joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405420
Capabilities:
Enumerate disk volumes
Get disk information
Get disk size
Get file size

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov r13d, ecx
mov rbx, rdx
cmp ecx, 0xffffffff
je 0x4054d6
test rdx, rdx
js 0x4054d6
call sym.unk_4321
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x405670
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x405670
mov ecx, r13d
call sym._telli64
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x4054d6
lea rdx, [rsp + 0x58]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x405670
cmp rbx, qword [rsp + 0x58]
ja 0x405530
xor r9d, r9d
mov qword [rsp + 0x60], rbx
lea r8, [rsp + 0x64]
mov edx, ebx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4054f0
cmp dword [rsp + 0x60], 0xffffffff
je 0x4054f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x83
je 0x405638
mov ecx, 0x16
call dbg._set_errno
mov eax, 0xffffffff
jmp 0x405513
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x4054d6
xor r8d, r8d
mov rdx, r15
mov ecx, r13d
call sym.unk_4331
cmp rax, 0xffffffffffffffff
je 0x4054d6
xor eax, eax
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x4054d6
mov edx, 2
mov ecx, 0x33
call sym.calloc
mov edx, 2
mov ecx, 0x106
mov r14, rax
call sym.calloc
mov rsi, rax
test r14, r14
je 0x405670
test rax, rax
je 0x405670
mov edx, 0x32
mov rcx, r14
lea rbp, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rdi, rax
jmp 0x4055aa
mov r8d, 0x32
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
je 0x405650
mov dword [rsp + 0x38], 0
mov r9, rbp
mov rdx, rsi
mov r8d, 0x105
mov qword [rsp + 0x30], 0
mov rcx, r14
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [rsp + 0x4c]
cmp dword [rsp + 0x7c], eax
jne 0x405590
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov rcx, rsi
call sym.free
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov rcx, r14
mov esi, eax
call sym.free
test esi, esi
je 0x405638
mov rax, rbx
sub rax, qword [rsp + 0x58]
cmp rax, qword [rsp + 0x50]
jbe 0x4054a1
nop word [rax + rax]
mov ecx, 0x1b
call dbg._set_errno
mov eax, 0xffffffff
jmp 0x405513
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov rcx, r14
xor r14d, r14d
call sym.free
jmp 0x4055f5
mov ecx, 9
call dbg._set_errno
mov eax, 0xffffffff
jmp 0x405513
Function at 0x411a50
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x00536410], 1
je 0x411afe
lea rcx, [0x00501150]
lea rbx, [0x00536410]
call sym.unk_4176
mov r12, qword [0x005363c0]
test r12, r12
jne 0x411aa1
jmp 0x411c98
mov rax, qword [r12 + 0x18]
test rax, rax
je 0x411c60
mov r12, rax
cmp qword [r12], rbx
jne 0x411a90
inc dword [r12 + 0x10]
lea r13, [r12 + 8]
lea rcx, [0x00501150]
call sym.unk_4178
mov rcx, r13
call sym.unk_4158
mov ebx, dword [0x00536410]
test ebx, ebx
jne 0x411b20
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x00501168], eax
cmp eax, 0xffffffff
je sym.unk_4187
mov dword [0x00536410], 1
mov rcx, r13
call sym.unk_4160
mov rcx, r12
call sym.unk_4182
mov ecx, dword [0x00501168]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x411b50
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
cmp ebx, 1
je 0x411aee
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r9d, ebx
lea r8, [0x00536410]
lea rdx, str._once__p_is__d_n
mov rcx, rax
call sym.fprintf
jmp 0x411aee
call sym.unk_4185
cmp qword [sym.unk_4191], 0
mov rbx, rax
je 0x411b12
test rax, rax
je 0x411b12
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call sym.unk_4175
cmp eax, 1
je 0x411cbd
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rsi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rsi
mov dword [rsp + 0x30], 2
mov r8, r13
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je sym.unk_4187
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x00501168]
mov rdx, rbx
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je sym.unk_4187
mov r12, rbx
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
mov edx, 0x20
mov ecx, 1
call sym.calloc
mov qword [rax], rbx
mov dword [rax + 0x10], 1
mov qword [r12 + 0x18], rax
mov r12, rax
lea r13, [r12 + 8]
xor edx, edx
mov rcx, r13
call sym.unk_4162
jmp 0x411ab1
mov edx, 0x20
mov ecx, 1
call sym.calloc
mov qword [rax], rbx
mov r12, rax
mov dword [rax + 0x10], 1
mov qword [0x005363c0], rax
jmp 0x411c81
call sym.unk_4181
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x412150
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
test edx, edx
jne 0x412180
test r8, r8
je 0x412230
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
cmp edx, 1
je 0x412260
cmp edx, 3
jne 0x412167
mov ecx, dword [0x00501168]
cmp ecx, 0xffffffff
je 0x412167
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x412167
test byte [rax + 0x40], 0x30
je 0x412290
mov rcx, qword [rax + 0x1d8]
test rcx, rcx
je 0x4121c2
call sym.unk_4188
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x4121ed
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r13
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x4121e3
call r13
pxor xmm0, xmm0
movups xmmword [r12 + 0x28], xmm0
lea rcx, [r12 + 0x38]
call sym.unk_4163
lea rcx, [r12 + 0x68]
call sym.unk_4175
cmp eax, 1
je 0x412324
mov qword [r12 + 0x68], 0xffffffffffffffff
mov rcx, r12
call sym.unk_4180
mov ecx, dword [0x00501168]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x412167
mov rcx, qword [0x005363d0]
test rcx, rcx
je 0x412167
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov qword [0x005363d0], 0
jmp 0x412167
lea rdx, [sym.unk_4179]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [0x005363d0], rax
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
mov rcx, qword [rax + 0x30]
mov eax, dword [rax + 0xbc]
test eax, eax
jne 0x412330
test rcx, rcx
je 0x4122ad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r12 + 0x1d8]
mov qword [r12 + 0x30], 0
mov dword [r12 + 0xbc], 1
test rcx, rcx
je 0x4122d4
call sym.unk_4188
lea r13, [r12 + 0x38]
lea r14, [r12 + 0x68]
test byte [r12 + 0x44], 4
je 0x412370
mov rcx, qword [r12 + 0x28]
mov dword [r12], 0xdeadbeef
test rcx, rcx
je 0x412302
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x28], 0
mov rcx, r13
call sym.unk_4163
mov rcx, r14
call sym.unk_4175
cmp eax, 1
jne 0x41220a
call sym.unk_4181
nop dword [rax]
test rcx, rcx
je 0x41233b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x30], 0
lea rcx, [r12 + 0x38]
call sym.unk_4163
lea rcx, [r12 + 0x68]
call sym.unk_4175
cmp eax, 1
je 0x412324
mov qword [r12 + 0x68], 0xffffffffffffffff
jmp 0x412167
mov rcx, r13
call sym.unk_4163
mov rcx, r14
call sym.unk_4175
cmp eax, 1
jne 0x41235d
jmp 0x412324

Function at 0x412e10
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x00501168], eax
cmp eax, 0xffffffff
je sym.unk_4207
add rsp, 0x28
ret
Function at 0x413410
Capabilities:
Hijack thread execution

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x4f8
mov rbx, rcx
test rcx, rcx
je 0x4134c2
lea rcx, [0x00501158]
call sym.unk_4158
mov rax, qword [0x005363e8]
test rax, rax
je 0x41345e
mov r9, qword [0x005363f0]
lea r8, [rax - 1]
xor edx, edx
cmp rax, 1
jne 0x41348e
cmp rbx, qword [r9 + 8]
je 0x413600
lea rcx, [0x00501158]
call sym.unk_4160
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
cmp rax, rdx
je 0x41345e
lea r8, [rax - 1]
cmp r8, rdx
jb 0x41345e
lea rax, [rdx + r8]
shr rax, 1
mov rcx, rax
shl rcx, 4
add rcx, r9
cmp rbx, qword [rcx + 8]
je 0x4134d8
jb 0x413480
lea rdx, [rax + 1]
jmp 0x413489
test dl, 0xc
jne 0x4135e0
and edx, 0xf
je 0x413610
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
mov rsi, qword [rcx]
lea rcx, [0x00501158]
call sym.unk_4160
test rsi, rsi
je 0x4134c2
mov rcx, qword [rsi + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x4134c2
lea r12, [rsp + 0x20]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x4134c2
lea r13, [rsi + 0x38]
mov rcx, r13
call sym.unk_4158
call sym.unk_4186
movzx edx, byte [rsi + 0x40]
test rax, rax
je 0x41352f
cmp rbx, qword [rax + 0x1d8]
je 0x413588
mov eax, dword [rsi + 0x44]
and eax, 3
cmp eax, 3
je 0x4134b0
and edx, 3
jne 0x4135e0
movzx eax, byte [rsi + 0x40]
and eax, 0xfffffffc
or eax, 1
mov byte [rsi + 0x40], al
lock inc dword [0x00536418]
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x41356a
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r13
call sym.unk_4160
xor eax, eax
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
test dl, 3
jne 0x4135e0
and edx, 0xfffffffc
or edx, 1
mov byte [rsi + 0x40], dl
lock inc dword [0x00536418]
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x4135ac
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rsi + 0x44]
mov edx, eax
and edx, 3
cmp edx, 3
jne 0x41356a
and eax, 0xfffffffe
mov rcx, r13
mov dword [rsi + 0x44], eax
movzx eax, byte [rsi + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rsi + 0x40], al
call sym.unk_4160
call sym.unk_4218
nop dword [rax]
mov rcx, r13
call sym.unk_4160
test byte [rsi + 0x40], 0xc
jne 0x4134c2
xor eax, eax
jmp 0x413574
mov rsi, qword [r9]
jmp 0x4134db
mov rcx, qword [rsi + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41356a
mov rcx, qword [rsi + 0x28]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [sym.unk_4218]
mov rcx, qword [rsi + 0x28]
mov rdx, r12
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rsi + 0x40]
and dword [rsi + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rsi + 0x40], al
lock inc dword [0x00536418]
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x413689
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r13
call sym.unk_4160
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x41356a
Function at 0x4136a0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, [0x00501158]
mov ebx, edx
call sym.unk_4158
mov rax, qword [0x005363e8]
test rax, rax
je 0x413710
mov r9, qword [0x005363f0]
lea r8, [rax - 1]
xor edx, edx
cmp rax, 1
jne 0x4136ee
jmp 0x413790
cmp rax, rdx
je 0x413710
lea r8, [rax - 1]
cmp r8, rdx
jb 0x413710
lea rax, [rdx + r8]
shr rax, 1
mov rcx, rax
shl rcx, 4
add rcx, r9
cmp r12, qword [rcx + 8]
je 0x413730
jb 0x4136e0
lea rdx, [rax + 1]
cmp r8, rdx
jae 0x4136ee
lea rcx, [0x00501158]
call sym.unk_4160
mov eax, 3
add rsp, 0x28
pop rbx
pop r12
ret
mov rax, qword [rcx]
test rax, rax
je 0x413710
cmp qword [rax + 0x1d8], r12
jne 0x413710
test byte [rax + 0x40], 0xc
jne 0x413710
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x413710
mov rax, qword [rax + 0x28]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x413710
lea rcx, [0x00501158]
call sym.unk_4160
test ebx, ebx
je 0x413788
sub ebx, 2
cmp ebx, 0x15
ja 0x4137a0
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
jmp sym.unk_4223
xor eax, eax
jmp 0x413721
cmp r12, qword [r9 + 8]
jne 0x413710
mov rax, qword [r9]
jmp 0x413733
mov eax, 0x16
jmp 0x413721
Function at 0x413a20
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call sym.unk_4185
mov r12, rax
test rax, rax
je 0x413cc0
test rdi, rdi
je 0x413a5a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x413ad0
test ebx, ebx
je 0x413bd8
mov ecx, 0x14
call r14
cmp ebx, 4
je 0x413ad0
inc ebx
jmp 0x413a95
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call sym.unk_4175
cmp eax, 1
je 0x413cd4
cmp qword [r12 + 0x30], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x413c72
xor edx, edx
test rsi, rsi
je 0x413b48
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x413ca0
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [sym.unk_4189]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x413c38
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x413c08
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x413be8
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ecx, ecx
inc ebx
call r13
jmp 0x413a95
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x413bb8
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x413b8e
mov edx, 0xf
cmp eax, 0xe
jg 0x413b8e
cmp eax, 2
mov edx, 2
cmovle edx, eax
jmp 0x413b8e
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x413c48
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call sym.unk_4163
mov rcx, r14
call sym.unk_4175
cmp eax, 1
je 0x413cd4
mov qword [r12 + 0x68], 0xffffffffffffffff
pxor xmm0, xmm0
movups xmmword [r12 + 0x28], xmm0
test rdi, rdi
je 0x413c7e
mov qword [rdi], 0
mov rcx, r12
call sym.unk_4180
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call sym.unk_4186
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x413b48
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call sym.unk_4181
nop
nop word [rax + rax]
Function at 0x417a20
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x417a4c
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x496870
Capabilities:
Create directory

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x68
mov rbx, rcx
mov dword [rsp + 0x30], 0
call sym.unk_2897
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rax
call qword [sym.imp.msvcrt.dll__wmkdir]
mov r8d, eax
mov eax, 1
test r8d, r8d
jne 0x4968b0
add rsp, 0x68
pop rbx
pop rsi
pop r12
pop r13
ret
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
cmp esi, 0x11
je 0x4968e0
call sym.unk_2898
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x38], rax
test esi, esi
jne 0x4968f7
xor eax, eax
add rsp, 0x68
pop rbx
pop rsi
pop r12
pop r13
ret
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sym.unk_3477
cmp al, 2
jne 0x4968bd
mov esi, dword [rsp + 0x30]
jmp 0x4968cb
mov ecx, 0x30
lea r12, [rsp + 0x40]
call sym.__cxa_allocate_exception
lea rdx, str.cannot_create_directory
mov rcx, r12
mov r13, rax
call sym.unk_3441
movdqa xmm0, xmmword [rsp + 0x30]
mov r8, rbx
mov rdx, r12
mov rcx, r13
lea r9, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.unk_3583
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x49694a
call sym.operator_delete_void_
lea r8, [sym.unk_3523]
lea rdx, [0x005095a0]
mov rcx, r13
call sym.__cxa_throw
mov rbx, rax
mov rcx, r13
call sym.__cxa_free_exception
mov rcx, rbx
call dbg._Unwind_Resume
mov rcx, qword [rsp + 0x40]
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x496963
call sym.operator_delete_void_
jmp 0x496963

Function at 0x496990
Capabilities:
Create directory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
mov rbx, rdx
mov rcx, qword [rcx]
call qword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x4969d0
call sym.unk_2897
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
cmp esi, 0x11
je 0x4969f8
call sym.unk_2898
mov dword [rbx], esi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
mov rdx, rbx
mov rcx, r12
call sym.unk_3477
cmp al, 2
jne 0x4969dd
xor eax, eax
jmp 0x4969bf
Function at 0x496a10
Capabilities:
Create directory

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbx, rdx
mov rsi, rcx
lea r12, [rsp + 0x40]
mov dword [rsp + 0x30], 0
call sym.unk_2897
mov rcx, qword [rbx]
mov rdx, r12
mov qword [rsp + 0x38], rax
call dbg._wstat64i32
test eax, eax
jne 0x496aa0
mov rcx, qword [rsi]
call qword [sym.imp.msvcrt.dll__wmkdir]
mov r8d, eax
mov eax, 1
test r8d, r8d
jne 0x496a70
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ebx, dword [rax]
cmp ebx, 0x11
je 0x496ac0
call sym.unk_2898
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x496ad7
xor eax, eax
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call sym.unk_2898
mov rdi, rax
call qword [sym.imp.msvcrt.dll__errno]
mov ebx, dword [rax]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], ebx
jmp 0x496a8b
lea rdx, [rsp + 0x30]
mov rcx, rsi
call sym.unk_3477
cmp al, 2
jne 0x496a7d
mov ebx, dword [rsp + 0x30]
jmp 0x496a8b
mov ecx, 0x30
call sym.__cxa_allocate_exception
lea rdx, str.cannot_create_directory
mov rcx, r12
mov r13, rax
call sym.unk_3441
movdqa xmm0, xmmword [rsp + 0x30]
mov r8, rsi
mov rdx, r12
mov rcx, r13
lea r9, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.unk_3583
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x496b25
call sym.operator_delete_void_
lea r8, [sym.unk_3523]
lea rdx, [0x005095a0]
mov rcx, r13
call sym.__cxa_throw
mov r12, rax
mov rcx, r13
call sym.__cxa_free_exception
mov rcx, r12
call dbg._Unwind_Resume
mov rcx, qword [rsp + 0x40]
mov r12, rax
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x496b3e
call sym.operator_delete_void_
jmp 0x496b3e

Function at 0x496b70
Capabilities:
Create directory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
mov r9, rdx
mov r12, rcx
lea rdx, [rsp + 0x20]
mov rbx, r8
mov rcx, qword [r9]
call dbg._wstat64i32
test eax, eax
jne 0x496be8
mov rcx, qword [r12]
call qword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x496bc0
call sym.unk_2897
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
cmp esi, 0x11
je 0x496c10
call sym.unk_2898
mov dword [rbx], esi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
call sym.unk_2898
mov r12, rax
call qword [sym.imp.msvcrt.dll__errno]
mov eax, dword [rax]
mov qword [rbx + 8], r12
mov dword [rbx], eax
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
mov rdx, rbx
mov rcx, r12
call sym.unk_3477
cmp al, 2
jne 0x496bcd
xor eax, eax
jmp 0x496bb4
Function at 0x49a840
Capabilities:
Get disk size

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov r12, rcx
mov rbx, rdx
lea r13, [rsp + 0x50]
call sym.unk_2897
pcmpeqd xmm0, xmm0
mov rdx, rbx
mov rcx, r13
movups xmmword [r12], xmm0
mov rsi, rax
mov qword [r12 + 0x10], 0xffffffffffffffff
call sym.unk_3444
mov rcx, r13
call sym.unk_3552
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x49a940
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x49a8d1
mov qword [r12], rax
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x49a8e0
mov qword [r12 + 8], rax
mov rax, qword [rsp + 0x38]
xor edi, edi
test rax, rax
jne 0x49a930
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x49a900
lea rcx, [rsp + 0x70]
call sym.unk_3525
mov rcx, qword [rsp + 0x50]
lea rbp, [rsp + 0x60]
cmp rcx, rbp
je 0x49a914
call sym.operator_delete_void_
test edi, edi
jne 0x49a94a
mov rax, r12
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [r12 + 0x10], rax
jmp 0x49a8ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x49a8ec
mov ecx, 0x30
call sym.__cxa_allocate_exception
lea rdx, str.cannot_get_free_space
mov rcx, r13
mov r14, rax
call sym.unk_3441
mov eax, edi
lea r9, [rsp + 0x20]
mov r8, rbx
mov rdx, r13
mov rcx, r14
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
call sym.unk_3583
mov rcx, qword [rsp + 0x50]
cmp rcx, rbp
je 0x49a994
call sym.operator_delete_void_
lea r8, [sym.unk_3523]
lea rdx, [0x005095a0]
mov rcx, r14
call sym.__cxa_throw
mov r12, rax
mov rcx, r14
call sym.__cxa_free_exception
mov rcx, r12
call dbg._Unwind_Resume
mov rcx, qword [rsp + 0x50]
mov r12, rax
cmp rcx, rbp
je 0x49a9ad
call sym.operator_delete_void_
jmp 0x49a9ad