joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a3b18
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x3d0
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov edx, 0x101
xor edi, edi
mov rbx, rcx
mov dword [rsp + 0x20], edx
cmp qword [rcx + 0x10], rdx
jb 0x1401a3b67
mov qword [rcx + 0x10], rdx
cmp qword [rcx + 0x18], 8
jb 0x1401a3b5b
mov rax, qword [rcx]
jmp 0x1401a3b5e
mov rax, rcx
mov word [rax + 0x202], di
jmp 0x1401a3b73
sub rdx, qword [rcx + 0x10]
xor r8d, r8d
call fcn.14000b4a0
cmp qword [rbx + 0x18], 8
jb 0x1401a3b7f
mov rdx, qword [rbx]
jmp 0x1401a3b82
mov rdx, rbx
lea r8, [rsp + 0x20]
mov ecx, 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x1401a3be3
mov edx, dword [rsp + 0x20]
cmp rdx, qword [rbx + 0x10]
ja 0x1401a3bb3
mov qword [rbx + 0x10], rdx
cmp qword [rbx + 0x18], 8
jb 0x1401a3bad
mov rbx, qword [rbx]
mov word [rbx + rdx*2], di
jmp 0x1401a3bc2
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.14000b4a0
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.140135130
mov rbx, qword [rsp + 0x3e8]
add rsp, 0x3d0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Failed_to_get_current_username.
mov edx, 0xf
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.14000bde4
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x30]
call fcn.1401377ec
int3
Function at 0x1401b1184
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rsi, r8
mov r14, rdx
mov rbp, rcx
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x1401b11bb
mov r8, qword [r8]
movabs rcx, 0xcbf29ce484222325
xor edx, edx
add r9, r9
je 0x1401b11ea
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r10, 0x100000001b3
imul rcx, r10
inc rdx
cmp rdx, r9
jb 0x1401b11cc
mov r15, qword [rbp + 0x30]
and r15, rcx
add r15, r15
mov rbx, qword [rbp + 0x18]
mov rbx, qword [rbx + r15*8]
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x18]
cmp qword [rcx + r15*8], rax
je 0x1401b1212
mov rax, qword [rcx + r15*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1401b12a7
lea rcx, [rbx + 0x10]
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x1401b122f
mov r9, qword [rsi]
jmp 0x1401b1232
mov r9, rsi
mov qword [rsp + 0x20], rax
mov r8, qword [rcx + 0x10]
xor edx, edx
call fcn.14000b8a0
nop
test eax, eax
je 0x1401b124c
mov rbx, qword [rbx]
jmp 0x1401b11fc
mov rdi, rbx
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x18]
cmp qword [rcx + r15*8], rax
je 0x1401b1265
mov rax, qword [rcx + r15*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1401b1299
lea r9, [rbx + 0x10]
mov rax, qword [r9 + 0x10]
cmp qword [r9 + 0x18], 8
jb 0x1401b127c
mov r9, qword [r9]
mov qword [rsp + 0x20], rax
mov r8, qword [rsi + 0x10]
xor edx, edx
mov rcx, rsi
call fcn.14000b8a0
nop
test eax, eax
jne 0x1401b1299
mov rbx, qword [rbx]
jmp 0x1401b124f
cmp rdi, rbx
je 0x1401b12a7
mov qword [r14], rdi
mov qword [r14 + 8], rbx
jmp 0x1401b12b2
mov rax, qword [rbp + 8]
mov qword [r14], rax
mov qword [r14 + 8], rax
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1401b2ac0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r11, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r10
cmp r10, 4
jb 0x1401b2af9
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov r8, rdx
add r8, r8
mov rcx, qword [r9 + 0x18]
mov rax, qword [rcx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x1401b2b39
mov rdi, qword [r9 + 8]
jmp 0x1401b2b41
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, rax
je 0x1401b2b9b
mov eax, dword [r11]
add rdx, rdx
mov rdi, qword [rdi + 8]
cmp eax, dword [rdi + 0x10]
je 0x1401b2b5d
cmp rdi, qword [rcx + rdx*8]
jne 0x1401b2b4c
jmp 0x1401b2b9b
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x18]
xor r8d, r8d
mov dl, 1
call fcn.14000b190
mov rcx, rbx
call fcn.14015729c
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1401b2c34
mov qword [rsp + 0x20], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x1401b2bd5
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x1401b2bf2
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1401b2c21
cmp rax, rdi
jne 0x1401b2bfd
mov qword [rdx + r8*8], rbx
jmp 0x1401b2c21
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1401b2c21
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.1401b4294
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1401b48a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, r8
movabs r9, 0xcbf29ce484222325
mov r8, rcx
xor r10d, r10d
movzx eax, byte [r10 + r11]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 4
jb 0x1401b48b3
mov rcx, qword [r8 + 0x30]
and rcx, r9
mov r9, qword [r8 + 0x18]
mov r8, qword [r8 + 8]
mov rax, rcx
add rax, rax
lea r10, [rcx + rcx]
mov rax, qword [r9 + rax*8]
cmp qword [r9 + r10*8], r8
jne 0x1401b48fa
mov rcx, r8
jmp 0x1401b4902
mov rcx, qword [r9 + r10*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1401b4923
mov ecx, dword [r11]
cmp dword [rax + 0x10], ecx
je 0x1401b4914
mov rax, qword [rax]
jmp 0x1401b48ef
mov ecx, dword [rax + 0x10]
cmp dword [r11], ecx
cmovne rax, r8
mov qword [rdx], rax
jmp 0x1401b4926
mov qword [rdx], r8
mov rax, rdx
ret
Function at 0x1401b6830
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
lea rbx, [rcx + 0x190]
xor r15d, r15d
cmp qword [rbx + 0x10], r15
sete al
test al, al
jne 0x1401b694c
mov rax, qword [rcx + 0x70]
sub rax, qword [rcx + 0x68]
sar rax, 5
test rax, rax
jne 0x1401b694c
lea r9, str.Args::ParseArgument:_Parsing_commandline.
lea edx, [rax + 0xe]
mov ecx, 0x4502e2
lea r8d, [r15 + 0x32]
call fcn.1400ccbf0
mov dword [rsp + 0x20], r15d
cmp qword [rbx + 0x18], 8
jb 0x1401b68b7
mov rbx, qword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
mov r14d, r15d
cmp dword [rsp + 0x20], r15d
jle 0x1401b693c
mov rsi, rax
mov rdx, qword [rsi]
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r15
mov word [rsp + 0x30], r15w
cmp word [rdx], r15w
jne 0x1401b68f7
mov r8, r15
jmp 0x1401b6905
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r15w
jne 0x1401b68fb
lea rcx, [rsp + 0x30]
call fcn.14000b6f8
nop
lea rdx, [rsp + 0x30]
lea rcx, [rdi + 0x68]
call fcn.14019b298
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.14000b190
inc r14d
add rsi, 8
cmp r14d, dword [rsp + 0x20]
jl 0x1401b68d5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [rdi + 0x1b4], r15d
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140135130
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1401b9254
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor edi, edi
mov dword [rbp - 0x49], edi
mov r8b, 1
mov edx, 0x3e8
lea rcx, [rbp - 1]
call fcn.1401b94e0
nop
cmp qword [rbp + 0xf], rdi
sete al
test al, al
je 0x1401b945e
mov r8b, 1
mov edx, 0xbb9
lea rcx, [rbp + 0x1f]
call fcn.1401b94e0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], rdi
mov qword [rbp - 9], 7
mov qword [rbp - 0x11], rdi
mov word [rbp - 0x21], di
lea r8d, [rdi + 1]
lea rdx, [0x14024f16c]
lea rcx, [rbp - 0x21]
call fcn.14000b6f8
nop
lea r8, [rbp - 0x21]
lea rdx, [rbp - 0x41]
lea rcx, [rbp + 0x1f]
call fcn.1400a0330
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x21]
call fcn.14000b190
mov rax, qword [rbp - 0x39]
mov rcx, qword [rbp - 0x41]
sub rax, rcx
sar rax, 5
cmp rax, 3
jb 0x1401b9446
lea esi, [rdi + 1]
dec rax
cmp rsi, rax
jae 0x1401b9446
lea r15d, [rdi + 0x20]
lea rdx, [rcx + r15]
mov qword [rbp - 9], 7
mov qword [rbp - 0x11], rdi
mov word [rbp - 0x21], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp - 0x21]
call fcn.14000b5b8
nop
mov r8, qword [rbp - 0x11]
test r8, r8
sete al
test al, al
jne 0x1401b93ab
mov r14, rdi
test r8, r8
je 0x1401b93ab
lea rax, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rax, qword [rbp - 0x21]
lea rbx, [rbp - 0x21]
cmovae rbx, qword [rbp - 0x21]
movzx ecx, word [rax + r14*2]
call fcn.14016362c
mov word [rbx + r14*2], ax
inc r14
mov r8, qword [rbp - 0x11]
cmp r14, r8
jb 0x1401b9379
lea r9, [0x1403361c0]
cmp qword [0x1403361d8], 8
cmovae r9, qword [0x1403361c0]
mov rax, qword [0x1403361d0]
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [rbp - 0x21]
call fcn.14000b8a0
nop
test eax, eax
je 0x1401b9411
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x21]
call fcn.14000b190
add rsi, 2
add r15, 0x40
mov rax, qword [rbp - 0x39]
mov rcx, qword [rbp - 0x41]
sub rax, rcx
sar rax, 5
dec rax
cmp rsi, rax
jb 0x1401b933e
jmp 0x1401b9446
lea rdx, [rsi + 1]
shl rdx, 5
add rdx, qword [rbp - 0x41]
lea rax, [rbp - 1]
cmp rax, rdx
je 0x1401b9437
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp - 1]
call fcn.14000b5b8
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x21]
call fcn.14000b190
nop
lea rcx, [rbp - 0x41]
call fcn.14001ee4c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x1f]
call fcn.14000b190
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rcx, qword [rbp - 1]
mov r9d, 2
lea r8, [rbp - 0x49]
mov edx, 0x20000070
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov eax, dword [rbp - 0x49]
test eax, eax
je 0x1401b94a6
sub eax, 1
je 0x1401b94a3
sub eax, 1
je 0x1401b94a6
cmp eax, 1
je 0x1401b94a3
mov ecx, 0x3413a3
call fcn.140175954
jmp 0x1401b94a6
mov dil, 1
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 1]
call fcn.14000b190
mov al, dil
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140135130
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1401ba5b0
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x400
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov rbx, rcx
cmp qword [rcx + 0xe8], 0
je 0x1401ba745
mov ecx, 0x48
call fcn.14000e5ac
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1401ba611
xor r8d, r8d
mov dl, 1
mov rcx, rax
call fcn.14018d27c
nop
lea rdi, [rbx + 0x188]
mov dword [rsp + 0x58], 0x93
test rax, rax
je 0x1401ba629
lock inc dword [rax + 0x18]
mov rcx, qword [rdi]
mov qword [rsp + 0x40], rcx
mov qword [rdi], rax
mov qword [rsp + 0x50], rcx
test rcx, rcx
je 0x1401ba65f
add rcx, 0x10
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401ba65f
test rcx, rcx
je 0x1401ba65f
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x1401bb544]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x1401ba6b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r9, str.CreateThread_call_failed.
lea edx, [rsi + 0xf]
lea rcx, [rsp + 0x60]
call fcn.140189b10
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x60]
call fcn.1401377ec
int3
mov ecx, 0x20
call fcn.14000e5ac
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1401ba6f3
lea rcx, vtable.RefCounted.0
mov qword [rax], rcx
mov dword [rax + 8], 0
lea rcx, vtable.OHandle.0
mov qword [rax], rcx
mov qword [rax + 0x10], rsi
mov byte [rax + 0x18], 1
mov dword [rax + 0x1c], 0x55
test rax, rax
je 0x1401ba6fc
lock inc dword [rax + 8]
mov r8, qword [rbx + 0x118]
mov qword [rsp + 0x30], r8
mov qword [rbx + 0x118], rax
test r8, r8
je 0x1401ba732
or eax, 0xffffffff
lock xadd dword [r8 + 8], eax
cmp eax, 1
jne 0x1401ba732
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
mov rcx, rdi
call fcn.1401d47f4
or edx, 0xffffffff
mov rcx, rax
call fcn.14018f1cc
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.140135130
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1401bfb98
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x3d0
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov edx, 0x101
xor edi, edi
mov rbx, rcx
mov dword [rsp + 0x20], edx
cmp qword [rcx + 0x10], rdx
jb 0x1401bfbe7
mov qword [rcx + 0x10], rdx
cmp qword [rcx + 0x18], 8
jb 0x1401bfbdb
mov rax, qword [rcx]
jmp 0x1401bfbde
mov rax, rcx
mov word [rax + 0x202], di
jmp 0x1401bfbf3
sub rdx, qword [rcx + 0x10]
xor r8d, r8d
call fcn.14000b4a0
cmp qword [rbx + 0x18], 8
jb 0x1401bfbff
mov rcx, qword [rbx]
jmp 0x1401bfc02
mov rcx, rbx
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x1401bfc5f
mov edx, dword [rsp + 0x20]
cmp rdx, qword [rbx + 0x10]
ja 0x1401bfc2f
mov qword [rbx + 0x10], rdx
cmp qword [rbx + 0x18], 8
jb 0x1401bfc29
mov rbx, qword [rbx]
mov word [rbx + rdx*2], di
jmp 0x1401bfc3e
sub rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rbx
call fcn.14000b4a0
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.140135130
mov rbx, qword [rsp + 0x3e8]
add rsp, 0x3d0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Failed_to_get_current_computername.
mov edx, 0xf
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.1400e5310
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x30]
call fcn.1401377ec
int3

Function at 0x1401c0988
Capabilities:
Copy file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x3f0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdx
cmp qword [rdx + 0x18], 8
jb 0x1401c09c7
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x1401c09d1
mov rcx, qword [rcx]
xor esi, esi
test r8b, r8b
sete sil
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1401c0a76
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1401c0a3b
mov r8b, 1
lea edx, [rax + 0x7b]
mov rcx, rbx
call fcn.140178df0
cmp qword [rbx + 0x18], 8
jb 0x1401c0a10
mov rdx, qword [rbx]
jmp 0x1401c0a13
mov rdx, rbx
cmp qword [rdi + 0x18], 8
jb 0x1401c0a1f
mov rcx, qword [rdi]
jmp 0x1401c0a22
mov rcx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1401c0a76
jmp 0x1401c0a3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, str.Failed_to_copy_file_src:__s__dest:__s
mov edx, 0xf
lea rcx, [rsp + 0x50]
call fcn.1401c03c4
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x50]
call fcn.1401377ec
nop
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.140135130
add rsp, 0x3f0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401c0e5c
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x510]
sub rsp, 0x610
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rbp + 0x500], rax
mov r14, r9
mov al, r8b
mov rsi, rdx
mov rdi, rcx
cmp qword [rdx + 0x18], 8
jb 0x1401c0ea1
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x1401c0eab
mov rcx, qword [rcx]
xor ebx, ebx
mov r8d, ebx
test al, al
sete r8b
lea r9, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x1401c0f00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
lea r9, str.Cannot_get_temp_file_name_in_path__s_with_prefix__s
mov r8d, eax
lea edx, [rbx + 0xf]
lea rcx, [rsp + 0x60]
call fcn.1401c0480
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x60]
call fcn.1401377ec
int3
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
cmp word [rbp + 0x2f0], bx
je 0x1401c0f33
lea rcx, [rbp + 0x2f0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x1401c0f27
mov rbx, rax
mov r8, rbx
lea rdx, [rbp + 0x2f0]
lea rcx, [rsp + 0x38]
call fcn.14000b6f8
nop
lea rax, [rsp + 0x38]
cmp r14, rax
je 0x1401c0f6d
xor r8d, r8d
mov dl, 1
mov rcx, r14
call fcn.14000b190
lea rdx, [rsp + 0x38]
mov rcx, r14
call fcn.14000ae7c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x38]
call fcn.14000b190
mov rcx, qword [rbp + 0x500]
xor rcx, rsp
call fcn.140135130
add rsp, 0x610
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1401c1048
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
and dword [rsp + 0x40], 0
mov rsi, rdx
mov rbx, rcx
call fcn.140178794
test al, al
jne 0x1401c106f
xor al, al
jmp 0x1401c10c4
cmp qword [rbx + 0x18], 8
jb 0x1401c107b
mov rcx, qword [rbx]
jmp 0x1401c107e
mov rcx, rbx
lea rdx, [rsp + 0x40]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test eax, eax
je 0x1401c106b
mov edx, edi
mov rcx, rsi
call fcn.1400639c8
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
neg rax
sbb r9, r9
and r9, qword [rsi]
cmp qword [rbx + 0x18], 8
jb 0x1401c10b2
mov rbx, qword [rbx]
mov r8d, edi
xor edx, edx
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401c11b8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x328]
sub rsp, 0x410
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x38], esi
mov rcx, qword [rcx + 0x30]
cmp rcx, 0xffffffffffffffff
jne 0x1401c122b
lea r8, str.trying_to_read_from_a_file_thats_not_open
lea edx, [rsi + 0x15]
lea rcx, [rsp + 0x70]
call fcn.14000bee8
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x70]
call fcn.1401377ec
int3
mov r14d, 7
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
jmp 0x1401c1283
cmp dword [rsp + 0x34], 2
jne 0x1401c1325
movzx r8d, word [rsp + 0x30]
cmp r8w, 0xa
je 0x1401c1325
cmp r8w, 0xd
je 0x1401c12ab
mov eax, 0xfeff
cmp r8w, ax
je 0x1401c127f
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.14000b4a0
mov rcx, qword [rdi + 0x30]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x34], esi
lea r9, [rsp + 0x34]
mov r8d, 2
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401c1242
jmp 0x1401c1334
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x34]
mov r8d, 2
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401c130a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x1401c1325
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r9, str.read_from_file_failed
mov edx, 0xf
lea rcx, [rsp + 0x70]
call fcn.1401c0340
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x70]
call fcn.1401377ec
int3
cmp word [rsp + 0x30], 0xa
je 0x1401c1325
mov rdx, 0xfffffffffffffffe
lea r8d, [rdx + 3]
mov rcx, rdi
call fcn.140178e94
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 0x18], 8
jmp 0x1401c134b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x1401c137a
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x10], rsi
cmp r14, 8
jb 0x1401c1352
mov rax, qword [rbx]
jmp 0x1401c1355
mov rax, rbx
mov word [rax], si
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14000ae7c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.14000b190
mov rax, rbx
jmp 0x1401c13ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r9, str.read_from_file_failed
mov edx, 0xf
lea rcx, [rsp + 0x70]
call fcn.1401c0340
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x70]
call fcn.1401377ec
nop
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.140135130
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1401c13d4
Capabilities:
Move file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov rdi, rcx
mov eax, 7
mov qword [rbp - 0x30], rax
xor esi, esi
mov qword [rbp - 0x38], rsi
mov word [rbp - 0x48], si
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x18], rsi
mov word [rbp - 0x28], si
lea r8d, [rax - 4]
lea rdx, [0x140283450]
lea rcx, [rbp - 0x28]
call fcn.14000b6f8
nop
lea r9, [rbp - 0x48]
mov r8b, 1
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.1401c0e5c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x28]
call fcn.14000b190
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rdx, qword [rbp - 0x48]
cmp qword [rdi + 0x18], 8
jb 0x1401c1471
mov rcx, qword [rdi]
jmp 0x1401c1474
mov rcx, rdi
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
lea rcx, [rbp - 0x48]
jne 0x1401c148b
mov rcx, rdi
call fcn.1401c14c0
mov bl, al
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x48]
call fcn.14000b190
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140135130
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401c14c0
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x1401c14d2
mov rcx, qword [rcx]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1401c1509
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rsp + 0x30]
mov r8, rbx
lea rdx, str.Failed_to_schedule_delete_file__s.__Error_Code:_0x_x.
mov dword [rsp + 0x30], eax
mov ecx, 2
call fcn.1401c08e0
xor al, al
jmp 0x1401c150b
mov al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1401c1dd8
Capabilities:
Get disk size

Disassembly:
push rbx
sub rsp, 0x3e0
mov rax, qword [0x140334860]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
and dword [rsp + 0x30], 0
xor eax, eax
cmp qword [rcx + 0x18], 8
mov rbx, rcx
mov dword [rsp + 0x34], eax
jb 0x1401c1e0a
mov rcx, qword [rcx]
xor r9d, r9d
lea rdx, [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1401c1e3d
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.140135130
add rsp, 0x3e0
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Failed_to_check_free_space_in_drive___s_
mov qword [rsp + 0x20], rbx
mov r8d, eax
lea rcx, [rsp + 0x40]
mov edx, 0xf
call fcn.140175be0
lea rdx, [0x140294a58]
lea rcx, [rsp + 0x40]
call fcn.1401377ec
int3

Function at 0x1401c1e74
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x30]
call fcn.1401380c0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x20]
add rsp, 0x58
ret