joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400141d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov ebp, r8d
mov eax, 0x80000000
mov dword [rsp + 0x60], r15d
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov r14, rcx
cmp r8, rax
jae 0x14001427d
test rbx, rbx
je 0x140014239
nop
mov rcx, qword [r14]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov qword [rsp + 0x20], r15
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001425c
mov eax, dword [rsp + 0x60]
add rdi, rax
sub rbx, rax
jne 0x140014210
test rsi, rsi
je 0x140014241
mov qword [rsi], rbp
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
test rsi, rsi
je 0x14001426e
mov ecx, dword [rsp + 0x60]
add rcx, rbp
sub rcx, rbx
mov qword [rsi], rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400142a0
jmp 0x140014243
mov r8d, 0x2e5
lea rdx, str.boralib_file_fileIOWindows.c
lea rcx, str.VERIFY__s:_d_n
call fcn.14002b900
int3
Function at 0x140015550
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push r12
push r15
sub rsp, 0x38
xor ebp, ebp
mov dword [rsp + 0x60], 0x20
mov dword [rsp + 0x64], 5
mov r15d, r8d
mov r12, rcx
test rcx, rcx
jne 0x140015582
mov esi, 0x1e7
jmp 0x140015699
mov edx, 1
mov qword [rsp + 0x30], r14
call fcn.140042350
mov r8d, 4
lea rdx, [0x140083fb0]
mov rcx, rax
mov r14, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x1400155e5
mov rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], bp
jne 0x1400155b5
cmp rax, 0x104
jb 0x1400155e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, 0xce
mov ecx, esi
mov dword [rax], 0x26
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140015694
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
nop
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140015609
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001560b
xor esi, esi
cmp ebp, r15d
jae 0x14001562a
xor ecx, ecx
lea rax, [rsp + 0x60]
cmp dword [rax], esi
je 0x1400156b1
inc ecx
add rax, 4
cmp ecx, 2
jb 0x140015617
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r14
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, qword [rsp + 0x68]
mov dword [rax], edi
mov rdi, qword [rsp + 0x70]
test esi, esi
je 0x140015694
test r15d, r15d
je 0x140015694
cmp ebp, r15d
jb 0x140015694
mov ecx, esi
call fcn.140013400
mov r9, r12
mov dword [rsp + 0x28], esi
mov r8d, r15d
mov qword [rsp + 0x20], rax
lea rdx, str.FileCreateDirectoryRetry
lea rcx, str.FILE:__s:_Retry_time_expired___u___s___last_error__s___d__n
call fcn.14001bf60
mov r14, qword [rsp + 0x30]
mov edx, esi
lea rcx, str.FileCreateDirectoryRetry
add rsp, 0x38
pop r15
pop r12
pop rsi
pop rbp
jmp fcn.140015e30
mov edx, 0x64
lea ecx, [rdx - 0x5a]
call fcn.140017340
add ebp, eax
jmp 0x1400155f0
Function at 0x1400156d0
Capabilities:
Delete file

Disassembly:
push rbp
push rsi
push r12
push r14
sub rsp, 0x38
xor ebp, ebp
mov dword [rsp + 0x60], 0x20
mov dword [rsp + 0x64], 5
mov r14d, r8d
mov r12, rcx
test rcx, rcx
jne 0x140015702
mov esi, 0x1e7
jmp 0x1400157c7
mov qword [rsp + 0x68], rbx
mov edx, 1
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x30], r15
call fcn.140042350
mov r15, rax
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140015737
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140015739
xor esi, esi
cmp ebp, r14d
jae 0x140015758
xor ecx, ecx
lea rax, [rsp + 0x60]
cmp dword [rax], esi
je 0x1400157df
inc ecx
add rax, 4
cmp ecx, 2
jb 0x140015745
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r15
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r15, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x68]
mov dword [rax], edi
mov rdi, qword [rsp + 0x70]
test esi, esi
je 0x1400157c7
test r14d, r14d
je 0x1400157c7
cmp ebp, r14d
jb 0x1400157c7
mov ecx, esi
call fcn.140013400
mov r9, r12
mov dword [rsp + 0x28], esi
mov r8d, r14d
mov qword [rsp + 0x20], rax
lea rdx, str.FileDeletionRetry
lea rcx, str.FILE:__s:_Retry_time_expired___u___s___last_error__s___d__n
call fcn.14001bf60
mov edx, esi
lea rcx, str.FileDeletionRetry
add rsp, 0x38
pop r14
pop r12
pop rsi
pop rbp
jmp fcn.140015e30
mov edx, 0x64
lea ecx, [rdx - 0x5a]
call fcn.140017340
add ebp, eax
jmp 0x140015720
Function at 0x140016040
Capabilities:
Delete directory

Disassembly:
push rbp
push rsi
push r12
push r14
sub rsp, 0x38
xor ebp, ebp
mov dword [rsp + 0x60], 0x20
mov dword [rsp + 0x64], 5
mov r14d, edx
mov r12, rcx
test rcx, rcx
jne 0x140016072
mov esi, 0x1e7
jmp 0x140016137
mov qword [rsp + 0x68], rbx
mov edx, 1
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x30], r15
call fcn.140042350
mov r15, rax
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400160a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400160a9
xor esi, esi
cmp ebp, r14d
jae 0x1400160c8
xor ecx, ecx
lea rax, [rsp + 0x60]
cmp dword [rax], esi
je 0x14001614f
inc ecx
add rax, 4
cmp ecx, 2
jb 0x1400160b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r15
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r15, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x68]
mov dword [rax], edi
mov rdi, qword [rsp + 0x70]
test esi, esi
je 0x140016137
test r14d, r14d
je 0x140016137
cmp ebp, r14d
jb 0x140016137
mov ecx, esi
call fcn.140013400
mov r9, r12
mov dword [rsp + 0x28], esi
mov r8d, r14d
mov qword [rsp + 0x20], rax
lea rdx, str.FileRemoveDirectoryRetry
lea rcx, str.FILE:__s:_Retry_time_expired___u___s___last_error__s___d__n
call fcn.14001bf60
mov edx, esi
lea rcx, str.FileRemoveDirectoryRetry
add rsp, 0x38
pop r14
pop r12
pop rsi
pop rbp
jmp fcn.140015e30
mov edx, 0x64
lea ecx, [rdx - 0x5a]
call fcn.140017340
add ebp, eax
jmp 0x140016090
Function at 0x1400164a0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rbx, rdx
test rcx, rcx
je 0x140016570
test rdx, rdx
je 0x140016570
mov qword [rsp + 0x30], rbp
mov edx, 1
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
call fcn.140042350
mov edx, 1
mov rcx, rbx
mov rbp, rax
call fcn.140042350
mov r8d, 1
mov rdx, rax
mov rcx, rbp
mov r14, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14001650b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001650d
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, rbp
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r14
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
mov dword [rax], edi
mov rdi, qword [rsp + 0x38]
jmp 0x140016575
mov esi, 0x1e7
mov edx, esi
lea rcx, str.File_RenameRetry
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
jmp fcn.140015e30
Function at 0x140016590
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
push r13
push r14
sub rsp, 0x58
xor ebp, ebp
mov dword [rax + 0x20], 0x20
mov dword [rax + 0x24], 5
mov r14d, r8d
mov r13, rdx
test rcx, rcx
je 0x1400166f6
test rdx, rdx
je 0x1400166f6
mov qword [rax + 0x10], rbx
lea edx, [rbp + 1]
mov qword [rax - 0x28], rdi
mov qword [rax - 0x30], r12
mov qword [rax - 0x38], r15
call fcn.140042350
lea edx, [rbp + 1]
mov rcx, r13
mov r15, rax
call fcn.140042350
mov r12, rax
mov r8d, 1
mov rdx, r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140016612
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140016614
xor esi, esi
cmp ebp, r14d
jae 0x140016636
xor ecx, ecx
lea rax, [rsp + 0x98]
cmp dword [rax], esi
je 0x1400166e2
inc ecx
add rax, 4
cmp ecx, 2
jb 0x140016623
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r15
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r12
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r15, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x88]
mov dword [rax], edi
mov rdi, qword [rsp + 0x50]
test esi, esi
je 0x1400166fb
test r14d, r14d
je 0x1400166fb
cmp ebp, r14d
jb 0x1400166fb
mov ecx, esi
call fcn.140013400
mov r9, qword [rsp + 0x80]
lea rdx, str.File_RenameRetry
mov dword [rsp + 0x30], esi
lea rcx, str.FILE:__s:_Retry_time_expired___u___s___s___last_error__s___d__n
mov qword [rsp + 0x28], rax
mov r8d, r14d
mov qword [rsp + 0x20], r13
call fcn.14001bf60
jmp 0x1400166fb
mov edx, 0x64
lea ecx, [rdx - 0x5a]
call fcn.140017340
add ebp, eax
jmp 0x1400165f2
mov esi, 0x1e7
mov edx, esi
lea rcx, str.File_RenameRetry
add rsp, 0x58
pop r14
pop r13
pop rsi
pop rbp
jmp fcn.140015e30
Function at 0x1400177d0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r13d, edx
mov r12, r9
mov edx, 0x2e
movzx ebx, r8b
mov r14, rcx
call sub.VCRUNTIME140.dll_strrchr
mov rbp, rax
test rax, rax
jne 0x14001781d
mov rbp, 0xffffffffffffffff
nop word [rax + rax]
inc rbp
cmp byte [r14 + rbp], 0
jne 0x140017810
add rbp, r14
mov rcx, r14
call fcn.140020b50
mov rcx, rax
mov qword [rsp + 0x60], rax
sub rcx, r14
mov byte [rcx + rbp], 0
test bl, bl
je 0x140017853
mov r9d, r13d
mov qword [rsp + 0x20], r12
mov r8, rbp
mov rdx, rax
mov rcx, r14
call fcn.140016e50
jmp 0x14001797b
mov qword [rsp + 0x70], r15
xor r15d, r15d
test r12, r12
je 0x140017864
mov qword [r12], r15
test r13d, r13d
js 0x140017976
mov qword [rsp + 0x68], rsi
test r13d, r13d
jne 0x14001787c
mov rsi, r14
jmp 0x140017899
lea r9d, [r13 - 1]
mov qword [rsp + 0x20], rbp
mov r8, rax
lea rdx, str._s__d_s
xor ecx, ecx
call fcn.140030570
mov rsi, rax
mov rcx, rsi
test r15, r15
jne 0x1400178dd
xor r8d, r8d
mov dl, 1
call fcn.1400156d0
mov ebx, eax
test eax, eax
je 0x1400178b8
sub ebx, 2
neg ebx
sbb ebx, ebx
cmp ebx, 0xffffffff
jne 0x14001791c
call fcn.140013250
mov r9, rax
lea rdx, str.FileRotateByRename
mov r8, rsi
lea rcx, str.FILE:__s:_failed_to_remove__s:__s_n
call fcn.14001bf60
jmp 0x14001791c
mov rdx, r15
call fcn.140025be0
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14001791c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14001791c
mov ecx, eax
call fcn.140013400
lea r9, str.FileRotateByRename
mov qword [rsp + 0x20], rax
mov r8, r15
lea rcx, str.FILE:__s:_failed_to_rename__s_____s:__s_n
mov rdx, rsi
call fcn.14001bf60
cmp rsi, r14
jne 0x140017936
test r12, r12
je 0x140017936
test ebx, ebx
jne 0x140017936
mov rcx, r15
call fcn.140020b50
mov qword [r12], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r15
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
sub r13d, 1
mov r15, rsi
mov dword [rax], edi
mov rax, qword [rsp + 0x60]
jns 0x140017872
mov rsi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, qword [rsp + 0x60]
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, qword [rsp + 0x78]
mov dword [rax], edi
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x140017e60
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r15
sub rsp, 0x40
xor edi, edi
mov rbx, rcx
mov r15d, edi
test rcx, rcx
je 0x140017f11
mov byte [rsp + 0x30], 1
lea r9, str..PhysicalDrive
mov qword [rsp + 0x28], 0xffffffffffffffff
lea r8, [rdi - 1]
xor edx, edx
mov qword [rsp + 0x20], rdi
call fcn.140042650
test eax, eax
je 0x140017f11
mov rcx, rbx
call fcn.140016230
mov r15, rax
test rax, rax
je 0x140017f11
lea rdx, [0x1400836ec]
mov rcx, rax
call fcn.1400209f0
test al, al
je 0x140017ed2
mov sil, 1
jmp 0x140017fb3
xor edx, edx
mov qword [rsp + 0x28], 1
lea r9, [0x140083cd8]
mov qword [rsp + 0x20], rdi
mov rcx, r15
lea r8, [rdx - 1]
call fcn.1400429f0
cmp rax, 0xffffffffffffffff
jne 0x140017f19
mov r8, r15
lea rdx, str.File_IsRemote
lea rcx, str.FILE:__s:_No_backslash_in_file__s_n
call fcn.14001dba0
xor sil, sil
jmp 0x140017fb3
mov qword [rsp + 0x60], rbp
mov r8, rax
xor edx, edx
mov qword [rsp + 0x68], r14
mov rcx, r15
call fcn.140042ce0
mov edx, 1
mov rcx, rax
mov rbp, rax
call fcn.140042350
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, rsi
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, rbp
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbp, qword [rsp + 0x60]
cmp r14d, 4
mov r14, qword [rsp + 0x68]
sete sil
mov dword [rax], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r15
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, qword [rsp + 0x70]
mov dword [rax], edi
movzx eax, sil
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
Function at 0x140019270
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, 0x1505
call fcn.140042340
mov rcx, rax
mov rbp, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strlwr]
movsx ecx, byte [rbp]
mov rdx, rbp
test ecx, ecx
je 0x1400192c0
nop word [rax + rax]
imul ebx, ebx, 0x21
lea rdx, [rdx + 1]
add ebx, ecx
movsx ecx, byte [rdx]
test ecx, ecx
jne 0x1400192b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, rbp
mov esi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r8d, ebx
lea rdx, [0x1400846e0]
xor ecx, ecx
mov dword [rax], esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140030570
Function at 0x14001a5c0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
xor r12d, r12d
mov r14, rcx
mov ebp, r12d
cmp byte [rcx + 4], bpl
je 0x14001a6a9
lea rax, [0x1400ed0b0]
cmp qword [rcx + 0x10], rax
je 0x14001a6a3
mov rcx, qword [rcx + 8]
lea r9, str..lck
mov qword [rsp + 0x28], 0xffffffffffffffff
lea rdx, [r12 - 1]
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x50], rsi
call fcn.140042c30
mov rcx, qword [r14 + 0x10]
xor edx, edx
mov r8d, 0x7d0
mov rsi, rax
call fcn.1400156d0
mov edx, 0x7d0
mov rcx, rsi
mov ebp, eax
call fcn.140016040
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, rsi
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, qword [r14 + 0x10]
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rsi, qword [rsp + 0x50]
mov dword [rax], edi
mov qword [r14 + 0x10], r12
jmp 0x14001a6d4
add rcx, 0x10
call fcn.140014810
test eax, eax
je 0x14001a6d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x10
je 0x14001a6d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14001a6d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, qword [r14 + 8]
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], edi
mov dword [r14], r12d
mov qword [r14 + 8], r12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r14
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, qword [rsp + 0x58]
mov dword [rax], edi
mov eax, ebp
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x14001a750
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r9d, r9d
lea rdx, [rsp + 0x80]
xor r8d, r8d
xor r14b, r14b
call fcn.140014d40
mov rcx, qword [rsp + 0x80]
lea r9, [0x140083cd8]
xor ebx, ebx
mov qword [rsp + 0x28], 0xffffffffffffffff
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rbx - 1]
call fcn.140042c30
lea edx, [rbx + 1]
mov rcx, rax
mov r15, rax
call fcn.140042350
mov rbp, rax
mov dword [rsp + 0x38], ebx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, rbp
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], edi
test sil, sil
je 0x14001a817
test byte [rsp + 0x78], 8
je 0x14001a833
mov r14b, 1
jmp 0x14001a833
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.File_DoesVolumeSupportAcls
lea rcx, str.FILE:__s:_GetVolumeInformation_failed:__d_n
call fcn.14001bf60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, qword [rsp + 0x80]
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r15
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, qword [rsp + 0x70]
mov dword [rax], edi
movzx eax, r14b
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140020c00
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, 1
call fcn.140042350
mov rdx, rbx
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, rsi
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov dword [rax], edi
mov eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140021220
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x20
mov rdx, 0xffffffffffffffff
mov rdi, rcx
lea r8d, [rdx + 8]
call fcn.140042370
mov rcx, rdi
test al, al
je 0x14002124c
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor r8d, r8d
mov qword [rsp + 0x30], rbx
lea rdx, [r8 - 1]
call fcn.140042560
mov rbx, rax
test rax, rax
je 0x14002129c
mov r9, rax
lea r8, str.Win32U_OutputDebugString
lea rdx, str._s:_String_with_invalid_encoding:__s
xor ecx, ecx
call fcn.140030510
mov rdi, rax
mov rcx, rax
test rax, rax
jne 0x14002128b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400212a5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]