joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e4a30
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rbx, [r8 + 0x2c]
mov r12, qword [rcx + 8]
mov rax, qword [rcx + 0x10]
mov r15d, 0x7fff
mov edx, 0x7fff
sub rdx, rax
lea rcx, [r12 + rax*2]
lea r8, [0x14029c682]
mov r9, rbx
call fcn.140016cb0
mov word [r12 + 0xfffe], 0
test eax, eax
js 0x1400e4b2b
movsxd r12, eax
sub r15, qword [rdi + 0x10]
cmp r15, r12
jl 0x1400e4b2b
mov edx, 0x8000
mov rcx, rbx
call fcn.14026e268
cmp rax, r12
jne 0x1400e4b2b
add qword [rdi + 0x10], r12
mov r14d, dword [r14]
test r14d, 0x400
jne 0x1400e4b5c
xor ebp, ebp
test r14b, 0x10
je 0x1400e4b3b
lea rdx, [0x1402c5c32]
mov rcx, rbx
call fcn.14027886c
test eax, eax
je 0x1400e4b02
lea rdx, [0x1402c5c36]
mov rcx, rbx
call fcn.14027886c
mov ebp, 1
test eax, eax
jne 0x1400e4b3b
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140259980
mov rcx, rsi
mov rdx, rdi
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.1400e4880
mov ecx, reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, 3
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140259980
mov eax, ebp
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ebp, 2
cmp byte [rdi + 0x2a], 0
je 0x1400e4b3b
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400e4b3b
mov ebp, 0
test r14b, 0x10
je 0x1400e4b3b
lea rdx, [rsp + 0x44]
mov r14, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1400e4c5f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, dword [rsp + 0x60]
mov ebp, dword [rsp + 0x70]
mov r12d, dword [rsp + 0x74]
mov r15, qword [rsi + 0x20]
test r15, r15
je 0x1400e4c13
mov rax, r15
jmp 0x1400e4bf9
mov rax, qword [rax + 0x10]
test rax, rax
je 0x1400e4c13
cmp dword [rax], r14d
jne 0x1400e4bf0
cmp dword [rax + 4], r12d
jne 0x1400e4bf0
cmp dword [rax + 8], ebp
jne 0x1400e4bf0
mov ebp, 2
jmp 0x1400e4b3b
lea rdx, [0x1402c5c32]
mov rcx, rbx
call fcn.14027886c
test eax, eax
je 0x1400e4c77
lea rdx, [0x1402c5c36]
mov rcx, rbx
call fcn.14027886c
test eax, eax
je 0x1400e4c77
mov ecx, 0x18
call fcn.140259c08
mov dword [rax], r14d
mov dword [rax + 4], r12d
mov dword [rax + 8], ebp
mov qword [rax + 0x10], r15
mov qword [rsi + 0x20], rax
mov ebp, 1
jmp 0x1400e4b3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
jmp 0x1400e4b30
mov rcx, rsi
mov rdx, rdi
call fcn.1400e4880
mov ebp, eax
jmp 0x1400e4b3b
Function at 0x1400e4cf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e4d57
mov ecx, eax
mov eax, 2
test cl, 0x10
je 0x1400e4d6c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
mov eax, 2
cmp rcx, 0xffffffffffffffff
je 0x1400e4d6c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400e4d6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor eax, eax
cmp ecx, 2
sete al
add eax, eax
add rsp, 0x40
pop rsi
ret

Function at 0x1400e4d80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
xor r8d, r8d
call fcn.1400ea480
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e4e01
mov esi, 2
test al, 0x10
je 0x1400e4e15
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400e4e15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
jmp 0x1400e4e15
call qword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xfffffffe
xor esi, esi
cmp eax, 2
sete sil
add esi, esi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400e4e24
call fcn.1402599a8
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140259980
mov eax, esi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x1400e4e40
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
xor edi, edi
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1400e4ef8
lea edi, [rax + 1]
movsxd rcx, eax
cmp eax, 0xffffffff
lea rax, [rcx + rcx + 2]
mov rcx, 0xffffffffffffffff
cmovge rcx, rax
call fcn.1402599b0
mov rsi, rax
mov ecx, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r14, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call r14
movsxd rbx, eax
mov rcx, rbx
call fcn.140023b70
mov rdi, rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call r14
mov rcx, rsi
call fcn.1402599a8
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400e4f10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.1400ea480
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test eax, eax
jne 0x1400e4fb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400e4fb0
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e4faa
test al, 0x10
je 0x1400e4fb0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400e4fb0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x1400e4fb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
setne bl
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400e4fc4
call fcn.1402599a8
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140259980
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400e4fe0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, 0x8000
mov edx, 2
call fcn.140023b10
mov rsi, rax
mov ecx, 0x7fff
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
mov word [rsi + rax*2], 0
mov rcx, rsi
mov rdx, 0xffffffffffffffff
xor r8d, r8d
call fcn.1400ec9b0
mov rdi, rax
mov rcx, rsi
call fcn.140262a24
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400e5040
Capabilities:
Create directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 0x8000
mov edx, 2
call fcn.140023b10
mov r14, rax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x28]
mov rdx, rsi
call fcn.1400ecf10
mov rdi, qword [rsp + 0x28]
lea r8, [0x14029c682]
mov edx, 0x7fff
mov rcx, r14
mov r9, rdi
call fcn.140016cb0
mov word [r14 + 0xfffe], 0
cmp eax, 0x7fff
ja 0x1400e5152
mov ebx, eax
movsxd r14, eax
mov edx, 0x8000
mov rcx, rdi
call fcn.14026e268
cmp rax, r14
jne 0x1400e5152
mov qword [rsp + 0x38], r14
cmp ebx, 0x7ff7
ja 0x1400e515d
mov dword [rsp + 0x24], 0
lea rdx, [rsp + 0x24]
mov ecx, 4
call fcn.1400e09f0
test al, al
je 0x1400e5192
mov r9d, dword [rsp + 0x24]
lea r8, [0x1402c5c2e]
lea rdi, [rsp + 0x47]
mov edx, 9
mov rcx, rdi
call fcn.140025570
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1400e47c0
test al, al
je 0x1400e515d
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400e5192
mov rcx, rdi
mov rdx, 0xffffffffffffffff
xor r8d, r8d
call fcn.1400ec9b0
jmp 0x1400e519a
mov ecx, reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400e516e
call fcn.1402599a8
mov rcx, qword [rsp + 0x30]
call fcn.140262a24
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140259980
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
call fcn.1400e51a0
mov rsi, rax
jmp 0x1400e515f
Function at 0x1400e51a0
Capabilities:
Create directory

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, 0x8000
mov edx, 2
call fcn.140023b10
mov rsi, rax
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1400ecf10
mov rbx, qword [rsp + 0x30]
lea r8, [0x14029c682]
mov edx, 0x7fff
mov rcx, rsi
mov r9, rbx
call fcn.140016cb0
mov word [rsi + 0xfffe], 0
cmp eax, 0x7fff
ja 0x1400e52e0
mov ebp, eax
movsxd rdi, eax
mov edx, 0x8000
mov rcx, rbx
call fcn.14026e268
cmp rax, rdi
jne 0x1400e52e0
cmp ebp, 0x7fdb
ja 0x1400e52eb
lea rcx, [rsp + 0x38]
call qword [sym.imp.RPCRT4.dll_UuidCreateSequential]
cmp eax, 0x720
je 0x1400e524c
test eax, eax
jne 0x1400e52eb
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x28]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x1400e52eb
mov rbx, qword [rsp + 0x28]
lea rcx, [rsi + rdi*2]
xor rdi, 0x7fff
lea r8, [0x14029c682]
mov rdx, rdi
mov r9, rbx
call fcn.140016cb0
mov word [rsi + 0xfffe], 0
test eax, eax
js 0x1400e52e0
movsxd r14, eax
cmp rdi, r14
jl 0x1400e52e0
mov edx, 0x8000
mov rcx, rbx
call fcn.14026e268
cmp rax, r14
jne 0x1400e52e0
lea rcx, [rsp + 0x28]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
xor edi, edi
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400e52ed
mov rcx, rsi
mov rdx, 0xffffffffffffffff
xor r8d, r8d
call fcn.1400ec9b0
mov rdi, rax
jmp 0x1400e52ed
mov ecx, reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400e52fc
call fcn.1402599a8
mov rcx, rsi
call fcn.140262a24
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140259980
mov rax, rdi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400e5320
Capabilities:
Delete directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov ebx, r8d
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
call fcn.1400ea480
test bl, bl
je 0x1400e53ef
mov ecx, 0x8000
mov edx, 2
call fcn.140023b10
mov rsi, rax
mov qword [rsp + 0x28], rax
mov word [rax], 0
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x1400e542d
lea r8, [0x14029c682]
mov edx, 0x7fff
mov rcx, rsi
mov r9, rdi
call fcn.140016cb0
mov word [rsi + 0xfffe], 0
cmp eax, 0x7fff
ja 0x1400e5422
mov ebx, eax
movsxd r14, eax
mov edx, 0x8000
mov rcx, rdi
call fcn.14026e268
cmp rax, r14
jne 0x1400e5422
mov qword [rsp + 0x30], r14
test ebx, ebx
je 0x1400e542d
cmp word [rsi + r14*2 - 2], 0x5c
jne 0x1400e53dc
lea rax, [r14 - 1]
mov qword [rsp + 0x30], rax
mov word [rsi + r14*2 - 2], 0
lea rcx, [rsp + 0x28]
call fcn.1400e5550
mov edi, eax
mov rsi, qword [rsp + 0x28]
jmp 0x1400e542f
mov rcx, qword [rsp + 0x38]
mov dl, 1
call fcn.1400eaeb0
cmp eax, 1
jne 0x1400e5413
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne dil
jmp 0x1400e5437
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x1400e5437
mov ecx, reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov rcx, rsi
call fcn.140262a24
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400e5446
call fcn.1402599a8
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140259980
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400e5460
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, r8
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.1400ea480
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e5515
test al, 0x10
je 0x1400e551b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400e551b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
mov rdx, rsi
xor r8d, r8d
call fcn.1400ea480
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne sil
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400e5528
call fcn.1402599a8
jmp 0x1400e5528
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400e5537
call fcn.1402599a8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140259980
mov eax, esi
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x1400e9fb0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 0x10]
mov ecx, dword [rax]
call fcn.140279090
mov rbx, rax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rcx, rax
mov rdx, rsi
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400ea08e
mov edi, dword [rsp + 0x44]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x1400ea095
mov ecx, dword [rsp + 0x44]
add rcx, rcx
call fcn.1402599b0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ebx, eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov ecx, ebx
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9d, dword [rsp + 0x44]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, ebx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
mov rcx, rdi
call fcn.1402599a8
movsxd rdi, esi
jmp 0x1400ea095
mov rdi, 0xffffffffffffffff
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140259980
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400ea1f0
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rcx + 0x10]
mov ecx, dword [rax]
call fcn.140279090
xor edi, edi
mov rcx, rax
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400ea23a
mov rax, qword [rsi + 0x10]
mov ecx, dword [rax]
call fcn.140279090
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne dil
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400eaeb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, 5
cmp eax, 0xffffffff
je 0x1400eaf64
test eax, 0x400
jne 0x1400eaef3
shr eax, 4
and eax, 1
mov edi, eax
jmp 0x1400eaf64
mov edi, 2
test bl, bl
je 0x1400eaf64
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 5
cmp rax, 0xffffffffffffffff
je 0x1400eaf64
mov rsi, rax
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x44]
shr eax, 4
and eax, 1
test edi, edi
mov edi, 5
cmovne edi, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140259980
mov eax, edi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400eb0c0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x28]
mov r8b, 1
xor r9d, r9d
call fcn.1400ea4a0
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400eb111
mov ecx, eax
and ecx, 0x400
je 0x1400eb111
mov rcx, rsi
test al, 0x10
jne 0x1400eb141
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400eb147
mov ecx, 0x1126
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
test rsi, rsi
je 0x1400eb12b
mov rcx, rsi
call fcn.1402599a8
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140259980
mov eax, edi
add rsp, 0x38
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne dil
test rsi, rsi
jne 0x1400eb123
jmp 0x1400eb12b
Function at 0x1400eb160
Capabilities:
Check if file exists
Delete directory
Delete file
Move file

Disassembly:
xor ecx, ecx
jmp 0x1400eb170
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov ebx, ecx
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
mov r8b, 1
xor r9d, r9d
call fcn.1400ea4a0
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400eb257
mov ecx, 2
test eax, 0x400
jne 0x1400eb1c6
shr eax, 4
and eax, 1
mov ecx, eax
cmp ecx, ebx
jne 0x1400eb264
lea rcx, [rsp + 0x28]
mov rdx, rdi
mov r8b, 1
xor r9d, r9d
call fcn.1400ea4a0
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.1400e4cf0
cmp eax, 1
jne 0x1400eb231
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400eb231
and eax, 0x400
je 0x1400eb231
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400eb295
mov ecx, eax
and ecx, 0x400
je 0x1400eb295
mov rcx, rdi
test al, 0x10
jne 0x1400eb2a4
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400eb2ae
mov rcx, rsi
mov rdx, rdi
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
test rdi, rdi
je 0x1400eb271
mov rcx, rdi
call fcn.1402599a8
jmp 0x1400eb271
mov ecx, 5
cmp ecx, ebx
je 0x1400eb1ce
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
test rsi, rsi
je 0x1400eb27e
mov rcx, rsi
call fcn.1402599a8
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140259980
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x1126
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x1400eb248
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400eb231
xor ebx, ebx
jmp 0x1400eb248
Function at 0x1400eb170
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file

Disassembly:
xor ecx, ecx
jmp 0x1400eb170
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov ebx, ecx
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
mov r8b, 1
xor r9d, r9d
call fcn.1400ea4a0
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400eb257
mov ecx, 2
test eax, 0x400
jne 0x1400eb1c6
shr eax, 4
and eax, 1
mov ecx, eax
cmp ecx, ebx
jne 0x1400eb264
lea rcx, [rsp + 0x28]
mov rdx, rdi
mov r8b, 1
xor r9d, r9d
call fcn.1400ea4a0
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.1400e4cf0
cmp eax, 1
jne 0x1400eb231
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400eb231
and eax, 0x400
je 0x1400eb231
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400eb295
mov ecx, eax
and ecx, 0x400
je 0x1400eb295
mov rcx, rdi
test al, 0x10
jne 0x1400eb2a4
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400eb2ae
mov rcx, rsi
mov rdx, rdi
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
test rdi, rdi
je 0x1400eb271
mov rcx, rdi
call fcn.1402599a8
jmp 0x1400eb271
mov ecx, 5
cmp ecx, ebx
je 0x1400eb1ce
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
test rsi, rsi
je 0x1400eb27e
mov rcx, rsi
call fcn.1402599a8
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140259980
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x1126
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x1400eb248
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400eb231
xor ebx, ebx
jmp 0x1400eb248

Function at 0x1400eb2c0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file

Disassembly:
mov ecx, 2
jmp 0x1400eb170
Function at 0x1400eb930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, r8
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x78]
mov r8b, 1
xor r9d, r9d
call fcn.1400ea4a0
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400eb9eb
test eax, 0x400
je 0x1400eb9d1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1400eb9eb
mov rbx, rax
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x1400eb9eb
mov eax, dword [rsp + 0x40]
shr eax, 4
and eax, 1
mov qword [rsi], rax
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1402731cc
test eax, eax
je 0x1400eba1c
mov qword [rsi], 5
test rdi, rdi
je 0x1400eb9ff
mov rcx, rdi
call fcn.1402599a8
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140259980
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
ret
imul rax, qword [rsp + 0x70], 0x3e8
mov qword [rsi + 8], rax
imul rax, qword [rsp + 0x68], 0x3e8
mov qword [rsi + 0x10], rax
imul rax, qword [rsp + 0x60], 0x3e8
mov qword [rsi + 0x18], rax
movzx eax, word [rsp + 0x46]
mov qword [rsi + 0x20], rax
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x28], rax
test rdi, rdi
jne 0x1400eb9f7
jmp 0x1400eb9ff

Function at 0x1400ebf90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov ebx, r8d
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x38]
mov r8b, 1
xor r9d, r9d
call fcn.1400ea4a0
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, 5
cmp eax, 0xffffffff
je 0x1400ec05a
test eax, 0x400
jne 0x1400ebfe9
shr eax, 4
and eax, 1
mov edi, eax
jmp 0x1400ec05a
mov edi, 2
test bl, bl
je 0x1400ec05a
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 5
cmp rax, 0xffffffffffffffff
je 0x1400ec05a
mov rbx, rax
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x44]
shr eax, 4
and eax, 1
test edi, edi
mov edi, 5
cmovne edi, eax
test rsi, rsi
je 0x1400ec067
mov rcx, rsi
call fcn.1402599a8
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140259980
mov eax, edi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret