joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004bb90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x14004bba5
mov r8d, r8d
add rsp, 0x28
jmp fcn.14004b290
test r8d, r8d
jne 0x14004bbaf
call fcn.140053180
xor eax, eax
add rsp, 0x28
ret

Function at 0x14004ecc0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14004ece9
xor eax, eax
xor r9d, r9d
nop word [rax + rax]
movzx r10d, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x14004ecd0
movzx eax, r9b
ret
xor eax, eax
ret

Function at 0x1400540c0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov esi, ecx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x14007de40]
lea r8, [rsp + 0x20]
mov qword [r8], rax
lea rcx, [0x140197320]
lea rdx, [0x14007ddd0]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140054152
cmp dword [0x140197328], 0
jne 0x14005414e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x14019732c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x14005414e
movsxd rax, esi
mov rsi, qword [rdi + rax*8]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140092da0
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x140054136
call fcn.1400a7010
int3
Function at 0x140060eb0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1038
call fcn.140092d40
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x1030], rax
lea r14, [rsp + 0x830]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1400c5230
lea rax, [rsp + 0x2c]
mov dword [rax], 1
lea r9, [rsp + 0x28]
mov dword [r9], 0x800
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, rdi
mov r8, r14
call fcn.140060df0
test eax, eax
jne 0x140060f5d
mov eax, dword [rsp + 0x2c]
cmp eax, 1
jne 0x140060f61
lea rdx, [rsp + 0x830]
mov rcx, rsi
call fcn.14005f174
xor edi, edi
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140092da0
mov eax, edi
add rsp, 0x1038
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x140060f3e
mov edi, 0x3f4
cmp eax, 2
jne 0x140060f3e
lea rdi, [rsp + 0x30]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1400c5230
lea rcx, [rsp + 0x830]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x28], eax
add eax, 0xfffffbff
mov edi, 0xea
cmp eax, 0xfffffc00
jb 0x140060f3e
lea rdx, [rsp + 0x30]
jmp 0x140060f34

Function at 0x140060fc0
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebp, r9d
mov r14, r8
mov rsi, rdx
mov r15, rcx
mov edi, dword [rsp + 0xd0]
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x5f]
mov byte [rbx], 0xaa
mov r12, qword [rcx]
lea rdx, str.WriteValue
lea r8, str....._basewin_registry.cc
lea r13, [rsp + 0x38]
mov rcx, r13
mov r9d, 0x1e3
call fcn.140048970
mov rcx, rbx
mov rdx, r13
mov r8, r12
mov r9d, 0x20006
call fcn.14005a300
mov rcx, qword [r15]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r14
mov rdx, rsi
xor r8d, r8d
mov r9d, edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, rbx
call fcn.14005a7f0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140092da0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140061e40
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x90], rax
movaps xmm0, xmmword [0x140152e90]
lea rbx, [rsp + 0x50]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.MapImageToMemory
lea r8, str....._base_filesmemory_mapped_file_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x1c
call fcn.140048970
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.14004c0e0
mov rcx, rsi
call fcn.1400406b0
test al, al
je 0x140061f59
lea rbx, [rsi + 0x40]
mov rcx, rsi
call fcn.140060660
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor edi, edi
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rbx
mov rdx, rax
call fcn.14002f1c8
mov rcx, qword [rsi + 0x40]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140061f59
mov qword [rsp + 0x20], 0
xor edi, edi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x140061f59
mov rbx, rax
lea rax, [0x140154f08]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], rbx
call fcn.14006a22c
mov eax, dword [rax + 0x50]
test rax, rax
setne dil
je 0x140061f59
mov qword [rsi + 0x30], rbx
mov qword [rsi + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.14004c160
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140092da0
mov eax, edi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140062270
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x140152e90]
lea r14, [rsp + 0x50]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.ReadAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x64
call fcn.140048970
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14004c0e0
test esi, esi
js 0x140062375
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.14004eae0
test al, al
jne 0x140062381
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14006239d
mov esi, dword [rsp + 0x2c]
test esi, esi
js 0x14006237c
lea rcx, [rsp + 0x30]
call fcn.14004eb60
lea rcx, [rsp + 0x50]
call fcn.14004c160
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140092da0
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14006234a
int3
mov r9d, esi
lea rdx, str.File::ReadAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.140122e40
jmp 0x140062310
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x140062340
Function at 0x1400623b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x140152e90]
lea r14, [rsp + 0x50]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x9c
call fcn.140048970
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14004c0e0
test esi, esi
js 0x1400624b6
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.14004eae0
test al, al
jne 0x1400624bd
lea r14, [rsp + 0x2c]
mov dword [r14], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [r14]
lea rcx, [rsp + 0x30]
call fcn.14004eb60
lea rcx, [rsp + 0x50]
call fcn.14004c160
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140092da0
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14006248b
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.140122e40
jmp 0x140062450

Function at 0x1400624e0
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x90], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
movaps xmm0, xmmword [0x140152e90]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0xb1
call fcn.140048970
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14004c0e0
mov qword [rbx + 8], r14
mov qword [rbx], 0
call fcn.14004eae0
test al, al
jne 0x1400625bc
lea rdi, [rsp + 0x28]
mov qword [rdi], r14
mov rcx, qword [rsi]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rdi]
lea rcx, [rsp + 0x30]
call fcn.14004eb60
lea rcx, [rsp + 0x50]
call fcn.14004c160
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140092da0
mov rax, rsi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x30]
mov r8, rsi
xor r9d, r9d
call fcn.140122e40
jmp 0x140062569
Function at 0x1400629e0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov edx, 1
jmp fcn.1400626f0

Function at 0x1400629f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm6
mov rsi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm6, xmmword [0x140152e90]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x2da
call fcn.140048970
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14004c0e0
call fcn.140078770
test al, al
jne 0x140062ab1
cmp byte [rsi + 0x17], 0
jns 0x140062a73
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
lea rcx, [rsp + 0x50]
call fcn.14004c160
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140092da0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov dword [rsp + 0x40], 0xaaaaaaaa
cmp byte [rsi + 0x17], 0
jns 0x140062acc
mov rsi, qword [rsi]
lea r8, [rsp + 0x20]
mov rcx, rsi
xor edx, edx
call fcn.140123090
test eax, eax
jmp 0x140062a7f

Function at 0x140062ae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [0x140152e90]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.DirectoryExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x309
call fcn.140048970
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14004c0e0
cmp byte [rdi + 0x17], 0
jns 0x140062b52
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.14004c160
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140092da0
mov eax, edi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x140062ba0
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1400c5230
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x140062c3f
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.1400aef34
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
call fcn.140048ac0
lea r14, [rsp + 0x48]
mov rcx, rbx
mov rdx, r14
call fcn.1400676c0
mov rcx, rsi
mov rdx, r14
call fcn.140048c70
mov rcx, r14
call fcn.140048c00
mov rcx, rbx
call fcn.140048c00
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140092da0
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140062c70
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm6, xmmword [0x140152e90]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
lea rdx, str.CreateDirectoryAndGetError
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x3ca
call fcn.140048970
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.14004c0e0
cmp byte [rdi + 0x17], 0
mov rbx, rdi
jns 0x140062cf3
mov rbx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140062d3d
mov bl, 1
test al, 0x10
je 0x140062ded
lea rcx, [rsp + 0x40]
call fcn.14004c160
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140092da0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x20]
mov qword [r14 + 0x10], rax
movaps xmmword [r14], xmm6
mov rcx, rdi
mov rdx, r14
call fcn.14008dc30
movsx rax, byte [rdi + 0x17]
mov rcx, rdi
test rax, rax
jns 0x140062d73
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
test rax, rax
js 0x140062deb
sete dl
test rcx, rcx
setne r8b
or r8b, dl
je 0x140062deb
movsx rdx, byte [rsp + 0x37]
test rdx, rdx
cmovs rdx, qword [rsp + 0x28]
cmovs r14, qword [rsp + 0x20]
test rdx, rdx
js 0x140062deb
sete r8b
test r14, r14
setne r9b
or r9b, r8b
je 0x140062deb
cmp rdx, rax
je 0x140062e0a
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.140062c70
test al, al
je 0x140062e5b
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
je 0x140062e36
lea rcx, [rsp + 0x20]
call fcn.140048c00
jmp 0x140062d0b
ud2
test rsi, rsi
je 0x140062df8
mov dword [rsi], 0xfffffff7
mov ecx, 0x50
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x140062d0b
test rax, rax
je 0x140062e25
xor edx, edx
movzx r8d, word [r14 + rdx*2]
cmp r8w, word [rcx + rdx*2]
jne 0x140062db6
inc rdx
cmp rax, rdx
jne 0x140062e11
mov eax, 0xfffffffc
mov ebp, 2
test rsi, rsi
jne 0x140062e51
jmp 0x140062e53
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0xb7
je 0x140062e62
test rsi, rsi
je 0x140062e53
mov ecx, ebp
call fcn.1400625e0
mov dword [rsi], eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x140062ddc
mov rcx, rdi
call fcn.140062ae0
test al, al
jne 0x140062ddc
jmp 0x140062e45
Function at 0x140063010
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [0x140152e90]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, [0x140163c67]
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x539
call fcn.140048970
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14004c0e0
cmp byte [rdi + 0x17], 0
jns 0x140063082
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov rcx, rsi
call fcn.14004c160
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140092da0
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400630c0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x568
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x560], rax
lea r14, [rsp + 0x298]
mov r8d, 0x2c8
mov rcx, r14
mov dl, 0xaa
call fcn.1400c5230
mov qword [rsp + 0x20], rdi
xor ebp, ebp
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
mov r9d, 3
call fcn.140063380
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x30]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x140152e90]
movaps xmmword [rbx], xmm0
mov rcx, r14
mov rdx, rbx
call fcn.140063590
movsx rax, byte [rbx + 0x17]
test rax, rax
jns 0x140063158
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x14006319a
lea rcx, [rsp + 0x30]
call fcn.140048c00
lea rcx, [rsp + 0x298]
call fcn.1400634d0
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.140092da0
mov eax, ebp
add rsp, 0x568
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r14, [rsp + 0x48]
lea r15, [rsp + 0x298]
mov r13, qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r12d, r12d
mov r8d, 0x250
mov rcx, r14
mov dl, 0xaa
call fcn.1400c5230
mov rcx, r15
mov rdx, r14
call fcn.140063540
mov edx, dword [rsp + 0x48]
test dl, 1
je 0x140063213
test sil, 1
jne 0x1400631fb
mov rcx, r14
call fcn.140091470
test al, al
je 0x1400631f7
mov rcx, r14
call fcn.140091470
xor ebp, ebp
test al, al
je 0x14006321f
jmp 0x140063261
mov edx, dword [rsp + 0x48]
cmp byte [rsp + 0x47], 0
mov rcx, rbx
jns 0x14006320a
mov rcx, qword [rsp + 0x30]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, r14
call fcn.140091470
test al, al
jne 0x140063259
test sil, 2
jne 0x1400632af
cmp byte [rsp + 0x47], 0
mov rcx, rbx
jns 0x140063238
mov rcx, qword [rsp + 0x30]
call r13
xor ebp, ebp
test eax, eax
jne 0x140063261
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
jmp 0x140063261
xor ebp, ebp
test sil, 1
jne 0x1400632bf
test r12d, r12d
cmovne ebp, r12d
mov rcx, r14
call fcn.14005a7f0
mov rcx, r15
mov rdx, r14
call fcn.140063590
mov rcx, rbx
mov rdx, r14
call fcn.140048c70
mov rcx, r14
call fcn.140048c00
movsx rax, byte [rsp + 0x47]
test rax, rax
jns 0x14006329e
mov rax, qword [rsp + 0x38]
mov r12d, ebp
test rax, rax
je 0x14006315d
jmp 0x1400631b1
mov rcx, rbx
call fcn.140106290
xor ebp, ebp
test al, al
je 0x140063241
jmp 0x140063261
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
call fcn.1400630c0
mov ebp, eax
test eax, eax
jne 0x140063261
cmp byte [rsp + 0x47], 0
js 0x1400632e1
lea rcx, [rsp + 0x30]
jmp 0x1400632e6
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x140063261
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
cmp ecx, 2
cmovne ebp, eax
jmp 0x140063261
Function at 0x140066150
Capabilities:
Delete file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.140066310
mov eax, dword [rsi]
mov dword [0x1401834bc], eax
mov bl, 1
test al, 1
jne 0x140066197
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140092da0
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [0x140192f20]
test rcx, rcx
je 0x1400661c5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140192f20], 0
cmp qword [0x140192f28], 0
jne 0x1400661c5
and byte [0x1401834bc], 0xfe
mov rax, qword [rsi + 0x28]
test rax, rax
je 0x1400661ee
movsx rcx, byte [rsi + 0x1f]
test rcx, rcx
jns 0x1400661dc
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jne 0x140066267
mov qword [0x140192f20], rax
jmp 0x14006617e
movsx rax, byte [rsi + 0x1f]
test rax, rax
jns 0x1400661fc
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1400662b6
lea rdi, [rsi + 8]
mov rcx, qword [0x140192f28]
test rcx, rcx
jne 0x140066237
mov ecx, 0x18
call fcn.140091880
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x140192f28], rax
mov rdx, rdi
call fcn.140039ea6
cmp dword [rsi + 0x24], 0
jne 0x14006625b
mov rcx, qword [0x140192f28]
cmp byte [rcx + 0x17], 0
jns 0x140066255
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.1400d18e0
mov ebx, eax
jmp 0x14006617e
lea rdx, str.BaseInitLoggingImpl_built_with_NDEBUG
lea r8, str....._baselogging.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x23f
call fcn.140048970
lea rdx, str.settings.log_file_path.empty__
lea r14, [rsp + 0x48]
mov rcx, r14
mov r8d, 0x7f
mov r9, rdi
call fcn.140109840
mov rcx, r14
call fcn.140109a50
mov rax, qword [rsi + 0x28]
jmp 0x1400661e5
lea rdx, str.BaseInitLoggingImpl_built_with_NDEBUG
lea r8, str....._baselogging.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r9d, 0x245
call fcn.140048970
lea rdx, str._settings.log_file_path.empty__
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r8d, 0x7f
mov r9, rdi
call fcn.140109840
lea rdx, str.LOG_TO_FILE_set_but_no_log_file_path_
mov rcx, rbx
call fcn.1401084b0
mov rcx, rbx
call fcn.140109a50
jmp 0x140066205

Function at 0x140069ba9
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rsi, rcx
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400c5230
xor ebx, ebx
lea r14, str.PROGRAMFILES
mov r15, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r14]
mov word [rsp + 0x20], 0
mov rdx, rdi
mov r8d, 0x104
call r15
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140069c24
mov edx, eax
mov rcx, rdi
mov r8, rsi
call fcn.140069b38
test al, al
jne 0x140069c51
add rbx, 8
cmp rbx, 0x18
jne 0x140069bf1
xor esi, esi
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.140092da0
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov sil, 1
jmp 0x140069c30
Function at 0x140069f40
Capabilities:
Get common file path
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140181040]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rsi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.1400c5230
mov word [rsi], 0
mov rcx, rsi
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x20]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x140152e90]
movaps xmmword [rdi], xmm0
mov rcx, rsi
call fcn.1400aef34
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.140103ad6
lea rdx, str.usp10.dll
mov r8d, 0xa
mov rcx, rdi
call fcn.140103b92
cmp byte [rax + 0x17], 0
jns 0x140069fd5
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp byte [rsp + 0x37], 0
jns 0x140069ff1
mov rcx, qword [rsp + 0x20]
call fcn.1400918bc
cmp esi, 0xffffffff
setne bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140092da0
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
Function at 0x14006de50
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x14006deaf
xor r11d, r11d
mov rsi, qword [r8 + r11*8]
mov rdi, qword [rcx + r11*8]
mov rbx, rdi
xor rbx, rsi
lea r14, [rbx - 1]
mov r15, rdi
sub r15, rsi
xor r15, rdi
or r15, rbx
not rbx
and r14, rbx
sar r14, 0x3f
xor r15, rdi
sar r15, 0x3f
or r15, 1
xor rax, r15
and rax, r14
xor rax, r15
inc r11
cmp r10, r11
jne 0x14006de6b
cmp rdx, r9
jb 0x14006debe
ja 0x14006dee2
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x14006dec0
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
not ecx
or eax, ecx
jmp 0x14006deb6
xor r8d, r8d
or r8, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x14006dee5
mov rcx, r8
not rcx
dec r8
and r8, rcx
sar r8, 0x3f
xor eax, 1
and eax, r8d
xor eax, 1
jmp 0x14006deb6