joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023e60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x20], 0
mov rdi, r9
mov rbp, r8
mov rbx, rcx
je 0x140023f00
cmp rdx, 0xffffffffffffffff
je 0x140023ea0
mov rax, qword [rcx]
xor r8d, r8d
mov rax, qword [rax + 0x40]
call qword [case.0x140017e6f.8]
cmp rax, 0xffffffffffffffff
je 0x140023f00
mov ecx, dword [rbx + 0x30]
xor edx, edx
mov rax, rdi
div rcx
test rdx, rdx
jne 0x140023f00
mov rsi, qword [rbx + 0x20]
lea r9, [rsp + 0x40]
mov rax, rdi
mov qword [rsp + 0x20], 0
div rcx
mov rcx, qword [rsi]
mov rdx, rbp
mov r8, rax
mov eax, dword [rsi + 0x1c]
imul r8, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140023f00
mov ecx, dword [rsi + 0x1c]
xor edx, edx
mov eax, dword [rsp + 0x40]
div rcx
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x140023f00
mov eax, dword [rbx + 0x30]
imul rax, rcx
jmp 0x140023f07
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400249b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, r9
mov rbp, r8
mov rdi, rcx
cmp rdx, 0xffffffffffffffff
je 0x1400249f0
mov rax, qword [rcx]
xor r8d, r8d
mov rax, qword [rax + 0x40]
call qword [case.0x140017e6f.8]
cmp rax, 0xffffffffffffffff
jne 0x1400249f0
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov rcx, qword [rdi + 0x20]
lea r9, [rsp + 0x58]
mov r8d, r14d
mov qword [rsp + 0x50], rbx
mov rdx, rbp
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rsi, 0xffffffffffffffff
test eax, eax
jne 0x140024a48
mov rbx, rsi
call fcn.14003a300
cmp eax, 0x13
jne 0x140024a68
mov r9, qword [rdi + 0x38]
mov r8, r14
mov rcx, qword [rdi + 0x20]
mov rdx, rbp
call fcn.14003c8a0
mov rbx, rax
cmp rax, rsi
je 0x140024a68
jmp 0x140024a4c
mov ebx, dword [rsp + 0x58]
add qword [rdi + 0x38], rbx
cmp dword [rdi + 0x28], 0
je 0x140024a68
mov rdx, rbx
mov rcx, rbp
call fcn.1400383d0
cmp rbx, rax
cmovne rbx, rsi
mov rbp, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x140024a80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov r14, r8
mov rsi, rcx
cmp rdx, 0xffffffffffffffff
je 0x140024abf
mov rax, qword [rcx]
xor r8d, r8d
mov rax, qword [rax + 0x40]
call qword [case.0x140017e6f.8]
cmp rax, 0xffffffffffffffff
je 0x140024b6f
xor r15d, r15d
mov edi, r15d
test rbp, rbp
jne 0x140024ae5
mov rdx, qword [rsi + 0x38]
mov rcx, qword [rsi + 0x20]
call fcn.14003c1c0
sub r15d, eax
neg r15d
sbb rax, rax
jmp 0x140024bb0
cmp dword [rsi + 0x28], edi
je 0x140024b78
mov r12d, 0x10000
cmp qword [rsi + 0x50], rdi
jne 0x140024b10
mov ecx, r12d
call fcn.14004e0e4
mov qword [rsi + 0x50], rax
test rax, rax
je 0x140024b6f
nop dword [rax + rax]
mov rcx, qword [rsi + 0x50]
cmp rbp, r12
mov rbx, rbp
mov rdx, r14
cmovae rbx, r12
mov r8, rbx
call fcn.14004d720
mov rcx, qword [rsi + 0x50]
mov rdx, rbx
call fcn.1400386b0
cmp rbx, rax
jne 0x140024b6f
mov rdx, qword [rsi + 0x50]
lea r9, [rsp + 0x68]
mov rcx, qword [rsi + 0x20]
mov r8d, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140024b6f
mov eax, dword [rsp + 0x68]
add rdi, rax
cmp rax, rbx
jne 0x140024ba3
add r14, rbx
sub rbp, rbx
jne 0x140024b10
jmp 0x140024ba3
mov rax, 0xffffffffffffffff
jmp 0x140024bb0
mov rcx, qword [rsi + 0x20]
lea r9, [rsp + 0x68]
mov r8d, ebp
mov qword [rsp + 0x20], r15
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140024b9f
mov rdi, 0xffffffffffffffff
jmp 0x140024bad
mov edi, dword [rsp + 0x68]
cmp rdi, 0xffffffffffffffff
je 0x140024bad
add qword [rsi + 0x38], rdi
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140024c40
Capabilities:
Get file size

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx + 0x20]
xor edx, edx
mov qword [rsp + 0x30], rdx
test rax, rax
je 0x140024c73
lea rdx, [rsp + 0x34]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x140024c8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140024c8b
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140024c99
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
call fcn.14003c5f0
test eax, eax
jne 0x140024c99
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret
mov rax, 0xffffffffffffffff
add rsp, 0x48
ret

Function at 0x140025020
Capabilities:
Set file attributes

Disassembly:
mov r11, rsp
push rbx
push rdi
sub rsp, 0x58
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x1400250f6
mov ebx, 0xffffffff
test rdx, rdx
je 0x1400250ed
cmp r8, 0x20
jne 0x1400250ed
cmp dword [rdx], 0x4957494e
jne 0x1400250ed
mov rax, qword [rdx + 4]
lea r8d, [rbx + 4]
mov qword [r11 - 0x28], rax
xor r9d, r9d
mov rax, qword [rdx + 0xc]
mov rcx, rdi
mov qword [r11 + 0x10], rbp
mov ebp, dword [rdx + 0x1c]
mov qword [r11 - 0x38], 0
mov qword [r11 + 8], rax
mov rax, qword [rdx + 0x14]
mov edx, 0x100
mov dword [rsp + 0x28], 0x80
mov qword [r11 + 0x20], rax
mov qword [r11 - 0x18], rsi
mov dword [rsp + 0x20], 3
call qword [0x140096148]
mov rsi, rax
test rax, rax
je 0x1400250e3
lea r9, [rsp + 0x70]
mov rcx, rax
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rsi
call qword [0x140096008]
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ebx, ebx
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x78]
mov eax, ebx
add rsp, 0x58
pop rdi
pop rbx
ret
mov ecx, 0xb
call int.14003a5d0
mov eax, 0xffffffff
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x140025330
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x1400962f8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov ebx, r9d
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14002536c
mov eax, 0x1b62
jmp 0x140025461
cmp qword [rcx + 8], 0
jne 0x14002537d
mov eax, 0x232e
jmp 0x140025461
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140017e6f.8]
mov r9, qword [rsi + 8]
bt ebx, 9
jae 0x1400253f9
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x1400253e0
mov eax, dword [rcx]
test eax, eax
je 0x1400253e0
cmp eax, 1
je 0x1400253ba
mov eax, dword [rcx + 4]
add rcx, 8
add rcx, rax
mov eax, dword [rcx]
test eax, eax
jne 0x1400253a3
jmp 0x1400253e0
mov r8d, 0x122
lea rdx, [rsp + 0x30]
mov rcx, r9
call fcn.140042320
test al, al
jne 0x1400253db
mov eax, 0x1388
jmp 0x140025461
lea r9, [rsp + 0x30]
mov r8d, 4
mov rdx, rdi
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
jmp 0x14002540d
mov r8, rdi
mov dword [rsp + 0x20], ebx
mov rcx, r9
call fcn.14003c2e0
test eax, eax
sete al
test al, al
je 0x140025455
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140025420
mov rcx, qword [rsi + 8]
inc rbx
lea rdx, [rbx + rbx]
call fcn.14004e0ec
test rax, rax
je 0x140025451
mov r8, rdi
mov qword [rsi + 8], rax
mov rdx, rbx
mov rcx, rax
call fcn.140045c10
xor eax, eax
jmp 0x140025461
call fcn.14003a300
mov ecx, eax
call fcn.140045800
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140047b10
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140025490
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x1400254b1
mov ecx, 0xd
call int.14003a5d0
mov eax, 0xffffffff
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret
Function at 0x1400255c0
Capabilities:
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1400962f8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [rcx]
mov edi, edx
mov rbx, rcx
mov rax, qword [rax + 0x20]
call qword [case.0x140017e6f.8]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002560a
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0xb8]
call qword [case.0x140017e6f.8]
movzx esi, al
bt edi, 9
jae 0x1400256b4
mov rcx, qword [rbx + 0x10]
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x14002567a
mov edx, dword [rcx]
test edx, edx
je 0x14002567a
nop dword [rax]
cmp edx, 1
je 0x140025657
mov eax, dword [rcx + 4]
add rcx, 8
add rcx, rax
mov edx, dword [rcx]
test edx, edx
jne 0x140025640
jmp 0x14002567a
mov r8d, 0x122
lea rdx, [rsp + 0x20]
mov rcx, r9
call fcn.140042320
test al, al
jne 0x140025675
mov eax, 0x1388
jmp 0x14002568f
lea r9, [rsp + 0x20]
xor edx, edx
mov rcx, r9
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1400256cd
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140047b10
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [rbx]
mov edx, edi
mov rcx, rbx
mov rax, qword [rax + 0xa0]
call qword [case.0x140017e6f.8]
test eax, eax
je 0x14002568d
call fcn.14003a300
mov ecx, eax
call fcn.140045800
lea ecx, [rax - 0x2332]
cmp ecx, 1
jbe 0x14002568d
test sil, sil
mov ecx, 0x2337
cmovne eax, ecx
jmp 0x14002568f
Function at 0x140027730
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xd8], 0
mov edi, edx
mov rbx, rcx
je 0x140027758
mov eax, 0x232d
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rsi
xor esi, esi
mov dword [rcx + 0xc0], edi
mov qword [rcx + 0xc8], rsi
test dil, 0x20
je 0x140027839
mov qword [rcx + 0x148], 0xffffffffffffffff
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400277ec
mov r8d, dword [rcx]
test r8d, r8d
je 0x1400277ec
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rcx + 4]
lea rdx, [rcx + 8]
add rdx, rax
cmp r8d, 0xf
je 0x1400277bd
mov r8d, dword [rdx]
mov rcx, rdx
test r8d, r8d
jne 0x1400277a0
jmp 0x1400277ec
mov r8, rdx
test rdx, rdx
jne 0x1400277ca
mov r8, rsi
jmp 0x1400277e7
cmp dword [rdx], esi
je 0x1400277e0
nop
mov eax, dword [r8 + 4]
add r8, 8
add r8, rax
cmp dword [r8], esi
jne 0x1400277d0
sub r8, rdx
add r8, 8
call fcn.14004d720
bt edi, 0x12
jae 0x140027839
mov dword [rbx + 0xe0], 0x67452301
mov dword [rbx + 0xe4], 0xefcdab89
mov dword [rbx + 0xe8], 0x98badcfe
mov dword [rbx + 0xec], 0x10325476
mov dword [rbx + 0xf0], 0xc3d2e1f0
mov qword [rbx + 0xf8], rsi
mov qword [rbx + 0x100], rsi
mov qword [rbx + 0x148], rsi
mov rax, qword [rbx + 0x168]
mov dword [rbx + 0xd8], 1
cmp rax, 0xffffffffffffffff
je 0x140027872
mov qword [rbx + 0xd0], rax
cmp qword [rbx + 0x48], rsi
jne 0x140027867
cmp rax, qword [rbx + 0x40]
jge 0x140027867
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x168], 0xffffffffffffffff
test dil, dil
jns 0x1400278af
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x140017e6f.8]
test rax, rax
je 0x1400278af
mov dword [rbx + 0xd8], esi
mov eax, 0x232a
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14002a280
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
push r12
push r14
sub rsp, 0x460
mov rax, qword [0x1400962f8]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor r12b, r12b
mov rdi, rdx
cmp byte [0x140097198], r12b
mov r14, rcx
je 0x14002a351
movzx eax, word [rdx]
test ax, ax
je 0x14002a464
xor ebp, ebp
mov rbx, rdi
cmp ax, 0xa
je 0x14002a2e3
nop
test ax, ax
je 0x14002a2e3
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0xa
jne 0x14002a2d0
mov rax, rbx
mov qword [rsp + 0x20], rbp
sub rax, rdi
lea r9, [rsp + 0x40]
sar rax, 1
mov rdx, rdi
mov rcx, r14
lea r8d, [rax + rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
movzx eax, word [rbx]
cmp ax, 0xa
jne 0x14002a332
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov r8d, 4
lea rdx, [0x140087e54]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
movzx eax, word [rbx]
test ax, ax
je 0x14002a464
movzx eax, word [rbx + 2]
lea rdi, [rbx + 2]
test ax, ax
jne 0x14002a2c5
jmp 0x14002a464
mov qword [rsp + 0x4a0], rsi
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x4a8], r15
mov esi, 0x400
lea r15, [rsp + 0x50]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x14002a372
inc rbx
cmp rbx, rsi
jbe 0x14002a39d
lfence
mov rcx, rbx
call fcn.14004e0e4
test rax, rax
je 0x14002a39d
mov r15, rax
mov rsi, rbx
mov r12b, 1
xor ebp, ebp
mov r8, rdi
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x30], rbp
xor ecx, ecx
mov dword [rsp + 0x28], esi
lea r9d, [rbp - 1]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [rsi + r15 - 1], bpl
mov rcx, r15
mov rsi, qword [rsp + 0x4a0]
cmp byte [r15], bpl
je 0x14002a44f
nop dword [rax + rax]
movzx eax, byte [rcx]
mov rbx, rcx
cmp al, 0xa
je 0x14002a3ff
nop word [rax + rax]
test al, al
je 0x14002a3ff
movzx eax, byte [rbx + 1]
inc rbx
cmp al, 0xa
jne 0x14002a3f0
mov r8d, ebx
mov qword [rsp + 0x20], rbp
sub r8d, ecx
lea r9, [rsp + 0x40]
mov rdx, rcx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp byte [rbx], 0xa
jne 0x14002a440
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov r8d, 2
lea rdx, [0x140087e5c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp byte [rbx], bpl
je 0x14002a44f
cmp byte [rbx + 1], bpl
lea rcx, [rbx + 1]
jne 0x14002a3e0
test r12b, r12b
je 0x14002a45c
mov rcx, r15
call fcn.14004e0d0
mov r15, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140047b10
add rsp, 0x460
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x140038bb0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140038bce
call fcn.14003a300
mov ecx, eax
add rsp, 0x28
jmp 0x14003a240
xor eax, eax
add rsp, 0x28
ret

Function at 0x14003adb0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x1400962f8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, rcx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x104
xor ebx, ebx
mov qword [rsp + 0x40], rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14003af1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14003af1a
add eax, 0xfffffffe
cmp eax, 1
ja 0x14003af15
lea edx, [rbx + 0x5c]
mov rcx, rsi
call fcn.140049608
test rax, rax
je 0x14003af15
sub rax, rsi
sar rax, 1
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140039420
test al, al
je 0x14003af15
mov rdi, qword [rsp + 0x40]
lea r15, [rdi + 1]
cmp r15, qword [rsp + 0x38]
jbe 0x14003aedc
lfence
movabs rax, 0xfc0fc0fc0fc0fc1
mul r15
shr rdx, 4
inc rdx
imul rax, rdx, 0x104
cmp rax, r15
cmovae r15, rax
lea rdx, [r15 + r15]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
cmp rcx, rax
cmove rcx, rbx
call fcn.14004e0ec
mov r14, rax
test rax, rax
je 0x14003af15
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x14003aed0
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
cmp rdx, rax
jne 0x14003aed0
lea r8, [rdi + rdi]
mov rcx, r14
call fcn.14004d720
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
jmp 0x14003aee1
mov r14, qword [rsp + 0x30]
mov word [r14 + rdi*2], bx
inc qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call fcn.14003adb0
test eax, eax
jne 0x14003af15
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14003af1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14003af1a
mov ebx, 0xffffffff
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
je 0x14003af33
test rcx, rcx
je 0x14003af33
call fcn.14004e0d0
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140047b10
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x14003c2e0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdx, r8
mov rdi, r8
mov rsi, rcx
mov ebx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14003c31b
xor ecx, ecx
mov eax, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14003c34b
test byte [rsp + 0x50], 1
je 0x14003c34b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor ecx, ecx
test eax, eax
cmovne ebx, ecx
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003c360
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1400962f8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test r9, r9
je 0x14003c39b
mov r8, r9
mov rdx, rbx
mov rcx, rdi
call fcn.140045c10
jmp 0x14003c3ae
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14003c417
mov eax, eax
cmp rax, rbx
ja 0x14003c417
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x14003c417
test rbx, rbx
je 0x14003c413
lea rcx, [rsp + 0x20]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003c3e0
lea r8, [rsp + 0x20]
mov rdx, rbx
mov rcx, rdi
cmp rax, rbx
jae 0x14003c403
call fcn.140055a48
xor eax, eax
jmp 0x14003c41e
lea r9, [rbx - 1]
call fcn.1400580e8
xor eax, eax
mov word [rdi + rbx*2 - 2], ax
xor eax, eax
jmp 0x14003c41e
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140047b10
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret

Function at 0x14003c480
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x28
mov r11, rcx
mov eax, r8d
mov edx, r8d
mov r10d, r8d
and edx, 1
mov r9d, edx
or r9d, 2
and al, 2
mov eax, r8d
cmove r9d, edx
mov ecx, r9d
or ecx, 4
and al, 4
mov eax, r8d
cmove ecx, r9d
mov edx, ecx
or edx, 0x10
and al, 8
mov eax, r8d
cmove edx, ecx
mov ecx, edx
bts ecx, 0xa
and al, 0x10
mov eax, r8d
cmove ecx, edx
mov edx, ecx
bts edx, 7
and al, 0x20
mov eax, r8d
cmove edx, ecx
mov r8d, edx
bts r8d, 9
and al, 0x80
mov eax, r10d
cmove r8d, edx
mov ecx, r8d
bts ecx, 0x12
and eax, 0x100
cmove ecx, r8d
mov edx, ecx
bts edx, 0x16
and r10d, 0x200
cmove edx, ecx
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret

Function at 0x14003c530
Capabilities:
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x1400962f8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, r9
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x14003c55e
test rbx, rbx
je 0x14003c59a
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x14003c5cc
test rdi, rdi
je 0x14003c58a
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x20]
mov qword [rdi], rax
test rbx, rbx
je 0x14003c59a
mov ecx, dword [rsp + 0x28]
call fcn.14003a880
mov dword [rbx], eax
test rsi, rsi
je 0x14003c5c8
lea rdx, [rsp + 0x24]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x20], eax
cmp eax, 0xffffffff
jne 0x14003c5c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14003c5cc
mov rax, qword [rsp + 0x20]
mov qword [rsi], rax
xor eax, eax
jmp 0x14003c5d1
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140047b10
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14003c8a0
Capabilities:
Get file size
Get system information on windows
Read file via mapping

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rsi, r9
mov rbx, r8
mov r15, rdx
mov r14, rcx
xor edi, edi
lea rdx, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x38], eax
cmp eax, 0xffffffff
jne 0x14003c8e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14003c8e0
lea eax, [rdi - 1]
jmp 0x14003c8e7
mov rdi, qword [rsp + 0x38]
xor eax, eax
test eax, eax
je 0x14003c901
mov rax, 0xffffffffffffffff
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
cmp rsi, rdi
jb 0x14003c917
xor eax, eax
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
lea rax, [rsi + rbx]
cmp rax, rdi
jbe 0x14003c926
mov rbx, rdi
sub rbx, rsi
mov eax, dword [0x140099684]
test eax, eax
jne 0x14003c945
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x78]
mov dword [0x140099684], eax
mov edi, eax
dec rdi
not rdi
and rdi, rsi
sub rsi, rdi
mov qword [rsp + 0x30], 0xffffffffffffffff
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, r14
call qword [0x140096170]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14003c9fe
lfence
lea rcx, [rsi + rbx]
mov r8, rdi
shr r8, 0x20
mov qword [rsp + 0x20], rcx
mov r9d, edi
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14003c9f5
lfence
lea rdx, [rax + rsi]
mov r8, rbx
mov rcx, r15
call fcn.14004d720
mov qword [rsp + 0x30], rbx
jmp 0x14003c9e9
lfence
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [0x140096008]
lfence
mov rax, qword [rsp + 0x30]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x14003ca20
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x50
mov eax, dword [0x140099688]
mov rdi, r8
mov rsi, rdx
mov r14, rcx
test eax, eax
jne 0x14003ca73
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov dword [0x140099688], eax
test eax, eax
je 0x14003cadd
mov ecx, eax
xor edx, edx
mov rax, r14
div rcx
test rdx, rdx
jne 0x14003cadd
mov rax, rsi
div rcx
test rdx, rdx
jne 0x14003cadd
mov rax, rdi
div rcx
test rdx, rdx
jne 0x14003cadd
lea ecx, [rdx + 0x20]
call fcn.14004e0e4
mov rbx, rax
test rax, rax
je 0x14003cadd
xor ecx, ecx
mov qword [rax], r14
lea rdx, [r14 + rsi]
mov qword [rax + 8], rsi
add rdx, rdi
mov qword [rax + 0x10], rdi
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x14003caf5
mov rcx, rbx
call fcn.14004e0d0
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
mov rax, rbx
jmp 0x14003cadf
Function at 0x14003f5b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
xor r15d, r15d
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rcx + rbx*2], r15w
jne 0x14003f5e0
inc rbx
mov r8b, 1
mov rdx, rbx
call fcn.14003d810
mov r14, rax
cmp rax, rbx
cmovb r14, rbx
lea rcx, [r14 + r14]
call fcn.14004e0e4
mov rbx, rax
mov r8, rdi
test rax, rax
jne 0x14003f631
mov rdx, rsi
mov rcx, rbp
call fcn.140045c10
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
call fcn.14003d810
jmp 0x14003f676
mov rdx, r14
mov rcx, rbx
call fcn.140045c10
xor r8d, r8d
mov rdx, r14
mov rcx, rbx
call fcn.14003d810
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
cmp rdi, rsi
jb 0x14003f66b
test rsi, rsi
je 0x14003f66b
mov word [rbp + rsi*2 - 2], r15w
mov rcx, rbx
call fcn.14004e0d0
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret