400ab7f0
mov ecx, 0xc0
call fcn.1400abd9c
xor edi, edi
test rax, rax
je 0x140048fa4
mov rcx, rax
call fcn.140048af0
mov qword [0x140114920], rax
jmp 0x140048fab
mov qword [0x140114920], rdi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x38], rdi
mov rdx, rax
mov word [rsp + 0x28], di
xor eax, eax
mov rdi, rdx
mov qword [rsp + 0x40], 7
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x20]
call fcn.1400041c0
mov rcx, qword [0x140114920]
lea rdx, [rsp + 0x20]
call fcn.140048b70
cmp qword [rsp + 0x40], 8
jb 0x140049007
mov rcx, qword [rsp + 0x28]
call fcn.1400ab7f0
add rsp, 0x50
pop rdi
ret

Function at 0x14004ed70
Capabilities:
Copy file

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 0x104
jae 0x14004edce
cmp qword [rdx + 0x18], 0x104
jae 0x14004edce
cmp qword [rdx + 0x20], 8
jb 0x14004ed95
mov rdx, qword [rdx + 8]
jmp 0x14004ed99
add rdx, 8
cmp qword [rcx + 0x20], 8
jb 0x14004edb7
mov rcx, qword [rcx + 8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne al
add rsp, 0x28
ret
add rcx, 8
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne al
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x14004ef70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x20], 8
jb 0x14004ef90
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret
add rcx, 8
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret

Function at 0x14004f010
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x20], 8
jb 0x14004f021
mov rcx, qword [rcx + 8]
jmp 0x14004f025
add rcx, 8
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004f03b
shr eax, 4
and eax, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x14004f330
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x2a0
mov rax, qword [0x140112ac0]
xor rax, rsp
mov qword [rsp + 0x290], rax
cmp qword [rcx + 0x18], 0x104
movzx esi, dl
mov rbx, rcx
jb 0x14004f366
xor al, al
jmp 0x14004f4b2
mov qword [rsp + 0x2b8], rdi
xor edi, edi
test sil, sil
jne 0x14004f3ea
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
call fcn.14004f050
test al, al
je 0x14004f3c8
cmp byte [rsp + 0x60], dil
je 0x14004f3c8
cmp qword [rbx + 0x20], 8
jb 0x14004f3b4
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x14004f4aa
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x14004f4aa
cmp qword [rbx + 0x20], 8
jb 0x14004f3d5
mov rcx, qword [rbx + 8]
jmp 0x14004f3d9
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14004f3ea
mov al, 1
jmp 0x14004f4aa
lea rcx, [rsp + 0x82]
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x80], di
call fcn.1400ac250
cmp qword [rbx + 0x20], 8
jb 0x14004f414
mov rbx, qword [rbx + 8]
jmp 0x14004f418
add rbx, 8
lea rcx, [rsp + 0x80]
movzx eax, word [rbx]
add rcx, 2
add rbx, 2
mov word [rcx - 2], ax
test ax, ax
jne 0x14004f420
xor eax, eax
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rax
mov eax, 0x414
mov word [rsp + 0x40], ax
test sil, sil
jne 0x14004f487
mov eax, 0x1494
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x14004f4a2
cmp eax, 2
je 0x14004f4a2
cmp eax, 0x402
jne 0x14004f4a7
mov edi, 1
mov al, dil
mov rdi, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400ac220
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x2a0
pop rsi
ret

Function at 0x1400504b0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x2c0
mov rax, qword [0x140112ac0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, rcx
lea rdx, [rsp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x14005058c
xor eax, eax
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x2d8], rdi
lea rdi, [rsp + 0xa0]
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x40], 7
repne scasw ax, word [rdi]
mov qword [rsp + 0x38], rax
mov word [rsp + 0x28], ax
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x20]
call fcn.1400041c0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140069770
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.14006aff0
mov rcx, rbx
mov rdx, rax
call fcn.140069f80
lea rcx, [rsp + 0x48]
call fcn.140069390
lea rcx, [rsp + 0x70]
call fcn.140069390
cmp qword [rsp + 0x40], 8
mov rdi, qword [rsp + 0x2d8]
jb 0x140050588
mov rcx, qword [rsp + 0x28]
call fcn.1400ab7f0
mov al, 1
jmp 0x14005058e
xor al, al
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400ac220
add rsp, 0x2c0
pop rbx
ret
Function at 0x140050640
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2c0
mov rax, qword [0x140112ac0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, rcx
lea rdx, [rsp + 0xa0]
xor edi, edi
mov ecx, 0x104
mov word [rsp + 0xa0], di
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140050729
cmp eax, 0x104
ja 0x140050729
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x88], rdi
mov word [rsp + 0x78], di
xor eax, eax
lea rdi, [rsp + 0xa0]
lea rdx, [rsp + 0xa0]
repne scasw ax, word [rdi]
mov qword [rsp + 0x90], 7
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x70]
call fcn.1400041c0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140069770
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14006aff0
mov rcx, rbx
mov rdx, rax
call fcn.140069f80
lea rcx, [rsp + 0x20]
call fcn.140069390
lea rcx, [rsp + 0x48]
call fcn.140069390
cmp qword [rsp + 0x90], 8
jb 0x140050725
mov rcx, qword [rsp + 0x78]
call fcn.1400ab7f0
mov al, 1
jmp 0x14005072b
xor al, al
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400ac220
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x2c0
pop rdi
ret
Function at 0x1400510e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x3c0
mov rax, qword [0x140112ac0]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
xor edi, edi
cmp qword [rcx + 0x20], 8
mov rbp, rdx
mov rsi, rcx
lea rbx, [rcx + 8]
mov dword [rsp + 0x30], edi
jb 0x14005111d
mov rcx, qword [rbx]
jmp 0x140051120
mov rcx, rbx
lea r9, [rsp + 0x1a0]
lea rdx, [0x1400e8df4]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x14005119c
call fcn.14003e110
cmp eax, 1
jg 0x140051193
mov edi, 1
call sub.KERNEL32.dll_GetLastError
lea rdx, str.._file_util_win.cc
lea rcx, [rsp + 0x60]
mov r9d, edi
mov r8d, 0x21d
mov dword [rsp + 0x20], eax
call fcn.1400404d0
lea rdx, str.Failed_to_get_temporary_file_name_in
lea rcx, [rax + 0x18]
call fcn.140005bd0
cmp qword [rsi + 0x20], 8
jb 0x140051188
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.14003f370
test dil, 1
jmp 0x140051291
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x1a0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x105
ja 0x14005123a
test eax, eax
je 0x14005123a
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x170]
mov r8d, eax
mov qword [rsp + 0x190], 7
mov qword [rsp + 0x188], rdi
mov word [rsp + 0x178], di
call fcn.1400041c0
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x38]
call fcn.140069770
mov rcx, rbp
mov rdx, rax
call fcn.140069f80
lea rcx, [rsp + 0x38]
call fcn.140069390
cmp qword [rsp + 0x190], 8
jb 0x140051236
mov rcx, qword [rsp + 0x178]
call fcn.1400ab7f0
mov al, 1
jmp 0x14005129f
call fcn.14003e110
cmp eax, 1
jg 0x14005128d
mov edi, 2
call sub.KERNEL32.dll_GetLastError
lea r9d, [rdi - 1]
lea rdx, str.._file_util_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x223
mov dword [rsp + 0x20], eax
call fcn.1400404d0
lea rdx, str.Failed_to_get_long_path_name_for
lea rcx, [rax + 0x18]
call fcn.140005bd0
lea rdx, [rsp + 0x1a0]
mov rcx, rax
call fcn.14003f370
test dil, 2
je 0x14005129d
lea rcx, [rsp + 0x60]
call fcn.140040550
xor al, al
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.1400ac220
mov rbx, qword [rsp + 0x3f0]
add rsp, 0x3c0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140051ed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x140112ac0]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor esi, esi
cmp qword [rcx + 0x20], 8
mov rbx, rcx
mov dword [rsp + 0x30], esi
lea rdi, [rcx + 8]
jb 0x140051f12
mov rbp, qword [rdi]
jmp 0x140051f15
mov rbp, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140051fa9
test al, 0x10
jne 0x1400520d0
call fcn.14003e110
cmp eax, 1
jg 0x140051f92
mov esi, 2
lea rdx, str.._file_util_win.cc
lea rcx, [rsp + 0x38]
lea r9d, [rsi - 1]
mov r8d, 0x25e
call fcn.1400403f0
lea rdx, str.CreateDirectory_
lea rcx, [rax + 8]
call fcn.140005bd0
mov rdx, rbp
mov rcx, rax
call fcn.14003f370
lea rdx, [0x1400eb9d0]
mov rcx, rax
call fcn.140005bd0
lea rdx, str.conflicts_with_existing_file.
mov rcx, rax
call fcn.140005bd0
test sil, 2
je 0x140051fa2
lea rcx, [rsp + 0x38]
call fcn.14003feb0
xor al, al
jmp 0x1400520d2
lea rdx, [rsp + 0x138]
mov rcx, rbx
call fcn.14006a0a0
cmp qword [rbx + 0x20], 8
mov r11, qword [rbx + 0x18]
jb 0x140051fc7
mov rdi, qword [rdi]
mov r8, qword [rsp + 0x150]
lea rcx, [rsp + 0x138]
mov r9, rdi
xor edx, edx
mov qword [rsp + 0x20], r11
call fcn.140001e00
lea rcx, [rsp + 0x138]
test eax, eax
je 0x1400520ba
call fcn.140051ed0
test al, al
je 0x1400520b2
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400520c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0xb7
jne 0x140052035
mov rcx, rbx
call fcn.14004f010
test al, al
jne 0x1400520c3
call fcn.14003e110
cmp eax, 1
jg 0x1400520a2
mov esi, 8
lea rdx, str.._file_util_win.cc
lea rcx, [rsp + 0x38]
lea r9d, [rsi - 7]
mov r8d, 0x27a
call fcn.1400403f0
lea rdx, str.Failed_to_create_directory
lea rcx, [rax + 8]
call fcn.140005bd0
mov rdx, rbp
mov rcx, rax
call fcn.14003f370
lea rdx, str.__last_error_is
mov rcx, rax
call fcn.140005bd0
mov edx, edi
mov rcx, rax
call fcn.14003f600
lea rdx, [0x1400eb970]
mov rcx, rax
call fcn.140005bd0
test sil, 8
je 0x1400520b2
lea rcx, [rsp + 0x38]
call fcn.14003feb0
lea rcx, [rsp + 0x138]
call fcn.140069390
xor al, al
jmp 0x1400520d2
lea rcx, [rsp + 0x138]
call fcn.140069390
mov al, 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400ac220
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140052100
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
jne 0x14005211a
xor al, al
add rsp, 0x60
pop rbx
ret
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r11d, eax
mov eax, 0xffffffff
mov qword [rbx + 0x18], r11
cmp r11, rax
je 0x140052112
mov rcx, qword [rbx]
mov qword [rsp + 0x80], rdi
xor edi, edi
lea r8d, [rdi + 2]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rax
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x14005223a
mov eax, dword [0x140114978]
test al, 1
jne 0x1400521ef
or eax, 1
lea r8d, [rdi + 0x22]
lea rdx, str.MemoryMappedFile.CreateFileMapping
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x50], 0xf
mov qword [rsp + 0x48], rdi
mov dword [0x140114978], eax
mov byte [rsp + 0x38], dil
call fcn.140003ca0
lea r8d, [rdi + 1]
lea rdx, [rsp + 0x30]
lea rcx, [0x140114970]
mov r9d, 0x3e80
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0x3e81
call fcn.1400881a0
cmp qword [rsp + 0x50], 0x10
jb 0x1400521e3
mov rcx, qword [rsp + 0x38]
call fcn.1400ab7f0
lea rcx, [0x1400e7960]
call fcn.1400ac940
cmp qword [0x140114970], rdi
je 0x14005222a
mov dword [rsp + 0x70], 0x3e7f
call sub.KERNEL32.dll_GetLastError
lea rdx, [rsp + 0x78]
cmp eax, 0x3e7f
mov dword [rsp + 0x78], eax
lea rcx, [rsp + 0x70]
cmovbe rcx, rdx
mov edx, dword [rcx]
mov rcx, qword [0x140114970]
call fcn.140083330
xor al, al
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbx
ret
mov rax, qword [rbx + 0x18]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x140052324
mov eax, dword [0x140114978]
test al, 2
jne 0x1400522e9
or eax, 2
lea rdx, str.MemoryMappedFile.MapViewOfFile
lea rcx, [rsp + 0x30]
mov r8d, 0x1e
mov qword [rsp + 0x50], 0xf
mov qword [rsp + 0x48], rdi
mov dword [0x140114978], eax
mov byte [rsp + 0x38], dil
call fcn.140003ca0
lea rdx, [rsp + 0x30]
lea rcx, [0x140114968]
mov r9d, 0x3e80
mov r8d, 1
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0x3e81
call fcn.1400881a0
cmp qword [rsp + 0x50], 0x10
jb 0x1400522dd
mov rcx, qword [rsp + 0x38]
call fcn.1400ab7f0
lea rcx, [0x1400e7910]
call fcn.1400ac940
cmp qword [0x140114968], rdi
je 0x140052324
mov dword [rsp + 0x70], 0x3e7f
call sub.KERNEL32.dll_GetLastError
lea rdx, [rsp + 0x78]
cmp eax, 0x3e7f
mov dword [rsp + 0x78], eax
lea rcx, [rsp + 0x70]
cmovbe rcx, rdx
mov edx, dword [rcx]
mov rcx, qword [0x140114968]
call fcn.140083330
cmp qword [rbx + 0x10], rdi
mov rdi, qword [rsp + 0x80]
setne al
add rsp, 0x60
pop rbx
ret
Function at 0x1400524a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x140112ac0]
xor rax, rsp
mov qword [rsp + 0x178], rax
xor ebp, ebp
mov rbx, rdx
mov rdi, rcx
mov esi, ebp
mov dword [rsp + 0x20], ebp
test r8b, r8b
je 0x1400524e1
mov r8b, 1
call fcn.14004ede0
jmp 0x14005260b
cmp byte [0x1401148b0], sil
je 0x140052547
call fcn.14003e110
cmp eax, 3
jg 0x140052547
cmp qword [rdi + 0x20], 8
jb 0x140052501
mov rcx, qword [rdi + 8]
jmp 0x140052505
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140052517
shr eax, 4
and al, 1
jne 0x140052547
mov esi, 1
lea rdx, str.._file_util_win.cc
lea rcx, [rsp + 0x50]
lea r9d, [rsi + 2]
mov r8d, 0x101
call fcn.1400403f0
lea rdx, str.Check_failed:_DirectoryExists_from_path_.
lea rcx, [rax + 8]
call fcn.140005bd0
test sil, 1
je 0x140052557
lea rcx, [rsp + 0x50]
call fcn.14003feb0
cmp qword [rbx + 0x20], 8
jb 0x140052564
mov rcx, qword [rbx + 8]
jmp 0x140052568
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140052595
call fcn.140041490
cmp eax, 4
jl 0x140052587
mov rcx, rbx
call fcn.140051ed0
jmp 0x140052595
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.14004ede0
lea rdx, [0x1400eba58]
lea rcx, [rsp + 0x28]
mov r8d, 3
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbp
mov word [rsp + 0x30], bp
call fcn.1400041c0
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x150]
mov rcx, rdi
call fcn.14006b550
cmp qword [rsp + 0x48], 8
jb 0x1400525e6
mov rcx, qword [rsp + 0x30]
call fcn.1400ab7f0
lea rcx, [rsp + 0x150]
xor r8d, r8d
mov rdx, rbx
call fcn.14004ede0
lea rcx, [rsp + 0x150]
movzx ebx, al
call fcn.140069390
mov al, bl
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1400ac220
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400535e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
xor ebx, ebx
mov ebp, r8d
mov rsi, rdx
mov dword [rsp + 0x150], ebx
cmp qword [rcx + 0x20], 8
jb 0x140053613
mov rcx, qword [rcx + 8]
jmp 0x140053617
add rcx, 8
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
lea r8d, [r9 + 3]
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14005373b
test rax, rax
je 0x14005373b
lea r9, [rsp + 0x150]
mov r8d, ebp
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400536df
mov esi, dword [rsp + 0x150]
cmp esi, ebp
jne 0x1400536df
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400536db
cmp byte [0x1401148b0], bl
je 0x1400536cc
call fcn.14003e110
cmp eax, 3
jg 0x1400536cc
mov ebx, 4
lea rdx, str.d:_b_build_slavechrome_official_build_src_base_scoped_handle_win.h
lea rcx, [rsp + 0x40]
lea r9d, [rbx - 1]
lea r8d, [rbx + 0x45]
call fcn.1400403f0
lea rdx, str.Check_failed:_false.
lea rcx, [rax + 8]
call fcn.140005bd0
test bl, 4
je 0x1400536db
lea rcx, [rsp + 0x40]
call fcn.14003feb0
mov eax, esi
jmp 0x14005373e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14005373b
cmp byte [0x1401148b0], bl
je 0x14005372c
call fcn.14003e110
cmp eax, 3
jg 0x14005372c
mov ebx, 8
lea rdx, str.d:_b_build_slavechrome_official_build_src_base_scoped_handle_win.h
lea rcx, [rsp + 0x40]
lea r9d, [rbx - 5]
lea r8d, [rbx + 0x41]
call fcn.1400403f0
lea rdx, str.Check_failed:_false.
lea rcx, [rax + 8]
call fcn.140005bd0
test bl, 8
je 0x14005373b
lea rcx, [rsp + 0x40]
call fcn.14003feb0
or eax, 0xffffffff
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400541a0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140112ac0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r8b, 1
mov rbx, rcx
mov dword [rsp + 0x20], 0
call fcn.14004ede0
test al, al
je 0x14005267f
mov dl, 1
mov rcx, rbx
call fcn.14004f330
test al, al
je 0x14005267f
mov al, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ac220
add rsp, 0x30
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ac220
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
cmp qword [rcx + 0x18], 0x104
mov rbx, rdx
mov rsi, rcx
jae 0x140054267
cmp qword [rdx + 0x18], 0x104
jae 0x140054267
cmp qword [rdx + 0x20], 8
jb 0x1400541d9
mov rdx, qword [rdx + 8]
jmp 0x1400541dd
add rdx, 8
cmp qword [rcx + 0x20], 8
mov qword [rsp + 0x30], rdi
jb 0x1400541f3
lea rdi, [rcx + 8]
mov rcx, qword [rcx + 8]
jmp 0x1400541fa
lea rdi, [rcx + 8]
mov rcx, rdi
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14005421c
mov al, 1
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
cmp qword [rsi + 0x20], 8
jb 0x140054226
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140054255
shr eax, 4
and al, 1
je 0x140054255
mov rdx, rbx
mov rcx, rsi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp 0x140052630
xor al, al
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
xor al, al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x1400564e0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
mov r8d, 0x238
add rcx, 0x18
call fcn.1400ac250
mov dword [rbx + 0x18], 0x238
cmp byte [rbx + 0x10], 0
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x18]
jne 0x14005652c
mov byte [rbx + 0x10], 1
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call sub.KERNEL32.dll_Process32NextW
mov rbx, qword [rsp + 0x30]
test eax, eax
setne al
add rsp, 0x20
pop rdi
ret