joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412150
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
test edx, edx
jne 0x412180
test r8, r8
je 0x412230
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
cmp edx, 1
je 0x412260
cmp edx, 3
jne 0x412167
mov ecx, dword [0x00501168]
cmp ecx, 0xffffffff
je 0x412167
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x412167
test byte [rax + 0x40], 0x30
je 0x412290
mov rcx, qword [rax + 0x1d8]
test rcx, rcx
je 0x4121c2
call sym._pthread_cleanup_dest.part.0
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x4121ed
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r13
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x4121e3
call r13
pxor xmm0, xmm0
movups xmmword [r12 + 0x28], xmm0
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x412324
mov qword [r12 + 0x68], 0xffffffffffffffff
mov rcx, r12
call sym.push_pthread_mem
mov ecx, dword [0x00501168]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x412167
mov rcx, qword [0x005363d0]
test rcx, rcx
je 0x412167
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov qword [0x005363d0], 0
jmp 0x412167
lea rdx, [sym.SetThreadName_VEH]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [0x005363d0], rax
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
mov rcx, qword [rax + 0x30]
mov eax, dword [rax + 0xbc]
test eax, eax
jne 0x412330
test rcx, rcx
je 0x4122ad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r12 + 0x1d8]
mov qword [r12 + 0x30], 0
mov dword [r12 + 0xbc], 1
test rcx, rcx
je 0x4122d4
call sym._pthread_cleanup_dest.part.0
lea r13, [r12 + 0x38]
lea r14, [r12 + 0x68]
test byte [r12 + 0x44], 4
je 0x412370
mov rcx, qword [r12 + 0x28]
mov dword [r12], 0xdeadbeef
test rcx, rcx
je 0x412302
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x28], 0
mov rcx, r13
call sym.pthread_mutex_destroy
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
jne 0x41220a
call sym.replace_spin_keys.part.0
nop dword [rax]
test rcx, rcx
je 0x41233b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x30], 0
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x412324
mov qword [r12 + 0x68], 0xffffffffffffffff
jmp 0x412167
mov rcx, r13
call sym.pthread_mutex_destroy
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
jne 0x41235d
jmp 0x412324

Function at 0x412e10
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x00501168], eax
cmp eax, 0xffffffff
je sym.pthread_tls_init.cold
add rsp, 0x28
ret
Function at 0x4136a0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, [0x00501158]
mov ebx, edx
call sym.pthread_mutex_lock
mov rax, qword [0x005363e8]
test rax, rax
je 0x413710
mov r9, qword [0x005363f0]
lea r8, [rax - 1]
xor edx, edx
cmp rax, 1
jne 0x4136ee
jmp 0x413790
cmp rax, rdx
je 0x413710
lea r8, [rax - 1]
cmp r8, rdx
jb 0x413710
lea rax, [rdx + r8]
shr rax, 1
mov rcx, rax
shl rcx, 4
add rcx, r9
cmp r12, qword [rcx + 8]
je 0x413730
jb 0x4136e0
lea rdx, [rax + 1]
cmp r8, rdx
jae 0x4136ee
lea rcx, [0x00501158]
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x28
pop rbx
pop r12
ret
mov rax, qword [rcx]
test rax, rax
je 0x413710
cmp qword [rax + 0x1d8], r12
jne 0x413710
test byte [rax + 0x40], 0xc
jne 0x413710
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x413710
mov rax, qword [rax + 0x28]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x413710
lea rcx, [0x00501158]
call sym.pthread_mutex_unlock
test ebx, ebx
je 0x413788
sub ebx, 2
cmp ebx, 0x15
ja 0x4137a0
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
jmp sym.pthread_cancel
xor eax, eax
jmp 0x413721
cmp r12, qword [r9 + 8]
jne 0x413710
mov rax, qword [r9]
jmp 0x413733
mov eax, 0x16
jmp 0x413721
Function at 0x413a20
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call sym.pop_pthread_mem
mov r12, rax
test rax, rax
je 0x413cc0
test rdi, rdi
je 0x413a5a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x413ad0
test ebx, ebx
je 0x413bd8
mov ecx, 0x14
call r14
cmp ebx, 4
je 0x413ad0
inc ebx
jmp 0x413a95
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
je 0x413cd4
cmp qword [r12 + 0x30], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x413c72
xor edx, edx
test rsi, rsi
je 0x413b48
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x413ca0
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [sym.pthread_create_wrapper]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x413c38
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x413c08
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x413be8
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ecx, ecx
inc ebx
call r13
jmp 0x413a95
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x413bb8
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x413b8e
mov edx, 0xf
cmp eax, 0xe
jg 0x413b8e
cmp eax, 2
mov edx, 2
cmovle edx, eax
jmp 0x413b8e
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x413c48
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call sym.pthread_mutex_destroy
mov rcx, r14
call sym.pthread_spin_destroy
cmp eax, 1
je 0x413cd4
mov qword [r12 + 0x68], 0xffffffffffffffff
pxor xmm0, xmm0
movups xmmword [r12 + 0x28], xmm0
test rdi, rdi
je 0x413c7e
mov qword [rdi], 0
mov rcx, r12
call sym.push_pthread_mem
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call sym.__pthread_self_lite
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x413b48
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call sym.replace_spin_keys.part.0
nop
nop word [rax + rax]
Function at 0x417a20
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x417a4c
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x496870
Capabilities:
Create directory

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x68
mov rbx, rcx
mov dword [rsp + 0x30], 0
call method.std::_V2.system_category__
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rax
call qword [sym.imp.msvcrt.dll__wmkdir]
mov r8d, eax
mov eax, 1
test r8d, r8d
jne 0x4968b0
add rsp, 0x68
pop rbx
pop rsi
pop r12
pop r13
ret
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
cmp esi, 0x11
je 0x4968e0
call method.std::_V2.generic_category__
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x38], rax
test esi, esi
jne 0x4968f7
xor eax, eax
add rsp, 0x68
pop rbx
pop rsi
pop r12
pop r13
ret
lea rdx, [rsp + 0x30]
mov rcx, rbx
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
cmp al, 2
jne 0x4968bd
mov esi, dword [rsp + 0x30]
jmp 0x4968cb
mov ecx, 0x30
lea r12, [rsp + 0x40]
call sym.__cxa_allocate_exception
lea rdx, str.cannot_create_directory
mov rcx, r12
mov r13, rax
call fcn.004e1750
movdqa xmm0, xmmword [rsp + 0x30]
mov r8, rbx
mov rdx, r12
mov rcx, r13
lea r9, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call method.std::filesystem::__cxx11::filesystem_error.filesystem_error_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::filesystem::__cxx11::path_const__std::error_code_
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x49694a
call sym.operator_delete_void_
lea r8, [sym.std::filesystem::__cxx11::filesystem_error::filesystem_error__]
lea rdx, [0x005095a0]
mov rcx, r13
call sym.__cxa_throw
mov rbx, rax
mov rcx, r13
call sym.__cxa_free_exception
mov rcx, rbx
call dbg._Unwind_Resume
mov rcx, qword [rsp + 0x40]
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x496963
call sym.operator_delete_void_
jmp 0x496963

Function at 0x496990
Capabilities:
Create directory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
mov rbx, rdx
mov rcx, qword [rcx]
call qword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x4969d0
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
cmp esi, 0x11
je 0x4969f8
call method.std::_V2.generic_category__
mov dword [rbx], esi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
mov rdx, rbx
mov rcx, r12
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
cmp al, 2
jne 0x4969dd
xor eax, eax
jmp 0x4969bf
Function at 0x496a10
Capabilities:
Create directory

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbx, rdx
mov rsi, rcx
lea r12, [rsp + 0x40]
mov dword [rsp + 0x30], 0
call method.std::_V2.system_category__
mov rcx, qword [rbx]
mov rdx, r12
mov qword [rsp + 0x38], rax
call dbg._wstat64i32
test eax, eax
jne 0x496aa0
mov rcx, qword [rsi]
call qword [sym.imp.msvcrt.dll__wmkdir]
mov r8d, eax
mov eax, 1
test r8d, r8d
jne 0x496a70
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ebx, dword [rax]
cmp ebx, 0x11
je 0x496ac0
call method.std::_V2.generic_category__
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x496ad7
xor eax, eax
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call method.std::_V2.generic_category__
mov rdi, rax
call qword [sym.imp.msvcrt.dll__errno]
mov ebx, dword [rax]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], ebx
jmp 0x496a8b
lea rdx, [rsp + 0x30]
mov rcx, rsi
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
cmp al, 2
jne 0x496a7d
mov ebx, dword [rsp + 0x30]
jmp 0x496a8b
mov ecx, 0x30
call sym.__cxa_allocate_exception
lea rdx, str.cannot_create_directory
mov rcx, r12
mov r13, rax
call fcn.004e1750
movdqa xmm0, xmmword [rsp + 0x30]
mov r8, rsi
mov rdx, r12
mov rcx, r13
lea r9, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call method.std::filesystem::__cxx11::filesystem_error.filesystem_error_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::filesystem::__cxx11::path_const__std::error_code_
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x496b25
call sym.operator_delete_void_
lea r8, [sym.std::filesystem::__cxx11::filesystem_error::filesystem_error__]
lea rdx, [0x005095a0]
mov rcx, r13
call sym.__cxa_throw
mov r12, rax
mov rcx, r13
call sym.__cxa_free_exception
mov rcx, r12
call dbg._Unwind_Resume
mov rcx, qword [rsp + 0x40]
mov r12, rax
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x496b3e
call sym.operator_delete_void_
jmp 0x496b3e

Function at 0x496b70
Capabilities:
Create directory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
mov r9, rdx
mov r12, rcx
lea rdx, [rsp + 0x20]
mov rbx, r8
mov rcx, qword [r9]
call dbg._wstat64i32
test eax, eax
jne 0x496be8
mov rcx, qword [r12]
call qword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x496bc0
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
cmp esi, 0x11
je 0x496c10
call method.std::_V2.generic_category__
mov dword [rbx], esi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
call method.std::_V2.generic_category__
mov r12, rax
call qword [sym.imp.msvcrt.dll__errno]
mov eax, dword [rax]
mov qword [rbx + 8], r12
mov dword [rbx], eax
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
mov rdx, rbx
mov rcx, r12
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
cmp al, 2
jne 0x496bcd
xor eax, eax
jmp 0x496bb4
Function at 0x49a840
Capabilities:
Get disk size

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov r12, rcx
mov rbx, rdx
lea r13, [rsp + 0x50]
call method.std::_V2.system_category__
pcmpeqd xmm0, xmm0
mov rdx, rbx
mov rcx, r13
movups xmmword [r12], xmm0
mov rsi, rax
mov qword [r12 + 0x10], 0xffffffffffffffff
call method.std::filesystem.absolute_std::filesystem::__cxx11::path_const_
mov rcx, r13
call method.std::filesystem::__cxx11::path.remove_filename__
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x49a940
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x49a8d1
mov qword [r12], rax
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x49a8e0
mov qword [r12 + 8], rax
mov rax, qword [rsp + 0x38]
xor edi, edi
test rax, rax
jne 0x49a930
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x49a900
lea rcx, [rsp + 0x70]
call method.std::filesystem::__cxx11::path::_List::_Impl_deleter.operator___std::filesystem::__cxx11::path::_List::_Impl__const
mov rcx, qword [rsp + 0x50]
lea rbp, [rsp + 0x60]
cmp rcx, rbp
je 0x49a914
call sym.operator_delete_void_
test edi, edi
jne 0x49a94a
mov rax, r12
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [r12 + 0x10], rax
jmp 0x49a8ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x49a8ec
mov ecx, 0x30
call sym.__cxa_allocate_exception
lea rdx, str.cannot_get_free_space
mov rcx, r13
mov r14, rax
call fcn.004e1750
mov eax, edi
lea r9, [rsp + 0x20]
mov r8, rbx
mov rdx, r13
mov rcx, r14
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
call method.std::filesystem::__cxx11::filesystem_error.filesystem_error_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::filesystem::__cxx11::path_const__std::error_code_
mov rcx, qword [rsp + 0x50]
cmp rcx, rbp
je 0x49a994
call sym.operator_delete_void_
lea r8, [sym.std::filesystem::__cxx11::filesystem_error::filesystem_error__]
lea rdx, [0x005095a0]
mov rcx, r14
call sym.__cxa_throw
mov r12, rax
mov rcx, r14
call sym.__cxa_free_exception
mov rcx, r12
call dbg._Unwind_Resume
mov rcx, qword [rsp + 0x50]
mov r12, rax
cmp rcx, rbp
je 0x49a9ad
call sym.operator_delete_void_
jmp 0x49a9ad
Function at 0x49a9e0
Capabilities:
Get disk size

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x70
pcmpeqd xmm0, xmm0
lea r13, [rsp + 0x40]
movups xmmword [rcx], xmm0
mov r12, rcx
mov rbx, r8
mov qword [rcx + 0x10], 0xffffffffffffffff
mov rcx, r13
call method.std::filesystem.absolute_std::filesystem::__cxx11::path_const_
mov rcx, r13
call method.std::filesystem::__cxx11::path.remove_filename__
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x28]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edi, eax
call method.std::_V2.system_category__
mov rsi, rax
test edi, edi
je 0x49aad0
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x49aa66
mov qword [r12], rax
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x49aa75
mov qword [r12 + 8], rax
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x49aac0
mov dword [rbx], 0
mov qword [rbx + 8], rsi
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x49aa9d
lea rcx, [rsp + 0x60]
call method.std::filesystem::__cxx11::path::_List::_Impl_deleter.operator___std::filesystem::__cxx11::path::_List::_Impl__const
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x49aab1
call sym.operator_delete_void_
mov rax, r12
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov qword [r12 + 0x10], rax
jmp 0x49aa7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
jmp 0x49aa89
Function at 0x49aae0
Capabilities:
Delete directory
Delete file

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbx, rcx
mov dword [rsp + 0x30], 0
lea r12, [rsp + 0x40]
call method.std::_V2.system_category__
mov rcx, qword [rbx]
mov rdx, r12
mov qword [rsp + 0x38], rax
mov rsi, rax
call dbg._wstat64i32
test eax, eax
jne 0x49abc0
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
cmp al, 2
je 0x49ac00
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x49ac11
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x49ac28
mov ecx, 0x30
call sym.__cxa_allocate_exception
lea rdx, str.cannot_remove
mov rcx, r12
mov r13, rax
call fcn.004e1750
movdqa xmm0, xmmword [rsp + 0x30]
mov r8, rbx
mov rdx, r12
mov rcx, r13
lea r9, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call method.std::filesystem::__cxx11::filesystem_error.filesystem_error_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::filesystem::__cxx11::path_const__std::error_code_
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x49aba8
call sym.operator_delete_void_
lea r8, [sym.std::filesystem::__cxx11::filesystem_error::filesystem_error__]
lea rdx, [0x005095a0]
mov rcx, r13
call sym.__cxa_throw
nop
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
call method.std::_V2.generic_category__
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
cmp esi, 2
je 0x49abe8
cmp esi, 0x14
je 0x49abe8
test esi, esi
jne 0x49ab5a
xor eax, eax
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x49ab3d
mov eax, 1
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call method.std::_V2.generic_category__
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
mov esi, eax
jmp 0x49abe0
Function at 0x49ac70
Capabilities:
Delete directory
Delete file

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, rdx
lea rdx, [rsp + 0x20]
call dbg._wstat64i32
test eax, eax
jne 0x49acd0
call method.std::_V2.system_category__
mov dword [rbx], 0
mov rdx, rbx
mov rcx, rsi
mov qword [rbx + 8], rax
mov rdi, rax
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
cmp al, 2
je 0x49ad10
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x49ad1d
mov eax, dword [rbx]
test eax, eax
je 0x49ad38
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
call method.std::_V2.generic_category__
cmp esi, 2
mov qword [rbx + 8], rax
sete al
cmp esi, 0x14
mov dword [rbx], esi
sete dl
or al, dl
je 0x49acc4
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x49acaf
mov eax, 1
mov dword [rbx], 0
mov qword [rbx + 8], rdi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
call method.std::_V2.generic_category__
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
xor eax, eax
jmp 0x49acc4

Function at 0x49ad60
Capabilities:
Move file

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rbx, rcx
mov rsi, rdx
mov rcx, qword [rcx]
mov rdx, qword [rdx]
call qword [sym.imp.msvcrt.dll__wrename]
test eax, eax
jne 0x49ad90
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call method.std::_V2.generic_category__
mov rdi, rax
call qword [sym.imp.msvcrt.dll__errno]
mov ebp, dword [rax]
test ebp, ebp
je 0x49ad82
mov ecx, 0x30
lea r13, [rsp + 0x40]
call sym.__cxa_allocate_exception
lea rdx, str.cannot_rename
mov rcx, r13
mov r12, rax
call fcn.004e1750
mov eax, ebp
mov r9, rsi
mov r8, rbx
mov rdx, r13
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov rcx, r12
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rdi
call sym._ZNSt10filesystem7__cxx1116filesystem_errorC2ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKNS0_4pathESC_St10error_c
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x49ae00
call sym.operator_delete_void_
lea r8, [sym.std::filesystem::__cxx11::filesystem_error::filesystem_error__]
lea rdx, [0x005095a0]
mov rcx, r12
call sym.__cxa_throw
mov rbx, rax
mov rcx, r12
call sym.__cxa_free_exception
mov rcx, rbx
call dbg._Unwind_Resume
mov rcx, qword [rsp + 0x40]
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x49ae19
call sym.operator_delete_void_
jmp 0x49ae19
Function at 0x49ae50
Capabilities:
Move file

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rdx, qword [rdx]
mov rcx, qword [rcx]
mov rbx, r8
call qword [sym.imp.msvcrt.dll__wrename]
test eax, eax
jne 0x49ae80
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
add rsp, 0x28
pop rbx
pop rsi
ret
call method.std::_V2.generic_category__
mov rsi, rax
call qword [sym.imp.msvcrt.dll__errno]
mov eax, dword [rax]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x4a6190
Capabilities:
Get disk size

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r13, qword [rsp + 0xa0]
mov qword [rsp + 0x28], 0
mov r12, rdx
mov rbp, r8
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x30]
mov rdi, r9
lea r9, [rsp + 0x38]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov esi, eax
call method.std::_V2.system_category__
mov rbx, rax
test esi, esi
je 0x4a6238
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x4a61f9
mov qword [r12], rax
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x4a6207
mov qword [rbp], rax
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x4a6230
mov dword [r13], 0
mov qword [r13 + 8], rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rdi], rax
jmp 0x4a6211
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [r13 + 8], rbx
mov dword [r13], eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x4ab8f0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x4ab917
call rbp
cmp dword [rax], 4
jne 0x4ab934
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x4ab910
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret