joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141404070
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
movzx edi, cl
mov eax, dword [0x141546030]
cmp eax, 0xffffffff
jne 0x1414040c5
lea rbx, [0x14154bd18]
mov rcx, rbx
call fcn.1413fb8d0
or rbx, 1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x141546030], eax
test bl, 1
je 0x1414040c5
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.1413fbd80
mov eax, dword [0x141546030]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x1414041ca
test dil, dil
je 0x1414041ca
lea ecx, [rax + 0x78]
call fcn.1414c4ae4
mov qword [rsp + 0x78], rax
lea edx, [rsi + 1]
mov rcx, rax
call fcn.141405610
mov rsi, rax
mov qword [rsp + 0x88], rax
mov rdx, rax
mov ecx, dword [0x141546030]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov ecx, 0x10
call fcn.1414c4ae4
mov qword [rsp + 0x78], rax
mov rdx, rsi
mov rcx, rax
call fcn.1414054f0
nop
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsi + 0x38], rax
mov rcx, rsi
call fcn.141405b80
mov byte [rsi + 0x72], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
mov qword [rsi + 0x40], rax
mov rax, qword [0x14154bbb8]
test rax, rax
jne 0x141404175
mov rax, qword [rsi + 0x38]
mov qword [0x14154bbb8], rax
jmp 0x1414041ca
mov qword [rsp + 0x78], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
xor eax, eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x78]
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rsi + 0x38]
mov rcx, qword [rsp + 0x78]
call fcn.1414049d0
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1414049d0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rsi, rdx
mov rdi, rcx
lea rbx, [0x14154bd10]
mov rcx, rbx
call fcn.1413fb8d0
or rbx, 1
mov qword [rsp + 0x60], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x14154bcf8]
jne 0x141404a23
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x141404b63
mov rax, qword [0x141546038]
mov r8d, dword [rax + 8]
btr r8d, 0x1f
movsxd rdx, dword [rax + 4]
lea ecx, [rdx + 1]
cmp dword [rax], 1
ja 0x141404a46
cmp r8d, ecx
jb 0x141404a49
jmp 0x141404a6e
cmp r8d, ecx
sbb r9d, r9d
and r9d, 8
cmp ecx, r8d
cmova r8d, ecx
lea rcx, [0x141546038]
call fcn.141404d20
mov rax, qword [0x141546038]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea rdx, [rcx + rdx*8]
mov qword [rdx + rax], rdi
mov rax, qword [0x141546038]
inc dword [rax + 4]
mov rax, qword [0x141546040]
mov r8d, dword [rax + 8]
btr r8d, 0x1f
movsxd rdx, dword [rax + 4]
lea ecx, [rdx + 1]
cmp dword [rax], 1
ja 0x141404aa7
cmp r8d, ecx
jb 0x141404aaa
jmp 0x141404acf
cmp r8d, ecx
sbb r9d, r9d
and r9d, 8
cmp ecx, r8d
cmova r8d, ecx
lea rcx, [0x141546040]
call fcn.141404b90
mov rax, qword [0x141546040]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea rdx, [rcx + rdx*8]
mov qword [rdx + rax], rsi
mov rax, qword [0x141546040]
inc dword [rax + 4]
cmp dword [0x14154bcf8], 0
jne 0x141404b55
cmp qword [0x14154bd00], 0
jne 0x141404b22
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14154bd00], rax
lea rdx, [0x14154bd00]
lea rcx, [0x141546038]
call fcn.1414043e0
lea rax, [0x14154bcf8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1414044d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x141404b63
mov rcx, qword [0x14154bd00]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
test bl, 1
je 0x141404b74
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.1413fbd80
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x141405440
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 8]
mov rsi, rcx
lea rbx, [rdi + 0x70]
test rbx, rbx
je 0x14140527b
mov rcx, rbx
call fcn.1413fb8d0
or rbx, 1
cmp byte [rdi + 0x7c], 0
je 0x1414052ac
cmp byte [rdi + 0xa0], 0
jne 0x141405293
mov byte [rdi + 0xa1], 1
jmp 0x1414052ac
mov rcx, qword [rdi + 0x90]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
mov rcx, rsi
call fcn.141404200
test bl, 1
je 0x1414052bd
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.1413fbd80
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test edx, edx
jne 0x14140549a
cmp r8d, 5
ja case.default.0x141405463
movsxd rax, r8d
lea r8, [0x140000000]
mov edx, dword [r8 + rax*4 + 0x14054d0]
add rdx, r8
jmp rdx
movzx edx, byte [rsp + 0x10]
jmp fcn.141405ff0
movzx edx, byte [rsp + 0x10]
jmp fcn.141405db0
mov rax, qword [r9 + 8]
mov edx, dword [rax]
jmp fcn.141404eb0
mov edx, 7
jmp fcn.141404eb0
jmp 0x141405250
xor edx, edx
jmp fcn.141405ce0
cmp edx, 0xa
jne case.default.0x141405463
mov rax, qword [r9 + 8]
mov rcx, qword [r9]
mov rdx, qword [rax]
lea rax, [fcn.141405ff0]
cmp rdx, rax
jne 0x1414054bc
mov dword [rcx], 0
ret
lea rax, [fcn.141405db0]
cmp rdx, rax
jne case.default.0x141405463
mov dword [rcx], 1
ret
Function at 0x141413a00
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rbp, r8
mov r12, rdx
mov rsi, rcx
mov r13, qword [rcx + 0x18]
test r8, r8
js 0x141413b6a
xor ebx, ebx
cmp qword [rcx + 0x78], rbx
je 0x141413ad8
mov r15b, 1
nop dword [rax]
nop word [rax + rax]
mov r8, rbp
sub r8, rbx
lea rcx, [rbx + r12]
mov r9, qword [rsi + 0x78]
mov edx, 1
call fcn.1414f0b60
mov rdi, rax
mov rcx, qword [rsi + 0x78]
call fcn.1414f07d0
test eax, eax
setne r14b
test r15b, r15b
je 0x141413aa6
test r14b, r14b
je 0x141413aa6
test rdi, rdi
jne 0x141413aa6
mov rcx, qword [rsi + 0x78]
call fcn.1414ecd00
mov rdx, rax
xor r8d, r8d
mov rcx, qword [rsi + 0x78]
call fcn.1414e87a8
xor r15b, r15b
jmp 0x141413aa9
add rbx, rdi
test r14b, r14b
jne 0x141413bc6
test rdi, rdi
jne 0x141413ac6
call fcn.1414e8148
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x141413ace
xor ecx, ecx
cmp rbx, rbp
setl cl
test ecx, ecx
jne 0x141413a50
jmp 0x141413b20
cmp dword [rcx + 0xa0], 0xffffffff
je 0x141413b29
mov rax, rbp
sub rax, rbx
mov r8d, 0x7fffffff
cmp rax, r8
cmovb r8d, eax
lea rdx, [rbx + r12]
mov ecx, dword [rsi + 0xa0]
call fcn.1414f132c
movsxd rcx, eax
test eax, eax
jle 0x141413b12
add rbx, rcx
cmp rbx, rbp
jl 0x141413ae1
cmp ecx, 0xffffffff
setne al
test al, al
jne 0x141413bc6
test rbx, rbx
jne 0x141413bc6
or rbx, 0xffffffffffffffff
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.1413fb150
nop
mov r8, rax
lea edx, [rbx + 2]
mov rcx, r13
call fcn.141411d80
nop
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx]
test eax, eax
je 0x141413bb7
cmp eax, ebx
je 0x141413bc6
mov edx, ebx
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x141413bc6
mov rcx, qword [rsp + 0x70]
jmp 0x141413bb7
mov edx, 0x16
lea rcx, [rsp + 0x80]
call fcn.1413fb150
nop
mov r8, rax
mov edx, 1
mov rcx, r13
call fcn.141411d80
nop
mov rcx, qword [rsp + 0x80]
mov eax, dword [rcx]
or rbx, 0xffffffffffffffff
test eax, eax
je 0x141413bb7
cmp eax, ebx
je 0x141413bc6
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141413bc6
mov rcx, qword [rsp + 0x80]
mov r8d, 8
lea edx, [r8 - 6]
call fcn.1413e6510
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x141414180
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rbp
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
mov r14, qword [rcx + 0x18]
test r8, r8
js 0x1414142b3
xor ebx, ebx
test r8, r8
je 0x1414142aa
cmp qword [rcx + 0x78], rbx
je 0x14141420d
nop dword [rax]
nop word [rax + rax]
mov r8, rdi
sub r8, rbx
lea rcx, [rbx + rbp]
mov r9, qword [rsi + 0x78]
mov edx, 1
call fcn.1414e800c
add rbx, rax
test rax, rax
jne 0x1414141ff
call fcn.1414e8148
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x141414207
xor ecx, ecx
cmp rbx, rdi
setl cl
test ecx, ecx
jne 0x1414141d0
jmp 0x141414250
cmp dword [rcx + 0xa0], 0xffffffff
je 0x141414255
nop word [rax + rax]
mov rax, rdi
sub rax, rbx
mov r8d, 0x7fffffff
cmp rax, r8
cmovb r8d, eax
lea rdx, [rbx + rbp]
mov ecx, dword [rsi + 0xa0]
call fcn.1414f1e4c
test eax, eax
jle 0x141414250
cdqe
add rbx, rax
cmp rbx, rdi
jl 0x141414220
test rbx, rbx
jne 0x1414142aa
or rbx, 0xffffffffffffffff
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.1413fb150
mov rdi, rax
call fcn.1414e8148
mov edx, 2
mov ecx, 4
cmp dword [rax], 0x1c
cmove edx, ecx
mov r8, rdi
mov rcx, r14
call fcn.141411d80
nop
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx]
test eax, eax
je 0x1414142f7
cmp eax, ebx
je 0x141414306
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141414306
mov rcx, qword [rsp + 0x50]
jmp 0x1414142f7
and dword [rsi + 0x40], 0xffdfffff
jmp 0x141414306
mov edx, 0x16
lea rcx, [rsp + 0x60]
call fcn.1413fb150
nop
mov r8, rax
mov edx, 2
mov rcx, r14
call fcn.141411d80
nop
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx]
or rbx, 0xffffffffffffffff
test eax, eax
je 0x1414142f7
cmp eax, ebx
je 0x141414306
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141414306
mov rcx, qword [rsp + 0x60]
mov r8d, 8
lea edx, [r8 - 6]
call fcn.1413e6510
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x141415cb0
Capabilities:
Copy file

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov r14, r8
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.141412710
mov rsi, rax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.141412710
mov rdi, rax
mov rcx, rsi
call fcn.1413db220
mov rbx, rax
mov rcx, rdi
call fcn.1413db220
mov rcx, rax
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx]
or ebx, 0xffffffff
test eax, eax
je 0x141415d44
cmp eax, ebx
je 0x141415d53
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141415d53
mov rcx, qword [rsp + 0x58]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x141415d71
cmp eax, 0xffffffff
je 0x141415d7f
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x141415d7f
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
test dil, dil
jne 0x141415d9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], 2
mov rcx, qword [rsp + 0x58]
mov qword [r14], rcx
movzx eax, dil
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x141416170
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x198]
sub rsp, 0x280
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x141548130]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rdi, rcx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
lea rax, [0x140036840]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
or rbx, 0xffffffffffffffff
test eax, eax
je 0x1414162cd
cmp esi, 0x104
jbe 0x141416275
mov eax, 2
mul rsi
cmovo rax, rbx
mov rcx, rax
call fcn.1414c53a4
mov r15, rax
mov rdx, rax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14141626b
mov r8d, esi
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.1413c12d0
mov rdx, rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x50], rcx
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov qword [rdx], rcx
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x14141625d
cmp eax, ebx
je 0x14141626b
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14141626b
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
mov rcx, r15
call fcn.1414c4b20
jmp 0x1414162cd
mov r8d, esi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.1413c12d0
mov rdx, rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov qword [rdx], rcx
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
test eax, eax
je 0x1414162bf
cmp eax, 0xffffffff
je 0x1414162cd
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1414162cd
mov rcx, qword [rsp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 4]
cmp ecx, 2
jl 0x141416350
cmp ecx, 1
jle 0x1414162e9
mov rcx, qword [rax + 0x10]
movzx r14d, word [rcx + rax + 2]
cmp r14w, 0x3a
jne 0x141416350
mov rcx, qword [rax + 0x10]
movzx ecx, word [rax + rcx]
call fcn.1413da690
mov esi, eax
mov rax, qword [rsp + 0x20]
mov edx, dword [rax + 4]
test edx, edx
jg 0x141416328
mov eax, 0x20
mov word [rsp + 0x28], ax
movzx r8d, ax
lea edx, [rax - 0x1f]
lea rcx, [rsp + 0x20]
call fcn.1413d94b0
jmp 0x141416343
cmp dword [rax], 1
ja 0x141416334
cmp qword [rax + 0x10], 0x18
je 0x141416348
inc edx
xor r8d, r8d
lea rcx, [rsp + 0x20]
call fcn.1413d7ac0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x10]
mov word [rax + rcx], si
movzx r8d, byte [rsp + 0x28]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.141411ee0
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x141416382
cmp eax, 0xffffffff
je 0x141416390
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x141416390
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1414c4ac0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x141418010
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x2b0], rbx
mov rax, qword [0x141548130]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rdx
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov ecx, dword [rax]
inc ecx
cmp ecx, 1
jbe 0x141418058
lock inc dword [rax]
mov rax, qword [rsp + 0x20]
mov r8d, dword [rax + 4]
cmp r8d, 2
jne 0x1414180ce
mov rcx, qword [rax + 0x10]
cmp word [rcx + rax + 2], 0x3a
jne 0x1414180ce
cmp dword [rax], 1
ja 0x141418082
mov edx, dword [rax + 8]
btr edx, 0x1f
lea ecx, [r8 + 2]
cmp ecx, edx
jbe 0x141418098
lea edx, [r8 + 2]
mov r8b, 1
lea rcx, [rsp + 0x20]
call fcn.1413d7ac0
mov rax, qword [rsp + 0x20]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea r8, [rcx + rdx*2]
mov ecx, 0x5c
mov word [r8 + rax], cx
mov rax, qword [rsp + 0x20]
inc dword [rax + 4]
mov rax, qword [rsp + 0x20]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea r8, [rcx + rdx*2]
xor ecx, ecx
mov word [r8 + rax], cx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.141434ad0
nop
lea rcx, [rsp + 0x28]
call fcn.1413db220
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x141418134
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x141418108
cmp eax, 0x20
jne 0x141418134
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rax]
inc ecx
cmp ecx, 1
jbe 0x14141811e
lock inc dword [rax]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.141417460
test al, al
cmovne ebx, dword [rsp + 0x40]
test rdi, rdi
je 0x141418141
cmp ebx, 0xffffffff
setne al
mov byte [rdi], al
cmp ebx, 0xffffffff
jne 0x14141814a
xor bl, bl
jmp 0x141418150
shr ebx, 4
and bl, 1
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx]
or edi, 0xffffffff
test eax, eax
je 0x141418172
cmp eax, edi
je 0x141418181
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141418181
mov rcx, qword [rsp + 0x28]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14141819f
cmp eax, 0xffffffff
je 0x1414181ad
lock xadd dword [rcx], edi
cmp edi, 1
jne 0x1414181ad
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
movzx eax, bl
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1414c4ac0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x2a0
pop rdi
ret
Function at 0x141418720
Capabilities:
Create shortcut via ishelllink

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x4e0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x510], rbx
mov rax, qword [0x141548130]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x38], 0
lea rax, [0x140036840]
mov qword [rcx], rax
mov dword [rsp + 0x38], 1
xor sil, sil
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x1401541e8]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140154238]
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, 0x800401f0
jne 0x1414187d0
mov sil, 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x1401541e8]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140154238]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1414188ec
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
lea rdx, [0x140154228]
call qword [rax]
test eax, eax
js 0x1414188e1
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.141412710
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov rbx, qword [rax]
call fcn.1413db220
mov rdx, rax
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [rbx + 0x28]
mov ebp, eax
mov rcx, qword [rsp + 0x48]
mov edx, dword [rcx]
or ebx, 0xffffffff
test edx, edx
je 0x141418845
cmp edx, ebx
je 0x141418853
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141418853
mov rcx, qword [rsp + 0x48]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
test ebp, ebp
js 0x1414188d6
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 2
lea r9, [rsp + 0x70]
mov r8d, 0x104
lea rdx, [rsp + 0x2c0]
call qword [rax + 0x18]
test eax, eax
jne 0x1414188d6
mov r8d, ebx
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x50]
call fcn.1413c12d0
mov rdx, rax
mov rcx, qword [rdi]
mov qword [rsp + 0x68], rcx
mov rax, qword [rax]
mov qword [rdi], rax
mov qword [rdx], rcx
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx]
test eax, eax
je 0x1414188c8
cmp eax, 0xffffffff
je 0x1414188d6
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x1414188d6
mov rcx, qword [rsp + 0x50]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test sil, sil
je 0x1414188f7
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, rdi
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.1414c4ac0
mov rbx, qword [rsp + 0x510]
add rsp, 0x4e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x141419270
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rdi, rdx
lea rdx, [rsp + 0x50]
call fcn.141412710
nop
mov rcx, rax
call fcn.1413db220
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx]
test eax, eax
je 0x1414192c9
cmp eax, 0xffffffff
je 0x1414192d7
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jne 0x1414192d7
mov rcx, qword [rsp + 0x50]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
test bl, bl
jne 0x1414192f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], 2
mov rcx, qword [rsp + 0x50]
mov qword [rdi], rcx
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x141419310
Capabilities:
Move file

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov r14, r8
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.141412710
mov rsi, rax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.141412710
mov rdi, rax
mov rcx, rsi
call fcn.1413db220
mov rbx, rax
mov rcx, rdi
call fcn.1413db220
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx]
or ebx, 0xffffffff
test eax, eax
je 0x14141939e
cmp eax, ebx
je 0x1414193ad
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1414193ad
mov rcx, qword [rsp + 0x58]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x1414193cb
cmp eax, 0xffffffff
je 0x1414193d9
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x1414193d9
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
test dil, dil
jne 0x1414193f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], 2
mov rcx, qword [rsp + 0x58]
mov qword [r14], rcx
movzx eax, dil
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x141419420
Capabilities:
Move file

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov r14, r8
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.141412710
mov rsi, rax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.141412710
mov rdi, rax
mov rcx, rsi
call fcn.1413db220
mov rbx, rax
mov rcx, rdi
call fcn.1413db220
mov rcx, rax
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx]
or ebx, 0xffffffff
test eax, eax
je 0x1414194b4
cmp eax, ebx
je 0x1414194c3
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1414194c3
mov rcx, qword [rsp + 0x58]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x1414194e1
cmp eax, 0xffffffff
je 0x1414194ef
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x1414194ef
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
test dil, dil
jne 0x14141950e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], 2
mov rcx, qword [rsp + 0x58]
mov qword [r14], rcx
movzx eax, dil
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x141419530
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.141434ad0
nop
mov rcx, rax
call fcn.1413db220
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx]
test eax, eax
je 0x141419584
cmp eax, 0xffffffff
je 0x141419592
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jne 0x141419592
mov rcx, qword [rsp + 0x48]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1413e6510
movzx eax, bl
add rsp, 0x30
pop rbx
ret