joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005a3d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea r8, [rsp + 0x38]
mov dword [r8], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005a458
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x14005a442
cmp dword [rsp + 0x38], 4
jne 0x14005a442
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140110970
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x14005a442

Function at 0x14005a460
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.140110910
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1401496f0
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005a513
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x14005a517
lea rdx, [rsp + 0x840]
mov rcx, rsi
call fcn.140044b30
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140110970
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x14005a4f4
mov edi, 0x3f4
cmp eax, 2
jne 0x14005a4f4
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1401496f0
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x14005a4f4
lea rdx, [rsp + 0x40]
jmp 0x14005a4ea
Function at 0x14005a960
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x140361d50]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x14005a995
jnp 0x14005a9b9
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140110970
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov esi, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x140361d60]
mov ecx, dword [0x14035efd0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005aace
mov eax, dword [0x140361d70]
mov ecx, dword [0x14035efd0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005ab08
rdtsc
mov rdi, rax
mov rbx, rdx
xor r15d, r15d
lea r14, [rsp + 0x20]
mov qword [r14], r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r12, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [r14], r15
lea rsi, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub r12, qword [0x140361d68]
xorps xmm0, xmm0
cvtsi2sd xmm0, r12
cvtsi2sd xmm1, qword [rsi]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x1402d9380]
ucomisd xmm1, xmm0
ja 0x14005a995
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x140361d58]
movq xmm6, rdi
punpckldq xmm6, xmmword [0x1402d9390]
subpd xmm6, xmmword [0x1402d93a0]
haddpd xmm6, xmm6
divsd xmm6, xmm0
movsd qword [0x140361d50], xmm6
jmp 0x14005a995
lea rcx, [0x140361d60]
call fcn.14010f47c
cmp dword [0x140361d60], 0xffffffff
jne 0x14005aa02
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x140361d58], rdx
lea rcx, [0x140361d60]
call fcn.14010f530
jmp 0x14005aa02
lea rcx, [0x140361d70]
call fcn.14010f47c
cmp dword [0x140361d70], 0xffffffff
jne 0x14005aa27
lea rdi, [rsp + 0x20]
mov qword [rdi], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
mov qword [0x140361d68], rax
lea rcx, [0x140361d70]
call fcn.14010f530
jmp 0x14005aa27

Function at 0x14005bdc0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x14005be07
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14005be21
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14005bdff
mov qword [rsi], rdi
call fcn.1400e1920
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x14005be37
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400e1920
mov rcx, qword [rsi]
call fcn.1400d9a60
mov qword [rsi], 0
jmp 0x14005bded
int3
Function at 0x14005c120
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call fcn.140083fc0
mov byte [rsi + 8], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
lea rax, [0x1402d4830]
mov qword [rsi], rax
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp qword [rsi + 0x18], rax
je 0x14005c195
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x14005c1a0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14005c18d
mov qword [rsi + 0x18], rdi
call fcn.1400e1920
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400e1920
mov rcx, qword [rsi + 0x18]
call fcn.1400d9a60
mov qword [rsi + 0x18], 0
jmp 0x14005c17a
Function at 0x14005cab0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb0
mov r15d, r8d
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [0x1402cdfe0]
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.MapFileRegionToMemory
lea r8, str....._base_filesmemory_mapped_file_win.cc
lea r12, [rsp + 0x40]
mov rcx, r12
mov r9d, 0x42
call fcn.1400e1900
xor r14d, r14d
mov rcx, rdi
mov rdx, r12
xor r8d, r8d
call fcn.140061fe0
mov rcx, rsi
call fcn.14005cdd0
test al, al
je 0x14005cc37
test r15d, r15d
jne 0x14005ccf2
mov ebp, 2
mov edi, 4
xor r15d, r15d
mov rcx, rsi
call fcn.14005cde0
mov dword [rsp + 0x20], r14d
mov qword [rsp + 0x28], 0
mov rcx, rax
xor edx, edx
mov r8d, ebp
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
cmp qword [rsi + 0x40], rax
je 0x14005cbb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi + 0x40]
inc rax
cmp rax, 2
jae 0x14005cc66
mov rax, r14
inc rax
cmp rax, 2
jb 0x14005cbad
mov qword [rsi + 0x40], r14
call fcn.1400e1920
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsi + 0x40]
inc r14
cmp r14, 2
jb 0x14005ccea
mov dword [rsp + 0x3c], 0
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
cmp rcx, qword [0x1402e8d40]
jne 0x14005cc81
cmp rdx, qword [0x1402e8d48]
jne 0x14005cc81
mov rcx, rsi
call fcn.14005d080
xor r14d, r14d
test rax, rax
jle 0x14005cc37
mov rbx, rax
xor r8d, r8d
xor eax, eax
mov rcx, qword [rsi + 0x40]
mov qword [rsp + 0x20], rax
mov edx, edi
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14005ccea
movsxd rcx, dword [rsp + 0x3c]
add rax, rcx
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov r14b, 1
lea rcx, [rsp + 0x60]
call fcn.140062060
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140110970
mov eax, r14d
add rsp, 0xb0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400e1920
mov rcx, qword [rsi + 0x40]
call fcn.1400d9a60
mov qword [rsi + 0x40], 0
jmp 0x14005cb98
xor eax, eax
lea r14, [rsp + 0x40]
mov qword [r14], rax
lea r9, [rsp + 0x30]
mov qword [r9], rax
lea r15, [rsp + 0x3c]
mov qword [rsp + 0x20], r15
mov r8, r14
call fcn.14018fcf0
mov rbx, qword [rbx + 8]
movsxd rax, dword [r15]
mov rdx, rax
sar rdx, 0x3f
add rax, rbx
adc rdx, 0
mov ecx, edx
and ecx, 1
neg rcx
xor rdx, rcx
setne dl
mov r14, qword [r14]
test r14, r14
js 0x14005ccea
test dl, dl
jne 0x14005ccea
test rcx, rcx
js 0x14005ccea
test rax, rax
je 0x14005ccea
mov r8, r14
shr r8, 0x20
jmp 0x14005cc07
xor r14d, r14d
jmp 0x14005cc37
mov edi, 0xaaaaaaaa
dec r15d
cmp r15d, 3
jbe 0x14005cd07
xor ebp, ebp
jmp 0x14005cb4c
lea rax, [0x1402e7ef0]
movsxd rcx, dword [rax + r15*4]
add rcx, rax
jmp rcx
mov ebp, 4
mov edi, 2
jmp 0x14005cb4c
mov ebp, 8
mov edi, 1
jmp 0x14005cb4c
mov rcx, rsi
call fcn.140181fc0
mov r14d, eax
jmp 0x14005cc37
mov r14, qword [rbx + 8]
mov r15, r14
shr r15, 0x20
mov ebp, 4
mov edi, 2
jmp 0x14005cb4f
Function at 0x14005cf30
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb0
mov esi, r9d
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [0x1402cdfe0]
lea r12, [rsp + 0x60]
movaps xmmword [r12 + 0x30], xmm0
movaps xmmword [r12 + 0x20], xmm0
movaps xmmword [r12 + 0x10], xmm0
movaps xmmword [r12], xmm0
lea rdx, str.Write
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x7f
call fcn.1400e1900
mov rcx, r12
mov rdx, r15
xor r8d, r8d
call fcn.140061fe0
mov ebp, 0xffffffff
test r14, r14
js 0x14005d029
test esi, esi
js 0x14005d029
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.140086c10
test al, al
jne 0x14005d057
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
lea r14, [rsp + 0x2c]
mov dword [r14], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor ebp, ebp
cmp eax, 1
sbb ebp, ebp
or ebp, dword [r14]
lea rcx, [rsp + 0x30]
call fcn.140086c90
lea rcx, [rsp + 0x60]
call fcn.140062060
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140110970
mov eax, ebp
add rsp, 0xb0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r9d, esi
lea rdx, str.File::Write
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.140217cc0
jmp 0x14005cfe0

Function at 0x14005d080
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x90], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
movaps xmm0, xmmword [0x1402cdfe0]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0xac
call fcn.1400e1900
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140061fe0
mov qword [rbx + 8], r14
mov qword [rbx], 0
call fcn.140086c10
test al, al
jne 0x14005d15c
lea rdi, [rsp + 0x28]
mov qword [rdi], r14
mov rcx, qword [rsi]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rdi]
lea rcx, [rsp + 0x30]
call fcn.140086c90
lea rcx, [rsp + 0x50]
call fcn.140062060
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140110970
mov rax, rsi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x30]
mov r8, rsi
xor r9d, r9d
call fcn.140217cc0
jmp 0x14005d109
Function at 0x14005d280
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x1402cdfe0]
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.DoInitialize
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x171
call fcn.1400e1900
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140061fe0
mov eax, ebx
and eax, 1
neg eax
and eax, 3
test bl, 2
mov edx, 1
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov r8d, 2
cmove r8d, edx
test bl, 0x10
mov eax, 5
cmove eax, r8d
test eax, eax
je 0x14005d4f1
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov r8d, ebx
rol r8d, 0x1a
and r8d, 0x80000100
or r8d, ecx
bt ebx, 0x12
jb 0x14005d4bb
mov edx, ebx
shr edx, 4
and edx, 0x10000
or edx, r8d
mov ecx, ebx
shr ecx, 8
and ecx, 3
mov r8d, ebx
shr r8d, 0xd
and r8d, 4
or r8d, ecx
xor r8d, 3
mov r15d, ebx
and r15d, 0x400
mov ecx, r15d
shl ecx, 0x14
mov r9d, ebx
shr r9d, 3
and r9d, 0x100
or r9d, ecx
mov ecx, ebx
shr ecx, 0xb
and ecx, 2
or ecx, r9d
mov r10d, ebx
shl r10d, 0xd
and r10d, 0x4000000
or r10d, ecx
mov r9d, ebx
shl r9d, 8
and r9d, 0xa000000
or r9d, r10d
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x14005d3e3
mov rcx, qword [rdi]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x30], 0
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp qword [rsi], rax
je 0x14005d439
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14005d490
mov rax, r14
inc rax
cmp rax, 2
jb 0x14005d42e
mov qword [rsi], r14
call fcn.1400e1920
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsi]
inc r14
cmp r14, 2
jb 0x14005d4a9
shr r15d, 0xa
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x29], r15b
test bl, 4
jne 0x14005d4dd
test bl, 0xa
jne 0x14005d4cd
bt ebx, 0x15
jb 0x14005d4d3
lea rcx, [rsp + 0x60]
call fcn.140062060
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140110970
nop
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.1400e1920
mov rcx, qword [rsi]
call fcn.1400d9a60
mov qword [rsi], 0
jmp 0x14005d41a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005d180
mov dword [rsi + 0x24], eax
jmp 0x14005d465
bt ebx, 0x15
jb 0x14005d50d
or r8d, 0x20000000
jmp 0x14005d361
mov byte [rsi + 0x28], 1
jmp 0x14005d45f
mov rcx, rdi
call fcn.140184aa0
jmp 0x14005d465
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [rsi + 0x28]
jmp 0x14005d45f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsi + 0x24], 0xffffffff
call fcn.1401934d0
jmp 0x14005d465
int3
Function at 0x14005d520
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14005d57e
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14005d568
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14005d558
mov qword [rdi], rsi
call fcn.1400e1920
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.1400e1920
mov rcx, qword [rdi]
call fcn.1400d9a60
mov qword [rdi], 0
jmp 0x14005d546
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14005d590
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [0x1402cdfe0]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x20d
call fcn.1400e1900
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140061fe0
cmp byte [rdi + 0x17], 0
jns 0x14005d602
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.140062060
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140110970
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x14005d640
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm6, xmmword [0x1402cdfe0]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
lea rdx, str.CreateDirectoryAndGetError
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x2f6
call fcn.1400e1900
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140061fe0
cmp byte [rdi + 0x17], 0
mov rbx, rdi
jns 0x14005d6c3
mov rbx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005d723
mov bl, 1
test al, 0x10
je 0x14005d709
lea rcx, [rsp + 0x40]
call fcn.140062060
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140110970
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
test rsi, rsi
je 0x14005d714
mov dword [rsi], 0xfffffff7
mov ecx, 0x50
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x14005d6d7
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x20]
mov qword [r14 + 0x10], rax
movaps xmmword [r14], xmm6
mov rcx, rdi
mov rdx, r14
call fcn.14006c530
movsx rax, byte [rdi + 0x17]
mov rcx, rdi
test rax, rax
jns 0x14005d759
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
test rax, rax
js 0x14005d830
sete dl
test rcx, rcx
setne r8b
or r8b, dl
je 0x14005d830
movsx rdx, byte [rsp + 0x37]
test rdx, rdx
cmovs rdx, qword [rsp + 0x28]
cmovs r14, qword [rsp + 0x20]
test rdx, rdx
js 0x14005d830
sete r8b
test r14, r14
setne r9b
or r9b, r8b
je 0x14005d830
cmp rdx, rax
jne 0x14005d7f1
test rax, rax
je 0x14005d7c7
xor edx, edx
movzx r8d, word [r14 + rdx*2]
cmp r8w, word [rcx + rdx*2]
jne 0x14005d7f1
inc rdx
cmp rax, rdx
jne 0x14005d7b3
mov eax, 0xfffffffc
mov ebp, 2
test rsi, rsi
je 0x14005d7d8
mov dword [rsi], eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea rcx, [rsp + 0x20]
call fcn.14006c480
jmp 0x14005d6d7
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.14005d640
test al, al
je 0x14005d7e0
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x14005d7e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0xb7
je 0x14005d832
test rsi, rsi
je 0x14005d7d8
mov ecx, ebp
call fcn.14005d180
jmp 0x14005d7d6
ud2
mov rcx, rdi
call fcn.140183580
test al, al
jne 0x14005d7e2
jmp 0x14005d822
Function at 0x14005e130
Capabilities:
Get file version info

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm6, xmmword [0x1402cdfe0]
lea rbx, [rsp + 0x50]
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
lea rdx, str.CreateFileVersionInfoWin
lea r8, str....._base_file_version_info_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x4d
call fcn.1400e1900
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140061fe0
mov dword [rsp + 0x2c], 0xaaaaaaaa
cmp byte [rdi + 0x17], 0
jns 0x14005e1b7
mov rdi, qword [rdi]
lea rdx, [rsp + 0x2c]
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
jne 0x14005e201
mov qword [rsi], 0
lea rcx, [rsp + 0x50]
call fcn.140062060
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140110970
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ebx, eax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x30]
mov qword [r14 + 0x10], rax
movaps xmmword [r14], xmm6
lea r8, [rsp + 0xa0]
mov byte [r8], 0
mov edx, ebx
mov rcx, r14
call fcn.14005e2f0
mov r9, qword [r14]
mov edx, dword [rsp + 0x2c]
mov rcx, rdi
mov r8d, ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14005e28a
mov rcx, qword [rsp + 0x30]
lea rdi, [rsp + 0xa0]
mov qword [rdi], 0
lea r9, [rsp + 0x9c]
mov dword [r9], 0xaaaaaaaa
lea rdx, str.VarFileInfoTranslation
mov r8, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
sete al
mov rbx, qword [rdi]
test rbx, rbx
sete cl
or cl, al
je 0x14005e2bf
xor edi, edi
mov qword [rsi], rdi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14005e1cf
mov rax, qword [rsp + 0x38]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
ja 0x14005e2e4
mov qword [rsp + 0x38], rcx
call fcn.14010f42c
jmp 0x14005e1cf
mov ecx, 0x38
call fcn.14010f3f0
mov rdi, rax
movzx r8d, word [rbx]
movzx r9d, word [rbx + 2]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140185870
jmp 0x14005e28c
ud2
Function at 0x140069e40
Capabilities:
Delete file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14034e040]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.14006a000
mov eax, dword [rsi]
mov dword [0x1403508ac], eax
mov bl, 1
test al, 1
jne 0x140069e87
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140110970
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [0x140361f30]
test rcx, rcx
je 0x140069eb5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140361f30], 0
cmp qword [0x140361f38], 0
jne 0x140069eb5
and byte [0x1403508ac], 0xfe
mov rax, qword [rsi + 0x28]
test rax, rax
je 0x140069ede
movsx rcx, byte [rsi + 0x1f]
test rcx, rcx
jns 0x140069ecc
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jne 0x140069f57
mov qword [0x140361f30], rax
jmp 0x140069e6e
movsx rax, byte [rsi + 0x1f]
test rax, rax
jns 0x140069eec
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x140069fa6
lea rdi, [rsi + 8]
mov rcx, qword [0x140361f38]
test rcx, rcx
jne 0x140069f27
mov ecx, 0x18
call fcn.14010f3f0
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x140361f38], rax
mov rdx, rdi
call fcn.14003a070
cmp dword [rsi + 0x24], 0
jne 0x140069f4b
mov rcx, qword [0x140361f38]
cmp byte [rcx + 0x17], 0
jns 0x140069f45
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.14018d490
mov ebx, eax
jmp 0x140069e6e
lea rdx, str.BaseInitLoggingImpl_built_with_NDEBUG
lea r8, str....._baselogging.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x231
call fcn.1400e1900
lea rdx, str.settings.log_file_path.empty__
lea r14, [rsp + 0x48]
mov rcx, r14
mov r8d, 0x7f
mov r9, rdi
call fcn.140193190
mov rcx, r14
call fcn.1401933a0
mov rax, qword [rsi + 0x28]
jmp 0x140069ed5
lea rdx, str.BaseInitLoggingImpl_built_with_NDEBUG
lea r8, str....._baselogging.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x237
call fcn.1400e1900
lea rdx, str._settings.log_file_path.empty__
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r8d, 0x7f
mov r9, rdi
call fcn.140193190
lea rdx, str.LOG_TO_FILE_set_but_no_log_file_path_
mov rcx, rbx
call fcn.14018d460
mov rcx, rbx
call fcn.1401933a0
jmp 0x140069ef5