joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14022bb70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14022bbd7
mov ecx, eax
mov eax, 2
test cl, 0x10
je 0x14022bbec
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
mov eax, 2
cmp rcx, 0xffffffffffffffff
je 0x14022bbec
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14022bbec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor eax, eax
cmp ecx, 2
sete al
add eax, eax
add rsp, 0x40
pop rsi
ret

Function at 0x14022bc00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
xor r8d, r8d
call fcn.140231300
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14022bc81
mov esi, 2
test al, 0x10
je 0x14022bc95
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14022bc95
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
jmp 0x14022bc95
call qword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xfffffffe
xor esi, esi
cmp eax, 2
sete sil
add esi, esi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14022bca4
call fcn.140258ec8
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140258ea0
mov eax, esi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x14022bcc0
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
xor edi, edi
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14022bd78
lea edi, [rax + 1]
movsxd rcx, eax
cmp eax, 0xffffffff
lea rax, [rcx + rcx + 2]
mov rcx, 0xffffffffffffffff
cmovge rcx, rax
call fcn.140258ed0
mov rsi, rax
mov ecx, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r14, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call r14
movsxd rbx, eax
mov rcx, rbx
call fcn.140006990
mov rdi, rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call r14
mov rcx, rsi
call fcn.140258ec8
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14022bd90
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.140231300
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test eax, eax
jne 0x14022be30
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14022be30
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14022be2a
test al, 0x10
je 0x14022be30
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14022be30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x14022be35
call qword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
setne bl
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14022be44
call fcn.140258ec8
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140258ea0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x14022be60
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, 0x8000
mov edx, 2
call fcn.140006930
mov rsi, rax
mov ecx, 0x7fff
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
mov word [rsi + rax*2], 0
mov rcx, rsi
mov rdx, 0xffffffffffffffff
xor r8d, r8d
call fcn.140233800
mov rdi, rax
mov rcx, rsi
call fcn.140261f34
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14022bec0
Capabilities:
Create directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 0x8000
mov edx, 2
call fcn.140006930
mov r14, rax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x28]
mov rdx, rsi
call fcn.140233d50
mov rdi, qword [rsp + 0x28]
lea r8, [0x140298b32]
mov edx, 0x7fff
mov rcx, r14
mov r9, rdi
call fcn.140012ac0
mov word [r14 + 0xfffe], 0
cmp eax, 0x7fff
ja 0x14022bfd2
mov ebx, eax
movsxd r14, eax
mov edx, 0x8000
mov rcx, rdi
call fcn.14026cad4
cmp rax, r14
jne 0x14022bfd2
mov qword [rsp + 0x38], r14
cmp ebx, 0x7ff7
ja 0x14022bfdd
mov dword [rsp + 0x24], 0
lea rdx, [rsp + 0x24]
mov ecx, 4
call fcn.140227870
test al, al
je 0x14022c012
mov r9d, dword [rsp + 0x24]
lea r8, [0x140345bae]
lea rdi, [rsp + 0x47]
mov edx, 9
mov rcx, rdi
call fcn.140008420
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.14022b640
test al, al
je 0x14022bfdd
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14022c012
mov rcx, rdi
mov rdx, 0xffffffffffffffff
xor r8d, r8d
call fcn.140233800
jmp 0x14022c01a
mov ecx, reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14022bfee
call fcn.140258ec8
mov rcx, qword [rsp + 0x30]
call fcn.140261f34
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140258ea0
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
call fcn.14022c020
mov rsi, rax
jmp 0x14022bfdf
Function at 0x14022c020
Capabilities:
Create directory

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, 0x8000
mov edx, 2
call fcn.140006930
mov rsi, rax
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.140233d50
mov rbx, qword [rsp + 0x30]
lea r8, [0x140298b32]
mov edx, 0x7fff
mov rcx, rsi
mov r9, rbx
call fcn.140012ac0
mov word [rsi + 0xfffe], 0
cmp eax, 0x7fff
ja 0x14022c160
mov ebp, eax
movsxd rdi, eax
mov edx, 0x8000
mov rcx, rbx
call fcn.14026cad4
cmp rax, rdi
jne 0x14022c160
cmp ebp, 0x7fdb
ja 0x14022c16b
lea rcx, [rsp + 0x38]
call qword [sym.imp.RPCRT4.dll_UuidCreateSequential]
cmp eax, 0x720
je 0x14022c0cc
test eax, eax
jne 0x14022c16b
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x28]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x14022c16b
mov rbx, qword [rsp + 0x28]
lea rcx, [rsi + rdi*2]
xor rdi, 0x7fff
lea r8, [0x140298b32]
mov rdx, rdi
mov r9, rbx
call fcn.140012ac0
mov word [rsi + 0xfffe], 0
test eax, eax
js 0x14022c160
movsxd r14, eax
cmp rdi, r14
jl 0x14022c160
mov edx, 0x8000
mov rcx, rbx
call fcn.14026cad4
cmp rax, r14
jne 0x14022c160
lea rcx, [rsp + 0x28]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
xor edi, edi
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14022c16d
mov rcx, rsi
mov rdx, 0xffffffffffffffff
xor r8d, r8d
call fcn.140233800
mov rdi, rax
jmp 0x14022c16d
mov ecx, reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14022c17c
call fcn.140258ec8
mov rcx, rsi
call fcn.140261f34
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140258ea0
mov rax, rdi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14022c1a0
Capabilities:
Delete directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov ebx, r8d
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
call fcn.140231300
test bl, bl
je 0x14022c26f
mov ecx, 0x8000
mov edx, 2
call fcn.140006930
mov rsi, rax
mov qword [rsp + 0x28], rax
mov word [rax], 0
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x14022c2ad
lea r8, [0x140298b32]
mov edx, 0x7fff
mov rcx, rsi
mov r9, rdi
call fcn.140012ac0
mov word [rsi + 0xfffe], 0
cmp eax, 0x7fff
ja 0x14022c2a2
mov ebx, eax
movsxd r14, eax
mov edx, 0x8000
mov rcx, rdi
call fcn.14026cad4
cmp rax, r14
jne 0x14022c2a2
mov qword [rsp + 0x30], r14
test ebx, ebx
je 0x14022c2ad
cmp word [rsi + r14*2 - 2], 0x5c
jne 0x14022c25c
lea rax, [r14 - 1]
mov qword [rsp + 0x30], rax
mov word [rsi + r14*2 - 2], 0
lea rcx, [rsp + 0x28]
call fcn.14022c3d0
mov edi, eax
mov rsi, qword [rsp + 0x28]
jmp 0x14022c2af
mov rcx, qword [rsp + 0x38]
mov dl, 1
call fcn.140231d30
cmp eax, 1
jne 0x14022c293
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne dil
jmp 0x14022c2b7
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x14022c2b7
mov ecx, reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov rcx, rsi
call fcn.140261f34
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14022c2c6
call fcn.140258ec8
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140258ea0
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14022c2e0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, r8
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
xor r8d, r8d
call fcn.140231300
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14022c395
test al, 0x10
je 0x14022c39b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14022c39b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
mov rdx, rsi
xor r8d, r8d
call fcn.140231300
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne sil
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14022c3a8
call fcn.140258ec8
jmp 0x14022c3a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14022c3b7
call fcn.140258ec8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140258ea0
mov eax, esi
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x140230e30
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 0x10]
mov ecx, dword [rax]
call fcn.14027e544
mov rbx, rax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rcx, rax
mov rdx, rsi
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140230f0e
mov edi, dword [rsp + 0x44]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x140230f15
mov ecx, dword [rsp + 0x44]
add rcx, rcx
call fcn.140258ed0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ebx, eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov ecx, ebx
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9d, dword [rsp + 0x44]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, ebx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
mov rcx, rdi
call fcn.140258ec8
movsxd rdi, esi
jmp 0x140230f15
mov rdi, 0xffffffffffffffff
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140258ea0
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x140231070
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rcx + 0x10]
mov ecx, dword [rax]
call fcn.14027e544
xor edi, edi
mov rcx, rax
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1402310ba
mov rax, qword [rsi + 0x10]
mov ecx, dword [rax]
call fcn.14027e544
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne dil
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140231d30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, 5
cmp eax, 0xffffffff
je 0x140231de4
test eax, 0x400
jne 0x140231d73
shr eax, 4
and eax, 1
mov edi, eax
jmp 0x140231de4
mov edi, 2
test bl, bl
je 0x140231de4
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 5
cmp rax, 0xffffffffffffffff
je 0x140231de4
mov rsi, rax
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x44]
shr eax, 4
and eax, 1
test edi, edi
mov edi, 5
cmovne edi, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140258ea0
mov eax, edi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret

Function at 0x140231f40
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x28]
mov r8b, 1
xor r9d, r9d
call fcn.140231320
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140231f91
mov ecx, eax
and ecx, 0x400
je 0x140231f91
mov rcx, rsi
test al, 0x10
jne 0x140231fc1
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140231fc7
mov ecx, 0x1126
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
test rsi, rsi
je 0x140231fab
mov rcx, rsi
call fcn.140258ec8
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140258ea0
mov eax, edi
add rsp, 0x38
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne dil
test rsi, rsi
jne 0x140231fa3
jmp 0x140231fab
Function at 0x140231fe0
Capabilities:
Check if file exists
Delete directory
Delete file
Move file

Disassembly:
xor ecx, ecx
jmp 0x140231ff0
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov ebx, ecx
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
mov r8b, 1
xor r9d, r9d
call fcn.140231320
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402320d7
mov ecx, 2
test eax, 0x400
jne 0x140232046
shr eax, 4
and eax, 1
mov ecx, eax
cmp ecx, ebx
jne 0x1402320e4
lea rcx, [rsp + 0x28]
mov rdx, rdi
mov r8b, 1
xor r9d, r9d
call fcn.140231320
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.14022bb70
cmp eax, 1
jne 0x1402320b1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402320b1
and eax, 0x400
je 0x1402320b1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140232115
mov ecx, eax
and ecx, 0x400
je 0x140232115
mov rcx, rdi
test al, 0x10
jne 0x140232124
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14023212e
mov rcx, rsi
mov rdx, rdi
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
test rdi, rdi
je 0x1402320f1
mov rcx, rdi
call fcn.140258ec8
jmp 0x1402320f1
mov ecx, 5
cmp ecx, ebx
je 0x14023204e
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
test rsi, rsi
je 0x1402320fe
mov rcx, rsi
call fcn.140258ec8
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140258ea0
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x1126
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x1402320c8
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1402320b1
xor ebx, ebx
jmp 0x1402320c8
Function at 0x140231ff0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file

Disassembly:
xor ecx, ecx
jmp 0x140231ff0
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov ebx, ecx
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
mov r8b, 1
xor r9d, r9d
call fcn.140231320
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402320d7
mov ecx, 2
test eax, 0x400
jne 0x140232046
shr eax, 4
and eax, 1
mov ecx, eax
cmp ecx, ebx
jne 0x1402320e4
lea rcx, [rsp + 0x28]
mov rdx, rdi
mov r8b, 1
xor r9d, r9d
call fcn.140231320
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.14022bb70
cmp eax, 1
jne 0x1402320b1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402320b1
and eax, 0x400
je 0x1402320b1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140232115
mov ecx, eax
and ecx, 0x400
je 0x140232115
mov rcx, rdi
test al, 0x10
jne 0x140232124
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14023212e
mov rcx, rsi
mov rdx, rdi
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
test rdi, rdi
je 0x1402320f1
mov rcx, rdi
call fcn.140258ec8
jmp 0x1402320f1
mov ecx, 5
cmp ecx, ebx
je 0x14023204e
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
test rsi, rsi
je 0x1402320fe
mov rcx, rsi
call fcn.140258ec8
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140258ea0
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x1126
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x1402320c8
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1402320b1
xor ebx, ebx
jmp 0x1402320c8

Function at 0x140232140
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file

Disassembly:
mov ecx, 2
jmp 0x140231ff0
Function at 0x1402327b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, r8
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x78]
mov r8b, 1
xor r9d, r9d
call fcn.140231320
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14023286b
test eax, 0x400
je 0x140232851
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14023286b
mov rbx, rax
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x14023286b
mov eax, dword [rsp + 0x40]
shr eax, 4
and eax, 1
mov qword [rsi], rax
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14027156c
test eax, eax
je 0x14023289c
mov qword [rsi], 5
test rdi, rdi
je 0x14023287f
mov rcx, rdi
call fcn.140258ec8
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140258ea0
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
ret
imul rax, qword [rsp + 0x70], 0x3e8
mov qword [rsi + 8], rax
imul rax, qword [rsp + 0x68], 0x3e8
mov qword [rsi + 0x10], rax
imul rax, qword [rsp + 0x60], 0x3e8
mov qword [rsi + 0x18], rax
movzx eax, word [rsp + 0x46]
mov qword [rsi + 0x20], rax
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x28], rax
test rdi, rdi
jne 0x140232877
jmp 0x14023287f

Function at 0x140232e10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov ebx, r8d
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x38]
mov r8b, 1
xor r9d, r9d
call fcn.140231320
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, 5
cmp eax, 0xffffffff
je 0x140232eda
test eax, 0x400
jne 0x140232e69
shr eax, 4
and eax, 1
mov edi, eax
jmp 0x140232eda
mov edi, 2
test bl, bl
je 0x140232eda
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 5
cmp rax, 0xffffffffffffffff
je 0x140232eda
mov rbx, rax
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x44]
shr eax, 4
and eax, 1
test edi, edi
mov edi, 5
cmovne edi, eax
test rsi, rsi
je 0x140232ee7
mov rcx, rsi
call fcn.140258ec8
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140258ea0
mov eax, edi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
Function at 0x140233af0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x140233bd7
mov eax, dword [rsp + 0x44]
cmp eax, ebx
jle 0x140233b46
mov dword [rsp + 0x44], ebx
mov eax, ebx
test eax, eax
jle 0x140233bce
xor r12d, r12d
xorps xmm6, xmm6
mov r13, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax + rax]
mov rbx, qword [rdi + r12*8]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r13
movsxd r14, eax
mov rcx, r14
call fcn.140006990
mov r15, rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r13
mov qword [rsi + r12*8], r15
inc r12
movsxd rax, dword [rsp + 0x44]
cmp r12, rax
jl 0x140233b60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140258ea0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret