joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400028a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002973
cmp byte [rcx + 0x71], 0
je 0x140002973
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000296f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002934
sub eax, 1
je 0x140002938
cmp eax, 2
jne 0x14000296f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003080
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002966
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000296f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000291c
xor al, al
jmp 0x14000291c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003080
add rsp, 0x60
pop rbx
ret

Function at 0x140003a00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003a4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003a4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003a4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003a4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140003a4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003a4c
xor al, al
add rsp, 0x28
ret
Function at 0x140001500
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
sub rsp, 0x40
mov r13, rcx
mov rbp, r8
mov ecx, 0x39
mov r12, rdx
call fcn.1400bb768
mov rbx, rax
test rax, rax
je 0x140001700
xorps xmm0, xmm0
mov qword [rsp + 0x70], rsi
movups xmmword [rbx], xmm0
xor eax, eax
mov qword [rsp + 0x78], r14
movups xmmword [rbx + 0x10], xmm0
mov qword [rsp + 0x80], r15
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
lea ecx, [rax + 0x24]
mov byte [rbx + 0x38], al
call fcn.1400bb768
xor r15d, r15d
lea rsi, [rbx + 8]
mov r14, rax
test rax, rax
je 0x14000164d
xorps xmm0, xmm0
lea edx, [r15 + 1]
movups xmmword [r14], xmm0
xor eax, eax
xor r9d, r9d
movups xmmword [r14 + 0x10], xmm0
mov dword [r14 + 0x20], eax
xor r8d, r8d
mov rax, qword [rbx + 0x20]
xor ecx, ecx
mov qword [rsi], r14
mov qword [r14 + 0x10], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r14], rax
test rax, rax
jne 0x1400015b0
mov edi, 0x3f0
jmp 0x140001652
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [r14]
mov r9, rbx
mov dword [rsp + 0x30], r15d
mov r8, rax
mov rcx, rax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x1400015e5
mov edi, 0x3f0
jmp 0x140001652
mov ecx, 0x10
mov edi, r15d
call fcn.1400bb768
mov r15, rax
test rax, rax
jne 0x140001601
mov edi, 0x708
jmp 0x140001644
lea rax, [0x140001880]
mov qword [r15 + 8], r14
mov qword [r15], rax
lea r8, [0x140001e70]
xor eax, eax
mov r9, r15
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14 + 8], rax
test rax, rax
jne 0x140001644
mov rcx, r15
call fcn.1400bb754
mov edi, 0x3eb
test edi, edi
je 0x140001699
xor r15d, r15d
jmp 0x140001652
mov edi, 0x708
mov rax, qword [rsi]
test rax, rax
je 0x140001661
mov dword [rax + 0x20], 1
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000167b
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], r15
test r14, r14
je 0x140001699
mov rcx, qword [r14]
test rcx, rcx
je 0x140001691
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14], r15
mov rcx, r14
call fcn.1400bb754
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
test edi, edi
jne 0x1400016c9
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r12
mov qword [rbp], rbx
mov rsi, qword [rsp + 0x70]
mov eax, edi
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
mov rax, qword [rsi]
test rax, rax
je 0x1400016d8
mov dword [rax + 0x20], 1
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400016f6
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0
mov rcx, rbx
call fcn.1400bb754
jmp 0x1400016b6
mov eax, 0x708
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400053d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x160], rax
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140005443
bt eax, 0xa
jae 0x140005443
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000542d
test al, 0x10
je 0x14000542d
mov rcx, rdi
call fcn.1400d95ec
jmp 0x140005435
mov rcx, rdi
call fcn.1400bd14c
test eax, eax
je 0x140005443
mov eax, 0x1f
jmp 0x1400055b7
mov rcx, rdi
mov qword [rsp + 0x188], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140005487
bt eax, 0xa
jae 0x140005487
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000547b
test al, 0x10
je 0x14000547b
mov rcx, rdi
call fcn.1400d95ec
jmp 0x140005483
mov rcx, rdi
call fcn.1400bd14c
test eax, eax
jne 0x14000549e
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d90a4
mov ebx, eax
test eax, eax
je 0x1400055ad
test rdi, rdi
jne 0x1400054a7
xor ebx, ebx
jmp 0x1400054b7
mov edx, 0x104
mov rcx, rdi
call fcn.1400d5db8
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.1400ae310
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
mov r8, rdi
mov edx, 0x104
call fcn.1400bb838
lea rcx, [rbx - 2]
cmp rcx, 0x102
ja 0x14000550b
cmp byte [rsp + rbx + 0x4f], 0x5c
jne 0x14000550b
dec rbx
cmp rbx, 0x104
jae 0x1400055d0
mov byte [rsp + rbx + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000554f
bt eax, 0xa
jae 0x14000554f
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140005541
test al, 0x10
je 0x140005541
lea rcx, [rsp + 0x50]
call fcn.1400d95ec
jmp 0x14000554b
lea rcx, [rsp + 0x50]
call fcn.1400bd14c
test eax, eax
jne 0x140005564
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400d90a4
mov ebx, eax
test eax, eax
je 0x1400055ad
lea rcx, [rsp + 0x50]
call fcn.1400d9368
mov ebx, eax
test eax, eax
je 0x1400055ad
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.1400aea18
mov rdi, rax
test rax, rax
je 0x1400055ad
lea rcx, [rsp + 0x50]
mov byte [rax], 0
call fcn.1400053d0
mov ebx, eax
test eax, eax
jne 0x1400055ad
lea rcx, [rsp + 0x50]
mov byte [rdi], 0x5c
call fcn.1400d9368
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x170
pop rdi
ret
call fcn.1400ac994
int3
Function at 0x140007b30
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbp
push rbx
lea rbp, [r11 - 0x68]
sub rsp, 0x158
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov rbx, rcx
test rcx, rcx
je 0x140007d08
mov rcx, qword [rcx + 0x108]
test rcx, rcx
je 0x140007d08
mov qword [r11 + 0x10], rsi
mov qword [r11 - 0x18], r14
call fcn.14000fc90
xorps xmm0, xmm0
lea rdx, [rbp - 0x60]
mov r14, rax
mov rcx, rbx
xor eax, eax
mov dword [rbp + 0x30], eax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
call fcn.140007750
mov esi, eax
test eax, eax
jne 0x140007ce2
mov eax, dword [rbp - 0x5c]
and eax, 0xff000000
cmp eax, 0x2000000
jne 0x140007ce2
mov ecx, 0x1000
mov qword [rsp + 0x180], rdi
call fcn.14000c0a0
mov rdi, rax
test rax, rax
jne 0x140007bf3
mov esi, 0x708
jmp 0x140007cda
mov rcx, qword [rbx + 0x108]
xorps xmm0, xmm0
xor eax, eax
mov dword [rsp + 0x20], 0x40200100
mov r8d, 0x1000
mov dword [rbp - 0x6c], eax
mov rdx, rdi
mov dword [rsp + 0x24], 0x6a09e667
movups xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x28], 0xbb67ae85
movups xmmword [rsp + 0x54], xmm0
mov dword [rsp + 0x2c], 0x3c6ef372
movups xmmword [rsp + 0x64], xmm0
mov dword [rsp + 0x30], 0xa54ff53a
movups xmmword [rsp + 0x74], xmm0
mov dword [rsp + 0x34], 0x510e527f
movups xmmword [rbp - 0x7c], xmm0
mov dword [rsp + 0x38], 0x9b05688c
mov dword [rsp + 0x3c], 0x1f83d9ab
mov dword [rsp + 0x40], 0x5be0cd19
call fcn.140010180
test rax, rax
je 0x140007caa
lfence
nop dword [rax + rax]
mov r8, rax
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.14000d1d0
mov rcx, qword [rbx + 0x108]
mov r8d, 0x1000
mov rdx, rdi
call fcn.140010180
test rax, rax
jne 0x140007c80
lea rcx, [rsp + 0x20]
call fcn.14000cf00
mov r8d, 0x20
lea rdx, [rbp + 0xc]
lea rcx, [rsp + 0x24]
call fcn.1400ae540
test eax, eax
mov ecx, 0xbbd
cmovne esi, ecx
mov rcx, rdi
call fcn.1400bb754
mov rdi, qword [rsp + 0x180]
mov rcx, qword [rbx + 0x108]
xor r8d, r8d
mov rdx, r14
call fcn.140010340
mov r14, qword [rsp + 0x150]
mov eax, esi
mov rsi, qword [rsp + 0x178]
jmp 0x140007d0d
mov eax, 0x8fc
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x158
pop rbx
pop rbp
ret
Function at 0x14000c010
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000c068
bt eax, 0xa
jae 0x14000c068
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000c055
test al, 0x10
je 0x14000c055
mov rcx, rbx
call fcn.1400d95ec
jmp 0x14000c05d
mov rcx, rbx
call fcn.1400bd14c
test eax, eax
je 0x14000c068
mov ecx, 0x1f
jmp 0x14000c077
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d90a4
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x60
pop rbx
ret
Function at 0x14000fcd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x14000fd0a
mov edx, dword [rcx]
sub edx, 1
je 0x14000fd1e
cmp edx, 1
jne 0x14000fd0a
mov rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x68
ret
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x68
ret
mov qword [rsp + 0x60], rbx
mov rbx, qword [rcx + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000fd63
bt eax, 0xa
jae 0x14000fd63
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000fd57
test al, 0x10
je 0x14000fd57
mov rcx, rbx
call fcn.1400d95ec
jmp 0x14000fd5f
mov rcx, rbx
call fcn.1400bd14c
test eax, eax
jne 0x14000fd7b
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400d90a4
test eax, eax
jne 0x14000fd7b
movsxd rax, dword [rsp + 0x34]
jmp 0x14000fd7d
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x68
ret
Function at 0x14000ff30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rsi, [0x140127a64]
mov rbx, rcx
test rcx, rcx
jne 0x14000ff60
lea eax, [rcx + 0x16]
jmp 0x1400100c8
mov qword [rsp + 0x70], rdi
call fcn.14000fa30
mov ecx, dword [rbx]
sub ecx, 1
je 0x14000ff94
cmp ecx, 1
jne 0x14000ff8a
cmp qword [rbx + 8], 0
je 0x14000ff8a
xor edi, edi
mov qword [rbx + 0x20], rdi
mov eax, edi
jmp 0x1400100c3
mov eax, 1
jmp 0x1400100c3
mov rax, qword [rbx + 0x18]
test rax, rax
cmovne rsi, rax
cmp dword [rbx + 4], 2
je 0x14000ffc3
lea rdx, [0x140128068]
mov rcx, rsi
call fcn.1400da990
test rax, rax
je 0x14000ffc3
mov eax, 0xd
jmp 0x1400100c3
mov qword [rsp + 0x68], rbp
xor edi, edi
mov rbp, qword [rbx + 8]
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001001c
bt eax, 0xa
jae 0x14001001c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140010003
test al, 0x10
je 0x140010003
mov rcx, rbp
call fcn.1400d95ec
jmp 0x14001000b
mov rcx, rbp
call fcn.1400bd14c
test eax, eax
je 0x14001001c
mov rcx, rdi
mov eax, 0x1f
jmp 0x1400100ba
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov r9, 0xffffffffffffffff
mov r8, rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [r9 + 0x21]
call fcn.1400bb838
lea rdx, [0x140128068]
mov rcx, rsi
call fcn.1400da990
test rax, rax
je 0x14001009d
mov edx, 0x63
mov rcx, rsi
call fcn.1400ae4b0
test rax, rax
jne 0x14001009d
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400d5db8
cmp rax, 0x20
jne 0x140010081
mov byte [rsp + 0x47], dil
jmp 0x14001009d
mov r9, 0xffffffffffffffff
lea r8, [0x14012806c]
lea rcx, [rsp + 0x28]
lea edx, [r9 + 0x21]
call fcn.1400ecb38
lea r8, [rsp + 0x28]
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.1400ecf08
mov rcx, qword [rsp + 0x20]
test rcx, rcx
cmovne eax, edi
mov rbp, qword [rsp + 0x68]
mov qword [rbx + 0x10], rcx
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ac830
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
Function at 0x140010540
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r14, r8
mov r12, rdx
mov rdi, rcx
test rcx, rcx
je 0x14001063f
test rdx, rdx
je 0x14001063f
cmp dword [rcx + 4], 2
jne 0x14001063f
mov ecx, dword [rcx]
sub ecx, 1
je 0x140010626
cmp ecx, 1
jne 0x14001063f
mov rax, qword [rdi + 0x20]
mov rsi, qword [rdi + 8]
lea rbp, [rax + r8]
test rsi, rsi
je 0x1400105ac
cmp qword [rdi + 0x10], rbp
jae 0x1400105fd
and rbp, 0xfffffffffffffe00
mov qword [rsp + 0x40], rbx
add rbp, 0x200
mov rcx, rsi
mov rdx, rbp
mov rbx, rsi
call fcn.1400d5384
test rbx, rbx
mov rsi, rax
mov rbx, qword [rsp + 0x40]
jne 0x1400105ec
test rax, rax
je 0x14001063f
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.1400ae310
test rsi, rsi
je 0x14001063f
mov rax, qword [rdi + 0x20]
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rbp
lea rcx, [rsi + rax]
mov r8, r14
mov rdx, r12
call fcn.140010720
add qword [rdi + 0x20], r14
mov r15, r14
mov rcx, qword [rdi + 0x20]
cmp rcx, qword [rdi + 0x18]
cmovbe rcx, qword [rdi + 0x18]
mov qword [rdi + 0x18], rcx
jmp 0x14001063f
mov r9, qword [rdi + 0x10]
test r9, r9
je 0x14001063f
mov edx, 1
mov rcx, r12
call fcn.1400ee820
mov r15, rax
mov rbp, qword [rsp + 0x48]
mov rax, r15
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140012d30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor edi, edi
movsxd rbx, ecx
mov r14, r9
mov r15, r8
mov rsi, rdx
test rdx, rdx
je 0x140012d6b
mov edx, 0x104
mov rcx, rsi
call fcn.1400d5db8
mov rbp, rax
jmp 0x140012d6d
mov ebp, edi
imul rbx, rbx, 0x38
lea r12, [0x14021cca0]
mov qword [rsp + 0x78], rbx
lea rax, [rbx + r12]
mov rcx, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
cmp qword [rbx + r12 + 0x28], rdi
je 0x140012ede
mov qword [rsp + 0x70], r13
call fcn.1400053c0
mov qword [rsp + 0x28], r14
mov r9, r15
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rcx, qword [rax]
or rcx, 2
call fcn.1400d5254
test eax, eax
mov rcx, 0xffffffffffffffff
cmovs eax, ecx
movsxd r12, eax
add r12, 2
mov rcx, r12
lea r13d, [rax + 2]
call fcn.1400bb768
mov rbx, rax
test rax, rax
je 0x140012ed9
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1400ae310
mov r9, r15
mov qword [rsp + 0x20], r14
mov r8, 0xffffffffffffffff
mov rdx, r12
mov rcx, rbx
call fcn.1400160e0
mov r9d, eax
test r12, r12
je 0x140012e25
cmp eax, 0xffffffff
jne 0x140012e25
lea r9d, [r13 - 1]
mov rax, rbx
cmp byte [rbx], dil
je 0x140012e4a
nop dword [rax]
cmp byte [rax + 1], dil
lea rcx, [rax + 1]
je 0x140012e4a
cmp byte [rax], 0xa
jne 0x140012e42
mov byte [rax], 9
mov rax, rcx
cmp byte [rcx], dil
jne 0x140012e30
test rsi, rsi
je 0x140012e9d
cmp r9d, ebp
jle 0x140012e9d
lea edi, [r9 + rbp]
cmp edi, r13d
jge 0x140012e9d
lfence
movsxd rax, ebp
mov r8, rsi
movsxd rcx, r9d
sub rcx, rax
add rcx, rbx
sub r8, rcx
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x140012e85
inc rcx
test eax, eax
jne 0x140012e72
test edx, edx
je 0x140012e9d
lfence
mov r8, r12
mov rdx, rsi
mov rcx, rbx
call fcn.140014340
mov r9d, edi
mov rsi, qword [rsp + 0x78]
lea rbp, [0x14021cca0]
movsxd r8, r9d
mov edx, 1
mov rcx, rbx
mov r9, qword [rsi + rbp + 0x28]
call fcn.1400ee820
cmp byte [rsi + rbp + 0x30], 0
mov edi, eax
je 0x140012ed1
mov rcx, qword [rsi + rbp + 0x28]
call fcn.1400eda84
mov rcx, rbx
call fcn.1400bb754
mov r13, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400140a0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x160], rax
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140014113
bt eax, 0xa
jae 0x140014113
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400140fd
test al, 0x10
je 0x1400140fd
mov rcx, rdi
call fcn.1400d95ec
jmp 0x140014105
mov rcx, rdi
call fcn.1400bd14c
test eax, eax
je 0x140014113
mov eax, 0x1f
jmp 0x140014287
mov rcx, rdi
mov qword [rsp + 0x188], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140014157
bt eax, 0xa
jae 0x140014157
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001414b
test al, 0x10
je 0x14001414b
mov rcx, rdi
call fcn.1400d95ec
jmp 0x140014153
mov rcx, rdi
call fcn.1400bd14c
test eax, eax
jne 0x14001416e
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d90a4
mov ebx, eax
test eax, eax
je 0x14001427d
test rdi, rdi
jne 0x140014177
xor ebx, ebx
jmp 0x140014187
mov edx, 0x104
mov rcx, rdi
call fcn.1400d5db8
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.1400ae310
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
mov r8, rdi
mov edx, 0x104
call fcn.1400bb838
lea rcx, [rbx - 2]
cmp rcx, 0x102
ja 0x1400141db
cmp byte [rsp + rbx + 0x4f], 0x5c
jne 0x1400141db
dec rbx
cmp rbx, 0x104
jae 0x1400142a0
mov byte [rsp + rbx + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001421f
bt eax, 0xa
jae 0x14001421f
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140014211
test al, 0x10
je 0x140014211
lea rcx, [rsp + 0x50]
call fcn.1400d95ec
jmp 0x14001421b
lea rcx, [rsp + 0x50]
call fcn.1400bd14c
test eax, eax
jne 0x140014234
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400d90a4
mov ebx, eax
test eax, eax
je 0x14001427d
lea rcx, [rsp + 0x50]
call fcn.1400d9368
mov ebx, eax
test eax, eax
je 0x14001427d
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.1400aea18
mov rdi, rax
test rax, rax
je 0x14001427d
lea rcx, [rsp + 0x50]
mov byte [rax], 0
call fcn.1400140a0
mov ebx, eax
test eax, eax
jne 0x14001427d
lea rcx, [rsp + 0x50]
mov byte [rdi], 0x5c
call fcn.1400d9368
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x170
pop rdi
ret
call fcn.1400ac994
int3
Function at 0x14001d960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x428
mov rax, qword [0x14021a328]
xor rax, rsp
mov qword [rsp + 0x410], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.1400ae310
call fcn.140002160
mov qword [0x14021ce68], rax
test rax, rax
jne 0x14001d9b9
mov eax, 0x708
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x428
ret
xor r9d, r9d
mov qword [rsp + 0x420], rdi
mov edx, 0x80
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x390]
lea r8d, [r9 + 7]
call fcn.140013c70
lea r8, [rsp + 0x30]
lea rdx, str.upe_.dll
lea rcx, [rsp + 0x390]
call fcn.14001f2c0
mov rdi, rax
test rax, rax
je 0x14001dbd8
mov qword [rsp + 0x430], rbx
mov qword [rsp + 0x438], rsi
lea rsi, [0x1401277ec]
nop
mov ecx, 0x30
call fcn.1400bb768
mov rbx, rax
test rax, rax
je 0x14001dbaa
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movups xmmword [rax], xmm0
mov edx, 0x2e
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
call fcn.1400ae4b0
test rax, rax
je 0x14001da7a
lea rcx, [rsp + 0x30]
mov byte [rax], 0
call fcn.1400d9700
mov qword [rbx + 0x18], rax
mov rdx, rbx
mov rcx, qword [0x14021ce68]
call fcn.140001f90
jmp 0x14001da82
mov rcx, rbx
call fcn.1400bb754
xor edx, edx
lea rcx, [rsp + 0x140]
mov r8d, 0x140
call fcn.1400ae310
xor edx, edx
lea rcx, [rsp + 0x280]
mov r8d, 0x104
call fcn.1400ae310
nop dword [rax]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
jne 0x14001db83
lea rax, [rsp + 0x16c]
mov ecx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [rdi + 8]
lea r8, [0x1401277f0]
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x280]
call fcn.14001f7c0
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001db73
bt eax, 0xa
jae 0x14001db73
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001db5e
bt eax, 0xa
jae 0x14001db5e
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001db51
test al, 0x10
je 0x14001db51
lea rcx, [rsp + 0x280]
call fcn.1400d95ec
jmp 0x14001db5e
lea rcx, [rsp + 0x280]
call fcn.1400bd14c
xor edx, edx
lea rcx, [rsp + 0x140]
mov r8d, 0x140
call fcn.1400ae310
cmp byte [rsp + 0x16c], 0
je 0x14001dab0
jmp 0x14001db87
test eax, eax
je 0x14001dbaa
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x16c]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1400bb838
jmp 0x14001da20
mov rcx, qword [rdi]
mov rsi, qword [rsp + 0x438]
mov rbx, qword [rsp + 0x430]
cmp rcx, 0xffffffffffffffff
je 0x14001dbd0
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rdi], 0xffffffffffffffff
mov rcx, rdi
call fcn.1400bb754
mov rdi, qword [rsp + 0x420]
xor eax, eax
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.1400ac830
add rsp, 0x428
ret