joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14018bc70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
and dword [rbx + 0x40], 0xfdffffff
cmp dword [rbx + 0xa4], 2
je 0x14018bca9
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0xa4], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140195f90
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x18]
cmp qword [rcx + 0x78], 0
jne 0x14019608d
cmp dword [rcx + 0xa0], 0xffffffff
jne 0x14019608d
cmp qword [rcx + 0x80], 0xffffffffffffffff
je 0x140196084
mov rdi, r8
xor r12d, r12d
mov ebx, r12d
mov r8d, 0x2000000
cmp rdi, r8
cmovl r8d, edi
lea rdx, [rbx + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140196026
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x140196021
add rbx, rax
sub rdi, rax
cmp rbx, rbp
jl 0x140195fe2
mov rax, rbx
jmp 0x140196092
test rbx, rbx
jne 0x140196021
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140164c60
nop
mov r8, rax
mov edx, 2
mov rcx, r15
call fcn.1401895e0
nop
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax]
test ecx, ecx
je 0x14019606f
cmp ecx, 0xffffffff
je 0x140196084
mov rax, qword [rsp + 0x30]
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140196084
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.1400affb0
mov rax, 0xffffffffffffffff
jmp 0x140196092
call fcn.14018bcd0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14018d5d0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rax, rdx
mov rdi, rcx
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.140189eb0
nop
mov rcx, rax
call fcn.1400c02d0
mov rbx, rax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140189eb0
nop
mov rcx, rax
call fcn.1400c02d0
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test eax, eax
setne dil
mov rcx, qword [rsp + 0x20]
mov edx, dword [rcx]
mov ebx, 0xffffffff
test edx, edx
je 0x14018d65b
cmp edx, ebx
je 0x14018d671
mov rax, qword [rsp + 0x20]
mov ecx, ebx
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x14018d671
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1400affb0
nop
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax]
test ecx, ecx
je 0x14018d68f
cmp ecx, 0xffffffff
je 0x14018d6a4
mov rax, qword [rsp + 0x28]
lock xadd dword [rax], ebx
cmp ebx, 1
jne 0x14018d6a4
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x28]
call fcn.1400affb0
test esi, esi
jne 0x14018d6c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], 2
mov rcx, qword [rsp + 0x58]
mov qword [r14], rcx
movzx eax, dil
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x14018d6e0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
movzx r14d, dl
lea rdx, [rbp + 0x38]
call fcn.1401897e0
nop
mov edi, 0xffffffff
mov rax, qword [rbp + 0x38]
cmp dword [rax + 4], 0
jne 0x14018d71b
lea rdx, str.Empty_filename_passed_to_function
jmp 0x14018d73d
xor ebx, ebx
mov r9d, 1
xor r8d, r8d
movzx edx, bx
lea rcx, [rbp + 0x38]
call fcn.1400ba9a0
cmp eax, edi
je 0x14018d773
lea rdx, str.Broken_filename_passed_to_function
xorps xmm0, xmm0
lea rax, [0x140265bd0]
mov qword [rbp - 0x20], 2
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x20]
call fcn.1400afb60
call fcn.14023ffb8
mov dword [rax], 0x16
xor bl, bl
jmp 0x14018d88e
lea rdx, [rbp + 0x38]
lea rcx, [rbp - 0x28]
call fcn.14012b3b0
nop
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.14012ccc0
mov rdx, qword [rbp + 0x38]
mov rcx, qword [rax]
mov qword [rbp + 0x38], rcx
mov qword [rax], rdx
mov rax, qword [rbp - 0x30]
mov ecx, dword [rax]
test ecx, ecx
je 0x14018d7b9
cmp ecx, 0xffffffff
je 0x14018d7ce
mov rax, qword [rbp - 0x30]
mov ecx, edi
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x14018d7ce
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x30]
call fcn.1400affb0
nop
mov rax, qword [rbp - 0x28]
mov ecx, dword [rax]
test ecx, ecx
je 0x14018d7ec
cmp ecx, 0xffffffff
je 0x14018d800
mov rax, qword [rbp - 0x28]
mov ecx, edi
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x14018d800
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x28]
call fcn.1400affb0
lea rdx, [rbp + 0x38]
lea rcx, [rbp - 0x30]
call fcn.140195280
nop
lea rcx, [rbp - 0x30]
call fcn.1400c02d0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rbp - 0x30]
mov edx, dword [rcx]
test edx, edx
je 0x14018d84a
cmp edx, 0xffffffff
je 0x14018d85e
mov rcx, qword [rbp - 0x30]
mov edx, edi
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x14018d85e
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x30]
call fcn.1400affb0
test esi, esi
je 0x14018d866
mov bl, 1
jmp 0x14018d88e
test r14b, r14b
jne 0x14018d86f
xor bl, bl
jmp 0x14018d88e
lea rcx, [rbp + 0x38]
cmp ebx, 0xb7
jne 0x14018d884
xor edx, edx
call fcn.1401901b0
jmp 0x14018d88b
xor edx, edx
call fcn.14018d8e0
movzx ebx, al
mov rcx, qword [rbp + 0x38]
mov eax, dword [rcx]
test eax, eax
je 0x14018d8aa
cmp eax, 0xffffffff
je 0x14018d8be
mov rcx, qword [rbp + 0x38]
lock xadd dword [rcx], edi
cmp edi, 1
jne 0x14018d8be
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp + 0x38]
call fcn.1400affb0
movzx eax, bl
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
Function at 0x14018d8e0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
movzx esi, dl
mov rdi, rcx
mov dword [rsp + 0x20], 2
lea rax, [0x1402e8784]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, 1
lea rdx, [rsp + 0x30]
call fcn.1400be7a0
test al, al
je 0x14018d94c
lea rcx, [rsp + 0x60]
call fcn.14012ca50
mov r8d, 1
movzx edx, word [rax]
mov rcx, rdi
call fcn.1400b9610
cmp eax, 3
jle 0x14018daf9
mov rcx, qword [rdi]
cmp dword [rcx + 4], 2
jne 0x14018d965
mov rax, qword [rcx + 0x10]
cmp word [rax + rcx + 2], 0x3a
je 0x14018daf9
mov ebx, 0xffffffff
test sil, sil
je 0x14018d9de
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140195280
nop
lea rcx, [rsp + 0x68]
call fcn.1400c02d0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rcx, qword [rsp + 0x68]
mov edx, dword [rcx]
test edx, edx
je 0x14018d9b3
cmp edx, ebx
je 0x14018d9c8
mov rcx, qword [rsp + 0x68]
mov edx, ebx
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x14018d9c8
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x68]
call fcn.1400affb0
test esi, esi
je 0x14018d9de
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea rcx, [rsp + 0x60]
call fcn.14012ca50
mov r9d, 1
mov r8d, ebx
movzx edx, word [rax]
mov rcx, rdi
call fcn.1400bb000
cmp eax, 1
jl 0x14018daf9
mov r8d, eax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400bb220
nop
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.14018d8e0
test al, al
je 0x14018daaf
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140195280
nop
lea rcx, [rsp + 0x68]
call fcn.1400c02d0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rcx, qword [rsp + 0x68]
mov edx, dword [rcx]
test edx, edx
je 0x14018da6f
cmp edx, 0xffffffff
je 0x14018da84
mov rcx, qword [rsp + 0x68]
mov edx, ebx
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x14018da84
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x68]
call fcn.1400affb0
test esi, esi
je 0x14018da8d
mov dil, 1
jmp 0x14018dab2
mov byte [rsp + 0x60], 0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1401901b0
test al, al
je 0x14018daaf
cmp byte [rsp + 0x60], 0
je 0x14018daaf
mov dil, 1
jmp 0x14018dab2
xor dil, dil
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax]
test ecx, ecx
je 0x14018dad0
cmp ecx, 0xffffffff
je 0x14018dae5
mov rcx, qword [rsp + 0x20]
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x14018dae5
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1400affb0
movzx eax, dil
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1401901b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2a0
mov rax, qword [0x140492fc0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rdx
mov r8, qword [rcx]
mov qword [rsp + 0x20], r8
mov eax, dword [r8]
inc eax
cmp eax, 1
jbe 0x1401901e8
lock inc dword [r8]
mov rax, qword [rsp + 0x20]
cmp dword [rax + 4], 2
jne 0x140190269
mov rcx, qword [rax + 0x10]
cmp word [rcx + rax + 2], 0x3a
jne 0x140190269
mov ecx, dword [rax]
mov rax, qword [rsp + 0x20]
cmp ecx, 1
ja 0x14019021c
mov edx, dword [rax + 8]
btr edx, 0x1f
mov ecx, dword [rax + 4]
add ecx, 2
cmp ecx, edx
jbe 0x140190234
mov edx, dword [rax + 4]
add edx, 2
mov r8b, 1
lea rcx, [rsp + 0x20]
call fcn.1400bcbb0
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 0x10]
add rdx, rax
movsxd rcx, dword [rax + 4]
add rcx, rcx
mov word [rdx + rcx], 0x5c
mov rax, qword [rsp + 0x20]
inc dword [rax + 4]
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 0x10]
add rdx, rax
movsxd rcx, dword [rax + 4]
add rcx, rcx
xor eax, eax
mov word [rdx + rcx], ax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.140195280
nop
lea rcx, [rsp + 0x28]
call fcn.1400c02d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1401902d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1401902a3
cmp eax, 0x20
jne 0x1401902d4
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rax]
inc ecx
cmp ecx, 1
jbe 0x1401902be
mov rax, qword [rsp + 0x28]
lock inc dword [rax]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14018f000
test al, al
cmovne ebx, dword [rsp + 0x40]
test rdi, rdi
je 0x1401902e1
cmp ebx, 0xffffffff
setne al
mov byte [rdi], al
cmp ebx, 0xffffffff
jne 0x1401902ea
xor bl, bl
jmp 0x1401902f0
shr ebx, 4
and bl, 1
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax]
mov edi, 0xffffffff
test ecx, ecx
je 0x140190314
cmp ecx, edi
je 0x14019032a
mov rax, qword [rsp + 0x28]
mov ecx, edi
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x14019032a
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x28]
call fcn.1400affb0
nop
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax]
test ecx, ecx
je 0x140190348
cmp ecx, 0xffffffff
je 0x14019035d
mov rax, qword [rsp + 0x20]
lock xadd dword [rax], edi
cmp edi, 1
jne 0x14019035d
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.1400affb0
movzx eax, bl
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140229fa0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x2a0
pop rdi
ret
Function at 0x1401909c0
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [0x140492fc0]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x38], 0
lea r15, [0x140484d90]
mov qword [rcx], r15
mov dword [rsp + 0x38], 1
xor r14b, r14b
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1403dd980]
xor edx, edx
mov r8d, 1
lea rcx, [0x1403dda10]
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, 0x800401f0
jne 0x140190a72
mov r14b, 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1403dd980]
xor edx, edx
mov r8d, 1
lea rcx, [0x1403dda10]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140190bcf
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
lea rdx, [0x1403dda00]
call qword [rax]
test eax, eax
js 0x140190bc4
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax]
mov rbx, qword [rdx + 0x28]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140189eb0
nop
mov rcx, rax
call fcn.1400c02d0
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call rbx
mov ebx, eax
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax]
mov edi, 0xffffffff
test ecx, ecx
je 0x140190aed
cmp ecx, edi
je 0x140190b02
mov rax, qword [rsp + 0x30]
mov ecx, edi
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140190b02
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.1400affb0
test ebx, ebx
js 0x140190bb9
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 2
lea r9, [rsp + 0x60]
mov r8d, 0x104
lea rdx, [rbp + 0x1b0]
call qword [rax + 0x18]
test eax, eax
jne 0x140190bb9
mov r8d, edi
lea rdx, [rbp + 0x1b0]
lea rcx, [rsp + 0x30]
call fcn.1400ba830
nop
mov rbx, qword [rax]
mov qword [rax], r15
mov dword [rsp + 0x38], 9
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax]
test ecx, ecx
je 0x140190b7a
cmp ecx, 0xffffffff
je 0x140190b8f
mov rax, qword [rsp + 0x30]
mov ecx, edi
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x140190b8f
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.1400affb0
mov rcx, qword [rsi]
mov qword [rsi], rbx
mov eax, dword [rcx]
test eax, eax
je 0x140190ba9
cmp eax, 0xffffffff
je 0x140190bb9
lock xadd dword [rcx], edi
cmp edi, 1
jne 0x140190bb9
mov edx, 2
mov r8d, 8
call fcn.1400affb0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx]
call qword [rdx + select]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
call qword [rdx + select]
test r14b, r14b
je 0x140190bda
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, rsi
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.140229fa0
mov rbx, qword [rsp + 0x510]
add rsp, 0x4d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140191700
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov rax, qword [rcx]
cmp dword [rax + 4], 0
jne 0x14019176c
mov rax, qword [rcx + 8]
cmp dword [rax + 4], 0
jne 0x14019176c
mov qword [rsp + 0x20], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
lea rax, [0x140265bd0]
mov qword [rsp + 0x38], rax
lea rdx, str.Empty_filename_passed_to_function
lea rcx, [rsp + 0x20]
call fcn.1400afb60
call fcn.14023ffb8
mov dword [rax], 0x16
xor al, al
jmp 0x140191886
lea rdx, [rsp + 0x70]
call fcn.140189eb0
nop
xor esi, esi
mov r9d, 1
xor r8d, r8d
movzx edx, si
mov rcx, rax
call fcn.1400ba9a0
mov ebp, eax
mov rcx, qword [rsp + 0x70]
mov edx, dword [rcx]
mov ebx, 0xffffffff
test edx, edx
je 0x1401917b3
cmp edx, ebx
je 0x1401917c8
mov rcx, qword [rsp + 0x70]
mov edx, ebx
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x1401917c8
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x70]
call fcn.1400affb0
cmp ebp, ebx
je 0x14019180a
mov qword [rsp + 0x20], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
lea rax, [0x140265bd0]
mov qword [rsp + 0x38], rax
lea rdx, str.Broken_filename_passed_to_function
lea rcx, [rsp + 0x20]
call fcn.1400afb60
call fcn.14023ffb8
mov dword [rax], 0x16
xor al, al
jmp 0x140191886
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.140189eb0
nop
mov rcx, rax
call fcn.1400c02d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test eax, eax
setne sil
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx]
test eax, eax
je 0x14019184f
cmp eax, 0xffffffff
je 0x140191864
mov rcx, qword [rsp + 0x70]
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x140191864
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x70]
call fcn.1400affb0
test edi, edi
jne 0x140191882
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], 2
mov rcx, qword [rsp + 0x60]
mov qword [r14], rcx
movzx eax, sil
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1401918a0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r12, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [rcx]
cmp dword [rax + 4], 0
jne 0x140191912
mov rax, qword [rcx + 8]
cmp dword [rax + 4], 0
jne 0x140191912
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x140265bd0]
mov qword [rbp - 0x10], rax
lea rdx, str.Empty_filename_passed_to_function
lea rcx, [rbp - 0x28]
call fcn.1400afb60
call fcn.14023ffb8
mov dword [rax], 0x16
xor al, al
jmp 0x140191ae8
lea rdx, [rbp + 0x48]
call fcn.140189eb0
nop
xor ebx, ebx
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.1400ba9a0
mov r15d, eax
mov rcx, qword [rbp + 0x48]
mov edx, dword [rcx]
mov edi, 0xffffffff
test edx, edx
je 0x140191957
cmp edx, edi
je 0x14019196b
mov rcx, qword [rbp + 0x48]
mov edx, edi
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x14019196b
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp + 0x48]
call fcn.1400affb0
cmp r15d, edi
je 0x1401919ad
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x140265bd0]
mov qword [rbp - 0x10], rax
lea rdx, str.Broken_filename_passed_to_function
lea rcx, [rbp - 0x28]
call fcn.1400afb60
call fcn.14023ffb8
mov dword [rax], 0x16
xor al, al
jmp 0x140191ae8
mov rax, qword [r14]
cmp dword [rax + 4], 0
jne 0x1401919c4
mov rax, qword [r14 + 8]
cmp dword [rax + 4], 0
je 0x1401918d5
lea rdx, [rbp + 0x48]
mov rcx, r14
call fcn.140189eb0
nop
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.1400ba9a0
mov r15d, eax
mov rcx, qword [rbp + 0x48]
mov edx, dword [rcx]
test edx, edx
je 0x140191a06
cmp edx, 0xffffffff
je 0x140191a1a
mov rcx, qword [rbp + 0x48]
mov edx, edi
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x140191a1a
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp + 0x48]
call fcn.1400affb0
cmp r15d, 0xffffffff
jne 0x140191970
lea rdx, [rbp - 0x30]
mov rcx, r14
call fcn.140189eb0
nop
mov rcx, rax
call fcn.1400c02d0
mov rbx, rax
lea rdx, [rbp + 0x48]
mov rcx, rsi
call fcn.140189eb0
nop
mov rcx, rax
call fcn.1400c02d0
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov ebx, eax
test eax, eax
setne sil
mov rcx, qword [rbp + 0x48]
mov edx, dword [rcx]
test edx, edx
je 0x140191a83
cmp edx, r15d
je 0x140191a98
mov rcx, qword [rbp + 0x48]
mov edx, edi
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x140191a98
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp + 0x48]
call fcn.1400affb0
nop
mov rax, qword [rbp - 0x30]
mov ecx, dword [rax]
test ecx, ecx
je 0x140191ab4
cmp ecx, 0xffffffff
je 0x140191ac8
mov rax, qword [rbp - 0x30]
lock xadd dword [rax], edi
cmp edi, 1
jne 0x140191ac8
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x30]
call fcn.1400affb0
test ebx, ebx
jne 0x140191ae4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x30], eax
mov dword [rbp + 0x34], 2
mov rcx, qword [rbp + 0x30]
mov qword [r12], rcx
movzx eax, sil
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140191b10
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r12, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [rcx]
cmp dword [rax + 4], 0
jne 0x140191b82
mov rax, qword [rcx + 8]
cmp dword [rax + 4], 0
jne 0x140191b82
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x140265bd0]
mov qword [rbp - 0x10], rax
lea rdx, str.Empty_filename_passed_to_function
lea rcx, [rbp - 0x28]
call fcn.1400afb60
call fcn.14023ffb8
mov dword [rax], 0x16
xor al, al
jmp 0x140191d5e
lea rdx, [rbp + 0x48]
call fcn.140189eb0
nop
xor ebx, ebx
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.1400ba9a0
mov r15d, eax
mov rcx, qword [rbp + 0x48]
mov edx, dword [rcx]
mov edi, 0xffffffff
test edx, edx
je 0x140191bc7
cmp edx, edi
je 0x140191bdb
mov rcx, qword [rbp + 0x48]
mov edx, edi
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x140191bdb
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp + 0x48]
call fcn.1400affb0
cmp r15d, edi
je 0x140191c1d
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x140265bd0]
mov qword [rbp - 0x10], rax
lea rdx, str.Broken_filename_passed_to_function
lea rcx, [rbp - 0x28]
call fcn.1400afb60
call fcn.14023ffb8
mov dword [rax], 0x16
xor al, al
jmp 0x140191d5e
mov rax, qword [r14]
cmp dword [rax + 4], 0
jne 0x140191c34
mov rax, qword [r14 + 8]
cmp dword [rax + 4], 0
je 0x140191b45
lea rdx, [rbp + 0x48]
mov rcx, r14
call fcn.140189eb0
nop
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.1400ba9a0
mov r15d, eax
mov rcx, qword [rbp + 0x48]
mov edx, dword [rcx]
test edx, edx
je 0x140191c76
cmp edx, 0xffffffff
je 0x140191c8a
mov rcx, qword [rbp + 0x48]
mov edx, edi
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x140191c8a
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp + 0x48]
call fcn.1400affb0
cmp r15d, 0xffffffff
jne 0x140191be0
lea rdx, [rbp - 0x30]
mov rcx, r14
call fcn.140189eb0
nop
mov rcx, rax
call fcn.1400c02d0
mov rbx, rax
lea rdx, [rbp + 0x48]
mov rcx, rsi
call fcn.140189eb0
nop
mov rcx, rax
call fcn.1400c02d0
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
test eax, eax
setne sil
mov rcx, qword [rbp + 0x48]
mov edx, dword [rcx]
test edx, edx
je 0x140191cf9
cmp edx, r15d
je 0x140191d0e
mov rcx, qword [rbp + 0x48]
mov edx, edi
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x140191d0e
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp + 0x48]
call fcn.1400affb0
nop
mov rax, qword [rbp - 0x30]
mov ecx, dword [rax]
test ecx, ecx
je 0x140191d2a
cmp ecx, 0xffffffff
je 0x140191d3e
mov rax, qword [rbp - 0x30]
lock xadd dword [rax], edi
cmp edi, 1
jne 0x140191d3e
mov edx, 2
mov r8d, 8
mov rcx, qword [rbp - 0x30]
call fcn.1400affb0
test ebx, ebx
jne 0x140191d5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x30], eax
mov dword [rbp + 0x34], 2
mov rcx, qword [rbp + 0x30]
mov qword [r12], rcx
movzx eax, sil
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140191d80
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.140195280
nop
mov rcx, rax
call fcn.1400c02d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx]
test eax, eax
je 0x140191dcd
cmp eax, 0xffffffff
je 0x140191de2
mov rcx, qword [rsp + 0x40]
mov edx, 0xffffffff
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x140191de2
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x40]
call fcn.1400affb0
movzx eax, bl
add rsp, 0x20
pop rbx
ret