joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bcb8
Capabilities:
Get disk information via ioctl

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rsp + 0x58], 0
mov rsi, rcx
mov rcx, rdx
mov rbx, rdx
call fcn.140001518
mov rax, qword [rbx]
mov r9d, 1
mov edx, 0x540
mov r8d, dword [rax - 0xc]
sub r9d, dword [rax - 8]
sub r8d, edx
or r9d, r8d
jge 0x14001bd00
mov rcx, rbx
call fcn.140001690
mov rax, qword [rbx]
cmp dword [rax - 8], 1
mov edi, dword [rax - 0xc]
jle 0x14001bd1a
mov edx, dword [rax - 0x10]
mov rcx, rbx
call fcn.140001588
mov rax, qword [rbx]
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov rcx, rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x70050
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14001bd95
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 0x7a
jne 0x14001bd7b
mov r8, qword [rbx]
mov ecx, dword [r8 - 0xc]
lea edx, [rcx + 0x480]
test edx, edx
js 0x14001bdb7
mov eax, 1
sub ecx, edx
sub eax, dword [r8 - 8]
or eax, ecx
jmp 0x14001bcf6
test ecx, ecx
mov eax, 0x65b
cmovne eax, ecx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
movsxd rax, dword [rsp + 0x58]
test eax, eax
js 0x14001bdb7
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14001bdb7
mov dword [rcx - 0x10], eax
mov rcx, rax
mov rax, qword [rbx]
mov byte [rcx + rax], 0
xor eax, eax
jmp 0x14001bd85
mov ecx, 0x80070057
call fcn.140002198
int3

Function at 0x14001bdc4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, rdx
mov rsi, rcx
call fcn.140001b5c
xor r14d, r14d
mov rcx, rax
test rax, rax
je 0x14001bead
mov rax, qword [rax]
call qword [rax + 0x18]
mov edx, 0x104
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov eax, dword [rbx - 0xc]
mov ecx, 1
sub ecx, dword [rbx - 8]
sub eax, edx
or ecx, eax
jge 0x14001be24
lea rcx, [rsp + 0x50]
call fcn.1400020a8
mov rbx, qword [rsp + 0x50]
mov edi, dword [rbx - 0xc]
mov rdx, rbx
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, eax
test eax, eax
je 0x14001be6d
cmp eax, edi
jbe 0x14001be46
test eax, eax
js 0x14001beb8
jmp 0x14001be04
sub edx, 1
js 0x14001beb8
cmp edx, dword [rbx - 0xc]
jg 0x14001beb8
movsxd rax, edx
mov rcx, rbp
mov dword [rbx - 0x10], edx
lea rdx, [rsp + 0x50]
mov word [rbx + rax*2], r14w
call fcn.14001a3e0
mov edi, r14d
jmp 0x14001be7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov edi, 0x65b
cmovne edi, eax
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001be98
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.140002198
int3
mov ecx, 0x80070057
call fcn.140002198
int3
Function at 0x14001bec4
Capabilities:
Check if file exists
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp + 0x18], r8d
push rsi
push rdi
push r14
sub rsp, 0x40
xor ebx, ebx
mov r14, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14001bef2
mov eax, 0x10da
jmp 0x14001bfa1
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x14001bf13
test dil, 1
je 0x14001bf13
mov edx, eax
mov rcx, rsi
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000080
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14001bf7f
mov r8d, dword [rsp + 0x70]
lea r9, [rsp + 0x70]
mov rdx, r14
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14001bf74
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, 0x65b
cmovne ebx, eax
mov rcx, rbp
call qword [fcn.140037368]
jmp 0x14001bf8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, 0x65b
cmovne ebx, eax
cmp edi, 0xffffffff
je 0x14001bf9f
mov edx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14001c18c
Capabilities:
Access pe header
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
and qword [rax - 0x18], 0
xor r9d, r9d
mov dword [rax - 0x20], 0x2000000
mov edx, 0x80000000
mov dword [rax - 0x28], 3
lea r8d, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001c1dd
mov esi, 0xffff
jmp 0x14001c2b0
and qword [rsp + 0x28], 0
xor r9d, r9d
and dword [rsp + 0x20], 0
xor edx, edx
mov rcx, rdi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov rbx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
mov esi, 0xffff
test rax, rax
je 0x14001c284
mov rcx, rax
movzx ebp, si
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x14001c238
movzx ebp, word [rax + 4]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
movzx ecx, bp
sub ecx, 0x14c
je 0x14001c282
sub ecx, 0x78
je 0x14001c27b
sub ecx, 0x3c
je 0x14001c274
sub ecx, 0x8464
je 0x14001c26d
cmp ecx, 0x2400
jne 0x14001c284
mov esi, 0xc
jmp 0x14001c284
mov esi, 9
jmp 0x14001c284
mov esi, 6
jmp 0x14001c284
mov esi, 5
jmp 0x14001c284
xor esi, esi
cmp rbx, 0xffffffffffffffff
je 0x14001c29d
mov rcx, rbx
call qword [fcn.140037368]
test eax, eax
jne 0x14001c29d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [fcn.140037368]
test eax, eax
jne 0x14001c2b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14001c378
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
and dword [r8], 0
lea rax, [r11 + 0x18]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c3b8
mov eax, dword [rsp + 0x58]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0x65e
add rsp, 0x38
ret
Function at 0x14001c3c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
lea rax, [r11 + 0x20]
mov rbx, r8
xor r14d, r14d
mov qword [r11 - 0x30], rax
lea r9, [r11 - 0x28]
mov qword [r11 - 0x38], r14
xor r8d, r8d
mov dword [r11 + 0x20], r14d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c419
mov edx, dword [rsp + 0x30]
lea ecx, [r14 + 1]
lea eax, [rdx - 1]
cmp eax, ecx
jbe 0x14001c42c
cmp edx, 7
je 0x14001c42c
mov eax, 0x65e
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov rdi, qword [rbx]
mov edx, dword [rsp + 0x78]
add edx, 2
shr edx, 1
mov eax, dword [rdi - 0xc]
sub ecx, dword [rdi - 8]
sub eax, edx
or ecx, eax
jge 0x14001c44f
mov rcx, rbx
call fcn.1400020a8
mov rdi, qword [rbx]
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c419
mov edx, dword [rsp + 0x78]
shr edx, 1
je 0x14001c487
lea ecx, [rdx - 1]
cmp word [rdi + rcx*2], r14w
cmove edx, ecx
test edx, edx
js 0x14001c4a8
mov rax, qword [rbx]
cmp edx, dword [rax - 0xc]
jg 0x14001c4a8
mov dword [rax - 0x10], edx
mov rax, qword [rbx]
movsxd rcx, edx
mov word [rax + rcx*2], r14w
xor eax, eax
jmp 0x14001c419
mov ecx, 0x80070057
call fcn.140002198
int3

Function at 0x14001c514
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x60
and qword [r11 - 0x28], 0
lea rax, [r11 - 0x18]
mov qword [r11 - 0x30], rax
mov ebx, r9d
and qword [r11 - 0x38], 0
mov rdi, r8
mov dword [rsp + 0x28], 0x20006
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 4
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001c593
mov eax, dword [rsp + 0x98]
mov r9d, ebx
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rdi
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [0x140057c38]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14001c740
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
mov rbx, r9
mov rcx, r9
mov rsi, r8
mov rbp, rdx
call fcn.140001518
mov rdx, qword [rbx]
mov edi, 1
mov eax, dword [rdx - 0xc]
mov dword [rsp + 0x68], eax
cmp dword [rdx - 8], edi
jle 0x14001c788
mov edx, dword [rdx - 0x10]
mov rcx, rbx
call fcn.140001588
mov rdx, qword [rbx]
lea rax, [rsp + 0x68]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, r14
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14001c7fb
cmp eax, 0xea
jne 0x14001c81b
mov edx, dword [rsp + 0x68]
test edx, edx
js 0x14001c82e
mov rcx, qword [rbx]
mov eax, dword [rcx - 0xc]
sub edi, dword [rcx - 8]
sub eax, edx
or edi, eax
jge 0x14001c7d6
mov rcx, rbx
call fcn.140001690
mov rcx, qword [rbx]
lea rax, [rsp + 0x68]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c81b
movsxd rax, dword [rsp + 0x68]
test eax, eax
js 0x14001c82e
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x14001c82e
mov dword [rcx - 0x10], eax
mov rcx, rax
mov rax, qword [rbx]
mov byte [rcx + rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80070057
call fcn.140002198
int3
Function at 0x14001c83c
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x70
mov r14, rcx
call fcn.140001b5c
mov rcx, rax
test rax, rax
je 0x14001c9f3
mov rax, qword [rax]
call qword [rax + 0x18]
mov ecx, 1
lea rbx, [rax + 0x18]
mov eax, dword [rbx - 0xc]
sub ecx, dword [rbx - 8]
sub eax, 0x4000
or ecx, eax
mov qword [rbp - 8], rbx
jge 0x14001c897
mov edx, 0x4000
lea rcx, [rbp - 8]
call fcn.1400020a8
mov rbx, qword [rbp - 8]
and qword [rsp + 0x58], 0
lea rax, [rbp + 0x40]
and qword [rsp + 0x50], 0
xor r9d, r9d
and qword [rsp + 0x48], 0
xor r8d, r8d
and qword [rsp + 0x40], 0
xor edx, edx
mov qword [rsp + 0x38], rax
mov rcx, r14
and qword [rsp + 0x30], 0
lea rax, [rbp + 0x38]
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
test eax, eax
jne 0x14001c9c3
or r12d, 0xffffffff
jmp 0x14001c959
add ecx, r12d
mov r9d, 0x4000
mov dword [rbp + 0x38], ecx
mov edx, ecx
mov rcx, r14
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test eax, eax
jne 0x14001c952
and qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov r9d, 0x3001f
mov qword [rsp + 0x20], rax
lea r8d, [rsi + 4]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x10]
mov esi, eax
test eax, eax
jne 0x14001c947
call fcn.14001ca00
mov rcx, qword [rbp - 0x10]
mov esi, eax
test rcx, rcx
je 0x14001c952
call qword [0x140057c38]
test esi, esi
cmove esi, edi
mov edi, esi
mov ecx, dword [rbp + 0x38]
test ecx, ecx
jne 0x14001c8ee
mov ecx, r12d
mov dword [rbp + 0x38], ecx
jmp 0x14001c9b6
and qword [rsp + 0x38], 0
lea r9, [rbp + 0x48]
and qword [rsp + 0x30], 0
add eax, r12d
and qword [rsp + 0x28], 0
mov edx, eax
and qword [rsp + 0x20], 0
mov r8, rbx
mov rcx, r14
mov dword [rbp + 0x40], eax
mov dword [rbp + 0x48], 0x4000
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x14001c9b1
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
cmove eax, edi
mov edi, eax
mov eax, dword [rbp + 0x40]
test eax, eax
jne 0x14001c968
mov eax, r12d
mov dword [rbp + 0x40], eax
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001c9dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0xa0]
mov eax, edi
add rsp, 0x70
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002198
int3

Function at 0x14001ca00
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.14001c83c
test eax, eax
jne 0x14001ca2f
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtDeleteKey]
test eax, eax
je 0x14001ca2d
mov ecx, eax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14001d064
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rdi
mov rax, qword [0x14006f5c0]
xor rax, rbp
mov qword [rbp + 0x10], rax
and qword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
mov rsi, rdx
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001d1ac
lea rdx, [rbp + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001d1ac
mov rcx, qword [rbp + 8]
cmp rcx, 0x40000000
jle 0x14001d0ea
mov esi, 0x80070018
jmp 0x14001d1b3
mov eax, ecx
lea rdx, [rax + 0x10]
cmp rax, rdx
sbb r8, r8
and r8, rdx
je 0x14001d156
cmp r8, 0x400
ja 0x14001d135
lea rax, [r8 + 0xf]
cmp rax, r8
ja 0x14001d117
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140040840
sub rsp, rax
lea rdi, [rsp + 0x40]
test rdi, rdi
je 0x14001d15d
mov dword [rdi], 0xcccc
jmp 0x14001d14c
mov rcx, r8
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14001d150
mov dword [rax], 0xdddd
add rdi, 0x10
mov rcx, qword [rbp + 8]
jmp 0x14001d158
xor edi, edi
test rdi, rdi
jne 0x14001d164
mov esi, 0x8007000e
jmp 0x14001d1b3
and qword [rsp + 0x20], 0
lea r9, [rbp]
mov r8d, ecx
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001d191
mov edx, dword [rbp]
mov r8, rsi
mov rcx, rdi
call fcn.14001d1ec
jmp 0x14001d196
call fcn.14001b570
lea rcx, [rdi - 0x10]
mov esi, eax
cmp dword [rcx], 0xdddd
jne 0x14001d1b3
call qword [sym.imp.msvcrt.dll_free]
jmp 0x14001d1b3
call fcn.14001b570
mov esi, eax
cmp rbx, 0xffffffffffffffff
je 0x14001d1cc
mov rcx, rbx
call qword [fcn.140037368]
test eax, eax
jne 0x14001d1cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, esi
mov rcx, qword [rbp + 0x10]
xor rcx, rbp
call fcn.1400408d0
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x14001d730
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x14006f5c0]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rbx, rcx
mov dword [rsp + 0x28], 0x4021
mov r8, rcx
mov dword [rsp + 0x20], 7
lea rcx, [rsp + 0x60]
mov edx, 0x100001
lea r9, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtOpenFile]
xor r14d, r14d
mov esi, eax
test eax, eax
jne 0x14001d8bb
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 4]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x68]
mov qword [rbx + 0x10], rax
mov dword [rsp + 0x68], r14d
mov qword [rbx + 8], rcx
jmp 0x14001d866
mov eax, dword [rbp - 4]
mov edx, dword [rbp - 8]
mov word [rsp + 0x6a], ax
mov word [rsp + 0x68], ax
test dl, 0x10
je 0x14001d82b
bt edx, 0xa
jae 0x14001d7e1
test dword [rbp], 0x20000000
jne 0x14001d82b
jmp 0x14001d802
cmp eax, 2
je 0x14001d7fb
cmp eax, 4
jne 0x14001d802
cmp word [rbp + 4], 0x2e
jne 0x14001d802
cmp word [rbp + 6], 0x2e
jne 0x14001d802
jmp 0x14001d861
cmp word [rbp + 4], 0x2e
je 0x14001d861
movups xmm0, xmmword [rbx]
lea rcx, [rbp - 0x70]
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rbp - 0x70], xmm0
movups xmm0, xmmword [rbx + 0x20]
movaps xmmword [rbp - 0x60], xmm1
movaps xmmword [rbp - 0x50], xmm0
call fcn.14001d730
mov edi, eax
test eax, eax
jne 0x14001d85f
mov edx, dword [rbp - 8]
test dl, 1
je 0x14001d841
xor edx, 1
mov rcx, rbx
call fcn.14001db68
mov edi, eax
test eax, eax
jne 0x14001d85f
mov rcx, rbx
call fcn.14001d988
mov edi, eax
test eax, eax
je 0x14001d861
mov edx, dword [rbp - 8]
test dl, 1
je 0x14001d85f
mov rcx, rbx
call fcn.14001db68
mov esi, edi
mov rcx, qword [rsp + 0x60]
mov byte [rsp + 0x50], r14b
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], r14
xor r9d, r9d
mov byte [rsp + 0x40], 0xff
xor r8d, r8d
mov dword [rsp + 0x38], 2
xor edx, edx
mov dword [rsp + 0x30], 0x248
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwQueryDirectoryFile]
test eax, eax
je 0x14001d7bb
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.1400408d0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001d988
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rsi, rcx
mov dword [rsp + 0x28], 0x204000
mov r8, rcx
mov dword [rsp + 0x20], 5
mov edi, 0x110000
lea r9, [rbp + 7]
mov edx, edi
lea rcx, [rbp + 0x77]
call qword [sym.imp.ntdll.dll_NtOpenFile]
xor ebx, ebx
test eax, eax
jne 0x14001db4f
mov rcx, qword [rbp + 0x77]
lea r9d, [rbx + 1]
lea r8, [rbp + 0x6f]
mov byte [rbp + 0x6f], 1
lea rdx, [rbp + 7]
mov dword [rsp + 0x20], 0xd
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov rcx, qword [rbp + 0x77]
mov r14d, eax
call qword [sym.imp.ntdll.dll_NtClose]
test r14d, r14d
jne 0x14001da12
xor eax, eax
jmp 0x14001db4f
mov rax, qword [rsi + 0x10]
movzx ecx, word [rax]
add rcx, 4
mov word [rbp - 9], cx
mov word [rbp - 7], cx
call fcn.140040c48
mov rdx, qword [rsi + 0x10]
mov rcx, rax
mov qword [rbp - 1], rax
movzx r8d, word [rdx]
mov rdx, qword [rdx + 8]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi + 0x10]
lea r9, [rbp + 7]
mov dword [rsp + 0x50], ebx
lea r8, [rbp + 0x17]
mov qword [rsp + 0x48], rbx
mov edx, 0x7e
mov dword [rsp + 0x40], 0x5000
movzx ecx, word [rax]
mov rax, qword [rbp - 1]
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 0x80
mov word [rcx + rax], dx
mov edx, 0x24
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x20], rbx
movzx ecx, word [rax]
mov rax, qword [rbp - 1]
mov word [rcx + rax + 2], dx
mov edx, edi
mov rax, qword [rsi + 8]
lea rcx, [rbp + 0x77]
mov qword [rbp + 0x1f], rax
lea rax, [rbp - 9]
mov qword [rbp + 0x27], rax
xor eax, eax
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x3f], rax
mov dword [rbp + 0x17], 0x30
mov dword [rbp + 0x2f], 0x40
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov rcx, qword [rbp - 1]
call fcn.14003b3dc
mov rax, qword [rsi + 0x10]
movzx ebx, word [rax]
lea rcx, [rbx + 0x18]
call fcn.140040c48
mov rdx, qword [rsi + 0x10]
mov rdi, rax
lea rcx, [rax + 0x14]
movzx r8d, word [rdx]
mov rdx, qword [rdx + 8]
call sub.msvcrt.dll_memcpy
mov byte [rdi], 1
lea r9d, [rbx + 0x18]
mov rcx, qword [rsi + 8]
mov r8, rdi
mov qword [rdi + 8], rcx
mov rcx, qword [rsi + 0x10]
mov dword [rsp + 0x20], 0xa
movzx edx, word [rcx]
mov dword [rdi + 0x10], edx
lea rdx, [rbp + 7]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov rcx, rdi
mov ebx, eax
call fcn.14003b3dc
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntdll.dll_NtClose]
neg ebx
sbb eax, eax
and eax, r14d
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001db68
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14006f5c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov ebx, edx
mov dword [rsp + 0x28], 0x204020
mov r8, rcx
mov dword [rsp + 0x20], 7
mov edx, 0x100100
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
jne 0x14001dbf4
xor edx, edx
lea r8d, [rax + 0x20]
lea rcx, [rsp + 0x48]
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x48]
mov r9d, 0x28
mov dword [rsp + 0x68], ebx
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x20], 4
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400408d0
add rsp, 0x80
pop rbx
ret

Function at 0x14001e2b4
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
mov rdi, rcx
call fcn.140001b5c
test rax, rax
je 0x14001e439
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rcx, [rbp + 0x38]
mov qword [rbp + 0x38], rax
call fcn.14001b988
or r15d, 0xffffffff
test eax, eax
jne 0x14001e3e0
mov rax, qword [rbp + 0x38]
movsxd rcx, dword [rax - 0x10]
lea edx, [rcx - 1]
test edx, edx
js 0x14001e42e
cmp edx, ecx
jg 0x14001e42e
lea edx, [r15 + 0x5d]
cmp word [rax + rcx*2 - 2], dx
je 0x14001e32d
lea rcx, [rbp + 0x38]
call fcn.14001a668
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r14d, eax
jmp 0x14001e36b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
lea rdx, [rbx - 0x18]
mov eax, r15d
jne 0x14001e3cb
inc esi
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001e36b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x40]
call fcn.14001a8f4
mov r9d, r14d
lea rdx, str.patchmgr_x__x_
mov r8d, esi
lea rcx, [rbp + 0x40]
call fcn.14001afac
mov rbx, qword [rbp + 0x40]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14001e340
lea rdx, [rbp + 0x40]
mov rcx, rdi
call fcn.14001a8f4
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001e3fa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14001e3fa
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001e3e0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
call fcn.140001b5c
test rax, rax
je 0x14001e439
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov rdx, qword [rbp + 0x38]
mov eax, r15d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001e41a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140002198
int3
mov ecx, 0x80004005
call fcn.140002198
int3