joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800c43a0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x20]
mov r14, r9
imul r13d, r8d, 0x1b9
mov r15d, r8d
mov r12, rdx
mov ebp, r8d
cmp r8d, r13d
ja 0x1800c450e
mov rsi, qword [rsp + 0x28]
mov edi, dword [rsp + 0x80]
nop word [rax + rax]
cmp ebp, 0x840
ja 0x1800c44a3
je 0x1800c44f7
mov eax, ebp
sub eax, 0x21
je 0x1800c4535
sub eax, 0x7b
je 0x1800c444b
cmp eax, 9
jne 0x1800c45ab
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], 4
xor r8d, r8d
xor edx, edx
mov ecx, 0x8e
call fcn.1800cd140
mov rcx, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r12]
mov dword [rcx], eax
jmp 0x1800c45a6
mov eax, dword [r14]
lea r8, [r12 + 0x48]
xor edx, edx
mov dword [rsp + 0x80], eax
mov r9d, 0xb2
lea rcx, [rsp + 0x80]
call fcn.1800488d0
test rax, rax
je 0x1800c45a6
mov edx, 0x30
mov rcx, rax
call fcn.1800df850
cmp eax, 1
jne 0x1800c45a6
movsd xmm0, qword [0x18011dab0]
movsd qword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x20]
jmp 0x1800c4511
cmp ebp, 0x2700
je 0x1800c44d1
cmp ebp, 0x2940
je 0x1800c44c6
cmp ebp, 0x51db
jne 0x1800c45ab
mov rax, qword [rsp + 0x28]
jmp 0x1800c4511
inc dword [0x18014a2b4]
jmp 0x1800c45ab
mov eax, 0x110
nop word [rax + rax]
cmp eax, 0x110
je 0x1800c45bf
add eax, 0xb3
cmp eax, 0x1c3
jb 0x1800c44e0
mov eax, 0xb5
nop dword [rax]
cmp eax, 0xb5
je 0x1800c4526
cmp eax, 0x170
jne 0x1800c4529
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rbx, rsi
add eax, 0xbb
cmp eax, 0x22b
jb 0x1800c4500
movsxd r8, dword [rcx]
xor edx, edx
mov rsi, qword [r12]
test r8, r8
jle 0x1800c45ab
nop dword [rax]
nop word [rax + rax]
mov ecx, 0xd1
mov eax, ecx
sub eax, 0xd1
je 0x1800c456d
cmp eax, 1
jne 0x1800c4594
movsxd rax, edi
mov rsi, qword [rsi + rax*8 + 0x10]
jmp 0x1800c4594
test rsi, rsi
jne 0x1800c458f
mov eax, 0x2a
cmp eax, 0x2a
je 0x1800c4583
cmp eax, 0x7b
je 0x1800c450e
jmp 0x1800c4585
xor ebx, ebx
add eax, 0x51
cmp eax, 0xcc
jb 0x1800c4577
movzx edi, byte [rdx + r14]
inc ecx
cmp ecx, 0xd3
jb 0x1800c4555
inc rdx
cmp rdx, r8
jl 0x1800c4550
mov rcx, qword [rsp + 0x70]
imul eax, r15d, 0x3f
add ebp, eax
cmp ebp, r13d
jbe 0x1800c43f0
jmp 0x1800c450e
movsd xmm0, qword [r14 + 8]
movsd qword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x20]
jmp 0x1800c4511
Function at 0x1800c7570
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov ebx, dword [rsp + 0xa0]
mov r13d, r8d
imul eax, r8d, 0x356
mov r9, rdx
mov r14, rcx
mov esi, r8d
mov dword [rsp + 0xa8], eax
cmp r8d, eax
ja 0x1800c7798
mov r12, qword [rsp + 0xa8]
mov r15d, dword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
mov edi, dword [rsp + 0xa0]
cmp esi, 0x8b56
ja 0x1800c7651
je 0x1800c762d
mov eax, esi
sub eax, 0x108
je 0x1800c7625
sub eax, 0x1a
je 0x1800c7604
cmp eax, 0x7db6
jne 0x1800c7785
mov dword [0x18016e380], 0
jmp 0x1800c7785
test r14, r14
je 0x1800c7798
mov r8, r14
mov edx, 0x81
mov rcx, r9
call fcn.18000abe0
mov r12, rax
jmp 0x1800c777d
mov rbp, r9
jmp 0x1800c7785
test r12, r12
je 0x1800c763a
mov qword [r12], 0
mov rdx, qword [r9 + 0x60]
mov r8d, IsCharSpaceW
mov rcx, r14
call fcn.1800825b0
jmp 0x1800c777d
cmp esi, 0xfca8
je 0x1800c774e
cmp esi, 0x17a78
je 0x1800c7676
cmp esi, 0x1f848
je 0x1800c7798
jmp 0x1800c7785
cmp dword [r14], 1
jge 0x1800c76af
mov r9d, dword [0x18016e384]
lea rax, [rsp + 0x30]
mov r8d, dword [0x18016e380]
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov r15d, eax
neg eax
sbb ebx, ebx
neg ebx
dec ebx
jmp 0x1800c777d
mov ebx, 0x10b
cmp ebx, 0x10b
je 0x1800c772a
cmp ebx, 0x1bf
je 0x1800c771a
cmp ebx, 0x273
je 0x1800c7702
cmp ebx, 0x327
jne 0x1800c772f
mov r9d, dword [0x18016e380]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov eax, dword [0x18016e384]
mov edx, edi
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov r15d, eax
jmp 0x1800c772f
lea rdx, [0x18016e384]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x18016e380], eax
jmp 0x1800c772f
mov eax, edi
or eax, 2
cmp dword [r14], 1
cmovne eax, edi
mov edi, eax
jmp 0x1800c772f
mov edi, 1
add ebx, 0xb4
cmp ebx, 0x3db
jb 0x1800c76b4
mov eax, r15d
neg eax
sbb ebx, ebx
neg ebx
dec ebx
jmp 0x1800c777d
lea r9, [rsp + 0x30]
mov dword [0x18016e384], 0
xor r8d, r8d
mov dword [rsp + 0xa0], 0x20
mov edx, 0xd5
lea rcx, [rsp + 0xa0]
call fcn.1800c77c0
mov r9, qword [rsp + 0x98]
imul eax, r13d, 0x7a
add esi, eax
cmp esi, dword [rsp + 0xa8]
jbe 0x1800c75d2
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800e8ae0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea edx, [rcx + 0x42e]
mov r12, r9
mov dword [rsp + 0x70], edx
mov r13, r8
mov ebx, dword [rsp + 0x70]
mov edi, ecx
cmp ecx, edx
jae 0x1800e8c0c
mov esi, dword [rsp + 0x70]
mov r14, qword [rsp + 0x30]
mov ebp, dword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
nop dword [rax]
cmp edi, 0x194
ja 0x1800e8cc1
je 0x1800e8c89
mov eax, edi
sub eax, 0x6e
je 0x1800e8c81
sub eax, 0x6b
je 0x1800e8ba0
sub eax, 0x50
je 0x1800e8b65
cmp eax, 0x1b
je 0x1800e8c45
jmp 0x1800e8c4c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, dword [r13]
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], 0
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
jmp 0x1800e8c4c
mov edi, 0x4c
mov eax, edi
sub eax, 0x4c
je 0x1800e8c59
sub eax, 1
je 0x1800e8bd3
sub eax, 1
je 0x1800e8bcb
cmp eax, 1
jne 0x1800e8c71
inc r15
jmp 0x1800e8c71
inc r14
jmp 0x1800e8c71
cmp esi, ebp
je 0x1800e8c3d
jge 0x1800e8bf7
mov eax, 0x7c
nop
cmp eax, 0x7c
je 0x1800e8ce5
add eax, 0x8b
cmp eax, 0x107
jb 0x1800e8be0
jmp 0x1800e8c3d
mov eax, 0x67
nop dword [rax]
cmp eax, 0x67
je 0x1800e8c2c
cmp eax, 0xe8
jne 0x1800e8c31
mov eax, ebx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ebx, 1
add eax, 0x81
cmp eax, 0x169
jb 0x1800e8c00
test esi, esi
jne 0x1800e8c71
mov edx, dword [rsp + 0x70]
mov edi, 0x144
xor ebx, ebx
add edi, 0x6b
cmp edi, edx
jb 0x1800e8b30
jmp 0x1800e8c0c
movsx ecx, byte [r14]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
movsx ecx, byte [r15]
mov esi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov ebp, eax
inc edi
cmp edi, 0x50
jb 0x1800e8ba5
jmp 0x1800e8ba0
mov r14, r12
mov r15, r13
jmp 0x1800e8c4c
cmp dword [rsp + 0x30], 0
jne 0x1800e8c4c
mov ecx, 0xb9
nop word [rax + rax]
mov eax, ecx
sub eax, 0xb8
je 0x1800e8c0c
cmp eax, 1
jne 0x1800e8cb5
lea ebx, [rax - 0xb]
dec ecx
cmp ecx, 0xb7
ja 0x1800e8ca0
jmp 0x1800e8c4c
mov eax, edi
sub eax, 0x1af
je 0x1800e8c0c
sub eax, 0x50
je 0x1800e8c4a
cmp eax, 0x6b
je 0x1800e8c0c
jmp 0x1800e8c4c
mov eax, 0xffffffff
jmp 0x1800e8c0e
Function at 0x1800efd70
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x180135928]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, dword [rsp + 0x20]
lea r12d, [rcx + 0xc]
mov r13, r8
mov r15, rdx
cmp ecx, r12d
jae case.0x1800efded.5
mov rdx, qword [rsp + 0x20]
lea ebp, [rcx - 0x48]
mov r14, qword [rsp + 0x20]
lea r8, [0x180000000]
mov qword [rsp + 0x20], rdx
nop dword [rax + rax]
cmp ebp, 0x1b
ja case.0x1800efded.9
movzx eax, byte [r8 + rbp + 0xeffe0]
mov ecx, dword [r8 + rax*4 + 0xeffb8]
add rcx, r8
jmp rcx
xor ebx, ebx
cmp qword [r15], rbx
setne bl
jmp case.0x1800efded.9
cmp dword [r15 + 0x18], 0
jbe case.0x1800efded.9
mov edi, 0xac
nop dword [rax]
cmp edi, 0xac
je 0x1800efe63
cmp edi, 0x7fa8
je 0x1800efe52
cmp edi, 0xfea4
je 0x1800efe3c
cmp edi, 0x17da0
jne 0x1800efe73
mov rax, qword [r15 + 8]
mov rcx, r14
call qword [rax + 0x10]
jmp 0x1800efe73
mov rcx, qword [r14]
test rcx, rcx
je 0x1800efe4c
mov rax, qword [r14 + 8]
mov qword [rcx + 8], rax
dec dword [r15 + 0x18]
jmp 0x1800efe73
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1800efe73
mov rax, qword [r14]
mov qword [rcx], rax
jmp 0x1800efe73
mov rax, qword [r15 + 0x10]
cmp rax, r14
jne 0x1800efe73
mov rax, qword [rax]
mov qword [r15 + 0x10], rax
add edi, 0x7efc
cmp edi, 0x1fbf0
jbe 0x1800efe10
mov rdx, qword [rsp + 0x20]
lea r8, [0x180000000]
jmp case.0x1800efded.9
xor esi, esi
nop dword [rax]
nop dword [rax + rax]
mov edi, 0xc5
cmp edi, 0xc5
jne 0x1800efec1
mov r8d, esi
lea rdx, [0x18010edb4]
lea rcx, [rsp + 0x28]
call fcn.180105fd0
inc edi
cmp edi, 0xc8
jb 0x1800efea5
inc esi
cmp esi, 0x2710
jl 0x1800efea0
mov r9, qword [rsp + 0x20]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x56]
call fcn.180062960
mov rdx, qword [rsp + 0x20]
lea r8, [0x180000000]
jmp case.0x1800efded.9
mov r9d, 0x105
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800bc410
mov rdx, rax
mov qword [rsp + 0x20], rax
lea r8, [0x180000000]
jmp case.0x1800efded.9
mov eax, dword [r15 + 0x10]
cmp eax, 0x18
jae 0x1800eff2e
mov ecx, dword [r8 + rax*4 + 0x1093c0]
jmp 0x1800eff37
mov eax, dword [r15 + 8]
lea ecx, [rax + rax*4]
add ecx, ecx
mov edx, 8
mov dword [r15 + 0xc], ecx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdx, qword [rsp + 0x20]
lea r8, [0x180000000]
mov qword [r15], rax
jmp case.0x1800efded.9
lea r14, [r13 - 0x10]
jmp case.0x1800efded.9
mov r9, rdx
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x13]
call fcn.1800c2220
mov rdx, qword [rsp + 0x20]
lea r8, [0x180000000]
jmp case.0x1800efded.9
xor ebx, ebx
inc ebp
lea eax, [rbp + 0x48]
cmp eax, r12d
jb 0x1800efdd0
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180106610
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140f82b24
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f82b2e
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f82b57
pop rbp
sub rbp, 0x33
sub rbp, 0xf82b24
sub rsp, 0x20
jmp 0x140f82b76
mov rax, 0xf82b24
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x2a1bcd0c
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f82b95
jmp 0x140f82bac
test ebp, r12d
xchg dword [rbp + 0xc0c0c30], eax
invalid

Function at 0xe16160
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00e162e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xe16191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xe16177
add dl, dl
jne 0xe1619e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xe161fe
xor eax, eax
add dl, dl
jne 0xe161ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xe162b5
add dl, dl
jne 0xe161be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe161cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe161d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe161e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xe161f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xe16186
mov eax, 1
add dl, dl
jne 0xe1620e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe1621b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xe16203
sub eax, ebx
mov ebx, 1
jne 0xe16254
mov ecx, 1
add dl, dl
jne 0xe16236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe16243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xe1622b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xe16186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xe16270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe1627d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xe16265
cmp eax, 0x7d00
jae 0xe162a3
cmp eax, 0x500
jb 0xe1629e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xe16186
cmp eax, 0x7f
ja 0xe162a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xe16186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xe162da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xe16186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400039da
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
mov edi, r8d
and edi, 0x300
lea r8d, [rdi + 9]
lea r9, [rsp + 0x40]
call fcn.140008036
test eax, eax
jne 0x140003ab5
test bpl, 2
je 0x140003a49
lea r9, [rsp + 0x4c]
mov dword [r9], 0
mov rcx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x140003aa5
lea r14, [rsp + 0x50]
mov r15, qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov rcx, qword [rsp + 0x40]
xor edx, edx
mov r8, r14
mov r9d, 0x105
call r15
test eax, eax
jne 0x140003a86
test bpl, 1
jne 0x140003aa5
mov rcx, qword [rsp + 0x40]
mov rdx, r14
mov r8d, ebp
call fcn.1400039da
test eax, eax
je 0x140003a55
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
mov rdx, rsi
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
jmp 0x140003ab5
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140003b5a
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x28
mov eax, ecx
mov rcx, qword [0x14001aa38]
test eax, eax
je 0x140003b86
test rcx, rcx
je 0x140003b76
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x14001aa38], 0
add rsp, 0x28
ret
test rcx, rcx
je 0x140003b96
xor ecx, ecx
add rsp, 0x28
jmp fcn.140008636
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x14001aa40]
jbe case.default.0x140003bdf
mov rax, qword [0x14000b048]
mov rcx, qword [rax]
mov qword [rsp + 0x20], 0
lea r9, [0x140003ac8]
mov edx, 0x6f
xor r8d, r8d
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [0x14001aa38], rax
mov rcx, rax
mov edx, 5
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x14000420c
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [0x14000b058]
mov rdi, qword [rax]
lea rsi, [rdi + 0xc800]
mov rcx, rsi
call fcn.140007c02
mov rcx, rsi
call fcn.140007b4c
test eax, eax
je 0x14000425f
mov rcx, rsi
call fcn.140007ad8
mov rcx, rsi
call fcn.1400074b1
add rdi, 0xc000
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140007e03
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400048e7
Capabilities:
Delete file
Enumerate files on windows
Move file

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [0x14000b458]
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x140004909
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], 0xffffffffffffffff
call fcn.140004954
mov rax, qword [0x14000b058]
mov ecx, 0xd000
add rcx, qword [rax]
mov edx, 7
add rsp, 0x20
pop rsi
jmp fcn.1400076f6
Function at 0x140007450
Capabilities:
Create directory

Disassembly:
sub rsp, 0x68
lea rax, [rsp + 0x40]
mov dword [rax], 0x40001
lea rdx, [0x14000b560]
mov qword [rax + 8], rdx
lea r8, [0x14000b550]
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], 0
mov qword [rax + 0x20], r8
lea rdx, [rsp + 0x28]
mov dword [rdx], 0x18
mov qword [rdx + 8], rax
mov dword [rdx + 0x10], 0
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x1400074ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
add rsp, 0x68
ret

Function at 0x1400074b1
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400074c8
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x14000754d
Capabilities:
Create process on windows

Disassembly:
push rsi
sub rsp, 0x70
mov rdx, rcx
mov dword [0x14003d7e0], 0x68
lea rax, [0x14003d7e0]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 0
xor esi, esi
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400075b1
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x58]
mov rax, rsi
add rsp, 0x70
pop rsi
ret

Function at 0x1400075ba
Capabilities:
Create process on windows

Disassembly:
mov dword [rcx], 0x70
mov qword [rcx + 0x40], 0
jmp qword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x140007674
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov edi, edx
mov rsi, rcx
call fcn.1400076c9
cmp eax, 0xffffffff
je 0x1400076bf
mov ebx, eax
mov rcx, rsi
test dil, 1
jne 0x14000769d
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400076a3
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, eax
mov eax, 1
test ecx, ecx
jne 0x1400076c1
test dil, 4
jne 0x1400076bf
mov rcx, rsi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400076c9
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400076ed
mov edx, esi
and edx, 0xfffffffe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400076f6
Capabilities:
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov ebx, edx
mov rsi, rcx
call fcn.14000795e
test bl, 8
jne 0x140007744
mov ebp, eax
mov edi, ebx
and edi, 4
test bl, 1
jne 0x140007760
lea rcx, [0x14003d850]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, rsi
call fcn.140007a42
jmp 0x14000779a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x14000b2b8]
cmp eax, 1
adc dword [rcx + 8], 0
jmp 0x140007920
test bl, 2
je 0x1400078d9
test ebp, ebp
je 0x1400078d9
lea r14, [0x14003d850]
mov rcx, r14
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rdx, str..
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp word [rsi], 0
jne 0x1400077aa
cmp word [0x14003d850], 0x5c
jne 0x1400077ba
lea rdx, [0x14000b58e]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
lea r14, [rsi + rax*2]
lea rcx, [0x14003d850]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1400078cd
mov r15, rax
mov dword [rsp + 0x24], ebp
mov ebp, ebx
and ebp, 3
lea r13, [rsp + 0x28]
mov r12, qword [sym.imp.KERNEL32.dll_FindNextFileW]
movzx ecx, word [rsp + 0x54]
movzx eax, word [rsp + 0x56]
cmp cx, 0x2e
jne 0x140007816
test ax, ax
je 0x1400078af
cmp cx, 0x2e
jne 0x14000782e
cmp ax, 0x2e
jne 0x14000782e
cmp word [rsp + 0x58], 0
je 0x1400078af
mov rcx, r14
lea rdx, [rsp + 0x54]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
test byte [rsp + 0x28], 0x10
jne 0x140007866
mov rcx, rsi
mov edx, edi
call fcn.140007674
test eax, eax
je 0x140007877
mov ecx, 0xfffffff2
mov rdx, rsi
call fcn.140006fb8
jmp 0x1400078af
cmp ebp, 3
jne 0x1400078af
mov rcx, rsi
mov edx, ebx
call fcn.1400076f6
jmp 0x1400078af
test edi, edi
jne 0x140007887
mov rax, qword [0x14000b2b8]
inc dword [rax + 8]
jmp 0x1400078af
mov ecx, 0xfffffff1
mov rdx, rsi
call fcn.140006fb8
mov rcx, rsi
xor edx, edx
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rax, qword [0x14000b2b8]
inc dword [rax + 0x10]
mov rcx, r15
mov rdx, r13
call r12
test eax, eax
jne 0x1400077fd
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [rsp + 0x24]
test bl, 1
je 0x140007920
mov word [r14 - 2], 0
test ebp, ebp
je 0x140007916
mov rcx, rsi
call fcn.140007aa7
test rax, rax
je 0x140007920
mov rcx, rsi
call fcn.140007ad8
mov edx, edi
or edx, 1
mov rcx, rsi
call fcn.140007674
test eax, eax
je 0x140007912
mov ecx, 0xffffffe5
mov rdx, rsi
call fcn.140006fb8
jmp 0x140007920
test edi, edi
jne 0x140007934
mov rax, qword [0x14000b2b8]
inc dword [rax + 8]
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 0xfffffff1
mov rdx, rsi
call fcn.140006fb8
mov rcx, rsi
xor edx, edx
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rax, qword [0x14000b2b8]
inc dword [rax + 0x10]
jmp 0x140007920