joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140064d80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140087010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140064e53
cmp byte [rcx + 0x71], 0
je 0x140064e53
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140064e4f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140064e14
sub eax, 1
je 0x140064e18
cmp eax, 2
jne 0x140064e4f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400680a0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140064e46
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140064e4f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140064dfc
xor al, al
jmp 0x140064dfc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400680a0
add rsp, 0x60
pop rbx
ret
Function at 0x140068d00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140068d4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140068d4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140068d4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140068d4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140068d4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140068d4c
xor al, al
add rsp, 0x28
ret
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020514]
cmp r15, 1
jne 0x140004953
push qword [0x140020604]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x140020604]
call fcn.14000dd0c
mov rcx, qword [0x140020604]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x14002060c]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205f4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add byte [rdi + 0x288cd809], dh
or eax, ebx
mov word [rax], gs
or eax, 0x6c8e8c52
cmp byte [rbx], 0xc0
ret 0x6f6d
cmpsd dword [rsi], dword [rdi]
jle 0x14003f60d
invalid
xchg bl, dh
sub eax, 0xd27566de
cmp al, 0x69
invalid
test byte ds:[rcx + 0x2227e561], 0xd0
invalid
scasb al, byte [rdi]
add al, 0xe0
invalid
push rax
invalid
cwde
push 0x57
out dx, al
or al, 0x82
imul esp, dword [rdi - 0x59], 0xffffffa1
out 0x81, eax
ffree st(4)
fsubr st(3)
jbe 0x14003f671
std
sub eax, 0xcdb361b6
invalid
mov bl, 0xcd
sbb bl, byte [rdi + 0x5ea01fa4]
pop rsi
invalid
pop rsi
int1
scasd eax, dword [rdi]
mov eax, 0x1a7edb2d
lodsb al, byte [rsi]
fdivr dword [rdi]
in al, dx
invalid
shl byte [rsi], cl
xor eax, 0xfe88000c
or eax, 0xf318f37c
sbb bl, dh
jae 0x14003f6d4
jae 0x14003f6d4
pop qword [rcx - 0x3f]
pop rax
mul edi
xor al, 0xc3
sbb eax, 0x30ce2940
invalid
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x1405f6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1405f61df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405f6089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f606f
add dl, dl
jne 0x1405f6096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f60f6
xor eax, eax
add dl, dl
jne 0x1405f60a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f61ad
add dl, dl
jne 0x1405f60b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f60c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f60d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f60dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405f60ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405f607e
mov eax, 1
add dl, dl
jne 0x1405f6106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f6113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f60fb
sub eax, ebx
mov ebx, 1
jne 0x1405f614c
mov ecx, 1
add dl, dl
jne 0x1405f612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405f613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f6123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405f6168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405f6175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f615d
cmp eax, 0x7d00
jae 0x1405f619b
cmp eax, 0x500
jb 0x1405f6196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f607e
cmp eax, 0x7f
ja 0x1405f619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405f61d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405f607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000f0ac
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
and qword [rbp - 8], 0
mov rdi, r8
and qword [rbp - 0x10], 0
mov r14d, edx
and dword [rbp + 0x30], 0
mov r15, rcx
test rcx, rcx
je 0x14000f250
test edx, edx
je 0x14000f250
test r8, r8
je 0x14000f250
xor eax, eax
lea rdx, str.SHA1
mov qword [r8], rax
lea rcx, [rbp - 8]
mov qword [r8 + 8], rax
xor r9d, r9d
mov dword [r8 + 0x10], eax
xor r8d, r8d
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x14000f255
and dword [rsp + 0x28], 0
lea rax, [rbp + 0x48]
mov rcx, qword [rbp - 8]
lea r8, [rbp + 0x30]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea rdx, str.ObjectLength
call qword [sym.imp.bcrypt.dll_BCryptGetProperty]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x14000f238
mov ebx, dword [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
neg rax
sbb ebx, ebx
not ebx
and ebx, 0xc0000017
test rsi, rsi
je 0x14000f238
and dword [rsp + 0x30], 0
lea rdx, [rbp - 0x10]
and dword [rsp + 0x28], 0
mov r8, rsi
mov r9d, dword [rbp + 0x30]
mov rcx, qword [rbp - 8]
and qword [rsp + 0x20], 0
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x14000f218
mov rcx, qword [rbp - 0x10]
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
call qword [sym.imp.bcrypt.dll_BCryptHashData]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x14000f208
mov rcx, qword [rbp - 0x10]
xor r9d, r9d
mov rdx, rdi
lea r8d, [r9 + 0x14]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
nop dword [rax + rax]
test ebx, ebx
jns 0x14000f271
jmp 0x14000f255
mov ebx, 0xc000000d
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
not ebx
shr ebx, 0x1f
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f794
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14006c080]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, dword [rsp + 0xc0]
xor r12d, r12d
mov r14, qword [rsp + 0xc8]
mov edi, ecx
mov ecx, dword [0x14006c0a4]
mov rbp, r9
mov qword [r11 - 0x60], r12
mov rsi, r8
mov r15, rdx
cmp ecx, 0xffffffff
jne 0x14000f856
xor edx, edx
lea r8d, [r12 + 0x20]
lea rcx, [r11 - 0x58]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8d, [r12 + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, str.WIM_Verbose_Logging
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
dec eax
cmp eax, 0xf
ja 0x14000f843
lea r8, [rsp + 0x30]
lea rdx, [0x14005cd90]
lea rcx, [rsp + 0x40]
call fcn.1400592a8
mov ecx, dword [0x14006c0a4]
test eax, eax
cmovg ecx, dword [rsp + 0x30]
jmp 0x14000f849
mov ecx, dword [0x14006c0a4]
cmp ecx, 0xffffffff
cmove ecx, r12d
mov dword [0x14006c0a4], ecx
cmp edi, 4
jne 0x14000f863
test ecx, ecx
je 0x14000f987
sub edi, 1
je 0x14000f88a
sub edi, 1
je 0x14000f883
sub edi, 1
je 0x14000f87c
cmp edi, 1
mov edi, 0x41009477
jmp 0x14000f88f
mov edi, 0x41009484
jmp 0x14000f88f
mov edi, 0x41009485
jmp 0x14000f88f
mov edi, 0x4100947f
mov r9d, dword [rsp + 0xd0]
lea rdx, str.__s:__d______s___s
mov qword [rsp + 0x28], rsi
lea rcx, [rsp + 0x38]
mov r8, r14
mov qword [rsp + 0x20], rbp
call fcn.140025410
mov rbp, qword [rsp + 0x38]
mov esi, ebx
and esi, 0x10000000
mov r14d, 0x13d
test rbp, rbp
je 0x14000f93e
mov ecx, ebx
test esi, esi
je 0x14000f8fa
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
cmp eax, r14d
jne 0x14000f8e8
mov edx, ebx
jmp 0x14000f90e
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov edx, eax
jmp 0x14000f90e
and ecx, 0x1fff0000
movzx eax, bx
cmp ecx, 0x70000
mov edx, ebx
cmove edx, eax
mov r9d, edx
mov r8, rbp
mov edx, edi
mov rcx, r15
call fcn.1400116e0
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov ecx, ebx
test esi, esi
je 0x14000f967
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
cmp eax, r14d
je 0x14000f979
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x14000f979
and ecx, 0x1fff0000
movzx eax, bx
cmp ecx, 0x70000
cmove ebx, eax
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400582e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140011ebc
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, r8
mov r14, rdx
mov rbx, rcx
xor esi, esi
lea rax, [rdx + 1]
test rax, 0xfffffffffffffffe
jne 0x140011ef5
test r8, r8
je 0x1400120d4
test rdi, rdi
je 0x14001209a
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov edx, 8
lea r8d, [rdx + 8]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
or r15d, 0xffffffff
mov eax, r15d
test rbx, rbx
je 0x140011f33
mov eax, dword [rbx]
mov r12d, 0xfeedf002
cmp eax, r12d
jne 0x14001209a
test rsi, rsi
je 0x14001209a
mov rcx, rdi
call fcn.14000ac64
mov qword [rsi], rax
test rax, rax
je 0x14001209a
lea rax, [r14 + 1]
test rax, 0xfffffffffffffffe
jne 0x140011fa9
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 7]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
je 0x14001209a
mov r14, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointerEx]
nop dword [rax + rax]
test eax, eax
je 0x14001209a
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetEndOfFile]
nop dword [rax + rax]
test eax, eax
je 0x14001209a
mov rdi, rbx
mov eax, r15d
test rbx, rbx
je 0x140011fec
mov eax, dword [rbx]
cmp eax, r12d
je 0x140011ff5
xor edi, edi
jmp 0x14001200e
mov rax, qword [rbx + 0x40]
jmp 0x140012002
mov rdi, rax
mov rax, qword [rax + 0x40]
test rax, rax
jne 0x140011ffb
add rdi, 0x208
mov qword [rsp + 0x68], rdi
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
nop
mov rax, rbx
mov ecx, r15d
test rbx, rbx
je 0x140012030
mov ecx, dword [rbx]
cmp ecx, r12d
je 0x140012039
xor eax, eax
jmp 0x14001204e
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x140012047
mov rax, rcx
jmp 0x140012039
mov rax, qword [rax + 0xe8]
mov qword [rsi + 8], rax
test rbx, rbx
je 0x14001205a
mov r15d, dword [rbx]
cmp r15d, r12d
jne 0x140012074
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x14001206d
mov rbx, rax
jmp 0x14001205f
mov qword [rbx + 0xe8], rsi
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
or r14, 0xffffffffffffffff
xor edi, edi
xor esi, esi
lea rax, [r14 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400120b3
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test rdi, rdi
je 0x1400120c7
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test rsi, rsi
je 0x1400120d4
mov rcx, rsi
call fcn.1400120f4
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x1400120f4
Capabilities:
Delete file

Disassembly:
test rcx, rcx
je 0x140012181
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, qword [rbx]
mov rsi, qword [rbx + 8]
test rdi, rdi
je 0x14001214a
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
mov rbx, rsi
test rsi, rsi
jne 0x14001210f
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140014478
Capabilities:
Set file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x14006c080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [rsp + 0xc0]
xor edx, edx
mov rdi, qword [rsp + 0xc8]
mov ebx, r8d
mov rbp, rcx
mov r14, r9
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x28]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
test ebx, ebx
je 0x1400144cd
and ebx, 0x3127
bts ebx, 7
mov dword [rsp + 0x60], ebx
test r14, r14
je 0x1400144e1
mov eax, dword [r14]
mov dword [rsp + 0x40], eax
mov eax, dword [r14 + 4]
mov dword [rsp + 0x44], eax
test rsi, rsi
je 0x1400144f3
mov eax, dword [rsi]
mov dword [rsp + 0x48], eax
mov eax, dword [rsi + 4]
mov dword [rsp + 0x4c], eax
test rdi, rdi
je 0x140014505
mov eax, dword [rdi]
mov dword [rsp + 0x50], eax
mov eax, dword [rdi + 4]
mov dword [rsp + 0x54], eax
mov r9d, 0x28
mov dword [rsp + 0x20], 4
lea r8, [rsp + 0x40]
mov rcx, rbp
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x14001453d
mov ebx, eax
bts ebx, 0x1c
cmp eax, 0xc000000d
jne 0x14001453f
xor ebx, ebx
test ebx, ebx
jns 0x140014558
mov r9d, ebx
lea rcx, str.RestoreFileInfo
mov r8d, 0x679
call fcn.14001b2f8
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400582e0
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001a5d0
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor esi, esi
mov rdi, rcx
mov ebx, esi
test rcx, rcx
je 0x14001a672
cmp word [rcx], si
je 0x14001a672
mov edx, 0x80
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
nop dword [rax + rax]
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 7]
mov dword [rsp + 0x28], 0x6200000
xor r9d, r9d
mov edx, 0x10000
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
je 0x14001a650
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14001a66e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
je 0x14001a66e
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebx
jmp 0x14001a685
mov ecx, 0x57
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14001ae1c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x680
mov rax, qword [0x14006c080]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov esi, 1
call fcn.14001ad18
mov rdx, rax
test rax, rax
je 0x14001af59
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x40], rdi
mov rcx, rdi
test rbx, rbx
je 0x14001ae89
mov rax, qword [rbx + 0x40]
jmp 0x14001ae7b
mov rbx, rax
mov rax, qword [rax + 0x40]
test rax, rax
jne 0x14001ae74
cmp qword [rbx + 0x58], rax
cmovne rcx, qword [rbx + 0x58]
lea rax, [rsp + 0x40]
mov r9d, 0x204021
mov qword [rsp + 0x30], rax
mov r8d, 3
mov qword [rsp + 0x28], rdx
mov edx, 0xc11d0131
mov dword [rsp + 0x20], FDICopy
call fcn.1400230f4
mov ebx, eax
test r14, r14
je 0x14001aeca
mov rax, qword [rsp + 0x40]
mov rcx, rdi
mov qword [r14], rax
jmp 0x14001aecf
mov rcx, qword [rsp + 0x40]
cmp rcx, rdi
je 0x14001aee0
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test ebx, ebx
jns 0x14001af33
mov ecx, ebx
bt ebx, 0x1c
jae 0x14001af11
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
cmp eax, 0x13d
je 0x14001af23
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x14001af23
and ecx, 0x1fff0000
movzx eax, bx
cmp ecx, 0x70000
cmove ebx, eax
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor esi, esi
mov eax, esi
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.1400582e0
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x680
pop r14
pop rdi
pop rsi
ret
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x618
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [rsp + 0x50]
mov rdx, rdi
mov rcx, rbx
call fcn.140019908
test eax, eax
lea rbx, [rsp + 0x50]
cmove rbx, rdi
mov rcx, rbx
call fcn.140023f38
test eax, eax
jne 0x14001afa9
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x14001af33
test r14, r14
je 0x14001af33
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x2200000
mov edx, 0xc11d0131
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
or rdi, 0xffffffffffffffff
cmp rax, rdi
je 0x14001af31
mov qword [r14], rax
jmp 0x14001af33
Function at 0x14001b1c0
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
mov r10, r8
mov r11, rdx
mov eax, ebx
test rcx, rcx
je 0x14001b1e3
mov rax, qword [rcx + 0x40]
test rax, rax
cmovne rcx, rax
mov eax, dword [rcx + 0x24]
mov rcx, r11
bt eax, 0x1c
jae 0x14001b1fb
mov r8d, r9d
mov rdx, r10
call fcn.1400232d4
mov ebx, eax
jmp 0x14001b242
xor eax, eax
mov dword [rsp + 0x20], 0xb
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x14001b242
or eax, 0x10000000
mov ebx, eax
jge 0x14001b242
mov r9d, eax
lea rcx, str.WimImageSetInformationFile
mov r8d, 0x8e4
call fcn.14001b2f8
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x14001b250
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 0x1c], 0x10
mov rsi, rcx
jne 0x14001b26f
mov rdx, qword [rdx + 0xb0]
mov rbx, qword [rdx + 0xb0]
test rbx, rbx
jne 0x14001b27f
xor eax, eax
jmp 0x14001b2e2
call fcn.140013c14
mov rdi, rax
test rax, rax
jne 0x14001b293
mov eax, 0x80070002
jmp 0x14001b2e2
mov rdx, rbx
mov rcx, rsi
call fcn.14001b250
test eax, eax
js 0x14001b2e2
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x14001b2d4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x14001b2e2
and eax, 0x400
neg eax
sbb eax, eax
and eax, 0x800702e5
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret