joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c01bc
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rdx
mov rsi, rcx
mov rdx, rcx
lea rcx, str.HttpGet:_url:__s_n
call fcn.1400b3458
xor ebx, ebx
mov dword [rsp + 0x34], 4
mov ebp, ebx
test rsi, rsi
jne 0x1400c020e
mov r14d, ebx
mov esi, ebx
jmp 0x1400c024e
call fcn.1400b2af0
mov r8, rax
or rdx, 0xffffffffffffffff
mov rcx, rsi
call fcn.1400be600
lea rdx, str.https
mov r14, rax
cmp rsi, rdx
jne 0x1400c0238
mov esi, 1
jmp 0x1400c024e
mov r8d, 5
mov rcx, rsi
call fcn.14010b194
test eax, eax
mov esi, ebx
sete sil
xor r9d, r9d
mov dword [rdi + 0x48], ebx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
lea rcx, str.SumatraPdfHTTP
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r15, rax
test rax, rax
jne 0x1400c027e
lea rcx, str.HttpGet:_InternetOpen_failed_n
jmp 0x1400c0336
shl esi, 0x17
xor r9d, r9d
sub esi, 0x7bfff000
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov dword [rsp + 0x20], esi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbp, rax
test rax, rax
jne 0x1400c02b6
lea rcx, str.HttpGet:_InternetOpenUrl_failed_n
jmp 0x1400c0336
lea r8, [rdi + 0x4c]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x34]
mov edx, 0x20000013
mov rcx, rbp
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x1400c02df
lea rcx, str.HttpGet:_HttpQueryInfoW_failed_n
jmp 0x1400c0336
mov esi, 0x400
jmp 0x1400c0311
cmp dword [rsp + 0x30], ebx
je 0x1400c035b
lock inc dword [0x140172368]
mov r8d, dword [rsp + 0x30]
lea rcx, [rdi + 8]
lea rdx, [rsp + 0x40]
call fcn.1400b18f8
lock dec dword [0x140172368]
test al, al
je 0x1400c038a
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], ebx
mov r8d, esi
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400c02e6
lea rcx, str.HttpGet:_InternetReadFile_failed_n
call fcn.1400b3458
xor ecx, ecx
call fcn.1400b5d58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x48], eax
test eax, eax
jne 0x1400c0356
mov dword [rdi + 0x48], 0x1f
test rbp, rbp
je 0x1400c0364
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test r15, r15
je 0x1400c0372
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov edx, dword [rdi + 0x48]
test edx, edx
je 0x1400c0398
xor r8d, r8d
lea rcx, str.HttpRspOk:_rsp__error__d__should_be__d__ERROR_SUCCESS__n
call fcn.1400b3458
jmp 0x1400c03b3
lea rcx, str.HttpGet:_data.Append_failed_n
call fcn.1400b3458
jmp 0x1400c0342
mov edx, dword [rdi + 0x4c]
cmp edx, 0x12c
jb 0x1400c03b1
lea rcx, str.HttpRspOk:_rsp__httpStatusCode:__d_n
call fcn.1400b3458
jmp 0x1400c03b3
mov bl, 1
mov al, bl
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400f44c0
mov rbx, qword [rsp + 0x490]
add rsp, 0x450
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c5364
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rdx
mov rbx, rcx
call fcn.1400b43c0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x250
mov rsi, rax
call fcn.14012a960
xor r8d, r8d
or rdx, 0xffffffffffffffff
mov rcx, rbx
call fcn.1400be600
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c53d2
xor al, al
jmp 0x1400c544c
call fcn.1400b2af0
mov r9, rax
lea rdx, [rsp + 0x4c]
or r8, 0xffffffffffffffff
mov ecx, 0xfde9
call fcn.1400be6d0
mov ecx, dword [rsp + 0x20]
test cl, 0x40
jne 0x1400c542a
test cl, 0x10
jne 0x1400c542a
bt ecx, 0xc
jb 0x1400c542a
bt ecx, 8
jb 0x1400c542a
bt ecx, 0xa
jb 0x1400c542a
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.1400b41a4
or r8d, 0xffffffff
mov rdx, rax
mov rcx, rdi
call fcn.1400bb18c
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400c53d2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rdi + 0x14], 0
setg al
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400f44c0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400c55c0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, rdx
lea rdx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edi, edi
mov rsi, rax
cmp dword [rsp + 0x50], edi
jle 0x1400c5634
mov rbx, rax
mov rbp, qword [rbx]
test rbp, rbp
je 0x1400c5628
call fcn.1400b2af0
mov r9, rax
or r8, 0xffffffffffffffff
mov rdx, rbp
mov ecx, 0xfde9
call fcn.1400be6d0
test rax, rax
je 0x1400c5628
cmp byte [rax], 0
je 0x1400c5628
or r8d, 0xffffffff
mov rdx, rax
mov rcx, r14
call fcn.1400bb18c
inc edi
add rbx, 8
cmp edi, dword [rsp + 0x50]
jl 0x1400c55ee
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1400c57c8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov ecx, 0x10
call fcn.1400f44e0
mov r9, rax
xor edx, edx
and qword [rax], 0
and qword [rax + 8], 0
mov r8, qword [rbx]
mov qword [rax], r8
lea r8, [0x1400c578c]
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
lea rcx, [rsp + 0x50]
and dword [rsp + 0x50], 0
mov qword [rsp + 0x28], rcx
xor ecx, ecx
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x1400c583d
test rdi, rdi
je 0x1400c583a
mov edx, dword [rsp + 0x50]
mov rcx, rdi
call fcn.1400c56ec
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c5848
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
and qword [rbp - 0x10], 0
mov rsi, r8
and qword [rbp + 0x40], 0
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
mov ebx, edx
mov dword [rsp + 0x20], 0xf0000000
mov rdi, rcx
xor edx, edx
lea rcx, [rbp - 0x10]
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400c58a3
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400c58a3
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400c58d5
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400c58d5
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1400c58fc
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400c58fc
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov rcx, qword [rbp + 0x40]
lea r9, [rbp + 0x28]
and dword [rbp + 0x38], 0
lea r8, [rbp + 0x38]
and dword [rsp + 0x20], 0
mov edi, 4
mov edx, edi
mov dword [rbp + 0x28], edi
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ebx, eax
cmp dword [rbp + 0x28], edi
je 0x1400c5938
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400c5938
call qword [sym.imp.KERNEL32.dll_DebugBreak]
test ebx, ebx
jne 0x1400c594c
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400c594c
call qword [sym.imp.KERNEL32.dll_DebugBreak]
cmp dword [rbp + 0x38], 0x10
je 0x1400c5962
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400c5962
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov rcx, qword [rbp + 0x40]
lea r9, [rbp + 0x38]
and dword [rsp + 0x20], 0
mov r8, rsi
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x1400c5991
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400c5991
call qword [sym.imp.KERNEL32.dll_DebugBreak]
cmp dword [rbp + 0x38], 0x10
je 0x1400c59a7
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400c59a7
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d18f0
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.1401282a0
sub rsp, rax
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rax, qword [0x1401725e0]
xor ebx, ebx
mov bpl, r8b
mov rsi, rdx
mov rdi, rcx
test rax, rax
jne 0x1400d19c1
cmp byte [0x1401725d8], bl
jne 0x1400d19c1
mov edx, 0x800
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1400d195b
mov qword [0x1401725d0], rbx
jmp 0x1400d19b3
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.1400d4e28
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1401725d0], rax
test rax, rax
je 0x1400d19b3
lea rdx, str.CryptProtectMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401725d0]
lea rdx, str.CryptUnprotectMemory
mov qword [0x1401725e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401725e8], rax
mov rax, qword [0x1401725e0]
mov byte [0x1401725d8], 1
mov rdx, rsi
and rdx, 0xfffffffffffffff0
test bpl, bpl
je 0x1400d19e0
test rax, rax
je 0x1400d19fa
xor r8d, r8d
mov rcx, rdi
call rax
test eax, eax
je 0x1400d1a38
jmp 0x1400d1a15
mov rax, qword [0x1401725e8]
test rax, rax
je 0x1400d19fa
xor r8d, r8d
mov rcx, rdi
call rax
test eax, eax
je 0x1400d1a72
jmp 0x1400d1a15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test rsi, rsi
je 0x1400d1a15
lea ecx, [rax + 0x4b]
add cl, bl
xor byte [rdi + rbx], cl
inc rbx
cmp rbx, rsi
jb 0x1400d1a05
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400f44c0
mov rbx, qword [rsp + 0x1070]
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.CryptProtectMemory_failed
lea rcx, [0x14016f7e8]
call fcn.1400daa94
mov edx, 2
lea rcx, [0x14016f7e8]
call fcn.1400dab3c
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x20]
lea rdx, [0x140162258]
call fcn.1400f7aec
int3
lea rdx, str.CryptUnprotectMemory_failed
lea rcx, [0x14016f7e8]
call fcn.1400daa94
mov edx, 2
lea rcx, [0x14016f7e8]
call fcn.1400dab3c
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x20]
lea rdx, [0x140162258]
call fcn.1400f7aec
int3
Function at 0x1400d53f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x1030
call fcn.1401282a0
sub rsp, rax
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x1020], rax
xor r14d, r14d
mov rdi, rdx
mov rsi, rcx
cmp word [rcx], r14w
je 0x1400d563a
or rbx, 0xffffffffffffffff
mov rbp, rbx
inc rbp
cmp word [rcx + rbp*2], r14w
jne 0x1400d5437
call fcn.1400d5358
test al, al
je 0x1400d5509
call fcn.1400d4dc0
test al, al
je 0x1400d548b
lea rax, [rbp + 4]
mov r10d, 0x800
cmp rax, r10
jae 0x1400d563a
mov r8d, r10d
lea rdx, [0x140154830]
mov rcx, rdi
call fcn.1400d4710
inc rbx
cmp word [rdi + rbx*2], r14w
jne 0x1400d547c
jmp 0x1400d561f
cmp word [rcx], 0x5c
jne 0x1400d563a
cmp word [rcx + 2], 0x5c
jne 0x1400d563a
lea rax, [rbp + 6]
mov r10d, 0x800
cmp rax, r10
jae 0x1400d563a
mov r8d, r10d
lea rdx, [0x140154830]
mov rcx, rdi
call fcn.1400d4710
mov rax, rbx
inc rax
cmp word [rdi + rax*2], r14w
jne 0x1400d54c8
cmp rax, r10
jae 0x1400d54ed
mov r8, r10
lea rcx, [rdi + rax*2]
sub r8, rax
lea rdx, [0x1401561b0]
call fcn.1400d4710
inc rbx
cmp word [rdi + rbx*2], r14w
jne 0x1400d54ed
cmp rbx, r10
jae 0x1400d5636
lea rdx, [rsi + 2]
jmp 0x1400d5627
lea rdx, [rsp + 0x20]
mov ecx, 0x7ff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x7fe
ja 0x1400d563a
cmp word [rsi], 0x5c
je 0x1400d55c8
cmp word [rsi], 0x2f
je 0x1400d55c8
lea rcx, [rsp + 0x20]
call fcn.1400d4df0
mov rax, rbx
lea rcx, [rsp + 0x20]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400d554c
add rax, 4
mov r10d, 0x800
add rax, rbp
cmp rax, r10
jae 0x1400d563a
mov r8d, r10d
lea rdx, [0x140154830]
mov rcx, rdi
call fcn.1400d4710
mov rax, rbx
inc rax
cmp word [rdi + rax*2], r14w
jne 0x1400d5581
cmp rax, r10
jae 0x1400d55a4
mov r8, r10
lea rcx, [rdi + rax*2]
sub r8, rax
lea rdx, [rsp + 0x20]
call fcn.1400d4710
cmp word [rsi], 0x2e
jne 0x1400d55bc
cmp word [rsi + 2], 0x5c
je 0x1400d55b8
cmp word [rsi + 2], 0x2f
jne 0x1400d55bc
add rsi, 4
inc rbx
cmp word [rdi + rbx*2], r14w
jne 0x1400d55bc
jmp 0x1400d561f
lea rax, [rbp + 6]
mov r10d, 0x800
cmp rax, r10
jae 0x1400d563a
mov r8d, r10d
lea rdx, [0x140154830]
mov rcx, rdi
call fcn.1400d4710
mov rax, rbx
mov word [rsp + 0x24], r14w
inc rax
cmp word [rdi + rax*2], r14w
jne 0x1400d55f2
cmp rax, r10
jae 0x1400d5615
mov r8, r10
lea rcx, [rdi + rax*2]
sub r8, rax
lea rdx, [rsp + 0x20]
call fcn.1400d4710
inc rbx
cmp word [rdi + rbx*2], r14w
jne 0x1400d5615
cmp rbx, r10
jae 0x1400d5636
mov rdx, rsi
sub r10, rbx
lea rcx, [rdi + rbx*2]
mov r8, r10
call fcn.1400d4710
mov al, 1
jmp 0x1400d563c
xor al, al
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400f44c0
lea r11, [rsp + 0x1030]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400d62ac
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x1b60], 0
lea rax, str.xb_r_
mov qword [rcx], rax
mov rbx, rcx
je 0x1400d62ed
mov rdi, qword [rcx + 0x1b68]
test rdi, rdi
je 0x1400d62ed
mov rcx, rdi
call fcn.1400d0898
mov edx, 0xc808
mov rcx, rdi
call fcn.1400f451c
mov rcx, qword [rbx + 0x5a58]
test rcx, rcx
je 0x1400d62fe
call fcn.140107298
mov rcx, qword [rbx + 0x36f8]
test rcx, rcx
je 0x1400d630f
call fcn.140107298
lea rcx, [rbx + 0x2670]
call fcn.1400d44c4
lea rcx, [rbx + 0x1b88]
call fcn.1400ebb68
lea rcx, [rbx + 0x1a20]
call fcn.1400de520
lea rcx, [rbx + 0x1048]
call fcn.1400d2018
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400dcd60
Function at 0x1400db288
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov word [rbp - 0xc], 0x500
lea rax, [rbp - 0x18]
mov dword [rbp - 0x10], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp - 0x20], eax
test eax, eax
je 0x1400db315
mov rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1400db306
mov dword [rbp - 0x20], ebx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp - 0x20]
test eax, eax
setne al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400f44c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x1400dcd60
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 8], 0xffffffffffffffff
lea rax, [0x140156378]
mov qword [rcx], rax
je 0x1400dcd8f
cmp byte [rcx + 0x19], 0
jne 0x1400dcd8f
cmp byte [rcx + 0x20], 0
je 0x1400dcd8a
add rsp, 0x28
jmp fcn.1400dd11c
call fcn.1400dd0bc
add rsp, 0x28
ret

Function at 0x1400dd11c
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x14], 0
mov rbx, rcx
jne 0x1400dd14c
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x1400dd138
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [rbx + 0x21], 0
je 0x1400dd14c
lea rcx, [rbx + 0x3a]
add rsp, 0x20
pop rbx
jmp fcn.1400ddf18
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400dd154
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
test r8, r8
jne 0x1400dd181
mov al, 1
jmp 0x1400dd229
cmp dword [rcx + 0x14], 1
lea rsi, [rcx + 8]
jne 0x1400dd199
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsi], rax
and dword [rsp + 0x60], 0
xor cl, cl
cmp dword [rbx + 0x14], 0
je 0x1400dd1f3
xor r14d, r14d
test rdi, rdi
je 0x1400dd217
mov r12d, 0x4000
mov eax, edi
lea rdx, [r14 + rbp]
sub eax, r14d
lea r9, [rsp + 0x60]
mov r8d, r12d
mov rcx, rdi
sub rcx, r14
cmp rcx, r12
mov rcx, qword [rsi]
cmovb r8d, eax
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete cl
jne 0x1400dd213
add r14, r12
cmp r14, rdi
jb 0x1400dd1b4
jmp 0x1400dd213
mov rcx, qword [rsi]
lea r9, [rsp + 0x60]
and qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete cl
test cl, cl
jne 0x1400dd223
cmp byte [rbx + 0x22], 0
je 0x1400dd223
cmp dword [rbx + 0x14], 0
je 0x1400dd242
mov byte [rbx + 0x10], 1
mov al, cl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
call fcn.1400daa34
int3
Function at 0x1400dd3a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
lea rdi, [rcx + 8]
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jne 0x1400dd3d5
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rdi], rax
mov rcx, qword [rdi]
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400dd45c
cmp qword [rdi], 0xffffffffffffffff
je 0x1400dd422
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileType]
add eax, 0xfffffffe
cmp eax, 1
ja 0x1400dd422
mov r8d, 0x4e20
cmp rsi, r8
jbe 0x1400dd422
mov rdx, rbp
mov rcx, rbx
call fcn.1400dd3a0
jmp 0x1400dd460
cmp dword [rbx + 0x14], 1
jne 0x1400dd437
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x1400dd437
xor eax, eax
jmp 0x1400dd460
cmp dword [rbx + 0x14], 0
jne 0x1400dd457
mov edi, 0x8000
cmp rsi, rdi
jbe 0x1400dd457
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x1400dd457
mov r8d, edi
jmp 0x1400dd415
or eax, 0xffffffff
jmp 0x1400dd460
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400dd7cc
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1030
call fcn.1401282a0
sub rsp, rax
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov ebp, r8d
mov sil, dl
or r8, 0xffffffffffffffff
mov rdi, rcx
xor ebx, ebx
inc r8
cmp word [rcx + r8*2], bx
jne 0x1400dd802
lea rax, [rcx - 2]
test r8, r8
lea rax, [rax + r8*2]
cmovne rcx, rax
cmp word [rcx], 0x2e
je 0x1400dd836
cmp word [rcx], 0x20
je 0x1400dd836
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400dd865
mov rcx, rdi
call fcn.1400ddbe8
cmp eax, 0xffffffff
jne 0x1400dd878
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d53f0
test al, al
je 0x1400dd878
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400dd878
test sil, sil
je 0x1400dd874
mov edx, ebp
mov rcx, rdi
call fcn.1400ddc60
xor eax, eax
jmp 0x1400dd893
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400dd88e
cmp eax, 3
sete bl
lea eax, [rbx + 1]
jmp 0x1400dd893
mov eax, 2
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400f44c0
mov rbx, qword [rsp + 0x1058]
add rsp, 0x1030
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ddbe8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1030
call fcn.1401282a0
sub rsp, rax
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400ddc3b
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d53f0
test al, al
je 0x1400ddc3b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400f44c0
mov rbx, qword [rsp + 0x1048]
add rsp, 0x1030
pop rdi
ret

Function at 0x1400ddc60
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1030
call fcn.1401282a0
sub rsp, rax
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov esi, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test eax, eax
jne 0x1400ddcc1
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d53f0
test al, al
je 0x1400ddcc1
mov edx, esi
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400f44c0
lea r11, [rsp + 0x1030]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400dde74
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2030
call fcn.1401282a0
sub rsp, rax
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
test eax, eax
jne 0x1400ddef0
lea rdx, [rsp + 0x1020]
mov rcx, rdi
call fcn.1400d53f0
test al, al
je 0x1400ddef0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400d53f0
test al, al
je 0x1400ddef0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x1020]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400f44c0
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400ddf18
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1030
call fcn.1401282a0
sub rsp, rax
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test eax, eax
jne 0x1400ddf70
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d53f0
test al, al
je 0x1400ddf70
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400f44c0
mov rbx, qword [rsp + 0x1048]
add rsp, 0x1030
pop rdi
ret
Function at 0x1400ddf94
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1030
call fcn.1401282a0
sub rsp, rax
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x1400ddfec
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d53f0
test al, al
je 0x1400ddfec
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400f44c0
mov rbx, qword [rsp + 0x1048]
add rsp, 0x1030
pop rdi
ret
Function at 0x1400e8b18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
cmp edx, 0xf
je 0x1400e8b86
cmp edx, 0x14
je 0x1400e8b71
cmp edx, 0x1a
je 0x1400e8b71
cmp edx, 0x1d
je 0x1400e8b5c
cmp edx, 0x32
jne 0x1400e8b97
cmp dword [rcx + 0x30], 1
jbe 0x1400e8b50
cmp byte [rcx + 0x4d98], 0
jne 0x1400e8b50
mov dl, r8b
add rsp, 0x28
jmp fcn.1400e0690
mov dl, r8b
add rsp, 0x28
jmp fcn.1400e683c
cmp byte [rcx + 0x4d98], 0
jne 0x1400e8b97
mov dl, r8b
add rsp, 0x28
jmp fcn.1400e4634
cmp byte [rcx + 0x4d98], 0
jne 0x1400e8b97
mov dl, r8b
add rsp, 0x28
jmp fcn.1400e34fc
cmp byte [rcx + 0x4d98], 0
jne 0x1400e8b97
mov dl, r8b
call fcn.1400e2510
add rsp, 0x28
ret