joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14020264c
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.140014500
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400145c0
add rsp, 0x10
mov rcx, qword [rsp + 0x28]
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140014550
add rsp, 0x28
lea rcx, [rsp + 0x38]
pop rdx
call fcn.140014430
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x14018c09e
sub rsp, 0x28
call fcn.140014550
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.1400147a0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.1400147a0
add rsp, 0x28
pop rcx
mov rcx, rax
sub rsp, 0x20
call fcn.140004144
add rsp, 0x20
pop rax
movabs rcx, 0x14018c09e
sub rsp, 0x28
call fcn.140014550
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.140014430
cmp byte [rsp + 0x50], 0
je 0x1402027c0
sub rsp, 8
push 0
push 0
mov rax, 7
push rax
push qword [rsp + 0x58]
push qword [rsp + 0x50]
movabs rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
push rax
movabs rax, 0x80000002
mov rcx, rax
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1401e83df
add rsp, 0x40
sub rsp, 8
push 0
push 0
mov rax, 7
push rax
push qword [rsp + 0x58]
push qword [rsp + 0x50]
movabs rax, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
push rax
movabs rax, 0x80000002
mov rcx, rax
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1401e83df
add rsp, 0x40
jmp 0x140202838
sub rsp, 8
push 0
push 0
push qword [rsp + 0x40]
movabs rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
push rax
movabs rax, 0x80000002
mov rcx, rax
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1401e800e
add rsp, 0x30
sub rsp, 8
push 0
push 0
push qword [rsp + 0x40]
movabs rax, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
push rax
movabs rax, 0x80000002
mov rcx, rax
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1401e800e
add rsp, 0x30
xor rax, rax
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400146e0
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.1400146e0
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400146e0
add rsp, 0x28
pop rax
add rsp, 0x48
ret

Function at 0x140203b14
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x1401d1238]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x140001000
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x5c], 0
mov rbx, rcx
jne 0x14000105a
cmp dword [rcx + 8], 0
jne 0x14000106a
call fcn.14004e780
mov edx, 1
mov r8d, 0x4000
mov dword [rax], 0
mov r9, qword [rbx + 0x60]
mov rcx, qword [rbx + 0x68]
call fcn.14004dab0
test eax, eax
mov dword [rbx + 8], eax
jne 0x140001063
mov rcx, qword [rbx + 0x60]
mov dword [rbx + 0x5c], 1
call fcn.140054400
test eax, eax
je 0x14000105a
mov dword [rbx + 0x58], 0xffffffff
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov rax, qword [rbx + 0x68]
mov qword [rbx], rax
mov rax, qword [rbx]
add dword [rbx + 8], 0xffffffff
movzx ecx, byte [rax]
add rax, 1
mov qword [rbx], rax
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x140001090
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 8]
mov rdi, rcx
cmp ebx, 2
jae 0x14000111f
test ebx, ebx
je 0x1400010b5
mov rax, qword [rcx]
mov rdx, qword [rcx + 0x68]
movzx eax, byte [rax]
mov byte [rdx], al
call fcn.14004e780
mov ecx, ebx
mov edx, 1
mov dword [rax], 0
mov r9, qword [rdi + 0x60]
mov eax, 0x4000
sar eax, cl
mov rcx, rbx
add rcx, qword [rdi + 0x68]
movsxd r8, eax
call fcn.14004dab0
test eax, eax
mov rbx, rax
jne 0x1400010fc
mov rcx, qword [rdi + 0x60]
call fcn.140054400
test eax, eax
je 0x1400010fc
mov dword [rdi + 0x58], 0xffffffff
add dword [rdi + 8], ebx
mov ecx, dword [rdi + 8]
mov rax, qword [rdi + 0x68]
cmp ecx, 2
mov qword [rdi], rax
jae 0x14000111f
mov dword [rdi + 0x90], ecx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rdi]
cmp byte [rax], 0x1f
jne 0x140001235
cmp byte [rax + 1], 0x8b
jne 0x140001235
add dword [rdi + 8], 0xfffffffe
add rax, 2
mov rcx, rdi
mov qword [rdi], rax
mov qword [rsp + 0x30], rsi
call fcn.140001000
mov rcx, rdi
mov ebx, eax
call fcn.140001000
cmp ebx, 8
mov esi, eax
jne 0x14000121e
test al, 0xe0
jne 0x14000121e
mov ebx, 6
nop
mov rcx, rdi
call fcn.140001000
sub rbx, 1
jne 0x140001170
test sil, 4
je 0x1400011b6
mov rcx, rdi
call fcn.140001000
mov rcx, rdi
mov ebx, eax
call fcn.140001000
shl eax, 8
add ebx, eax
nop
nop
mov ecx, ebx
add ebx, 0xffffffff
test ecx, ecx
je 0x1400011b6
mov rcx, rdi
call fcn.140001000
cmp eax, 0xffffffff
jne 0x1400011a0
test sil, 8
je 0x1400011d1
nop
mov rcx, rdi
call fcn.140001000
test eax, eax
je 0x1400011d1
cmp eax, 0xffffffff
jne 0x1400011c0
test sil, 0x10
je 0x1400011e8
mov rcx, rdi
call fcn.140001000
test eax, eax
je 0x1400011e8
cmp eax, 0xffffffff
jne 0x1400011d7
test sil, 2
je 0x140001201
mov ebx, 2
mov rcx, rdi
call fcn.140001000
sub rbx, 1
jne 0x1400011f3
mov eax, dword [rdi + 0x5c]
mov rsi, qword [rsp + 0x30]
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
mov dword [rdi + 0x58], ecx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rdi + 0x58], 0xfffffffd
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rdi + 0x90], 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001320
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
test rcx, rcx
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
je 0x1400013f6
cmp byte [rcx + 0x94], 0x77
jne 0x1400013f6
test r8d, r8d
mov qword [rcx], rdx
mov dword [rcx + 8], r8d
je 0x1400013d0
nop
nop
cmp dword [rbx + 0x18], 0
jne 0x14000138d
mov rcx, qword [rbx + 0x70]
mov r9, qword [rbx + 0x60]
mov edx, 1
mov r8d, 0x4000
mov qword [rbx + 0x10], rcx
call fcn.14004d300
cmp rax, 0x4000
jne 0x1400013c9
mov dword [rbx + 0x18], eax
mov eax, dword [rbx + 8]
xor edx, edx
mov rcx, rbx
add dword [rbx + 0x9c], eax
mov eax, dword [rbx + 0x18]
add dword [rbx + 0xa0], eax
call fcn.1400019e0
mov ecx, dword [rbx + 8]
sub dword [rbx + 0x9c], ecx
mov ecx, dword [rbx + 0x18]
mov dword [rbx + 0x58], eax
sub dword [rbx + 0xa0], ecx
test eax, eax
jne 0x1400013d0
cmp dword [rbx + 8], eax
jne 0x140001360
jmp 0x1400013d0
mov dword [rbx + 0x58], 0xffffffff
mov ecx, dword [rbx + 0x78]
mov r8d, edi
mov rdx, rsi
call fcn.140003a50
sub edi, dword [rbx + 8]
mov dword [rbx + 0x78], eax
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 0xfffffffe
add rsp, 0x20
pop rdi
ret

Function at 0x140001410
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x20
xor r12d, r12d
test rcx, rcx
mov ebp, edx
mov esi, r12d
mov rbx, rcx
je 0x14000150f
cmp byte [rcx + 0x94], 0x77
jne 0x14000150f
mov qword [rsp + 0x30], rdi
mov dword [rcx + 8], r12d
nop
mov edi, 0x4000
sub edi, dword [rbx + 0x18]
je 0x140001486
mov r9, qword [rbx + 0x60]
mov rcx, qword [rbx + 0x70]
mov r8d, edi
mov edx, 1
call fcn.14004d300
cmp eax, edi
jne 0x140001503
mov rax, qword [rbx + 0x70]
mov dword [rbx + 0x18], 0x4000
mov qword [rbx + 0x10], rax
test esi, esi
jne 0x1400014de
mov eax, dword [rbx + 0x18]
mov edx, ebp
mov rcx, rbx
add dword [rbx + 0xa0], eax
call fcn.1400019e0
mov ecx, dword [rbx + 0x18]
sub dword [rbx + 0xa0], ecx
test edi, edi
mov dword [rbx + 0x58], eax
jne 0x1400014b6
cmp eax, 0xfffffffb
jne 0x1400014b6
mov dword [rbx + 0x58], r12d
test ecx, ecx
jne 0x1400014c5
cmp dword [rbx + 0x58], 1
je 0x1400014c5
mov esi, r12d
jmp 0x1400014ca
mov esi, 1
mov eax, dword [rbx + 0x58]
test eax, eax
je 0x140001450
cmp eax, 1
je 0x140001450
mov eax, dword [rbx + 0x58]
cmp eax, 1
cmove eax, r12d
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov dword [rbx + 0x58], 0xffffffff
or eax, 0xffffffff
jmp 0x1400014e8
mov eax, 0xfffffffe
jmp 0x1400014ed
Function at 0x1400025c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop
nop
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
mov eax, dword [rdi + 0x44]
sub esi, dword [rdi + 0x9c]
lea ecx, [rbx + rax - 0x106]
sub esi, edx
cmp edx, ecx
jb 0x14000267c
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.140049c80
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, ebx
jb 0x140002640
sub eax, ebx
jmp 0x140002642
xor eax, eax
add r8d, 0xffffffff
mov word [rdx], ax
jne 0x140002630
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
nop
nop
nop
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, ebx
jb 0x140002670
sub eax, ebx
jmp 0x140002672
xor eax, eax
add edx, 0xffffffff
mov word [rcx], ax
jne 0x140002660
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x1400026f7
mov edx, dword [rdi + 0x9c]
mov eax, dword [rdi + 0x94]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.140002370
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x1400026e1
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
add eax, 1
mov dword [rdi + 0x70], r8d
movzx eax, byte [rax + rdx]
shl r8d, cl
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x1400026f7
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x1400025e0
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140009690
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor eax, eax
cmp eax, 1
je 0x1400097c1
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x1400096d3
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14000a380
jmp 0x1400097d5
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call fcn.14000c5b0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x140009766
cmp qword [rsp + 0x20], 0
jle 0x140009766
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140009712
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call fcn.14000c7f8
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.1400066bc
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call fcn.14000c640
cmp qword [rsp + 0x50], 0
jle 0x1400097ad
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x1400097ad
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call fcn.14004d300
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
jmp 0x1400097d5
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14000a380
add rsp, 0x38
ret
Function at 0x1400097e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor eax, eax
cmp eax, 1
je 0x14000991b
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140009823
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14000a4c0
jmp 0x14000992f
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call fcn.14000c688
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x1400098b6
cmp qword [rsp + 0x20], 0
jle 0x1400098b6
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140009862
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call fcn.14000c80c
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.1400066bc
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call fcn.14000c78c
cmp qword [rsp + 0x50], 0
jle 0x140009907
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140009907
mov rcx, qword [rsp + 0x40]
call fcn.14000beb8
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call fcn.14004dab0
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
jmp 0x14000992f
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14000a4c0
add rsp, 0x38
ret
Function at 0x140009f00
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [0x1400b00e8]
xor rax, rsp
mov qword [rsp + 0xa8], rax
call fcn.1400067e0
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x50]
call fcn.140006758
movzx eax, al
test eax, eax
je 0x140009f56
lea rcx, [rsp + 0xc8]
call fcn.140006790
jmp 0x14000a196
mov rcx, qword [rsp + 0xc0]
call fcn.14000c7f8
test rax, rax
je 0x140009fc1
mov rcx, qword [rsp + 0xc0]
call fcn.14000c7f8
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0xc0]
call fcn.14000c768
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
jae 0x140009fc1
lea rcx, [rsp + 0xc8]
call fcn.140006738
mov byte [rsp + 0x42], al
mov rcx, qword [rsp + 0xc0]
call fcn.14000c5e8
mov cl, byte [rsp + 0x42]
mov byte [rax], cl
mov eax, dword [rsp + 0xc8]
jmp 0x14000a196
mov rax, qword [rsp + 0xc0]
cmp qword [rax + 0x80], 0
jne 0x140009fdd
call fcn.1400067e0
jmp 0x14000a196
mov rcx, qword [rsp + 0xc0]
call fcn.14000beb8
mov rax, qword [rsp + 0xc0]
cmp qword [rax + 0x68], 0
jne 0x14000a042
lea rcx, [rsp + 0xc8]
call fcn.140006738
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rcx + 0x80]
mov cl, al
call fcn.140008418
movzx eax, al
test eax, eax
je 0x14000a030
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x48], eax
jmp 0x14000a039
call fcn.1400067e0
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
jmp 0x14000a196
mov qword [rsp + 0x78], 0x20
lea rcx, [rsp + 0xc8]
call fcn.140006738
mov byte [rsp + 0x40], al
lea rax, [rsp + 0xa0]
lea rcx, [rsp + 0x41]
mov rdx, qword [rsp + 0xc0]
add rdx, 0x74
lea r8, [rsp + 0x68]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rcx
lea r8, [rsp + 0x40]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x68]
call fcn.14000ac00
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x14000a191
cmp dword [rsp + 0x44], 1
jle 0x14000a0da
cmp dword [rsp + 0x44], 3
je 0x14000a156
jmp 0x14000a191
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x14000a12e
mov rax, qword [rsp + 0xc0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x58]
mov edx, 1
lea rcx, [rsp + 0x80]
call fcn.14004d300
cmp qword [rsp + 0x58], rax
je 0x14000a12e
call fcn.1400067e0
jmp 0x14000a196
mov rax, qword [rsp + 0xc0]
mov byte [rax + 0x71], 1
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x70], rax
je 0x14000a14f
mov eax, dword [rsp + 0xc8]
jmp 0x14000a196
call fcn.1400067e0
jmp 0x14000a196
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rax + 0x80]
mov cl, byte [rsp + 0x40]
call fcn.140008418
movzx eax, al
test eax, eax
je 0x14000a182
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x4c], eax
jmp 0x14000a18b
call fcn.1400067e0
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x4c]
jmp 0x14000a196
call fcn.1400067e0
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140045d50
add rsp, 0xb8
ret
Function at 0x14000bf5c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1400b00e8]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x68], 0
je 0x14000bf99
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000bfa0
mov al, 1
jmp 0x14000c0e2
call fcn.1400067e0
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x48], rcx
mov edx, eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x48]
call qword [case.0x1400463c6.0]
mov dword [rsp + 0x38], eax
call fcn.1400067e0
mov dword [rsp + 0x3c], eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x3c]
call fcn.140006758
movzx eax, al
test eax, eax
je 0x14000bff8
xor al, al
jmp 0x14000c0e2
mov qword [rsp + 0x58], 0x20
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
add rcx, 0x74
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x60]
mov rdx, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x68]
call fcn.14000c9b8
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000c05d
cmp dword [rsp + 0x30], 1
je 0x14000c069
cmp dword [rsp + 0x30], 3
je 0x14000c0dc
jmp 0x14000c0e0
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x14000c0b4
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.14004d300
cmp qword [rsp + 0x40], rax
je 0x14000c0b4
xor al, al
jmp 0x14000c0e2
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000c0ce
mov dword [rsp + 0x34], 1
jmp 0x14000c0d6
mov dword [rsp + 0x34], 0
mov al, byte [rsp + 0x34]
jmp 0x14000c0e2
mov al, 1
jmp 0x14000c0e2
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140045d50
add rsp, 0x98
ret
Function at 0x14001ab4c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x958
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov rax, qword [0x1400b00e8]
xor rax, rsp
mov qword [rsp + 0x940], rax
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x34], 0x401
cmp dword [rsp + 0x34], 0
jle 0x14001abcc
mov eax, dword [rsp + 0x34]
dec eax
mov dword [rsp + 0x34], eax
movsxd rax, dword [rsp + 0x34]
shl rax, 1
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0x802
jae 0x14001abb6
jmp 0x14001abbb
call fcn.140045f14
xor eax, eax
mov rcx, qword [rsp + 0x40]
mov word [rsp + rcx + 0x130], ax
jmp 0x14001ab8b
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14001ad4c
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x90]
call fcn.14001560c
nop
mov rdx, qword [rsp + 0x968]
lea rcx, [rsp + 0xf0]
call fcn.140071160
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov r8, qword [rsp + 0x50]
lea rdx, str.AdobeHeadlightsCCHLLog_
lea rcx, [rsp + 0xd0]
call fcn.14001c000
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea r8, str..txt
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0xb0]
call fcn.140013c28
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x90]
call fcn.1400142ec
nop
lea rcx, [rsp + 0xb0]
call fcn.140013680
nop
lea rcx, [rsp + 0xd0]
call fcn.140013680
nop
lea rcx, [rsp + 0xf0]
call fcn.140013680
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x110]
call fcn.140071550
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.140071c20
mov byte [rsp + 0x30], al
lea rcx, [rsp + 0x110]
call fcn.140013680
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x14001ad3f
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x960]
call fcn.140071360
mov eax, dword [rsp + 0x38]
or eax, 1
mov dword [rsp + 0x38], eax
lea rcx, [rsp + 0x90]
call fcn.140013680
mov rax, qword [rsp + 0x960]
jmp 0x14001ad73
lea rcx, [rsp + 0x90]
call fcn.140013680
lea rdx, [0x140099500]
mov rcx, qword [rsp + 0x960]
call fcn.140008fa0
mov eax, dword [rsp + 0x38]
or eax, 1
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x960]
mov rcx, qword [rsp + 0x940]
xor rcx, rsp
call fcn.140045d50
add rsp, 0x958
ret

Function at 0x1400479b0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
jb 0x1400479d2
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x1400479dc
mov rcx, qword [rcx]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400479f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400479f6
xor eax, eax
lea rcx, str.boost::filesystem::rename
mov r9, rsi
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov ecx, eax
mov rdx, rbx
call fcn.1400476c0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140071bc0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call fcn.140071ce0
movzx eax, al
test eax, eax
jne 0x140071bde
mov al, 1
jmp 0x140071c0b
mov rcx, qword [rsp + 0x40]
call fcn.140008950
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140071bff
mov dword [rsp + 0x20], 1
jmp 0x140071c07
mov dword [rsp + 0x20], 0
mov al, byte [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140071c20
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov byte [rsp + 0x20], 0
mov rcx, qword [rsp + 0x50]
call fcn.140008ad0
movzx eax, al
test eax, eax
je 0x140071c51
mov al, byte [rsp + 0x20]
jmp 0x140071cd3
mov rcx, qword [rsp + 0x50]
call fcn.140071ce0
movzx eax, al
test eax, eax
je 0x140071c8a
mov rcx, qword [rsp + 0x50]
call fcn.140071f30
movzx eax, al
test eax, eax
jne 0x140071c8a
mov rcx, qword [rsp + 0x50]
call fcn.140071bc0
movzx eax, al
test eax, eax
jne 0x140071c8a
mov al, byte [rsp + 0x20]
jmp 0x140071cd3
mov rcx, qword [rsp + 0x50]
call fcn.140008950
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x140071cc8
cmp dword [rsp + 0x24], 0x50
je 0x140071cc8
cmp dword [rsp + 0x24], 0xb7
je 0x140071cc8
jmp 0x140071ccd
mov byte [rsp + 0x20], 1
jmp 0x140071ccf
mov al, byte [rsp + 0x20]
add rsp, 0x48
ret

Function at 0x140071ce0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call fcn.140008950
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140071d0a
mov dword [rsp + 0x20], 1
jmp 0x140071d12
mov dword [rsp + 0x20], 0
mov al, byte [rsp + 0x20]
add rsp, 0x38
ret