joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a850
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, r8
mov qword [rsp + 0x38], rdx
mov rsi, rcx
xor edi, edi
test r8, r8
jne 0x14001a88c
mov al, 1
jmp 0x14001aa7d
lea r15, [rcx + 8]
cmp dword [rcx + 0x14], 1
jne 0x14001a8a9
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [r15], rax
mov rdx, qword [rsp + 0x38]
mov bpl, dil
mov dword [rsp + 0x30], edi
cmp dword [rsi + 0x14], edi
je 0x14001a908
mov rbx, rdi
test r14, r14
je 0x14001a92d
mov rcx, r14
sub rcx, rbx
mov eax, r14d
sub eax, ebx
mov r8d, 0x4000
cmp rcx, r8
cmovb r8d, eax
add rdx, rbx
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bpl
test eax, eax
je 0x14001a924
add rbx, 0x4000
cmp rbx, r14
mov rdx, qword [rsp + 0x38]
jb 0x14001a8bd
jmp 0x14001a924
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
mov r8d, r14d
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bpl
test bpl, bpl
jne 0x14001aa76
cmp byte [rsi + 0x22], dil
je 0x14001aa76
cmp dword [rsi + 0x14], edi
jne 0x14001aa76
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsi]
mov rax, qword [rcx + 0x28]
mov rcx, rsi
call qword [0x140058518]
mov r13, rax
lea r12, [rsi + 0x40]
mov rcx, r12
call fcn.14001b23c
mov rbx, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rbx, r14
jbe 0x14001a99f
mov rcx, r13
sub rcx, r14
mov ebx, 0xffffffff
cmp rcx, rbx
ja 0x14001a99f
lea rax, [r14 + r13]
cmp rax, rbx
jbe 0x14001a99f
mov rdx, r12
lea rcx, [0x140072f00]
call fcn.140011300
xor r8d, r8d
mov rdx, r12
lea rcx, [0x140072f00]
call fcn.140010a80
xor edi, edi
test al, al
je 0x14001aa00
mov ecx, dword [rsp + 0x30]
cmp rcx, r14
mov rdx, qword [rsp + 0x38]
jae 0x14001a8a9
test ecx, ecx
je 0x14001a8a9
mov rbx, qword [rsi]
mov rcx, rsi
mov rax, qword [rbx + 0x28]
call qword [0x140058518]
mov ecx, dword [rsp + 0x30]
sub rax, rcx
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
mov rax, qword [rbx + 0x20]
call qword [0x140058518]
jmp 0x14001a8a4
mov qword [rsp + 0x40], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xor r8d, r8d
lea rdx, [0x140059368]
lea rcx, [rsp + 0x40]
call fcn.1400033a4
nop
mov r8, r12
lea rdx, [rsp + 0x40]
lea rcx, [0x140072f00]
call fcn.1400112e0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001aa76
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aa71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001aaa2
call fcn.140040ee4
mov byte [rsi + 0x10], 1
mov al, bpl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140041060
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140046414
int3
Function at 0x14001af6c
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001af97
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor esi, esi
test eax, eax
setne dil
test eax, eax
jne 0x14001b031
mov qword [rsp + 0x20], rsi
movdqa xmm0, xmmword [0x140058940]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], si
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002253c
test al, al
je 0x14001aff3
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne dil
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001b031
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b02c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b051
call fcn.140040ee4
mov al, dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140041060
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.140046414
int3

Function at 0x14001b058
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001b083
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
test eax, eax
setne dil
test eax, eax
jne 0x14001b11d
mov qword [rsp + 0x20], rsi
movdqa xmm0, xmmword [0x140058940]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], si
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002253c
test al, al
je 0x14001b0df
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne dil
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001b11d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b118
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b13d
call fcn.140040ee4
mov al, dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140041060
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.140046414
int3
Function at 0x14001b158
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001b183
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14001b216
xor esi, esi
mov qword [rsp + 0x20], rsi
movdqa xmm0, xmmword [0x140058940]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], si
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002253c
test al, al
je 0x14001b1d8
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001b216
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b211
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b235
call fcn.140040ee4
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140041060
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.140046414
int3

Function at 0x14001b23c
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], bx
lea rdx, [rbp - 0x28]
call fcn.1400221a4
mov qword [rbp - 0x40], rbx
cmp qword [rbp - 0x18], rbx
jne 0x14001b284
mov ecx, ebx
jmp 0x14001b292
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14001b2bc
mov eax, dword [rbp - 0x3c]
cmp eax, dword [rbp - 0x34]
ja 0x14001b2bc
mov ebx, eax
shl rbx, 0x20
mov eax, dword [rbp - 0x40]
add rbx, rax
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14001b2f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b2f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b312
call fcn.140040ee4
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140041060
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
call fcn.140046414
int3
Function at 0x14001b328
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
lea rdx, [rsp + 0x40]
call fcn.140021e4c
cmp qword [rsp + 0x50], rbx
jne 0x14001b37d
mov ecx, ebx
jmp 0x14001b38e
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov dword [rsp + 0x38], 0x105
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x14001b3e8
lea rdx, [0x1400593c0]
lea rcx, [rsp + 0x60]
call fcn.14004a000
test eax, eax
je 0x14001b3e6
lea rdx, str.FAT32
lea rcx, [rsp + 0x60]
call fcn.14004a000
test eax, eax
jne 0x14001b3e8
mov bl, 1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001b426
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b421
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b448
call fcn.140040ee4
mov al, bl
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140041060
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rbp
ret
call fcn.140046414
int3

Function at 0x14001b45c
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [r11 - 0x38], rbx
mov qword [r11 - 0x28], rbx
mov qword [r11 - 0x20], 7
mov word [rsp + 0x20], bx
lea rdx, [r11 - 0x38]
call fcn.140021e4c
cmp qword [rsp + 0x30], rbx
jne 0x14001b49e
mov ecx, ebx
jmp 0x14001b4af
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x14001b4bf
cmp eax, 5
jne 0x14001b4c1
mov bl, 1
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001b4ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b4fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b514
call fcn.140040ee4
mov al, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140041060
add rsp, 0x50
pop rbx
ret
call fcn.140046414
int3
Function at 0x14001b7e4
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14d, r8d
mov bpl, dl
mov rdi, rcx
call fcn.140021cdc
cmp ax, 0x2e
je 0x14001b842
cmp ax, 0x20
je 0x14001b842
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001b82c
mov rcx, qword [rdi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
xor ebx, ebx
test eax, eax
jne 0x14001b8dd
jmp 0x14001b846
xor ebx, ebx
mov esi, ebx
mov rcx, rdi
call fcn.14001b158
cmp eax, 0xffffffff
jne 0x14001b8f1
mov qword [rsp + 0x20], rbx
movdqa xmm0, xmmword [0x140058940]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], bx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14002253c
test al, al
je 0x14001b89b
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001b8d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b8d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b92e
call fcn.140040ee4
test esi, esi
je 0x14001b8f1
test bpl, bpl
je 0x14001b8ed
mov edx, r14d
mov rcx, rdi
call fcn.14001c06c
xor eax, eax
jmp 0x14001b90c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14001b907
cmp eax, 3
sete bl
lea eax, [rbx + 1]
jmp 0x14001b90c
mov eax, 2
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140041060
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140046414
int3
Function at 0x14001bc6c
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rbx, rcx
cmp qword [rdx + 0x18], 8
jb 0x14001bc9f
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x14001bca9
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor r14d, r14d
test eax, eax
setne sil
test eax, eax
jne 0x14001bdb3
mov qword [rbp - 0x30], r14
movdqa xmm0, xmmword [0x140058940]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
mov qword [rbp - 0x50], r14
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r14w
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.14002253c
test al, al
je 0x14001bd2c
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.14002253c
test al, al
je 0x14001bd2c
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne sil
mov ebx, 0x1000
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14001bd69
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, rbx
jb 0x14001bd64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bddd
call fcn.140040ee4
movdqa xmm0, xmmword [0x140058940]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r14w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001bdb3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, rbx
jb 0x14001bdae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bdd7
call fcn.140040ee4
mov al, sil
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140041060
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140046414
nop
call fcn.140046414
nop
int3
Function at 0x14001c06c
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov esi, edx
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001c096
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ebp, ebp
test eax, eax
setne dil
test eax, eax
jne 0x14001c132
mov qword [rsp + 0x20], rbp
movdqa xmm0, xmmword [0x140058940]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], bp
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002253c
test al, al
je 0x14001c0f4
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne dil
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001c132
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c12d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c152
call fcn.140040ee4
mov al, dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140041060
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
call fcn.140046414
int3
Function at 0x14001cee8
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rdi, r8
mov rbx, rdx
mov r14, rcx
xor r15d, r15d
or rsi, 0xffffffffffffffff
cmp rcx, rsi
jne 0x14001d004
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x14001cf3a
mov rcx, qword [rdx]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, rsi
jne 0x14001d024
mov qword [rsp + 0x20], r15
movdqa xmm0, xmmword [0x140058940]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r15w
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002253c
test al, al
je 0x14001cf9a
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001cfdc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cfd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d154
call fcn.140040ee4
cmp r14, rsi
jne 0x14001d024
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 2]
test ecx, 0xffffffee
jne 0x14001cffa
cmp eax, 0x13
mov al, r15b
jne 0x14001cffc
mov al, 1
mov byte [rdi + 0x64], al
jmp 0x14001d121
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001d024
mov r14, rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
jmp 0x14001cffc
cmp rdi, rbx
je 0x14001d042
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001d036
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rdi
call fcn.1400032dc
mov qword [rsp + 0x20], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x6c]
inc rsi
cmp word [rax + rsi*2], r15w
jne 0x14001d055
mov r8, rsi
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.1400033a4
nop
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140023c54
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001d0c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d0bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d14e
call fcn.140040ee4
mov ecx, dword [rsp + 0x5c]
shl rcx, 0x20
mov eax, dword [rsp + 0x60]
add rcx, rax
mov qword [rdi + 0x20], rcx
mov eax, dword [rsp + 0x40]
mov dword [rdi + 0x28], eax
mov rax, qword [rsp + 0x44]
mov qword [rdi + 0x48], rax
mov rax, qword [rsp + 0x4c]
mov qword [rdi + 0x50], rax
mov rax, qword [rsp + 0x54]
mov qword [rdi + 0x58], rax
lea rcx, [rdi + 0x30]
lea rdx, [rsp + 0x54]
call fcn.1400334dc
lea rcx, [rdi + 0x38]
lea rdx, [rsp + 0x44]
call fcn.1400334dc
lea rcx, [rdi + 0x40]
lea rdx, [rsp + 0x4c]
call fcn.1400334dc
mov dword [rdi + 0x60], r15d
mov rax, r14
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140041060
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x2a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140046414
int3
call fcn.140046414
int3
Function at 0x14001d9f8
Capabilities:
Hash data using crc32b

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, 2
mov ebx, edx
mov rsi, rcx
lea ebp, [rdi - 1]
cmp edx, ebp
jbe 0x14001da47
test bl, 1
je 0x14001da31
mov r8d, edi
mov edx, ebp
mov rcx, rsi
call fcn.14001da68
mov ebp, eax
mov r8d, edi
mov edx, edi
mov rcx, rsi
call fcn.14001da68
shr ebx, 1
mov edi, eax
cmp ebx, 1
ja 0x14001da1d
mov r8d, edi
mov edx, ebp
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14001da68

Function at 0x14001dda8
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x14006e368]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor bl, bl
cmp byte [0x140072f18], bl
jne 0x14001de0d
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 0xa
ja 0x14001ddfc
jne 0x14001ddfe
cmp dword [rsp + 0x2c], 0x55f0
jb 0x14001ddfe
call fcn.14001de30
test al, al
jne 0x14001ddfe
mov bl, 1
mov byte [0x140072f19], bl
mov byte [0x140072f18], 1
jmp 0x14001de13
mov bl, byte [0x140072f19]
mov al, bl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140041060
add rsp, 0x150
pop rbx
ret
Function at 0x140021948
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov sil, dl
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
xor ebp, ebp
mov rax, rbx
mov qword [rbx + 0x10], rbp
cmp qword [rbx + 0x18], 8
jb 0x140021978
mov rax, qword [rbx]
lea r8, [rsp + 0x40]
mov word [rax], bp
mov edx, 0x1a
xor ecx, ecx
mov dil, bpl
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x1400219e7
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call fcn.140023af0
test al, al
je 0x1400219e7
cmp qword [rbx + 0x10], rbp
je 0x1400219e7
mov rcx, rbx
call fcn.1400205dc
mov r8d, 6
lea rdx, [0x14005b858]
mov rcx, rbx
call fcn.140007058
mov rcx, rbx
call fcn.14001b144
mov dil, al
test al, al
jne 0x1400219e7
test sil, sil
je 0x1400219e7
mov rcx, rbx
call fcn.14001ad88
mov dil, al
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [0x140058518]
mov rbx, qword [rsp + 0x48]
mov al, dil
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x140021b34
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor esi, esi
test eax, eax
je 0x140021bed
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rsi
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.14000d250
nop
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
sub rcx, rdx
sar rcx, 1
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
mov rdx, qword [rsp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], si
jne 0x140021b96
mov rcx, rbx
call fcn.1400032dc
test edi, edi
setne bl
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140021beb
mov rdx, qword [rsp + 0x30]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021be6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021bfd
call fcn.140040ee4
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call fcn.140046414
int3