joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140224430
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov r9d, r8d
mov edi, edx
xor edx, edx
xor r8d, r8d
call fcn.140223e10
mov rsi, rax
test rax, rax
je 0x140224527
mov dword [rsi + 0x7d0], edi
mov rax, qword [rsi + 0x708]
mov rcx, qword [rax + 0x378]
test rcx, rcx
je 0x1402244b9
call fcn.14023a710
mov qword [rsi + 0x730], rax
mov qword [rsi + 0x40], send
mov rax, qword [rsi + 0x708]
mov rcx, qword [rax + 0x380]
call fcn.14023a710
mov qword [rsi + 0x738], rax
mov rax, qword [rsi + 0x708]
mov rcx, qword [rax + 0x388]
call fcn.14023a710
mov qword [rsi + 0x740], rax
mov rax, qword [rsi + 0x708]
mov rcx, qword [rax + 0x3c0]
cmp edi, 1
jne 0x1402244cc
call fcn.14023a140
jmp 0x1402244d1
call fcn.14023a1f0
mov qword [rsi + 0x728], rax
mov qword [rsi + 0x748], 3
mov qword [rsi + 0x788], 0
mov ecx, dword [0x1404a6de8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140224512
cmp byte [rax + 8], 0
jne 0x140224517
mov rcx, rax
call fcn.140041280
test rax, rax
jne 0x140224517
call fcn.1402021d0
mov qword [rsi + 0x10], rax
mov qword [rax + 0x60], rsi
mov rcx, rsi
call fcn.1402022c0
test rsi, rsi
setne al
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140224670
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov edi, edx
mov rbx, rcx
mov r14, qword [rcx + 0x3a8]
cmp qword [0x1404ab4b0], 0
sete sil
mov rcx, r14
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rcx, r14
mov edx, esi
call fcn.140226db0
mov rsi, rax
mov qword [rax + 0x700], 0
mov qword [rax + 0x708], rbx
mov qword [rax + 0xd30], 0
mov eax, 0x80
xchg qword [rsi + 0x790], rax
mov dword [rsi + 0xc40], 0
mov rcx, r14
call fcn.140006ee0
mov dword [rsi + 0x7d0], edi
mov qword [rsi + 0x748], 3
mov qword [rsi + 0x788], 0
mov ecx, dword [0x1404a6de8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140224721
cmp byte [rax + 8], 0
jne 0x140224726
mov rcx, rax
call fcn.140041280
test rax, rax
jne 0x140224726
call fcn.1402021d0
mov qword [rsi + 0x10], rax
mov qword [rax + 0x60], rsi
mov rcx, rsi
call fcn.1402022c0
mov al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140226590
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1404a6de8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1402265bc
cmp byte [rax + 8], 0
jne 0x1402265c1
mov rcx, rax
call fcn.140041280
test rax, rax
jne 0x1402265c1
call fcn.1402021d0
mov rax, qword [rax + 0x68]
test rax, rax
je 0x1402265d7
cmp qword [rax + 0x10], rsi
sete al
add rsp, 0x20
pop rsi
ret
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x1402265e0
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1404a6de8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140226610
cmp byte [rax + 8], 0
jne 0x140226615
mov rcx, rax
call fcn.140041280
test rax, rax
jne 0x140226615
call fcn.1402021d0
mov rbx, qword [rax + 0x68]
test rbx, rbx
je 0x1402266e2
lea rdi, [rsi + 8]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov byte [rbx + 0x28], 1
mov rax, qword [rsi + 0xd8]
test rax, rax
je 0x1402266d1
inc rax
mov qword [rsi + 0xd8], rax
lea r14, [rsi + 0x48]
cmp qword [rsi + 0x48], r14
jne 0x1402266d1
cmp qword [rsi + 0x60], 0
je 0x1402266d1
mov ecx, 0x38
call fcn.14029f9b8
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rsi
mov rax, qword [0x14040f388]
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], 0
mov byte [rbx + 0x28], 0
lea rcx, [rbx + 0x30]
call fcn.140006ef0
mov qword [rbx], r14
mov rax, qword [rsi + 0x50]
mov qword [rbx + 8], rax
mov qword [rsi + 0x50], rbx
mov qword [rax], rbx
inc qword [rsi + 0x28]
mov rcx, rdi
call fcn.140006ee0
lea rcx, str.DartWorker
lea rdx, [0x140226ad0]
mov r8, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140202310
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140006ee0
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1402266f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1404a6de8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14022671e
cmp byte [rax + 8], 0
jne 0x140226723
mov rcx, rax
call fcn.140041280
test rax, rax
jne 0x140226723
call fcn.1402021d0
mov rbx, qword [rax + 0x68]
test rbx, rbx
je 0x140226767
lea rdi, [rsi + 8]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
cmp byte [rbx + 0x28], 1
jne 0x140226758
mov byte [rbx + 0x28], 0
mov rax, qword [rsi + 0xd8]
test rax, rax
je 0x140226758
dec rax
mov qword [rsi + 0xd8], rax
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140006ee0
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x1402278e0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov edx, dword [0x1404ab688]
cmp edx, 0x10000001
jb 0x140227917
lea rcx, str.warning:_value_specified_for___old_gen_heap_size__d_is_larger_than_the_physically_addressable_range__using_0_unlimited__instead.__n
call fcn.140203290
mov dword [0x1404ab688], 0
mov edx, dword [0x1404ab678]
cmp edx, 0x10000001
jb 0x140227941
lea rcx, str.warning:_value_specified_for___new_gen_semi_max_size__d_is_larger_than_the_physically_addressable_range__using__lld_instead.__n
mov r8d, reloc.WS2_32.dll_recv
call fcn.140203290
mov dword [0x1404ab678], 0x10
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x1404af368], rax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14022796d
add rsp, 0x58
ret
call fcn.14029fd30
int3
Function at 0x140227990
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rbx, rcx
lea rsi, [rdx + rcx]
sub rsi, qword [0x1404af368]
test byte [0x1404ab450], 1
mov eax, 4
mov ebp, 0x40
cmovne ebp, eax
test r8b, r8b
cmove ebp, eax
xor r15d, r15d
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x2000
mov r9d, ebp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140227a44
mov r14, rax
add rax, rdi
dec rax
neg rdi
and rdi, rax
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x1000
mov r9d, ebp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp rax, rdi
je 0x140227a23
mov rcx, r14
mov rdx, rsi
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor r15d, r15d
jmp 0x140227a44
test rdi, rdi
je 0x140227a1e
mov ecx, 0x20
call fcn.14029f9b8
mov r15, rax
mov qword [rax], rdi
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rsi
mov rax, r15
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140246390
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf0
movaps xmmword [rsp + 0xe0], xmm6
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov byte [r8 + 8], 0
mov qword [rcx + 0x30], r8
mov eax, dword [0x1404b15b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x18]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
mov qword [rdi + 0x20], rax
lea r15, [rsp + 0x30]
mov rcx, r15
call fcn.140256ad0
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + 0x128]
mov dword [rsp + 0xa6], 0
mov byte [rsp + 0xaa], 0
mov dword [rsp + 0xac], 0
mov byte [rsp + 0xb0], 0
mov dword [rsp + 0xb2], 0
mov byte [rsp + 0xb6], 0
mov qword [rsp + 0xb8], 0
mov byte [rsp + 0xc0], 0
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0x9d], 0
mov qword [rsp + 0xc8], WSAGetLastError
mov dword [rsp + 0xd0], 0xffffffff
mov rax, qword [r14]
lea r8, [rsp + 0x60]
mov rcx, r14
mov rdx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + 0x30]
mov rcx, qword [rdi + 0x30]
mov rax, qword [rcx]
call qword [rax + 0xc8]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140246519
lea r14, [rsp + 0x60]
nop dword [rax + rax]
lea rcx, [rax - 1]
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rdx + rax*8 - 8]
mov rax, qword [rcx]
mov rdx, rdi
mov r8, r14
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x1402464f0
cmp byte [rdi + 0x39], 0
je 0x140246531
mov rcx, 0xffffffffffffffff
lea rdx, str.RegExp_too_big
xor eax, eax
jmp 0x14024654e
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140258720
mov rcx, qword [rsp + 0x28]
call fcn.140246590
mov rcx, qword [rdi + 8]
xor edx, edx
mov qword [rsi], rdx
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x140246587
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14029fd30
int3
Function at 0x14025c1e0
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
call fcn.14025c070
mov rax, qword [rsi + 0x60]
cmp rax, 1
je 0x14025c231
test rax, rax
jne 0x14025c23d
mov eax, dword [0x1404b14c0]
mov ecx, dword [0x1404b15b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x10]
jg 0x14025c2e3
mov rax, qword [0x1404b14b8]
jmp 0x14025c2d9
mov rax, qword [rsi + 0x70]
mov rax, qword [rax]
jmp 0x14025c2d9
mov rdx, qword [rsi]
mov ecx, 0x20
call fcn.1401774b0
mov rdi, rax
mov eax, dword [0x1404b15b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x18]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], rax
cmp qword [rsi + 0x60], 0
jle 0x14025c2bb
xor ebx, ebx
nop word cs:[rax + rax]
mov r14, qword [rsi + 0x70]
mov rdx, qword [rdi]
inc rdx
mov rcx, rdi
call fcn.140166fd0
mov rax, qword [r14 + rbx*8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 0x10]
mov qword [rdx + rcx*8 - 8], rax
inc rbx
cmp rbx, qword [rsi + 0x60]
jl 0x14025c290
mov rdx, qword [rsi]
mov ecx, 0x20
call fcn.1401774b0
mov rsi, rax
mov rcx, rax
mov rdx, rdi
call fcn.140259490
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1404b14c0]
call fcn.14029fb20
cmp dword [0x1404b14c0], 0xffffffff
jne 0x14025c225
mov ecx, 8
call fcn.14029f9b8
lea rcx, [0x1404286e0]
mov qword [rax], rcx
mov qword [0x1404b14b8], rax
lea rcx, [0x1404b14c0]
call fcn.14029fb88
jmp 0x14025c225
Function at 0x140261570
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, r8
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov eax, dword [0x1404b15b8]
mov r8, qword gs:[0x58]
mov rax, qword [r8 + rax*8]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rcx
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov byte [rsp + 0x78], 1
mov dword [rsp + 0x7c], edx
mov dword [rsp + 0x80], 0
mov r8, qword [rcx + 8]
mov rax, qword [r8 + 7]
cmp rax, 2
jl 0x140261624
mov rax, qword [r8 - 1]
shr eax, 0xc
cmp eax, 0x5f
je 0x140261645
cmp eax, 0x5e
jne 0x1402617af
movzx eax, byte [r8 + 0xf]
movzx eax, ax
mov ecx, 1
test dl, 8
jne 0x140261657
jmp 0x1402616d2
mov dword [rsp + 0x58], 0x200000
mov rax, qword [r8 + 7]
sar rax, 1
inc rax
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x78], 0
jmp 0x1402616db
movzx eax, word [r8 + 0xf]
movzx eax, ax
mov ecx, 1
test dl, 8
je 0x1402616d2
mov rdx, qword [r8 + 7]
cmp rdx, 4
jl 0x1402616d2
mov edx, eax
and edx, 0xfc00
cmp edx, 0xd800
jne 0x1402616d2
mov rdx, qword [r8 - 1]
shr edx, 0xc
cmp edx, 0x5f
je 0x1402616a0
cmp edx, 0x5e
jne 0x1402617af
movzx edx, byte [r8 + 0x10]
mov r8d, edx
and r8d, 0xfc00
cmp r8d, 0xdc00
je 0x1402616b8
jmp 0x1402616d2
movzx edx, word [r8 + 0x11]
mov r8d, edx
and r8d, 0xfc00
cmp r8d, 0xdc00
jne 0x1402616d2
and eax, 0x3ff
shl eax, 0xa
and edx, 0x3ff
add eax, edx
add eax, 0x10000
mov ecx, 2
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x58], eax
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.14025cad0
mov rdi, rax
mov rcx, rbx
call fcn.14025e170
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x98]
test al, al
je 0x140261730
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x90]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 7]
sar rcx, 1
cmp qword [rax], rcx
jne 0x140261730
mov byte [rsp + 0x80], 1
mov qword [rsi], rdi
mov rbx, qword [rsp + 0x68]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x98]
test al, al
je 0x14026175a
cmp byte [rsp + 0x80], 1
jne 0x14026175a
test rbx, rbx
sete al
jmp 0x14026175c
xor eax, eax
mov byte [rsi + 0x10], al
movzx eax, byte [rsp + 0x81]
mov byte [rsi + 0x11], al
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
call fcn.140260a30
mov rax, qword [rsi + 0x18]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 8], rcx
mov qword [rsi + 0x28], rbx
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1402617a9
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
call fcn.14029fd30
int3
lea rax, str..._.._runtime_vm_object.h
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x90], 0x34c3
lea rdx, str.unreachable_code
lea rcx, [rsp + 0x88]
call fcn.1402d94a0
int3

Function at 0x14026af30
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x28
test rcx, rcx
jle 0x14026af53
mov r8, rcx
xor ecx, ecx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
setns al
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret
Function at 0x14026ef70
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x278], rax
mov eax, 4
cmp byte [rcx + 0x18], 0
jne 0x14026f100
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx + 0x10], 0
je 0x14026f042
movsxd rax, dword [rsi + 0x1c]
mov qword [rdi + 0x10], rax
mov rcx, qword [rdi + 8]
mov word [rcx + rax*2], 0
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14026eff1
test rax, rax
je 0x14026efdc
mov rax, qword [rax + 0x20]
cmp rax, rcx
je 0x14026effa
mov edx, 0x18
call fcn.14029f9fc
mov qword [rsi + 0x20], 0
mov rax, qword [rsi]
test rax, rax
je 0x14026effe
mov rax, qword [rax + 0x20]
mov qword [rsi + 0x20], rax
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14026f123
lea r8, [rsp + 0x28]
mov rcx, rdi
mov rdx, rsi
call fcn.14026f160
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
je 0x14026f114
jmp 0x14026f14e
cmp qword [rsi], 0
lea rax, [0x1404960ca]
lea rbx, [0x1404960c8]
cmove rbx, rax
mov r14, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
mov r15d, 0x7fff
mov edx, 0x7fff
sub rdx, rax
lea rcx, [r14 + rax*2]
lea r8, [0x140495be8]
mov r9, rbx
call fcn.1400143a0
mov word [r14 + 0xfffe], 0
test eax, eax
js 0x14026f0ec
movsxd r14, eax
sub r15, qword [rdi + 0x10]
cmp r15, r14
jl 0x14026f0ec
mov edx, 0x8000
mov rcx, rbx
call fcn.1402c12a0
cmp rax, r14
jne 0x14026f0ec
add r14, qword [rdi + 0x10]
mov qword [rdi + 0x10], r14
dec r14d
mov dword [rsi + 0x1c], r14d
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14026f0f7
mov qword [rsi + 0x10], rax
movsxd rax, dword [rsi + 0x1c]
mov qword [rdi + 0x10], rax
mov rcx, qword [rdi + 8]
mov word [rcx + rax*2], 0
jmp 0x14026f015
mov ecx, reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 0x18], 1
mov eax, 3
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14026f14e
add rsp, 0x280
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov byte [rsi + 0x18], 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 0x12
sete al
add eax, 3
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
je 0x14026f114
call fcn.14029fd30
int3
Function at 0x14026f160
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rbx, [r8 + 0x2c]
mov r12, qword [rcx + 8]
mov rax, qword [rcx + 0x10]
mov r15d, 0x7fff
mov edx, 0x7fff
sub rdx, rax
lea rcx, [r12 + rax*2]
lea r8, [0x140495be8]
mov r9, rbx
call fcn.1400143a0
mov word [r12 + 0xfffe], 0
test eax, eax
js 0x14026f25c
movsxd r12, eax
sub r15, qword [rdi + 0x10]
cmp r15, r12
jl 0x14026f25c
mov edx, 0x8000
mov rcx, rbx
call fcn.1402c12a0
cmp rax, r12
jne 0x14026f25c
add qword [rdi + 0x10], r12
mov ebp, dword [r14]
test ebp, 0x400
jne 0x14026f295
xor eax, eax
test bpl, 0x10
je 0x14026f26c
lea rdx, [0x1404960c4]
mov rcx, rbx
call fcn.1402c5714
test eax, eax
je 0x14026f233
lea rdx, [0x1404960c2]
mov rcx, rbx
call fcn.1402c5714
mov ecx, eax
mov eax, 1
test ecx, ecx
jne 0x14026f26c
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14029fd30
mov rcx, rsi
mov rdx, rdi
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.14026ef70
mov ecx, reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 3
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14026f28f
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14029fd30
int3
mov eax, 2
cmp byte [rdi + 0x2a], 1
jne 0x14026f26c
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
mov eax, 2
cmp r14, 0xffffffffffffffff
je 0x14026f26c
mov eax, 0
test bpl, 0x10
je 0x14026f26c
lea rdx, [rsp + 0x44]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x14026f391
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, dword [rsp + 0x60]
mov ebp, dword [rsp + 0x70]
mov r12d, dword [rsp + 0x74]
mov r15, qword [rsi + 0x20]
test r15, r15
je 0x14026f345
mov rax, r15
jmp 0x14026f32b
mov rax, qword [rax + 0x10]
test rax, rax
je 0x14026f345
cmp dword [rax], r14d
jne 0x14026f322
cmp dword [rax + 4], r12d
jne 0x14026f322
cmp dword [rax + 8], ebp
jne 0x14026f322
mov eax, 2
jmp 0x14026f26c
lea rdx, [0x1404960c4]
mov rcx, rbx
call fcn.1402c5714
test eax, eax
je 0x14026f3a9
lea rdx, [0x1404960c2]
mov rcx, rbx
call fcn.1402c5714
test eax, eax
je 0x14026f3a9
mov ecx, 0x18
call fcn.14029f9b8
mov dword [rax], r14d
mov dword [rax + 4], r12d
mov dword [rax + 8], ebp
mov qword [rax + 0x10], r15
mov qword [rsi + 0x20], rax
mov eax, 1
jmp 0x14026f26c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
jmp 0x14026f261
mov rcx, rsi
mov rdx, rdi
call fcn.14026ef70
jmp 0x14026f26c
Function at 0x14026f420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14026f48b
mov ecx, eax
mov eax, 2
test cl, 0x10
je 0x14026f485
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
mov eax, 2
cmp rcx, 0xffffffffffffffff
je 0x14026f485
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x40
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor eax, eax
cmp ecx, 2
sete al
add eax, eax
add rsp, 0x40
pop rsi
ret

Function at 0x14026f4b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
call fcn.1402750d0
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14026f52e
mov esi, 2
test al, 0x10
je 0x14026f542
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14026f542
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
jmp 0x14026f542
call qword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xfffffffe
xor esi, esi
cmp eax, 2
sete sil
add esi, esi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14026f551
call fcn.14029f9fc
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14026f56b
mov eax, esi
add rsp, 0x48
pop rdi
pop rsi
ret
call fcn.14029fd30
int3

Function at 0x14026f580
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
xor edi, edi
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14026f638
lea edi, [rax + 1]
movsxd rcx, eax
cmp eax, 0xffffffff
lea rax, [rcx + rcx + 2]
mov rcx, 0xffffffffffffffff
cmovge rcx, rax
call fcn.14029fa30
mov rsi, rax
mov ecx, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r14, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call r14
movsxd rbx, eax
mov rcx, rbx
call fcn.140006630
mov rdi, rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call r14
mov rcx, rsi
call fcn.14029f9fc
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14026f650
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
call fcn.1402750d0
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test eax, eax
jne 0x14026f6ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14026f6ed
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14026f6e7
test al, 0x10
je 0x14026f6ed
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14026f6ed
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x14026f6f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
setne bl
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14026f701
call fcn.14029f9fc
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14026f71c
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
call fcn.14029fd30
int3

Function at 0x14026f730
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, 0x8000
mov edx, 2
call fcn.1400065d0
mov rsi, rax
mov ecx, 0x7fff
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
mov word [rsi + rax*2], 0
mov rcx, rsi
mov rdx, 0xffffffffffffffff
xor r8d, r8d
call fcn.140278b50
mov rdi, rax
mov rcx, rsi
call fcn.1402bbd1c
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret