joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012a6b0
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140302028]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x30]
mov rbx, rdx
mov dword [rsp + 0x20], 0x100
xor edx, edx
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x20]
lea rdx, [rsp + 0x30]
xor eax, eax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rax
mov rcx, rbx
mov word [rbx], ax
call fcn.140074a60
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14009f440
add rsp, 0x240
pop rbx
ret

Function at 0x14012a920
Capabilities:
Get user security identifier

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x88]
mov r10, r9
mov r9, qword [rsp + 0x70]
mov r11, r8
mov qword [rsp + 0x30], rax
mov rcx, rdx
mov rax, qword [rsp + 0x80]
mov r8, r10
mov qword [rsp + 0x28], rax
mov rdx, r11
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
setne al
add rsp, 0x40
pop rbx
ret
Function at 0x14012e100
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, rdx
mov rbx, rcx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x50], rcx
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 7
mov word [rbx], cx
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x14012e17e
mov rdx, qword [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14012e160
mov rcx, rbx
call fcn.140074a60
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1401374b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov dword [rsp + 0x58], 4
mov dword [r8], eax
lea r9, [rsp + 0x58]
mov rcx, qword [rcx]
mov rbx, r8
mov dword [rsp + 0x40], eax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140137509
mov eax, dword [rsp + 0x40]
mov dword [rbx], eax
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x140137520
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rbp, r8
mov r15, rdx
mov r12, rcx
xor sil, sil
mov dword [r11 + 0x20], 1
mov dword [rsp + 0x70], 0
lea rax, [r11 + 8]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], 0
lea r9, [r11 + 0x20]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14013763f
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x14013763f
mov ecx, eax
mov eax, 2
mul rcx
mov r14, rax
mov rbx, 0xffffffffffffffff
cmovo r14, rbx
mov rcx, r14
call fcn.14009f83c
mov rdi, rax
test rax, rax
je 0x1401375c6
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x1401375c8
xor edi, edi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14013761d
nop dword [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140137600
mov r8, rbx
mov rdx, rdi
mov rcx, rbp
call fcn.140074a60
mov sil, 1
jmp 0x140137630
xor r8d, r8d
lea rdx, [0x14023a2d8]
mov rcx, rbp
call fcn.140074a60
nop
test rdi, rdi
je 0x140137651
mov rcx, rdi
call fcn.14009f0ec
jmp 0x140137651
xor r8d, r8d
lea rdx, [0x14023a2d8]
mov rcx, rbp
call fcn.140074a60
movzx eax, sil
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140137670
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
xor r15d, r15d
mov dword [r11 - 0x58], r15d
mov dword [r11 + 0x20], r15d
lea rax, [r11 + 0x20]
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x68], r15
lea r9, [r11 - 0x58]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140137823
cmp dword [rsp + 0x30], 7
jne 0x140137823
mov eax, dword [rsp + 0xa8]
test eax, eax
je 0x140137815
mov edx, eax
shr rdx, 1
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0x48]
call fcn.140137380
nop
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov r14, qword [rsp + 0x48]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140137819
mov rax, r14
mov qword [rsp + 0x38], rax
mov rsi, qword [rsp + 0x50]
lea rdi, [rsi - 2]
cmp r14, rdi
jae 0x1401377d0
mov rbx, rax
cmp rax, rsi
je 0x14013775f
nop dword [rax]
cmp word [rbx], 0
je 0x14013775f
add rbx, 2
cmp rbx, rsi
jne 0x140137750
mov qword [rsp + 0x90], rbx
mov rcx, qword [rbp + 8]
cmp qword [rbp + 0x10], rcx
je 0x14013779e
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 7
mov word [rcx], r15w
cmp rax, rbx
je 0x140137797
mov r8, rbx
sub r8, rax
sar r8, 1
mov rdx, rax
call fcn.140074a60
add qword [rbp + 8], 0x20
jmp 0x1401377be
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x38]
mov rdx, rcx
mov rcx, rbp
call fcn.140137080
mov rbx, qword [rsp + 0x90]
lea rax, [rbx + 2]
mov qword [rsp + 0x38], rax
cmp rax, rdi
jb 0x140137741
test r14, r14
je 0x140137815
mov rax, qword [rsp + 0x58]
sub rax, r14
sar rax, 1
lea rdx, [rax + rax]
mov rax, r14
cmp rdx, 0x1000
jb 0x14013780c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14013780c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14009f0ec
nop
mov al, 1
jmp 0x140137825
lea rcx, [rsp + 0x48]
call fcn.140086960
xor al, al
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140137880
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov r10, rdx
mov rbx, rcx
mov rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], 0
jne 0x140137893
lea ecx, [rax + rax]
test eax, eax
mov edx, 2
mov r9d, 1
cmovne edx, ecx
mov rcx, qword [rbx]
mov dword [rsp + 0x28], edx
mov rdx, r10
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1401378de
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x1401378f0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x28], 4
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140137936
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x140137940
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov r15, r8
mov r13, rdx
mov r12, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
xor ebx, ebx
mov qword [rbp - 8], rbx
mov r14, qword [r8 + 8]
mov rdi, qword [r8]
mov rax, qword [rbp - 0x10]
cmp rdi, r14
je 0x140137a28
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14013799f
mov rdx, qword [rdi]
mov rcx, qword [rdi + 0x10]
lea rsi, [rdx + rcx*2]
mov rbx, rdi
jb 0x1401379af
mov rbx, qword [rdi]
cmp rbx, rsi
je 0x1401379ea
cmp qword [rbp - 8], rax
je 0x1401379ce
movzx ecx, word [rbx]
mov word [rax], cx
mov rax, qword [rbp - 0x10]
add rax, 2
mov qword [rbp - 0x10], rax
jmp 0x1401379e1
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1401371e0
mov rax, qword [rbp - 0x10]
add rbx, 2
cmp rbx, rsi
jne 0x1401379b4
xor ebx, ebx
mov word [rbp + 0x40], bx
cmp qword [rbp - 8], rax
je 0x140137a07
mov word [rax], bx
mov rax, qword [rbp - 0x10]
add rax, 2
mov qword [rbp - 0x10], rax
jmp 0x140137a1b
lea r8, [rbp + 0x40]
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1401371e0
mov rax, qword [rbp - 0x10]
add rdi, 0x20
cmp rdi, r14
jne 0x140137992
mov rcx, qword [rbp - 0x18]
sub rax, rcx
sar rax, 1
lea edx, [rax + rax]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rcx
mov r9d, 7
xor r8d, r8d
mov rdx, r13
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140137abf
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140137ab3
mov rax, qword [rbp - 8]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140137aa2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140137aa2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009f0ec
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rbx
mov rcx, r15
call fcn.1400bf040
mov al, 1
jmp 0x140137b19
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140137b0f
mov rax, qword [rbp - 8]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140137afe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140137afe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009f0ec
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rbx
mov rcx, r15
call fcn.1400bf040
xor al, al
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140137c70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x298
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x140302028]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, r9
mov rsi, rcx
mov dword [rsp + 0x38], r8d
mov rax, r9
cmp qword [r9 + 0x18], 8
jb 0x140137caf
mov rax, qword [r9]
xor ebp, ebp
mov qword [r9 + 0x10], rbp
mov word [rax], bp
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, edx
xor r8d, r8d
mov rdx, qword [str.SOFTWARENitroPro13Settings]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140137dfa
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140137def
movdqa xmm0, xmmword [0x140239780]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], bp
jne 0x140137d60
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140074a60
nop
lea rax, [rsp + 0x50]
cmp rbx, rax
je 0x140137da9
mov rcx, rbx
call fcn.140074800
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x50], bp
jmp 0x140137dae
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140137def
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140137de9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140137de9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009f0ec
nop
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14009f440
add rsp, 0x298
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140139e70
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x28
call fcn.14022e150
sub rsp, rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x28
jmp fcn.14013a250
Function at 0x140147d40
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.14022e150
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140161770
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.14022e150
sub rsp, rax
lea rcx, [0x14030d698]
add rsp, 0x28
jmp fcn.140147ba0

Function at 0x140171fb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.14022e150
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x140171fe0
xor r9d, r9d
cmp rdx, r8
jae 0x140171ff9
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov r9d, reloc.WS2_32.dll_recv
cmp r9, 0x10
jae 0x140172021
sub r8, r10
lea rax, [r9 + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, r9
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140172010
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.14013ebb0
test eax, eax
je 0x140172052
cmp dword [rsp + 0x40], 0x10
jne 0x140172052
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x140172200
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x140172288
test r8, r8
je 0x140172288
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x140172246
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x140172230
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x140172288
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x140172288
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x140172270
ret

Function at 0x140182230
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x20
call fcn.14022e150
sub rsp, rax
mov rbx, rcx
call fcn.140075e80
test eax, eax
je 0x140182253
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]

Function at 0x1401bdae0
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.14022e150
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x1401bdb09
lea rax, [0x1401bc150]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.14014e5b0
lea rax, [0x1401bb310]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.14014e300
Function at 0x1401c4aa9
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401c4c9a
push rbx
mov eax, 0xd0
call fcn.14022e150
sub rsp, rax
mov rax, qword [0x140302028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.1401b1a80
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1401b1420
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.1401ae160
mov rcx, r15
call fcn.1401b1a80
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.1401b1420
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1401ae160
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1401c4b10
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14009f440
add rsp, 0xd0
pop rbx
ret
Function at 0x14020f520
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0xd0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x100], rbx
mov rax, qword [0x140302028]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14020f55f
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14020f589
test rbx, rbx
je 0x14020f585
mov dword [rbx], 0
mov byte [rbx + 4], 0
lea rdi, [0x14023f1d0]
mov qword [rbx + 8], rdi
mov al, 1
jmp 0x14020f5ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov dword [rsp + 0x20], 0
mov byte [rsp + 0x24], 0
lea rdi, [0x14023f1d0]
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.14020fbe0
cmp dword [rax], 3
jne 0x14020f5d7
test rbx, rbx
je 0x14020f5ea
mov dword [rbx], 0
mov byte [rbx + 4], 0
mov qword [rbx + 8], rdi
jmp 0x14020f5ea
test rbx, rbx
je 0x14020f610
mov r8, rdi
mov edx, r14d
mov rcx, rbx
call fcn.14020f120
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14009f440
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop r14
pop rdi
pop rsi
ret
lea rdx, str.boost::filesystem::create_directory
lea rcx, [rsp + 0x48]
call fcn.14007ef30
nop
call fcn.14020cf30
mov r8, rax
mov edx, r14d
lea rcx, [rsp + 0x38]
call fcn.14020c9f0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x20], xmm0
lea r9, [rsp + 0x20]
mov r8, rsi
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.1402110f0
lea rdx, [0x1402fb518]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14020fa00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebp, ebp
lea r14, [0x14023f1d0]
cmp qword [rcx + 0x18], 8
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x20], ebp
mov byte [rsp + 0x24], bpl
mov qword [rsp + 0x28], r14
jb 0x14020fa39
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14020fa60
lea r8, [rsp + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.14020f8d0
mov ebp, dword [rsp + 0x20]
mov ebx, dword [rax]
jmp 0x14020fac5
bt ebx, 0xa
jae 0x14020fabc
mov rcx, rsi
call fcn.14020f670
test al, al
je 0x14020fa84
test bl, 0x10
mov eax, ntohs
mov ebx, 4
cmovne ebx, eax
jmp 0x14020fac5
mov ebx, 9
test rdi, rdi
je 0x14020fa9c
mov dword [rdi], 0
mov byte [rdi + 4], 0
mov qword [rdi + 8], r14
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call fcn.14020faf0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
test ebx, ebx
jne 0x14020fa89
test ebp, ebp
je 0x14020fa89
lea r9, str.boost::filesystem::remove
mov r8, rdi
mov rdx, rsi
mov ecx, ebp
call fcn.140211340
xor al, al
jmp 0x14020faa9
Function at 0x14020faf0
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rcx
cmp edx, 1
jne 0x14020fb2e
test rbx, rbx
je 0x14020fb21
lea rax, [0x14023f1d0]
mov dword [r8], 0
mov qword [r8 + 8], rax
mov byte [r8 + 4], 0
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [rdx - 3]
test eax, 0xfffffff7
je 0x14020fb4a
cmp qword [rcx + 0x18], 8
jb 0x14020fb42
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14020fb5a
cmp qword [rcx + 0x18], 8
jb 0x14020fb54
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14020fbb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
ja 0x14020fb79
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x14020fbb5
cmp eax, 0x7b
je 0x14020fbb5
cmp eax, 0x57
je 0x14020fbb5
cmp eax, 0xa1
je 0x14020fbb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14020fbb5
lea r9, str.boost::filesystem::remove
mov r8, rbx
mov rdx, rdi
mov ecx, eax
call fcn.140211340
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test rbx, rbx
je 0x14020fbcf
lea rax, [0x14023f1d0]
mov byte [rbx + 4], 0
mov qword [rbx + 8], rax
mov dword [rbx], 0
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x14020fbe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x140302028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x14020fc20
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x14020fc40
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.14020f8d0
jmp 0x14020fd64
mov edx, ebp
mov rcx, rsi
call fcn.14020f770
mov r15d, eax
xor r12d, r12d
bt ebp, 0xa
jae 0x14020fd22
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14020fc67
mov rdx, qword [rsi]
movdqa xmm0, xmmword [0x140239780]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r12w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r12w
jne 0x14020fc82
lea rcx, [rsp + 0x50]
call fcn.140074a60
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.140074800
nop
cmp rbx, 0xffffffffffffffff
jne 0x14020fcf6
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.14020f8d0
nop
jmp 0x14020fd64
mov rcx, rsi
call fcn.14020f670
test al, al
jne 0x14020fd18
mov dword [rdi], 9
mov dword [rdi + 4], r15d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x14020fd64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r14, r14
je 0x14020fd3a
mov dword [r14], r12d
mov byte [r14 + 4], 0
lea rax, [0x14023f1d0]
mov qword [r14 + 8], rax
and ebp, 0x10
je 0x14020fd45
mov eax, dword [rsp + 0x40]
jmp 0x14020fd4d
mov eax, r15d
mov r15d, dword [rsp + 0x40]
test ebp, ebp
setne r12b
add r12d, 2
mov dword [rdi], r12d
test ebp, ebp
cmove r15d, eax
mov dword [rdi + 4], r15d
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14009f440
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret