joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004bdb0
Capabilities:
Check if file exists
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.14005b400
test al, al
jne 0x14004bdea
mov rcx, rbx
call fcn.14005b400
test al, al
jne 0x14004bdea
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140050660
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0x104
mov rdi, rdx
mov rbx, rcx
jae 0x140050750
cmp qword [rdx + 0x10], 0x104
jae 0x140050750
cmp qword [rdx + 0x18], 8
jb 0x140050696
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x1400506a0
mov rcx, qword [rcx]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1400506bd
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
xor sil, sil
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rbx + 0x18], 8
mov ebp, eax
jb 0x1400506de
mov rcx, qword [rbx]
jmp 0x1400506e1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005072f
shr eax, 4
and al, 1
je 0x14005072f
mov rdx, rdi
mov rcx, rbx
call fcn.14004e7b0
test al, al
je 0x14005072c
mov dl, 1
mov rcx, rbx
call fcn.14004e490
test al, al
je 0x14005072c
mov rbp, qword [rsp + 0x38]
mov sil, 1
movzx eax, sil
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor sil, sil
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x38]
movzx eax, sil
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14004bf90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
xor ebp, ebp
mov r15, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x14004bfc3
cmp qword [rdx + 0x18], 0x10
mov qword [rdx + 0x10], rbp
jb 0x14004bfbd
mov rax, qword [rdx]
jmp 0x14004bfc0
mov rax, rsi
mov byte [rax], bpl
call fcn.14005b400
test al, al
je 0x14004bfdc
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
mov rcx, rbx
mov qword [rsp + 0x48], r14
call fcn.140050010
mov r14, rax
test rax, rax
je 0x14004c0a3
mov ecx, 0x10000
mov qword [rsp + 0x40], rdi
call fcn.140111e80
mov r9, r14
mov edx, 1
mov r8d, 0x10000
mov rcx, rax
mov rbx, rax
call fcn.14011d990
mov rdi, rax
test rax, rax
je 0x14004c071
test rsi, rsi
je 0x14004c045
mov rcx, r15
mov r8, rdi
sub rcx, rbp
mov rdx, rbx
cmp rcx, rdi
cmovb r8, rcx
mov rcx, rsi
call fcn.14002a3b8
mov rax, r15
sub rax, rbp
cmp rax, rdi
jb 0x14004c082
mov r9, r14
mov edx, 1
mov r8d, 0x10000
mov rcx, rbx
add rbp, rdi
call fcn.14011d990
mov rdi, rax
test rax, rax
jne 0x14004c025
mov rcx, r14
call fcn.14011c930
test eax, eax
jne 0x14004c082
mov dil, 1
jmp 0x14004c085
xor dil, dil
mov rcx, r14
call fcn.14011cd3c
test rbx, rbx
je 0x14004c09a
mov rcx, rbx
call fcn.140111880
movzx eax, dil
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
Function at 0x14004c1a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x18], 8
mov r14, r8
mov rsi, rdx
mov rbx, rcx
jb 0x14004c1cd
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004c1df
shr eax, 4
and al, 1
jmp 0x14004c1e1
xor al, al
test al, al
mov qword [rsp + 0x40], 7
mov ecx, 0x4001
mov edi, 0x24001
cmove edi, ecx
mov rcx, qword [0x14017a910]
xor ebp, ebp
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x28], bp
test rcx, rcx
je 0x14004c221
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
call qword [rax + 0x10]
mov r8d, edi
mov dword [rsp + 0x4c], ebp
mov rdx, rbx
mov word [rsp + 0x50], bp
lea rcx, [rsp + 0x20]
call fcn.14006fe30
mov rax, qword [rsp + 0x20]
inc rax
test rax, 0xfffffffffffffffe
jne 0x14004c24e
xor bl, bl
jmp 0x14004c261
mov r8, qword [r14]
lea rcx, [rsp + 0x20]
mov rdx, qword [rsi]
call fcn.140078c40
movzx ebx, al
lea rcx, [rsp + 0x20]
call fcn.1400787b0
mov rcx, qword [0x14017a910]
test rcx, rcx
je 0x14004c283
mov r8, qword [rcx]
lea rdx, [rsp + 0x48]
call qword [r8 + 0x18]
lea rcx, [rsp + 0x28]
call fcn.1400599c0
lea rcx, [rsp + 0x20]
call fcn.1400337b0
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140111850
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004e490
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rcx + 0x10]
xor esi, esi
mov dword [rsp + 0x20], esi
movzx r14d, dl
mov rdi, rcx
mov ebp, esi
test rax, rax
jne 0x14004e4cb
mov al, 1
jmp 0x14004e69a
cmp rax, 0x104
jb 0x14004e4da
xor al, al
jmp 0x14004e69a
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x98], rbx
call fcn.14005a840
mov r9d, 2
lea rdx, [0x140150750]
xor r8d, r8d
mov rcx, rax
call fcn.1400509c0
lea rcx, [rsp + 0x28]
mov rbx, rax
call fcn.1400599c0
cmp rbx, 0xffffffffffffffff
je 0x14004e562
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.14005a840
lea rdx, [rsp + 0x28]
mov rcx, rdi
mov rbx, rax
call fcn.14005a6a0
mov rcx, rax
movzx r8d, r14b
mov rdx, rbx
call fcn.14004dfa0
lea rcx, [rsp + 0x28]
movzx ebx, al
call fcn.1400599c0
lea rcx, [rsp + 0x48]
call fcn.1400599c0
movzx eax, bl
jmp 0x14004e692
cmp qword [rdi + 0x18], 8
jb 0x14004e56e
mov rcx, qword [rdi]
jmp 0x14004e571
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14004e585
mov al, 1
jmp 0x14004e692
test bl, 1
je 0x14004e5ac
cmp qword [rdi + 0x18], 8
jb 0x14004e596
mov rcx, qword [rdi]
jmp 0x14004e599
mov rcx, rdi
mov edx, ebx
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x14004e690
test bl, 0x10
jne 0x14004e5ce
cmp qword [rdi + 0x18], 8
jb 0x14004e5bb
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
jmp 0x14004e692
test r14b, r14b
je 0x14004e618
mov ebp, 1
mov qword [rsp + 0x40], 7
mov r8d, ebp
mov qword [rsp + 0x38], rsi
lea rdx, [0x140150758]
mov word [rsp + 0x28], si
lea rcx, [rsp + 0x28]
call fcn.140029c40
movzx r8d, bpl
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14004dfa0
test al, al
jne 0x14004e618
xor bl, bl
jmp 0x14004e61a
mov bl, 1
test bpl, 1
je 0x14004e672
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x14004e672
mov rcx, qword [rsp + 0x28]
inc rax
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
ja 0x14004e6b8
add rax, rax
cmp rax, 0x1000
jb 0x14004e66d
test cl, 0x1f
jne 0x14004e6be
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14004e6c4
sub rcx, rax
cmp rcx, 8
jb 0x14004e6ca
cmp rcx, 0x27
ja 0x14004e6d0
mov rcx, rax
call fcn.140111e78
test bl, bl
je 0x14004e690
cmp qword [rdi + 0x18], 8
jb 0x14004e680
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x14004e692
xor al, al
mov rbx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140111850
mov rbp, qword [rsp + 0xa0]
add rsp, 0x70
pop r14
pop rdi
pop rsi
ret
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
Function at 0x14004e6e0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
jb 0x14004e702
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x14004e70c
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14004e728
mov al, 1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbp
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140078d60
cmp qword [rdi + 0x18], 8
mov ebp, eax
jb 0x14004e746
mov rdi, qword [rdi]
cmp qword [rbx + 0x18], 8
jb 0x14004e750
mov rbx, qword [rbx]
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r9d, [rax + 2]
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
je 0x14004e777
mov al, 1
jmp 0x14004e793
test rsi, rsi
je 0x14004e791
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140078d60
cmp eax, 0xfffffffc
cmove eax, ebp
mov dword [rsi], eax
xor al, al
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14004ed50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 8
jb 0x14004ed5e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004ed74
shr eax, 4
and eax, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x14004ed80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rdi, rcx
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x14004ef07
mov qword [rsp + 0x298], rbx
mov qword [rsp + 0x2a0], rsi
xor esi, esi
cmp word [rsp + 0x60], si
jne 0x14004ede4
mov r8d, esi
jmp 0x14004edfa
lea rax, [rsp + 0x60]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], si
jne 0x14004edf0
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rsi
mov word [rsp + 0x20], si
test r8, r8
jne 0x14004ee21
mov rbx, rsi
mov word [rsp + 0x20], si
mov qword [rsp + 0x30], rbx
jmp 0x14004ee35
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140029c40
mov rbx, qword [rsp + 0x30]
xor edx, edx
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.140050760
cmp rax, 0xffffffffffffffff
je 0x14004ee60
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.14002b250
mov rbx, qword [rsp + 0x30]
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x58], 7
cmovae rdx, qword [rsp + 0x20]
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
test rbx, rbx
jne 0x14004ee95
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
jmp 0x14004eea2
mov r8, rbx
lea rcx, [rsp + 0x40]
call fcn.140029c40
xor edx, edx
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.140050760
mov rsi, qword [rsp + 0x2a0]
mov rbx, qword [rsp + 0x298]
cmp rax, 0xffffffffffffffff
je 0x14004eed8
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.14002b250
lea rcx, [rsp + 0x40]
call fcn.14005b7c0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140059a60
lea rcx, [rsp + 0x40]
call fcn.1400599c0
lea rcx, [rsp + 0x20]
call fcn.1400599c0
mov al, 1
jmp 0x14004ef09
xor al, al
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140111850
mov rdi, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
add rsp, 0x280
pop rbp
ret
Function at 0x14004ef30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x28]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14004f001
cmp word [rsp + 0x50], 0
je 0x14004f001
lea rax, [rsp + 0x50]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004ef90
xor edi, edi
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
test r8, r8
jne 0x14004efcc
cmp qword [rbx + 0x18], 8
mov qword [rbx + 0x10], rdi
jb 0x14004efc4
mov rax, qword [rbx]
mov word [rax], di
jmp 0x14004efd9
mov rax, rbx
mov word [rbx], di
jmp 0x14004efd9
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140029c40
xor edx, edx
xor r8d, r8d
mov rcx, rbx
call fcn.140050760
cmp rax, 0xffffffffffffffff
je 0x14004f080
or r8, 0xffffffffffffffff
mov rdx, rax
mov rcx, rbx
call fcn.14002b250
jmp 0x14004f080
xor edi, edi
mov qword [rsp + 0x48], 7
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
call fcn.14004ed80
mov qword [rbx + 0x18], 7
mov rcx, rbx
mov qword [rbx + 0x10], rdi
mov word [rbx], di
test al, al
je 0x14004f042
lea rdx, [rsp + 0x30]
call fcn.140029ff0
jmp 0x14004f076
mov r8d, 3
lea rdx, [0x140150760]
call fcn.140029c40
xor edx, edx
xor r8d, r8d
mov rcx, rbx
call fcn.140050760
cmp rax, 0xffffffffffffffff
je 0x14004f076
or r8, 0xffffffffffffffff
mov rdx, rax
mov rcx, rbx
call fcn.14002b250
lea rcx, [rsp + 0x30]
call fcn.1400599c0
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140111850
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x14004fdbc
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rcx + 0x18], 8
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
jb 0x14004fde8
mov rsi, qword [rcx]
jmp 0x14004fdeb
mov rsi, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004fe16
test al, 0x10
je 0x14004fe04
mov al, 1
jmp 0x14004fe9f
test rbx, rbx
je 0x14004fe0f
mov dword [rbx], 0xfffffff7
xor al, al
jmp 0x14004fe9f
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14005a6a0
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.14002be8c
test al, al
je 0x14004fe43
test rbx, rbx
je 0x14004fe8c
mov dword [rbx], 0xfffffffc
xor bl, bl
jmp 0x14004fe92
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14004fdb0
test al, al
je 0x14004fe8c
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14004fe90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0xb7
jne 0x14004fe7e
mov rcx, rdi
call fcn.14004ed50
test al, al
jne 0x14004fe90
test rbx, rbx
je 0x14004fe8c
mov ecx, esi
call fcn.140078d60
mov dword [rbx], eax
xor bl, bl
jmp 0x14004fe92
mov bl, 1
lea rcx, [rsp + 0x28]
call fcn.1400599c0
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140111850
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140050140
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x68], r12
mov esi, r8d
mov qword [rsp + 0x60], r13
mov r12, rdx
xor r13d, r13d
mov dword [rsp + 0x48], r13d
cmp qword [rcx + 0x18], 8
jb 0x14005016a
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov qword [rsp + 0xa8], rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, r13
mov qword [rsp + 0x40], r13
mov rbx, rax
test rax, rax
je 0x1400502d6
mov qword [rsp + 0x58], r14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x40]
mov r14d, eax
lea rcx, [rdi - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14005023c
mov qword [rsp + 0x50], r15
call fcn.14006b020
mov rcx, qword [0x14017c0e0]
mov rbp, rax
mov r15, qword [rsp + 0x88]
test rcx, rcx
jne 0x1400501f6
call fcn.14006da40
mov rcx, qword [0x14017c0e0]
mov r10, qword [rcx]
lea r8, [rsp + 0x40]
mov r9, r15
mov qword [rsp + 0x20], rbp
mov rdx, rdi
call qword [r10 + 0x10]
mov rcx, qword [0x14017c0e0]
mov rdi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
test rcx, rcx
jne 0x14005022f
call fcn.14006da40
mov rcx, qword [0x14017c0e0]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
mov qword [rsp + 0x40], r13
cmp rbx, 0xffffffffffffffff
je 0x140050286
mov qword [rsp + 0x40], rbx
call fcn.14006b020
mov rcx, qword [0x14017c0e0]
mov rdi, rax
mov rbp, qword [rsp + 0x88]
test rcx, rcx
jne 0x14005026f
call fcn.14006da40
mov rcx, qword [0x14017c0e0]
mov r10, qword [rcx]
lea r8, [rsp + 0x40]
mov r9, rbp
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call qword [r10 + reloc.OLEAUT32.dll_VariantClear]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
lea rax, [rdi + 1]
test rax, 0xfffffffffffffffe
je 0x1400502d6
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], r13
mov r8d, esi
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400502d1
mov ebx, dword [rsp + 0x48]
cmp ebx, esi
jne 0x1400502d1
mov rdi, qword [rsp + 0x40]
jmp 0x1400502d9
mov rdi, qword [rsp + 0x40]
or ebx, 0xffffffff
mov r13, qword [rsp + 0x60]
lea rax, [rdi - 1]
mov r12, qword [rsp + 0x68]
cmp rax, 0xfffffffffffffffd
ja 0x140050352
call fcn.14006b020
mov rcx, qword [0x14017c0e0]
mov rsi, rax
mov rbp, qword [rsp + 0x88]
test rcx, rcx
jne 0x140050315
call fcn.14006da40
mov rcx, qword [0x14017c0e0]
mov r10, qword [rcx]
lea r8, [rsp + 0x40]
mov r9, rbp
mov qword [rsp + 0x20], rsi
mov rdx, rdi
call qword [r10 + 0x10]
mov rcx, qword [0x14017c0e0]
mov rdi, qword [rsp + 0x40]
test rcx, rcx
jne 0x140050349
call fcn.14006da40
mov rcx, qword [0x14017c0e0]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8]
mov eax, ebx
mov rbp, qword [rsp + 0xa8]
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140050370
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rdi, rcx
lea rdx, [rbp - 0x80]
xor esi, esi
mov ecx, 0x104
mov word [rbp - 0x80], si
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x103
ja 0x140050570
mov qword [rsp + 0x2b8], rbx
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rsi
mov word [rsp + 0x60], si
cmp word [rbp - 0x80], si
jne 0x1400503e6
mov r8d, esi
jmp 0x1400503fa
lea rax, [rbp - 0x80]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], si
jne 0x1400503f0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.140029c40
cmp qword [rsp + 0x78], 8
lea rdx, [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmovae rdx, qword [rsp + 0x60]
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rsi
mov word [rsp + 0x20], si
test r8, r8
jne 0x140050445
mov rbx, rsi
mov word [rsp + 0x20], si
mov qword [rsp + 0x30], rbx
jmp 0x140050454
lea rcx, [rsp + 0x20]
call fcn.140029c40
mov rbx, qword [rsp + 0x30]
xor edx, edx
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.140050760
cmp rax, 0xffffffffffffffff
je 0x14005047f
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.14002b250
mov rbx, qword [rsp + 0x30]
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x58], 7
cmovae rdx, qword [rsp + 0x20]
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
test rbx, rbx
jne 0x1400504b4
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
jmp 0x1400504c1
mov r8, rbx
lea rcx, [rsp + 0x40]
call fcn.140029c40
xor edx, edx
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.140050760
mov rbx, qword [rsp + 0x2b8]
cmp rax, 0xffffffffffffffff
je 0x1400504ef
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.14002b250
lea rcx, [rsp + 0x40]
call fcn.14005b7c0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140059a60
lea rcx, [rsp + 0x40]
call fcn.1400599c0
lea rcx, [rsp + 0x20]
call fcn.1400599c0
mov rax, qword [rsp + 0x78]
cmp rax, 8
jb 0x14005056c
mov rcx, qword [rsp + 0x60]
inc rax
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
ja 0x140050596
add rax, rax
cmp rax, 0x1000
jb 0x140050567
test cl, 0x1f
jne 0x14005059c
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400505a2
sub rcx, rax
cmp rcx, 8
jb 0x1400505a8
cmp rcx, 0x27
ja 0x1400505ae
mov rcx, rax
call fcn.140111e78
mov al, 1
jmp 0x140050572
xor al, al
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140111850
lea r11, [rsp + 0x2a0]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
Function at 0x1400505c0
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.14005b400
test al, al
jne 0x14005064d
mov rcx, rbx
call fcn.14005b400
test al, al
jne 0x14005064d
cmp qword [rdi + 0x10], 0x104
jae 0x14005064d
cmp qword [rbx + 0x10], 0x104
jae 0x14005064d
cmp qword [rbx + 0x18], 8
jb 0x140050603
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x14005060d
mov rdi, qword [rdi]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14005064d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005064d
test al, 1
je 0x140050640
and eax, 0xfffffffe
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140050660
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.14005b400
test al, al
jne 0x14004bdea
mov rcx, rbx
call fcn.14005b400
test al, al
jne 0x14004bdea
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140050660
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0x104
mov rdi, rdx
mov rbx, rcx
jae 0x140050750
cmp qword [rdx + 0x10], 0x104
jae 0x140050750
cmp qword [rdx + 0x18], 8
jb 0x140050696
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x1400506a0
mov rcx, qword [rcx]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1400506bd
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
xor sil, sil
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rbx + 0x18], 8
mov ebp, eax
jb 0x1400506de
mov rcx, qword [rbx]
jmp 0x1400506e1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14005072f
shr eax, 4
and al, 1
je 0x14005072f
mov rdx, rdi
mov rcx, rbx
call fcn.14004e7b0
test al, al
je 0x14005072c
mov dl, 1
mov rcx, rbx
call fcn.14004e490
test al, al
je 0x14005072c
mov rbp, qword [rsp + 0x38]
mov sil, 1
movzx eax, sil
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor sil, sil
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x38]
movzx eax, sil
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret