joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400112e4
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400157c0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400157e0
xor al, al
jmp 0x140015861
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400157f3
xor al, al
jmp 0x140015861
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001581d
xor al, al
jmp 0x140015861
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015831
xor al, al
jmp 0x140015861
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015843
xor al, al
jmp 0x140015861
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001585f
xor al, al
jmp 0x140015861
mov al, 1
add rsp, 0x38
ret

Function at 0x140011302
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x140011e00
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x158]
mov rax, qword [0x14001f9c0]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x1400260a5]
call fcn.140011424
nop
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp + 0x130]
xor edx, edx
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, qword [rbp + 0x138]
mov qword [rcx], rax
mov rax, qword [rbp + 0x138]
cmp qword [rax], 0
jne 0x140011ebf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.___VirtualAllocEx_failed__error:__d_n_n
call fcn.1400111e5
nop
xor eax, eax
jmp 0x140011f7d
mov rax, qword [rbp + 0x138]
mov rdx, qword [rax]
lea rcx, str.__Allocated_memory_at:_0x_p_n_n
call fcn.1400111e5
nop
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x130]
mov r8, qword [rbp + 0x128]
mov rax, qword [rbp + 0x138]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140011f15
mov rax, qword [rbp + 0x130]
cmp qword [rbp + 8], rax
je 0x140011f2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.___WriteProcessMemory_failed__error:__d_n_n
call fcn.1400111e5
nop
xor eax, eax
jmp 0x140011f7d
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, qword [rbp + 0x130]
mov rax, qword [rbp + 0x138]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x140011f78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.___VirtualProtectEx_failed__error:__d_n_n
call fcn.1400111e5
nop
xor eax, eax
jmp 0x140011f7d
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001c050]
call fcn.1400113a7
mov rax, rdi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.1400111fe
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14001132f
Capabilities:
Resume thread

Disassembly:
jmp 0x140011ca0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x758
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x13e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x778]
mov rax, qword [0x14001f9c0]
xor rax, rbp
mov qword [rbp + 0x728], rax
lea rcx, [0x1400260a5]
call fcn.140011424
nop
mov dword [rbp + 0x40], 0x100001
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x750]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x140011d24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.___GetThreadContext_failed_with_error:__d_n_n
call fcn.1400111e5
nop
xor eax, eax
jmp 0x140011d86
mov rax, qword [rbp + 0x758]
mov qword [rbp + 0x108], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x750]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x140011d60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.___SetThreadContext_failed_with_error:__d_n_n
call fcn.1400111e5
nop
xor eax, eax
jmp 0x140011d86
mov rcx, qword [rbp + 0x750]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x750]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001c0e0]
call fcn.1400113a7
mov rax, rdi
mov rcx, qword [rbp + 0x728]
xor rcx, rbp
call fcn.1400111fe
lea rsp, [rbp + 0x738]
pop rdi
pop rbp
ret
Function at 0x140013c80
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001144c
movzx eax, al
test eax, eax
jne 0x140013ca0
mov ecx, 7
call fcn.1400113b1
nop
mov byte [rsp + 0x20], 0
call fcn.1400113ca
mov byte [rsp + 0x21], al
cmp dword [0x140020220], 1
jne 0x140013cc4
mov ecx, 7
call fcn.1400113b1
nop
jmp 0x140013d1c
cmp dword [0x140020220], 0
jne 0x140013d17
mov dword [0x140020220], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.1400111ea
test eax, eax
je 0x140013cf8
mov eax, 0xff
jmp 0x140013e21
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.1400113bb
mov dword [0x140020220], 2
jmp 0x140013d1c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001139d
call fcn.140011320
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140013d79
mov rcx, qword [rsp + 0x30]
call fcn.14001119f
movzx eax, al
test eax, eax
je 0x140013d79
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140027020]
nop
call fcn.14001135c
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140013dad
mov rcx, qword [rsp + 0x38]
call fcn.14001119f
movzx eax, al
test eax, eax
je 0x140013dad
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001140b
nop
call fcn.140013ed0
mov dword [rsp + 0x28], eax
call fcn.1400112e4
movzx eax, al
test eax, eax
jne 0x140013dcc
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140013ddb
call fcn.140011415
nop
xor edx, edx
mov cl, 1
call fcn.140011186
mov eax, dword [rsp + 0x28]
jmp 0x140013e21
add rsp, 0x68
ret
Function at 0x140001d00
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1400bb4a8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rdx
mov rsi, rcx
xor edi, edi
mov word [rsp + 0x40], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x42]
call fcn.14002b5b0
lea rdx, str.Entering__GetDrsFolder__function....._n
mov rcx, qword [0x1400bc2d8]
call fcn.140003dd0
mov rcx, qword [0x1400bc2d8]
call fcn.140003f60
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140001e38
lea rcx, [rsp + 0x30]
call fcn.140027560
nop
lea rdx, str._SHGetFolderPath__fn_successfully_retrieved_the__Common_App_data__path__n
mov rcx, qword [0x1400bc2d8]
call fcn.140003dd0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140025fc0
mov rcx, qword [0x1400bc2d8]
cmp eax, 1
jbe 0x140001dcd
mov r8d, eax
lea rdx, str.WARNING:__obtainDrsPath__fn_failed_to_retrieve_the__Drs__path__err:_d__n
call fcn.140003dd0
jmp 0x140001e2b
lea rdx, str._obtainDrsPath__fn_successfully_retrieved_the__Drs__path__n
call fcn.140003dd0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140027710
lea rdx, [0x14009de78]
mov rcx, rbx
call fcn.140027d10
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400279b0
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x140001e14
lea edi, [rax + 1]
jmp 0x140001e2b
mov r8, qword [rbx]
lea rdx, str.WARNING:__s_Path_is_not_absolute___n
mov rcx, qword [0x1400bc2d8]
call fcn.140003dd0
nop
lea rcx, [rsp + 0x30]
call fcn.140027e00
nop
jmp 0x140001e54
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.WARNING:__SHGetFolderPath__fn_failed_to_retrieve__Common_App_data__path__error___u__n
mov rcx, qword [0x1400bc2d8]
call fcn.140003dd0
mov rcx, qword [0x1400bc2d8]
call fcn.140003fa0
mov r8d, edi
lea rdx, str.Exiting__GetDrsFolder__function.Return__d_n
mov rcx, qword [0x1400bc2d8]
call fcn.140003dd0
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140028460
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140002af0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rcx, qword [0x1400bc2d8]
lea rdx, str.Entering__SetLDDMRegistry__function....._n
call fcn.140003dd0
mov rcx, qword [0x1400bc2d8]
call fcn.140003f60
xor esi, esi
mov ecx, 0x20a
mov qword [rsp + 0x68], rsi
mov edi, 1
call fcn.14002833c
xor edx, edx
mov r8d, 0x20a
mov rcx, rax
mov rbx, rax
call fcn.14002b5b0
mov rcx, qword [0x1400bc2d8]
lea rdx, str.Querying_the_OS_for_the_ALLUSERSPROFILE__n
call fcn.140003dd0
lea r9, [rsp + 0x60]
mov qword [rsp + 0x60], rsi
xor r8d, r8d
lea rcx, [0x1400a19c0]
xor edx, edx
call sub.SHELL32.dll_SHGetKnownFolderPath
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x140002b97
mov edx, 0x105
mov rcx, rbx
call fcn.140039be4
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1400bc2d8]
lea rdx, str.ALLUSERSPROFILE_obtained_as___s__n
mov r8, rbx
call fcn.140003dd0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [0x1400bc2d8]
cmp eax, 0xffffffff
jne 0x140002bd5
lea rdx, str.WARNING:_ALLUSERSPROFILE_is_not_a_valid_System_path__n
mov edi, esi
call fcn.140003dd0
jmp 0x140002cb7
lea r8, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
lea rdx, str.Creating_Opening_the_reg_path___s__n
call fcn.140003dd0
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [0x1400bc2d8]
lea r8, str.SOFTWARENVIDIA_CorporationGlobalDrsPath
test eax, eax
jne 0x140002ca9
lea rdx, str.Setting_NVDRS_PATH_key_on___s__n
call fcn.140003dd0
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rbx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140002c50
mov rcx, qword [rsp + 0x68]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.NVDRS_PATH
mov r9d, edi
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140002c9c
mov rcx, qword [0x1400bc2d8]
lea rdx, str.WARNING:_Could_not_set_the_registry_entry_for_NVDRS_PATH__n
mov edi, esi
call fcn.140003dd0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002cb7
lea rdx, str.WARNING:_Could_not_Create_or_Open_the_reg_path___s___n
call fcn.140003dd0
mov edi, esi
mov rcx, rbx
call fcn.140028344
mov rcx, qword [0x1400bc2d8]
call fcn.140003fa0
mov rcx, qword [0x1400bc2d8]
lea rdx, str.Exiting__SetLDDMRegistry__function._Return__d_n
mov r8d, edi
call fcn.140003dd0
mov rbx, qword [rsp + 0x70]
mov eax, edi
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140003dd0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
mov eax, 0x2860
call fcn.140028490
sub rsp, rax
mov rax, qword [0x1400bb4a8]
xor rax, rsp
mov qword [rsp + 0x2840], rax
cmp dword [rcx + 0x18], 0xffffffff
mov rdi, rcx
je 0x140003f43
mov rcx, qword [rcx + 8]
mov edx, 0xffffffff
mov qword [rsp + 0x2858], rbx
mov qword [rsp + 0x2850], rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rbx, [rsp + 0x2880]
call fcn.140004950
mov r9, qword [rsp + 0x2878]
lea rdx, [rsp + 0x840]
mov qword [rsp + 0x28], rbx
mov r8d, 0x7fffffff
xor ebx, ebx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rbx
call fcn.1400700ac
lea rcx, [rsp + 0x840]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rdi + 0x9c]
lea rdx, [0x14009fa1c]
call fcn.14004d8c8
mov rsi, rax
test rax, rax
je 0x140003f29
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x400
lea r9, str.hh:mm:ss_tt
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetTimeFormatW]
test eax, eax
je 0x140003ee8
mov eax, dword [rdi + 0x18]
lea r9, [rdi + 0x1c]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea rdx, str._s____s__d___
mov rcx, rsi
call fcn.140004aa0
mov rax, qword [rdi]
cmp dword [rax + 4], ebx
jle 0x140003f09
mov rdx, rsi
lea rcx, [0x14009fa68]
call fcn.14004d560
mov rax, qword [rdi]
inc ebx
cmp ebx, dword [rax + 4]
jl 0x140003ef0
mov rdx, rsi
lea rcx, [rsp + 0x840]
call fcn.14004d560
mov rcx, rsi
call fcn.140070e64
mov rcx, rsi
call fcn.1400706c8
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rsi, qword [rsp + 0x2850]
mov rbx, qword [rsp + 0x2858]
mov rcx, qword [rsp + 0x2840]
xor rcx, rsp
call fcn.140028460
add rsp, 0x2860
pop rdi
ret
Function at 0x140004050
Capabilities:
Check if file exists
Check mutex on windows
Get file attributes
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x460
mov rax, qword [0x1400bb4a8]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rdx
mov rdi, rcx
xor ebp, ebp
lea rcx, [rsp + 0x242]
xor edx, edx
mov word [rsp + 0x240], bp
mov r8d, 0x206
call fcn.14002b5b0
mov r8d, 0x104
lea rdx, [rsp + 0x240]
mov rcx, rdi
call fcn.140004510
test eax, eax
je 0x140004250
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.14002b5b0
lea r8, [rsp + 0x240]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140039be4
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r8, [rdi + 0x2a4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi + 8], rax
test rax, rax
je 0x140004250
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rax, [rdi + 0x4ac]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rcx, [rbp - 1]
xor edx, edx
mov dword [rsp + 0x20], 8
lea r8d, [rbp + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x140004164
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], rbp
jmp 0x140004250
mov qword [rsp + 0x478], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov esi, eax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi], rax
test rax, rax
jne 0x1400041c0
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 8]
mov qword [rdi + 0x10], rbp
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], rbp
jmp 0x140004248
cmp esi, 0xb7
je 0x1400041d0
mov dword [rax], ebp
mov rax, qword [rdi]
mov dword [rax + 4], ebp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400041f3
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140004280
lea rcx, [rdi + 0x9c]
mov edx, 0x104
lea r8, [rsp + 0x240]
call fcn.140039be4
mov rcx, rdi
sub rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx + 0x1c], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x140004220
mov rcx, qword [rdi]
mov edx, dword [rcx]
lea eax, [rdx + 1]
mov dword [rcx], eax
mov rcx, qword [rdi + 8]
mov dword [rdi + 0x18], edx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rsi, qword [rsp + 0x478]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140028460
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140004280
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rcx, rdx
mov r14, r8
mov rbx, rdx
xor edi, edi
call qword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
jne 0x140004441
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x140004441
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000440e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x1400042ee
cmp eax, 0xb7
jmp 0x14000441d
inc r14
mov eax, 2
mul r14
mov rsi, 0xffffffffffffffff
cmovo rax, rsi
mov rcx, rax
call fcn.14002833c
mov rbp, rax
test rax, rax
je 0x140004424
mov r8, rbx
mov rdx, r14
mov rcx, rax
call fcn.140039be4
mov eax, 2
mul r14
cmovo rax, rsi
mov rcx, rax
call fcn.14002833c
mov rsi, rax
test rax, rax
je 0x1400043e9
mov r8, rbp
mov rdx, r14
mov rcx, rax
call fcn.140039be4
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathStripToRootW]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathSkipRootW]
mov rdx, r14
mov rcx, rbp
mov r8, rax
call fcn.140039be4
xor r8d, r8d
lea rdx, [0x14009de78]
mov rcx, rbp
call fcn.14004d340
test rax, rax
je 0x1400043ce
nop dword [rax + rax]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400043b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400043ce
xor r8d, r8d
lea rdx, [0x14009de78]
xor ecx, ecx
call fcn.14004d340
test rax, rax
jne 0x140004390
mov rdx, rbx
mov rcx, rsi
call fcn.14003ad48
mov rcx, rsi
mov ebx, eax
call fcn.140028344
test ebx, ebx
sete dil
mov rcx, rbp
call fcn.140028344
mov rsi, qword [rsp + 0x38]
mov eax, edi
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000441f
test eax, eax
jne 0x140004424
mov edi, 1
mov rsi, qword [rsp + 0x38]
mov eax, edi
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000a2c0
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x8b0
mov rax, qword [0x1400bb4a8]
xor rax, rsp
mov qword [rsp + 0x8a0], rax
xorps xmm0, xmm0
xor eax, eax
mov rsi, rcx
mov dword [rsp + 0x90], eax
xor ebp, ebp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x800
mov ebx, ebp
movups xmmword [rsp + 0x60], xmm0
mov edi, ebp
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.14002b5b0
mov r8, rsi
lea rcx, [rsp + 0xa0]
mov edx, 0x400
call fcn.140039be4
lea edx, [rbp + 0x5c]
lea rcx, [rsp + 0xa0]
call fcn.14002a240
lea rcx, [rsp + 0xa0]
mov word [rax], bp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea r14d, [rbp + 8]
cmp eax, 0xffffffff
je 0x14000a38a
and eax, 0x410
cmp eax, 0x10
je 0x14000a38a
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
cmove edi, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000a41e
bt eax, 0xa
jb 0x14000a3f2
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x48]
mov dword [rsp + 0x28], 0x210400
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000a418
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x14000a41e
cmp dword [rsp + 0x88], 1
jbe 0x14000a41e
mov r9d, 1
mov byte [rsp + 0x40], 1
lea r8, [rsp + 0x40]
mov rcx, rbx
lea edx, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
mov edi, ebp
test eax, eax
jne 0x14000a418
mov edi, r14d
cmp rbx, 0xffffffffffffffff
je 0x14000a427
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x8a0]
xor rcx, rsp
call fcn.140028460
lea r11, [rsp + 0x8b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14000aba0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rdi, rdx
mov rbx, rcx
test r8b, r8b
je 0x14000abf5
mov eax, 1
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x58]
mov word [rsp + 0x50], ax
lea r8d, [rsi + 2]
mov rcx, rdi
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000acbb
cmp dword [rsp + 0x58], 2
jne 0x14000acbb
test byte [rbx + 0x818], 0x40
lea r9, [rsp + 0x58]
mov eax, esi
mov qword [rsp + 0x20], rsi
setne al
lea rdx, [rsp + 0x50]
inc ax
mov r8d, 2
mov rcx, rdi
mov word [rsp + 0x50], ax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000acbb
cmp dword [rsp + 0x58], 2
jne 0x14000acbb
movzx eax, word [rbx + 0x800]
lea r9, [rsp + 0x58]
mov r8d, 2
mov word [rsp + 0x50], ax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000acbb
cmp dword [rsp + 0x58], 2
jne 0x14000acbb
mov r8d, dword [rbx + 0x800]
lea r9, [rsp + 0x58]
mov rdx, qword [rbx + 0x808]
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000acbb
mov eax, dword [rbx + 0x800]
cmp dword [rsp + 0x58], eax
jne 0x14000acbb
mov rdx, rdi
mov rcx, rbx
call fcn.14000d860
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 8
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret