joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009b3c0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x14009b3d8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x14009b3e0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x14009b3f0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x14009b43d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x14009b434
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14009b43f
add rax, 0x28
cmp rax, r9
jne 0x14009b420
xor eax, eax
ret

Function at 0x14009b440
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x14009b4d0
mov rdx, qword [0x14029d040]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14009b4be
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14009b4be
cmp word [rax + 0x18], 0x20b
jne 0x14009b4be
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x14009b4d0
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x14009b4a9
add rbx, 0x28
cmp rbx, rdi
je 0x14009b4d0
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x14009b4a0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x14009b4e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14029d040]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14009b500
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14009b508
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14009b500
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14009b55d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14009b554
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14009b500
add rax, 0x28
cmp rax, r9
jne 0x14009b540
xor eax, eax
ret

Function at 0x14009b560
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14029d040]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14009b57f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14009b588
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14009b57f
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x14009b5a0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x14029d040]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x14009b5c0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x14009b5c8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x14009b5c0
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x14009b610
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x14009b607
test rcx, rcx
je 0x14009b5c0
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x14009b5f8
xor eax, eax
ret

Function at 0x14009b620
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14029d040]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14009b63f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14009b648
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x14009b660
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14029d040]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14009b680
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14009b688
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14009b680
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x14009b680
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x14009b6d4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14009b6e0
add rdx, 0x28
cmp r9, rdx
jne 0x14009b6c0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x14009b6f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14029d040]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x14009b712
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x14009b720
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14009b712
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x14009b712
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x14009b712
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x14009b775
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x14009b788
add rdx, 0x28
cmp r10, rdx
jne 0x14009b760
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x14009b797
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x14009b7a7
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14009b77e
test ecx, ecx
jg 0x14009b790
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x14000e760
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
lea r8, [rdx - 0x40]
lea r11, [rcx + 0x40]
mov eax, 0x40
cmp r8, rax
jb 0x14000e8ad
add rdx, 0xffffffffffffff80
mov r9, rdx
and r9, 0xffffffffffffffc0
mov r10, r9
sub r10, 0xffffffffffffff80
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x14014a250]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm9, 0
movdqa xmm12, xmm3
pclmulqdq xmm12, xmm9, 0
movdqa xmm11, xmm2
pclmulqdq xmm11, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm8, 0x11
movdqa xmm5, xmm3
pclmulqdq xmm5, xmm8, 0x11
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm8, 0x11
movdqa xmm13, xmm1
pclmulqdq xmm13, xmm8, 0x11
movdqu xmm0, xmmword [r11]
pxor xmm0, xmm6
pxor xmm0, xmm4
movdqu xmm3, xmmword [r11 + 0x10]
pxor xmm3, xmm12
pxor xmm3, xmm5
movdqu xmm2, xmmword [r11 + 0x20]
pxor xmm2, xmm11
pxor xmm2, xmm7
movdqu xmm1, xmmword [r11 + 0x30]
pxor xmm1, xmm10
pxor xmm1, xmm13
add r8, 0xffffffffffffffc0
add r11, 0x40
cmp r8, 0x3f
ja 0x14000e7f8
sub rdx, r9
add rcx, r10
mov r8, rdx
mov r11, rcx
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x14014a260]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp r8, 0x10
jb 0x14000e93d
movdqu xmm1, xmmword [r11]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm1
pxor xmm0, xmm2
add r11, 0x10
add r8, 0xfffffffffffffff0
cmp r8, 0xf
ja 0x14000e912
movdqa xmm1, xmmword [0x14014a260]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pmovzxdq xmm1, xmm0
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm2, rax
pclmulqdq xmm2, xmm1, 0
pxor xmm2, xmm0
pmovzxdq xmm0, xmm2
pclmulqdq xmm0, xmmword [0x14014a270], 0x10
pmovzxdq xmm0, xmm0
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x14000fa40
Capabilities:
Check mutex on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], 0
mov qword [rcx + 8], 0
lea r8, str.A946A6A9_917E_4949_B9BC_6BADA8C7FD63
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 8], rax
test rax, rax
je 0x14000fa80
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete byte [rsi]
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x14000fba0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx], rdx
je 0x14000fbf7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call fcn.14000fc00
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14000fbe7
mov qword [rsi], rdi
call fcn.140047f50
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.14004a9a0
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140015290
Capabilities:
Get session information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x140015366
lea r9, [rsp + 0x50]
mov qword [r9], 0
lea rcx, [rsp + 0x4c]
mov dword [rcx], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov r8d, 0x18
mov edx, eax
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x140015366
mov rbx, qword [rsp + 0x50]
mov ecx, 0x30
call fcn.14011a310
mov rdi, rax
lea rdx, [0x140016820]
lea r8, [0x140086570]
mov rcx, rax
call fcn.140046e40
lea rax, [0x14011a2f0]
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rbx
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rdi
call fcn.140046e80
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov rdx, rbx
call fcn.140046ef0
mov rcx, rbx
call fcn.140046e90
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.14004beb0
cmp dword [rsp + 0x4c], 0xd7
ja 0x14001536f
mov qword [rsi], 0
jmp 0x140015383
mov qword [rsi], 0
jmp 0x14001538d
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0xc8]
mov rcx, rsi
call fcn.14004c160
lea rcx, [rsp + 0x40]
call fcn.14004bee0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14011a370
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001bdb0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x280
movaps xmmword [rsp + 0x270], xmm6
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x268], rax
add rbx, 8
lea rcx, str.chrome.exe
lea rsi, [rsp + 0xa0]
mov qword [rsi], rcx
call fcn.140120930
mov qword [rsi + 8], rax
lea r15, [rsp + 0x248]
mov rcx, rbx
mov rdx, r15
mov r8, rsi
call fcn.14002a080
lea r14, [rsp + 0x70]
mov rcx, r14
mov rdx, r15
call fcn.1400304d0
mov edx, dword [rdi + 0x28]
lea rbx, [rsp + 0xb0]
mov rcx, rbx
call fcn.140043450
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
lea rdi, [rsp + 0x1e0]
movdqu xmmword [rdi + 0x10], xmm0
mov byte [rdi], 0
lea rsi, str.try_chrome_again
mov rcx, rsi
call fcn.140120c40
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.140006510
mov rcx, r14
mov rdx, rdi
mov r8, rbx
call fcn.140031780
mov rcx, rdi
call fcn.1400064a0
mov rcx, rbx
call fcn.1400066b0
xorps xmm6, xmm6
movaps xmmword [rdi], xmm6
xor eax, eax
mov qword [rdi + 0x60], rax
movaps xmmword [rdi + 0x50], xmm6
movaps xmmword [rdi + 0x40], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
mov dword [rdi], 0x68
mov qword [rsp + 0x60], rax
movaps xmmword [rsp + 0x50], xmm6
lea rbx, [rsp + 0x1c0]
xor r8d, r8d
mov rcx, r14
mov rdx, rbx
call fcn.140032540
mov eax, 7
cmp qword [rbx + 0x18], rax
jbe 0x14001bee9
mov rbx, qword [rsp + 0x1c0]
cmp qword [rsp + 0x260], rax
jbe 0x14001befb
mov r15, qword [rsp + 0x248]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor r9d, r9d
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001bf54
lea rsi, [rsp + 0xb0]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14004eeb0
mov rcx, rsi
call fcn.14004ef00
jmp 0x14001bfcf
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x14001bfcf
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_user_experiment.cc
lea rsi, [rsp + 0xb0]
mov r8d, 0x222
mov r9d, 2
mov rcx, rsi
call fcn.14002d860
lea rcx, [rsp + 0xc0]
lea rdx, str.Failed_to_launch:
call fcn.140002bb0
cmp qword [rsp + 0x1d8], 7
jbe 0x14001bfb7
mov rdx, qword [rsp + 0x1c0]
jmp 0x14001bfbf
lea rdx, [rsp + 0x1c0]
mov rcx, rax
call fcn.14002da70
mov rcx, rsi
call fcn.14002d9a0
lea rcx, [rsp + 0x1c0]
call fcn.1400066b0
lea rcx, [rsp + 0x70]
call fcn.140030890
lea rcx, [rsp + 0x248]
call fcn.1400289c0
mov rcx, qword [rsp + 0x268]
xor rcx, rsp
call fcn.14011a370
movaps xmm6, xmmword [rsp + 0x270]
add rsp, 0x280
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14002bc00
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov r14, rcx
mov rax, qword [0x14017b818]
xor rax, rbp
mov qword [rbp], rax
call fcn.140030b70
mov rdi, rax
lea rbx, [0x1401513c1]
mov rcx, rax
mov rdx, rbx
call fcn.140031080
test al, al
jne 0x14002bc5d
lea rdx, str.vmodule
mov rcx, rdi
call fcn.140031080
test al, al
je 0x14002bd7e
cmp qword [0x14017cbb0], 0
jne 0x14002be88
mov rax, qword [0x14017cbb8]
mov qword [0x14017cbb0], rax
mov ecx, 0x20
call fcn.14011a310
mov rsi, rax
lea rcx, str.vmodule
mov qword [rbp - 0x50], rcx
call fcn.140120c40
mov qword [rbp - 0x48], rax
lea r15, [rbp - 0x20]
lea r8, [rbp - 0x50]
mov rcx, rdi
mov rdx, r15
call fcn.140031180
mov qword [rbp - 0x60], rbx
mov rcx, rbx
call fcn.140120c40
mov qword [rbp - 0x58], rax
lea rbx, [rbp - 0x40]
lea r8, [rbp - 0x60]
mov rcx, rdi
mov rdx, rbx
call fcn.140031180
lea r9, [0x14017cbc0]
mov rcx, rsi
mov rdx, rbx
mov r8, r15
call fcn.140051500
mov qword [0x14017cbb8], rsi
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x14002bd35
mov rcx, qword [rbp - 0x40]
add rax, 1
cmp rax, 0x1000
jb 0x14002bd30
test cl, 0x1f
jne 0x14002be81
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14002be81
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
mov rcx, rax
jae 0x14002be81
call fcn.14011a350
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x14002bd7e
mov rcx, qword [rbp - 0x20]
add rax, 1
cmp rax, 0x1000
jb 0x14002bd79
test cl, 0x1f
jne 0x14002be81
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14002be81
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
mov rcx, rax
jae 0x14002be81
call fcn.14011a350
mov eax, dword [r14]
mov dword [0x14017b508], eax
mov bl, 1
test al, 1
je 0x14002be63
mov rcx, qword [0x14017cc08]
test rcx, rcx
je 0x14002bdae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017cc08], 0
mov rdi, qword [0x14017cbc8]
test rdi, rdi
jne 0x14002bde7
mov ecx, 0x20
call fcn.14011a310
mov rdi, rax
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rdi + 0x10], xmm0
mov word [rdi], 0
mov qword [0x14017cbc8], rdi
mov rsi, qword [r14 + 8]
mov rcx, rsi
call fcn.140120930
mov rbx, rax
mov rax, qword [rdi + 0x18]
cmp rax, rbx
jae 0x14002be16
mov rcx, rdi
mov rdx, rbx
mov r9, rsi
call fcn.140005da0
cmp dword [r14 + 0x14], 0
jne 0x14002be5c
jmp 0x14002be45
mov r15, rdi
cmp rax, 8
jb 0x14002be22
mov r15, qword [rdi]
mov qword [rdi + 0x10], rbx
mov r8, rbx
add r8, rbx
mov rcx, r15
mov rdx, rsi
call fcn.14011d3a0
mov word [r15 + rbx*2], 0
cmp dword [r14 + 0x14], 0
jne 0x14002be5c
mov rcx, qword [0x14017cbc8]
cmp qword [rcx + 0x18], 7
jbe 0x14002be56
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.14002be90
mov ebx, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.14011a370
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call fcn.140120f80
ud2
int3
Function at 0x14002e210
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15d, edx
mov rsi, rcx
mov rax, qword [rcx + 0x10]
mov dil, 1
test rax, rax
je 0x14002e3bf
cmp rax, 0x103
jbe 0x14002e250
xor edi, edi
jmp 0x14002e3bf
lea rbp, [rsp + 0x40]
mov rcx, rsi
mov rdx, rbp
call fcn.140029a30
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x58], 7
jbe 0x14002e272
mov rbp, qword [rsp + 0x40]
test rax, rax
je 0x14002e2b1
jle 0x14002e2b1
lea rax, [rax*2]
add rax, rbp
mov rbx, rbp
nop word [rax + rax]
movzx ecx, word [rbx]
cmp ecx, 0x3f
je 0x14002e3db
movzx ecx, cx
cmp ecx, 0x2a
je 0x14002e3db
add rbx, 2
cmp rbx, rax
jb 0x14002e290
lea rcx, [rsp + 0x40]
call fcn.1400289c0
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x14002e2c8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x14002e3bf
test bl, 1
je 0x14002e2fe
mov edx, ebx
and edx, 0xfffffffe
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x14002e2f0
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x14002e249
test bl, 0x10
jne 0x14002e31b
cmp qword [rsi + 0x18], 7
jbe 0x14002e30d
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14002e3b9
test r15b, r15b
je 0x14002e3a6
movaps xmm0, xmmword [0x14014ef60]
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x40], 0x2a
lea rdx, [rsp + 0x40]
mov r8b, 1
mov rcx, rsi
call fcn.14002e440
mov ebx, eax
mov rax, qword [rsp + 0x58]
cmp rax, 8
jb 0x14002e39e
add rax, 1
js 0x14002e434
mov rcx, qword [rsp + 0x40]
add rax, rax
cmp rax, 0x1000
jb 0x14002e399
test cl, 0x1f
jne 0x14002e434
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14002e434
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
mov rcx, rax
jae 0x14002e434
call fcn.14011a350
test bl, bl
je 0x14002e249
cmp qword [rsi + 0x18], 7
jbe 0x14002e3b0
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14011a370
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
sub rbx, rbp
lea rcx, [rsp + 0x40]
call fcn.1400289c0
cmp rbx, 0xfffffffffffffffe
je 0x14002e2bb
lea r14, [rsp + 0x40]
mov rcx, rsi
mov rdx, r14
call fcn.140029a30
lea rbx, [rsp + 0x20]
mov rcx, rsi
mov rdx, rbx
call fcn.140029680
mov rcx, rbx
mov rdx, r14
mov r8d, r15d
call fcn.14002e440
mov edi, eax
mov rcx, rbx
call fcn.1400289c0
mov rcx, r14
call fcn.1400289c0
jmp 0x14002e3bf
call fcn.140120f80
ud2
Function at 0x14002e440
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
mov ebx, r8d
mov r14, rdx
mov rax, rcx
mov rcx, qword [0x14017b818]
xor rcx, rsp
mov qword [rsp + 0x570], rcx
mov qword [rsp + 0x20], rdx
lea rdi, [rsp + 0x2a0]
xor r8d, r8d
mov r9d, 3
mov rcx, rdi
mov rdx, rax
call fcn.140047170
lea rsi, [rsp + 0x280]
mov rcx, rdi
mov rdx, rsi
call fcn.1400472e0
cmp qword [rsp + 0x290], 0
je 0x14002e5b7
mov r15b, 1
lea rdi, [rsp + 0x2a0]
lea rbp, [rsp + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r12, qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop
mov rcx, rdi
mov rdx, rbp
call fcn.140047250
mov edx, dword [rsp + 0x30]
test dl, 1
je 0x14002e514
test bl, bl
jne 0x14002e4f8
mov rcx, rbp
call fcn.140046f50
test al, al
jne 0x14002e514
mov edx, dword [rsp + 0x30]
and edx, 0xfffffffe
cmp qword [rsp + 0x298], 7
mov rcx, rsi
jbe 0x14002e511
mov rcx, qword [rsp + 0x280]
call r12
mov rcx, rbp
call fcn.140046f50
test al, al
je 0x14002e560
test bl, bl
je 0x14002e580
mov r8b, 1
mov rcx, rsi
mov rdx, r14
call fcn.14002e440
test al, al
je 0x14002e57d
cmp qword [rsp + 0x298], 7
mov rcx, rsi
jbe 0x14002e54c
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14002e580
jmp 0x14002e57d
cmp qword [rsp + 0x298], 7
mov rcx, rsi
jbe 0x14002e576
mov rcx, qword [rsp + 0x280]
call r13
test eax, eax
jne 0x14002e580
xor r15d, r15d
mov rcx, rbp
call fcn.14004be30
mov rcx, rdi
mov rdx, rbp
call fcn.1400472e0
mov rcx, rsi
mov rdx, rbp
call fcn.140028aa0
mov rcx, rbp
call fcn.1400289c0
cmp qword [rsp + 0x290], 0
jne 0x14002e4d0
jmp 0x14002e5ba
mov r15b, 1
lea rcx, [rsp + 0x280]
call fcn.1400289c0
and r15b, 1
lea rcx, [rsp + 0x2a0]
call fcn.1400471a0
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.14011a370
mov eax, r15d
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14002e600
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x10], 0x103
jbe 0x14002e612
xor eax, eax
jmp 0x14002e62f
cmp qword [rcx + 0x18], 7
jbe 0x14002e61c
mov rcx, qword [rcx]
xor edx, edx
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x14002e640
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rdx + 0x18], 7
jbe 0x14002e65d
mov rdx, qword [rdi]
cmp qword [rbx + 0x18], 7
mov rcx, rbx
jbe 0x14002e66a
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov bpl, 1
test eax, eax
jne 0x14002e6da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004fc40
mov r14d, eax
cmp qword [rbx + 0x18], 7
jbe 0x14002e691
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 7
jbe 0x14002e69b
mov rdi, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x14002e6da
test rsi, rsi
je 0x14002e6d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004fc40
cmp eax, 0xfffffffc
cmovne r14d, eax
mov dword [rsi], r14d
xor ebp, ebp
mov eax, ebp
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret