joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa06680
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xa0668d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xa0669d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xa06685
lea eax, [rcx + 1]
jmp 0xa066ab
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xa066be
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xa066a4
sub eax, 3
jb 0xa066de
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xa0672d
sar eax, 1
movsxd rbp, eax
jb 0xa06714
jmp 0xa066ec
add ebx, ebx
jne 0xa066ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xa06714
inc ecx
add ebx, ebx
jne 0xa066fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xa06714
call r11
adc ecx, ecx
add ebx, ebx
jne 0xa0670d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xa066fc
add ecx, 2
jmp 0xa06719
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00a06642
jmp 0xa0668d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x28d600
mov dl, 0x17
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xa06779
cmp rsi, rcx
jae 0xa06781
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xa06760
cmp al, 0x8f
ja 0xa06760
cmp byte [rsi - 2], 0xf
je 0xa06766
sub al, 0xe8
cmp al, 1
ja 0xa0674a
cmp rsi, rcx
jae 0xa06781
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xa06750
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xa06781
lodsb al, byte [rsi]
jmp 0xa06760
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x5ff000]
mov eax, dword [rdi]
or eax, eax
je 0xa067de
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x606000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xa0678e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xa067d8
mov qword [rbx], rax
add rbx, 8
jmp 0xa067ae
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xa06822
cmp al, 0xef
ja 0xa0680a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xa067ea
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xa067f9
mov eax, dword [rdi]
add rdi, 4
jmp 0xa067f9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xa06876
sub rsp, 0xffffffffffffff80
jmp 0x466ca0
Function at 0x1400016a0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ebp, ebp
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x140001833
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov edi, 0xffffffff
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x14000182d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x1400043b0]
xor edx, edx
lea r8d, [rbp + 1]
lea rcx, [0x1400043c0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14000182d
lea ecx, [rbp + 0x18]
call fcn.140002078
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000178b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rbp
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140001863
jmp 0x14000178e
mov rbx, rbp
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x140001858
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x18]
mov esi, eax
lock xadd dword [rbx + 0x10], edi
cmp edi, 1
jne 0x140001809
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400017ea
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400017fc
call fcn.140002070
mov qword [rbx + 8], rbp
mov edx, 0x18
mov rcx, rbx
call fcn.140002070
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
test esi, esi
js 0x14000182d
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
jmp 0x140001835
call qword [sym.imp.ole32.dll_CoUninitialize]
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140002050
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov ecx, 0x8007000e
call fcn.140001eb0
nop
mov ecx, 0x8007000e
call fcn.140001eb0
int3
Function at 0x140001880
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea ecx, [rdi + 0x20]
call fcn.140002078
mov rcx, rax
mov qword [rsp + 0x38], rax
movdqa xmm0, xmmword [0x1400045f0]
movdqu xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [0x140004588]
movups xmmword [rax], xmm1
movzx eax, word [0x140004598]
mov word [rcx + 0x10], ax
mov byte [rcx + 0x12], dil
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.1400012a0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14000193e
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001939
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001939
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002070
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rdx, qword [rsp + 0x58]
lea rcx, [0x1400045a0]
call fcn.140001010
call fcn.1400016a0
test al, al
je 0x140001985
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001af0
mov rcx, rax
lea rdx, [0x140001ca0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001a28
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140001870]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x1400019d2
lea rcx, [0x1400045d0]
call fcn.140001010
lea edi, [rbx + 1]
jmp 0x140001a28
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, edi
nop dword [rax + rax]
test bl, 1
je 0x140001a03
mov edx, ebx
lea rcx, [0x140004560]
call fcn.140001010
inc ebx
cmp ebx, 0x3e8
jl 0x1400019f0
mov ebx, edi
nop
mov edx, ebx
lea rcx, [0x1400045e0]
call fcn.140001010
inc ebx
cmp ebx, 0x1f4
jl 0x140001a10
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140001a68
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002070
mov eax, edi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140002050
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140002a30
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002a7a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002a7a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002a7a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002a7a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002a7a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002a7c
xor al, al
add rsp, 0x28
ret
Function at 0x140001b70
Capabilities:
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor ebx, ebx
lea rcx, str.c:windows_system32_ntdll.dll
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x20], ebx
xor edx, edx
mov r8d, 0x1000002
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea edx, [rbx + 4]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r9, rax
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rcx + rax + 0x88]
add rdx, rax
mov r11d, dword [rdx + 0x1c]
mov r8d, dword [rdx + 0x20]
add r11, rax
mov edi, dword [rdx + 0x24]
add r8, rax
mov r10d, dword [rdx + 0x18]
add rdi, rax
test r10d, r10d
je 0x140001ced
nop
mov eax, dword [r8]
mov ecx, 0x562aded
add rax, r9
movsx edx, byte [rax]
inc rax
test edx, edx
je 0x140001c59
nop word [rax + rax]
imul ecx, ecx, 0x21
lea rax, [rax + 1]
add ecx, edx
movsx edx, byte [rax - 1]
test edx, edx
jne 0x140001c40
cmp ecx, 0x59a4ea4a
je 0x140001c69
inc ebx
add r8, 4
cmp ebx, r10d
jb 0x140001c20
jmp 0x140001ced
mov eax, ebx
movzx ecx, word [rdi + rax*2]
mov ebx, dword [r11 + rcx*4]
add rbx, r9
je 0x140001ced
lea rdx, str.c:windows_system32_ntdll.dll
lea rcx, [rsp + 0x40]
call fcn.1400020a0
mov rcx, rax
call fcn.140001350
test rax, rax
je 0x140001ced
mov edx, 0x59a4ea4a
mov rcx, rax
call fcn.140001aa0
mov rdi, rax
mov rcx, qword [rax]
cmp rcx, qword [rbx]
jne 0x140001cb8
mov rcx, qword [rax + 8]
cmp rcx, qword [rbx + 8]
je 0x140001ced
mov edx, 0x10
lea r9, [rsp + 0x60]
mov rcx, rdi
lea r8d, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movups xmm0, xmmword [rbx]
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x68]
mov edx, 0x10
mov rcx, rdi
movups xmmword [rdi], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400021d0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140002b64
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002bae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002bae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002bae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002bae
cmp dword [rcx + 0x84], 0xe
jbe 0x140002bae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002bb0
xor al, al
add rsp, 0x28
ret
Function at 0x140004510
Capabilities:
Check if file exists
Delete directory
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x140060010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r14, rdx
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memset
or rbx, 0xffffffffffffffff
xor r15d, r15d
mov rdi, rbx
test rbp, rbp
je 0x14000469b
mov rax, rbx
inc rax
cmp word [rbp + rax*2], r15w
jne 0x140004563
test rax, rax
je 0x14000469b
lea r8, [0x14004374c]
mov rcx, rbp
call fcn.140004310
mov rsi, rax
test rax, rax
jne 0x14000459c
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14000468b
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, rbx
je 0x140004677
test byte [rsp + 0x20], 0x10
je 0x1400045ed
lea rdx, [0x140043750]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140004661
lea rdx, [0x140043754]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140004661
lea r8, [rsp + 0x4c]
mov rcx, rbp
call fcn.140004310
mov rbx, rax
test rax, rax
je 0x140004661
test byte [rsp + 0x20], 0x10
mov rcx, rax
je 0x14000463c
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004623
and eax, 0x410
cmp eax, 0x410
je 0x140004631
xor r8d, r8d
mov rdx, r14
mov rcx, rbx
call fcn.140004510
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14000464d
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rax, r14
call qword [case.0x140018f01.0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400045b6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
jmp 0x1400046a8
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140037640
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x280
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400046d0
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
test rcx, rcx
jne 0x1400046f1
lea ecx, [rbx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14000473b
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140004702
mov eax, 1
jmp 0x14000473b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000471b
mov ecx, 0x410
and eax, ecx
cmp eax, ecx
je 0x14000472a
lea rdx, [0x140004420]
mov rcx, rbx
call fcn.140004510
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne dil
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140004e38
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140060010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rdx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
lea rsi, [0x140069c08]
mov eax, dword [rdx + rcx]
cmp dword [0x140069be0], eax
jle 0x140004ebb
lea rcx, [0x140069be0]
call fcn.140037ac8
cmp dword [0x140069be0], 0xffffffff
jne 0x140004ebb
mov rcx, rsi
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CFileName::constructor_void____ptr64]
lea rcx, [0x14003beb0]
call fcn.1400378e8
nop
lea rcx, [0x140069be0]
call fcn.140037a68
mov rcx, rsi
call qword [sym.imp.Cmmlib.dll_public:_bool___cdecl_Cmm::CStringT_wchar_t_::empty_void_const___ptr64]
test al, al
je 0x140004f7c
lea rdx, [rsp + 0x28]
call fcn.140005174
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CFileName____ptr64___cdecl_Cmm::CFileName::operator_class_Cmm::CFileName____ptr64____ptr64]
lea rcx, [rsp + 0x28]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CFileName::destructor_void____ptr64]
call fcn.140005990
test al, al
je 0x140004f46
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.140005a90
nop
mov rdx, rax
mov rcx, rsi
call qword [reloc.Cmmlib.dll___4__CStringT__W_Cmm__QEAAAEAV01_AEBV01__Z]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov rcx, rsi
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140004f46
mov rcx, rsi
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, str.webview2_
mov rcx, rsi
call qword [reloc.Cmmlib.dll___Y__CStringT__W_Cmm__QEAAAEAV01_PEB_W_Z]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140004d84
nop
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t__const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CFileName::constructor_class_Cmm::CFileName_const____ptr64____ptr64]
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140037640
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140004fac
Capabilities:
Copy file
Get file attributes
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x7b0]
sub rsp, 0x8b0
mov rax, qword [0x140060010]
xor rax, rsp
mov qword [rbp + 0x7a0], rax
xor r14d, r14d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x140005144
test rdx, rdx
je 0x140005144
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14000500a
mov eax, 1
jmp 0x140005146
mov r15d, 0x412
lea rcx, [rsp + 0x60]
mov r8d, r15d
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8d, r15d
lea rcx, [rbp + 0x380]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
lea rcx, [rsp + 0x60]
mov edx, 0x208
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
or rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp word [rdi + rax*2], r14w
jne 0x14000504a
movsxd rcx, eax
lea rax, [rcx + rcx]
cmp rax, r15
jae 0x14000516c
lea rcx, [rcx*2 + 2]
mov word [rsp + rax + 0x60], r14w
cmp rcx, r15
jae 0x14000516c
mov word [rsp + rcx + 0x60], r14w
mov r8, rbx
lea rcx, [rbp + 0x380]
mov edx, 0x208
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
inc rsi
cmp word [rbx + rsi*2], r14w
jne 0x140005096
movsxd rax, esi
lea rcx, [rax + rax]
cmp rcx, r15
jae 0x14000516c
lea rax, [rax*2 + 2]
mov word [rbp + rcx + 0x380], r14w
cmp rax, r15
jae 0x14000516c
mov word [rbp + rax + 0x380], r14w
lea rcx, [rsp + 0x20]
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x60]
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x380]
mov qword [rsp + 0x38], rax
mov eax, 0x414
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], 2
movups xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [rsp + 0x44], r14d
jne 0x140005144
test eax, eax
jne 0x140005144
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x140005144
mov rcx, rdi
call fcn.1400046d0
jmp 0x140005000
xor eax, eax
mov rcx, qword [rbp + 0x7a0]
xor rcx, rsp
call fcn.140037640
mov rbx, qword [rsp + 0x8f0]
add rsp, 0x8b0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140037ce4
int3
Function at 0x140005380
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140060010]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov rdx, rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_class_Cmm::CStringT_wchar_t__const____ptr64____ptr64]
nop
lea rdx, [0x1400439c0]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_Cmm::CStringT_wchar_t_::append_wchar_t_const____ptr64____ptr64]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400054b3
test byte [rsp + 0x70], 0x10
je 0x140005493
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x20]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rdx, [0x140043750]
lea rcx, [rsp + 0x20]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::Compare_wchar_t_const____ptr64_const___ptr64]
test eax, eax
je 0x140005488
lea rdx, [0x140043754]
lea rcx, [rsp + 0x20]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::Compare_wchar_t_const____ptr64_const___ptr64]
test eax, eax
je 0x140005488
mov rbx, qword [rdi + 8]
cmp rbx, qword [rdi + 0x10]
je 0x140005477
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_class_Cmm::CStringT_wchar_t__const____ptr64____ptr64]
lea rax, vtable.Cmm::CStringT_wchar_t_.0
mov qword [rbx], rax
add qword [rdi + 8], 0x28
jmp 0x140005488
lea r8, [rsp + 0x20]
mov rdx, rbx
mov rcx, rdi
call fcn.14000693c
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140005407
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140037640
mov rbx, qword [rsp + 0x300]
add rsp, 0x2d0
pop rdi
pop rsi
pop rbp
ret