joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4785bc
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x18], r8d
push rbp
lea rbp, [rax - 0x158]
sub rsp, 0x250
and dword [rbp + 0x170], 0
xor eax, eax
mov rsi, rdx
mov dword [rsp + 0x30], eax
xorps xmm0, xmm0
lea rdx, [rsp + 0x40]
mov rbx, rcx
lea r8d, [rax + 0x40]
movups xmmword [rsp + 0x20], xmm0
call fcn.00401684
cmp eax, 0x40
jne 0x4787bb
mov eax, 0x5a4d
cmp word [rsp + 0x40], ax
jne 0x4787bb
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
jne 0x47862c
or rcx, 0xffffffffffffffff
jmp 0x478666
movsxd rax, dword [rsp + 0x7c]
lea r8, [rbp + 0x17c]
mov edx, eax
mov qword [rbp + 0x178], rax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x178], eax
cmp eax, 0xffffffff
jne 0x47865f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x478626
mov rcx, qword [rbp + 0x178]
movsxd rax, dword [rsp + 0x7c]
cmp rcx, rax
jne 0x4787bb
mov r8d, 4
lea rdx, [rbp + 0x170]
mov rcx, rbx
call fcn.00401684
cmp eax, 4
jne 0x4787bb
cmp dword [rbp + 0x170], 0x4550
jne 0x4787bb
lea r8d, [rax + 0x10]
mov rcx, rbx
lea rdx, [rsp + 0x20]
call fcn.00401684
cmp eax, 0x14
jne 0x4787bb
mov eax, 0x14c
cmp word [rsp + 0x20], ax
je 0x4786d8
mov eax, 0x8664
cmp word [rsp + 0x20], ax
jne 0x4787bb
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0xe0
call fcn.00424830
xor edx, edx
lea rcx, [rbp + 0x60]
mov r8d, 0xf0
call fcn.00424830
mov rcx, qword [rbx + 8]
mov eax, 0x14c
cmp word [rsp + 0x20], ax
jne 0x478760
cmp rcx, 0xffffffffffffffff
je 0x47873e
and qword [rbp + 0x178], 0
lea r8, [rbp + 0x17c]
mov r9d, 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x178], eax
cmp eax, 0xffffffff
jne 0x47873e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0xe0
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.00401684
cmp eax, 0xe0
jne 0x4787bb
mov rax, qword [rbp]
mov qword [rsi], rax
jmp 0x4787b7
cmp rcx, 0xffffffffffffffff
je 0x478794
and qword [rbp + 0x178], 0
lea r8, [rbp + 0x17c]
mov r9d, 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x178], eax
cmp eax, 0xffffffff
jne 0x478794
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0xf0
lea rdx, [rbp + 0x60]
mov rcx, rbx
call fcn.00401684
cmp eax, 0xf0
jne 0x4787bb
mov rcx, qword [rbp + 0xf0]
mov qword [rsi], rcx
mov al, 1
jmp 0x4787bd
xor al, al
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x478cfc
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, rdx
test rdx, rdx
je 0x478d55
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x478d55
mov r8d, 0xf01ff
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
jne 0x478d6c
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov edi, ebx
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x478deb
mov eax, dword [rsp + 0x24]
cmp eax, 1
je 0x478de9
cmp eax, 4
je 0x478da7
cmp eax, 7
je 0x478da7
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3c
jb 0x478d6e
jmp 0x478deb
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x478de2
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x478deb
cmp dword [rsp + 0x24], 1
je 0x478de9
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3c
jb 0x478dbc
jmp 0x478deb
mov bl, 1
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bl
jmp 0x478d57
Function at 0x478e0c
Capabilities:
Enumerate services

Disassembly:
test rdx, rdx
je 0x479051
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
xor r12d, r12d
mov r15, rdx
xor edx, edx
mov dword [rbp + 0x1a0], r12d
xor ecx, ecx
mov dword [rbp + 0x1a8], r12d
mov dword [rbp + 0x1b0], r12d
lea r8d, [r12 + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
je 0x479037
lea rax, [rbp + 0x1b0]
xor r9d, r9d
mov qword [rsp + 0x38], rax
lea esi, [r12 + 3]
lea rax, [rbp + 0x1a8]
mov r8d, esi
mov qword [rsp + 0x30], rax
lea edi, [rsi + 0x2d]
lea rax, [rbp + 0x1a0]
mov edx, edi
mov qword [rsp + 0x28], rax
mov rcx, r14
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
jne 0x478ec6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x47902e
mov ecx, dword [rbp + 0x1a0]
movabs r13, 0xaaaaaaaaaaaaaaab
mov rax, r13
mul rcx
mov rcx, 0xffffffffffffffff
mov rax, rdi
shr rdx, 5
inc rdx
mul rdx
lea rdx, [0x0047b0a0]
cmovo rax, rcx
mov rcx, rax
call fcn.0042267c
mov rbx, rax
test rax, rax
je 0x47902e
mov ecx, dword [rbp + 0x1a0]
mov rax, r13
mul rcx
mov rcx, rbx
shr rdx, 5
inc rdx
lea r8, [rdx + rdx*2]
xor edx, edx
shl r8, 4
call fcn.00424830
lea rax, [rbp + 0x1b0]
mov r9, rbx
mov qword [rsp + 0x38], rax
mov r8d, esi
lea rax, [rbp + 0x1a8]
mov edx, edi
mov qword [rsp + 0x30], rax
mov rcx, r14
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x1a0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x479026
mov esi, r12d
cmp dword [rbp + 0x1a8], r12d
jbe 0x479026
lea rax, [rsp + 0x58]
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], rax
lea rax, [0x0048d7e0]
mov qword [rsp + 0x40], rax
mov eax, esi
mov dword [rsp + 0x54], 0x104
mov word [rsp + 0x58], r12w
lea rdi, [rax + rax*2]
add rdi, rdi
mov rdx, qword [rbx + rdi*8]
test rdx, rdx
je 0x479018
lea r8, [rsp + 0x40]
call fcn.00478b00
test al, al
je 0x479018
or rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], r12w
jne 0x478fd8
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x478ff9
mov r8d, eax
mov rdx, r15
call fcn.00438e94
jmp 0x479004
cmp dword [rsp + 0x50], 1
mov eax, r12d
setae al
test eax, eax
jne 0x479018
cmp dword [rbx + rdi*8 + 0x14], 1
je 0x479018
mov rdx, qword [rbx + rdi*8]
call fcn.00478cfc
inc esi
cmp esi, dword [rbp + 0x1a8]
jb 0x478f8b
mov rcx, rbx
call fcn.00422660
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x479058
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rax - 0x388]
sub rsp, 0x470
mov r14, rdx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x234
call fcn.00424830
test r14, r14
je 0x4791a0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x4791a0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x47918f
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x479181
mov r8d, 0x104
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x479178
lea rcx, [rbp + 0x160]
call qword [sym.imp.USER32.dll_CharLowerW]
mov rdx, r14
lea rcx, [rbp + 0x160]
call fcn.00423b70
test rax, rax
je 0x479178
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetTopWindow]
jmp 0x47915e
and dword [rbp + 0x390], 0
lea rdx, [rbp + 0x390]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rsp + 0x28]
cmp dword [rbp + 0x390], ecx
mov rcx, rbx
je 0x479168
mov edx, 2
call qword [sym.imp.USER32.dll_GetWindow]
mov rbx, rax
test rax, rax
jne 0x47912d
jmp 0x479178
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4790ca
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x4791d8
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x7c8]
sub rsp, 0x8c0
xor esi, esi
lea rcx, [0x0048d7e0]
mov rbx, rdx
mov qword [rsp + 0x20], rcx
mov edx, 0x104
mov qword [rbp + 0x140], rcx
lea rax, [rsp + 0x38]
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x360]
lea rax, [rbp + 0x158]
mov dword [rbp + 0x154], edx
xor edx, edx
mov qword [rbp + 0x148], rax
mov r8d, 0x208
mov dword [rsp + 0x30], esi
mov word [rsp + 0x38], si
mov dword [rbp + 0x150], esi
mov word [rbp + 0x158], si
call fcn.00424830
mov r8d, 0x103
lea rdx, [rbp + 0x360]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x360]
call qword [sym.imp.USER32.dll_CharLowerW]
test rbx, rbx
je 0x479387
cmp word [rbx], si
je 0x479387
mov r8, rbx
lea rdx, str._s.exe
lea rcx, [rbp + 0x140]
call fcn.004012e8
mov rcx, qword [rbp + 0x148]
lea rdx, [rbp + 0x570]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x479387
test byte [rbp + 0x570], 0x10
jne 0x479366
lea r9, [rbp + 0x59c]
mov r8, rbx
lea rdx, [0x00491de8]
lea rcx, [rsp + 0x20]
call fcn.004012e8
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x47933c
mov edx, dword [rsp + 0x30]
inc edx
call fcn.0043771c
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x47933c
lea r8, [rbp + 0x360]
mov rax, rcx
sub r8, rcx
movzx edx, word [rax]
cmp dx, word [rax + r8]
jne 0x479335
add rax, 2
test dx, dx
jne 0x47931e
mov eax, esi
jmp 0x479346
sbb eax, eax
or eax, 1
jmp 0x479346
cmp dword [rsp + 0x30], 1
mov eax, esi
setae al
test eax, eax
je 0x479366
lea rdx, [0x0048d7c4]
call fcn.00423b70
mov rdx, rax
call fcn.00479058
mov rdx, rbx
call fcn.00478e0c
lea rdx, [rbp + 0x570]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4792ca
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140002f25
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
push rbp
push r15
mov rax, 0x14
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140002f3e
sub rsp, 0x28
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140014020
add rsp, 0x10
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.140014020
add rsp, 0x10
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x38]
sub rsp, 0x10
call fcn.140014020
add rsp, 0x10
lea rax, [rsp + 0x40]
lea rbp, [rsp + 0x40]
mov dword [rbp], 0x70
mov dword [rbp + 4], 0x140
mov dword [rbp + 0x30], 0
movabs rax, 0x14001b037
mov rax, rax
push rax
pop rax
mov qword [rbp + 0x10], rax
mov rax, qword [rsp + 0x28]
mov rax, rax
push rax
pop rax
mov qword [rbp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov rax, rax
push rax
pop rax
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x30]
mov rax, rax
push rax
pop rax
mov qword [rbp + 0x28], rax
lea rax, [rsp + 0x40]
mov rax, rax
push rax
pop rcx
call sub.SHELL32.DLL_ShellExecuteExA
mov qword [rsp + 0xb0], rax
push 0x19
pop rcx
call fcn.14000d038
lea rax, [rsp + 0xb8]
mov rax, rax
push rax
lea rbp, [rsp + 0x48]
push qword [rbp + 0x68]
pop rcx
pop rdx
call sub.KERNEL32.dll_GetExitCodeProcess
and rax, rax
je 0x140003052
mov r15, qword [rsp + 0xb8]
cmp r15, 0x103
je 0x140003052
jmp 0x140003054
jmp 0x140003014
mov rax, qword [rsp + 0xb8]
jmp 0x140003061
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400140f0
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400140f0
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.1400140f0
add rsp, 0x28
pop rax
add rsp, 0xc8
pop r15
pop rbp
ret
Function at 0x1400030a4
Capabilities:
Get common file path

Disassembly:
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
movabs rax, 0x14001b035
push rax
push qword [0x14001cb0c]
pop rcx
pop rdx
call fcn.140003d76
and rax, rax
je 0x14000326e
push 0x400
pop rcx
call fcn.14000ff00
mov qword [rsp + 0x28], rax
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
pop rcx
sub rsp, 0x20
call fcn.140010240
add rsp, 0x28
lea rcx, [rsp + 0x38]
pop rdx
call fcn.140013f60
push qword [rsp + 0x28]
push 0
movabs rax, 0x14001b01e
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
pop r9
call sub.KERNEL32.dll_GetTempFileNameA
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
push qword [rsp + 0x40]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000ffd0
add rsp, 0x28
lea rcx, [0x14001cbf4]
pop rdx
call fcn.140013f60
push qword [rsp + 0x28]
pop rcx
call fcn.140010050
push qword [0x14001cbf4]
pop rcx
call fcn.14001030c
push qword [0x14001cbf4]
pop rcx
call fcn.1400101c0
push qword [0x14001cbf4]
pop rcx
call sub.SHLWAPI.DLL_PathAddBackslashA
mov rcx, qword [0x14001cbf4]
push qword [0x14001d5d0]
sub rsp, 0x28
call fcn.140014120
add rsp, 0x28
mov rcx, qword [0x14001cb84]
sub rsp, 0x28
call fcn.140014120
add rsp, 0x28
mov rcx, qword [0x14001cb2c]
sub rsp, 0x28
call fcn.140014120
add rsp, 0x28
lea rcx, [0x14001cb14]
pop rdx
call fcn.140013f60
push qword [0x14001cb14]
push 0
pop rcx
pop rdx
call fcn.140010960
push qword [0x14001ca5c]
push qword [0x14001ca34]
push 0
pop rcx
pop rdx
pop r8
call fcn.140010c60
push 0
pop rcx
call fcn.140010560
mov rcx, qword [0x14001cb14]
push qword [0x14001d5d0]
sub rsp, 0x28
call fcn.140014120
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.140013f60
push qword [rsp + 0x38]
pop rcx
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push qword [rsp + 0x38]
push qword [0x14001cadc]
pop rcx
pop rdx
call fcn.14000a0b8
push qword [0x14001cacc]
push qword [0x14001cb84]
pop rcx
pop rdx
call fcn.14000a0b8
mov qword [0x14001ca54], 1
xor rax, rax
push rax
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400140f0
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.1400140f0
add rsp, 0x28
pop rax
add rsp, 0x48
ret
Function at 0x14000329c
Capabilities:
Delete directory

Disassembly:
xor rax, rax
push rax
push rax
sub rsp, 0x28
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
push qword [0x14001d5d0]
push qword [0x14001d5d0]
pop rcx
sub rsp, 0x20
call fcn.140010314
add rsp, 0x20
inc qword [0x14001d5d0]
push qword [0x14001cb9c]
mov rdx, qword [0x14001d5e0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400099d8
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.140013f60
mov rcx, qword [rsp + 0x28]
xor rdx, rdx
call fcn.140014090
or rax, rax
jne 0x14000339f
mov rcx, qword [rsp + 0x28]
push qword [0x14001d5d0]
sub rsp, 0x28
call fcn.140014120
add rsp, 0x28
lea rcx, [0x14001cb24]
pop rdx
call fcn.140013f60
push qword [0x14001cb24]
pop rcx
call fcn.140010374
mov rcx, qword [0x14001ca7c]
xor rdx, rdx
call fcn.140014090
or rax, rax
jne 0x14000336b
push qword [0x14001ca7c]
pop rcx
call fcn.140003793
push qword [0x14001cb3c]
push 1
pop rcx
pop rdx
call fcn.140010960
and rax, rax
je 0x14000339f
push qword [0x14001cb34]
push 1
pop rcx
pop rdx
call fcn.140010cf0
push 1
pop rcx
call fcn.140010560
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
push qword [0x14001d5d0]
push qword [0x14001d5d0]
pop rcx
sub rsp, 0x20
call fcn.140009e04
add rsp, 0x20
mov rdx, qword [0x14001d5e0]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140010390
add rsp, 0x28
mov rdx, qword [0x14001d5e0]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140010374
add rsp, 0x28
pop qword [0x14001d5d0]
push qword [0x14001cbfc]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryA
xor rax, rax
mov qword [0x14001ca24], rax
jmp 0x140001b86
Function at 0x140003443
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
push 0x400
pop rcx
call fcn.14000ff00
mov qword [rsp + 0x28], rax
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
pop rcx
sub rsp, 0x20
call fcn.140010240
add rsp, 0x28
lea rcx, [rsp + 0x38]
pop rdx
call fcn.140013f60
push qword [rsp + 0x28]
push 0
movabs rax, 0x14001b01e
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
pop r9
call sub.KERNEL32.dll_GetTempFileNameA
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
push qword [rsp + 0x40]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000ffd0
add rsp, 0x28
lea rcx, [0x14001cbfc]
pop rdx
call fcn.140013f60
push qword [rsp + 0x28]
pop rcx
call fcn.140010050
push qword [0x14001cbfc]
pop rcx
call fcn.14001030c
push qword [0x14001cbfc]
pop rcx
call fcn.1400101c0
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
pop rcx
sub rsp, 0x20
call fcn.140010314
add rsp, 0x28
lea rcx, [0x14001cb24]
pop rdx
call fcn.140013f60
push qword [rsp + 0x50]
pop rcx
call fcn.14000ff20
mov rax, rax
push rax
xor r15, r15
cmp r15, qword [rsp]
jne 0x14000357e
mov rcx, qword [0x14001cbfc]
push qword [0x14001d5d0]
sub rsp, 0x20
call fcn.140014120
add rsp, 0x20
lea rcx, [0x14001cb24]
pop rdx
sub rsp, 0x28
call fcn.140013f60
add rsp, 0x28
mov qword [rsp + 0x40], 2
jmp 0x140003594
mov r15, 1
cmp r15, qword [rsp]
jne 0x140003594
mov qword [rsp + 0x40], 1
pop rax
mov r15, qword [rsp + 0x50]
add r15, qword [rsp + 0x38]
mov rax, r15
push rax
pop rcx
call fcn.14000ff20
mov qword [0x14001cb8c], rax
mov r15, qword [rsp + 0x50]
add r15, qword [rsp + 0x38]
inc r15
mov rax, r15
push rax
pop rcx
call fcn.14000ff20
mov qword [0x14001ca2c], rax
mov rax, 1
jmp 0x1400035da
push rax
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400140f0
add rsp, 0x28
pop rax
add rsp, 0x40
pop r15
ret
Function at 0x1400035f5
Capabilities:
Accept command line arguments

Disassembly:
push r15
xor rax, rax
push rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
mov rax, qword [rsp + 0x80]
mov qword [0x14001d5d0], rax
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
sub rsp, 8
sub rsp, 0x20
call sub.KERNEL32.dll_GetCommandLineA
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000ffd0
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.140013f60
mov rcx, qword [rsp + 0x28]
push qword [0x14001d5d0]
sub rsp, 0x28
call fcn.140014120
add rsp, 0x28
lea rcx, [rsp + 0x38]
pop rdx
call fcn.140013f60
mov rax, qword [rsp + 0x30]
mov rax, rax
push rax
pop rcx
call sub.SHLWAPI.DLL_PathRemoveArgsA
mov qword [rsp + 0x38], rax
push qword [rsp + 0x30]
pop rcx
call fcn.1400062c0
mov qword [rsp + 0x40], rax
mov r15, qword [rsp + 0x40]
and r15, r15
jle 0x140003721
push qword [0x14001d5d0]
movabs rcx, str.__BFINOPSX
sub rsp, 0x28
call fcn.140014120
add rsp, 0x28
push qword [0x14001d5d0]
push qword [0x14001d5d0]
push qword [0x14001d5d0]
push qword [0x14001d5d0]
mov r15, qword [rsp + 0x68]
inc r15
mov rax, r15
push rax
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140006680
add rsp, 0x20
mov rdx, qword [0x14001d5e0]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140006150
add rsp, 0x20
pop rax
lea rcx, [rsp + 0x50]
pop rdx
call fcn.140013f60
mov rcx, qword [rsp + 0x48]
push qword [0x14001d5d0]
sub rsp, 0x28
call fcn.140014120
add rsp, 0x28
pop rax
add rax, qword [0x14001d5e0]
jmp 0x140003754
push rax
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400140f0
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400140f0
add rsp, 0x28
mov rcx, qword [rsp + 0x50]
sub rsp, 0x28
call fcn.1400140f0
add rsp, 0x28
pop rax
add rsp, 0x50
pop r15
ret
Function at 0x140004817
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
mov r15, qword [0x14001cb8c]
cmp r15, 1
jne 0x1400048fd
push qword [0x14001cc4c]
pop rcx
call fcn.14000bb30
mov r15, rax
and r15, r15
jle 0x140004893
mov rcx, qword [0x14001cc4c]
call fcn.14000bb38
mov rcx, qword [0x14001cc4c]
call fcn.14000bb4c
or rax, rax
je 0x140004893
mov rbp, qword [0x14001cc54]
push qword [rbp + 0x10]
pop rcx
call fcn.1400123e0
mov r15, rax
movsxd rax, dword [rbp + 0x18]
cmp r15, rax
jne 0x140004891
mov rbp, qword [0x14001cc54]
push qword [rbp + 0x10]
pop rcx
call fcn.14001030c
jmp 0x140004854
push qword [0x14001cc5c]
pop rcx
call fcn.14000bb30
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x1400048fd
push 5
push 0
push 1
push qword [0x14001cc5c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009280
mov rcx, qword [0x14001cc5c]
call fcn.14000bb38
mov rcx, qword [0x14001cc5c]
call fcn.14000bb4c
or rax, rax
je 0x1400048fd
mov rbp, qword [0x14001cc64]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryA
jmp 0x1400048da
mov rax, 1
jmp 0x140004909
add rsp, 0x38
pop r15
pop rbp
ret
Function at 0x140004911
Capabilities:
Accept command line arguments
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
push qword [0x14001cb3c]
push 1
pop rcx
pop rdx
call fcn.140010960
and rax, rax
je 0x140004b70
push qword [0x14001cb64]
push 1
pop rcx
pop rdx
call fcn.140010da0
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
push qword [0x14001d5d0]
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
sub rsp, 8
sub rsp, 0x20
call sub.KERNEL32.dll_GetCommandLineA
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000ffd0
add rsp, 0x28
mov rdx, qword [0x14001d5e0]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call sub.SHLWAPI.DLL_PathGetArgsA
add rsp, 0x20
pop qword [0x14001d5d0]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000ffd0
add rsp, 0x28
inc qword [0x14001d5d0]
push qword [0x14001cbc4]
mov rdx, qword [0x14001d5e0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000a0b8
add rsp, 0x28
pop qword [0x14001d5d0]
push qword [0x14001cb34]
push 1
pop rcx
pop rdx
call fcn.140010da0
mov r15, qword [0x14001ca54]
cmp r15, 1
jne 0x140004b63
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
movabs rbp, 0x14001b145
mov r15, rbp
movabs rbp, 0x14001b098
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x14001b098
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14000ff40
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.140013f60
push qword [rsp + 0x28]
pop rcx
call fcn.1400062c0
mov qword [rsp + 0x30], rax
push qword [rsp + 0x30]
pop rcx
call fcn.14000ff00
mov qword [rsp + 0x38], rax
push qword [rsp + 0x30]
pop rcx
call fcn.14000ff00
mov qword [rsp + 0x40], rax
push qword [rsp + 0x28]
push qword [rsp + 0x40]
pop rcx
pop rdx
call fcn.140010160
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x30]
cmp rax, qword [rsp + 0x48]
jl 0x140004b09
mov r15, qword [rsp + 0x38]
add r15, qword [rsp + 0x48]
mov rax, r15
push rax
pop rcx
call fcn.14000ff20
mov r15, rax
imul r15, r15, 0xffffffffffffffff
mov rax, r15
push rax
mov r15, qword [rsp + 0x48]
add r15, qword [rsp + 0x50]
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.14000ff30
inc qword [rsp + 0x48]
jno 0x140004ac2
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
sub rsp, 8
push qword [0x14001d5d0]
push qword [rsp + 0x68]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000ffd0
add rsp, 0x28
inc qword [0x14001d5d0]
push 1
mov rdx, qword [0x14001d5e0]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140010da0
add rsp, 0x28
pop qword [0x14001d5d0]
push 1
pop rcx
call fcn.140010560
jmp 0x140004bba
push qword [0x14001cb3c]
pop rcx
call fcn.14001030c
call fcn.140004817
push 0x10
push qword [0x14001cb4c]
push qword [0x14001cc04]
pop rcx
pop rdx
pop r8
call fcn.140009924
push qword [0x14001cbfc]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryA
mov rax, 1
mov qword [0x14001ca24], rax
jmp 0x140001b86
xor rax, rax
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400140f0
add rsp, 0x28
pop rax
add rsp, 0x58
pop r15
pop rbp
ret