joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141dad8d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
mov r14, qword [rcx + 0x28]
test r8, r8
js 0x141dad9d7
xor ebx, ebx
test r8, r8
je 0x141dad9ce
cmp qword [rcx + 0xa8], rbx
je 0x141dad954
mov r8, rdi
sub r8, rbx
lea rcx, [rbx + rbp]
mov r9, qword [rsi + 0xa8]
mov edx, 1
call fcn.141ed189c
add rbx, rax
test rax, rax
jne 0x141dad946
call fcn.141ed0e2c
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x141dad94e
xor ecx, ecx
cmp rbx, rdi
setl cl
test ecx, ecx
jne 0x141dad914
jmp 0x141dad990
cmp dword [rcx + 0xd0], 0xffffffff
je 0x141dad995
nop dword [rax]
mov rax, rdi
sub rax, rbx
mov r8d, 0x7fffffff
cmp rax, r8
cmovb r8d, eax
lea rdx, [rbx + rbp]
mov ecx, dword [rsi + 0xd0]
call fcn.141ed2ea4
test eax, eax
jle 0x141dad990
cdqe
add rbx, rax
cmp rbx, rdi
jl 0x141dad960
test rbx, rbx
jne 0x141dad9ce
mov rbx, 0xffffffffffffffff
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.141d8c460
mov rdi, rax
call fcn.141ed0e2c
mov edx, 2
mov ecx, 4
cmp dword [rax], 0x1c
cmove edx, ecx
mov r8, rdi
mov rcx, r14
call fcn.141daa810
nop
jmp 0x141dad9ff
and dword [rsi + 0x70], 0xffdfffff
jmp 0x141dada1e
mov edx, 0x16
lea rcx, [rsp + 0x20]
call fcn.141d8c460
nop
mov r8, rax
mov edx, 2
mov rcx, r14
call fcn.141daa810
nop
mov rbx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x141dada1e
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141dada1e
mov rcx, qword [rsp + 0x20]
call fcn.141ec82c8
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x141dafba0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x50
mov r14, r8
mov rax, rdx
mov rdi, rcx
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.141dab300
nop
mov rcx, rax
call fcn.141d45210
mov rbx, rax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.141dab300
nop
mov rcx, rax
call fcn.141d45210
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test eax, eax
setne dil
mov ebx, 0xffffffff
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x141dafc2c
mov ecx, ebx
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x141dafc2c
mov rcx, qword [rsp + 0x20]
call fcn.141ec82c8
nop
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x141dafc49
lock xadd dword [rax], ebx
cmp ebx, 1
jne 0x141dafc49
mov rcx, qword [rsp + 0x38]
call fcn.141ec82c8
test esi, esi
jne 0x141dafc67
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x7c], 2
mov rcx, qword [rsp + 0x78]
mov qword [r14], rcx
movzx eax, dil
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x141dafc90
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x141f1bb40]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rbx, r8
movzx r15d, dl
lea rdx, [rsp + 0x20]
call fcn.141daaaa0
nop
mov edi, 0xffffffff
cmp qword [rsp + 0x30], 0
jne 0x141dafd24
mov qword [rsp + 0x38], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
lea rax, [0x1400f0a68]
mov qword [rsp + 0x50], rax
lea rdx, [0x140079e28]
lea rcx, [rsp + 0x38]
call fcn.141d4a260
call fcn.141ed0e2c
mov dword [rax], 0x16
xor bl, bl
jmp 0x141dafecd
xor esi, esi
mov r9d, 1
xor r8d, r8d
movzx edx, si
lea rcx, [rsp + 0x20]
call fcn.141d3f010
cmp rax, 0xffffffffffffffff
je 0x141dafd83
mov qword [rsp + 0x38], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
lea rax, [0x1400f0a68]
mov qword [rsp + 0x50], rax
lea rdx, [0x140079e50]
lea rcx, [rsp + 0x38]
call fcn.141d4a260
call fcn.141ed0e2c
mov dword [rax], 0x16
xor bl, bl
jmp 0x141dafecd
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.141d514f0
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.141d54f30
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov qword [rax], rdx
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x28], rcx
mov qword [rax + 8], rdx
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x10], rdx
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x141dafdf4
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141dafdf4
mov rcx, qword [rsp + 0x58]
call fcn.141ec82c8
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x141dafe13
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141dafe13
mov rcx, qword [rsp + 0x38]
call fcn.141ec82c8
mov r8b, 1
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.141daef50
cmp byte [rsp + 0x70], 0
jne 0x141dafe31
xor bl, bl
jmp 0x141dafecd
lea r14, [rsp + 0x78]
cmp byte [rsp + 0x71], 0
cmovne r14, rsi
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.141db9d70
nop
lea rcx, [rsp + 0x58]
call fcn.141d45210
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x141dafe8e
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x141dafe8e
mov rcx, qword [rsp + 0x58]
call fcn.141ec82c8
test esi, esi
je 0x141dafe96
mov bl, 1
jmp 0x141dafecd
test r15b, r15b
jne 0x141dafe9f
xor bl, bl
jmp 0x141dafecd
cmp ebx, 0xb7
je 0x141dafebe
cmp ebx, 5
je 0x141dafebe
xor r8d, r8d
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.141daff20
jmp 0x141dafeca
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.141db25e0
movzx ebx, al
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x141dafeea
lock xadd dword [rax], edi
cmp edi, 1
jne 0x141dafeea
mov rcx, qword [rsp + 0x20]
call fcn.141ec82c8
movzx eax, bl
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.141ec2250
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x141daff20
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
movzx esi, r8b
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x20], 2
lea rax, [0x140079860]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, 1
lea rdx, [rsp + 0x20]
call fcn.141d43a40
mov r14d, 0x5c
test al, al
je 0x141daff92
mov r8d, 1
movzx edx, r14w
mov rcx, rbx
call fcn.141d3c6e0
cmp rax, 3
jle 0x141db00e3
cmp qword [rbx + 0x10], 2
jne 0x141daffa8
mov rax, qword [rbx + 8]
cmp word [rax + 2], 0x3a
je 0x141db00e3
mov rdi, 0xffffffffffffffff
test sil, sil
je 0x141db0004
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.141db9d70
nop
lea rcx, [rsp + 0x20]
call fcn.141d45210
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x141dafff9
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x141dafff9
mov rcx, qword [rsp + 0x20]
call fcn.141ec82c8
test esi, esi
je 0x141db0004
mov al, 1
jmp 0x141db00e5
mov r9d, 1
mov r8, rdi
movzx edx, r14w
mov rcx, rbx
call fcn.141d3f6f0
nop
cmp eax, 1
jl 0x141db00e3
movsxd r8, eax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.141d3f780
nop
mov r8b, 1
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.141daff20
test al, al
je 0x141db00bf
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.141db9d70
nop
lea rcx, [rsp + 0x20]
call fcn.141d45210
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x141db008d
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x141db008d
mov rcx, qword [rsp + 0x20]
call fcn.141ec82c8
test esi, esi
je 0x141db0095
mov bl, 1
jmp 0x141db00c1
mov byte [rsp + 0x98], 0
lea rdx, [rsp + 0x98]
mov rcx, rbx
call fcn.141db25e0
test al, al
je 0x141db00bf
cmp byte [rsp + 0x98], 0
je 0x141db00bf
mov bl, 1
jmp 0x141db00c1
xor bl, bl
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x141db00de
lock xadd dword [rax], edi
cmp edi, 1
jne 0x141db00de
mov rcx, qword [rsp + 0x40]
call fcn.141ec82c8
movzx eax, bl
jmp 0x141db00e5
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x141db0370
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rbx, rcx
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x28]
call fcn.141d37e90
nop
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x141db03ab
mov eax, dword [rax]
cmp eax, 1
jle 0x141db03c0
mov r8d, 1
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.141d40f90
mov rdx, qword [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
cmp eax, 0x104
jbe 0x141db041a
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.141d42f70
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x141db03f6
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x141db040b
mov r8d, 1
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.141d40f90
mov rdx, qword [rsp + 0x30]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
cmp edi, 2
jb 0x141db0463
mov rax, qword [rsp + 0x30]
cmp word [rax + 2], 0x3a
jne 0x141db0463
movzx ecx, word [rax]
call fcn.141d444e0
mov esi, eax
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x141db0446
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x141db045b
mov r8d, 1
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.141d40f90
mov rax, qword [rsp + 0x30]
mov word [rax], si
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.141d42f70
movzx r8d, byte [rsp + 0x50]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.141daa8b0
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x141db04a5
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141db04a5
mov rcx, qword [rsp + 0x28]
call fcn.141ec82c8
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x141db25e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x141f1bb40]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rsi, rdx
mov rax, qword [rcx]
mov qword [rsp + 0x38], rax
mov r8, qword [rcx + 8]
mov qword [rsp + 0x40], r8
mov r9, qword [rcx + 0x10]
mov qword [rsp + 0x48], r9
test rax, rax
je 0x141db263d
lock inc dword [rax]
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov r14d, 0x5c
cmp r9, 2
jne 0x141db265f
cmp word [r8 + 2], 0x3a
jne 0x141db265f
movzx edx, r14w
lea rcx, [rsp + 0x38]
call fcn.141d390e0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.141db9d70
nop
lea rcx, [rsp + 0x58]
call fcn.141d45210
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov edi, 0xffffffff
cmp eax, 0xffffffff
jne 0x141db279c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x141db26a6
cmp eax, 0x20
jne 0x141db279c
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x20], xmm1
movsd xmm0, qword [rsp + 0x68]
movsd qword [rsp + 0x30], xmm0
movq rax, xmm1
test rax, rax
je 0x141db26c9
lock inc dword [rax]
lea rax, [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov r8d, 1
movzx edx, r14w
lea rcx, [rsp + 0x20]
call fcn.141d3d1c0
test al, al
je 0x141db2717
nop dword [rax + rax]
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.141d3bac0
mov r8d, 1
movzx edx, r14w
lea rcx, [rsp + 0x20]
call fcn.141d3d1c0
test al, al
jne 0x141db26f0
mov edx, 0x3a
mov r8d, 1
lea rcx, [rsp + 0x20]
call fcn.141d3d1c0
test al, al
jne 0x141db277d
lea rcx, [rsp + 0x20]
call fcn.141d45210
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x141db277d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x141db2777
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141db2777
mov rcx, qword [rsp + 0x20]
call fcn.141ec82c8
mov ebx, dword [rsp + 0x70]
jmp 0x141db279c
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x141db279c
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141db279c
mov rcx, qword [rsp + 0x20]
call fcn.141ec82c8
test rsi, rsi
je 0x141db27a9
cmp ebx, 0xffffffff
setne al
mov byte [rsi], al
cmp ebx, 0xffffffff
jne 0x141db27b2
xor bl, bl
jmp 0x141db27b8
shr ebx, 4
and bl, 1
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x141db27d8
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141db27d8
mov rcx, qword [rsp + 0x58]
call fcn.141ec82c8
nop
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x141db27f5
lock xadd dword [rax], edi
cmp edi, 1
jne 0x141db27f5
mov rcx, qword [rsp + 0x38]
call fcn.141ec82c8
movzx eax, bl
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.141ec2250
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x141db40f0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
call fcn.141daafb0
test al, al
je 0x141db4152
mov qword [rsp + 0x20], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
lea rax, [0x1400f0a68]
mov qword [rsp + 0x38], rax
lea rdx, [0x140079e28]
lea rcx, [rsp + 0x20]
call fcn.141d4a260
call fcn.141ed0e2c
mov dword [rax], 0x16
xor al, al
jmp 0x141db4247
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.141dab300
nop
xor edi, edi
mov r9d, 1
xor r8d, r8d
movzx edx, di
mov rcx, rax
call fcn.141d3f010
mov rbp, rax
mov ebx, 0xffffffff
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x141db419d
mov ecx, ebx
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x141db419d
mov rcx, qword [rsp + 0x20]
call fcn.141ec82c8
cmp rbp, 0xffffffffffffffff
je 0x141db41e1
mov qword [rsp + 0x20], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
lea rax, [0x1400f0a68]
mov qword [rsp + 0x38], rax
lea rdx, [0x140079e50]
lea rcx, [rsp + 0x20]
call fcn.141d4a260
call fcn.141ed0e2c
mov dword [rax], 0x16
xor al, al
jmp 0x141db4247
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.141dab300
nop
mov rcx, rax
call fcn.141d45210
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test eax, eax
setne sil
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x141db4225
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x141db4225
mov rcx, qword [rsp + 0x20]
call fcn.141ec82c8
test edi, edi
jne 0x141db4243
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], 2
mov rcx, qword [rsp + 0x70]
mov qword [r14], rcx
movzx eax, sil
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x141db4260
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, r8
mov rsi, rdx
mov r14, rcx
call fcn.141daafb0
test al, al
je 0x141db42c8
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x1400f0a68]
mov qword [rbp - 0x10], rax
lea rdx, [0x140079e28]
lea rcx, [rbp - 0x28]
call fcn.141d4a260
call fcn.141ed0e2c
mov dword [rax], 0x16
xor al, al
jmp 0x141db4448
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.141dab300
nop
xor ebx, ebx
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.141d3f010
mov r15, rax
mov edi, 0xffffffff
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x141db4310
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x141db4310
mov rcx, qword [rbp - 0x40]
call fcn.141ec82c8
cmp r15, 0xffffffffffffffff
je 0x141db4353
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x1400f0a68]
mov qword [rbp - 0x10], rax
lea rdx, [0x140079e50]
lea rcx, [rbp - 0x28]
call fcn.141d4a260
call fcn.141ed0e2c
mov dword [rax], 0x16
xor al, al
jmp 0x141db4448
mov rcx, rsi
call fcn.141daafb0
test al, al
jne 0x141db428b
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.141dab300
nop
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.141d3f010
mov r15, rax
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x141db43a4
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x141db43a4
mov rcx, qword [rbp - 0x40]
call fcn.141ec82c8
cmp r15, 0xffffffffffffffff
jne 0x141db4316
lea rdx, [rbp - 0x28]
mov rcx, rsi
call fcn.141dab300
nop
mov rcx, rax
call fcn.141d45210
mov rbx, rax
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.141dab300
nop
mov rcx, rax
call fcn.141d45210
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov ebx, eax
test eax, eax
setne sil
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x141db440d
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x141db440d
mov rcx, qword [rbp - 0x40]
call fcn.141ec82c8
nop
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x141db4428
lock xadd dword [rax], edi
cmp edi, 1
jne 0x141db4428
mov rcx, qword [rbp - 0x28]
call fcn.141ec82c8
test ebx, ebx
jne 0x141db4444
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x4c], 2
mov rcx, qword [rbp + 0x48]
mov qword [r12], rcx
movzx eax, sil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x141db4470
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, r8
mov rsi, rdx
mov r14, rcx
call fcn.141daafb0
test al, al
je 0x141db44d8
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x1400f0a68]
mov qword [rbp - 0x10], rax
lea rdx, [0x140079e28]
lea rcx, [rbp - 0x28]
call fcn.141d4a260
call fcn.141ed0e2c
mov dword [rax], 0x16
xor al, al
jmp 0x141db465e
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.141dab300
nop
xor ebx, ebx
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.141d3f010
mov r15, rax
mov edi, 0xffffffff
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x141db4520
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x141db4520
mov rcx, qword [rbp - 0x40]
call fcn.141ec82c8
cmp r15, 0xffffffffffffffff
je 0x141db4563
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
lea rax, [0x1400f0a68]
mov qword [rbp - 0x10], rax
lea rdx, [0x140079e50]
lea rcx, [rbp - 0x28]
call fcn.141d4a260
call fcn.141ed0e2c
mov dword [rax], 0x16
xor al, al
jmp 0x141db465e
mov rcx, rsi
call fcn.141daafb0
test al, al
jne 0x141db449b
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.141dab300
nop
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.141d3f010
mov r15, rax
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x141db45b4
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x141db45b4
mov rcx, qword [rbp - 0x40]
call fcn.141ec82c8
cmp r15, 0xffffffffffffffff
jne 0x141db4526
lea rdx, [rbp - 0x28]
mov rcx, rsi
call fcn.141dab300
nop
mov rcx, rax
call fcn.141d45210
mov rbx, rax
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.141dab300
nop
mov rcx, rax
call fcn.141d45210
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
test eax, eax
setne sil
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x141db4623
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x141db4623
mov rcx, qword [rbp - 0x40]
call fcn.141ec82c8
nop
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x141db463e
lock xadd dword [rax], edi
cmp edi, 1
jne 0x141db463e
mov rcx, qword [rbp - 0x28]
call fcn.141ec82c8
test ebx, ebx
jne 0x141db465a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x4c], 2
mov rcx, qword [rbp + 0x48]
mov qword [r12], rcx
movzx eax, sil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x141db4ef0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rbp, rdx
mov r14, rcx
xor sil, sil
xor edi, edi
call fcn.141daaee0
test al, al
je 0x141db4f92
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.141daaaa0
mov rcx, qword [rax + 8]
movzx ecx, word [rcx]
call fcn.141d444e0
lea ecx, [rax - 0x41]
mov ebx, 1
shl ebx, cl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x141db4f80
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141db4f80
mov rcx, qword [rsp + 0x30]
call fcn.141ec82c8
and ebx, edi
setne sil
neg ebx
sbb edi, edi
and edi, 0x14
jmp 0x141db505f
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.141dab300
nop
mov qword [rsp + 0x20], 7
lea rax, [0x140079eb0]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov ebx, 1
mov r8d, ebx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.141d43a40
test al, al
je 0x141db503d
mov rdx, qword [rsp + 0x38]
mov r9d, ebx
mov r8d, 7
movzx edx, word [rdx]
lea rcx, [rsp + 0x30]
call fcn.141d3f010
test eax, eax
jle 0x141db5027
mov rdx, qword [rsp + 0x38]
inc eax
movsxd r8, eax
mov r9d, ebx
movzx edx, word [rdx]
lea rcx, [rsp + 0x30]
call fcn.141d3f010
test eax, eax
jle 0x141db5027
mov rcx, qword [rsp + 0x40]
dec rcx
cdqe
cmp rax, rcx
jne 0x141db503d
lea rcx, [rsp + 0x30]
call fcn.141db54a0
test al, al
je 0x141db503d
mov edi, 0x10
movzx esi, bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x141db505f
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141db505f
mov rcx, qword [rsp + 0x30]
call fcn.141ec82c8
test sil, sil
je 0x141db5089
mov dword [rbp + 0x10], edi
test dil, 0x10
mov ecx, 0x20000
mov eax, 0x40000
cmovne ecx, eax
or ecx, dword [rbp + 4]
bts ecx, 0x16
mov dword [rbp + 4], ecx
or dword [rbp], 0x560000
movzx eax, sil
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret