joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000fca8
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x14006d378]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rdi, qword [rbp + 0x190]
mov rax, r8
mov rsi, qword [rbp + 0x198]
mov r8d, 0x40
mov r14, qword [rbp + 0x1a0]
cmp r9, r8
mov r12, rdx
mov r15, rcx
cmovb r8, r9
lea rcx, [rbp + 0xd0]
mov rdx, rax
mov rbx, r9
call fcn.1400426c0
cmp rbx, 0x44
jae 0x14000ff01
lea rax, [rbx + 1]
mov byte [rbp + rbx + 0xd0], 0
cmp rax, 0x44
jae 0x14000ff01
mov byte [rbp + rax + 0xd0], 0
lea rax, [rbx + 2]
cmp rax, 0x44
jae 0x14000ff01
and qword [rsp + 0x40], 0
lea r9, [rbx + 4]
and qword [rsp + 0x38], 0
lea r8, [rbp + 0xd0]
and qword [rsp + 0x30], 0
mov rdx, r12
and qword [rsp + 0x28], 0
mov rcx, r15
mov byte [rbp + rax + 0xd0], 0
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
mov byte [rbp + rbx + 0xd3], 1
call fcn.14000f98c
movups xmm0, xmmword [rbp + 0x68]
mov eax, dword [rbp + 0x1a8]
movups xmm1, xmmword [rbp + 0x78]
dec eax
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], rsi
lea rdi, [rbp + 0x40]
mov qword [rbp + 0x60], r14
lea rsi, [rbp + 0x50]
movups xmmword [rbp + 0x88], xmm0
mov dword [rbp + 0x40], eax
mov r14d, 3
movups xmmword [rbp + 0x98], xmm1
mov dword [rbp + 0x44], 0x10
mov dword [rbp + 0x48], 0x10
mov byte [rsp + 0x51], 0
mov byte [rsp + 0x50], 0
cmp dword [rdi], 0
jbe 0x14000fe7b
mov ebx, dword [rdi]
lea rax, [rsp + 0x50]
mov r9d, 0x20
mov qword [rsp + 0x40], rax
lea r8, [rbp + 0x68]
lea rax, [rsp + 0x60]
mov rdx, r12
mov qword [rsp + 0x38], rax
mov rcx, r15
lea rax, [rsp + 0x51]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x20], rax
call fcn.14000f98c
movups xmm0, xmmword [rbp + 0xa8]
xor eax, eax
movups xmm1, xmmword [rbp + 0xb8]
movups xmmword [rbp + 0x68], xmm0
lea ecx, [rax + 2]
movups xmmword [rbp + 0x78], xmm1
movdqu xmm0, xmmword [rbp + rax + 0x88]
movdqu xmm1, xmmword [rbp + rax + 0x68]
lea rax, [rax + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0x78], xmm1
sub rcx, 1
jne 0x14000fe4e
sub rbx, 1
jne 0x14000fdeb
mov rax, qword [rsi]
add rdi, 4
movups xmm0, xmmword [rbp + 0x88]
add rsi, 8
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbp + 0x98]
movups xmmword [rax + 0x10], xmm1
sub r14, 1
jne 0x14000fde0
lea edx, [r14 + 0x44]
lea rcx, [rbp + 0xd0]
call fcn.14002f200
lea ebx, [r14 + 0x20]
mov edx, ebx
lea rcx, [rbp + 0x88]
call fcn.14002f200
mov edx, ebx
lea rcx, [rbp + 0x68]
call fcn.14002f200
mov edx, ebx
lea rcx, [rbp + 0xa8]
call fcn.14002f200
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140040b40
add rsp, 0x230
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140040d04
int3
Function at 0x140019c90
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x14], 0
mov rbx, rcx
jne 0x140019cc7
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x140019cb3
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140057518]
cmp byte [rbx + 0x21], 0
je 0x140019cc7
lea rcx, [rbx + 0x40]
add rsp, 0x20
pop rbx
jmp fcn.14001aee8
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140019cd0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jne 0x140019d02
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140019d7f
mov rcx, rbx
call fcn.140019e40
test al, al
je 0x140019d45
mov r8d, 0x4e20
cmp rsi, r8
jbe 0x140019d45
mov rdx, rbp
mov rcx, rbx
call fcn.140019cd0
jmp 0x140019d83
cmp dword [rbx + 0x14], 1
jne 0x140019d5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x140019d5a
xor eax, eax
jmp 0x140019d83
cmp dword [rbx + 0x14], 0
jne 0x140019d7a
mov edi, 0x8000
cmp rsi, rdi
jbe 0x140019d7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x140019d7a
mov r8d, edi
jmp 0x140019d38
or eax, 0xffffffff
jmp 0x140019d83
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14001a0ec
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
xor r8d, r8d
mov rbx, rcx
call fcn.14001a148
test al, al
je 0x14001a120
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rax, qword [rbx]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov rax, qword [rax + 0x20]
call qword [0x140057518]
add rsp, 0x20
pop rbx
ret

Function at 0x14001a660
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x14001a6e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14006d378]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, r8
mov qword [rsp + 0x38], rdx
mov rsi, rcx
xor edi, edi
test r8, r8
jne 0x14001a71c
mov al, 1
jmp 0x14001a90d
lea r15, [rcx + 8]
cmp dword [rcx + 0x14], 1
jne 0x14001a739
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [r15], rax
mov rdx, qword [rsp + 0x38]
mov bpl, dil
mov dword [rsp + 0x30], edi
cmp dword [rsi + 0x14], edi
je 0x14001a798
mov rbx, rdi
test r14, r14
je 0x14001a7bd
mov rcx, r14
sub rcx, rbx
mov eax, r14d
sub eax, ebx
mov r8d, 0x4000
cmp rcx, r8
cmovb r8d, eax
add rdx, rbx
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bpl
test eax, eax
je 0x14001a7b4
add rbx, 0x4000
cmp rbx, r14
mov rdx, qword [rsp + 0x38]
jb 0x14001a74d
jmp 0x14001a7b4
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
mov r8d, r14d
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bpl
test bpl, bpl
jne 0x14001a906
cmp byte [rsi + 0x22], dil
je 0x14001a906
cmp dword [rsi + 0x14], edi
jne 0x14001a906
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsi]
mov rax, qword [rcx + 0x28]
mov rcx, rsi
call qword [0x140057518]
mov r13, rax
lea r12, [rsi + 0x40]
mov rcx, r12
call fcn.14001b0cc
mov rbx, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rbx, r14
jbe 0x14001a82f
mov rcx, r13
sub rcx, r14
mov ebx, 0xffffffff
cmp rcx, rbx
ja 0x14001a82f
lea rax, [r14 + r13]
cmp rax, rbx
jbe 0x14001a82f
mov rdx, r12
lea rcx, [0x14006ff10]
call fcn.140011170
xor r8d, r8d
mov rdx, r12
lea rcx, [0x14006ff10]
call fcn.1400108f4
xor edi, edi
test al, al
je 0x14001a890
mov ecx, dword [rsp + 0x30]
cmp rcx, r14
mov rdx, qword [rsp + 0x38]
jae 0x14001a739
test ecx, ecx
je 0x14001a739
mov rbx, qword [rsi]
mov rcx, rsi
mov rax, qword [rbx + 0x28]
call qword [0x140057518]
mov ecx, dword [rsp + 0x30]
sub rax, rcx
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
mov rax, qword [rbx + 0x20]
call qword [0x140057518]
jmp 0x14001a734
mov qword [rsp + 0x40], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xor r8d, r8d
lea rdx, [0x140058368]
lea rcx, [rsp + 0x40]
call fcn.140003394
nop
mov r8, r12
lea rdx, [rsp + 0x40]
lea rcx, [0x14006ff10]
call fcn.140011150
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001a906
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a901
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a932
call fcn.1400409c4
mov byte [rsi + 0x10], 1
mov al, bpl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140040b40
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140045ef4
int3
Function at 0x14001adfc
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006d378]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001ae27
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor esi, esi
test eax, eax
setne dil
test eax, eax
jne 0x14001aec1
mov qword [rsp + 0x20], rsi
movdqa xmm0, xmmword [0x140057940]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], si
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002211c
test al, al
je 0x14001ae83
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne dil
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001aec1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aebc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001aee1
call fcn.1400409c4
mov al, dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140040b40
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.140045ef4
int3

Function at 0x14001aee8
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006d378]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001af13
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
test eax, eax
setne dil
test eax, eax
jne 0x14001afad
mov qword [rsp + 0x20], rsi
movdqa xmm0, xmmword [0x140057940]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], si
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002211c
test al, al
je 0x14001af6f
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne dil
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001afad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001afa8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001afcd
call fcn.1400409c4
mov al, dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140040b40
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.140045ef4
int3
Function at 0x14001afe8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006d378]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001b013
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14001b0a6
xor esi, esi
mov qword [rsp + 0x20], rsi
movdqa xmm0, xmmword [0x140057940]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], si
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002211c
test al, al
je 0x14001b068
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001b0a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b0a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b0c5
call fcn.1400409c4
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140040b40
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.140045ef4
int3

Function at 0x14001b0cc
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14006d378]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], bx
lea rdx, [rbp - 0x28]
call fcn.140021d84
mov qword [rbp - 0x40], rbx
cmp qword [rbp - 0x18], rbx
jne 0x14001b114
mov ecx, ebx
jmp 0x14001b122
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14001b14c
mov eax, dword [rbp - 0x3c]
cmp eax, dword [rbp - 0x34]
ja 0x14001b14c
mov ebx, eax
shl rbx, 0x20
mov eax, dword [rbp - 0x40]
add rbx, rax
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14001b188
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b183
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b1a2
call fcn.1400409c4
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140040b40
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
call fcn.140045ef4
int3
Function at 0x14001b1b8
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14006d378]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
lea rdx, [rsp + 0x40]
call fcn.140021a2c
cmp qword [rsp + 0x50], rbx
jne 0x14001b20d
mov ecx, ebx
jmp 0x14001b21e
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov dword [rsp + 0x38], 0x105
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x14001b278
lea rdx, [0x1400583c0]
lea rcx, [rsp + 0x60]
call fcn.140049ae0
test eax, eax
je 0x14001b276
lea rdx, str.FAT32
lea rcx, [rsp + 0x60]
call fcn.140049ae0
test eax, eax
jne 0x14001b278
mov bl, 1
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001b2b6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b2b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b2d8
call fcn.1400409c4
mov al, bl
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140040b40
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rbp
ret
call fcn.140045ef4
int3

Function at 0x14001b2ec
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
mov rax, qword [0x14006d378]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [r11 - 0x38], rbx
mov qword [r11 - 0x28], rbx
mov qword [r11 - 0x20], 7
mov word [rsp + 0x20], bx
lea rdx, [r11 - 0x38]
call fcn.140021a2c
cmp qword [rsp + 0x30], rbx
jne 0x14001b32e
mov ecx, ebx
jmp 0x14001b33f
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x14001b34f
cmp eax, 5
jne 0x14001b351
mov bl, 1
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001b38f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b38a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b3a4
call fcn.1400409c4
mov al, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140040b40
add rsp, 0x50
pop rbx
ret
call fcn.140045ef4
int3
Function at 0x14001b674
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14006d378]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14d, r8d
mov bpl, dl
mov rdi, rcx
call fcn.1400218bc
cmp ax, 0x2e
je 0x14001b6d2
cmp ax, 0x20
je 0x14001b6d2
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001b6bc
mov rcx, qword [rdi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
xor ebx, ebx
test eax, eax
jne 0x14001b76d
jmp 0x14001b6d6
xor ebx, ebx
mov esi, ebx
mov rcx, rdi
call fcn.14001afe8
cmp eax, 0xffffffff
jne 0x14001b781
mov qword [rsp + 0x20], rbx
movdqa xmm0, xmmword [0x140057940]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], bx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14002211c
test al, al
je 0x14001b72b
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001b769
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b764
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b7be
call fcn.1400409c4
test esi, esi
je 0x14001b781
test bpl, bpl
je 0x14001b77d
mov edx, r14d
mov rcx, rdi
call fcn.14001befc
xor eax, eax
jmp 0x14001b79c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14001b797
cmp eax, 3
sete bl
lea eax, [rbx + 1]
jmp 0x14001b79c
mov eax, 2
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140040b40
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140045ef4
int3
Function at 0x14001bafc
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14006d378]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rbx, rcx
cmp qword [rdx + 0x18], 8
jb 0x14001bb2f
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x14001bb39
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor r14d, r14d
test eax, eax
setne sil
test eax, eax
jne 0x14001bc43
mov qword [rbp - 0x30], r14
movdqa xmm0, xmmword [0x140057940]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
mov qword [rbp - 0x50], r14
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r14w
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.14002211c
test al, al
je 0x14001bbbc
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.14002211c
test al, al
je 0x14001bbbc
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne sil
mov ebx, 0x1000
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14001bbf9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, rbx
jb 0x14001bbf4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bc6d
call fcn.1400409c4
movdqa xmm0, xmmword [0x140057940]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r14w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001bc43
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, rbx
jb 0x14001bc3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bc67
call fcn.1400409c4
mov al, sil
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140040b40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140045ef4
nop
call fcn.140045ef4
nop
int3
Function at 0x14001befc
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006d378]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov esi, edx
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001bf26
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ebp, ebp
test eax, eax
setne dil
test eax, eax
jne 0x14001bfc2
mov qword [rsp + 0x20], rbp
movdqa xmm0, xmmword [0x140057940]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], bp
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002211c
test al, al
je 0x14001bf84
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne dil
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001bfc2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bfbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bfe2
call fcn.1400409c4
mov al, dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140040b40
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
call fcn.140045ef4
int3
Function at 0x14001cd78
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14006d378]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rdi, r8
mov rbx, rdx
mov r14, rcx
xor r15d, r15d
or rsi, 0xffffffffffffffff
cmp rcx, rsi
jne 0x14001ce94
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x14001cdca
mov rcx, qword [rdx]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, rsi
jne 0x14001ceb4
mov qword [rsp + 0x20], r15
movdqa xmm0, xmmword [0x140057940]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r15w
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002211c
test al, al
je 0x14001ce2a
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001ce6c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ce67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001cfe4
call fcn.1400409c4
cmp r14, rsi
jne 0x14001ceb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 2]
test ecx, 0xffffffee
jne 0x14001ce8a
cmp eax, 0x13
mov al, r15b
jne 0x14001ce8c
mov al, 1
mov byte [rdi + 0x64], al
jmp 0x14001cfb1
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001ceb4
mov r14, rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
jmp 0x14001ce8c
cmp rdi, rbx
je 0x14001ced2
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001cec6
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rdi
call fcn.1400032c8
mov qword [rsp + 0x20], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x6c]
inc rsi
cmp word [rax + rsi*2], r15w
jne 0x14001cee5
mov r8, rsi
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.140003394
nop
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400237c0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001cf52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cf4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001cfde
call fcn.1400409c4
mov ecx, dword [rsp + 0x5c]
shl rcx, 0x20
mov eax, dword [rsp + 0x60]
add rcx, rax
mov qword [rdi + 0x20], rcx
mov eax, dword [rsp + 0x40]
mov dword [rdi + 0x28], eax
mov rax, qword [rsp + 0x44]
mov qword [rdi + 0x48], rax
mov rax, qword [rsp + 0x4c]
mov qword [rdi + 0x50], rax
mov rax, qword [rsp + 0x54]
mov qword [rdi + 0x58], rax
lea rcx, [rdi + 0x30]
lea rdx, [rsp + 0x54]
call fcn.140033060
lea rcx, [rdi + 0x38]
lea rdx, [rsp + 0x44]
call fcn.140033060
lea rcx, [rdi + 0x40]
lea rdx, [rsp + 0x4c]
call fcn.140033060
mov dword [rdi + 0x60], r15d
mov rax, r14
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140040b40
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x2a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140045ef4
int3
call fcn.140045ef4
int3
Function at 0x14001d988
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x14006d378]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor bl, bl
cmp byte [0x14006ff28], bl
jne 0x14001d9ed
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 0xa
ja 0x14001d9dc
jne 0x14001d9de
cmp dword [rsp + 0x2c], 0x55f0
jb 0x14001d9de
call fcn.14001da10
test al, al
jne 0x14001d9de
mov bl, 1
mov byte [0x14006ff29], bl
mov byte [0x14006ff28], 1
jmp 0x14001d9f3
mov bl, byte [0x14006ff29]
mov al, bl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140040b40
add rsp, 0x150
pop rbx
ret