joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov eax, edx
mov rdi, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x110]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rdi + 0x60], ymm0
vmovups ymmword [rdi + 0x40], ymm0
vmovups ymmword [rdi + 0x20], ymm0
vmovups ymmword [rdi], ymm0
mov qword [rdi + 0x80], 0
vmovups ymm0, ymmword [rdx + 0x18]
vmovups ymmword [rdi + 0x58], ymm0
mov r10, qword [rdx + 0x38]
mov qword [rdi + 0x78], r10
test r8b, r8b
je 0x14001d6dc
mov byte [rdi + 0x80], 2
test byte [rdx + 0x52], 2
jne 0x14001d6e9
jmp 0x14001d710
mov byte [rdi + 0x80], 1
test byte [rdx + 0x52], 2
je 0x14001d720
cmp qword [rdx + 0x10], 5
jne 0x14001d70b
mov r10, qword [rdx + 8]
mov r11d, 0x646f6323
xor r11d, dword [r10]
movzx r10d, byte [r10 + 4]
xor r10d, 0x65
or r10d, r11d
je 0x14001d751
test r8b, r8b
je 0x14001d720
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x28], al
mov byte [rsp + 0x30], 1
jmp 0x14001d72e
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x28], al
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
mov r8, rsi
vzeroupper
call fcn.1400224b0
nop
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
vzeroupper
ret
mov rbx, qword [rdx]
movzx eax, word [rbx + 0x50]
test eax, 0x104
je 0x14001d873
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0x3000000
lea rcx, [rsp + 0x58]
mov rax, qword [0x1400e47f8]
mov edx, dword [rax + 0x3c]
mov r8d, dword [rax + 0x40]
vzeroupper
call fcn.1400135e0
mov dword [rsp + 0x68], 0
mov rax, qword [0x1400e47f8]
mov ecx, dword [rax + 0x3c]
mov dword [rsp + 0x6c], ecx
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x78], xmm0
vmovups xmmword [rsp + 0x88], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x98], rax
mov rax, qword [rbx + 0x38]
mov qword [rsp + 0xc0], rax
vmovups ymm0, ymmword [rbx + 0x18]
vmovups ymmword [rsp + 0xa0], ymm0
mov byte [rsp + 0xc8], 2
vmovups ymm0, ymmword [rsp + 0x48]
vmovups ymmword [rdi], ymm0
mov eax, dword [rsp + 0x68]
mov dword [rdi + 0x20], eax
mov eax, dword [rsp + 0x6c]
mov dword [rdi + 0x24], eax
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x28], rax
vmovups xmm0, xmmword [rsp + 0x78]
vmovups xmmword [rdi + 0x30], xmm0
mov rax, qword [rsp + 0xc8]
mov qword [rdi + 0x80], rax
vmovups xmm0, xmmword [rsp + 0xa8]
vmovups xmmword [rdi + 0x60], xmm0
mov rax, qword [rsp + 0xb8]
mov qword [rdi + 0x70], rax
mov rax, qword [rsp + 0xc0]
mov qword [rdi + 0x78], rax
vmovups ymm0, ymmword [rsp + 0x88]
vmovups ymmword [rdi + 0x40], ymm0
mov rcx, qword [rbx + 0x40]
mov al, 1
cmp rcx, rsi
je 0x14001d88a
mov rcx, qword [rcx]
cmp rcx, rsi
je 0x14001d88a
lea rdx, str.This_is_unexpected._Did_you_forget_a___or_a___
jmp 0x14001d880
lea rax, str.code_is_used_like_this:_ncode:_a__2__or_code__a__2__
mov rcx, rdx
mov rdx, rax
vzeroupper
call fcn.140011a10
xor eax, eax
jmp 0x14001d742
Function at 0x14004aaf0
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
mov rax, qword [0x1400e46d0]
movsxd rcx, dword [0x1400e46dc]
lea rcx, [rcx + rcx*4]
lea rcx, [rax + rcx*8]
mov qword [rsp + 0x30], rcx
cmp rax, rcx
jae 0x14004ade8
mov rcx, qword [0x1400e4660]
mov qword [rsp + 8], rcx
mov edx, dword [0x1400e4668]
mov rcx, qword [0x1400e45f0]
mov qword [rsp], rcx
mov edi, dword [0x1400e45f8]
mov rbx, qword [0x1400e4628]
mov ebp, dword [0x1400e4630]
lea r9, [0x1400b2ab0]
lea r10, [0x1400b2a9c]
lea r11, [0x1400b2a88]
lea ebx, [0x1400b2a88]
Function at 0x14006b2e0
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
lock and byte [rcx + 0x451d], 0xfd
mov cl, 1
nop word cs:[rax + rax]
movzx eax, byte [rsi + 0x451c]
test al, al
jne 0x14006b300
xor eax, eax
lock cmpxchg byte [rsi + 0x451c], cl
je 0x14006b31b
pause
jmp 0x14006b300
mov rax, qword [rsi + 0x20]
cmp rax, 0xffffffffffffffff
je 0x14006b401
mov rcx, qword [rsi + 0x18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov rax, qword [rsi + 0x48]
mov rax, qword [rsi + 0x48]
cmp rax, 0xffffffffffffffff
je 0x14006b34d
mov rcx, qword [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_ClosePseudoConsole]
mov rax, qword [rsi + 0x30]
cmp rax, 0xffffffffffffffff
je 0x14006b361
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x38]
cmp rax, 0xffffffffffffffff
je 0x14006b375
mov rcx, qword [rsi + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x40]
cmp rax, 0xffffffffffffffff
je 0x14006b389
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x18]
cmp rax, 0xffffffffffffffff
je 0x14006b39d
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x20]
cmp rax, 0xffffffffffffffff
je 0x14006b3bd
mov rcx, qword [rsi + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x18], 0xffffffffffffffff
mov qword [rsi + 0x20], 0xffffffffffffffff
mov qword [rsi + 0x30], 0xffffffffffffffff
mov qword [rsi + 0x38], 0xffffffffffffffff
mov qword [rsi + 0x40], 0xffffffffffffffff
mov qword [rsi + 0x48], 0xffffffffffffffff
mov rax, qword [rsi + 0x4500]
test rax, rax
je 0x14006b401
lock and byte [rax + 0x122], 0xf7
xor eax, eax
xchg byte [rsi + 0x451c], al
add rsp, 0x20
pop rsi
ret
Function at 0x14006c440
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov r10, qword [rsi]
mov r8, qword [rsi + 8]
lea rdx, [r10 + r8]
vbroadcastss ymm0, dword [0x1400aa048]
vmovups ymmword [rsp + 0x50], ymm0
vbroadcastss ymm0, dword [0x1400aa04c]
vmovups ymmword [rsp + 0x30], ymm0
vlddqu ymm0, ymmword [rsp + 0x50]
vlddqu ymm1, ymmword [rsp + 0x30]
mov r9, rdx
and r9, 0xffffffffffffffe0
cmp r8, 0x20
cmovl r9, r10
mov esi, 1
cmp r10, r9
jb 0x14006c553
mov r8, r10
cmp r8, rdx
jb 0x14006c4fe
imul rax, rax, 0xf4240
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x14006c5c7
xor edx, edx
div rcx
mov rdi, rax
jmp 0x14006c5cd
inc r8
mov r9, r8
mov r8, r9
cmp r9, rdx
jae 0x14006c4c3
movzx r9d, byte [r8]
cmp r9d, 0xd
je 0x14006c520
cmp r9d, 0xa
jne 0x14006c4f0
inc esi
jmp 0x14006c4f0
inc esi
lea r9, [r8 + 1]
cmp r9, rdx
jae 0x14006c4f6
cmp byte [r8 + 1], 0xa
jne 0x14006c4f6
add r8, 2
jmp 0x14006c4f3
add r10, 0x20
mov r8, r10
mov r10, r8
cmp r8, r9
jae 0x14006c4be
vlddqu ymm2, ymmword [r10]
vpcmpeqb ymm3, ymm2, ymm0
vpcmpeqb ymm2, ymm2, ymm1
vpor ymm2, ymm3, ymm2
vpmovmskb r8d, ymm2
test r8d, r8d
je 0x14006c540
mov r8, r10
jmp 0x14006c58f
mov r8, r11
nop word cs:[rax + rax]
inc r8
mov r11d, r8d
sub r11d, r10d
test r11b, 0x1f
je 0x14006c547
cmp r8, r9
jae 0x14006c547
movzx r11d, byte [r8]
cmp r11d, 0xd
je 0x14006c5b0
cmp r11d, 0xa
jne 0x14006c580
inc esi
jmp 0x14006c580
inc esi
lea r11, [r8 + 1]
cmp r11, rdx
jae 0x14006c580
cmp byte [r8 + 1], 0xa
je 0x14006c572
mov r11, r8
jmp 0x14006c572
xor edx, edx
div ecx
mov edi, eax
lea rcx, [rsp + 0x28]
vzeroupper
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
imul rax, qword [rsp + 0x28], 0xf4240
mov rcx, qword [rsp + 0x20]
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x14006c607
xor edx, edx
div rcx
jmp 0x14006c60b
xor edx, edx
div ecx
sub rax, rdi
add qword [0x1400f2010], rax
mov eax, esi
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14006f5e0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov ebp, r9d
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test al, al
je 0x14006f770
cmp dword [rsp + 0x38], 0
je 0x14006f77e
mov cl, 1
nop
movzx eax, byte [rsi + 0x120]
test al, al
jne 0x14006f640
xor eax, eax
lock cmpxchg byte [rsi + 0x120], cl
je 0x14006f65b
pause
jmp 0x14006f640
lea rcx, [rsi + 0x40]
mov eax, dword [rsi + 0x4c]
mov edx, dword [rsp + 0x38]
add eax, edx
cmp eax, 0x100000
jb 0x14006f6b2
mov dword [rsi + 0x4c], 0
mov qword [rsi + 0xb8], 0
mov dword [rsi + 0x84], 0
mov byte [rsi + 0x121], 1
vmovups xmm0, xmmword [0x1400a8bd0]
vmovups xmmword [rsi + 0xdc], xmm0
vmovups xmm0, xmmword [0x1400a8bc0]
vmovups xmmword [rsi + 0xcc], xmm0
call fcn.1400018f0
mov dword [rsp + 0x3c], 0
mov r8d, dword [rsp + 0x38]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test dil, dil
je 0x14006f786
mov eax, dword [rsp + 0x3c]
sub eax, dword [rsp + 0x38]
add dword [rsi + 0x4c], eax
mov eax, dword [rsi + 0x4c]
cmp eax, 0x100000
jb 0x14006f78d
movsxd r8, dword [rsi + 0x4c]
lea r14d, [r8 - 0x100000]
mov rcx, qword [rsi + 0x40]
movsxd rax, dword [rsi + 0x48]
imul r8, rax
add r8, rcx
mov rdx, r14
imul rdx, rax
add rdx, rcx
sub r8, rdx
call fcn.140091e40
sub dword [rsi + 0x4c], r14d
mov qword [rsi + 0xb8], 0
mov dword [rsi + 0x84], 0
mov byte [rsi + 0x121], 1
vmovups xmm0, xmmword [0x1400a8bd0]
vmovups xmmword [rsi + 0xdc], xmm0
vmovups xmm0, xmmword [0x1400a8bc0]
vmovups xmmword [rsi + 0xcc], xmm0
jmp 0x14006f78d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
setne bl
jmp 0x14006f7d2
test bpl, bpl
sete bl
jmp 0x14006f7d2
mov eax, dword [rsp + 0x38]
sub dword [rsi + 0x4c], eax
test bl, bl
je 0x14006f799
lock or byte [rsi + 0x122], 2
test dil, dil
setne bl
mov rcx, rsi
call fcn.14006f390
mov rcx, qword [0x1400f2098]
xor edi, edi
mov edx, 0x400
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_PostMessageW]
lock or byte [rsi + 0x122], 4
add bl, bl
xchg byte [rsi + 0x120], dil
mov eax, ebx
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140074de0
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x40
mov byte [0x1400edb73], 0
cmp byte [0x1400edb71], 0
jne 0x140074e02
jmp 0x140074e0d
pause
movzx eax, byte [0x1400edb72]
test al, al
je 0x140074e00
mov byte [0x1400edb73], 1
mov byte [0x1400edb72], 0
cmp byte [0x1400edb71], 4
jne 0x140074e5c
vmovups xmm0, xmmword [0x1400a89f0]
vmovaps xmmword [rsp + 0x30], xmm0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x140074270]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
jmp 0x140074eaf
mov eax, dword [0x140178928]
mov rcx, qword [0x140178c28]
movsxd rdx, dword [0x140178c30]
imul rdx, rax
mov rsi, qword [rcx + rdx + 0x38]
vmovups xmm0, xmmword [0x1400a89f0]
vmovaps xmmword [rsp + 0x30], xmm0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1400745c0]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x140074ec5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
add rsp, 0x40
pop rsi
ret
Function at 0x140075a00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
imul rax, qword [rsp + 0x30], 0xf4240
mov rcx, qword [rsp + 0x28]
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x140075a53
xor edx, edx
div rcx
mov r15, rax
jmp 0x140075a5a
xor edx, edx
div ecx
mov r15d, eax
mov r8, qword [r14 + 0x4598]
mov ecx, dword [r14 + 0x45a0]
mov eax, dword [r14 + 0x45a4]
mov edx, eax
imul edx, ecx
movsxd rdx, edx
add rdx, r8
cmp r8, rdx
jae 0x140075aee
mov r12, r8
jmp 0x140075aa4
add r12, 0x48
mov edx, ecx
imul edx, eax
movsxd rdx, edx
add rdx, r8
cmp r12, rdx
jae 0x140075aee
mov rdx, r15
sub rdx, qword [r12 + 8]
cmp rdx, 0x23c34601
jb 0x140075a90
imul eax, ecx
cdqe
add r8, rax
movsxd rdx, ecx
add rdx, r12
sub r8, rdx
mov rcx, r12
call fcn.140091e40
mov eax, dword [r14 + 0x45a4]
dec eax
mov dword [r14 + 0x45a4], eax
mov r8, qword [r14 + 0x4598]
mov ecx, dword [r14 + 0x45a0]
jmp 0x140075a94
mov rdx, qword [r14 + 0x4458]
mov r9, qword [r14 + 0x4460]
cmp rdx, rbx
cmovge rdx, rbx
lea r10, [rdi + rbx]
cmp r9, r10
cmovg r10, r9
mov qword [r14 + 0x4458], rdx
mov qword [r14 + 0x4460], r10
cmp eax, dword [r14 + 0x45a8]
jne 0x140075b46
lea rcx, [r14 + 0x4598]
call fcn.140001620
mov eax, dword [r14 + 0x45a4]
mov r8, qword [r14 + 0x4598]
mov ecx, dword [r14 + 0x45a0]
mov r12, qword [rsp + 0x90]
imul ecx, eax
movsxd r15, ecx
add r15, r8
inc eax
mov dword [r14 + 0x45a4], eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
imul rax, qword [rsp + 0x30], 0xf4240
mov rcx, qword [rsp + 0x28]
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x140075b97
xor edx, edx
div rcx
jmp 0x140075b9b
xor edx, edx
div ecx
mov qword [r15 + 8], rax
mov byte [r15], 3
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], rbx
mov qword [r15 + 0x20], rdi
vmovups ymm0, ymmword [rsi]
vmovups ymmword [r15 + 0x28], ymm0
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
vzeroupper
ret
Function at 0x140082f20
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov ebx, ecx
cmp cl, 8
jne 0x140082f45
mov rax, qword [0x1400c5c48]
test al, 0x40
jne 0x140082f45
xor esi, esi
jmp 0x140083126
mov edi, dword [0x140178928]
inc edi
mov eax, dword [0x140178c34]
cmp edi, eax
cmovae edi, eax
cmp eax, dword [0x140178c38]
jne 0x140082f72
lea rcx, [0x140178c28]
call fcn.140001620
mov eax, dword [0x140178c34]
mov r14, qword [0x140178c28]
movsxd rdx, dword [0x140178c30]
mov r15, rdx
imul r15, rdi
lea rsi, [r14 + r15]
lea rcx, [rsi + rdx]
movsxd r8, eax
sub r8, rdi
imul r8, rdx
mov rdx, rsi
call fcn.140091e40
inc dword [0x140178c34]
movsxd r8, dword [0x140178c30]
xor ebp, ebp
mov rcx, rsi
xor edx, edx
call fcn.1400924f0
mov dword [r14 + r15 + 0x10], edi
mov byte [r14 + r15 + 0x34], bl
mov eax, dword [0x140181a58]
mov dword [r14 + r15 + 0x14], eax
inc eax
mov dword [0x140181a58], eax
mov rax, qword [0x140178c28]
movsxd rcx, dword [0x140178c34]
imul rcx, rcx, 0x248
add rcx, rax
cmp rax, rcx
jae 0x140083017
nop word cs:[rax + rax]
lea rdx, [rax + 0x48]
mov qword [rax], rdx
mov dword [rax + 0x10], ebp
inc ebp
add rax, 0x248
cmp rax, rcx
jb 0x140083000
cmp bl, 2
jne 0x140083085
mov r8d, dword [0x140178928]
mov eax, dword [0x140178c34]
dec eax
lea rcx, [0x1400edbf8]
cmp r8d, eax
jae 0x1400830f5
mov rax, qword [0x140178c28]
movsxd rdx, dword [0x140178c30]
imul rdx, r8
movzx r8d, byte [rax + rdx + 0x34]
cmp r8d, 2
je 0x1400830ec
cmp r8d, 1
jne 0x1400830f5
mov rax, qword [rax + rdx + 0x38]
cmp word [rax + 0x4428], 0
lea rax, [rax + 0x28]
lea rcx, [0x1400edbf8]
cmovne rcx, rax
jmp 0x1400830f5
cmp bl, 8
jne 0x140083126
mov byte [rsi + 0x44], 0
mov edi, dword [rsi + 0x14]
vmovups xmm0, xmmword [0x1400a89f0]
vmovaps xmmword [rsp + 0x30], xmm0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14006e5e0]
xor ecx, ecx
xor edx, edx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x1400830e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lock and qword [0x1400c5c48], 0xffffffffffffffbf
jmp 0x140083126
mov rcx, qword [rax + rdx + 0x38]
add rcx, 0x50
call fcn.14006b410
mov qword [rsi + 0x38], rax
mov qword [rax + 0x20], 0xffffffffffffffff
mov qword [rax + 0x30], 0xffffffffffffffff
mov qword [rax + 0x38], 0xffffffffffffffff
mov qword [rax + 0x40], 0xffffffffffffffff
mov qword [rax + 0x48], 0xffffffffffffffff
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14008ac40
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
vmovups xmm0, xmmword [rcx]
vmovaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call fcn.140004aa0
mov rax, qword [rsi + 8]
lea rdi, [rax*4 + 2]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [0x1400c67c0]
nop dword [rax]
mov edx, dword [rcx + rbx*4 + 0x10]
cmp edx, eax
je 0x14008acc3
mov edx, dword [rcx + rbx*4 + 0x14]
cmp edx, eax
je 0x14008acb4
mov edx, dword [rcx + rbx*4 + 0x18]
cmp edx, eax
je 0x14008acb9
mov edx, dword [rcx + rbx*4 + 0x1c]
cmp edx, eax
je 0x14008acbf
add rbx, 4
cmp rbx, 0x80
jne 0x14008ac80
mov eax, 0xffffffff
jmp 0x14008acc5
inc rbx
jmp 0x14008acc3
add rbx, 2
jmp 0x14008acc3
add rbx, 3
mov eax, ebx
shl rax, 4
mov rdx, qword [rax + rcx + 0x218]
mov r8, qword [rax + rcx + 0x210]
add r8, rdx
add rdi, rdx
mov qword [rax + rcx + 0x218], rdi
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1400030a0
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14008ad09
mov rax, qword [rsp + 0x28]
mov word [rcx + rax], 0
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
Function at 0x14008d210
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
test r8, r8
je 0x14008d3d8
mov ebx, r9d
mov rsi, r8
mov rdi, rdx
mov r14, rcx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
imul rax, qword [rsp + 0x28], 0xf4240
mov rcx, qword [rsp + 0x20]
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x14008d26c
xor edx, edx
div rcx
mov r15, rax
jmp 0x14008d273
xor edx, edx
div ecx
mov r15d, eax
mov r8, qword [r14 + 0x4598]
mov ecx, dword [r14 + 0x45a0]
mov eax, dword [r14 + 0x45a4]
mov edx, eax
imul edx, ecx
movsxd rdx, edx
add rdx, r8
cmp r8, rdx
jae 0x14008d2fe
mov r12, r8
jmp 0x14008d2b4
add r12, 0x48
mov edx, ecx
imul edx, eax
movsxd rdx, edx
add rdx, r8
cmp r12, rdx
jae 0x14008d2fe
mov rdx, r15
sub rdx, qword [r12 + 8]
cmp rdx, 0x23c34601
jb 0x14008d2a0
imul eax, ecx
cdqe
add r8, rax
movsxd rdx, ecx
add rdx, r12
sub r8, rdx
mov rcx, r12
call fcn.140091e40
mov eax, dword [r14 + 0x45a4]
dec eax
mov dword [r14 + 0x45a4], eax
mov r8, qword [r14 + 0x4598]
mov ecx, dword [r14 + 0x45a0]
jmp 0x14008d2a4
mov rdx, qword [r14 + 0x4458]
cmp rdx, rdi
cmovge rdx, rdi
mov qword [r14 + 0x4458], rdx
cmp eax, dword [r14 + 0x45a8]
jne 0x14008d33d
lea rcx, [r14 + 0x4598]
call fcn.140001620
mov eax, dword [r14 + 0x45a4]
mov r8, qword [r14 + 0x4598]
mov ecx, dword [r14 + 0x45a0]
mov r12, qword [rsp + 0xa0]
imul ecx, eax
movsxd r15, ecx
add r15, r8
inc eax
mov dword [r14 + 0x45a4], eax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
imul rax, qword [rsp + 0x28], 0xf4240
mov rcx, qword [rsp + 0x20]
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x14008d38e
xor edx, edx
div rcx
jmp 0x14008d392
xor edx, edx
div ecx
mov qword [r15 + 8], rax
mov byte [r15], 0
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], rdi
lea rcx, [rsp + 0x28]
mov rdx, rsi
call fcn.140001460
vmovups ymm0, ymmword [rsp + 0x28]
vmovups ymmword [r15 + 0x20], ymm0
mov rcx, qword [r15 + 0x20]
add rdi, qword [r14 + 0x44a0]
mov rdx, rdi
mov r8, rsi
vzeroupper
call fcn.140091e40
mov byte [r15 + 0x40], bl
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14008ebb0
Capabilities:
Delete file
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 8]
lea r14, [rax*4 + 2]
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rbx, [0x1400c67c0]
nop dword [rax]
mov ecx, dword [rbx + r15*4 + 0x10]
cmp ecx, eax
je 0x14008ec27
mov ecx, dword [rbx + r15*4 + 0x14]
cmp ecx, eax
je 0x14008ec18
mov ecx, dword [rbx + r15*4 + 0x18]
cmp ecx, eax
je 0x14008ec1d
mov ecx, dword [rbx + r15*4 + 0x1c]
cmp ecx, eax
je 0x14008ec23
add r15, 4
cmp r15, 0x80
jne 0x14008ebe0
mov eax, 0xffffffff
jmp 0x14008ec2a
inc r15
jmp 0x14008ec27
add r15, 2
jmp 0x14008ec27
add r15, 3
mov eax, r15d
shl rax, 4
mov rcx, qword [rax + rbx + 0x218]
mov r8, qword [rax + rbx + 0x210]
add r8, rcx
add r14, rcx
mov qword [rax + rbx + 0x218], r14
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1400030a0
mov rax, qword [rsi + 8]
lea rdi, [rax*4 + 2]
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop
mov ecx, dword [rbx + r14*4 + 0x10]
cmp ecx, eax
je 0x14008ecb7
mov ecx, dword [rbx + r14*4 + 0x14]
cmp ecx, eax
je 0x14008eca8
mov ecx, dword [rbx + r14*4 + 0x18]
cmp ecx, eax
je 0x14008ecad
mov ecx, dword [rbx + r14*4 + 0x1c]
cmp ecx, eax
je 0x14008ecb3
add r14, 4
cmp r14, 0x80
jne 0x14008ec70
mov eax, 0xffffffff
jmp 0x14008ecba
inc r14
jmp 0x14008ecb7
add r14, 2
jmp 0x14008ecb7
add r14, 3
mov eax, r14d
shl rax, 4
mov rcx, qword [rax + rbx + 0x218]
mov r8, qword [rax + rbx + 0x210]
add r8, rcx
add rdi, rcx
mov qword [rax + rbx + 0x218], rdi
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1400030a0
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x14008ecfe
mov rax, qword [rsp + 0x28]
mov word [rdx + rax], 0
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x14008ed28
mov rdi, qword [rsp + 0x38]
mov word [rsi + rdi], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14008ed44
mov word [rsi + rdi], 0
jmp 0x14008ed36
xor edi, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14008ed46
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
jmp 0x14008ed46
xor edi, edi
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret