joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009434c
Capabilities:
Copy file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov esi, r8d
mov r15, rdx
mov r14, rcx
and esi, 0xf
xor r12d, r12d
cmp esi, 2
je 0x1400944ea
lea r8d, [r12 + 1]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
test eax, eax
je 0x1400943a0
mov byte [rbp + 0x48], 1
mov dword [rbp + 0x4c], r12d
jmp 0x1400943ae
mov byte [rbp + 0x48], r12b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov dword [rbp + 0x4c], eax
mov rax, qword [rbp + 0x48]
mov rcx, rax
shr rcx, 0x20
cmp ecx, 0x50
jne 0x14009451a
test esi, esi
je 0x14009451a
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
lea edi, [rcx - 0x4d]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea edx, [rcx + 0x31]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14009440b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
test eax, eax
je 0x14009440b
mov byte [rbp + 0x48], r12b
jmp 0x140094513
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x82
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14009446a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
test eax, eax
je 0x14009446a
mov byte [rbp + 0x48], r12b
mov dword [rbp + 0x4c], eax
cmp rbx, 0xffffffffffffffff
je 0x140094516
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test eax, eax
je 0x140094533
jmp 0x140094516
cmp esi, 1
jne 0x140094491
mov dword [rbp + 0x4c], r12d
mov byte [rbp + 0x48], r12b
cmp rdi, 0xffffffffffffffff
je 0x140094449
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test eax, eax
je 0x140094533
jmp 0x140094449
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.1400940dc
nop
test eax, eax
je 0x1400944a7
mov dword [rbp + 0x4c], eax
jmp 0x140094473
lea rdx, [rbp + 0x48]
mov rcx, rdi
call fcn.1400940dc
nop
test eax, eax
jne 0x1400944a2
mov rax, qword [rbp + 0x48]
cmp qword [rbp - 0x10], rax
jle 0x14009446f
cmp rdi, 0xffffffffffffffff
je 0x1400944d6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test eax, eax
je 0x140094533
cmp rbx, 0xffffffffffffffff
je 0x1400944ea
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test eax, eax
je 0x140094533
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
test eax, eax
je 0x140094508
mov byte [rbp + 0x48], 1
mov dword [rbp + 0x4c], r12d
jmp 0x140094516
mov byte [rbp + 0x48], r12b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov dword [rbp + 0x4c], eax
mov rax, qword [rbp + 0x48]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400bce24
nop
int3
Function at 0x14009b0cc
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14009b0df
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14009b6f8
lea rdx, [0x14015f960]
lea rcx, [rsp + 0x20]
call fcn.1400b6600
int3

Function at 0x1400a5b1c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140167c90]
xor edx, edx
jmp fcn.14009b0cc

Function at 0x1400a64ec
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140167c90]
jmp fcn.14009b0cc

Function at 0x1400b2440
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400b2500]
mov r9, qword [r9 + 8]
jmp fcn.1400a3484

Function at 0x1400b24d4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400b2510]
mov r9, qword [r9 + 8]
jmp fcn.1400a3484

Function at 0x1400ce4d8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400ce304
Function at 0x1400e2730
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov esi, edi
test rcx, rcx
je 0x1400e27f3
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rbx + rdx*2], si
jne 0x1400e2764
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1400e27f6
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8d, eax
lea ecx, [r8 - 1]
cmp word [rsi + rcx*2], 0x5c
je 0x1400e27af
mov eax, 0x5c
mov word [rsi + r8*2], ax
inc r8d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x1400e27b3
test rax, rax
je 0x1400e27f3
mov rdx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [rdi + r8]
inc edi
mov word [rsi + rcx*2], ax
mov edx, edi
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400e27e4
cmp rdx, rax
jb 0x1400e27d0
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e3090
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rax, qword [0x140168e50]
xor esi, esi
mov rbx, r8
mov r14, rdx
mov ebp, ecx
test rax, rax
jne 0x1400e30d9
xor edx, edx
lea rcx, str.Setupapi.dll
call fcn.1400e50b0
mov qword [0x140168e50], rax
test rax, rax
je 0x1400e31b6
cmp qword [0x140168e58], rsi
jne 0x1400e3109
lea rdx, [0x140115b00]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140168e58], rax
test rax, rax
je 0x1400e31b6
mov rax, qword [0x140168e50]
cmp qword [0x140168e60], rsi
jne 0x1400e3139
lea rdx, [0x140115b18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140168e60], rax
test rax, rax
je 0x1400e31b6
mov rax, qword [0x140168e50]
cmp qword [0x140168e70], rsi
jne 0x1400e3165
lea rdx, [0x1401159d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140168e70], rax
test rax, rax
je 0x1400e31b6
mov rax, qword [0x140168e50]
cmp qword [0x140168e68], rsi
jne 0x1400e3191
lea rdx, [0x140115b30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140168e68], rax
test rax, rax
je 0x1400e31b6
mov rax, qword [0x140168e50]
cmp qword [0x140168bc8], rsi
jne 0x1400e31bd
lea rdx, [0x1401159f8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140168bc8], rax
test rax, rax
jne 0x1400e31bd
xor eax, eax
jmp 0x1400e325d
mov r9d, 6
mov qword [rsp + 0x30], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [0x140168e58]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400e3256
xor eax, eax
mov r8, rbx
mov qword [rbx], rax
xor edx, edx
mov qword [rbx + 8], rax
mov rcx, rdi
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov dword [rbx], 0x20
call qword [0x140168e60]
test eax, eax
je 0x1400e324d
nop word [rax + rax]
mov r8, rbx
mov rdx, rdi
mov ecx, ebp
call fcn.1400e3950
cmp eax, 1
je 0x1400e3273
xor eax, eax
inc esi
mov qword [rbx], rax
mov r8, rbx
mov qword [rbx + 8], rax
mov edx, esi
mov qword [rbx + 0x10], rax
mov rcx, rdi
mov qword [rbx + 0x18], rax
mov dword [rbx], 0x20
call qword [0x140168e60]
test eax, eax
jne 0x1400e3210
mov rcx, rdi
call qword [0x140168bc8]
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [r14], rdi
mov eax, 1
jmp 0x1400e3258
Function at 0x1400e6730
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x30
mov rbx, rcx
xor ebp, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x1400e6955
xor edx, edx
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], dx
jne 0x1400e6756
test rax, rax
je 0x1400e6794
xor ecx, ecx
nop word [rax + rax]
movzx r8d, word [rbx + rcx*2]
cmp r8w, 0x5c
je 0x1400e6955
cmp r8w, 0x2f
je 0x1400e6955
inc edx
mov ecx, edx
cmp rcx, rax
jb 0x1400e6770
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
call fcn.1400e6970
mov rsi, rax
test rax, rax
je 0x1400e6885
mov qword [rsp + 0x50], r14
call fcn.1400e71d0
mov r14, rax
test rax, rax
je 0x1400e6872
mov rcx, rsi
call fcn.1400e2590
test eax, eax
je 0x1400e685b
lea rax, str.system32_
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x20]
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
nop word [rax + rax]
mov rdx, qword [rdi]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdx + rbx*2], bp
jne 0x1400e6807
mov r8, rbx
mov rcx, rsi
call fcn.1400c7f30
test eax, eax
je 0x1400e682f
add rdi, 8
lea rax, [rsp + 0x30]
cmp rdi, rax
jb 0x1400e6800
jmp 0x1400e683e
lea rdx, [rsi + rbx*2]
mov rcx, r14
call fcn.1400e5a10
mov rbp, rax
lea rax, [rsp + 0x30]
cmp rdi, rax
jne 0x1400e6869
mov rcx, rsi
call fcn.1400e2530
test eax, eax
je 0x1400e6869
mov rbp, rsi
xor esi, esi
jmp 0x1400e6869
mov rdx, rsi
mov rcx, r14
call fcn.1400e5a10
mov rbp, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x50]
jmp 0x1400e6921
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x1400e692a
mov rcx, rbx
call fcn.1400e2410
mov rdi, rax
test rax, rax
je 0x1400e692a
mov ecx, 0x37e4
call fcn.1400e4e90
test eax, eax
je 0x1400e68bf
xor ecx, ecx
call fcn.1400e6e70
jmp 0x1400e68c4
call fcn.1400e71d0
mov rbx, rax
test rax, rax
je 0x1400e6918
mov rdx, rdi
mov rcx, rax
call fcn.1400e5a10
mov rbp, rax
test rax, rax
je 0x1400e690f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e68f1
test al, 0x50
je 0x1400e690f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400e6904
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ebp, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbp, rbp
je 0x1400e692a
xor ecx, ecx
jmp 0x1400e6937
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400e693d
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x48]
mov rax, rbp
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rbp
ret
Function at 0x1400e71d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov ecx, 0x40
add rdx, rdx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1400e7232
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400e7227
cmp edi, eax
jb 0x1400e7227
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400e72e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x40
mov rbx, rcx
mov r14d, r8d
xor ecx, ecx
mov ebp, edx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x1400e745a
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x1400e7346
cmp ax, 0x2f
je 0x1400e7346
movzx ecx, ax
call fcn.1400c8e70
test eax, eax
je 0x1400e745a
cmp word [rbx + 2], 0x3a
jne 0x1400e745a
movzx eax, word [rbx + 4]
cmp ax, 0x2f
je 0x1400e7346
cmp ax, 0x5c
jne 0x1400e745a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e743e
test al, 0x50
jne 0x1400e743e
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov edx, 0x80000000
mov rcx, rbx
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400e73b3
lea ecx, [rax + 0x21]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x68]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
test r14d, r14d
mov dword [rsp + 0x60], edi
lea rdx, [rsp + 0x60]
mov rcx, rbx
cmove rdx, rdi
call fcn.1400e75b0
test eax, eax
je 0x1400e73e5
test r14d, r14d
je 0x1400e73f9
cmp dword [rsp + 0x60], edi
jne 0x1400e73f9
mov ecx, 0x80092009
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.1400e51c0
test eax, eax
je 0x1400e7410
and ebp, 0xffffe8f7
xor edx, edx
mov r8d, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rsi, rsi
je 0x1400e742e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x1400e739d
xor ecx, ecx
jmp 0x1400e7397
mov ecx, 0x7e
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x70]
mov rax, rdi
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x1400ebf28
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 8
jb 0x1400ebf36
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ebf48
shr eax, 4
and al, 1
jmp 0x1400ebf4a
xor al, al
add rsp, 0x28
ret

Function at 0x1400ebf50
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x1401620b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdx, qword [rcx + 0x10]
xor ebx, ebx
test rdx, rdx
jne 0x1400ebf8e
xor al, al
jmp 0x1400ec0fb
mov dword [rbp - 0x5c], 0x5c
mov eax, dword [0x140115c28]
mov dword [rbp - 0x10], eax
movzx eax, word [0x140115c2c]
mov word [rbp - 0xc], ax
mov rax, rcx
cmp qword [rcx + 0x18], 8
jb 0x1400ebfb6
mov rax, qword [rcx]
lea r8, [rax + rdx*2]
jb 0x1400ebfbf
mov rcx, qword [rcx]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rbx
mov r9b, byte [rbp - 0x60]
mov rdx, rcx
lea rcx, [rbp - 0x50]
call fcn.1400ebc54
nop
mov word [rbp - 0x60], bx
mov rdx, qword [rbp - 0x48]
cmp qword [rbp - 0x40], rdx
je 0x1400ebff7
mov word [rdx], bx
add rdx, 2
mov qword [rbp - 0x48], rdx
jmp 0x1400ec004
lea r8, [rbp - 0x60]
lea rcx, [rbp - 0x50]
call fcn.1400ebb50
mov qword [rbp - 0x58], rbx
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x10]
mov rcx, qword [rbp - 0x50]
call fcn.1400ee3a0
mov rdi, rax
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], bx
xor r8d, r8d
lea rdx, [0x14011dda0]
lea rcx, [rbp - 0x30]
call fcn.140005dd4
nop
test rdi, rdi
je 0x1400ec0e4
test rdi, rdi
je 0x1400ec068
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], bx
jne 0x1400ec052
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.140004c90
cmp qword [rbp - 0x20], rbx
jbe 0x1400ec0aa
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rbp - 0x30]
cmp eax, 0xffffffff
je 0x1400ec094
call fcn.1400ebf28
test al, al
jmp 0x1400ec0a8
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400ec0e6
lea rax, [rbp - 0x5c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bx
jne 0x1400ec0b2
lea rdx, [rbp - 0x5c]
lea rcx, [rbp - 0x30]
call fcn.140004c90
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.1400ee3a0
mov rdi, rax
test rax, rax
jne 0x1400ec049
mov bl, 1
lea rcx, [rbp - 0x30]
call fcn.140005cfc
nop
lea rcx, [rbp - 0x50]
call fcn.140044fc8
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140097440
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x1400ec11c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x140044377
Capabilities:
Execute anti-debugging instructions

Disassembly:
scasb al, byte [rdi]
mov ecx, 0xe68b4d98
mov r12, r14
mov r8b, 0x8d
call fcn.140044365
cmc
jg 0x1400442e4
mov bh, byte [rcx + 0x33]
ror byte [rbp - 0x24], cl
invalid
mov rdi, 0xffffffffaa02df81
jmp 0x1400442e7
xchg r12b, r15b
bsf di, r14w
mov bp, word [rsp]
jmp 0x14004436e
not di
mov r9d, 0x298df4b
lea rsp, [rsp + 6]
add r10b, sil
stc
jmp 0x14004434e
mov bp, word [rsp]
jmp 0x14004436e
jo 0x14004430a
xchg r12b, r15b
bsf di, r14w
jmp 0x140044334
rdtsc
pop word [rsp + 2]
jmp 0x140044320
mov r12b, r10b
call 0x140044377
jg 0x140044301
je 0x14004439e
add ecx, dword [rbp + rcx*4 + 0xc]
and eax, 0x1b875f31
neg bpl
jbe 0x1400443ee
pop r14
xchg rbp, r11
jmp 0x14004445a
jmp qword [rsi + 0x44]
pop r14
xchg rbp, r11
mov r11w, word [rsp]
mov eax, ecx
jmp 0x140044411
jmp 0x1400443d1
lea rax, [r9 + r11]
mov r9b, 0x6c
shl ebp, cl
xchg r14b, dil
bt ax, ax
jmp 0x140044479
dec r12b
not r11w
bswap r11
mov dx, word [rsp]
dec r9b
jmp 0x14004443e
shl ebp, cl
xchg r14b, dil
bt ax, ax
jmp 0x140044479
jnp 0x1400443f0
lea rax, [r9 + r11]
mov r9b, 0x6c
jmp 0x140044424
mov r11w, word [rsp]
mov eax, ecx
jmp 0x140044411
mov dword [rsp], ebp
xchg word [rsp], r8w
pop bp
lea rsp, [rsp + 6]
jmp 0x14004448c
ror r12b, 0
push rdx
mov dword [rsp + 2], esi
mov r9d, esi
mov edx, 0x323fc666
jmp 0x140044463
neg r12b
sub r14b, spl
jmp 0x1400447d9
bswap r8
sub rsp, 5
inc r11b
lea rsp, [rsp + 1]
lea rsp, [rsp + 4]
jmp 0x1400444e9
bswap rax
jmp 0x140044632
add r12b, 0x74
push r8w
jle 0x1400444d3
bswap rax
stc
not r14
sub rsp, 0x18
not r15w
jmp 0x1400445ac
inc r11b
lea rsp, [rsp + 1]
lea rsp, [rsp + 4]
jmp 0x1400444e9
adc bp, cx
mov r9w, r12w
mov r15, r14
jmp 0x140044556
btc rdx, r11
jmp 0x14004451b
inc rcx
lea r8, [r13 + riz]
lea r11, [rsi + riz - 0x192a3aec]
jmp 0x140044604
add sil, r12b
xchg edx, edi
not bpl
xchg r8d, r11d
mov dil, byte [rsp]
jmp 0x140044540
not r11w
setge r11b
cmp ax, bx
jbe 0x14004453a
btc rdx, r11
adc bp, cx
mov r9w, r12w
mov r15, r14
jmp 0x140044556
not r15w
mov bpl, 0xf0
lea rsp, [rsp + 2]
rol r12b, 0
jmp 0x140044578
xchg r15b, r9b
setl dl
rdtsc
jmp 0x1400445d8
xchg r15b, r11b
xchg r8, rdi
jmp 0x1400445ba
bswap edx
xchg r8d, r9d
bswap r11
neg r10b
neg bpl
jmp 0x1400446ed
neg r11w
xchg dil, r9b
bsr r9, rax
bsf rax, rbx
jmp 0x1400446d7
xor r8d, 0xc486272c
jns 0x1400445d0
xchg r15b, r11b
xchg r8, rdi
xchg r15b, r9b
setl dl
rdtsc
jmp 0x1400445d8
stc
not r14
sub rsp, 0x18
jmp 0x1400445a8
bswap rax
mov dl, 0x72
lea r12, [r9 + riz]
call fcn.14004471d
mov ecx, 0xdbb4829
sbb byte [rbx + 0xf], bh
invalid
jg 0x1400445ec
neg r11w
xchg dil, r9b
call fcn.14004463f
xchg qword [rsp], rdx
lea r14, [r15 + riz + 0x65]
bswap r8d
neg r9b
dec eax
mov r8w, r10w
jmp 0x140044762
xchg qword [rsp], rdx
not al
mov r15w, r12w
mov r8d, r15d
xchg r9w, ax
mov r14b, al
jmp 0x1400447bb
lea rdx, [rdx + riz + 0xaa]
mov r11b, byte [rsp]
not bpl
stc
mov r8, rdi
setg r14b
jmp 0x140044737
push qword [rsp]
ret 8
jle 0x140044498
bswap r8
sub rsp, 5
jmp 0x14004450c
Function at 0x140173521
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
call fcn.140173073
lea rsp, [rsp + 7]
mov byte [rsp + 0xc], r8b
push qword [rsp + 0x1d]
jmp 0x140173e9c
mov rax, qword [rax + riz]
mov rax, qword [rax + riz + 0x10]
push rax
jmp 0x14017306e
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
jmp 0x140173955
mov dword [rsp + 0x12], eax
push rbp
mov word [rsp + 0x23], di
push word [rsp + 7]
lea rsp, [rsp + 5]
lea rsp, [rsp + 0x30]
jmp 0x140173d4b
Function at 0x140002e70
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140003da0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140003da0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140002ee0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400080a4]
mov rbx, rcx
test esi, esi
jle 0x140003010
mov rax, qword [0x1400080a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140002f2b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140002fb5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140002f10
mov rcx, rbx
call fcn.140003930
mov rdi, rax
test rax, rax
je 0x140003032
mov rax, qword [0x1400080a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003a70
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400080a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140003017
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140002fae
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140002fc0
add dword [0x1400080a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400080a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002fae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140002e70
nop dword [rax]
xor esi, esi
jmp 0x140002f38
mov rax, qword [0x1400080a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140002e70
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140002e70
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400035a0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140008100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400080e0]
test rbx, rbx
je 0x1400035fc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400035f3
test rsi, rsi
je 0x1400035f3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400035d8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]