joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019c9c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r9
mov r13, r8
mov rsi, rdx
mov r14, rcx
movzx eax, byte [r8]
mov edx, eax
movabs rcx, 0xcbf29ce484222325
xor rdx, rcx
movabs rcx, 0x100000001b3
imul rdx, rcx
mov qword [rsp + 0x60], rdx
mov rcx, qword [r14 + 0x30]
and rcx, rdx
add rcx, rcx
mov rdx, qword [r14 + 0x18]
mov rbx, qword [rdx + rcx*8 + 8]
lea r8, [r14 + 8]
mov r15, qword [r8]
cmp rbx, r15
jne 0x14019ca35
mov rbx, r15
mov rbp, r15
jmp 0x14019ca7b
mov rcx, qword [rdx + rcx*8]
cmp al, byte [rbx + 0x10]
je 0x14019ca4e
nop
cmp rbx, rcx
je 0x14019ca75
mov rbx, qword [rbx + 8]
cmp al, byte [rbx + 0x10]
jne 0x14019ca40
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0x666666666666666
cmp qword [r14 + 0x10], rax
je 0x14019cbfc
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], 0
mov ecx, 0x28
call fcn.1403e3660
mov rdi, rax
mov qword [rsp + 0x28], rax
movzx ecx, byte [r13]
mov byte [rax + 0x10], cl
xor r13d, r13d
mov qword [rax + 0x18], r13
mov qword [rax + 0x20], r13
mov rcx, qword [r12]
mov qword [rax + 0x18], rcx
mov rcx, qword [r12 + 8]
mov qword [rax + 0x20], rcx
mov qword [r12], r13
mov qword [r12 + 8], r13
mov rcx, qword [r14 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x14019caf0
cvtsi2ss xmm0, rcx
jmp 0x14019cb05
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r14 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14019cb18
cvtsi2ss xmm1, rcx
jmp 0x14019cb2d
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r14]
seta al
test al, al
je 0x14019cba0
mov rcx, r14
call fcn.1401a0880
mov r8, qword [rsp + 0x60]
mov rdx, r8
and rdx, qword [r14 + 0x30]
add rdx, rdx
mov rcx, qword [r14 + 0x18]
mov rax, qword [rcx + rdx*8 + 8]
mov rbx, qword [r14 + 8]
cmp rax, rbx
je 0x14019cb86
mov rdx, qword [rcx + rdx*8]
movzx ecx, byte [rdi + 0x10]
cmp cl, byte [rax + 0x10]
je 0x14019cb83
mov rbx, rax
cmp rax, rdx
je 0x14019cb93
mov rax, qword [rax + 8]
cmp cl, byte [rax + 0x10]
jne 0x14019cb72
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, rbx
jmp 0x14019cba5
mov qword [rsp + 0x20], rax
mov rbp, rbx
mov r15, rax
jmp 0x14019cba5
mov r8, qword [rsp + 0x60]
mov rdx, qword [rbx + 8]
inc qword [r14 + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 0x30]
and rax, r8
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [r14 + 8]
jne 0x14019cbd9
mov qword [rcx + rax*8], rdi
jmp 0x14019cbeb
cmp r8, rbp
jne 0x14019cbe4
mov qword [rcx + rax*8], rdi
jmp 0x14019cbf0
cmp qword [rcx + rax*8 + 8], rdx
jne 0x14019cbf0
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x14019ca55
lea rcx, str.unordered_map_set_too_long
call fcn.1403c238c
int3
Function at 0x1401a0470
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
mov r14, rcx
movzx eax, byte [r8]
mov r13d, eax
movabs rcx, 0xcbf29ce484222325
xor r13, rcx
movabs rcx, 0x100000001b3
imul r13, rcx
mov rcx, qword [r14 + 0x30]
and rcx, r13
add rcx, rcx
mov rdx, qword [r14 + 0x18]
mov rbx, qword [rdx + rcx*8 + 8]
lea r8, [r14 + 8]
mov r15, qword [r8]
cmp rbx, r15
jne 0x1401a04de
mov rbx, r15
mov rbp, r15
jmp 0x1401a0522
mov rcx, qword [rdx + rcx*8]
cmp al, byte [rbx + 0x10]
je 0x1401a04f5
cmp rbx, rcx
je 0x1401a051c
mov rbx, qword [rbx + 8]
cmp al, byte [rbx + 0x10]
jne 0x1401a04e7
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0x666666666666666
cmp qword [r14 + 0x10], rax
je 0x1401a067f
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], 0
mov ecx, 0x28
call fcn.1403e3660
mov rdi, rax
mov qword [rsp + 0x28], rax
movzx ecx, byte [r12]
mov byte [rax + 0x10], cl
xor r12d, r12d
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r12
mov rcx, qword [r14 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1401a057d
cvtsi2ss xmm0, rcx
jmp 0x1401a0592
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r14 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1401a05a5
cvtsi2ss xmm1, rcx
jmp 0x1401a05ba
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r14]
seta al
test al, al
je 0x1401a0621
mov rcx, r14
call fcn.1401a0880
mov rdx, qword [r14 + 0x30]
and rdx, r13
add rdx, rdx
mov rcx, qword [r14 + 0x18]
mov rax, qword [rcx + rdx*8 + 8]
mov rbx, qword [r14 + 8]
cmp rax, rbx
je 0x1401a0614
mov rdx, qword [rcx + rdx*8]
movzx ecx, byte [rdi + 0x10]
cmp cl, byte [rax + 0x10]
je 0x1401a0611
nop word [rax + rax]
mov rbx, rax
cmp rax, rdx
je 0x1401a0655
mov rax, qword [rax + 8]
cmp cl, byte [rax + 0x10]
jne 0x1401a0600
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [r14 + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 0x30]
and rax, r13
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [r14 + 8]
jne 0x1401a065c
mov qword [rcx + rax*8], rdi
jmp 0x1401a066e
mov qword [rsp + 0x20], rax
jmp 0x1401a0619
cmp r8, rbp
jne 0x1401a0667
mov qword [rcx + rax*8], rdi
jmp 0x1401a0673
cmp qword [rcx + rax*8 + 8], rdx
jne 0x1401a0673
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x1401a04fc
lea rcx, str.unordered_map_set_too_long
call fcn.1403c238c
int3
Function at 0x1401a0e70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1401a08a5
cvtsi2ss xmm0, rdx
jmp 0x1401a08ba
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.14043cb28
movss xmm1, dword [0x14057a8a0]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1401a08e8
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1401a08e8
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1401a091a
cmp rbx, 0x200
jae 0x1401a0917
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1401a091a
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1401a0e70
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1401a0fff
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400eda30
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1401a0fc4
mov qword [rsp + 0x38], rbp
movabs rdi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
mov edx, r9d
mov rcx, qword [rcx]
xor rdx, rdi
imul rdx, rbp
and r11, rdx
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x1401a0f42
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1401a0fb3
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x1401a0f7b
mov r10, qword [rdx]
cmp r10, rax
je 0x1401a0f75
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1401a0fb3
cmp r8, rdx
je 0x1401a0f8f
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x1401a0fd9
cmp r8, rdx
jne 0x1401a0f80
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1401a0f10
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1401a0fb3
lea rcx, str.invalid_hash_bucket_count
call fcn.1403c238c
int3
Function at 0x1401a8290
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
mov byte [rcx + 0x1a0], 0
mov rdx, rbx
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1401a82df
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x70], eax
lea r9, str.WSAStartup_failed_
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.1401a8980
movzx eax, byte [rbx + 0x1a0]
add rsp, 0x60
pop rbx
ret
xor eax, eax
mov dword [rsp + 0x38], 1
cmp qword [0x1405fabb8], 0xf
lea rdx, str.7770
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
cmova rdx, qword [str.7770]
lea r9, [rbx + 0x198]
xorps xmm1, xmm1
mov dword [rsp + 0x3c], 6
lea r8, [rsp + 0x30]
lea rcx, str.127.0.0.1
movdqu xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x50], xmm1
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [rsp + 0x70], eax
test eax, eax
je 0x1401a8362
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
call fcn.1401a8c50
call qword [sym.imp.WS2_32.dll_WSACleanup]
movzx eax, byte [rbx + 0x1a0]
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x1a0], 1
mov al, 1
add rsp, 0x60
pop rbx
ret
Function at 0x1401a8380
Capabilities:
Connect socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
cmp byte [rcx + 0x1a0], 0
jne 0x1401a83d1
call fcn.1401a8290
test al, al
jne 0x1401a83d1
lea r9, str.unable_to_init_SparserChan
lea r8, str.SPARSERCHAN
mov edx, 4
call fcn.1400c6f10
xor al, al
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x198]
mov r8d, dword [rcx + 0xc]
mov edx, dword [rcx + 8]
mov ecx, dword [rcx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
jne 0x1401a841d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, str.socket_failed_with_error:_
call fcn.1401a8980
xor bl, bl
jmp 0x1401a84f2
mov rax, qword [rbx + 0x198]
mov r8d, dword [rax + 0x10]
mov rdx, qword [rax + 0x20]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1401a8446
lea r9, str.Unable_to_connect_to_server
jmp 0x1401a84db
mov rdx, qword [rsi]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1401a8450
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1401a848f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, str.send_failed_with_error:
call fcn.1401a8980
xor bl, bl
jmp 0x1401a84f2
mov edx, 1
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_shutdown]
cmp eax, 0xffffffff
jne 0x1401a84c6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, str.shutdown_SD_SEND_failed_with_error:_
call fcn.1401a8980
xor bl, bl
jmp 0x1401a84f2
lea rdx, [rsp + 0x50]
call fcn.1401a8510
test al, al
jne 0x1401a84f0
lea r9, str.ProcessReply_failed
lea r8, str.SPARSERCHAN
mov edx, 4
call fcn.1400c6f10
xor bl, bl
jmp 0x1401a84f2
mov bl, 1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_closesocket]
movzx eax, bl
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1401a8510
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rdx
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x50]
call fcn.14043d3a0
xor ebx, ebx
mov dword [rsp + 0x40], 0x2710
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1401a8590
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r9, str.setsockopt_failed_with_error:
jmp 0x1401a863e
mov r8d, 0x400
sub r8d, ebx
movsxd rax, ebx
lea rdx, [rsp + 0x50]
add rdx, rax
xor r9d, r9d
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1401a85b8
add ebx, eax
jmp 0x1401a8590
jne 0x1401a8631
xor edx, edx
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_shutdown]
cmp eax, 0xffffffff
jne 0x1401a85d9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r9, str.shutdown_SD_RECEIVE_failed_with_error:_
jmp 0x1401a863e
test ebx, ebx
jne 0x1401a85f5
lea r9, str.Reply_was_empty:_Connection_closed
lea r8, str.SPARSERCHAN
lea edx, [rbx + 3]
call fcn.1400c6f10
jmp 0x1401a8651
lea rax, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x1401a8601
movsxd rax, ebx
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.1401a7ec0
jmp 0x1401a8653
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r9, str.recv_failed_with_error:_
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.1401a8980
xor al, al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1403e3630
mov rbx, qword [rsp + 0x470]
add rsp, 0x460
pop rdi
ret

Function at 0x1401acaf0
Capabilities:
Delete directory
Delete file

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [rcx + 0xc], 0
mov rbx, rcx
je 0x1401acb7b
mov ecx, dword [rcx + 8]
xor edx, edx
mov qword [rsp + 0x78], rdi
lea r8d, [rdx + 1]
call fcn.14040b0bc
mov ecx, dword [rbx + 8]
call fcn.14040acdc
mov rdi, qword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi]
call fcn.14040bdd0
test eax, eax
jne 0x1401acb5f
movzx eax, word [rsp + 0x26]
mov ecx, 0xf000
and ax, cx
mov ecx, 0x4000
cmp ax, cx
jne 0x1401acb5f
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1401acb72
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401acb72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x78]
mov byte [rbx + 0xc], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1403e3630
add rsp, 0x60
pop rbx
ret
Function at 0x1401ace20
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
xor esi, esi
mov qword [rsp + 0x38], r14
mov rbx, 0xffffffffffffffff
mov r14, rcx
cmp word [rax + rbx*2 + 2], si
lea rbx, [rbx + 1]
jne 0x1401ace43
lea rbx, [rbx*2 + 2]
mov qword [rsp + 0x30], rbp
mov rcx, rbx
call fcn.1401ab990
mov rdx, qword [r14]
mov r8, rbx
mov rcx, rax
mov rdi, rax
call fcn.14043cc20
movzx eax, word [rdi]
mov rbx, rdi
mov r14, qword [rsp + 0x38]
test ax, ax
je 0x1401aced6
mov ebp, 0x5c
nop dword [rax]
cmp ax, bp
je 0x1401ace9b
cmp ax, 0x2f
jne 0x1401acec9
cmp rbx, rdi
je 0x1401acec9
cmp word [rbx - 2], 0x3a
je 0x1401acec9
xor edx, edx
mov word [rbx], si
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1401acec6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1401acf1b
mov word [rbx], bp
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x1401ace90
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1401acefc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov esi, 1
cmp eax, 0xb7
cmovne ecx, esi
mov esi, ecx
mov rcx, rdi
call fcn.1401ab980
mov rbp, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov esi, 1
jmp 0x1401acefc

Function at 0x1401ad540
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x60
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, rdx
mov rbx, rcx
mov rcx, qword [rcx]
lea rdx, [0x1404aba2c]
call fcn.1403fd9a4
mov rbp, rax
test rax, rax
je 0x1401ad646
mov rcx, qword [rbx]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x98], rdi
call fcn.14040bdd0
test eax, eax
jne 0x1401ad668
movzx eax, word [rsp + 0x26]
mov ecx, 0xf000
and ax, cx
mov ecx, 0x8000
cmp ax, cx
jne 0x1401ad668
movsxd rdi, dword [rsp + 0x34]
test rdi, rdi
je 0x1401ad668
mov qword [rsp + 0x90], rsi
cmp rdi, 0x8000000
ja 0x1401ad65c
lea rcx, [rdi + 1]
call fcn.1401ab990
mov rsi, rax
test rax, rax
je 0x1401ad65c
xor ebx, ebx
mov r9, rbp
mov r8, rdi
mov rcx, rax
lea edx, [rbx + 1]
call fcn.140404b68
test rax, rax
je 0x1401ad61f
nop dword [rax]
add rbx, rax
sub rdi, rax
mov r9, rbp
mov r8, rdi
mov edx, 1
lea rcx, [rbx + rsi]
call fcn.140404b68
test rax, rax
jne 0x1401ad600
mov rcx, rbp
mov byte [rbx + rsi], 0
call fcn.1403fdcd8
test r14, r14
je 0x1401ad633
mov qword [r14], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1403e3630
add rsp, 0x60
pop r14
pop rbp
pop rbx
ret
mov rcx, rbp
call fcn.1403fdcd8
xor eax, eax
jmp 0x1401ad636
mov rcx, rbp
call fcn.1403fdcd8
mov ecx, 1
call fcn.1401ab990
mov byte [rax], 0
test r14, r14
je 0x1401ad63e
xor ebx, ebx
mov qword [r14], rbx
jmp 0x1401ad63e
Function at 0x1401ad690
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx]
call fcn.14040bdd0
test eax, eax
jne 0x1401ad6f5
movzx eax, word [rsp + 0x26]
mov ecx, 0xf000
and ax, cx
mov ecx, 0x4000
cmp ax, cx
jne 0x1401ad6f5
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1401ad725
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1403e3630
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401ad725
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 2
setne cl
mov eax, ecx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1403e3630
add rsp, 0x60
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1403e3630
add rsp, 0x60
pop rbx
ret

Function at 0x1401ad880
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov qword [r11 + 0x10], rbp
mov rsi, rcx
mov qword [r11 + 0x18], rdi
xor r12d, r12d
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
jne 0x1401ad92f
mov rax, qword [rsi + 8]
mov rbx, 0xffffffffffffffff
mov rcx, qword [rax]
nop dword [rax]
cmp word [rcx + rbx*2 + 2], r12w
lea rbx, [rbx + 1]
jne 0x1401ad8d0
lea rcx, [rbx*2 + 6]
call fcn.1401ab990
mov rbp, rax
test rax, rax
je 0x1401ad98f
mov rdx, qword [rsi + 8]
lea rdi, [rbx + rbx]
mov r8, rdi
mov rcx, rax
mov rdx, qword [rdx]
call fcn.14043cc20
lea rdx, [rsp + 0x20]
mov dword [rdi + rbp], 0x2a005c
mov rcx, rbp
mov word [rbp + rbx*2 + 4], r12w
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
jmp 0x1401ad93c
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1401ad98f
movzx ecx, word [rsp + 0x4c]
movzx eax, word [rsp + 0x4e]
cmp cx, 0x2e
jne 0x1401ad96d
test ax, ax
je 0x1401ad8b2
cmp cx, cx
jne 0x1401ad96d
cmp ax, cx
jne 0x1401ad96d
cmp word [rsp + 0x50], r12w
je 0x1401ad8b2
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x1401ad97b
call fcn.1401ada60
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x4c]
call fcn.1401ad390
mov qword [rsi + 0x10], rax
jmp 0x1401ad991
xor eax, eax
mov rdi, qword [rsp + 0x2c0]
mov rbp, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1403e3630
add rsp, 0x280
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret

Function at 0x1401ada90
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.1401ad220
test al, al
je 0x1401adae2
mov rcx, rdi
mov qword [rsp + 0x30], rbx
call fcn.1401ad300
mov rcx, rax
mov rbx, rax
call fcn.1401ad880
test rax, rax
je 0x1401adad5
nop
mov rcx, rax
call fcn.1401ada90
mov rcx, rbx
call fcn.1401ad880
test rax, rax
jne 0x1401adac0
mov rcx, rbx
call fcn.1401ad840
mov rbx, qword [rsp + 0x30]
mov rcx, rdi
add rsp, 0x20
pop rdi
jmp fcn.1401ad690
Function at 0x1401af3c0
Capabilities:
Delete directory
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
call fcn.1401ada90
mov rcx, qword [rbx + 0x20]
add rsp, 0x20
pop rbx
jmp fcn.1401acaf0