joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011a00
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140148158]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call sym.unk_6363
mov rax, qword [0x14019bcf8]
test rax, rax
je 0x140011a70
mov r9, qword [0x14019bd00]
lea r8, [rax - 1]
xor ecx, ecx
cmp rax, 1
jne 0x140011a4e
jmp 0x140011ae8
cmp rcx, rax
je 0x140011a70
lea r8, [rax - 1]
cmp r8, rcx
jb 0x140011a70
lea rax, [rcx + r8]
shr rax, 1
mov rdx, rax
shl rdx, 4
add rdx, r9
cmp rbx, qword [rdx + 8]
je 0x140011a88
jb 0x140011a40
lea rcx, [rax + 1]
cmp r8, rcx
jae 0x140011a4e
mov rcx, rdi
call sym.unk_6365
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rdx]
test rax, rax
je 0x140011a70
cmp qword [rax + 0x1d8], rbx
jne 0x140011a70
test byte [rax + 0x40], 0xc
jne 0x140011a70
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140011a70
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140011a70
mov rcx, rdi
call sym.unk_6365
test esi, esi
je 0x140011ae0
sub esi, 2
cmp esi, 0x15
ja 0x140011af3
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.unk_6428
xor eax, eax
jmp 0x140011a7d
cmp rbx, qword [r9 + 8]
jne 0x140011a70
mov rax, qword [r9]
jmp 0x140011a8b
mov eax, 0x16
jmp 0x140011a7d
Function at 0x140011da0
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
mov r12, r9
call sym.unk_6392
mov rbx, rax
test rax, rax
je 0x140011fd4
test rbp, rbp
je 0x140011ddb
mov rax, qword [rax + 0x1d8]
mov qword [rbp], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbx + 0x44], 1
mov dword [rbx + 0xbc], 0
mov qword [rbx + 0x28], 0xffffffffffffffff
mov r14, r13
mov qword [rbx + 8], r12
mov r12, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rsi
xor esi, esi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call r12
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x140011e50
test esi, esi
jne 0x140011e40
xor ecx, ecx
mov esi, 1
call r14
jmp 0x140011e0f
add esi, 1
mov ecx, 0x14
call r13
cmp esi, 5
jne 0x140011e0f
mov qword [rbx + 0x38], 0xffffffffffffffff
lea r12, [rbx + 0x68]
mov rcx, r12
call sym.unk_6380
cmp eax, 1
je 0x140011ffa
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xc0], 0
mov dword [rbx + 0xb8], 0
je 0x140011fbd
xor edx, edx
test rdi, rdi
je 0x140011ebd
mov eax, dword [rdi]
mov rsi, qword [rdi + 0x10]
mov dword [rbx + 0x44], eax
test al, 8
jne 0x140011fe0
mov eax, dword [rdi + 0x18]
mov dword [rbx + 0xc0], eax
mov edx, esi
lea r8, [sym.unk_6396]
mov r9, rbx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140011f88
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x140011f60
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
jne 0x140011f40
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rsi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140011f27
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x140011f01
mov edx, 2
cmp eax, edx
cmovle edx, eax
cmp eax, 0xf
mov eax, 0xf
cmovge edx, eax
jmp 0x140011f01
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140011f97
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call sym.unk_6368
mov rcx, r12
call sym.unk_6380
cmp eax, 1
je 0x140011ffa
mov qword [rbx + 0x68], 0xffffffffffffffff
pxor xmm0, xmm0
movups xmmword [rbx + 0x28], xmm0
test rbp, rbp
je 0x140011fca
mov qword [rbp], 0
cmp qword [rbx + 0x1d0], 0
je 0x140011ff0
mov eax, 0xb
jmp 0x140011f31
call sym.unk_6393
mov eax, dword [rax + 0xc0]
jmp 0x140011eb5
mov rcx, rbx
call sym.unk_6390
jmp 0x140011fd4
call sym.unk_6387
nop
Function at 0x140015be0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x140015c0c
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x1400a5610
Capabilities:
Create directory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rbx, rcx
mov dword [rsp + 0x30], 0
call sym.unk_5167
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rax
call qword [sym.imp.msvcrt.dll__wmkdir]
mov edx, eax
mov eax, 1
test edx, edx
jne 0x1400a5650
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
cmp esi, 0x11
je 0x1400a5680
call sym.unk_5168
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x38], rax
test esi, esi
jne 0x1400a5697
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sym.unk_5775
cmp al, 2
jne 0x1400a565d
mov esi, dword [rsp + 0x30]
jmp 0x1400a566b
mov ecx, 0x30
lea rdi, [rsp + 0x40]
call sym.unk_2059
lea rdx, str.cannot_create_directory
mov rcx, rdi
mov rsi, rax
call sym.unk_5743
movdqa xmm0, xmmword [rsp + 0x30]
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
lea r9, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.unk_5875
mov rcx, rdi
call sym.unk_4955
lea r8, [sym.unk_5883]
lea rdx, [0x140160690]
mov rcx, rsi
call sym.unk_2101
mov rbx, rax
jmp 0x1400a5704
mov rcx, rsi
call sym.unk_2055
mov rcx, rbx
call dbg._Unwind_Resume
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400a5720
Capabilities:
Create directory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rbx, rdx
mov rcx, qword [rcx]
call qword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x1400a5760
call sym.unk_5167
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov edi, dword [rax]
cmp edi, 0x11
je 0x1400a5788
call sym.unk_5168
mov dword [rbx], edi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rdx, rbx
mov rcx, rsi
call sym.unk_5775
cmp al, 2
jne 0x1400a576d
xor eax, eax
jmp 0x1400a577a
Function at 0x1400a57a0
Capabilities:
Create directory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rbx, rdx
mov rdi, rcx
lea rsi, [rsp + 0x40]
mov dword [rsp + 0x30], 0
call sym.unk_5167
mov rcx, qword [rbx]
mov rdx, rsi
mov qword [rsp + 0x38], rax
call qword [sym.imp.msvcrt.dll__wstat64]
test eax, eax
jne 0x1400a5830
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x1400a5800
mov eax, 1
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ebx, dword [rax]
cmp ebx, 0x11
je 0x1400a5850
call sym.unk_5168
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x1400a5867
xor eax, eax
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.unk_5168
mov rbp, rax
call qword [sym.imp.msvcrt.dll__errno]
mov qword [rsp + 0x38], rbp
mov ebx, dword [rax]
mov dword [rsp + 0x30], ebx
jmp 0x1400a581b
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sym.unk_5775
cmp al, 2
jne 0x1400a580d
mov ebx, dword [rsp + 0x30]
jmp 0x1400a581b
mov ecx, 0x30
call sym.unk_2059
lea rdx, str.cannot_create_directory
mov rcx, rsi
mov rbp, rax
call sym.unk_5743
movdqa xmm0, xmmword [rsp + 0x30]
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
lea r9, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.unk_5875
mov rcx, rsi
call sym.unk_4955
lea r8, [sym.unk_5883]
lea rdx, [0x140160690]
mov rcx, rbp
call sym.unk_2101
mov rbx, rax
jmp 0x1400a58cf
mov rcx, rbp
call sym.unk_2055
mov rcx, rbx
call dbg._Unwind_Resume
nop

Function at 0x1400a58e0
Capabilities:
Create directory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x20]
mov rbx, r8
mov rcx, qword [rax]
call qword [sym.imp.msvcrt.dll__wstat64]
test eax, eax
jne 0x1400a5958
mov rcx, qword [rsi]
call qword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x1400a5930
call sym.unk_5167
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov edi, dword [rax]
cmp edi, 0x11
je 0x1400a5978
call sym.unk_5168
mov dword [rbx], edi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
call sym.unk_5168
mov rsi, rax
call qword [sym.imp.msvcrt.dll__errno]
mov eax, dword [rax]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
xor eax, eax
jmp 0x1400a594a
mov rdx, rbx
mov rcx, rsi
call sym.unk_5775
cmp al, 2
jne 0x1400a593d
jmp 0x1400a5948
Function at 0x1400a8370
Capabilities:
Get common file path

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
xor r11d, r11d
mov rdi, qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r12, [rsp + 0x40]
mov rbp, rdx
mov rbx, rcx
mov edx, 0x400
mov qword [rsp + 0x30], r12
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x38], 0
mov word [rsp + 0x40], r11w
nop dword [rax]
xor r8d, r8d
mov rcx, rsi
call sym.unk_5621
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
call rdi
mov edx, eax
cmp qword [rsp + 0x38], rdx
jb 0x1400a83b0
mov qword [rsp + 0x28], rdx
test eax, eax
je 0x1400a8480
call sym.unk_5167
mov rdx, qword [rsp + 0x28]
xor edi, edi
mov dword [rbp], edi
xor r8d, r8d
mov rcx, rsi
mov qword [rbp + 8], rax
call sym.unk_5621
mov rax, qword [rsp + 0x30]
lea rdx, [rbx + 0x10]
mov rcx, qword [rsp + 0x38]
mov qword [rbx], rdx
cmp rax, r12
je 0x1400a84f0
mov qword [rbx], rax
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rcx
lea rdi, [rbx + 0x20]
xor r10d, r10d
mov rcx, rdi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0
mov word [rsp + 0x40], r10w
call sym.unk_5825
mov rcx, rbx
call sym.unk_5845
mov rcx, qword [rsp + 0x30]
cmp rcx, r12
je 0x1400a8468
mov rax, qword [rsp + 0x40]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov r9d, dword [rbp]
test r9d, r9d
je 0x1400a84a0
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sym.unk_5167
mov rdx, qword [rsp + 0x28]
jmp 0x1400a83e8
mov rdx, rbp
mov rcx, rbx
call sym.unk_5775
mov r8d, dword [rbp]
test r8d, r8d
jne 0x1400a8530
cmp al, 2
je 0x1400a8471
mov rax, qword [rbx]
xor edx, edx
mov qword [rbx + 8], 0
mov rcx, rbx
mov word [rax], dx
call sym.unk_5845
call sym.unk_5168
mov dword [rbp], 0x14
mov qword [rbp + 8], rax
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rax, [rcx + rcx + 2]
cmp eax, 8
jae 0x1400a8556
test al, 4
jne 0x1400a85a6
test eax, eax
je 0x1400a8420
movzx r8d, byte [r12]
mov byte [rbx + 0x10], r8b
test al, 2
je 0x1400a8420
mov eax, eax
movzx r8d, word [r12 + rax - 2]
mov word [rdx + rax - 2], r8w
jmp 0x1400a8420
mov rax, qword [rbx]
xor ecx, ecx
mov qword [rbx + 8], 0
mov word [rax], cx
mov rcx, rbx
call sym.unk_5845
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8, qword [r12]
mov r11, r12
mov qword [rbx + 0x10], r8
mov r8d, eax
mov r9, qword [r12 + r8 - 8]
mov qword [rdx + r8 - 8], r9
lea r9, [rbx + 0x18]
and r9, 0xfffffffffffffff8
sub rdx, r9
add eax, edx
sub r11, rdx
and eax, 0xfffffff8
cmp eax, 8
jb 0x1400a8420
and eax, 0xfffffff8
xor edx, edx
mov r8d, edx
add edx, 8
mov r10, qword [r11 + r8]
mov qword [r9 + r8], r10
cmp edx, eax
jb 0x1400a858f
jmp 0x1400a8420
mov r8d, dword [r12]
mov eax, eax
mov dword [rbx + 0x10], r8d
mov r8d, dword [r12 + rax - 4]
mov dword [rdx + rax - 4], r8d
jmp 0x1400a8420
Function at 0x1400a9a90
Capabilities:
Get disk size

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rsi, rdx
lea rdi, [rsp + 0x50]
mov rbx, rcx
call sym.unk_5167
pcmpeqd xmm0, xmm0
mov rdx, rsi
mov rcx, rdi
mov rbp, rax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0xffffffffffffffff
call sym.unk_5746
mov rcx, rdi
call sym.unk_5847
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1400a9bb0
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1400a9b1e
mov qword [rbx], rax
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1400a9b2c
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1400a9b3a
mov qword [rbx + 0x10], rax
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x1400a9b90
lea rcx, [rsp + 0x70]
xor r12d, r12d
call sym.unk_5820
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
cmp rcx, rax
je 0x1400a9b74
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
test r12d, r12d
jne 0x1400a9bde
mov rax, rbx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
cmp rcx, rax
je 0x1400a9b74
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x1400a9b74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0x70]
mov r12d, eax
test rdx, rdx
je 0x1400a9bcd
lea rcx, [rsp + 0x70]
call sym.unk_5820
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
cmp rcx, rax
jne 0x1400a9b60
jmp 0x1400a9b6f
mov ecx, 0x30
call sym.unk_2059
lea rdx, str.cannot_get_free_space
mov rcx, rdi
mov r13, rax
call sym.unk_5743
mov eax, r12d
lea r9, [rsp + 0x20]
mov r8, rsi
mov rdx, rdi
mov rcx, r13
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbp
call sym.unk_5875
mov rcx, rdi
call sym.unk_4955
lea r8, [sym.unk_5883]
lea rdx, [0x140160690]
mov rcx, r13
call sym.unk_2101
mov rbx, rax
jmp 0x1400a9c48
mov rcx, r13
call sym.unk_2055
mov rcx, rbx
call dbg._Unwind_Resume
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400a9c60
Capabilities:
Get disk size

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
pcmpeqd xmm0, xmm0
lea rdi, [rsp + 0x40]
movups xmmword [rcx], xmm0
mov rbx, rcx
mov rsi, r8
mov qword [rcx + 0x10], 0xffffffffffffffff
mov rcx, rdi
call sym.unk_5746
mov rcx, rdi
call sym.unk_5847
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1400a9d50
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400a9cdb
mov qword [rbx], rax
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1400a9ce9
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x1400a9d40
call sym.unk_5167
xor edi, edi
mov rdx, qword [rsp + 0x60]
mov dword [rsi], edi
mov qword [rsi + 8], rax
test rdx, rdx
je 0x1400a9d14
lea rcx, [rsp + 0x60]
call sym.unk_5820
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x1400a9d32
mov rax, qword [rsp + 0x50]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rax, rbx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
mov qword [rbx + 0x10], rax
jmp 0x1400a9cf3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sym.unk_5167
jmp 0x1400a9cfa

Function at 0x1400a9d60
Capabilities:
Delete directory
Delete file

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rbx, rcx
lea rdi, [rsp + 0x30]
mov dword [rsp + 0x30], 0
call sym.unk_5167
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov rsi, rax
call sym.unk_5782
test al, al
jne 0x1400a9da8
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x1400a9dd8
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
cmp al, 0xff
je 0x1400a9d9b
mov rdx, rdi
mov rcx, rbx
call sym.unk_5775
cmp al, 2
je 0x1400a9e38
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400a9e49
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400a9e60
mov ecx, 0x30
lea rdi, [rsp + 0x40]
call sym.unk_2059
lea rdx, str.cannot_remove
mov rcx, rdi
mov rsi, rax
call sym.unk_5743
movdqa xmm0, xmmword [rsp + 0x30]
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
lea r9, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.unk_5875
mov rcx, rdi
call sym.unk_4955
lea r8, [sym.unk_5883]
lea rdx, [0x140160690]
mov rcx, rsi
call sym.unk_2101
nop dword [rax]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x1400a9dbb
mov eax, 1
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], eax
jmp 0x1400a9d97
Function at 0x1400a9ea0
Capabilities:
Delete directory
Delete file

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
call sym.unk_5782
test al, al
je 0x1400a9eee
cmp al, 0xff
je 0x1400a9f00
mov rdx, rbx
mov rcx, rsi
call sym.unk_5775
cmp al, 2
je 0x1400a9f18
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400a9f25
mov eax, dword [rbx]
test eax, eax
jne 0x1400a9eee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call sym.unk_5167
mov dword [rbx], esi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.unk_5167
mov dword [rbx], 0
mov qword [rbx + 8], rax
jmp 0x1400a9eee
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x1400a9ec8
call sym.unk_5167
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x1400a9f40
Capabilities:
Move file

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbx, rdx
lea rbp, [rsp + 0x40]
mov r12, rcx
mov dword [rsp + 0x40], 0
call sym.unk_5167
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x48], rax
mov rdi, rax
call sym.unk_5775
mov rsi, rax
cmp al, 0xff
je 0x1400a9fb8
mov ecx, dword [rsp + 0x40]
test ecx, ecx
jne 0x1400aa01e
test al, al
jne 0x1400a9fd0
mov rdx, qword [rbx]
mov rcx, qword [r12]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1400aa088
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x48], rdi
jmp 0x1400a9f8c
mov rdx, rbp
mov rcx, r12
call sym.unk_5775
mov edx, dword [rsp + 0x40]
test edx, edx
jne 0x1400aa01e
cmp sil, 2
je 0x1400aa008
cmp al, 2
jne 0x1400a9f8c
call sym.unk_5168
mov dword [rsp + 0x40], 0x14
mov qword [rsp + 0x48], rax
jmp 0x1400aa01e
cmp al, 2
je 0x1400a9f8c
call sym.unk_5168
mov dword [rsp + 0x40], 0x15
mov qword [rsp + 0x48], rax
mov ecx, 0x30
lea rdi, [rsp + 0x50]
call sym.unk_2059
lea rdx, str.cannot_rename
mov rcx, rdi
mov rsi, rax
call sym.unk_5743
lea rax, [rsp + 0x30]
mov r9, rbx
mov r8, r12
mov rdx, rdi
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [rsp + 0x40]
mov rcx, rsi
movaps xmmword [rsp + 0x30], xmm0
call sym.unk_5877
mov rcx, rdi
call sym.unk_4955
lea r8, [sym.unk_5883]
lea rdx, [0x140160690]
mov rcx, rsi
call sym.unk_2101
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x1400aa0c8
call rdi
mov dword [rax], 5
call sym.unk_5168
mov rsi, rax
call rdi
mov qword [rsp + 0x48], rsi
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x1400aa01e
jmp 0x1400a9fa7
call rdi
mov dword [rax], 0xd
jmp 0x1400aa0a2
Function at 0x1400aa100
Capabilities:
Move file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rbp, rcx
mov rdx, r8
mov rbx, r8
mov rcx, rsi
call sym.unk_5775
mov rdi, rax
cmp al, 0xff
je 0x1400aa160
mov ecx, dword [rbx]
test ecx, ecx
jne 0x1400aa153
test al, al
jne 0x1400aa178
mov rdx, qword [rsi]
mov rcx, qword [rbp]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1400aa1c0
call sym.unk_5167
mov dword [rbx], 0
mov qword [rbx + 8], rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.unk_5167
mov dword [rbx], 0
mov qword [rbx + 8], rax
jmp 0x1400aa12d
mov rdx, rbx
mov rcx, rbp
call sym.unk_5775
mov edx, dword [rbx]
test edx, edx
jne 0x1400aa153
cmp dil, 2
je 0x1400aa1a8
cmp al, 2
jne 0x1400aa12d
call sym.unk_5168
mov dword [rbx], 0x14
mov qword [rbx + 8], rax
jmp 0x1400aa153
cmp al, 2
je 0x1400aa12d
call sym.unk_5168
mov dword [rbx], 0x15
mov qword [rbx + 8], rax
jmp 0x1400aa153
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x1400aa1f5
call rdi
mov dword [rax], 5
call sym.unk_5168
mov rsi, rax
call rdi
mov eax, dword [rax]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call rdi
mov dword [rax], 0xd
jmp 0x1400aa1da

Function at 0x1400b5cd0
Capabilities:
Get disk size

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, qword [rsp + 0x90]
mov rdi, rdx
mov rbp, r8
mov rsi, r9
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x28]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1400b5d68
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400b5d2a
mov qword [rdi], rax
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1400b5d38
mov qword [rbp], rax
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x1400b5d60
call sym.unk_5167
xor esi, esi
mov dword [rbx], esi
mov qword [rbx + 8], rax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov qword [rsi], rax
jmp 0x1400b5d42
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call sym.unk_5167
mov dword [rbx], esi
mov qword [rbx + 8], rax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400bee00
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x1400bee48
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1400bee1a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400d6cc0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400d6ce8
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400d6d30
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400d6d00
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400d6d3c
call rbp
cmp dword [rax], 4
je 0x1400d6d00
lea rcx, str.random_device_could_not_be_read
call sym.unk_3870
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400d7060
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400d7088
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400d70d0
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400d70a0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400d70dc
call rbp
cmp dword [rax], 4
je 0x1400d70a0
lea rcx, str.random_device_could_not_be_read
call sym.unk_3870
nop
nop
nop
nop
nop
nop
nop
nop