joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400343c0
Capabilities:
Encode data using base64

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x1419a1b80]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov ebx, r8d
mov r14, rdx
mov r12, rcx
mov qword [rsp + 0x28], rdx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
movaps xmm0, xmmword [0x1401e4fb0]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm1, xmmword [0x1401e4fc0]
movaps xmmword [rsp + 0x90], xmm1
movaps xmm0, xmmword [0x1401e4fd0]
movaps xmmword [r11 - 0x78], xmm0
movaps xmm1, xmmword [0x1401e4fe0]
movaps xmmword [r11 - 0x68], xmm1
movzx eax, byte [0x1401e4ff0]
mov byte [r11 - 0x58], al
movaps xmm0, xmmword [0x1401e5000]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [0x1401e5010]
movaps xmmword [rsp + 0x40], xmm1
movaps xmm0, xmmword [0x1401e5020]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [0x1401e5030]
movaps xmmword [rsp + 0x60], xmm1
movzx eax, byte [0x1401e5040]
mov byte [rsp + 0x70], al
bt r8d, 0
lea r15, [rsp + 0x30]
lea rax, [r11 - 0x98]
cmovae r15, rax
mov r13, qword [rcx + 0x10]
lea rcx, [r13 + 2]
movabs rax, 0x5555555555555556
imul rcx
mov rax, rdx
shr rax, 0x3f
add rdx, rax
shl rdx, 2
xor r8d, r8d
mov rcx, r14
call fcn.140031630
mov dword [rsp + 0x20], 1
mov esi, ebp
mov rax, qword [r14]
test rax, rax
je 0x1400344d7
mov eax, dword [rax]
cmp eax, 1
jle 0x1400344e9
mov r8d, 1
mov rdx, qword [r14 + 0x10]
mov rcx, r14
call fcn.140033020
mov rdi, qword [r14 + 8]
and ebx, 2
test r13, r13
jle 0x1400345d0
lea r9, [0x1401e4f90]
mov rdx, qword [r12 + 8]
mov rax, r9
test rdx, rdx
cmovne rax, rdx
movzx ecx, byte [rax + rsi]
inc rsi
shl ecx, 0x10
cmp rsi, r13
jne 0x140034525
mov ebp, 2
jmp 0x14003455a
mov rax, r9
test rdx, rdx
cmovne rax, rdx
movzx eax, byte [rax + rsi]
inc rsi
shl eax, 8
or ecx, eax
cmp rsi, r13
jne 0x140034547
mov ebp, 1
jmp 0x14003455a
mov rax, r9
test rdx, rdx
cmovne rax, rdx
movzx eax, byte [rax + rsi]
inc rsi
or ecx, eax
mov edx, ecx
shr edx, 6
and edx, 0x3f
mov r8d, ecx
and r8d, 0x3f
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + r15]
mov byte [rdi], al
shr rcx, 0xc
and ecx, 0x3f
movzx eax, byte [rcx + r15]
mov byte [rdi + 1], al
add rdi, 2
cmp rbp, 1
jle 0x1400345a2
test ebx, ebx
jne 0x1400345c7
mov byte [rdi], 0x3d
inc rdi
mov byte [rdi], 0x3d
inc rdi
jmp 0x1400345c7
movzx ecx, byte [rdx + r15]
mov byte [rdi], cl
inc rdi
test rbp, rbp
jle 0x1400345bd
test ebx, ebx
jne 0x1400345c7
mov byte [rdi], 0x3d
inc rdi
jmp 0x1400345c7
movzx ecx, byte [r8 + r15]
mov byte [rdi], cl
inc rdi
cmp rsi, r13
jl 0x140034500
test ebx, ebx
je 0x14003460a
mov rax, qword [r14]
test rax, rax
je 0x1400345e3
mov eax, dword [rax]
cmp eax, 1
jle 0x1400345f5
mov r8d, 1
mov rdx, qword [r14 + 0x10]
mov rcx, r14
call fcn.140033020
sub rdi, qword [r14 + 8]
cmp rdi, qword [r14 + 0x10]
jge 0x14003460a
mov rdx, rdi
mov rcx, r14
call fcn.140033eb0
mov rax, r14
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14016c210
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140042430
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
mov dword [rsp + 0x20], 1
mov rcx, rdx
call fcn.14001d9a0
mov rcx, rax
lea rdx, [rsp + 0xa0]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14, rax
test rax, rax
je 0x1400425e4
movsxd rdx, dword [rsp + 0xa0]
mov rcx, rbx
call fcn.14003d060
movsxd rcx, dword [rsp + 0xa0]
lea rbp, [r14 + rcx*8]
mov rsi, r14
cmp r14, rbp
jae 0x1400425db
mov rdi, qword [rsp + 0x90]
nop dword [rax + rax]
mov r8, 0xffffffffffffffff
mov rdx, qword [rsi]
lea rcx, [rsp + 0x40]
call fcn.140017720
nop
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov eax, dword [rsp + 0x20]
or eax, 0xa
mov dword [rsp + 0x20], eax
test al, 4
je 0x140042535
and dword [rsp + 0x20], 0xfffffffb
test rdi, rdi
je 0x140042535
mov eax, 0xffffffff
lock xadd dword [rdi], eax
cmp eax, 1
jne 0x140042535
mov edx, 2
mov r8d, 8
mov rcx, rdi
call fcn.140030bb0
nop
mov eax, dword [rsp + 0x20]
test al, 2
je 0x140042570
and dword [rsp + 0x20], 0xfffffffd
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140042570
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140042570
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x40]
call fcn.140030bb0
nop
lea r8, [rsp + 0x28]
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.14000ad10
mov rax, qword [rbx]
test rax, rax
je 0x140042590
mov eax, dword [rax]
cmp eax, 1
jle 0x1400425a1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000a560
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400425ce
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400425ce
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x28]
call fcn.140030bb0
add rsi, 8
cmp rsi, rbp
jb 0x1400424c0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, rbx
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400593c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r9d, r9d
mov r10, rcx
sub r10, r8
mov r11d, r9d
cmp rdx, 0x20
jb 0x140059443
mov qword [rsp + 0x10], rbx
lea rbx, [r8 + 0x10]
mov qword [rsp], rdi
mov edi, 0x10
sub rdi, r8
nop dword [rax + rax]
movdqu xmm0, xmmword [rbx + r10 - 0x10]
add r11, 0x20
movdqu xmm2, xmmword [rbx + r10]
lea rbx, [rbx + 0x20]
movdqa xmm1, xmm0
lea rax, [rdi + rbx]
psrlw xmm0, 8
psllw xmm1, 8
xorps xmm1, xmm0
movdqa xmm0, xmm2
psllw xmm0, 8
psrlw xmm2, 8
xorps xmm0, xmm2
movdqu xmmword [rbx - 0x20], xmm0
movdqu xmmword [rbx - 0x30], xmm1
cmp rax, rdx
jbe 0x1400593f0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
lea rax, [r11 + 0x10]
cmp rax, rdx
ja 0x14005946c
movdqu xmm0, xmmword [r11 + rcx]
movdqa xmm1, xmm0
psrlw xmm0, 8
psllw xmm1, 8
xorps xmm1, xmm0
movdqu xmmword [r11 + r8], xmm1
mov r11, rax
cmp r11, rdx
jae 0x14005949a
lea rax, [r11 + r8]
cmp r9, 0x10
jae 0x14005949a
movzx ecx, word [r10 + rax]
add r9, 2
ror cx, 8
mov word [rax], cx
add rax, 2
mov rcx, rax
sub rcx, r8
cmp rcx, rdx
jb 0x140059475
mov rax, rdx
add rsp, 8
ret
Function at 0x140076910
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0xd4], 1
je 0x140076949
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400a0d2d.0]
mov dword [rbx + 0xd4], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140083f10
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x28]
mov rcx, qword [rcx + 0xa8]
test rcx, rcx
jne 0x140083fff
cmp dword [rsi + 0xd0], 0xffffffff
jne 0x140084089
cmp qword [rsi + 0xb0], 0xffffffffffffffff
je 0x140084080
mov rdi, r8
xor r12d, r12d
mov ebx, r12d
nop word [rax + rax]
mov r8d, 0x2000000
cmp rdi, r8
cmovl r8d, edi
lea rdx, [rbx + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x80]
mov rcx, qword [rsi + 0xb0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140083fbd
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x140083fb5
add rbx, rax
sub rdi, rax
cmp rbx, rbp
jl 0x140083f70
mov rax, rbx
jmp 0x140084097
test rbx, rbx
jne 0x140083fb5
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140063d80
nop
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.1400745f0
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140084080
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jmp 0x140084069
call fcn.14017c3f8
mov ecx, eax
call fcn.14017c27c
cmp rax, 0xffffffffffffffff
je 0x140084089
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
add eax, 0xfffffffe
cmp eax, 1
ja 0x140084089
mov rcx, qword [rsi + 0xa8]
call fcn.140179c68
test eax, eax
je 0x140084089
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140063f20
nop
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.1400745f0
nop
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140084080
mov ecx, 0xffffffff
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x140084080
mov r8d, 8
mov edx, 2
mov rcx, qword [rsp + 0x30]
call fcn.140030bb0
mov rax, 0xffffffffffffffff
jmp 0x140084097
mov r8, rbp
mov rdx, r14
mov rcx, rsi
call fcn.140076970
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140076970
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov r15, rdx
mov rbp, rcx
mov r12, qword [rcx + 0x28]
test r8, r8
js 0x140076ac4
xor ebx, ebx
cmp qword [rcx + 0xa8], rbx
je 0x140076a36
nop dword [rax + rax]
mov r8, rsi
sub r8, rbx
lea rcx, [rbx + r15]
mov r9, qword [rbp + 0xa8]
mov edx, 1
call fcn.14017a000
mov rdi, rax
mov rcx, qword [rbp + 0xa8]
call fcn.140179c68
test eax, eax
setne r14b
test eax, eax
je 0x1400769e9
test rdi, rdi
je 0x140076a16
add rbx, rdi
test eax, eax
jne 0x140076a78
test rdi, rdi
jne 0x140076a08
call fcn.140179abc
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x140076a10
xor ecx, ecx
cmp rbx, rsi
setl cl
test ecx, ecx
jne 0x1400769b0
jmp 0x140076a78
mov rcx, qword [rbp + 0xa8]
call fcn.140176410
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0xa8]
call fcn.14017a2e0
jmp 0x140076a78
cmp dword [rcx + 0xd0], 0xffffffff
je 0x140076a8a
nop
mov rax, rsi
sub rax, rbx
mov r8d, 0x7fffffff
cmp rax, r8
cmovb r8d, eax
lea rdx, [rbx + r15]
mov ecx, dword [rbp + 0xd0]
call fcn.14017ad18
movsxd rcx, eax
test eax, eax
jle 0x140076a71
add rbx, rcx
cmp rbx, rsi
jl 0x140076a40
cmp ecx, 0xffffffff
setne r14b
test r14b, r14b
jne 0x140076b16
test rbx, rbx
jne 0x140076b16
mov rbx, 0xffffffffffffffff
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.140063f20
nop
mov r8, rax
mov edx, 1
mov rcx, r12
call fcn.1400745f0
nop
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x140076b16
mov ecx, ebx
lock xadd dword [rax], ecx
cmp ecx, 1
jmp 0x140076aff
mov edx, 0x16
lea rcx, [rsp + 0x20]
call fcn.140063f20
nop
mov r8, rax
mov edx, 1
mov rcx, r12
call fcn.1400745f0
nop
mov rbx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140076b16
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140076b16
mov r8d, 8
mov edx, 2
mov rcx, qword [rsp + 0x20]
call fcn.140030bb0
mov rax, rbx
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400774e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
and dword [rbx + 0x70], 0xfdffffff
cmp dword [rbx + 0xd4], 2
je 0x140077520
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400a0d2d.0]
mov dword [rbx + 0xd4], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400842c0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x28]
cmp qword [rcx + 0xa8], 0
jne 0x1400843c6
cmp dword [rcx + 0xd0], 0xffffffff
jne 0x1400843c6
cmp qword [rcx + 0xb0], 0xffffffffffffffff
je 0x1400843bd
mov rdi, r8
xor r12d, r12d
mov ebx, r12d
nop word [rax + rax]
mov r8d, 0x2000000
cmp rdi, r8
cmovl r8d, edi
lea rdx, [rbx + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x80]
mov rcx, qword [rsi + 0xb0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14008436a
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x140084365
add rbx, rax
sub rdi, rax
cmp rbx, rbp
jl 0x140084320
mov rax, rbx
jmp 0x1400843cb
test rbx, rbx
jne 0x140084365
mov edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140063d80
nop
mov r8, rax
mov edx, 2
mov rcx, r15
call fcn.1400745f0
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400843bd
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400843bd
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x30]
call fcn.140030bb0
mov rax, 0xffffffffffffffff
jmp 0x1400843cb
call fcn.140077540
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140077540
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
mov r14, qword [rcx + 0x28]
test r8, r8
js 0x140077647
xor ebx, ebx
test r8, r8
je 0x14007763e
cmp qword [rcx + 0xa8], rbx
je 0x1400775c4
mov r8, rdi
sub r8, rbx
lea rcx, [rbx + rbp]
mov r9, qword [rsi + 0xa8]
mov edx, 1
call fcn.14017a524
add rbx, rax
test rax, rax
jne 0x1400775b6
call fcn.140179abc
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x1400775be
xor ecx, ecx
cmp rbx, rdi
setl cl
test ecx, ecx
jne 0x140077584
jmp 0x140077600
cmp dword [rcx + 0xd0], 0xffffffff
je 0x140077605
nop dword [rax]
mov rax, rdi
sub rax, rbx
mov r8d, 0x7fffffff
cmp rax, r8
cmovb r8d, eax
lea rdx, [rbx + rbp]
mov ecx, dword [rsi + 0xd0]
call fcn.14017b878
test eax, eax
jle 0x140077600
cdqe
add rbx, rax
cmp rbx, rdi
jl 0x1400775d0
test rbx, rbx
jne 0x14007763e
mov rbx, 0xffffffffffffffff
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.140063f20
mov rdi, rax
call fcn.140179abc
mov edx, 2
mov ecx, 4
cmp dword [rax], 0x1c
cmove edx, ecx
mov r8, rdi
mov rcx, r14
call fcn.1400745f0
nop
jmp 0x14007766f
and dword [rsi + 0x70], 0xffdfffff
jmp 0x140077699
mov edx, 0x16
lea rcx, [rsp + 0x20]
call fcn.140063f20
nop
mov r8, rax
mov edx, 2
mov rcx, r14
call fcn.1400745f0
nop
mov rbx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140077699
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140077699
mov r8d, 8
mov edx, 2
mov rcx, qword [rsp + 0x20]
call fcn.140030bb0
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140079a00
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x50
mov r14, r8
mov rax, rdx
mov rdi, rcx
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.140074f40
nop
mov rcx, rax
call fcn.14001d9a0
mov rbx, rax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140074f40
nop
mov rcx, rax
call fcn.14001d9a0
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test eax, eax
setne dil
mov ebx, 0xffffffff
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x140079a97
mov ecx, ebx
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x140079a97
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.140030bb0
nop
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140079abf
lock xadd dword [rax], ebx
cmp ebx, 1
jne 0x140079abf
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x38]
call fcn.140030bb0
test esi, esi
jne 0x140079add
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x7c], 2
mov rcx, qword [rsp + 0x78]
mov qword [r14], rcx
movzx eax, dil
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x140079dc0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
movzx esi, r8b
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x20], 2
lea rax, [0x140214598]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, 1
lea rdx, [rsp + 0x20]
call fcn.14001c760
mov r14d, 0x5c
test al, al
je 0x140079e32
mov r8d, 1
movzx edx, r14w
mov rcx, rbx
call fcn.140015d60
cmp rax, 3
jle 0x140079fa8
cmp qword [rbx + 0x10], 2
jne 0x140079e48
mov rax, qword [rbx + 8]
cmp word [rax + 2], 0x3a
je 0x140079fa8
mov rdi, 0xffffffffffffffff
test sil, sil
je 0x140079eaf
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140083520
nop
lea rcx, [rsp + 0x20]
call fcn.14001d9a0
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x140079ea4
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x140079ea4
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.140030bb0
test esi, esi
je 0x140079eaf
mov al, 1
jmp 0x140079faa
mov r9d, 1
mov r8, rdi
movzx edx, r14w
mov rcx, rbx
call fcn.140018780
nop
cmp eax, 1
jl 0x140079fa8
movsxd r8, eax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140018810
nop
mov r8b, 1
mov rdx, rbp
lea rcx, [rsp + 0x40]
call fcn.140079dc0
test al, al
je 0x140079f79
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140083520
nop
lea rcx, [rsp + 0x20]
call fcn.14001d9a0
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x140079f47
mov ecx, edi
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x140079f47
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.140030bb0
test esi, esi
je 0x140079f4f
mov bl, 1
jmp 0x140079f7b
mov byte [rsp + 0x98], 0
lea rdx, [rsp + 0x98]
mov rcx, rbx
call fcn.14007c690
test al, al
je 0x140079f79
cmp byte [rsp + 0x98], 0
je 0x140079f79
mov bl, 1
jmp 0x140079f7b
xor bl, bl
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140079fa3
lock xadd dword [rax], edi
cmp edi, 1
jne 0x140079fa3
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x40]
call fcn.140030bb0
movzx eax, bl
jmp 0x140079faa
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14007a260
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rcx
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x28]
call fcn.140012960
nop
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14007a29b
mov eax, dword [rax]
cmp eax, 1
jle 0x14007a2b0
mov r8d, 1
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.140019fd0
mov rdx, qword [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
cmp eax, 0x104
jbe 0x14007a30a
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.14001bf70
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14007a2e6
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x14007a2fb
mov r8d, 1
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.140019fd0
mov rdx, qword [rsp + 0x30]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
cmp ebx, 2
jb 0x14007a353
mov rax, qword [rsp + 0x30]
cmp word [rax + 2], 0x3a
jne 0x14007a353
movzx ecx, word [rax]
call fcn.14001d030
mov esi, eax
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14007a336
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x14007a34b
mov r8d, 1
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.140019fd0
mov rax, qword [rsp + 0x30]
mov word [rax], si
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.14001bf70
movzx r8d, byte [rsp + 0x50]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140074690
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14007a3a0
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14007a3a0
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x28]
call fcn.140030bb0
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14007c690
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2d0
mov rax, qword [0x1419a1b80]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rdi, rdx
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov r8, qword [rcx + 8]
mov qword [rsp + 0x28], r8
mov r9, qword [rcx + 0x10]
mov qword [rsp + 0x30], r9
test rax, rax
je 0x14007c6de
lock inc dword [rax]
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x28]
cmp r9, 2
jne 0x14007c6fb
cmp word [r8 + 2], 0x3a
jne 0x14007c6fb
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call fcn.140013a10
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140083520
nop
lea rcx, [rsp + 0x38]
call fcn.14001d9a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14007c76e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x14007c735
cmp eax, 0x20
jne 0x14007c76e
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x60], xmm0
movq rax, xmm1
test rax, rax
je 0x14007c758
lock inc dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14007b7a0
test al, al
cmovne ebx, dword [rsp + 0x70]
test rdi, rdi
je 0x14007c77b
cmp ebx, 0xffffffff
setne al
mov byte [rdi], al
cmp ebx, 0xffffffff
jne 0x14007c784
xor bl, bl
jmp 0x14007c78a
shr ebx, 4
and bl, 1
mov edi, 0xffffffff
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14007c7ba
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14007c7ba
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x38]
call fcn.140030bb0
nop
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x14007c7e2
lock xadd dword [rax], edi
cmp edi, 1
jne 0x14007c7e2
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.140030bb0
movzx eax, bl
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.14016c210
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2d0
pop rdi
ret
Function at 0x14007def0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
call fcn.140074c90
test al, al
je 0x14007df52
mov qword [rsp + 0x20], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
lea rax, [0x140285bf8]
mov qword [rsp + 0x38], rax
lea rdx, [0x140214b58]
lea rcx, [rsp + 0x20]
call fcn.140022730
call fcn.140179abc
mov dword [rax], 0x16
xor al, al
jmp 0x14007e05d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140074f40
nop
xor edi, edi
mov r9d, 1
xor r8d, r8d
movzx edx, di
mov rcx, rax
call fcn.140017e00
mov rbp, rax
mov ebx, 0xffffffff
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x14007dfa8
mov ecx, ebx
lock xadd dword [rdx], ecx
cmp ecx, 1
jne 0x14007dfa8
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.140030bb0
cmp rbp, 0xffffffffffffffff
je 0x14007dfec
mov qword [rsp + 0x20], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
lea rax, [0x140285bf8]
mov qword [rsp + 0x38], rax
lea rdx, [0x140214b80]
lea rcx, [rsp + 0x20]
call fcn.140022730
call fcn.140179abc
mov dword [rax], 0x16
xor al, al
jmp 0x14007e05d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140074f40
nop
mov rcx, rax
call fcn.14001d9a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test eax, eax
setne sil
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14007e03b
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x14007e03b
mov edx, 2
mov r8d, 8
mov rcx, qword [rsp + 0x20]
call fcn.140030bb0
test edi, edi
jne 0x14007e059
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], 2
mov rcx, qword [rsp + 0x70]
mov qword [r14], rcx
movzx eax, sil
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret