joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140117c20
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2d8
mov r14, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x270]
mov qword [rdi + 0x50], rax
movaps xmm0, xmmword [0x140257270]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, [0x14025cc92]
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x60]
mov rcx, rbx
mov r9d, 0x462
call fcn.14007e2d0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14008e970
lea rbx, [rsp + 0x60]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1400cf750
mov word [rbx], 0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
dec edi
cmp edi, 0x103
ja 0x140117d23
lea rsi, [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.1400ca328
mov qword [rsi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.14009f4c0
lea rsi, [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
call fcn.1400afca0
mov rcx, r14
mov rdx, rsi
call fcn.1400b4d80
mov rcx, rsi
call fcn.14007cab0
mov rcx, rbx
call fcn.14007cab0
cmp edi, 0x104
setb bl
lea rcx, [rsp + 0x270]
call fcn.14007d0f0
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebx
add rsp, 0x2d8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140119fc0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, dword [0x14029bff0]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14011a05b
lea rcx, [0x14029bfe8]
call fcn.1400a0960
test rax, rax
jne 0x14011a03a
mov ecx, 4
call fcn.1400c9cbc
mov dword [rax], 0
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
lea rsi, [rsp + 0x30]
mov rcx, rsi
call fcn.14011a0b0
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
jne 0x14011a09f
lea rsi, [0x14029bfe8]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ccfe0
mov rcx, rsi
add rsp, 0x40
pop rsi
jmp fcn.1400a0960
lea rcx, [0x14029bff0]
call fcn.1400c9d58
cmp dword [0x14029bff0], 0xffffffff
jne 0x140119ff5
mov qword [0x14029bfe8], 0
lea rcx, [0x14029bfe8]
lea rdx, [0x140128b10]
call fcn.1400721e0
lea rcx, [0x14029bff0]
call fcn.1400c9cf8
jmp 0x140119ff5
call fcn.1400c9cac
jmp 0x14011a03a
Function at 0x140120990
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14029ba28]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401209c5
lea rcx, [0x14029ba20]
add rsp, 0x28
jmp fcn.1400a0960
lea rcx, [0x14029ba28]
call fcn.1400c9d58
cmp dword [0x14029ba28], 0xffffffff
jne 0x1401209b5
mov qword [0x14029ba20], 0
lea rcx, [0x14029ba20]
xor edx, edx
call fcn.1400721e0
lea rcx, [0x14029ba28]
call fcn.1400c9cf8
jmp 0x1401209b5

Function at 0x140120a80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
lea rdx, [rsi + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x90]
mov byte [rsi + 0xde9], 1
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x50]
test rax, rax
je 0x140120b20
mov eax, dword [0x14029b0b0]
mov ecx, dword [0x140293330]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140120ae4
lea rcx, [0x14029b0a8]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140098d50
lea rcx, [0x14029b0b0]
call fcn.1400c9d58
cmp dword [0x14029b0b0], 0xffffffff
jne 0x140120ad0
mov qword [0x14029b0a8], 0
lea rcx, [0x14029b0a8]
xor edx, edx
call fcn.1400721e0
lea rcx, [0x14029b0b0]
call fcn.1400c9cf8
jmp 0x140120ad0
add rsp, 0x20
pop rsi
ret

Function at 0x1401228c0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.1400ccf70
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r15, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r15
mov dl, 0xaa
call fcn.1400cf750
lea r12, [rsp + 0x3c]
mov dword [r12], 1
lea rsi, [rsp + 0x38]
mov dword [rsi], 0x800
lea rdx, str.ReadValue
lea r8, str..._.._base_win_registry.cc
lea rcx, [rsp + 0x40]
mov r9d, 0x19e
call fcn.14007e2d0
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
mov rdx, rdi
xor r8d, r8d
mov r9, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14012299d
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x1401229a1
lea rdx, [rsp + 0x840]
mov rcx, r14
call fcn.1400a90fe
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edi, eax
jmp 0x14012297a
cmp eax, 2
jne 0x1401229e6
lea rsi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.1400cf750
lea rcx, [rsp + 0x840]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
dec eax
cmp eax, 0x3ff
ja 0x1401229ed
lea rdx, [rsp + 0x40]
jmp 0x140122970
mov edi, 0x3f4
jmp 0x14012297a
mov edi, 0xea
jmp 0x14012297a
Function at 0x14012b800
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm6
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], r15
movaps xmm6, xmmword [0x140257270]
movaps xmmword [rsi + 0x40], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rdx, str.CreateDirectoryAndGetError
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x336
call fcn.14007e2d0
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14008e970
cmp byte [rdi + 0x17], 0
mov rbx, rdi
jns 0x14012b896
mov rbx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14012b8e2
mov sil, 1
test al, 0x10
je 0x14012b97c
lea rcx, [rsp + 0x40]
call fcn.14007d0f0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rsi, [rsp + 0x20]
mov qword [rsi + 0x10], r15
movaps xmmword [rsi], xmm6
mov rcx, rdi
mov rdx, rsi
call fcn.140009a00
movzx ecx, byte [rsi + 0x17]
mov r8, rcx
test cl, cl
jns 0x14012b909
mov r8, qword [rsp + 0x28]
movzx eax, byte [rdi + 0x17]
mov rdx, rax
test al, al
jns 0x14012b918
mov rdx, qword [rdi + 8]
cmp r8, rdx
je 0x14012b99a
lea rcx, [rsp + 0x20]
mov rdx, r14
call fcn.14012b800
test al, al
je 0x14012b9e4
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov sil, 1
test eax, eax
je 0x14012b953
lea rcx, [rsp + 0x20]
call fcn.14007cab0
jmp 0x14012b8af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xb7
jne 0x14012b96e
mov rcx, rdi
call fcn.14012b9f0
test al, al
jne 0x14012b944
test r14, r14
je 0x14012b9dc
mov ecx, ebx
call fcn.14010ec10
jmp 0x14012b9d9
test r14, r14
je 0x14012b988
mov dword [r14], 0xfffffff7
mov ecx, 0x50
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x14012b8af
test r8, r8
je 0x14012b9ca
test cl, cl
jns 0x14012b9a8
mov rsi, qword [rsp + 0x20]
mov rcx, rdi
test al, al
jns 0x14012b9b2
mov rcx, qword [rdi]
xor edx, edx
movzx eax, word [rsi + rdx*2]
cmp ax, word [rcx + rdx*2]
jne 0x14012b91d
inc rdx
cmp r8, rdx
jne 0x14012b9b4
mov eax, 0xfffffffc
mov ebx, 2
test r14, r14
je 0x14012b9dc
mov dword [r14], eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x14012b944
Function at 0x14012b9f0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x140257270]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.DirectoryExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x2a9
call fcn.14007e2d0
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14008e970
cmp byte [rdi + 0x17], 0
jns 0x14012ba74
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.14007d0f0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, edi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret

Function at 0x14012c0f0
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov r14, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1400cf750
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14012c18f
lea rsi, [rsp + 0x20]
mov qword [rsi], rbx
mov rcx, rbx
call fcn.1400ca328
mov qword [rsi + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.14009f4c0
lea rsi, [rsp + 0x48]
mov rcx, rbx
mov rdx, rsi
call fcn.1400afca0
mov rcx, r14
mov rdx, rsi
call fcn.1400b4d80
mov rcx, rsi
call fcn.14007cab0
mov rcx, rbx
call fcn.14007cab0
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14012cc20
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402910c8]
cmp ecx, 0xffffffff
je 0x14012cc45
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x14012cc40
Function at 0x14013b400
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x14013b530
cmp qword [rsi], 0
jne 0x14013b530
cmp dword [rsi + 0x14], 0
jne 0x14013b530
cmp qword [rsi + 8], 0
jne 0x14013b530
xor eax, eax
mov rbx, qword [rdi]
cmp rax, rbx
je 0x14013b471
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14013b4c2
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14013b469
mov qword [rsi], rbx
call fcn.140071760
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rdi + 8]
cmp qword [rsi + 8], rbp
je 0x14013b4ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14013b4ea
lea rax, [rbp + 1]
cmp rax, 2
jb 0x14013b4a3
mov qword [rsi + 8], rbp
call fcn.140071760
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140071760
mov r14, qword [rsi]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x14013b514
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x14013b457
call fcn.140071760
mov r14, qword [rsi + 8]
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x14013b522
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi + 8], 0
jmp 0x14013b490
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x14013b4d6
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x14013b4ff
mov rcx, rsi
call fcn.14013a5c0
mov rax, qword [rsi]
jmp 0x14013b43b

Function at 0x140140546
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14022c8a0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x14014059f
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ccfe0
nop
add rsp, 0x40
pop rsi
ret
lea rdx, str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x1b
call fcn.140189280
mov rcx, rsi
call fcn.1401892a0
lea rdx, [0x14026cfb8]
mov r8d, 0xc
mov rcx, rax
call fcn.1400a7acb
mov rcx, rsi
call fcn.1401892b0
jmp 0x14014058b
Function at 0x140140fcf
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rdi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.14013b0ed
test rax, rax
jne 0x14014100e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
je 0x14014102a
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400ac390
test al, al
je 0x140141080
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0xfc
mov r9d, 2
call fcn.14014efd0
lea rcx, [rsp + 0x40]
lea rdx, [0x14025f3de]
mov r8d, 0xc
call fcn.1400a7acb
mov rcx, rsi
call fcn.1401412f0
xor esi, esi
jmp 0x14014100e
Function at 0x1401487ee
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x38]
mov rsi, qword [rcx + 0x40]
cmp rbx, rsi
jne 0x140148816
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r15, r8
mov edi, edx
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], edi
jne 0x14014883e
cmp byte [rbx + 0x27], 0
jns 0x140148833
mov rcx, qword [rbx + 0x10]
jmp 0x140148837
lea rcx, [rbx + 0x10]
call r12
test al, 0x10
je 0x140148849
add rbx, 0x70
cmp rsi, rbx
je 0x140148808
jmp 0x140148822
mov r14, qword [r15 + 8]
cmp r14, qword [r15 + 0x10]
jne 0x140148860
mov rcx, r15
mov rdx, rbx
call fcn.1401b13a2
jmp 0x14014883e
mov rcx, r14
mov rdx, rbx
call fcn.1401b1336
add r14, 0x68
mov qword [r15 + 8], r14
jmp 0x14014883e
Function at 0x140158ba0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0xc0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x60]
mov qword [rdi + 0x50], rax
movaps xmm0, xmmword [0x140257270]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, [0x14025cc88]
lea r8, str..._.._base_files_file_util_win.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r9d, 0x42a
call fcn.14007e2d0
xor r15d, r15d
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
call fcn.14008e970
cmp byte [rbx + 0x17], 0
jns 0x140158c32
mov rbx, qword [rbx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov rcx, rbx
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x140158c89
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rdi, 0xffffffffffffffff
je 0x140158d32
call fcn.140071760
mov r15, rdi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdi, [r15 + 1]
cmp rdi, 2
jb 0x140158d1d
lea rsi, [rsp + 0x40]
mov dword [rsi], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, r14
mov r8d, ebp
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsi]
xor edx, edx
cmp eax, 1
sbb edx, edx
cmp ecx, ebp
mov esi, 0xffffffff
cmove esi, ecx
or esi, edx
cmp rdi, 2
jb 0x140158cf1
call fcn.140071760
mov rcx, qword [0x1402980e0]
test rcx, rcx
je 0x140158d24
mov rax, qword [rcx]
mov rdx, r15
call qword [rax]
lea rcx, [rsp + 0x60]
call fcn.14007d0f0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, esi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x140158cd2
call fcn.140122340
mov rcx, qword [0x1402980e0]
jmp 0x140158ce9
xor r15d, r15d
jmp 0x140158c81

Function at 0x140158e00
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov edx, 1
jmp 0x1400040a0
Function at 0x140158e10
Capabilities:
Move file

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x50], rax
movaps xmm0, xmmword [0x140257270]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str..._.._base_files_file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x1f5
call fcn.14007e2d0
xor ebp, ebp
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.14008e970
movzx eax, byte [rsi + 0x17]
mov rcx, rax
test al, al
jns 0x140158e9d
mov rcx, qword [rsi + 8]
cmp rcx, 0x103
ja 0x140158ec4
test al, al
jns 0x140158ead
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bpl
lea rcx, [rsp + 0x40]
call fcn.14007d0f0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebp
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140165864
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
lea rcx, [rsp + 0x28]
mov edx, eax
call fcn.140166178
lea rdi, [rsi + 0xb8]
cmp byte [rsi + 0xcf], 0
jns 0x1401658ab
mov rcx, qword [rdi]
call fcn.1400c9cac
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdi], xmm0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ccfe0
nop
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x1401679c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1401679c8
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x140167a26
mov edi, dword [rsi + 0x5c]
test r15b, r15b
je 0x140167a06
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.1400cb764
cmp eax, 0xffffffff
je 0x140167aa3
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x140167a44
mov byte [rsp + 0x57], 0xaa
cmp byte [rsi + 0x61], 0
je 0x140167aad
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test r15b, r15b
je 0x140167a80
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x140167a06
mov edi, edi
test rdi, rdi
jle 0x140167b52
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movzx ecx, byte [rsp + rax + 0x58]
call fcn.1400cb70c
cmp eax, 0xffffffff
jne 0x140167a82
mov edi, 0xffffffff
jmp 0x140167a06
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x57]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [rax + 0x18]
cmp eax, 1
jne 0x140167b3b
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp rdi, 8
je 0x140167aa3
mov rcx, qword [rsi + 0x40]
call fcn.1400cb764
cmp eax, 0xffffffff
je 0x140167aa3
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x140167abe
cmp eax, 2
je 0x140167aa3
cmp eax, 3
je 0x140167a69
jmp 0x140167a71
movzx edi, byte [rsp + 0x57]
jmp 0x140167a06
Function at 0x140167cb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x140167cb8
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x140167d16
movzx edi, word [rsi + 0x5c]
test r15b, r15b
je 0x140167cf6
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.1400cb764
cmp eax, 0xffffffff
je 0x140167d9b
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x140167d34
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x140167da4
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test r15b, r15b
je 0x140167d75
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x140167cf6
mov edi, edi
test rdi, rdi
jle 0x140167e49
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movsx eax, byte [rsp + rax + 0x58]
movzx ecx, ax
call fcn.1400cb70c
cmp eax, 0xffffffff
jne 0x140167d77
mov di, 0xffff
jmp 0x140167cf6
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x56]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [rax + 0x18]
cmp eax, 1
jne 0x140167e32
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp rdi, 8
je 0x140167d9b
mov rcx, qword [rsi + 0x40]
call fcn.1400cb764
cmp eax, 0xffffffff
je 0x140167d9b
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x140167db5
cmp eax, 2
je 0x140167d9b
cmp eax, 3
je 0x140167d5b
jmp 0x140167d65
movzx edi, word [rsp + 0x56]
jmp 0x140167cf6
Function at 0x140167fc0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14028f028]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 - 8], r12
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov ebp, 0xffffffff
mov qword [rsp + 0x30], r12
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x30]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1400cb76c
cmp rax, rbx
jne 0x14016805c
cmp edi, 1
je 0x140168004
cmp edi, 2
je 0x14016805c
mov rcx, qword [rsi + 0x40]
call fcn.1400cb7f0
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ccfe0
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140168080
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x1401680b5
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400cb76c
xor ebx, ebx
test rsi, rsi
jle 0x1401680da
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x1401680da
inc rbx
cmp rsi, rbx
jne 0x1401680bc
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret